The Cyberlaw Podcast

The Biden administration is pissing away one of the United States’ most important counterterrorism intelligence programs. At least that’s my conclusion from this episode’s depressing review of the administrations halting and delusion-filled approach to the transatlantic data crisis. The EU thinks time is on its side, and it’s ignoring Jamil Jaffer’s heartfelt plea to be a better ally in the face of Russian and Chinese pressure. Every day, Silicon Valley companies whose data stores in the U.S. have been a goldmine for counterterrorism are feeling legal pressure to move that data to Europe. Those companies care little whether the U.S. gets good intelligence from its section 702 requests, at least compared to the prospects of massive fines and liability in Europe. So, unless the administration creates a countervailing incentive, the other actors will simply present Washington with a fait accompli. The Biden administration, like the Trump administration before it, seems unable to grasp the need for action. When Trump was in charge, we could call him incompetent. When we wake up to what we’ve lost under Biden, that’s what we’ll call him, too.

For companies struggling with their role in this global drama, Charles Helleputte has moderately good news. The European Commission, contrary to the dogmatic approach of the data protection agencies, has opened a door for transfers using the new standard contractual clauses. If your data has not been requested by the U.S. under section 702 or similar intelligence programs and you can offer good reason to think they won’t be requested in the future, you could avoid the hammer of a data export ban while using the standard corporate clauses if they have never received a 702 or similar request and can offer good reason to think they won’t in future.

In other news, Jamil and I cross swords on whether the Colonial pipeline hack should have ended TSA’s light-touch oversight of pipeline cybersecurity.

And Nate Jones and I dig deep into the state trend toward regulating police access to DNA ancestry databases. After some fireworks, we come close to agreement that some state law provision on database access is inevitable and workable, but that the Maryland law is so hostile to solving brutal crimes with DNA searches that it is hard to distinguish from a ban.

Jamil explains the Biden administration’s decision to provide a new foundation for the Trump ban on investment in Chinese military companies. Treasury will take the program away from the Department of Defense, which had handled its responsibilities with the delicacy of Edward Scissorhands.

Nate limbers up the DeHype Machine to put in perspective the Department of Justice's claim to be giving ransomware hacks the same priority as terrorism. Jamil takes on autonomous drones and pours cold water on the notion that the Pentagon will be procuring some of its drones from China.

In a moment of weakness I fail to attack or even mock the UN GGE’s latest report on norms for cyberconflict.

And in a series of quick hits: 

• Jamil reviews Facebook’s latest antitrust problems in the EU and UK.
• I bring back the Congresswoman whose failed lawsuit over a newspaper’s publication of her nude photos is now set to cost her over $100,000.
• In case you haven’t heard, Facebook might let Trump come back in January 2023, and his blog page has shut down for good.
• The European Commission has proposed a trusted and secure Digital Identity for all Europeans but Charles thinks there’s less there than meets the eye.
• And Nigeria has suspended Twitter after the platform shut down the President’s account for obliquely threatening military action against secessionists.

And more!

Download the 365th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

We don’t get far into my interview with the authors of a widely publicized Ransomware Task Force report, before I object that most of its recommendations are “boring” procedural steps that don’t directly address the ransomware scourge. That prompts a vigorous dialogue with Philip Reiner, the Executive Director of the Institute for Security and Technology (IST), the report’s sponsoring organization, from Megan Stifel, of the Global Cyber Alliance, and Chris Painter, of The Global Forum on Cyber Expertise Foundation. And we, in fact, find several new and not at all boring recommendations among the nearly 50 put forward in the report.

In the news roundup, Dmitri Alperovitch has an answer to my question, “Is Putin getting a handle on U.S. social media?” Not just Putin, but every other large authoritarian government is finding ways to bring Google, Twitter and Facebook to heel. In Russia’s case, the method is first a token fine, then a gradual throttling of service delivery that makes domestic competitors look better in comparison to the Silicon Valley brand.

Mark MacCarthy handicaps the Epic v. Apple lawsuit. The judge is clearly determined to give both sides reason to fear that the case won’t go well. And our best guess is that Epic might get some form of relief but not the kind of outcome they hoped for.

Dmitri and I marvel at the speed and consensus around regulatory approaches to the Colonial Pipeline ransomware event. It’s highly likely that the attack will spur legislation mandating reports of cyber incidents (and without any liability protection) as well as aggressive security regulation from the agency with jurisdiction—TSA.  I offer a cynical Washington perspective on why TSA has acted so decisively. 

Mark and I dig into the signing and immediate court filing against Florida’s social media regulation attacking common content moderation issues. Florida will face an uphill fight, but neither of us is persuaded by the tech press’s claim that the law will be “laughed out of court.”  There is a serious case to be made for almost everything in the law, with the exception of the preposterous (and probably severable) exemption for owners of Florida theme parks.

Dmitri revs up the DeHyping Machine for reports that the Russians responded to Biden administration sanctions by delivering another cyberpunch in the form of hijacked USAID emails. It turns out that the attack was garden variety cyberespionage, that the compromise didn’t involve access to USAID networks, that it was launched before sanctions, and that it didn’t get very far. 

Jordan Schneider explains the impact of U.S. government policy on the cellular-equipment industry, and the appeal of Open RAN as a way of end-running the current incumbents. U.S. industrial policy could be transformed by the shape-shifting Endless Frontier Act. 

Jordan and Dmitri explain how. I ask whether we’re seeing a deep convergence on industrial policy on both sides of the Pacific, now that President Xi has given a speech on tech policy that could have been delivered by half a dozen Republican or Democratic senators. 

Finally, Dmitri reviews the bidding in cryptocurrency regulation both at the White House White House and in London. 

In short hits, we cover:

The European Court of Human Rights decision squeezing but not quite killing GCHQ’s mass data interception programs and cooperation with the U.S. I offer a possible explanation for the court’s caution.

A court filing strongly suggesting that the Biden administration will not be abandoning a controversial Trump administration rule that requires visa applicants to register their social media handles with the U.S. government.  I speculate on why.

A WhatsApp decision not to threaten its users to get them to accept the company’s new privacy terms. Instead, I suspect, WhatsApp will annoy them into submission.

And, finally, a festival of EU competition law Brussels attacks on Silicon Valley, from Germany and France. 

And More!

Paul Rosenzweig kicks off the news roundup by laying out the New York Times’s brutal overview of the many compromises Tim Cook’s Apple has made with an increasingly oppressive Chinese government. There is no way to square Apple’s aggressive opposition to U.S. national security measures with its quiet surrender to much more demanding Chinese measures. I suggest that the disparity could not be greater if Tim Cook were Dorian Gray and storing his portrait behind the Great Firewall. Paul, Jamil Jaffer and I note the tension between Apple’s past claim that it could not legally share data with the Chinese government and its new claim that it solved the problem by turning its data over to a Chinese government-owned corporation.

Ransomware hasn’t stopped making news, Paul tells us, Irish hospitals with the latest to go down. Nate Jones assesses the likelihood (low) that governments will effectively ban the payment of ransomware demands. And Paul points out that, while cryptocurrency may be facilitating crime, at least it’s also warming the planet, as an entire American power plant is taken out of mothballs to power cryptocurrency mining operations.

Governments are increasingly cracking down on cryptocurrency, and Paul gives us one week of news in new regulation: China has reiterated its opposition to unregulated access to crypto.

The IRS is threatening action against unreported transactions in cryptocurrency.

And Hong Kong plans to restrict crypto exchanges to professional investors.

Another 60+ pages from the FISA court approving the executive branch’s section 702 procedures.

With Nate on the job, you don’t need to read it all, or rely on the ideologically motivated criticism of privacy groups. Nate tells us that in approving the 702 procedures the FISA court has much less leeway than a court usually does in reviewing federal agency action (with a hat tip to a good analysis by NSA alum George Croner).   

Jamil bemoans the enthusiasm sweeping Europe for sticking it to US (but not Chinese) tech companies under a variety of competition law theories.

Google has been fined just over €100 million by Italy’s antitrust watchdog for abuse of a dominant market position in Android auto apps.

Germany is readying big guns for an attack on Amazon’s market.

I point out that American policyholders seem to share this enthusiasm, at least judging from the questions the presiding judge in Epic v. Apple posed this week to Tim Cook.

Nate and I explore Apple’s apparent decision to let Parler back into the app store. (And, given the enthusiasm for regulating such dual-facing markets on antitrust grounds, that decision would be wise.) But Apple is still demanding that Parler block speech that Parler doesn’t think it should be blocking.

We wrap up with a few quick hits:

Looking for a cheap way to defeat ransomware?  Brian Krebs has a “might not work but what do you have to lose?” Idea: install a Russian keyboard layout on your computer (although with my luck, the ransomware will translate all my files into Russian). 

Andy Greenberg has a good retrospective on the seeds. OG supply chain hack: the Chinese theft of RSA’s core security.

Dangling the other shoe: The UK’s head of MI5 isn’t mincing words. Ken McCallum is accusing Facebook of giving a ‘free pass’ to terrorists by preparing to introduce end-to-end crypto on its messaging app. Sooner or later, this is going to end in tears.

And we all agree that the Biden administration was lucky to persuade Matt Olsen to leave Uber to become head of the Department of Justice’s National Security Division.

And more!

Our interview is with Brandon Wales, acting head of the Department of Homeland Security’s (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and Jen Daskal, deputy general counsel for Cyber and Technology Law at DHS. We dig deep into the latest Executive Order on cybersecurity. There’s a lot to say. The EO is focused largely on how the federal civilian government protects its networks, and it is just short of revolutionary in overriding long standing turf fights, almost all of which are resolved in favor of CISA—to the point where it seems clear that CISA is on its way to being the civilian agencies’ CISO, or Chief Information Security Office. This is clearly CISA’s moment. It is getting new authorities from the president and new money from Congress. Whether it can meet all the expectations that these things bring is the question.

We also touch on parts of the EO that will touch the private sector, from the determined push for breach and other incident reporting in federal contracts to the formation of a Cyber Safety Review Board to investigate private sector incidents. I predict that the board will need and will get subpoena power soon. Neither Brandon nor Jen takes the other side of that bet.

In the news, we get an update on the Colonial Pipeline ransomware attack from Nick Weaver and first-timer Betsy Cooper. Colonial has paid $5 million in ransom, gotten a bad decryption tool and restarted operations anyway. Since it’s likely to end up as the second test case for the Cyber Security Review Board, Colonial may regret having waited five days to start sharing information with CISA.

Maury Shenk explains the 200-page Irish High Court decision allowing the Irish data protection regulator to begin an inquiry that could cut off its data exports to the United States. Facebook would love to forestall that day until EU-U.S. talks on a new data export deal is done, but the Biden administration isn’t exactly making it a priority to bail out either Facebook or the U.S. intelligence community, which has as much at stake in data flows as the companies.

One of the puzzles of recent weeks has been persistent but vague stories that DHS wants more authority to gather information from public postings on social media. Nick, Betsy, and I try to make sense of the story, and we’re not helped by the fact that much of the media and politicians have switched from condemning such intelligence operations to demanding them, and vice versa, since the Trump administration ended.

Nick can’t resist a story that leaves both bitcoin and Tor looking bad, so of course we cover the boom in Tor exit nodes configured to steal the cryptocurrency of Tor users.

Betsy covers the unanimous view of chip making and consuming companies that the federal government should subsidize chip making in the U.S. Industrial policy is making a comeback, we note, but Betsy reminds us there’s a reason it went away. *cough*Solyndra*cough*

Betsy seizes on the latest WhatsApp tactic to lament the willingness of data-driven tech companies to annoy us into submission.

Nick and I cross swords over Apple’s firing of Antonio García Martínez, author of Chaos Monkeys, in my view one of the funniest and most insightful Silicon Valley books of the last decade. Part of its appeal is Garcia Martinez’s relentless burning of every bridge in his past business and personal life.  How, you keep asking, can he recover from telling all those truths about Morgan Stanley, Facebook, Y Combinator, and AdTech? Turns out, he can’t. But it wasn’t any of those supposedly potent institutions that nailed him. Instead, it was his claim that the women of Silicon Valley are mostly "soft and weak, cosseted and naïve” and possessed of a “self-regarding entitlement feminism.”

Apple employees demanded that they be protected from Garcia Martinez, and he was summarily fired. The more interesting question is whether hiring Garcia Martinez shows just how determined Apple is to replace Facebook as Google’s main competition in the “leverage customer data to sell ads” business.

In quick hits, I revisit the claim that a Saudi prince hacked Jeff Bezos’s phone and turned his unexpurgated selfies over to the National Enquirer in order to suppress Washington Post publicity over the killing of Jamal Khashoggi. That was all BS, it turns out, apparently designed to turn Bezos from an ordinary tawdry adulterer into a press freedom crusader.

And Nick draws our attention to Counterfit, a promising Microsoft tool for testing artificial intelligence algorithms to find security flaws.

And More!

Download the 362nd Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Bruce Schneier joins us to talk about artificial intelligence (AI) hacking in all its forms. He’s particularly interested in ways AI will hack humans, essentially preying on the rough rules of thumb programmed into our wetware—that big-eyed, big-headed little beings are cute and need to have their demands met or that intimate confidences should be reciprocated. AI may not even know what it’s doing, since machines are famous for doing what works unless there’s a rule against it.  Bruce is particularly interested in law-hacking—finding and exploiting unintended consequences buried in the rules in the U.S. Code. If any part of that code will lend itself to AI hacking, Bruce thinks, it’s the tax code (insert your favorite tax lawyer joke here). It’s a bracing view of a possible near-term future.

In the news, Nick Weaver and I dig into the Colonial Pipeline ransomware attack and what it could mean for more aggressive cybersecurity action in Washington than the Biden administration was contemplating just last week as it was pulling together an executive order that focused heavily on regulating government contractors.

Nate Jones and Nick examine the stalking flap that is casting a cloud over Apple’s introduction of AirTags.

Michael Weiner takes us through a quick tour of all the pending U.S. government antitrust lawsuits and investigations against Big Tech. What’s striking to me is how much difference there is in the stakes (and perhaps the prospects for success) depending on the company in the dock. Facebook faces a serious challenge but has a lot of defenses. Amazon and Apple are being attacked on profitable but essentially peripheral business lines. And Google is staring at existential lawsuits aimed squarely at its core business. 

Nate and I mull over the Russian proposal for a UN cybercrime proposal. The good news is that stopping progress in the UN is usually even easier than stopping legislation in Washington.

Nate and I also puzzle over ambiguous leaks about what the Department of Homeland Security wants to do with private firms as it tries to monitor extremist chatter online. My guess: This is mostly about wanting the benefit of anonymity or a fake persona while monitoring public speech.

And then Michael takes us into the battle between Apple and Fortnite over access to the app store without paying the 30 percent cut demanded by Apple. Michael thinks we’ve mostly seen the equivalent of trash talk at the weigh-in so far, and the real fight will begin with the economists’ testimony this week.

Nick indulges a little trash talk of his own about the claim that Apple’s app review process provides a serious benefit to users, citing among other things the litigation-driven disclosure that Apple never sent emails to users of the 125 million buggered apps it found a few years back.

Nick and I try to make sense of stories that federal prosecutors in 2020 sought phone records for three Washington Post journalists as part of an investigation into the publication of classified information that occurred in 2017.

I try to offer something new about the Facebook Oversight Board’s decision on the suspension of President Trump’s account.  To my mind, a telling and discrediting portion of the opinion reveals that a minority of the board members thought that international human rights law required more limits on Trump’s speech—and they chose to base that on the notion that calling the coronavirus a Chinese virus is racist. Anyone who has read Nicholas Wade’s careful article knows that there’s lots of evidence the virus leaked from the Wuhan virology lab. If any virus in the last hundred years deserves to be named for its point of origin, then, this is it. Nick disagrees.

Nate previews an ambitious task force plan on tackling ransomware. We’ll be having the authors on the podcast soon to dig deeper into its nearly 50 recommendations.

Signal is emerging a Corporate Troll of the Year, if not the decade. Nick explains how, fresh from trolling Cellebrite, Signal took on Facebook by creating a bevy of personalized Instagram ads that take personalization to the Next Level. 

Years after the fact, the New York Attorney General has caught up with the three firms that generated fake comments opposing the Federal Communications Commission’s net neutrality rollback. They’ll be paying fines. But I can’t help wondering why anyone thinks it’s useful to think about proposed rules by counting the number of postcards and emails that shout “yes” or “no” but offer no analysis.

Download the 361st Episode (mp3) 

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Our interview is with Kevin Roose, author of Futureproof: 9 Rules for Humans in the Age of Automation that debunks most of the comforting stories we use to anaesthetize ourselves to the danger that artificial intelligence and digitization poses to our jobs. Luckily, he also offers some practical and very personal ideas for how to avoid being caught in the oncoming robot apocalypse. 

In the news roundup, Dmitri Alperovitch and I take a few moments to honor Dan Kaminsky, an extraordinary internet security and even more extraordinarily decent man. He died too young, at 42, as Nicole Perlroth demonstrates in one of her career-best articles. 

Maury Shenk and Mark MacCarthy lay out the EU’s plan to charge Apple with anti-competitive behaviour in running its app store. 

Under regulation-friendly EU competition law, the more austere U.S. version, it sure looks as though Apple is going to have trouble escaping unscathed.  

Mark and I duke it out over Gov. DeSantis’s Florida bill on content moderation reform.

We agree that it will be challenged as a violation of the First Amendment and as preempted by federal Section 230. Mark thinks it will fail that test. I don’t, especially if the challenge ends up in the Supreme Court, where Justice Thomas at least has already put out the “Welcome” mat. 

Dmitri and I puzzle over the statement by top White House cyber official Anne Neuberger that the U.S. reprisals against Russia are so far not enough to deter further cyberattacks. We decide it’s a “Kinsley gaffe”—where a top official inadvertently utters an inconvenient truth. 

This Week in Information Operations: Maury explains that China may be hyping America’s racial tensions not as a tactic to divide us but simply because it’s an irresistible comeback to U.S. criticisms or Chinese treatment of ethnic minorities. And Dmitri explains why we shouldn’t be surprised at Russia’s integrated use of hacking and propaganda. The real question is why the US has been so bad at the same work.

In shorter stories: 

• Mark covers the slooow rollout of an EU law forcing one-hour takedowns of terrorist content 

• Dmitri tells us about the evolution of ransomware into, full-service doxtortion as sensitive files of the Washington D.C. Police Department are leaked online 

• Dmitri also notes the inevitability of more mobile phone adtech tracking scandals, such as the compromise of U.S. military operations 

• Maury and I discuss the extent to which China’s internet giants find themselves competing, not for consumers, but for government favor, as China uses antitrust law to cement its control of the tech sector 

• Finally, Dmitri and I unpack the latest delay in DOD’s effort to achieve cybersecurity maturity through regulatory-style compliance, an effort Dmitri believes is doomed

Download the 360th Episode (mp3) 

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

The Cyberlaw Podcast discusses issues at the intersection of technology and the law.

Download the 359th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Our interview is with Mark Montgomery and John Costello, both staff to the Cyberspace Solarium Commission. The commission, which issued its main report more than a year ago, is swinging through the pitch, following up with new white papers, draft legislative language and enthusiastic advocacy for its recommendations in Congress, many of which were adopted last year. That makes it the most successful of the many cybersecurity commissions that have come and gone in Washington. And it’s not done yet. Mark and John review several of the most important legislative proposals the commission will be following this year. I don’t agree with all of them, but they are all serious ideas and it’s a good bet that a dozen or more could be adopted in this Congress.

In the news roundup, David Kris and I cover the FBI’s use of a single search warrant to remove a large number of web shells from computers infected by China’s irresponsible use of its access to Microsoft Exchange. The use of a search (or, more accurately, a seizure warrant)  is a surprisingly far-reaching interpretation of Federal Criminal Rule 41. But despite valiant efforts, David is unable to disagree with my earlier expressed view that the tactic is lawful.

Brian Egan outlines what’s new in the Biden administration’s sanctions on Russia for its SolarWinds exploits. The short version: While some of the sanctions break new ground, as with Russian bonds, they do so cautiously.

Paul Rosenzweig, back from Costa Rica, unpacks a hacking story that has everything—terrorism, the FBI, Apple, private sector hacking and litigation. Short version: we now know the private firm that saved Apple from the possibility of an order to hack its own phone. It’s an Australian firm named Azimuth that apparently only works for democratic governments but that is nonetheless caught up in Apple’s bully-the-cybersecurity-researchers litigation campaign.

Gus Hurwitz talks to us about the seamy side of content moderation (or at least on seamy side) – the fight against “coordinated inauthentic behaviour.”

In quicker takes, Paul gives us a master class in how to read the intel community’s Annual Threat Assessment.  David highlights what may be the next Chinese  telecom manufacturing target, at least for the GOP, after Huawei and ZTE. I highlight the groundbreaking financial industry breach notification rule that has finished and is moving toward adoption. And Gus summarizes the state of Silicon Valley antitrust legislation—everyone has a bill—so no one is likely to get a bill.

Download the 358th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

They used to say that a conservative was a liberal who’d been mugged. Today’s version is that a conservative who’s comfortable with business regulation is a conservative who’s been muzzled by Silicon Valley. David Kris kicks off this topic by introducing Justice Thomas’s opinion in a case over Trump’s authority to block users he didn’t like. The case was made thoroughly moot by both the election and Twitter’s blocking of Trump, but Justice Thomas wrote separately to muse on the ways in which Twitter’s authority to block users could be regulated by treating the company as a common carrier or public accommodation. David sees a trend among conservative jurists to embrace limits on Big Social’s authority to suppress speech.

I recount my experience being muzzled by LinkedIn, which would not let me link to a new Daily Mail story about the Hunter Biden laptop and say, “The social media giants that won’t let you say the 2020 election was rigged are the people who did their best to rig it: The Hunter Biden laptop was genuine and scandalous according to the Daily Mail.” To my mind, this is Big Social protecting its own business interests by suppressing a story that could convince people that the industry has too much power over our national dialogue and our elections. (I mocked LinkedIn by posting 5 variants of my original post, all making the same point in slightly different ways. You can see this on my LinkedIn account result.)

But my view that we should not let five or six Silicon Valley owners take over our national dialogue is challenged by Jamil Jaffer, a friend and conservative who is appalled at my deviation from Republican antiregulatory orthodoxy and first amendment doctrine. It’s a great conservative catfight that mirrors the much greater catfight now under way in the Republican party.

Elsewhere in the news roundup, Jordan Schneider and David dig into the claims that China has built advanced weapons systems with the help of American chip designers and Taiwanese fabs.

The accusation has led the Biden administration to slap export controls on several Chinese firms. Whether this will work without more aggressive U.S. controls on, say, foreign fabs serving those firms is open to question.

More to the point, it raises questions about long term U.S. industrial policy. David notes that one answer, the bipartisan “Endless Frontier Act,” is gaining some momentum. (I understand the motivation but question the execution.) We also touch on the sad story of Intel’s recent missteps, and the opportunity that industrial policy has created for GlobalFoundries’ IPO.

Meanwhile Jamil takes on AdTech espionage, while U.S. senators ask Digital-Ad auctioneers to name foreign clients amid national-security concerns.

We all weigh in on the administration’s cyber picks, announced over the weekend. The unanimous judgment is that Chris Inglis, Jen Easterly and Rob Silvers are good picks—and, remarkably, ended up in the right jobs.

In shorter hits, David and I ponder Twitch’s unusual decision to start punishing people on line for misdeeds offline—misdeeds that Twitch will investigate itself. While neither of us are comfortable with the decision, including the effort to do privately what we pay cops and courts to do publicly, but there is more justification for the policy in some cases (think child sexual abuse) than might be apparent at first glance.

I tell the story of the Italian authorities identifying and arresting someone trying to hire a hitman using cryptocurrency and the dark web. As far as I know, successful cryptocurrency hitmen remain as rare as unicorns

David suggests that I should be glad not to live in Singapore, where the penalty for information the establishment doesn’t like is a criminal libel judgment that I’d be forced to crowdfund like Singapore’s government critics. I note that American sites like GoFundMe and Patreon have already imposed ideological screens that mean I wouldn’t be able to crowdfund my defense against Big Social.

And, for This Week in Data Breaches, I note the new tactic of ransomware gangs trying to pressure their victims to pay by threatening the victims’ customers with doxxing plus the remarkable phenomenon of half-billion-user data troves that the source companies  say are not really the result of network breaches and so not disclosable.

Our interview is with Kim Zetter, author of the best analysis to date of the weird messaging from the National Security Agency (NSA) and Cyber Command about the domestic “blind spot” or “gap” in their cybersecurity surveillance. I ask Kim whether this is a prelude to new NSA domestic surveillance authorities (definitely not, at least under this administration), why the gap can’t be filled with the broad emergency authorities for the Foreign Intelligence Surveillance Act and criminal intercepts (they don’t fit, quite) and how the gap is being exploited by Russian (and soon other) cyberattackers. My most creative contribution: maybe Amazon Web Services, where most of the domestic machines are being spun up, would trade faster cooperation in targeting such machines for a break on the know-your-customer rules they may otherwise have to comply with. And if you haven’t subscribed to Kim’s (still free for now) substack newsletter, you’re missing out.

In the news roundup, we give a lick and a promise to today’s Supreme Court decision in the fight between Oracle and Google over application programming interface copyrights, but Mark MacCarthy takes us deep on the Supreme Court’s decision cutting the heart out of most, class actions for robocalling. Echoing Congressional Democrats, Mark thinks the court’s decision is too narrow. I think it’s exactly right. We both expect Congress to revisit the law soon.

Nick Weaver and I explore the fuss over vaccination passports and how Silicon Valley can help. 

Considering what a debacle the Google and Apple effort on tracing turned into, with a lot of help from privacy zealots, I’m pleased that Nick and I agree that this is a tempest in a teapot. Paper vax records are likely to be just fine most of the time. That won’t prevent privacy advocates from trying to set unrealistic and unnecessary standards for any electronic vax records system, more or less guaranteeing that it will fall of its own weight. 

Speaking of unrealistic privacy advocates, Charles-Albert Helleputte explains why the much-touted General Data Protection Regulation privacy regime is grinding to a near halt as it moves from theory to practice. Needless to say, I am not surprised.

Mark and I scratch the surface of Facebook’s Fairness Flow for policing artificial intelligence bias. Like anything Facebook does, it’s attracted heavy criticism from the left, but Mark thinks it’s a useful, if limited, tool for spotting bias in machine learning algorithms.  I’m half inclined to agree, but I am deeply suspicious of the confession in one “model card” that the designers of an algorithm for identifying toxic speech seem to have juiced their real-life data with what they call “synthetic data” because “real data often has disproportionate amounts of toxicity directed at specific groups.” That sure sounds as though the algorithm relying on real data wasn’t politically correct, so the researchers just made up data that fit their ideology and pretended it was real—an appalling step for scientists to take with little notice.  I welcome informed contradiction. 

Nick explains why there’s no serious privacy problem with the IRS subpoena to Circle, asking for the names of everyone who has more than $20 thousand in cryptocurrency transactions. Short answer: everybody who doesn’t deal in cryptocurrency already has their transactions reported to the IRS without a subpoena.

Charles-Albert and I note that the EU is on the verge of finding that South Korea’s data protection standards are “adequate” by EU standards.  The lesson for the U.S. and China is simple: The Europeans aren’t looking for compliance; they’re looking for assurances of compliance. As Fleetwood Mac once sang, “Tell me lies, tell me sweet little lies.” 

Mark and I note the extreme enthusiasm with which the FBI used every high-tech tool to identify even people who simply trespassed in the Capitol on Jan. 6. The tech is impressive, but we suspect a backlash is coming. Nick weighs in to tell me I’m wrong when I argue that we didn’t see these tools used this way against Antifa’s 2020 rioters.

Nick thinks we haven’t paid enough attention to the Accellion breach, and I argue that companies are getting a little too comfortable with aggressive lawyering of their public messages after a breach. One result is likely to be a new executive order about breach notification (and other cybersecurity obligations) for government contractors, I predict.

And Charles and I talk about the UK’s plan to take another bite out of end-to-end encryption services, essentially requiring them to show they can still protect kids from sexual exploitation without actually reading the texts and pictures they receive. 

Good luck with that!

Download the 356th Episode (mp3)  

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.