The Cyberlaw Podcast

Our interview this week is with Francis Fukuyama, a fellow and teacher at Stanford and a renowned scholar and public intellectual for at least three decades. He is the coauthor of the Report of the Working Group on Platform Scale. It’s insightful on the structural issues that have enhanced the power of platforms to suppress and shape public debate. It understands the temptation to address those issues through an antitrust lens – as well as the reasons why antitrust will fail to address the threat that platform power poses to our democracy. As a solution, it proposes to force the platforms to divest their curatorial authority over what Americans (and the world) reads, creating a host of middleware suppliers who will curate consumers’ feeds in the way that consumers prefer. We explore the many objections to this approach, from first amendment purists to those, mainly on the left, who really like the idea of suppressing their opponents on the right. But it remains the one policy proposal that could attract support from left and right and also make a real difference.

In the news roundup, Dmitri Alperovich, Nick Weaver, and I have a spirited debate over the wisdom of Google’s decision to expose and shut down a western intelligence agency’s use of zero day exploits against terrorist targets. I argue that if a vulnerabilities equities process balancing security and intelligence is something we expect from NSA, it should also be expected of Google. 

Nate Jones and Dmitri explore the slightly odd policy take on SolarWinds that seems to be coming from NSA and Cyber Command – the notion that the Russians exploited NSA’s domestic blind spot by using US infrastructure for their attack. That suggests that NSA wants to do more spying domestically, although no such proposal has surface. Nate, Dmitri, and I are united in thinking that the solution is a change in US law, though Dmitri thinks a know your customer rule for cloud providers is the best answer, while I think I persuaded Nate that empowering faster and more automatic warrant procedures for the FBI is doable, pretty much as we did with the burner phone problem in the 90s.

The courts, meanwhile, seem to be looking for ways to bring back a Potter Stewart style of jurisprudence for new technology and the fourth amendment: “I can’t define it, but I know it when it creeps me out.” The first circuit’s lengthy oral argument on how long video surveillance of public spaces can continue without violating the fourth amendment is a classic of the genre. 

Dmitri and Nick weigh in on Facebook’s takedown of Chinese hackers using Facebook to target Uighurs abroad.

Dmitri thinks we can learn policy lessons from the exposure (and likely sanctioning) of the private Chinese companies that carried out the operation.

Dmitri also explains why CISA’s head is complaining about the refusal of private companies to tell DHS which US government agencies were compromised in SolarWinds. The companies claimed that their NDAs with, say, Treasury meant that they couldn’t tell DHS that Treasury had been pawned. That’s an all too familiar example of federal turf fights hurting federal cybersecurity.  

In our ongoing feature, This Week in U.S.-China Decoupling, we cover the “Disaster in Alaska” evaluate the latest bipartisan bill to build a Western technology sphere to compete with China’s sector, note the completely predictable process ousting of Chinese telecom companies from the US market, and conclude that the financial sector’s effort to defy the gravity of decoupling will be a hard act to maintain. 

Always late to embrace a trend, I offer Episode 1 of the Cyberlaw Podcast as a Non-Fungible Token to the first listener to cough up $150, and Nick explains why it would be cheap at a tenth the price, dashing my hopes of selling the next 354 episodes and retiring. 

Nick and I have kind words for whoever is doxxing Russian criminal gangs, and I suggest offering the doxxer a financial reward (not just a hat tip in a Brian Krebs column. We fewer kind words have for the prospect that AI will soon be able to locate, track, and bankrupt problem gamblers.   

I issue a rare correction to an earlier episode, noting that Israel may not have traded its citizens’ health data for first dibs on the Pfizer vaccine. It turns out that what was deidentified aggregate health data, Israel offered Pfizer which with proper implementation may actually stay aggregate and deidentified. And I offer my own hat tip to Peter Machtiger, for a student note in an NYU law journal that cites the Cyberlaw Podcast, twice!

And more!

Download the 355th Episode (mp3)  

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Our news roundup for this episode is heavy on China and tech policy. And most of the news is bad for tech companies. Jordan Schneider tells us that China is telling certain agencies, not to purchase Teslas or allow them on the premises, for fear that Elon Musk’s famously intrusive record-keeping systems will give U.S. agencies insight into Chinese facilities and personnel. Pete Jeydel says the Biden administration is prepping to make the same determination about Chinese communications and information technology, sending subpoenas to a number of Chinese tech suppliers. Meanwhile, Apple’s effort to protect its consumers from apps that collect personal data is coming under pressure from what Jordan sees as a remarkable alliance of normally warring companies, including Baidu, Tencent and Bytedance. In addition to their commercial heft, all these companies likely have more juice in Beijing than Apple, so look for Tim Cook to climb down from his privacy high horse in China. (And Russia, where Apple has already agreed to let the Russian government specify the apps that must come preinstalled on iPhones sold in Russia.) Still, you can expect that Apple will continue to bravely refuse to cooperate with the FBI on terrorism and serious crime because that might set a precedent for cooperating with government demands in places like Russia and China (like them, I guess, but, you know, smaller).

But the episode gets its title from our discovery that President Xi’s critique of social media platforms sounds exactly like Sen. Josh Hawley’s. It is, in fact, the global bien pensant consensus, which has no dissenters to speak of now that the Chinese go to Davos. Jordan offers insights into why the Chinese government’s concerns about Big Tech might have its origins in something other than factional strife in Beijing.

David Kris and I dive into the final word from the intelligence community on foreign governments’ interference  (via hacking or influence ops) in our 2020 election. The short answer is that the Russians and the Chinese didn’t hack our election machinery, in fact they didn’t even try. So, chest-beating over our 2020 cyber defenses may be a little like doing a victory lap after the other team forfeits. David and I manage to disagree about a few things, including the Hunter Biden laptop story, which I contend is now the principal disinformation campaign of 2020, as the media and Big Tech combined to throttle the story on spurious suspicions of a Russian hand in its provenance; David disagrees.

Pete Jeydel and Ishan Sharma, our interview guest, weigh in on the latest cyber conflict paper from the United Nations. We all agree that it could be worse, and that getting the General Assembly to accept it was an achievement at a time of lowered expectations for the UN.

The Cyber Space Solarium Commission is not going away, Pete and I agree, as witness the most recent report card issued to the Biden administration by a Solarium staffer. In principle, that’s a good thing; commissions need to stick around and fight for their recommendations. But I can’t help complaining that some of the things the commission is fighting for—Senate confirmation of a White House cyber director, and cutting the Department of Homeland Security out of supply chain governance—are bad ideas. 

We close with a recognition of the rafts of material supplied over the years to the podcast by the data protection authorities of Europe. They’ve mostly always been an example of what Texans call “all hat and no cattle” – better talkers than doers. But now their lack of serious implementation skills is catching up to them, as the companies they have penalized begin to  pursue, and win, judicial appeals. That’s a trend likely to continue, and a good thing too.

Our interview is with Ishan Sharma, from the Federation of American Scientists, and author of “A More Responsible Digital Surveillance Future Multi-stakeholder Perspectives and Cohesive State & Local, Federal, and International Actions."

If you like the episodes where I disagree profoundly with my guests, this one’s for you. I don’t think Ishan gets more than two minutes in before the critiquing begins. Still, he holds his own, defending a vision of surveillance technology that serves democratic ends and is for that reason supported and even subsidized in a global competition with the less democratic alternatives from China. I suspect that he’ll lose friends on both the left and the right as he tries to walk this line, but he’s clearly put a lot of thought into finding an alternative to technopessimism, and he defends it ably.

And more!

Download the 354th Episode (mp3) 

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

This week we interview Eliot Higgins, founder and executive director of the online investigative collective Bellingcat and author of We Are Bellingcat.

Bellingcat has produced remarkable investigative scoops on everything from Saddam’s use of chemical weapons to exposing the Russian FSB operatives who killed Sergei Skripal with Novichok, and, most impressive, calling a member of the FSB team that tried to kill Navalny and getting him to confess. Eliot talks about the techniques that make Bellingcat so effective and the hazards, physical and moral, that surround crowdsourced investigations.

In the news, Dave Aitel gives us the latest on the Exchange server compromise, and the reckless Chinese hack-everyone spree that was apparently triggered by Microsoft’s patch of the vulnerability.

Jamil Jaffer introduces us to the vulnerability of the week – dependency confusion, and the startling speed with which it is being exploited.

I ask Nate Jones and the rest of the panel what all this means for government policy.  No one thinks that the Biden published cyberstrategy tells us anything useful. More interesting are two deep dives on cyber strategy from people with a long history in the field. We see Jim Lewis’s talk on the topic as an evolution in the direction of much harsher responses to Russian and Chinese intrusions. Dmitri Alperovich’s approach also has a hard edge, although he points out that the utter irresponsibility of the Chinese pawn-em-all tactic  deserves an especially harsh response.  I wonder why Cyber Command didn’t respond by releasing a worm that would install poorly secured shells on every Exchange server in China. 

In other news, I blame poor (or rushed) Pentagon lawyering for the district court ruling that the Department of Defense couldn’t list Xiaomi as an entity aligned with the Chinese military. Jamil is more charitable both to DOD and the Judge who made the ruling, but he expects (or maybe just hopes) that the court of appeal will show the Pentagon more deference.

Twitter, on the other hand, is praying that the Northern District of California suffers from full-blown Red State Derangement, as it asks the court there to enjoin a Texas Attorney General investigation into possible anticompetitive coordination in the Great Deplatforming of January 2021.

Nate gives us the basics. I observe that, to bring such a Hail Mary of a case, Twitter must deeply fear what its own employees were saying about the deplatforming at the time. Neither Nate nor I give Twitter a high probability of success. And even if it does succeed, red states are lining up new laws and regulatory initiatives for Silicon Valley, most notably Gov. DeSantis’s controversial effort to navigate section 230 and the first amendment.

Nate also provides a remarkably clear explanation of the sordid tale of European intelligence and law enforcement agencies trying to cut a special deal for themselves in the face of surveillance-hostile rulings from the EU’s Court of Justice. The agencies are right to want to avoid those foolish decisions, but leaving the US on the hook will only inflame trans-Atlantic relations.

In quick hits, Jamil and Dave talk us through Israel’s Unit 8200, the press on which offers a better cybersecurity VC alumni network than Stanford. We also discuss recent news about security lapses in what Dave calls the internet of things.

And more!

Download the 353rd Episode (mp3)  

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

We’re mostly back to our cybersecurity roots in this episode, for good reasons and bad. The worst of the bad reasons is a new set of zero-day vulnerabilities in Microsoft’s Exchange servers. They’ve been patched, Bruce Schneier tells us, but that seems to have inspired the Chinese government hackers to switch their campaign from Stealth to Promiscuous Mode. Anyone who hasn’t already installed the Microsoft patch is at risk of being compromised today for exploitation tomorrow.

Nick Weaver and Dmitri Alperovitch weigh in on the scope of the disaster and later contribute to our discussion of what to do about our ongoing cyberinsecurity. We’re long on things that don’t work. Bruce has pointed out that the market for software products, unfortunately, makes it entirely rational for industry to skimp on security while milking a product’s waning sales. Voluntary information sharing, has failed Dmitri notes. In fact, as OODA Loop reported in a devastating chart, information sharing is one of half a dozen standard recommendations made in the last dozen commission recommendations for cybersecurity. They either haven’t been implemented or they don’t work.

Dmitri is hardly an armchair quarterback on cybersecurity policy. He’s putting his money where his mouth is, in the form of the Silverado Policy Accelerator, which we discuss during the interview segment of the episode. Silverado is focused on moving the cybersecurity policy debate forward in tangible, sometimes incremental, ways. It will be seeking new policy ideas in cybersecurity, international trade and industrial security, and ecological and economic security (what the group is calling Eco2Sec).

(The unifying theme is the challenge to the US posed by the rise of China and the inadequacy of our past response to that challenge.) But ideas are easy; implementation is hard. Dmitri expects Silverado to focus its time and resources both on identifying novel policy ideas and on ensuring those ideas are transformed into concrete outcomes.

Whether artificial intelligence (AI) would benefit from some strategic decoupling sparks a debate between me, Nick, Jane Bambauer and Bruce, inspired by the final AI commission report. We shift from that to China’s version of industrial policy, which seems to reflect Chinese politics in its enthusiasm not just for AI and chips but also for keeping old leaders alive longer.

Jane and I check in on the debate over social media speech suppression, including the latest developments in the Facebook Oversight Board and the unusual bedfellows that the issue has inspired. I mock Google for YouTube’s noblesse oblige promise that it will stop suppressing President Trump’s speech when it no longer sees a threat of violence on the Right. And then I mock it again for its silly refusal to return search results for “BlueAnon”—the Right’s label for the Left’s wackier conspiracy theories.

In quick hits, Bruce and Dmitri explore a recent Atlantic Council report on hacked access as a service and what to do about it. Bruce thinks the problem (usually associated with NSO Group) is real and the report’s recommendations plausible. Dmitri points out that trying to stamp out a trade in zero days is looking at the wrong part of the problem, since reverse engineering patches is the source of most successful attacks, not zero days.  Speaking of NSO Group, Nick reminds us of the rumors that they have been under criminal investigation and that the investigation has been revived recently.

Jane notes that Virginia has become the second state with a consumer data protection law, and one that resembles the California Consumer Privacy Act. 

Jane also notes the Israeli Supreme Court decision ending (sort of) Shin Bet’s use cellphone data  for coronavirus contact tracing. Ironically, it turns out to have been more effective than most implementations of the Gapple privacy-crippled app. 

Bruce and Dmitri celebrate the hacking of three Russian cybercrime forums for the rich array of identity clues the doxxing is likely to make available to researchers like Bellingcat (whose founder will be our interview guest on Episode 353 of the Cyberlaw Podcast).

And more!

Download the 352nd Episode (mp3) 

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

In the news roundup, David Kris digs into rumors that Chinese malware attacks may have caused a blackout in India at a time when military conflict was flaring on the two nation’s Himalayan border. This leads us to Russia’s targeting of the U.S. grid and to uneasy speculation on how well our regulatory regime is adapted to preventing successful grid attacks.

The Biden administration is starting to get its legs under it on cybersecurity. In its first major initiative, Maury Shenk and Nick Weaver tell us, it has called for a set of studies on how to secure the supply chain in several critical products, from rare earths to semiconductors. As a reflection of the rare bipartisanship of the issue, the president’s order is weirdly similar to Sen. Tom Cotton’s to “beat China” economically. 

Nick explains the most recent story on how China repurposed an NSA attack tool to use against U.S. targets. Bottom line: It’s embarrassing for sure, but it’s also business as usual for attack teams. This leads us to a surprisingly favorable review of the Cyber Threat Alliance’s recent paper on how to run a Vulnerability Equities Process.

Maury explains the new rules that Facebook, WhatsApp and Twitter will face in India. 

Among other things, the rules will require Indi-based “grievance officers”to handle complaints. I am unable to resist snarking that if ever there were a title that the wokeforce at these companies should aspire to, it’s Chief Grievance Officer.

Nick and I make short work of two purported scandals—ICE investigators using a private utility database to enforce immigration law and the IRS purchasing cellphone location data. I argue that the first is the work of ideologues who would loudly protest ICE access to the White Pages. And the second is a nonstory largely manufactured by Sen. Wyden. 

In a story that isn’t manufactured, David and I predict that the Supremes will agree to decide the scope of cellphone border searches.  More than that, we conclude, the Ninth Circuit will lose. The hard question is how broadly the Court decides to rule once it has kicked the Ninth Circuit rule to the curb.

Maury reports that Facebook and Google have pushed the Aussie government into a compromise on paying Aussie media fees for links. 

Facebook gets the credit for being willing to shoot the family members the government was holding hostage (although in Facebook’s case, the hostage was probably a second cousin once removed). 

Maury predicts that the negotiations will be tougher once the European Union starts rounding up its hostages.  

In quick hits, I claim credit for pointing out years ago that sooner or later the crybullies would come for  “quantum supremacy.” And they have.

Maury and I note the rise of audits for AI bias. 

He’s mildly favorable; I am not. And I close by noting the surprisingly difficult choices illustrated by Pro Publica’s story on how the content moderation sausage was made at Facebook when the Turkish government demanded that a Kurdish group’s postings be taken down. 

And more!

Download the 351st Episode (mp3)  

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

This episode features an interview with Jason Fagone, journalist and author of The Woman Who Smashed Codes: A True Story of Love, Spies, and the Unlikely Heroine Who Outwitted America's Enemies. I wax enthusiastic about Jason’s book, which features remarkable research, a plot like a historical novel, and deep insights into what I call the National Security Agency’s (NSA) “pre-history”—the years from 1917 through 1940 when the need for cryptanalysis was only dimly perceived by the US government. Elizebeth and William Friedman more or less invented American cryptanalysis in those years, but the full story was never known, even to NSAers. It was protected by a force even stronger even than classification—J. Edgar Hoover’s indomitable determination to get good press for the FBI even when all the credit belonged elsewhere. And, at all its crucial stages, that prehistory is a love story that lasted, literally, right to the grave. Don’t miss this (long!) interview with Jason Fagone, or his book.

Meanwhile, in the news roundup. Dmitri Alperovitch covers the latest events in what we just can’t call the SolarWinds hack any more. There’s no doubt that Microsoft code is at the center of the hack, though not because of unintended features; the hackers showed great interest in Microsoft’s code. Dmitri predicts multiple executive orders from Anne Neuberger’s review, and he hopes it means more centralization of federal civilian security monitoring and policy under the Cybersecurity and Infrastructure Security Agency. Dmitri and I agree that the Congressional effort to turn the cybersecurity director position into a Senate-confirmed White House office is more trouble than it’s worth.

The Maryland law imposing taxes on Google and Facebook ad revenue is ground-breaking, and for that reason, it will also be heavily litigated. First time caller, first time listener David Fruchtman explains the tax and the litigation it has already spawned.

Which came first, China’s dream of a rare-earth boycott or U.S. nightmares of a rare-earth boycott? We ask Jordan Schneider, who suggests that neither the dream nor the nightmare is likely to come true any time soon.

Is Australia going to war with Big Tech?  I take on Oz’s link fee and end up siding, improbably, with Mike Masnick and Facebook and against the fee. Meanwhile, the Australian infrastructure protection bill is drawing fire from Microsoft. Dmitri leans toward Microsoft’s view that the law should not give government authority to intervene when a private sector entity is unable or unwilling to respond to an attack.  I lean toward the government.

Jordan Schneider reviews the latest stories of tech companies getting a little too close for comfort to the Chinese surveillance state. The ByteDance censorship story is compelling but not new.  The Oracle story is compelling, new, and a clever piece of journalism by another alumna of the podcast, Mara Hvistendahl: Feeding the Beast: How Oracle Sells Repression in China 

Finally, in a series of quick bites, we cover:

• U.S. charges against three North Koreans who boosted national GDP appreciably with their hacks. 
• The ongoing Jones Day Doxtorsion. 
• France’s discovery that GRU hackers successfully targeted Centreon servers for years, and
• Sultan Meghji’s departure from The Cyberlaw Podcast for some damn thing or other.

And more!

Download the 350th Episode (mp3) 

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Our interview this week is with Nicole Perlroth, The New York Times reporter and author of This Is How They Tell Me the World Ends: The Cyberweapons Arms Race. It’s wide-ranging, occasionally confrontational and a great tour of the issues raised in the book about 0-day exploits, U.S. responsibility for the global cyber arms race and the colorful personalities whose hard choices helped shape the cybersecurity environment we all now live in.

In the news roundup, Nate Jones serves up a second helping of the SuperMicro story, a rerun of a much-maligned Bloomberg report from two years ago that SuperMicro gear had been elaborately compromised by China. This time, Nate reports, Bloomberg offers much more evidence, but probably not enough to completely satisfy the critics. Still, as we conclude, even giving the critics their due, this is a very bad story for SuperMicro—and for its customers. 

It seemed like a classic cybersecurity horror story, with hackers using access to the industrial control system to nearly poison Oldsmar, Florida’s water supply. But Nate and I both suspect that it will turn out to be a much more mundane horror story, one where the call is always coming from inside the house—and untraceable because all the employees use the same password and no firewall.

Paying for news links is suddenly all the rage among Western governments. I’d link to the Australian stories about their new law, but I’m afraid they’d want me to pay them. Mark MacCarthy says that risk is overrated, but the prospect for such payment schemes is pretty good. Not just Australia, but also the European Union is moving in this direction.

And Microsoft has expressed its willingness to let Google pay such a fee in the U.S. I suggest that this is all part of restoring an establishment of “authoritative narrative shapers,” in an internet age, noting that the critical question will be which publishers can attach themselves to the flow of internet funding—a question already causing angst among French publishers.

Paul Rosenzweig summarizes the work done by a lot of smart people on the question of how to think about Chinese technology platforms operating in the United States. He also summarizes the current state of litigation over Chinese technology platforms operating in the United States. In a word, it’s mostly on hold, waiting for the Biden administration to run a laborious interagency review.

Nate says the process has already begun for a related topic—how to secure the U.S. tech supply chain, particularly manufacturing semiconductors.

Meanwhile, the U.S. Court of Appeals for the First Circuit has taken on the question of border searches of mobile phones, ruling against a coalition of cyberleft organizations. There is now a circuit conflict that could bring the Supreme Court into the fray—soon if the cyberleft losers are imprudent enough to seek cert but not much longer than that if the Solicitor General picks a favorable case to lose in the U.S. Court of Appeals for the Ninth Circuit.

In short hits, I wonder at just how bad open source security has gotten, noting a clever hack that pawned many companies by providing a public (and compromised) package in a public repository, thereby trumping the companies’ private packages.

Luckily, NIST is all over open source security. Or not. It turns out that NIST is actually offering a host of insecure open source  products with known flaws. The purpose of the products? Better computer security, naturally. 

The creative policing award of the week goes to the Beverly Hills cop who expresses his unhappiness with being filmed on the job by playing background snippets of songs that will get the video taken down by copyright bots if it is ever posted. 

In the “about time” category, a Canadian woman who defamed dozens of ordinary people in online vendettas has been arrested in Toronto.  

And EncroChat, the phone that promised criminals absolute security but delivered them into the hands of law enforcement has spawned a complicated debate about whether stealing messages from memory was wiretapping or hacking. 

Finally, either The Cyberlaw Podcast has hit a new height or the Harvard Law Review has hit a new low: Looking for a way to sum up the European Court of Justice’s ruling in Schrems II , a student note in the review quotes from the podcast, characterizing Schrems II as “solipsistic Europocrisy meets judicial imperialism.” Couldn’t have said it better myself!

And more!

Download the 349th Episode (mp3) 

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

This episode features a deep dive into the National Security Agency’s (NSA) self-regulatory approach to overseas signals intelligence, or SIGINT. Frequent contributor David Kris takes us into the details of the SIGINT Annex that governs NSA’s collections outside the U.S. It turns out to be a surprising amount of fun as we stop to examine the SIGINT turf wars of the 1940s, the intelligence scandals of the 1970s, and how they shaped NSA’s corporate culture.

In the news roundup, Bruce Schneier and I review the privacy commissioner’s determination that Clearview artificial intelligence (AI) violated Canadian privacy law by scraping Canadians’ photos from social media.

Bruce thinks Clearview had it coming; I’m skeptical, since it appears that pretty much everyone has been scraping public face data for their machine learning collections for years.

David Kris explains why a sleepy investment review committee with practically no staff is now being compared to a SWAT team. The short answer is “CFIUS.”

More and more, Gus Hurwitz and I note, Big Tech CEOs are being treated like comic book supervillains in Washington.  But have they met their match? Sen. Amy Klobuchar is clearly campaigning to be, if not attorney general, then their nemesis. Like Doc Ock, she’s throwing punch after punch at Big Tech, not just in antitrust legislation but Section 230 reform as well.

We’re not done with SolarWinds yet, and Bruce Schneier thinks that’s fair. He critiques the company for milking profits from its software niche without reinvesting in security.

Gus revives the theme of Big Tech at bay, noting that Australia may start charging Google when it links to Australian news stories and that the new administration seems quite willing to join the rest of the world in imposing more taxes on tech profits.

David covers the flap between India and Twitter, which is refusing to follow an Indian order to suppress several Twitter accounts. That’s probably, I suggest, because there is insufficient proof that the accounts in question belong to Republicans.

IBM seems to be bailing on blockchain, and Bruce thinks it’s about time.  In some ways, IBM is the most interesting of tech companies, since it has less of a moat around its business than most and must live by its wits, which are formidable. Bruce offers quantum computing as an example of IBM doing the right things well.

Bruce and Gus help me with a preview of an upcoming interview of Nicole Perlroth as we cover an op-ed pulled from her new book. Bruce also offers a quick assessment of the draft report of the National Security Commission on Artificial Intelligence. The short version: There isn’t enough there there.

Finally, Gus reminds us that a prophet who predicts the attention economy but then refuses to play by its rules is almost guaranteed to end up as an attention Cassandra, as Michael Goldhaber has.  

And more!

Download the 348th Episode (mp3) 

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

The U.S. has never really had a “cyberczar.” Arguably, though, the U.K. has. The head of the National Cyber Security Center (NCSC) combines the security roles of the National Security Agency and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency. To find out how cybersecurity issues look from that perspective, we interview Ciaran Martin, the first director of the NCSC.

In the news roundup, Paul Rosenzweig sums up recent successes in taking down the NetWalker  and Emotet hacking networks: It’s a win, and that’s good, but we will need more than this to change the overall security status of the country.

Jordan Schneider explains the remarkable trove of leaked Chinese police records and the extraordinary surveillance now being imposed on the Uighur minority in China.

Enthusiasts for end-to-end encryption should be worried, Mark MacCarthy and I conclude. First, the EU—once a firm advocate of unbreakable encryption—is now touting “security through encryption and security despite encryption.” You can only get the second with some sort of lawful access, an idea that has now achieved respectability inside Brussels government circles, despite lobbying by e2e messaging firms based in Europe. On top of that, there’s a growing fifth column of encryption skeptics inside the firms, whose sentiments can be summarized as, “I’m all for cop-proof encryption as long as it isn’t used by lawbreakers who voted for Trump.” 

Paul brings us up to speed on the Office 36—I mean the SolarWinds—attack. Turns out lots of companies were compromised without any connection to SolarWinds. The episode shows that information sharing about exploits still has a ways to go. And if you’re a lawyer who’s been paying ten cents a page for downloads from the federal courts’ electronic filing system, whatever you’ve been paying for, it isn’t security. The attackers got in there, and as a result, we’ll be making sensitive filings on paper.  First voting, then suing—more and more of our lives are heading off line.

Does China want your DNA, and why? I have a truly scary suggestion, and Jordan tries to talk me down.

The Facebook Oversight Board has issued its first decisions. Paul and Mark touch on the highlights. I predict that the board will overrule Trump’s deplatforming, to surprisingly little dissent. 

Jordan and I dig into two overviews of U.S. tech and military competition. It starts to feel a little incestuous when it turns out we all know the authors—and that Jordan has invited them all to be on his excellent podcast, ChinaTalk.

In short hits, I predict that Beijing will fight CFIUS to the last dollar of TikTok revenue. And could easily win. I question YouTube’s demonetization of the Epoch Times, but Jordan has less sympathy for the paper. I’m less flexible about Google’s hard-to-justify decision to block the ads of a group that (like most Americans) opposes Democratic proposals to pack the Supreme Court. And if you’re wondering how dumb stuff like this happens, the L.A.Times gives an object lesson. Faced with a campaign to recall California Governor Gavin Newsom, the Times dug into the online organizations supporting recall. Remarkably, it found that the groups included a lot of the same kinds of folks who came to Washington in January to protest President Biden’s victory. Shortly after that drive-by festival of guilt by association, Facebook banned ads supporting the recall movement.

And more!

Download the 347th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

It’s a story that has everything, except a reporter able to tell it. A hostile state attacking the U.S. power grid is a longstanding and quite plausible national security concern.

The Trump administration was galvanized by the threat, even seizing Chinese power equipment at the port to do a detailed breakdown and then issuing an executive order and follow-up rulings designed to cut Chinese products from the supply chain.

Yet the Biden administration suspended this order for 90 days—the only Trump cybersecurity order to be called into question so far.

Industry lobbying? Chinese maneuvering? Tech uncertainty?  No one knows, but Brian Egan and I at least sketch the outlines of an irresistible story that will have to wait for a persistent journalist.

The SolarWinds story needs a new moniker, as the compromises spread beyond the scope of SolarWinds distributions to victims like Malwarebytes.

Increasingly, it looks as though Microsoft and its cloud are the common denominators, Sultan Meghji and I observe, but that’s one moniker the story will never acquire.

In other cyber news, the Chinese are stealing airline passenger reservation data, Sultan notes.

Maybe they’re just trying to find out when Mike Pompeo next plans to come to China so they can meet him at the airport and enforce their latest sanctions—no Great Wall tours for you, Mr. Secretary!

This is our last week of Trumpian cyber news, so we wallow in it. The President issued a last-minute order calling for an assessment of the security risks of Chinese drones, Maury Shenk tells us.

And Brian unpacks the other last-minute order requiring U.S. cloud providers to know which foreigners they are selling virtual machines to.

I claim victory in my short letter to former Secretary of the Treasury Steven Mnuchin, suggesting that, instead of jamming a cryptocurrency regulation through on his watch, he concentrates on convincing the newly confirmed Secretary Janet Yellen to carry through.  If he took my advice, it seems to have worked. Sultan reports that she is showing signs of wanting to "curtail" cryptocurrency. 

In other news, Sultan boldly predicts the advent of interplanetary cryptocurrency in Elon Musk’s lifetime.

Brian and I unpack the latest Cyberspace Solarium Commission product—Transition Book—which is persuasive for the Biden administration.

I predict that the statutorily mandated cybersecurity director will have to be subordinated to the deputy national security adviser for cybersecurity for the office to be accepted in the administration.

And in quick hits, Maury covers the surprisingly robust European enforcement of employee protections against video surveillance. I explain Parler’s loss in trying to overturn the Amazon Web Services ban that pushed it off the internet. Sultan explains why the Biden Peloton is a cybersecurity risk, and I tip my hat to the president’s physical fitness.  

I summarize the Michael Ellis story; he held the job of NSA's general counsel for about a day before a political witch-hunt caught up with him, and may never serve another day.  

And, finally, a little schadenfreude for the European Parliament, which is being investigated by the EU’s lead data regulator for poor cookie notices on a website it set up for Members of the European Parliament to book coronavirus tests. The complainant? Max Schrems, who is on his way to becoming as unpopular with European politicos as he is in the U.S.

And more!

Download the 346th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.