The Cyberlaw Podcast

We open the episode with David Kris’s thoughts on the two-years-late CFIUS investigation of TikTok, its Chinese owner, ByteDance, and ByteDance’s US acquisition of the lip-syncing company Musical.ly. Our best guess is that this unprecedented reach-back investigation will end in a more or less precedented mitigation agreement.

I cover the WhatsApp suit against NSO Group over the use of spyware on WhatsApp’s network. I predict that this is going to be a highwire act given the applicable precedents on whether violating terms of service also violates the Computer Fraud and Abuse Act. I also muse on whether NSO will find ways to make this a much less comfortable lawsuit for WhatsApp to pursue.

I award the ACLU the prize for making a PR and fundraising mountain out of a molehill of a lawsuit. Matthew Heiman and I try to decide which took less effort – cutting and pasting the ACLU’s generic FOIA complaint or cutting and pasting the ACLU’s generic “Oh my God, it’s a surveillance dystopia” press release. 

I comment on a heart-warming story about a geek in Normal, Illinois, who runs the most successful ransomware-rescue site in the world – and is going broke doing it. Advice to DHS’s CISA: Why not sponsor prizes for people who post ransomware decryptors with real impact? 

Mark MacCarthy discusses the guidance provided by the Defense Innovation Board on building ethical AI. I complain that political correctness seems to outweigh things like, you know, winning wars.

Matthew tells us that Israel is creating its own CFIUS-like panel, and we note the longstanding tension between the US and Israel over Chinese access to Israeli technology.

David notes more decoupling: The Interior Department has grounded its entire drone fleet, citing the risk from Chinese manufacturers.

Mark and I find common ground in thinking the Facebook got the political ad censorship question more right than wrong. Twitter rises to the challenge, naturally. 

Matthew fills us in on a story suggesting that North Korea breached an Indian nuclear plant’s network. He and I also briefly note that Georgia was the victim of a massive case of cyber vandalism.

In updates of past stories, I cover Coalfire’s persuasive critique of the sheriff who arrested the company’s pentesters in an Iowa courthouse. In another even longer-running story, the latest and perhaps the last word on the LabMD-Tiversa-FTC imbroglio can be found in an excellent New Yorker story that leaves LabMD looking good, the FTC looking bad, and Tiversa looking like a candidate for criminal prosecution. Finally, David updates the story of the 2016 Uber hack that cost the company’s chief security officer his job. It’s also going to cost the hackers their freedom, as they plead guilty to CFAA violations. 

Download the 285th Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

I talk about the photographs of Congresswoman Katie Hill and whether the rush to portray her as a victim of revenge porn raises questions about revenge porn laws themselves. Paul Rosenzweig, emboldened by twin tweets – from President Trump calling Never-Trumpers like him “human scum” and from Mark Hamill welcoming him to the Rebel Scum Alliance – takes issue with me.

In a more serious vein, Brian Egan, Paul, and I dig deep into the roots of the battle over how to keep “emerging technology” out of Chinese hands. 

Paul explains a Georgia Supreme Court ruling that cops need a warrant to access automobile data after an accident.

Brian and I talk about why DHS might issue a binding operational directive requiring federal agencies to adopt vulnerability disclosure programs.

Maury Shenk tells us to look for tougher cybersecurity rules in China starting December 1.

Paul unpacks the thinking behind a finding of bias in a widely used algorithm found in a healthcare system.

Maury tells us that “going dark is not going dark.” India’s Supreme Court is consolidating the legal fights over WhatsApp’s end-to-end encryption. In Afghanistan, meanwhile, the New York Times says that WhatsApp has become a key tool for communication by the government. 

I note a well-written study that contradicts the media narrative that YouTube’s recommendation engine is what’s radicalizing Americans. According to the authors, the problem isn’t YouTube’s recommendations but an audience that is looking for the kinds of alternative content that conservatives (not to mention the Alt-Right and the Alt-Lite) are offering.

In shorter takes, Paul and I cover Microsoft beating AWS for an enormous Pentagon cloud contract, and Brian takes on the question of lies in political ads on Facebook. I ask whether we would be wise to follow Russia’s example and disconnect from the Internet from time to time. 

Finally, Maury and I explore the challenge that TikTok poses not just to the US government but also to the Chinese government. Short take: TikTok can get away with more pro-Hong-Kong-protest speech in the US than the NBA can. 

Download the 284th Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

Our interview is with Alex Joel, former Chief of the Office of Civil Liberties, Privacy, and Transparency at the Office of the Director of National Intelligence. Alex is now at the American University law school’s Tech, Law, and Security Program. We share stories about the difficulties of government startups and how the ODNI carved out a role for itself in the Intelligence Community (hint: It involved good lawyering). We dive pretty deep on recent FISA court opinions and the changes they forced in FBI procedures. In the course of that discussion, I realize that every “reform” of intelligence dreamed up by Congress in the last decade has turned out to be a self-licking compliance trap, and I take back some of my praise for the DNI’s lawyering.

In the News Roundup, we’re inundated by serious new reports on cyberattacks. Dave Aitel admits that the hacking group he envies most is Turla, which was recently discovered to have totally pwned and stolen the entire attack infrastructure of an Iranian government team. Dave notes that Avast has succumbed to a second, far-reaching intrusion into its network, reminiscent of the last attack, which led to the company sending out a compromised CCleaner application: We may never know whether Avast got the intruder out, Dave suggests, but his hat is off to the company’s PR team. In still more pwnage news, Dave praises two new detailed reports from security companies: FireEye’s report on APT41’s combination of espionage and cybercrime and Crowdstrike’s report on amazingly successful Chinese efforts to steal aircraft intellectual property. And one more: Cyber Command has leaked the bare minimum of information designed to show that Iran’s strike against Saudi oil facilities did not go unpunished. Dave and I take our hats off to Iran’s PR team, which responded to the vague leak by claiming that Cyber Command “must have dreamt it.”

In other news, Gus Hurwitz breaks down a recent Ninth Circuit decision construing the Section 230 immunity for tools that filter content on the Internet. Remarkably, two judges thought that the immunity for preventing access to “objectionable” content would allow a company to cut off consumers’ access to its competitor’s products. Luckily, the two judges were a district court judge and the Ninth Circuit dissenter. But the close call shows how broadly the “objectionable” immunity sweeps. Which raises the question whether our trade agreements should broaden the immunity and turn it into international law that can’t be amended easily, or at all. That was a point of rare bipartisan agreement at a recent House hearing. But there’s no sign yet that Congress is going to reject the trade deals that do this. Gus and I also touch on the latest flaps over social media content monitoring. 

Dan Podair explains what’s good and what’s missing from the California Attorney General’s rules implementing California’s new, sweeping privacy act.

Poor Equifax: Just when they were hoping the worst had passed, the plaintiff’s bar doxxed even more embarrassing security failings. Dave offers this cold comfort: All the mistakes that were offered to show that Equifax security was bad could be found in pretty much any network in the country. More cold than comfort, Dave!

And, finally, we close with This Week in Puerile Jokes: All inspired, of course, by the UK Government’s decision to drop its plan to require ID to watch sex videos online.

Download the 283rd Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed! 

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! 

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

Our interview is with Sultan Meghji, CEO of Neocova. We cover the large Chinese investment in quantum technology and what it means for the United States. It’s possible that Chinese physicists are even better than American physicists at extracting funding from their government. Indeed, it looks as though some quantum tech, such as the use of entangled particles to identify eavesdropping, may turn out to have dubious military value. But not all. Sultan thinks the threat of special purpose quantum computing to break encryption poses a real, near-term threat to U.S. financial institutions’ security.

In the News Roundup, we cover the new California Consumer Privacy Act regulations, which devote a surprising amount of their 24 pages to fixing problems caused by the Act’s feel-good promise that consumers can access and delete the information companies have on them. Speaking of feel-good laws that are full of liability land mines for companies, the Supreme Court has let stand a Ninth Circuit ruling that allows blind people to sue under the Americans with Disabilities Act if websites don’t accommodate their needs. Nick Weaver and I explore the risks of making law by retroactively imposing liability.

Weirdly for a populist administration that says it hates the big social platforms for restricting speech, the Trump trade negotiators are actually expanding Section 230 immunities for Silicon Valley that both left and right have begun to question. The expansion is buried in hard-to-amend and even-harder-to-repeal trade agreements. By way of explanation, I explain the Realpolitik of trade deals. As if to prove my point, the U.S. and Japan have signed a Digital Trade Agreement that has much the same provision.

Nick and I muse on the rise of Commerce Department sanctions on individual companies. In a way, such sanctions are a less harsh alternative to OFAC boycotts, but like antibiotics, they either destroy the target or teach it to develop better resistance for the future.

Does TLS stand for “Tough Luck, Sucker?” That’s the message of a new and clever form of malware, softly attributed to the Russian FSB.

Apple, having banned, then unbanned an app that locates police activity in Hong Kong, has re-banned it. Tim Cook’s explanation triggers Nick’s bovine excrement detection system. In a Final Four of Hypocritical Surrender, LeBron and the NBA give ESPN a run for its money. South Park fails to qualify.

Matthew Heiman and I discuss India’s effort to create a national facial recognition system. Naturally BuzzFeed News thinks it’s evil.

Nick and I consider DHS’s request for the power to subpoena ISPs to identify owners of compromised systems. I critique Herb Lin’s suggestion that the ISPs can solve the problem without giving data to DHS.

As Matthew notes, it was just last month that the French government gave the world a stiff-necked little lecture on respecting sovereignty in cyberspace. So why are French police helping reprogram computers in Latin America? Because it’s different when the French are doing it than when it’s done to them, I surmise.

A recent “good guy with a keyboard” story offers me one more chance to ask why someone who’s rescued hundreds from ransomware should have to worry for one minute about liability for the compromised C2 machines he re-compromised in the rescue.

Matthew and I try to simplify a complex ruling from two FISA courts. Among the takeaways: The FBI has been running a lot of searches against 702 databases (3.1 million a year!), and the FISA courts are overusing the Fourth Amendment, which in FISA minimization cases is like trying to do brain surgery with a chainsaw.

Argh! That embarrassing Bloomberg Supermicro story is back. Sort of. Wired has shown that something like this could really be done. Which, Nick points out, we already knew.

I give a shoutout to Jennifer Daskal and Peter Swire for their useful overview of the U.K.-U.S. CLOUD Act, but I wonder if mutual “no targeting of the other country’s nationals” assurances are a scalable solution.

Finally, Matthew reviews the second volume of the Senate Intelligence Committee’s investigation into Russian election interference. The TL;DR? The Russians did what you think they did. Mildly surprising: After starting out just trying to hurt Hillary, by the end the Russians seem to have been trying to help Trump too.

Download the 282nd Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

Today’s episode opens with a truly disturbing bit of neocolonial judicial lawmaking from the Court of Justice of the European Union. The CJEU ruled that an Austrian court can order Facebook to take down statements about an Austrian politician. Called an “oaf” and a “fascist,” the politician more or less proved the truth of the accusations by suing to keep that and similar statements off Facebook worldwide. Trying to find allies for my proposal to adopt blocking legislation to protect the First Amendment from foreign government interference, I argue that President Trump should support such a law. After all, if he were ever to insult a European politician on Twitter, this ruling could lead to litigation that takes his Twitter account offline. True, he could criticize the judges responsible for the judgment as “French” or “German” without upsetting CNN, but that would be cold comfort. At last, a legislative and international agenda for the Age of Trump!

Nick Weaver returns to give the FDA a better report card than I expected on its approach to cybersecurity. But we agree that the state of medical device and implant security remains parlous.

I try my hand at explaining the D.C. Circuit’s Net Neutrality ruling in Mozilla v. FCC. There are still some rounds to be played, but Net Neutrality, if not dead, may at least be pining for the fjords.

Introducing a new feature: This Week in Elizabeth Warren. She has a plan to revive the Congressional Office of Technology Assessment. Nick likes the idea. I’m less enthusiastic, perhaps because I actually did some work for OTA before it disappeared.

Nick also helps unpack the flap over Google’s proposal to do DNS-over-HTTPS, and why ISPs aren’t happy about it. Bottom line: If you haven’t been paying much attention to the issue, you’ve made the right choice. Just think of how much time you saved by listening to the podcast!

Nick explains how Uzbekistan managed to give cyberattacks an aura, not of menace or invincibility, but of clownish incompetence.

David Kris explains the objections from privacy advocates and NGOs to the French government’s use of nationwide facial recognition for its ID program. I suggest that this may be the dumbest face recognition privacy “scandal” in history.

The cops shut down a Dark Web data center operating from… a NATO bunker? Nick reveals that the main reason to operate from a NATO bunker is, well, marketing.

Apparently channeling Stewart Baker, Attorney General Bill Barr is all-in on discouraging mass-market warrant-proof encryption. Nick thinks he’s picked the wrong fight. And maybe Nick’s right, since the civil-liberties shine on Apple is looking a little scuffed these days.

David tells us that NSA has launched a new defense directorate with Anne Neuberger at its helm. I promise to have her on the podcast early next year.

David talks about the California man charged with delivering classified information to China’s Ministry of State Security.

A Yahoo engineer pleads guilty to hacking emails for pornographic images. I’m surprised this doesn’t happen every month.

And in a sign that Congress can reach bipartisan agreement on bills that do more or less nothing, both the House and the Senate have adopted bills authorizing (but not funding) DHS “cyber hunt” teams to help local governments suffering from cyber ransom and other attacks.

Bringing back an old favorite, I cover the hacking of an electronic billboard to play porn.

Download the 281st Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed! 

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! 

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

In this episode I cross swords with John Samples of the Cato Institute on Silicon Valley’s efforts to disadvantage conservative speech and what to do about it. I accuse him of Panglossian libertarianism; he challenges me to identify any way in which bringing government into the dispute will make things better. I say government is already in it, citing TikTok’s People’s Republic of China-friendly “community standards” and Silicon Valley’s obeisance to European standards on hate speech and terror incitement. Disagreeing on how deep the Valley’s bias runs, we agree to put our money where our mouths are: I bet John $50 that Donald J. Trump will be suspended or banned from Twitter by the end of the year in which he leaves office.

There’s a lot of news in the Roundup. David Kris explains the background of the first CLOUD Act agreement that may be signed this year with the UK.

Nate Jones and I ask, “What is the president’s beef with CrowdStrike, anyway?” And find a certain amount of common ground on the answer.

This Week in Counterattacks in the War on Terror: David and I recount the origins and ironies of Congress’s willingness to end the NSA 215 phone surveillance program. We also take time to critique the New York Times’s wide-eyed hook-line-and-sinker ingestion of an EFF attack on the FBI’s use of National Security Letters.

Edward Snowden’s got a new book out, and the Justice Department wants to make sure he never collects his royalties. Nate explains. I’m just relieved that I will be able to read it without having to shoplift it. And it seems to be an episode for challenges, as I offer Snowden a chance to be interviewed on the podcast—anytime, anywhere, Ed!

Matthew Heiman explains the latest NotPeya travail for FedEx: A shareholder suit alleging that the company failed to disclose how much damage the malware caused to its ongoing business. 

Evan Abrams gives a hint about the contents of Treasury’s 300-page opus incorporating Congress’s overhaul of CFIUS into the CFR.

I credit David for inspiring my piece questioning how long end-to-end commercial encryption is going to last, and we note that even the New York Times seems to be questioning whether Silicon Valley’s latest enthusiasm is actually good for the world.

Matthew tells us that China may have a new tool in the trade war—or at least to keep companies toeing the party line: The government is assigning social credit scores to businesses. 

Finally, Matthew outlines France’s OG take on international law and cyber conflict. France opens up some distance between its views and those of the United States, but everyone will get a chance to talk at even greater length on the topic, as the U.N. gears up two different bodies to engage in yet another round of cyber-norm-building.

Download the 280th Episode (mp3). 

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

In our 279th episode of The Cyberlaw Podcast, the Blockchain Group takes over the podcast. Host Alan Cohn is joined by Gary Goldsholle, Will Turner and Evan Abrams to discuss:

• The SEC has issued its second token-related no-action letter to Pocketful of Quarters, Inc., giving more guidance and opening a number of issues.
• The SEC has brought a double-headed complaint against ICOBOX, an entity that both conducted an initial coin offering (ICO) and facilitated ICOs for others.
• The US has brought the Financial Action Task Force along on its travel rule adventure.
• The SEC and FINRA have custody guidance.
• FinCEN has guidance on convertible virtual currencies.
• The SEC has brought a complaint against FantasyCoin for what amounts to sheer, brazen fraud.
• The SEC settlement in SimplyVital Health, with Steptoe as counsel, shows the SEC’s willingness to work with companies that voluntarily remediate errors.

Download the 279th Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

Joel Trachtman thinks it’s a near certainty that the World Trade Organization agreements will complicate U.S. efforts to head off an Internet of Things cybersecurity meltdown, and there’s a real possibility that a U.S. cybersecurity regime could be held to violate our international trade obligations. Claire Schachter and I dig into the details of the looming disaster and how to avoid it.

In the news, Paul Rosenzweig analyzes the Ninth Circuit holding that scraping publicly available information doesn’t violate the CFAA.

The California legislature has adjourned, leaving behind a smoking ruin where Silicon Valley’s business models used to be. Mark MacCarthy elaborates: One new law would force companies like Uber and Lyft (and a boatload more) to treat workers as employees, not contractors. Another set of votes has left the California Consumer Privacy Act more or less unscathed as its 2020 effective date looms. Really, it’s beginning to look as though even California hates Silicon Valley. 

Klon Kitchen and I discuss the latest round of U.S. sanctions on North Korean hacking groups. The sanctions won’t hit anyone in North Korea, but they might affect a few of their enablers on the Internet. The real question, though, is this: Since sanctions violations are punishable even when they aren’t intentional, will U.S. companies whose money is stolen by the Lazarus Group be penalized for having engaged in a prohibited transaction with a sanctioned party? Maybe the Lazarus Group should steal a license too, just to be sure. 

Klon also lays out in chilling detail what the Russians were really trying to do to Ukraine’s grid—and the growing risk that someone is going to launch a destructive cyberattack that leads to a cycle of serious real-world violence. The drone attack on Saudi oil facilities shows how big that risk can be. 

Paul examines reports that Israel planted spy devices near the White House. He thinks it says more about the White House than about Israel.

Paul also reports on one of the unlikelier escapades of students from his alma mater: Trading 15 minutes at the keyboard for a lifetime of trouble on their permanent records. The lesson? If you try to access the president’s tax data online, you’re going to jail, prank or not.

I walk back the deepfake voice scam story, but Klon points out that it reflects a future that is coming for U.S. soon, if not today.

Proving the old adage about a fool for a lawyer, the Mar-a-Lago trespasser has been found guilty after an ineffective pro se defense.

Klon digs into the long and thoughtful op-ed by NSA’s Glenn Gerstell about the effects of the “digital revolution” on national security.

I note the recent Carnegie report trying to move the encryption debate forward. I also plug my upcoming speech in Israel on the topic. 

Download the 278th Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

Camille Stewart talks about a little-known national security risk: China’s propensity to acquire U.S. technology through the bankruptcy courts and the many ways in which the bankruptcy system isn’t set up to combat improper tech transfers. Published by the Journal of National Security Law & Policy, Camille’s paper is available here. Camille has enjoyed great success in her young career working with the Transformative Cyber Innovation Lab at the Foundation for Defense of Democracies, as a Cybersecurity Policy Fellow at New America, and as a 2019 Cyber Security Woman of the Year, among other achievements. We talk at the end of the session about life and advancement as an African American woman in cybersecurity.

Want to hear more from Camille on this topic? She’ll be speaking Friday, Sept. 13, at a lunch event hosted by the Foundation for Defense of Democracies (FDD). She’ll be joined by fellow panelists Giovanna Cinelli, Jamil Jaffer and Harvey Rishikof, along with moderator Dr. Samantha Ravich. The event will be livestreamed at www.fdd.org/events. If you would like to learn more about the event, please contact Abigail Barnes at FDD. If you are a member of the press, please direct your inquiries to [email protected].

In the News Roundup, Maury Shenk tells us that UK courts have so far resisted a sustained media narrative that all facial recognition tech is inherently evil. Americans seem to agree, Matthew Heiman notes, since a majority trust law enforcement to use it responsibly. Which is more than you can say for Silicon Valley, which only 36 percent of Americans trust with the technology.

Mieke Eoyang and I talk about the Department of Homeland Security’s plan to use fake identities to view publicly available social media postings and the conflict with social media sites’ terms of service. I am unsympathetic, given the need for operational security in conducting such reviews, but we agree that DHS is biting off more than it can chew, especially in languages other than English. But really, DHS, how clueless can you be when your list of social media to be scrutinized includes three-years-dead Vine but not TikTok, which Mieke notes ironically is “what all the kids are using these days.”

Maury brings us up to speed on EU plans for the tech sector, which will be familiar to Brits contemplating the EU’s plan for them. And speaking of EU hypocrisy and incoherence (we were, weren’t we?), Erin Egan of Facebook has written a paper on data portability that deserves more attention, since it’s impossible to square the EU’s snit over Cambridge Analytica with its sanctifying of the principle of “data portability.” The paper also calls out the Federal Trade Commission for slamming Facebook for Cambridge Analytica while Commissioner Noah Phillips is warning that restrictions on data transfers can be anticompetitive. I promise to invite the commissioner on the podcast again to explore that issue.

Well, that was quick: Fraudsters used AI to mimic a CEO’s voice—accent, “melody” and all—in an unusual cybercrime case. Anyone can do this now, Maury explains. I tell listeners how to tell whether my voice has been AI-napped in future episodes.

In short hits, Mieke and I mock Denmark’s appointment of an “ambassador” to Silicon Valley. Way to cut the Valley down to size, Denmark! Maury notes that FinFisher is under investigation for violating EU export control law by selling spyware. Mieke does her best to rebut my suggestion that Silicon Valley’s bias is showing in the latest actuarial stat: It turns out that 10 percent of the accounts that President Trump has retweeted have been deplatformed. Matthew and I note that China has been caught hacking several Asian telecomm companies to spy on Uighurs. Of course, if the U.S. had 5,000 citizens fighting for the Islamic State and al-Qaeda, as China claims to have, we’d probably be hacking all the same companies. State attorneys general will launch sweeping and apparently bipartisan antitrust probes into Facebook and Google this week. Good to see Silicon Valley bringing Rs and Ds together at last; who says its business model is social division? Finally, Mieke leaves us uneasy about the online security of our pensions, as hackers steal $4.2 million from one fund via compromised email.

Download the 277th Episode (mp3). 

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

In this bonus episode of the Cyberlaw Podcast, Alex Stamos of Stanford’s Freeman Spogli Institute talks about the Institute’s recent paper on the risk of Chinese social media interference with Taiwan’s upcoming presidential election. It’s a wide-ranging discussion of everything from a century of Chinese history to the reasons why WeChat lost a social media competition in Taiwan to a Japanese company. Along the way, Alex notes that efforts to identify foreign government election interference have been seriously degraded by (what else?) privacy law, mixed with fear of commercial consequences when China is the attacker. If companies make data about foreign government and “inauthentic” users public, the risk of liability under GDPR as well as Chinese retaliation is real, and the benefits go more to the nation as a whole rather than to the companies taking the risk.

During the interview, Alex references a paper co-authored by his colleague, Jennifer Pan, regarding the “50c party.” You can find that paper here. He also mentions his recent op-ed in Lawfare, which you can find here.

Download the 276th Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.