In our last episode before the August break, the Cyberlaw Podcast drills down on the AI  industry leaders’ trip to Washington, where they dutifully signed up to what Gus Hurwitz calls “a bag of promises.” Gus and I parse the promises, some of which are empty, others of which have substance. Along the way, we examine the  EU’s struggling campaign to lobby other countries to adopt its AI regulation framework. Really, guys, if you don’t want to be called regulatory neocolonialists, maybe you shouldn’t go around telling former European colonies to change their laws to match Europe’s. Jeffery Atik picks up the AI baton, unpacking Senate Majority Leader Chuck Schumer’s (D-N.Y.)  overhyped set of AI amendments to the National Defense Authorization Act (NDAA), and panning  authors’ claim that AI models have been “stealing” their works. Also this week, another endless and unjustified claim of high-tech infringement came to a likely close with  appellate rejection of the argument that linking to a site violates the site’s copyright. We also cover the industry’s unfortunately well-founded  fear of enabling face recognition and Meta’s  unusual open-source AI strategy. Richard Stiennon pulls the podcast back to the National Cybersecurity Implementation Plan, which I praised last episode for its disciplined format. Richard introduces us to an Atlantic Council report allowing several domain experts  to mark up the text. This exposes flaws not apparent on first read; it turns out that the implementation plan took a few remarkable dives, even omitting all mention of one of the strategy’s more ambitious goals.   Gus gives us a regulatory lawyer’s take on the  FCC’s new cybersecurity label for IoT devices and the  EPA’s beleaguered regulations for water system cybersecurity. He doubts that either program can be grounded in a grant of regulatory jurisdiction. Richard points out that CISA  managed to get new cybersecurity concessions from Microsoft without even a pretense of regulatory jurisdiction.  Gus gives us a quick assessment of the  latest DOJ/FTC draft merger review guidelines. He thinks it’s an overreach that will tarnish the prestige and persuasiveness of the guidelines. In quick hits:   Richard updates us on the latest U.S. sanctions on  European spyware firms. I offer a dissent from the whole campaign.   Jeffery covers the  brain drain in semiconductors from Europe to China, and we ask when it will hit the U.S.    Gus covers the latest technopanic and media handwringing over the use of technology to catch  serial killers and  drug dealers.   Speaking of technopanics, I question the latest narrative expressing shock that an FBI agent searched the 702 database   Download 469th Episode (mp3) You can subscribe to The Cyberlaw Podcast using  iTunes,  Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@gmail.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

In our last episode before the August break, the Cyberlaw Podcast drills down on the AI <a href="https://www.marketscreener.com/quote/stock/FORTUM-OYJ-1412461/news/Fortum-s-Russian-business-to-be-renamed-Forward-Energo-after-seizure-company-44402034/" rel="nofollow" target="_blank"> industry leaders’ trip to Washington</a>, where they dutifully signed up to what <a href="https://www.law.upenn.edu/faculty/ghurwitz" rel="nofollow" target="_blank">Gus Hurwitz</a> calls “a bag of promises.” Gus and I parse the promises, some of which are empty, others of which have substance. Along the way, we examine the <a href="https://www.reuters.com/technology/eus-ai-lobbying-blitz-gets-lukewarm-response-asia-officials-2023-07-17/?utm_source=pocket_saves" rel="nofollow" target="_blank"> EU’s struggling campaign</a> to lobby other countries to adopt its AI regulation framework. Really, guys, if you don’t want to be called regulatory neocolonialists, maybe you shouldn’t go around telling former European colonies to change their laws to match Europe’s. <a href="https://www.lls.edu/faculty/facultylista-b/jefferyatik/" rel="nofollow" target="_blank">Jeffery Atik</a> picks up the AI baton, unpacking Senate Majority Leader Chuck Schumer’s (D-N.Y.) <a href="https://www.washingtonpost.com/politics/2023/07/20/senators-look-tuck-ai-social-media-into-huge-defense-bill/?utm_source=pocket_saves" rel="nofollow" target="_blank"> overhyped set of AI amendments</a> to the National Defense Authorization Act (NDAA), and panning <a href="https://techcrunch.com/2023/07/18/thousands-of-authors-sign-letter-urging-ai-makers-to-stop-stealing-books/?utm_source=pocket_saves" rel="nofollow" target="_blank"> authors’ claim</a> that AI models have been “stealing” their works. Also this week, another endless and unjustified claim of high-tech infringement came to a likely close with <a href="https://torrentfreak.com/instagram-not-liable-for-copyright-infringement-over-embedded-images-230718/?utm_source=pocket_saves" rel="nofollow" target="_blank"> appellate rejection of</a> the argument that linking to a site violates the site’s copyright. We also cover the industry’s unfortunately well-founded <a href="https://www.nytimes.com/2023/07/18/technology/openai-chatgpt-facial-recognition.html?utm_source=pocket_saves" rel="nofollow" target="_blank"> fear of enabling face recognition</a> and Meta’s <a href="https://www.nytimes.com/2023/07/18/technology/meta-ai-open-source.html?utm_source=pocket_saves" rel="nofollow" target="_blank"> unusual open-source AI strategy</a>. <a href="https://it-harvest.com/" rel="nofollow" target="_blank">Richard Stiennon</a> pulls the podcast back to the National Cybersecurity Implementation Plan, which I praised last episode for its disciplined format. Richard introduces us to an Atlantic Council report allowing several domain experts <a href="https://dfrlab.org/2023/07/18/national-cybersecurity-strategy-implementation-plan-markup/?utm_source=pocket_saves" rel="nofollow" target="_blank"> to mark up the text</a>. This exposes flaws not apparent on first read; it turns out that the implementation plan took a few remarkable dives, even omitting all mention of one of the strategy’s more ambitious goals.   Gus gives us a regulatory lawyer’s take on the <a href="https://www.theverge.com/2023/7/18/23798153/fcc-cyber-trust-mark-biden-security" rel="nofollow" target="_blank"> FCC’s new cybersecurity label for IoT devices</a> and the <a href="https://therecord.media/epa-water-utilities-cybersecurity-rule-appeals-court-decision?utm_source=pocket_saves" rel="nofollow" target="_blank"> EPA’s beleaguered regulations for water system cybersecurity</a>. He doubts that either program can be grounded in a grant of regulatory jurisdiction. Richard points out that CISA <a href="https://therecord.media/cisa-microsoft-expands-access-to-logging-tools-after-data-breach?utm_source=pocket_saves" rel="nofollow" target="_blank"> managed to get new cybersecurity concessions from Microsoft</a> without even a pretense of regulatory jurisdiction.  Gus gives us a quick assessment of the <a href="https://www.cnn.com/2023/07/19/business/biden-administration-mergers-potential-changes-ftc-doj/?utm_source=pocket_saves" rel="nofollow" target="_blank"> latest DOJ/FTC draft merger review guidelines</a>. He thinks it’s an overreach that will tarnish the prestige and persuasiveness of the guidelines. In quick hits: <ul> <li> Richard updates us on the latest U.S. sanctions on <a href="https://www.wsj.com/articles/european-spyware-firms-threaten-global-security-and-privacy-u-s-says-ca86c35f?mod=djemalertNEWS&amp;utm_source=pocket_saves" rel="nofollow" target="_blank"> European spyware firms.</a> I offer a dissent from the whole campaign. </li> <li> Jeffery covers the <a href="https://www.bloomberg.com/news/newsletters/2023-07-19/china-s-semiconductor-ambitions-fuel-european-brain-drain?utm_source=pocket_saves" rel="nofollow" target="_blank"> brain drain in semiconductors from Europe to China</a>, and we ask when it will hit the U.S.  </li> <li> Gus covers the latest technopanic and media handwringing over the use of technology to catch <a href="https://urldefense.com/v3/__https:/www.schneier.com/blog/archives/2023/07/tracking-down-a-suspect-through-cell-phone-records.html?utm_source=pocket_saves__;!!ApXA7kLm!3K_8le9PIM-7AQ3E7pK1vnMDtqRLxrotcVh6buhR-5Gn6FtplG94iuSaxCUQ1JGml1kv4l0aVRWLm3c$" rel="nofollow" target="_blank"> serial killers</a> and <a href="https://www.forbes.com/sites/thomasbrewster/2023/07/17/license-plate-reader-ai-criminal/?sh=6c8e1663ccc9&amp;utm_source=pocket_saves" rel="nofollow" target="_blank"> drug dealers</a>. </li> <li> Speaking of technopanics, I question the latest narrative expressing shock that an FBI <a href="https://www.forbes.com/sites/thomasbrewster/2023/07/17/license-plate-reader-ai-criminal/?sh=6c8e1663ccc9&amp;utm_source=pocket_saves" rel="nofollow" target="_blank">agent searched the 702 database</a> </li> </ul> <a href="https://www.steptoe.com/podcasts/TheCyberlawPodcast-469.mp3" rel="nofollow" target="_blank">Download 469th Episode (mp3)</a> You can subscribe to The Cyberlaw Podcast using <a href="https://itunes.apple.com/us/podcast/steptoe-cyberlaw-podcast/id830593115?mt=2" rel="nofollow" target="_blank"> iTunes</a>, <a href="https://play.google.com/music/listen#/ps/Ikx2d2ncjvw6zuoq3zh4qp2i7qu" rel="nofollow" target="_blank"> Google Play</a>, <a href="https://open.spotify.com/show/3Co2wdTUaZr4Xqnlxs4soG" rel="nofollow" target="_blank">Spotify</a>, <a href="http://pcasts.in/steptoe" rel="nofollow" target="_blank">Pocket Casts</a>, or our <a href="http://www.steptoe.com/feed-Cyberlaw.rss" rel="nofollow" target="_blank">RSS feed.</a> As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with <a href="https://twitter.com/stewartbaker" rel="nofollow" target="_blank">@stewartbaker</a> on Twitter. Send your questions, comments, and suggestions for topics or interviewees to <a href="mailto:CyberlawPodcast@gmail.com">CyberlawPodcast@gmail.com</a>. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

AI Leaders Bring Washington a Bag of Promises

This episode of the Cyberlaw Podcast kicks off with a stinging defeat for the Federal Trade Commission (FTC), which could not persuade the courts to suspend the Microsoft-Activision Blizzard acquisition. Mark MacCarthy says that the FTC’s loss will pave the way for a complete victory for Microsoft, as other jurisdictions trim their sails. We congratulate Brad Smith, Microsoft’s President, whose policy smarts likely helped to construct this win. Meanwhile, the FTC is still doubling down on its determination to pursue aggressive legal theories. Maury Shenk explains  the agency’s investigation of OpenAI, which raises issues not usually associated with consumer protection. Mark and Maury argue that this is just a variation of the tactic that made the FTC the de facto privacy regulator in the U.S. I ask why policing ChatGPT’s hallucinatory libel problem constitutes consumer protection, and they answer, plausibly, that libel is a kind of deception, which the FTC does have authority to police. Mark then helps us drill down on the  Associated Press deal licensing its archives to OpenAI, a deal that may turn out to be good for both companies. Nick Weaver and I try to make sense of  the district court ruling that Ripple’s XRP is a regulated investment contract when provided to sophisticated buyers but not when sold to retail customers in the market. It is  hard to say that it makes policy sense, since the securities laws are there to protect the retail customers more than sophisticated buyers. But it does seem to be at least temporary good news for the cryptocurrency exchanges, who now have a basis for offering what the SEC has been calling an unregistered security. And it’s clearly bad news for the SEC, which may not be able to litigate its way to the Cryptopocalypse it has been pursuing. Andy Greenberg makes a guest appearance to discuss  his WIRED story about the still mysterious mechanism by which Chinese cyberspies acquired the ability to  forge Microsoft authentication tokens.  Maury tells us why Meta’s Twitter-killer, Threads, won’t be available soon in Europe. That leads me to reflect on just how disastrously Brussels has managed the EU’s economy. Fifteen years ago, the  U.S. and EU had roughly similar GDPs, at about $15 trillion each. Now the EU GDP has scarcely grown, while U.S. GCP is close to $25 trillion. It’s hard to believe that EU tech policy hasn’t contributed to this continental impoverishment, which Maury points out is even making Brexit look good.  Maury also explains the  French police drive to get explicit authority to conduct surveillance through cell phones. Nick offers his take on FISA section 702 reform. Stories. And Maury evaluates  Amazon’s challenge to new EU content rules, which he thinks have more policy than legal appeal. Not content with his takedown of the Ripple decision, Nick reviews all the criminal cases in which cryptocurrency enthusiasts are embroiled. These include a Chinese bust of  Multichain, the  sentencing of Variety Jones for his role in the Silk Road crime market, and  the arrest of Alex Mashinsky, CEO of the cryptocurrency exchange Celsius. Finally, in quick hits,    Mark and I duel over the lawsuit claiming that  Texas’s TikTok Ban on government phones will threaten academic freedom.   I praise the surprisingly good  National Cybersecurity-Strategy Implementation Plan and puzzle over the decision not to  nominate the acting head of that office to head the office permanently.   And I note that the Allow States and Victims to Fight Online Sex Trafficking Act, also known as FOSTA-SESTA, reviled by the left, has  withstood a constitutional challenge in the DC Circuit.   Download 468th Episode (mp3) You can subscribe to The Cyberlaw Podcast using iTunes,  Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@gmail.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

This episode of the Cyberlaw Podcast kicks off with a stinging defeat for the Federal Trade Commission (FTC), which <a>could not persuade the courts</a> to suspend the Microsoft-Activision Blizzard acquisition. <a href="https://cbpp.georgetown.edu/people/mark-maccarthy/" rel="nofollow" target="_blank">Mark MacCarthy</a> says that the FTC’s loss will pave the way for a complete victory for Microsoft, as other jurisdictions trim their sails. We congratulate Brad Smith, Microsoft’s President, whose policy smarts likely helped to construct this win. Meanwhile, the FTC is still doubling down on its determination to pursue aggressive legal theories. <a href="https://www.steptoe.com/en/lawyers/maury-shenk.html" rel="nofollow" target="_blank">Maury Shenk</a> explains <a href="https://urldefense.com/v3/__https:/www.washingtonpost.com/technology/2023/07/13/ftc-openai-chatgpt-sam-altman-lina-khan/?utm_source=pocket_saves__;!!ApXA7kLm!1MMleloFuwbfw8bXS_qtwkcLew3u-YFa9bQV9G-0wRjh4Swsqu_CmYr09AuWtTF-FhBdDEh6vbwlmnX39qSnsw$" rel="nofollow" target="_blank"> the agency’s investigation of OpenAI</a>, which raises issues not usually associated with consumer protection. Mark and Maury argue that this is just a variation of the tactic that made the FTC the de facto privacy regulator in the U.S. I ask why policing ChatGPT’s hallucinatory libel problem constitutes consumer protection, and they answer, plausibly, that libel is a kind of deception, which the FTC does have authority to police. Mark then helps us drill down on the <a href="https://urldefense.com/v3/__https:/apnews.com/article/openai-chatgpt-associated-press-ap-f86f84c5bcc2f3b98074b38521f5f75a__;!!ApXA7kLm!2VOqeVg5pQ_hMzPDaLLasPyDIgO7sL12YwOJnt5lzPdZLw4YcszKl7pJ3CTzO5mrGE8AooQb79mcnaMuM_0v6w$" rel="nofollow" target="_blank"> Associated Press deal licensing its archives to OpenAI</a>, a deal that may turn out to be good for both companies. <a href="https://www.linkedin.com/in/nicholas-weaver-13893644/" rel="nofollow" target="_blank">Nick Weaver</a> and I try to make sense of <a href="https://urldefense.com/v3/__https:/www.washingtonpost.com/business/2023/07/13/crypto-ripple-sec-regulation-securities/?utm_source=pocket_saves__;!!ApXA7kLm!1MMleloFuwbfw8bXS_qtwkcLew3u-YFa9bQV9G-0wRjh4Swsqu_CmYr09AuWtTF-FhBdDEh6vbwlmnVLDm0yXw$" rel="nofollow" target="_blank"> the district court ruling that Ripple’s XRP is a regulated investment contract</a> when provided to sophisticated buyers but not when sold to retail customers in the market. It is <a href="https://lawprofessors.typepad.com/business_law/2023/07/so-ripple.html" rel="nofollow" target="_blank"> hard to say that it makes policy sense</a>, since the securities laws are there to protect the retail customers more than sophisticated buyers. But it does seem to be at least temporary good news for the cryptocurrency exchanges, who now have a basis for offering what the SEC has been calling an unregistered security. And it’s clearly bad news for the SEC, which may not be able to litigate its way to the Cryptopocalypse it has been pursuing. <a href="https://www.wired.com/author/andy-greenberg/" rel="nofollow" target="_blank">Andy Greenberg</a> makes a guest appearance to discuss <a href="https://urldefense.com/v3/__https:/www.wired.com/story/microsoft-cloud-attack-china-hackers/?utm_source=pocket_saves__;!!ApXA7kLm!1MMleloFuwbfw8bXS_qtwkcLew3u-YFa9bQV9G-0wRjh4Swsqu_CmYr09AuWtTF-FhBdDEh6vbwlmnUR_10qpA$" rel="nofollow" target="_blank"> his WIRED story</a> about the still mysterious mechanism by which Chinese cyberspies acquired the ability to <a href="https://urldefense.com/v3/__https:/www.securityweek.com/chinese-cyberspies-used-forged-authentication-tokens-to-hack-government-emails/?utm_source=pocket_saves__;!!ApXA7kLm!1MMleloFuwbfw8bXS_qtwkcLew3u-YFa9bQV9G-0wRjh4Swsqu_CmYr09AuWtTF-FhBdDEh6vbwlmnWXtMKB3g$" rel="nofollow" target="_blank"> forge Microsoft authentication tokens</a>.  Maury tells us why Meta’s Twitter-killer, Threads<a href="https://urldefense.com/v3/__https:/techcrunch.com/2023/07/14/meta-is-blocking-eu-based-users-from-accessing-threads-via-vpn/?utm_source=pocket_saves__;!!ApXA7kLm!1MMleloFuwbfw8bXS_qtwkcLew3u-YFa9bQV9G-0wRjh4Swsqu_CmYr09AuWtTF-FhBdDEh6vbwlmnVn7bvgVA$" rel="nofollow" target="_blank">, won’t be available soon in Europe</a>. That leads me to reflect on just how disastrously Brussels has managed the EU’s economy. Fifteen years ago, the <a href="https://www.wsj.com/articles/europeans-poorer-inflation-economy-255eb629?mod=hp_lead_pos7" rel="nofollow" target="_blank"> U.S. and EU had roughly similar GDPs</a>, at about $15 trillion each. Now the EU GDP has scarcely grown, while U.S. GCP is close to $25 trillion. It’s hard to believe that EU tech policy hasn’t contributed to this continental impoverishment, which Maury points out is even making Brexit look good.  Maury also explains the <a href="https://urldefense.com/v3/__https:/www.schneier.com/blog/archives/2023/07/french-police-will-be-able-to-spy-on-people-through-their-cell-phones.html?utm_source=pocket_saves__;!!ApXA7kLm!1MMleloFuwbfw8bXS_qtwkcLew3u-YFa9bQV9G-0wRjh4Swsqu_CmYr09AuWtTF-FhBdDEh6vbwlmnXAYDjnmg$" rel="nofollow" target="_blank"> French police drive to get explicit authority to conduct surveillance through cell phones</a>. Nick offers his take on FISA section 702 reform. Stories. And Maury evaluates <a href="https://urldefense.com/v3/__https:/www.cnbc.com/2023/07/11/amazon-launches-first-us-challenge-to-eu-content-rules.html?utm_source=pocket_saves__;!!ApXA7kLm!1MMleloFuwbfw8bXS_qtwkcLew3u-YFa9bQV9G-0wRjh4Swsqu_CmYr09AuWtTF-FhBdDEh6vbwlmnXMEeuUPQ$" rel="nofollow" target="_blank"> Amazon’s challenge to new EU content rules</a>, which he thinks have more policy than legal appeal. Not content with his takedown of the Ripple decision, Nick reviews all the criminal cases in which cryptocurrency enthusiasts are embroiled. These include a Chinese bust of <a href="https://urldefense.com/v3/__https:/www.theblock.co/post/239589/multichain-ceases-operations-as-ceos-sister-is-detained-in-china-while-holding-220-million-of-funds?utm_source=pocket_saves__;!!ApXA7kLm!1MMleloFuwbfw8bXS_qtwkcLew3u-YFa9bQV9G-0wRjh4Swsqu_CmYr09AuWtTF-FhBdDEh6vbwlmnViyGaFdA$" rel="nofollow" target="_blank"> Multichain,</a> the <a href="https://urldefense.com/v3/__https:/therecord.media/silk-road-mentor-variety-jones-sentenced-to-20-years?utm_source=pocket_saves__;!!ApXA7kLm!1MMleloFuwbfw8bXS_qtwkcLew3u-YFa9bQV9G-0wRjh4Swsqu_CmYr09AuWtTF-FhBdDEh6vbwlmnUhKL-wwg$" rel="nofollow" target="_blank"> sentencing of Variety Jones</a> for his role in the Silk Road crime market, and <a href="https://www.nytimes.com/2023/07/13/business/celsius-cryptocurrency-founder-arrested.html" rel="nofollow" target="_blank"> the arrest of Alex Mashinsky, CEO of the cryptocurrency exchange Celsius</a>. Finally, in quick hits,  <ul> <li> Mark and I duel over the lawsuit claiming that <a href="https://urldefense.com/v3/__https:/www.nytimes.com/2023/07/13/business/texas-tiktok-ban-challenge.html?utm_source=pocket_saves__;!!ApXA7kLm!1MMleloFuwbfw8bXS_qtwkcLew3u-YFa9bQV9G-0wRjh4Swsqu_CmYr09AuWtTF-FhBdDEh6vbwlmnUFRSMsiw$" rel="nofollow" target="_blank"> Texas’s TikTok Ban on government phones will threaten academic freedom</a>. </li> <li> I praise the surprisingly good <a href="https://urldefense.com/v3/__https:/www.whitehouse.gov/wp-content/uploads/2023/07/National-Cybersecurity-Strategy-Implementation-Plan-WH.gov_.pdf?utm_source=pocket_saves__;!!ApXA7kLm!1MMleloFuwbfw8bXS_qtwkcLew3u-YFa9bQV9G-0wRjh4Swsqu_CmYr09AuWtTF-FhBdDEh6vbwlmnVOnbZJQw$" rel="nofollow" target="_blank"> National Cybersecurity-Strategy Implementation Plan</a> and puzzle over the decision not to <a href="https://urldefense.com/v3/__https:/therecord.media/oncd-acting-director-kemba-walden-told-she-will-not-receive-nomination?utm_source=pocket_saves__;!!ApXA7kLm!1MMleloFuwbfw8bXS_qtwkcLew3u-YFa9bQV9G-0wRjh4Swsqu_CmYr09AuWtTF-FhBdDEh6vbwlmnWOetD7WA$" rel="nofollow" target="_blank"> nominate the acting head of that office</a> to head the office permanently. </li> <li> And I note that the Allow States and Victims to Fight Online Sex Trafficking Act, also known as FOSTA-SESTA, reviled by the left, has <a href="https://urldefense.com/v3/__https:/www.law360.com/technology/articles/1697284?nl_pk=ba937d35-603d-43df-b094-ca4dcdcccf39&amp;nlaidx=6&amp;nlsidx=0&amp;read_more=1&amp;utm_source=pocket_saves__;!!ApXA7kLm!1MMleloFuwbfw8bXS_qtwkcLew3u-YFa9bQV9G-0wRjh4Swsqu_CmYr09AuWtTF-FhBdDEh6vbwlmnXMENogug$" rel="nofollow" target="_blank"> withstood a constitutional challenge in the DC Circuit</a>. </li> </ul> <a href="https://www.steptoe.com/podcasts/TheCyberlawPodcast-468.mp3" rel="nofollow" target="_blank">Download 468th Episode (mp3)</a> You can subscribe to The Cyberlaw Podcast using <a href="https://itunes.apple.com/us/podcast/steptoe-cyberlaw-podcast/id830593115?mt=2" rel="nofollow" target="_blank">iTunes</a>, <a href="https://play.google.com/music/listen#/ps/Ikx2d2ncjvw6zuoq3zh4qp2i7qu" rel="nofollow" target="_blank"> Google Play</a>, <a href="https://open.spotify.com/show/3Co2wdTUaZr4Xqnlxs4soG" rel="nofollow" target="_blank">Spotify</a>, <a href="http://pcasts.in/steptoe" rel="nofollow" target="_blank">Pocket Casts</a>, or our <a href="http://www.steptoe.com/feed-Cyberlaw.rss" rel="nofollow" target="_blank">RSS feed.</a> As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with <a href="https://twitter.com/stewartbaker" rel="nofollow" target="_blank">@stewartbaker</a> on Twitter. Send your questions, comments, and suggestions for topics or interviewees to <a href="mailto:CyberlawPodcast@gmail.com">CyberlawPodcast@gmail.com</a>. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

The FTC Doubles Down, Down, Down

It’s surely fitting that a decision released on July 4 would set off fireworks on the Cyberlaw Podcast. The source of the drama was  U.S. District Court Judge Terry Doughty’s injunction prohibiting multiple federal agencies from leaning on social media platforms to suppress speech the agencies don’t like. Megan Stifel, Paul Rosenzweig, and I could not disagree more about the decision, which seems quite justified to me, given the aggressive White House communications telling the platforms whose speech the government wanted suppressed. Paul and Megan argue that it’s not censorship, that the judge got standing law wrong, and that I ought to invite a few content moderation aficionados on for a full hour episode on the topic.   That all comes after a much less lively review of recent stories on artificial intelligence. Sultan Meghji downplays  OpenAI’s claim that they’ve taken a step forward in preventing the emergence of a “misaligned”—in other words evil—superintelligence. We note what may be  the first real-life “liar’s dividend” from deep faked voice. Even more interesting is the prospect that large language models will end up poisoning themselves by  consuming their own waste—that is, by being trained on recent internet discourse that includes large volumes of text created by earlier models. That might stall progress in AI, Sultan suggests. But not, I predict before government regulation tries to do the same; as witness, New York City’s law  requiring companies that use AI in hiring to disclose all the evidence needed to sue them for discrimination. Also vying to load large language models with rent-seeking demands are Big Content lawyers. Sultan and I try to  separate the few legitimate intellectual property claims against AI from the many bogus ones.  I channel a recent New York gubernatorial candidate in opining that the rent-seeking is too damn high.  Paul dissects China’s most recent and self-defeating effort to deter the West from decoupling from Chinese supply chains. It looks as though China was so eager to punish the West that it  rolled out supply chain penalties  before it had the leverage to make the punishment stick. Speaking of self-defeating Chinese government policies, it looks as though the government’s two-minute hate directed  at China’s fintech giants is coming to an end. Sultan walks us through the wreckage of the American cryptocurrency industry, pausing to note the  executive exodus from Binance and the end of the view that cryptocurrency could be squared with U.S. regulatory authorities. Not in this administration, and maybe not in any, and outcome that will delay financial modernization here for years. I renew my promise to get Gus Coldebella on the podcast to see if he can turn the tide of negativism.  In quick hits and updates:   There’s an effort afoot to  amend the National Defense Authorization Act  to prevent American government agencies, and only American government agencies, from buying data available to everyone else. We are skeptical that it will pass.    The EU and the U.S. have  reached a (third) transatlantic data transfer deal, and just in time for Meta, which was facing a  new set of competition attacks on its data protection compliance.   And Canada, which already looks ineffectual for passing a link tax that led Facebook and Google to simply drop links to Canadian media, now looks ineffectual and petty, announcing it has pulled its paltry advertising  budget from Facebook.   Oh, and last year’s social media villain is this year’s social media hero, at least on the left, as Meta launches Threads and threatens Twitter’s hopes for a recovery.   Download 467th Episode (mp3) You can subscribe to The Cyberlaw Podcast using  iTunes,  Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@gmail.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

It’s surely fitting that a decision released on July 4 would set off fireworks on the Cyberlaw Podcast. The source of the drama was <a href="https://www.washingtonpost.com/documents/75e9f7a3-da4e-45af-8430-6eeba37eaf9f.pdf?itid=lk_interstitial_manual_30" rel="nofollow" target="_blank"> U.S. District Court Judge Terry Doughty’s injunction</a> prohibiting multiple federal agencies from leaning on social media platforms to suppress speech the agencies don’t like. <a href="https://securityandtechnology.org/team/core-team/megan-stifel-2/" rel="nofollow" target="_blank">Megan Stifel,</a> <a href="http://redbranchconsulting.com/" rel="nofollow" target="_blank">Paul Rosenzweig,</a> and I could not disagree more about the decision, which seems quite justified to me, given the aggressive White House communications telling the platforms whose speech the government wanted suppressed. Paul and Megan argue that it’s not censorship, that the judge got standing law wrong, and that I ought to invite a few content moderation aficionados on for a full hour episode on the topic.   That all comes after a much less lively review of recent stories on artificial intelligence. <a href="https://carnegieendowment.org/experts/1778" rel="nofollow" target="_blank">Sultan Meghji</a> downplays <a href="https://techcrunch.com/2023/07/05/openai-is-forming-a-new-team-to-bring-superintelligent-ai-under-control/?utm_source=pocket_saves" rel="nofollow" target="_blank"> OpenAI’s claim</a> that they’ve taken a step forward in preventing the emergence of a “misaligned”—in other words evil—superintelligence. We note what may be <a href="https://restofworld.org/2023/indian-politician-leaked-audio-ai-deepfake/?utm_source=pocket_saves" rel="nofollow" target="_blank"> the first real-life “liar’s dividend” from deep faked voice</a>. Even more interesting is the prospect that large language models will end up poisoning themselves by <a href="https://www.lightbluetouchpaper.org/2023/06/06/will-gpt-models-choke-on-their-own-exhaust/?utm_source=pocket_saves" rel="nofollow" target="_blank"> consuming their own waste</a>—that is, by being trained on recent internet discourse that includes large volumes of text created by earlier models. That might stall progress in AI, Sultan suggests. But not, I predict before government regulation tries to do the same; as witness, New York City’s law <a href="https://www.wsj.com/articles/new-york-city-starts-to-regulate-ai-used-in-hiring-tools-79a2260f?mod=djemalertNEWS&amp;utm_source=pocket_saves" rel="nofollow" target="_blank"> requiring companies that use AI in hiring to disclose</a> all the evidence needed to sue them for discrimination. Also vying to load large language models with rent-seeking demands are Big Content lawyers. Sultan and I try to <a href="https://www.financialexpress.com/business/blockchain-generative-ai-and-intellectual-property-rights-an-uneasy-co-existence-3126312/" rel="nofollow" target="_blank"> separate the few legitimate intellectual property claims against AI from the many bogus ones</a>.  I channel a recent New York gubernatorial candidate in opining that <a href="https://en.wikipedia.org/wiki/Jimmy_McMillan" rel="nofollow" target="_blank">the rent-seeking is too damn high</a>.  Paul dissects China’s most recent and self-defeating effort to deter the West from decoupling from Chinese supply chains. It looks as though China was so eager to punish the West that it <a href="https://www.reuters.com/markets/commodities/china-adviser-warns-chipmaking-export-curbs-are-just-start-yellen-visit-looms-2023-07-05/?utm_source=pocket_saves" rel="nofollow" target="_blank"> rolled out supply chain penalties</a> <a href="https://www.reuters.com/technology/tsmc-does-not-expect-direct-production-impact-chinas-metal-export-curbs-2023-07-06/?utm_source=pocket_saves" rel="nofollow" target="_blank"> before it had the leverage</a> to make the punishment stick. Speaking of self-defeating Chinese government policies, it looks as though the government’s two-minute hate directed <a href="https://www.bloomberg.com/news/articles/2023-07-07/china-ends-probe-of-jack-ma-backed-ant-with-984-million-fine?leadSource=reddit_wall&amp;utm_source=pocket_saves" rel="nofollow" target="_blank"> at China’s fintech giants is coming to an end</a>. Sultan walks us through the wreckage of the American cryptocurrency industry, pausing to note the <a href="https://fortune.com/crypto/2023/07/06/binance-crisis-executives-quit-changpeng-zhao-justice-department/" rel="nofollow" target="_blank"> executive exodus from Binance</a> and the end of the view that cryptocurrency could be squared with U.S. regulatory authorities. Not in this administration, and maybe not in any, and outcome that will delay financial modernization here for years. I renew my promise to get <a href="https://www.linkedin.com/in/coldebella/" rel="nofollow" target="_blank">Gus Coldebella</a> on the podcast to see if he can turn the tide of negativism.  In quick hits and updates: <ul> <li> There’s an effort afoot to <a href="https://www.wired.com/story/ndaa-2023-davidson-jacobs-fourth-amendment/?utm_source=pocket_saves" rel="nofollow" target="_blank"> amend the National Defense Authorization Act</a>  to prevent American government agencies, and only American government agencies, from buying data available to everyone else. We are skeptical that it will pass.  </li> <li> The EU and the U.S. have <a href="https://www.politico.eu/article/eu-signs-off-on-data-transfers-deal-with-us/" rel="nofollow" target="_blank"> reached a (third) transatlantic data transfer deal</a>, and just in time for Meta, which was facing a <a href="https://techcrunch.com/2023/07/04/cjeu-meta-superprofiling-decision/?utm_source=pocket_saves" rel="nofollow" target="_blank"> new set of competition attacks</a> on its data protection compliance. </li> <li> And Canada, which already looks ineffectual for passing a link tax that led Facebook and Google to simply drop links to Canadian media, now looks ineffectual and petty, announcing it has pulled its paltry advertising <a href="https://www.bloomberg.com/news/articles/2023-07-05/canada-suspends-ads-on-facebook-instagram-in-feud-over-new-law?leadSource=reddit_wall&amp;utm_source=pocket_saves" rel="nofollow" target="_blank"> budget from Facebook</a>. </li> <li> Oh, and last year’s social media villain is this year’s social media hero, at least on the left, as Meta launches Threads and threatens Twitter’s hopes for a recovery. </li> </ul> <a href="https://www.steptoe.com/podcasts/TheCyberlawPodcast-467.mp3" rel="nofollow" target="_blank">Download 467th Episode (mp3)</a> You can subscribe to The Cyberlaw Podcast using <a href="https://itunes.apple.com/us/podcast/steptoe-cyberlaw-podcast/id830593115?mt=2" rel="nofollow" target="_blank"> iTunes</a>, <a href="https://play.google.com/music/listen#/ps/Ikx2d2ncjvw6zuoq3zh4qp2i7qu" rel="nofollow" target="_blank"> Google Play</a>, <a href="https://open.spotify.com/show/3Co2wdTUaZr4Xqnlxs4soG" rel="nofollow" target="_blank">Spotify</a>, <a href="http://pcasts.in/steptoe" rel="nofollow" target="_blank">Pocket Casts</a>, or our <a href="http://www.steptoe.com/feed-Cyberlaw.rss" rel="nofollow" target="_blank">RSS feed.</a> As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with <a href="https://twitter.com/stewartbaker" rel="nofollow" target="_blank">@stewartbaker</a> on Twitter. Send your questions, comments, and suggestions for topics or interviewees to <a href="mailto:CyberlawPodcast@gmail.com">CyberlawPodcast@gmail.com</a>. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

District Judge’s Injunction Sets Off Fireworks

Geopolitics has always played a role in prosecuting hackers. But it’s getting a lot more complicated, as Kurt Sanger reports. Responding to a U.S. request, a Russian cybersecurity executive  has been arrested in Kazakhstan, accused of having hacked Dropbox and Linkedin more than ten years ago. The executive, Nikita Kislitsin, has been hammered by geopolitics in that time. The firm he joined after the alleged hacking, Group IB, has seen its CEO arrested by Russia for treason—probably for getting too close to U.S. investigators. Group IB sold off all its Russian assets and moved to Singapore, while Kislitsin stayed behind, but showed up in Kazakhstan recently, perhaps as a result of the Ukraine war. Now both Russia and the U.S. have dueling extradition requests before the Kazakh authorities; Paul Stephan points out that Kazakhstan’s tenuous independence from Russia will be tested by the tug of war.  In more hacker geopolitics, Kurt and  Justin Sherman examine  the hacking of a Russian satellite communication system that served military and civilian users. It’s reminiscent of the Viasat hack that complicated Ukrainian communications, and a bunch of unrelated commercial services, when Russia invaded. Kurt explores the law of war issues raised by an attack with multiple impacts. Justin and I consider the claim that the Wagner group carried it out as part of their aborted protest march on Moscow. We end up thinking that this makes more sense as the Ukrainians serving up revenge for Viasat at a time when it might complicate Russian’s response to the Wagner group.  But when it’s hacking and geopolitics, who really knows? Paul outlines the legal theory—and antitrust nostalgia—behind the  FTC’s planned lawsuit targeting Amazon’s exploitation of its sales platform. We also ask whether the FTC will file the case in court or before the FTC’s own administrative law judge. The latter may smooth the lawsuit’s early steps, but it will also bring to the fore arguments that Lina Khan should recuse herself because she’s already expressed a view on the issues to be raised by the lawsuit. I’m not Chairman Khan’s biggest fan, but I don’t see why her policy views should lead to recusal; they are, after all, why she was appointed in the first place. Justin and I cover the  latest Chinese law raising the risk of doing business in that country by adopting a vague and sweeping view of espionage.  Paul and I try to straighten out the EU’s apparently endless series of laws governing data, from General Data Protection Regulation (GDPR) and the AI Act to the  Data Act (not to be confused with the Data Governance Act). This week, Paul summarizes the Data Act, which sets the terms for access and control over nonpersonal data. It’s based on a plausible idea—that government can unleash the value of data by clarifying and making fair the rules for who can use data in new businesses. Of course, the EU is unable to resist imposing its own views of fairness, thus upsetting existing commercial arrangements without really providing any certainty about what will replace them. The outcome is likely to reduce, not improve, the certainty that new data businesses want.  Speaking of which, that’s the critique of the AI Act now being offered by dozens of European business executives, whose  open letter slams the way the AI Act kludged the regulation of generative AI into a framework where it didn’t really fit. They accuse the European Parliament of “wanting to anchor the regulation of generative AI in law and proceeding with a rigid compliance logic [that] is as bureaucratic …  as it is ineffective in fulfilling its purpose.” And you thought I was the EU-basher.  Justin recaps an Indian court’s rejection of Twitter’s lawsuit challenging the Indian government’s orders to block users who’ve earned the government’s ire. Kurt covers a matching story about whether Facebook  should suspend Hun Sen’s Facebook account for threatening users with violence. I take us to Nigeria and question why social media thinks governments can be punished for threatening violence. Finally, in two updates,   I note that  Google has joined Facebook in calling Canada’s bluff by refusing to link to Canadian news media in order to avoid the Canadian link tax.    And I do a victory lap for the Cyberlaw Podcast’s Amber Alert feature. One week after we nominated the Commerce Department’s IT supply chain security program for an Amber Alert, the Department answered the call by posting the supply chain czar position in USAJOBS.   Download 466th Episode (mp3) You can subscribe to The Cyberlaw Podcast using iTunes,  Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@gmail.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Geopolitics has always played a role in prosecuting hackers. But it’s getting a lot more complicated, as <a href="https://www.linkedin.com/in/kurt-sanger-311970115/" rel="nofollow" target="_blank">Kurt Sanger</a> reports. Responding to a U.S. request, a Russian cybersecurity executive <a href="https://krebsonsecurity.com/2023/06/russian-cybersecurity-executive-arrested-for-alleged-role-in-2012-megahacks/?utm_source=pocket_saves" rel="nofollow" target="_blank"> has been arrested in Kazakhstan</a>, accused of having hacked Dropbox and Linkedin more than ten years ago. The executive, Nikita Kislitsin, has been hammered by geopolitics in that time. The firm he joined after the alleged hacking, Group IB, has seen its CEO arrested by Russia for treason—probably for getting too close to U.S. investigators. Group IB sold off all its Russian assets and moved to Singapore, while Kislitsin stayed behind, but showed up in Kazakhstan recently, perhaps as a result of the Ukraine war. Now both Russia and the U.S. have dueling extradition requests before the Kazakh authorities; <a href="https://www.law.virginia.edu/faculty/profile/pbs/1211911" rel="nofollow" target="_blank">Paul Stephan</a> points out that Kazakhstan’s tenuous independence from Russia will be tested by the tug of war.  In more hacker geopolitics, Kurt and <a href="https://www.globalcyberstrategies.com/#:~:text=Global%20Cyber%20Strategies%20is%20a%20Washington%2C%20DC-based%20research,Project%20Strategizing%205%20Communications%20Planning%206%20Expert%20Network" rel="nofollow" target="_blank"> Justin Sherman</a> examine <a href="https://therecord.media/hackers-take-down-russian-satellite-provider?utm_source=pocket_saves" rel="nofollow" target="_blank"> the hacking of a Russian satellite communication system</a> that served military and civilian users. It’s reminiscent of the Viasat hack that complicated Ukrainian communications, and a bunch of unrelated commercial services, when Russia invaded. Kurt explores the law of war issues raised by an attack with multiple impacts. Justin and I consider the claim that the Wagner group carried it out as part of their aborted protest march on Moscow. We end up thinking that this makes more sense as the Ukrainians serving up revenge for Viasat at a time when it might complicate Russian’s response to the Wagner group.  But when it’s hacking and geopolitics, who really knows? Paul outlines the legal theory—and antitrust nostalgia—behind the  <a href="https://arstechnica.com/tech-policy/2023/06/ftc-prepares-the-big-one-a-major-lawsuit-targeting-amazons-core-business/?utm_source=pocket_saves" rel="nofollow" target="_blank">FTC’s planned lawsuit targeting Amazon’s exploitation of its sales platform.</a> We also ask whether the FTC will file the case in court or before the FTC’s own administrative law judge. The latter may smooth the lawsuit’s early steps, but it will also bring to the fore arguments that Lina Khan should recuse herself because she’s already expressed a view on the issues to be raised by the lawsuit. I’m not Chairman Khan’s biggest fan, but I don’t see why her policy views should lead to recusal; they are, after all, why she was appointed in the first place. Justin and I cover the <a href="https://www.wsj.com/articles/new-chinese-law-raises-risks-for-american-firms-in-china-u-s-officials-say-cf62c1a0?mod=hp_lead_pos10&amp;utm_source=pocket_saves" rel="nofollow" target="_blank"> latest Chinese law</a> raising the risk of doing business in that country by adopting a vague and sweeping view of espionage.  Paul and I try to straighten out the EU’s apparently endless series of laws governing data, from General Data Protection Regulation (GDPR) and the AI Act to the <a href="https://www.consilium.europa.eu/en/press/press-releases/2023/06/27/data-act-council-and-parliament-strike-a-deal-on-fair-access-to-and-use-of-data/?source=email&amp;utm_source=pocket_saves" rel="nofollow" target="_blank"> Data Act</a> (not to be confused with the Data Governance Act). This week, Paul summarizes the Data Act, which sets the terms for access and control over nonpersonal data. It’s based on a plausible idea—that government can unleash the value of data by clarifying and making fair the rules for who can use data in new businesses. Of course, the EU is unable to resist imposing its own views of fairness, thus upsetting existing commercial arrangements without really providing any certainty about what will replace them. The outcome is likely to reduce, not improve, the certainty that new data businesses want.  Speaking of which, that’s the critique of the AI Act now being offered by dozens of European business executives, whose <a href="https://www.theverge.com/2023/6/30/23779611/eu-ai-act-open-letter-artificial-intelligence-regulation-renault-siemens" rel="nofollow" target="_blank"> open letter</a> slams the way the AI Act kludged the regulation of generative AI into a framework where it didn’t really fit. They accuse the European Parliament of “wanting to anchor the regulation of generative AI in law and proceeding with a rigid compliance logic [that] is as bureaucratic …  as it is ineffective in fulfilling its purpose.” And you thought I was the EU-basher.  Justin recaps an <a href="https://techcrunch.com/2023/06/29/court-dismisses-twitter-plea-against-india-government/?utm_source=pocket_saves" rel="nofollow" target="_blank">Indian court’s rejection of Twitter’s lawsui</a>t challenging the Indian government’s orders to block users who’ve earned the government’s ire. Kurt covers a matching story about whether Facebook <a href="https://www.washingtonpost.com/world/2023/06/29/meta-hun-sen-cambodia-suspended-accounts/?utm_source=pocket_saves" rel="nofollow" target="_blank"> should suspend Hun Sen’s Facebook account for threatening users with violence.</a> I take us to Nigeria and question why social media thinks governments can be punished for threatening violence. Finally, in two updates, <ul> <li> I note that <a href="https://blog.google/intl/en-ca/company-news/outreach-initiatives/an-update-on-canadas-bill-c-18-and-our-search-and-news-products/?utm_source=pocket_saves" rel="nofollow" target="_blank"> Google has joined Facebook</a> in calling Canada’s bluff by refusing to link to Canadian news media in order to avoid the Canadian link tax.  </li> <li> And I do a victory lap for the Cyberlaw Podcast’s Amber Alert feature. One week after we nominated the Commerce Department’s IT supply chain security program for an Amber Alert, the Department answered the call by <a href="https://www.usajobs.gov/job/734298700?utm_source=pocket_saves" rel="nofollow" target="_blank">posting the supply chain czar position in USAJOBS</a>. </li> </ul> <a href="https://www.steptoe.com/podcasts/TheCyberlawPodcast-466.mp3" rel="nofollow" target="_blank">Download 466th Episode (mp3)</a> You can subscribe to The Cyberlaw Podcast using <a href="https://itunes.apple.com/us/podcast/steptoe-cyberlaw-podcast/id830593115?mt=2" rel="nofollow" target="_blank">iTunes</a>, <a href="https://play.google.com/music/listen#/ps/Ikx2d2ncjvw6zuoq3zh4qp2i7qu" rel="nofollow" target="_blank"> Google Play</a>, <a href="https://open.spotify.com/show/3Co2wdTUaZr4Xqnlxs4soG" rel="nofollow" target="_blank">Spotify</a>, <a href="http://pcasts.in/steptoe" rel="nofollow" target="_blank">Pocket Casts</a>, or our <a href="http://www.steptoe.com/feed-Cyberlaw.rss" rel="nofollow" target="_blank">RSS feed.</a> As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with <a href="https://twitter.com/stewartbaker" rel="nofollow" target="_blank">@stewartbaker</a> on Twitter. Send your questions, comments, and suggestions for topics or interviewees to <a href="mailto:CyberlawPodcast@gmail.com">CyberlawPodcast@gmail.com</a>. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

The Geopolitics of Extraditing Hackers

Max Schrems

Stewart Baker

Max Schrems is the lawyer and activist behind two (and, probably soon, a third) legal challenge to the adequacy of U.S. law to protect European personal data. Thanks to the Federalist Society’s Regulatory Transparency Project, Max and I were able to spend an hour debating the law and policy behind Europe’s generation-long fight with the United States over transatlantic data flows.  It’s civil, pointed, occasionally raucous, and wide-ranging – a fun, detailed introduction to the issues that will almost certainly feature in the next round of litigation over the latest agreement between Europe and the U.S. Don’t miss it! Download 465th Episode (mp3) You can subscribe to The Cyberlaw Podcast using  iTunes,  Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@gmail.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

<a href="https://www.linkedin.com/in/max-schrems/?originalSubdomain=at" rel="nofollow" target="_blank">Max Schrems</a> is the lawyer and activist behind two (and, probably soon, a third) legal challenge to the adequacy of U.S. law to protect European personal data. Thanks to the <a href="https://rtp.fedsoc.org/" rel="nofollow" target="_blank">Federalist Society’s Regulatory Transparency Project,</a> Max and I were able to spend an hour debating the law and policy behind Europe’s generation-long fight with the United States over transatlantic data flows.  It’s civil, pointed, occasionally raucous, and wide-ranging – a fun, detailed introduction to the issues that will almost certainly feature in the next round of litigation over the latest agreement between Europe and the U.S. Don’t miss it! <a href="https://www.steptoe.com/podcasts/TheCyberlawPodcast-465.mp3" rel="nofollow" target="_blank">Download 465th Episode (mp3)</a> You can subscribe to The Cyberlaw Podcast using <a href="https://itunes.apple.com/us/podcast/steptoe-cyberlaw-podcast/id830593115?mt=2" rel="nofollow" target="_blank"> iTunes</a>, <a href="https://play.google.com/music/listen#/ps/Ikx2d2ncjvw6zuoq3zh4qp2i7qu" rel="nofollow" target="_blank"> Google Play</a>, <a href="https://open.spotify.com/show/3Co2wdTUaZr4Xqnlxs4soG" rel="nofollow" target="_blank">Spotify</a>, <a href="http://pcasts.in/steptoe" rel="nofollow" target="_blank">Pocket Casts</a>, or our <a href="http://www.steptoe.com/feed-Cyberlaw.rss" rel="nofollow" target="_blank">RSS feed.</a> As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with <a href="https://twitter.com/stewartbaker" rel="nofollow" target="_blank">@stewartbaker</a> on Twitter. Send your questions, comments, and suggestions for topics or interviewees to <a href="mailto:CyberlawPodcast@gmail.com">CyberlawPodcast@gmail.com</a>. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Stewart Baker and Max Schrems Debate the Privacy Framework

Sen. Schumer (D-N.Y.) has announced an  ambitious plan to produce a bipartisan AI regulation program in a matter of months. Jordan Schneider admires the project; I’m more skeptical. The rest of our commentators, Chessie Lockhart and Michael Ellis, also weigh in on AI issues. Chessie lays out the case against panicking over existential AI threats, this week  canvassed in the MIT Technology Review. I suggest that anyone complaining that the EU or China is getting ahead of the U.S. in AI regulation (lookin’ at you, Sen. Warner!) doesn’t quite understand the race we’re running. Jordan explains the difficulty the U.S. faces in  trying to keep China from surprising us in AI. Michael catches us up on  Canada’s ill-advised effort to force Google and Meta to pay Canadian media whenever a user links to a Canadian story. Meta has already said it would rather end such links. The end result could be that even more Canadian news gets filtered through American media, hardly a popular outcome north of the border. Speaking of ill-advised regulatory initiatives, Michael and I comment on Australia’s  threatening Twitter with a fine for allowing too much hate speech on the platform post-Elon.   Chessie gives an overview of the  Data Elimination and Limiting Extensive Tracking and Exchange Act or the DELETE Act, a relatively modest bipartisan effort to regulate data brokers’ control of personal data. Michael and I talk about the  growing tension between EU member states with real national security tasks to complete and the Brussels establishment, which has enjoyed a 70-year holiday from national security history and expects the next 70 to be more of the same. The latest conflict is over  how much leeway to give member states when they feel the need to plant spyware on journalists’ phones. Remarkably, both sides think the government should have such leeway; the fight is over how much.   Michael and I are surprised that the BBC feels obliged to ask, “Why is it so rare to hear about Western cyber-attacks?” Because, BBC, the agencies carrying out those attacks are on our side and mostly respect rules we support. In updates and quick hits:   I bring listeners up to date on how things turned out for the lawyers who filed a ChatGPT-hallucinated brief in federal court:  Not well.    Chessie flags the creation of a new Justice Department section in the National Security Division:  Natsec Cyber   Chessie also welcomes the growing recognition,  some of it in cold, hard cash, for  cyber security clinics.    Download 464th Episode (mp3)  You can subscribe to The Cyberlaw Podcast using  iTunes,  Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@gmail.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Sen. Schumer (D-N.Y.) has announced an <a href="https://www.washingtonpost.com/technology/2023/06/21/ai-regulation-us-senate-chuck-schumer/?utm_source=pocket_saves" rel="nofollow" target="_blank"> ambitious plan</a> to produce a bipartisan AI regulation program in a matter of months. <a href="https://rhg.com/" rel="nofollow" target="_blank">Jordan Schneider</a> admires the project; I’m more skeptical. The rest of our commentators, <a href="https://www.strausscenter.org/person/francesca-lockhart/" rel="nofollow" target="_blank">Chessie Lockhart</a> and <a href="https://www.heritage.org/staff/michael-j-ellis" rel="nofollow" target="_blank">Michael Ellis,</a> also weigh in on AI issues. Chessie lays out the case against panicking over existential AI threats, this week <a href="https://www.technologyreview.com/2023/06/19/1075140/how-existential-risk-became-biggest-meme-in-ai/" rel="nofollow" target="_blank"> canvassed in the MIT Technology Review</a>. I suggest that anyone complaining that the EU or China is getting ahead of the U.S. in AI regulation (<a href="https://www.politico.com/news/2023/06/15/senate-intelligence-chair-china-leads-the-world-on-ai-rules-00102168?utm_source=pocket_saves" rel="nofollow" target="_blank">lookin’ at you, Sen. Warner</a>!) doesn’t quite understand the race we’re running. Jordan explains the difficulty the U.S. faces in <a href="https://www.wsj.com/articles/u-s-grapples-with-potential-threats-from-chinese-ai-7d1f2e70?mod=djemalertNEWS&amp;utm_source=pocket_saves" rel="nofollow" target="_blank"> trying to keep China from surprising us</a> in AI. Michael catches us up on <a href="https://nationalpost.com/news/politics/showdown-looming-as-online-news-bill-is-about-to-become-law" rel="nofollow" target="_blank"> Canada’s ill-advised effort</a> to force Google and Meta to pay Canadian media whenever a user links to a Canadian story. Meta has already said it would rather end such links. The end result could be that even more Canadian news gets filtered through American media, hardly a popular outcome north of the border. Speaking of ill-advised regulatory initiatives, Michael and I comment on Australia’s <a href="https://www.washingtonpost.com/world/2023/06/22/australia-elon-musk-twitter-hate/?utm_source=pocket_saves" rel="nofollow" target="_blank"> threatening Twitter with a fine</a> for allowing too much hate speech on the platform post-Elon.   Chessie gives an overview of the <a href="https://therecord.media/delete-act-reintroduced-congress-data-brokers" rel="nofollow" target="_blank"> Data Elimination and Limiting Extensive Tracking and Exchange Act or the DELETE Act</a>, a relatively modest bipartisan effort to regulate data brokers’ control of personal data. Michael and I talk about the <a href="https://therecord.media/delete-act-reintroduced-congress-data-brokers" rel="nofollow" target="_blank"> growing tension</a> between EU member states with real national security tasks to complete and the Brussels establishment, which has enjoyed a 70-year holiday from national security history and expects the next 70 to be more of the same. The latest conflict is over <a href="https://therecord.media/european-council-agrees-on-reduced-journalist-protections" rel="nofollow" target="_blank"> how much leeway to give member states</a> when they feel the need to plant spyware on journalists’ phones. Remarkably, both sides think the government should have such leeway; the fight is over how much.   Michael and I are surprised that the BBC feels obliged to ask, “<a href="https://www.bbc.com/news/technology-65977742" rel="nofollow" target="_blank">Why is it so rare to hear about Western cyber-attacks?</a>” Because, BBC, the agencies carrying out those attacks are on our side and mostly respect rules we support. In updates and quick hits: <ul> <li> I bring listeners up to date on how things turned out for the lawyers who filed a ChatGPT-hallucinated brief in federal court: <a href="https://www.law360.com/technology/articles/1691963?nl_pk=ba937d35-603d-43df-b094-ca4dcdcccf39&amp;nlaidx=0&amp;nlsidx=0&amp;utm_source=pocket_saves" rel="nofollow" target="_blank"> Not well</a>.  </li> <li> Chessie flags the creation of a new Justice Department section in the National Security Division: <a href="https://therecord.media/doj-national-security-division-new-cybercrimes-section" rel="nofollow" target="_blank"> Natsec Cyber</a> </li> <li> Chessie also welcomes the growing recognition, <a href="https://urldefense.com/v3/__https:/www.axios.com/2023/06/23/google-cybersecurity-clinics-20m-investment__;!!ApXA7kLm!yiS3lWc_uj93P-lE0PB_O_hh4vXIAvVzNTT_YBF-eoFWxG9i7udNt0mWc0THay-mGFi8sEkLR_fKGSkzNw6NUuoNUD9mwQcwrw$" rel="nofollow" target="_blank"> some of it in cold, hard cash</a>, for <a href="https://urldefense.com/v3/__https:/www.wired.com/story/ut-austin-cybersecurity-clinic-311/__;!!ApXA7kLm!yiS3lWc_uj93P-lE0PB_O_hh4vXIAvVzNTT_YBF-eoFWxG9i7udNt0mWc0THay-mGFi8sEkLR_fKGSkzNw6NUuoNUD-D6XR9ig$" rel="nofollow" target="_blank"> cyber security clinics</a>.  </li> </ul> <a href="https://www.steptoe.com/podcasts/TheCyberlawPodcast-464.mp3" rel="nofollow" target="_blank">Download 464th Episode (mp3)</a> You can subscribe to The Cyberlaw Podcast using <a href="https://itunes.apple.com/us/podcast/steptoe-cyberlaw-podcast/id830593115?mt=2" rel="nofollow" target="_blank"> iTunes</a>, <a href="https://play.google.com/music/listen#/ps/Ikx2d2ncjvw6zuoq3zh4qp2i7qu" rel="nofollow" target="_blank"> Google Play</a>, <a href="https://open.spotify.com/show/3Co2wdTUaZr4Xqnlxs4soG" rel="nofollow" target="_blank">Spotify</a>, <a href="http://pcasts.in/steptoe" rel="nofollow" target="_blank">Pocket Casts</a>, or our <a href="http://www.steptoe.com/feed-Cyberlaw.rss" rel="nofollow" target="_blank">RSS feed.</a> As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with <a href="https://twitter.com/stewartbaker" rel="nofollow" target="_blank">@stewartbaker</a> on Twitter. Send your questions, comments, and suggestions for topics or interviewees to <a href="mailto:CyberlawPodcast@gmail.com">CyberlawPodcast@gmail.com</a>. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Sen. Schumer Tackles AI Regulation

Senator Ron Wyden (D-Ore.) is to moral panics over privacy what Andreessen Horowitz is to cryptocurrency startups. He’s constantly trying to blow life into them, hoping to justify new restrictions on government or private uses of data. His latest crusade is against the intelligence community’s purchase of behavioral data, which is generally available to everyone from Amazon to the GRU. He has launched his campaign several times, introducing legislation, holding up Avril Haines’s confirmation over the issue, and extracting a  Director of National Intelligence report on the topic that has now been declassified. It was a sober and reasonable explanation of why commercial data is valuable for intelligence purposes, so naturally WIRED magazine’s headline summary was, “The U.S. Is Openly Stockpiling Dirt on All Its Citizens.” Matthew Heiman takes us through the story, sparking a debate that pulls in Michael Karanicolas and Cristin Flynn Goodwin. Next, Michael explains  IBM’s announcement that it has made a big step forward in quantum computing.  Meanwhile, Cristin tells us, the EU has taken another incremental step forward in  producing its AI Act—mainly by piling even more demands on artificial intelligence companies. We debate whether Europe can be a leader in AI regulation if it has no AI industry. (I think it makes the whole effort easier, pointing to a  Stanford study suggesting that every AI model we’ve seen is already in violation of the AI Act’s requirements.) Michael and I discuss  a story claiming persuasively that an Amazon driver’s allegation of racism led to an Amazon customer being booted out of his own “smart” home system for days. This leads us to the question of how Silicon Valley’s many “local” monopolies enable its unaccountable power to  dish out punishment to customers it doesn’t approve of. Matthew recaps the administration’s effort to turn the debate over renewal of section 702 of FISA. This week, it rolled out some impressive claims about the cyber value of 702, including  identifying the Colonial Pipeline attackers (and getting back some of the ransom). It also introduced yet another set of FBI reforms designed to ensure that agents face career consequences for breaking the rules on accessing 702 data.  Cristin and I  award North Korea the “Most Improved Nation State Hacker” prize for the decade, as the country triples its cryptocurrency thefts and shows real talent for social engineering and supply chain exploits. Meanwhile, the Russians who are likely behind Anonymous Sudan decided to embarrass Microsoft with a  DDOS attack on its application level. The real puzzle is what Russia gains from the stunt.  Finally, in updates and quick hits, we give deputy national cyber director Rob Knake a fond sendoff, as he  moves to the private sector, we anticipate an important competition decision in a couple of months as the FTC tries to stop  the Microsoft-Activision Blizzard merger in court, and I speculate on what could be a Very Big Deal – the  possible breakup of Google’s adtech business. Download 463rd Episode (mp3)  You can subscribe to The Cyberlaw Podcast using  iTunes,  Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@gmail.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Senator Ron Wyden (D-Ore.) is to moral panics over privacy what Andreessen Horowitz is to cryptocurrency startups. He’s constantly trying to blow life into them, hoping to justify new restrictions on government or private uses of data. His latest crusade is against the intelligence community’s purchase of behavioral data, which is generally available to everyone from Amazon to the GRU. He has launched his campaign several times, introducing legislation, holding up Avril Haines’s confirmation over the issue, and extracting a <a href="https://urldefense.com/v3/__https:/www.odni.gov/files/ODNI/documents/assessments/ODNI-Declassified-Report-on-CAI-January2022.pdf__;!!ApXA7kLm!2V3qMpdFJqZlsgtCbgn9_hpuHjpfO9q7bihvuU1QqfdaRy75x0vhWo-mdqjOwb7HxdBpqBOC6LLs69BkO-WdxdSNAU1v$" rel="nofollow" target="_blank"> Director of National Intelligence report</a> on the topic that has now been declassified. It was a sober and reasonable explanation of why commercial data is valuable for intelligence purposes, so naturally WIRED magazine’s headline summary was, “<a href="https://urldefense.com/v3/__https:/www.wired.com/story/odni-commercially-available-information-report/?utm_source=pocket_saves__;!!ApXA7kLm!2V3qMpdFJqZlsgtCbgn9_hpuHjpfO9q7bihvuU1QqfdaRy75x0vhWo-mdqjOwb7HxdBpqBOC6LLs69BkO-WdxTkmpO2U$" rel="nofollow" target="_blank">The U.S. Is Openly Stockpiling Dirt on All Its Citizens</a>.” <a href="https://fedsoc.org/contributors/matthew-heiman" rel="nofollow" target="_blank">Matthew Heiman</a> takes us through the story, sparking a debate that pulls in Michael Karanicolas and Cristin Flynn Goodwin. Next, Michael explains <a href="https://urldefense.com/v3/__https:/www.nytimes.com/2023/06/14/science/ibm-quantum-computing.html?action=click&amp;module=Well&amp;pgtype=Homepage§ion=Science&amp;utm_source=pocket_saves__;!!ApXA7kLm!2V3qMpdFJqZlsgtCbgn9_hpuHjpfO9q7bihvuU1QqfdaRy75x0vhWo-mdqjOwb7HxdBpqBOC6LLs69BkO-WdxcXPdWM8$" rel="nofollow" target="_blank"> IBM’s announcement</a> that it has made a big step forward in quantum computing.  Meanwhile, Cristin tells us, the EU has taken another incremental step forward in <a href="https://urldefense.com/v3/__https:/www.nytimes.com/2023/06/14/technology/europe-ai-regulation.html?action=click&amp;module=Well&amp;pgtype=Homepage§ion=Technology&amp;utm_source=pocket_saves__;!!ApXA7kLm!2V3qMpdFJqZlsgtCbgn9_hpuHjpfO9q7bihvuU1QqfdaRy75x0vhWo-mdqjOwb7HxdBpqBOC6LLs69BkO-Wdxbhk2QPT$" rel="nofollow" target="_blank"> producing its AI Act</a>—mainly by piling even more demands on artificial intelligence companies. We debate whether Europe can be a leader in AI regulation if it has no AI industry. (I think it makes the whole effort easier, pointing to a <a href="https://urldefense.com/v3/__https:/crfm.stanford.edu/2023/06/15/eu-ai-act.html?utm_source=pocket_saves__;!!ApXA7kLm!2V3qMpdFJqZlsgtCbgn9_hpuHjpfO9q7bihvuU1QqfdaRy75x0vhWo-mdqjOwb7HxdBpqBOC6LLs69BkO-WdxTx4qjpn$" rel="nofollow" target="_blank"> Stanford study</a> suggesting that every AI model we’ve seen is already in violation of the AI Act’s requirements.) Michael and I discuss <a href="https://urldefense.com/v3/__https:/medium.com/@bjax_/a-tale-of-unwanted-disruption-my-week-without-amazon-df1074e3818b__;!!ApXA7kLm!2V3qMpdFJqZlsgtCbgn9_hpuHjpfO9q7bihvuU1QqfdaRy75x0vhWo-mdqjOwb7HxdBpqBOC6LLs69BkO-WdxV61R6mN$" rel="nofollow" target="_blank"> a story</a> claiming persuasively that an Amazon driver’s allegation of racism led to an Amazon customer being booted out of his own “smart” home system for days. This leads us to the question of how Silicon Valley’s many “local” monopolies enable its unaccountable power to <a href="https://urldefense.com/v3/__https:/reason.com/volokh/2023/06/17/smart-home-system-home-system-that-amazon-can-mess-with-if-it-doesnt-like-what-you-say/__;!!ApXA7kLm!2x81hakMILjfPMZaYV8IJD0_em-6-aPDlsfSXZEl_VYxGVnkIsYtbOGdOCbMCT_pH2Tv4_HFWKV5i2YKv0dXFDAO$" rel="nofollow" target="_blank"> dish out punishment</a> to customers it doesn’t approve of. Matthew recaps the administration’s effort to turn the debate over renewal of section 702 of FISA. This week, it rolled out some impressive claims about the cyber value of 702, including <a href="https://urldefense.com/v3/__https:/therecord.media/colonial-pipeline-hack-section-702-surveillance-fbi?utm_source=pocket_saves__;!!ApXA7kLm!2V3qMpdFJqZlsgtCbgn9_hpuHjpfO9q7bihvuU1QqfdaRy75x0vhWo-mdqjOwb7HxdBpqBOC6LLs69BkO-WdxVKTjPwH$" rel="nofollow" target="_blank"> identifying the Colonial Pipeline attackers</a> (and getting back some of the ransom). It also introduced yet another set of FBI reforms designed to ensure that agents face career consequences for breaking the rules on accessing 702 data.  Cristin and I <a href="https://urldefense.com/v3/__https:/www.wsj.com/articles/how-north-koreas-hacker-army-stole-3-billion-in-crypto-funding-nuclear-program-d6fe8782?mod=hp_lead_pos5&amp;utm_source=pocket_saves__;!!ApXA7kLm!2V3qMpdFJqZlsgtCbgn9_hpuHjpfO9q7bihvuU1QqfdaRy75x0vhWo-mdqjOwb7HxdBpqBOC6LLs69BkO-WdxYKO98oe$" rel="nofollow" target="_blank"> award North Korea the “Most Improved Nation State Hacker”</a> prize for the decade, as the country triples its cryptocurrency thefts and shows real talent for social engineering and supply chain exploits. Meanwhile, the Russians who are likely behind Anonymous Sudan decided to embarrass Microsoft with a <a href="https://urldefense.com/v3/__https:/msrc.microsoft.com/blog/2023/06/microsoft-response-to-layer-7-distributed-denial-of-service-ddos-attacks/?utm_source=pocket_saves__;!!ApXA7kLm!2V3qMpdFJqZlsgtCbgn9_hpuHjpfO9q7bihvuU1QqfdaRy75x0vhWo-mdqjOwb7HxdBpqBOC6LLs69BkO-WdxWK1VqoU$" rel="nofollow" target="_blank"> DDOS attack on its application level</a>. The real puzzle is what Russia gains from the stunt.  Finally, in updates and quick hits, we give deputy national cyber director Rob Knake a fond sendoff, as he <a href="https://urldefense.com/v3/__https:/therecord.media/white-house-oncd-cyber-official-rob-knake-to-depart-national-cyber-strategy?utm_source=pocket_saves__;!!ApXA7kLm!2V3qMpdFJqZlsgtCbgn9_hpuHjpfO9q7bihvuU1QqfdaRy75x0vhWo-mdqjOwb7HxdBpqBOC6LLs69BkO-WdxRktyjHn$" rel="nofollow" target="_blank"> moves to the private sector</a>, we anticipate an important competition decision in a couple of months as the FTC tries to stop <a href="https://urldefense.com/v3/__https:/www.theverge.com/2023/6/13/23760192/microsoft-activision-blizzard-tro-granted-ftc-injunction__;!!ApXA7kLm!2V3qMpdFJqZlsgtCbgn9_hpuHjpfO9q7bihvuU1QqfdaRy75x0vhWo-mdqjOwb7HxdBpqBOC6LLs69BkO-WdxZDVKwNt$" rel="nofollow" target="_blank"> the Microsoft-Activision Blizzard merger in court,</a> and I speculate on what could be a Very Big Deal – the <a href="https://urldefense.com/v3/__https:/www.theverge.com/2023/6/14/23759094/european-commission-google-antitrust-advertising-market-antitrust__;!!ApXA7kLm!2V3qMpdFJqZlsgtCbgn9_hpuHjpfO9q7bihvuU1QqfdaRy75x0vhWo-mdqjOwb7HxdBpqBOC6LLs69BkO-WdxX8SAY7Z$" rel="nofollow" target="_blank"> possible breakup of Google’s adtech business</a>. <a href="https://www.steptoe.com/podcasts/TheCyberlawPodcast-463.mp3" rel="nofollow" target="_blank">Download 463rd Episode (mp3)</a> You can subscribe to The Cyberlaw Podcast using <a href="https://itunes.apple.com/us/podcast/steptoe-cyberlaw-podcast/id830593115?mt=2" rel="nofollow" target="_blank"> iTunes</a>, <a href="https://play.google.com/music/listen#/ps/Ikx2d2ncjvw6zuoq3zh4qp2i7qu" rel="nofollow" target="_blank"> Google Play</a>, <a href="https://open.spotify.com/show/3Co2wdTUaZr4Xqnlxs4soG" rel="nofollow" target="_blank">Spotify</a>, <a href="http://pcasts.in/steptoe" rel="nofollow" target="_blank">Pocket Casts</a>, or our <a href="http://www.steptoe.com/feed-Cyberlaw.rss" rel="nofollow" target="_blank">RSS feed.</a> As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with <a href="https://twitter.com/stewartbaker" rel="nofollow" target="_blank">@stewartbaker</a> on Twitter. Send your questions, comments, and suggestions for topics or interviewees to <a href="mailto:CyberlawPodcast@gmail.com">CyberlawPodcast@gmail.com</a>. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Yet Another Synthetic Moral Panic Over Privacy

It was a disastrous week for cryptocurrency in the United States, as the Securities Exchange Commission (SEC)  filed suit against the two biggest exchanges, Binance and Coinbase, on a theory that makes it nearly impossible to run a cryptocurrency exchange that is competitive with overseas exchanges. Nick Weaver lays out the differences between “process crimes” and “crime crimes,” and how they help distinguish the two lawsuits. The SEC action marks the end of an uneasy truce, but not the end of the debate. Both exchanges have the funds for a hundred-million-dollar defense and lobbying campaign. So you can expect to hear more about this issue for years (and years) to come. I touch on two AI regulation stories. First, I found  Mark Andreessen’s post trying to head off AI regulation pretty persuasive until the end, where he said that the risk of bad people using AI for bad things can be addressed by using AI to stop them. Sorry, Mark, it doesn’t work that way. We aren’t stopping the crimes that modern encryption makes possible by throwing more crypto at the culprits.  My nominee for the AI Regulation Hall of Fame, though, goes to Japan, which has decided to address the phony issue of AI copyright infringement by  declaring that it’s a phony issue and there’ll be no copyright liability for their AI industry when they train models on copyrighted content. This is the right answer, but it’s also a brilliant way of borrowing and subverting the EU’s GDPR model (“We regulate the world, and help EU industry too”). If Japan applies this policy to models built and trained in Japan, it will give Japanese AI companies at least an arguable immunity from copyright claims  around the world. Companies will flock to Japan to train their models and build their datasets in relative regulatory certainty. The rest of the world can follow suit or watch their industries set up shop in Japan. It helps, of course, that copyright claims against AI are mostly rent-seeking by Big Content, but this has to be the smartest piece of international AI regulation any jurisdiction has come up with so far. Kurt Sanger, just back from a NATO cyber conference in Estonia, explains why military cyber defenders are  stressing their need for access to the private networks they’ll be defending. Whether they’ll get it, we agree, is another kettle of fish entirely. David Kris turns to public-private cooperation issues in another context. The Cyberspace Solarium Commission  has another report out. It calls on the government to  refresh and rethink the aging orders that regulate how the government deals with the private sector on cyber matters. Kurt and I consider whether Russia is committing war crimes by DDOSing emergency services in Ukraine at the same time as its bombing of Ukrainian cities. We agree that the evidence isn’t there yet.  Nick and I dig into two recent exploits that stand out from the crowd. It turns out that Barracuda’s security appliance has been so badly compromised that  the only remedial measure involve a woodchipper. Nick is confident that the tradecraft here suggests a nation-state attacker. I wonder if it’s also a way to move Barracuda’s customers to the cloud.  The other compromise is  an attack on MOVEit Transfer. The attack on the secure file transfer system has allowed ransomware gang Clop to download so much proprietary data that they have resorted to  telling their victims to self-identify and pay the ransom rather than wait for Clop to figure out who they’ve pawned. Kurt, David, and I talk about  the White House effort to sell section 702 of FISA for its cybersecurity value and  my effort, with Michael Ellis, to sell 702 (packaged with intelligence reform) to a conservative caucus that is newly skeptical of the intelligence community. David finds himself uncomfortably close to endorsing our efforts. Finally, in quick updates:   Nick talks about Tesla’s Full Self Driving,  and the accidents it has been involved in   I warn listeners that Virginia has joined the ranks of states that  require an ID proving age to access Pornhub. I predict that twenty states will adopt such a requirement in the next year   Download 462nd Episode (mp3) You can subscribe to The Cyberlaw Podcast using  iTunes,  Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@gmail.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

It was a disastrous week for cryptocurrency in the United States, as the Securities Exchange Commission (SEC) <a href="https://www.wired.com/story/coinbase-binance-lawsuits-put-crypto-on-ice/?mbid=CRMWIR012019%0A%0A&amp;utm_brand=wired&amp;utm_mailing=WIR_SubPersRec_1_02012020&amp;utm_source=pocket_saves" rel="nofollow" target="_blank"> filed suit against the two biggest exchanges</a>, Binance and Coinbase, on a theory that makes it nearly impossible to run a cryptocurrency exchange that is competitive with overseas exchanges. <a href="https://www.linkedin.com/in/nicholas-weaver-13893644/" rel="nofollow" target="_blank">Nick Weaver</a> lays out the differences between “process crimes” and “crime crimes,” and how they help distinguish the two lawsuits. The SEC action marks the end of an uneasy truce, but not the end of the debate. Both exchanges have the funds for a hundred-million-dollar defense and lobbying campaign. So you can expect to hear more about this issue for years (and years) to come. I touch on two AI regulation stories. First, I found <a href="https://pmarca.substack.com/p/why-ai-will-save-the-world?utm_source=pocket_reader" rel="nofollow" target="_blank"> Mark Andreessen’s post</a> trying to head off AI regulation pretty persuasive until the end, where he said that the risk of bad people using AI for bad things can be addressed by using AI to stop them. Sorry, Mark, it doesn’t work that way. We aren’t stopping the crimes that modern encryption makes possible by throwing more crypto at the culprits.  My nominee for the AI Regulation Hall of Fame, though, goes to Japan, which has decided to address the phony issue of AI copyright infringement by <a href="https://technomancers.ai/japan-goes-all-in-copyright-doesnt-apply-to-ai-training/?utm_source=pocket_saves" rel="nofollow" target="_blank"> declaring</a> that it’s a phony issue and there’ll be no copyright liability for their AI industry when they train models on copyrighted content. This is the right answer, but it’s also a brilliant way of borrowing and subverting the EU’s GDPR model (“We regulate the world, and help EU industry too”). If Japan applies this policy to models built and trained in Japan, it will give Japanese AI companies at least an arguable immunity from copyright claims  around the world. Companies will flock to Japan to train their models and build their datasets in relative regulatory certainty. The rest of the world can follow suit or watch their industries set up shop in Japan. It helps, of course, that copyright claims against AI are mostly rent-seeking by Big Content, but this has to be the smartest piece of international AI regulation any jurisdiction has come up with so far. <a href="https://www.linkedin.com/in/kurt-sanger-311970115/" rel="nofollow" target="_blank">Kurt Sanger,</a> just back from a NATO cyber conference in Estonia, explains why military cyber defenders are <a href="https://therecord.media/nato-peacetime-cyberdefense-david-van-weel-cycon?utm_source=pocket_saves" rel="nofollow" target="_blank"> stressing their need for access</a> to the private networks they’ll be defending. Whether they’ll get it, we agree, is another kettle of fish entirely. <a href="https://culperpartners.com/" rel="nofollow" target="_blank">David Kris</a> turns to public-private cooperation issues in another context. The Cyberspace Solarium Commission <a href="https://cybersolarium.org/csc-2-0-reports/revising-public-private-collaboration-to-protect-u-s-critical-infrastructure/?utm_source=pocket_saves" rel="nofollow" target="_blank"> has another report out</a>. It calls on the government to <a href="https://therecord.media/critical-infrastructure-ppd21-white-house-outdated-cyberspace-solarium-commission?utm_source=pocket_saves" rel="nofollow" target="_blank"> refresh and rethink</a> the aging orders that regulate how the government deals with the private sector on cyber matters. Kurt and I consider whether Russia is committing war crimes by <a href="https://www.wired.com/story/cloudflare-project-galileo-ukraine/" rel="nofollow" target="_blank">DDOSing emergency services in Ukraine</a> at the same time as its bombing of Ukrainian cities. We agree that the evidence isn’t there yet.  Nick and I dig into two recent exploits that stand out from the crowd. It turns out that Barracuda’s security appliance has been so badly compromised that <a href="https://www.bleepingcomputer.com/news/security/barracuda-says-hacked-esg-appliances-must-be-replaced-immediately/?utm_source=pocket_saves" rel="nofollow" target="_blank"> the only remedial measure involve a woodchipper</a>. Nick is confident that the tradecraft here suggests a nation-state attacker. I wonder if it’s also a way to move Barracuda’s customers to the cloud.  The other compromise is <a href="https://www.bleepingcomputer.com/news/security/new-moveit-transfer-zero-day-mass-exploited-in-data-theft-attacks/?utm_source=pocket_saves" rel="nofollow" target="_blank"> an attack on MOVEit Transfer</a>. The attack on the secure file transfer system has allowed ransomware gang Clop to download so much proprietary data that they have resorted to <a href="https://www.bbc.com/news/technology-65829726?utm_source=pocket_saves" rel="nofollow" target="_blank"> telling their victims to self-identify and pay the ransom</a> rather than wait for Clop to figure out who they’ve pawned. Kurt, David, and I talk about <a href="https://cyberscoop.com/white-house-section-702-fisa-surveillance/?utm_source=pocket_saves" rel="nofollow" target="_blank"> the White House effort to sell section 702</a> of FISA for its cybersecurity value and <a href="https://www.washingtonexaminer.com/restoring-america/fairness-justice/house-republicans-should-use-debt-ceiling-playbook-to-reform-the-intelligence-community" rel="nofollow" target="_blank"> my effort, with Michael Ellis</a>, to sell 702 (packaged with intelligence reform) to a conservative caucus that is newly skeptical of the intelligence community. David finds himself uncomfortably close to endorsing our efforts. Finally, in quick updates: <ul> <li> Nick talks about Tesla’s Full Self Driving, <a href="https://urldefense.com/v3/__https:/www.washingtonpost.com/technology/2023/06/10/tesla-autopilot-crashes-elon-musk/__;!!ApXA7kLm!ypki2Z17AoV8stMdFdOjKK-v0WxbwdFozBhxIelZtVoReHQVNs6j16UdWvmCvd4rbBSkNGN4XmGsYa1FebQs0Ao$" rel="nofollow" target="_blank"> and the accidents it has been involved in</a> </li> <li> I warn listeners that <a href="https://lis.virginia.gov/cgi-bin/legp604.exe?231+ful+SB1515" rel="nofollow" target="_blank">Virginia</a> has joined the ranks of states that <a href="https://www.wusa9.com/article/news/local/virginia/porn-age-verification-bill-signed-by-youngkin-in-virginia/65-bedcdfc2-93ee-472a-917f-d53189b83344" rel="nofollow" target="_blank"> require an ID proving age</a> to access Pornhub. I predict that twenty states will adopt such a requirement in the next year </li> </ul> <a href="https://www.steptoe.com/podcasts/TheCyberlawPodcast-462.mp3" rel="nofollow" target="_blank">Download 462nd Episode (mp3)</a> You can subscribe to The Cyberlaw Podcast using <a href="https://itunes.apple.com/us/podcast/steptoe-cyberlaw-podcast/id830593115?mt=2" rel="nofollow" target="_blank"> iTunes</a>, <a href="https://play.google.com/music/listen#/ps/Ikx2d2ncjvw6zuoq3zh4qp2i7qu" rel="nofollow" target="_blank"> Google Play</a>, <a href="https://open.spotify.com/show/3Co2wdTUaZr4Xqnlxs4soG" rel="nofollow" target="_blank">Spotify</a>, <a href="http://pcasts.in/steptoe" rel="nofollow" target="_blank">Pocket Casts</a>, or our <a href="http://www.steptoe.com/feed-Cyberlaw.rss" rel="nofollow" target="_blank">RSS feed.</a> As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with <a href="https://twitter.com/stewartbaker" rel="nofollow" target="_blank">@stewartbaker</a> on Twitter. Send your questions, comments, and suggestions for topics or interviewees to <a href="mailto:CyberlawPodcast@gmail.com">CyberlawPodcast@gmail.com</a>. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Cryptopocalypse

This episode of the Cyberlaw Podcast kicks off with a spirited debate over AI regulation. Mark MacCarthy dismisses  AI researchers’ recent call for attention to the existential risks posed by AI; he thinks it’s a sci-fi  distraction from the real issues that need regulation—copyright, privacy, fraud, and competition. I’m utterly flummoxed by the determination on the left to insist that existential threats are not worth discussing, at least while other, more immediate regulatory proposals have not been addressed. Mark and I cross swords about whether anything on his list really needs new, AI-specific regulation when Big Content is  already pursuing copyright claims in court, the FTC is already primed to look at AI-enabled fraud and monopolization, and privacy harms are still speculative. Paul Rosenzweig reminds us that we are apparently recapitulating a debate being held behind closed doors in the Biden administration. Paul also points to potentially promising research from OpenAI on  reducing AI hallucination. Gus Hurwitz breaks down the week in FTC news. Amazon settled an FTC claim  over children’s privacy and another over security failings  at Amazon’s Ring doorbell operation. The bigger story is the  FTC’s effort to issue a commercial death sentence on Meta’s children’s business for what looks to Gus and me more like a misdemeanor. Meta thinks, with some justice, that the FTC is looking for an excuse to rewrite the 2019 consent decree, something Meta says only a court can do.  Paul flags a batch of China stories:    China’s version of Bloomberg has begun quietly limiting the information about China’s economy that is available to overseas users.    TikTok is accused of storing influencers’ sensitive financial information In China, contrary to its promises.    Malaysia won’t ban Huawei from it 5G network.    The  former Harvard chair convicted of lying about taking Chinese money has been sentenced to just two days in prison.   And another professor charged and then exonerated of commercial espionage has  won the right to sue the FBI for his arrest.   Gus tells us that Microsoft has  effectively lost a data protection case in Ireland and will face a fine of more than $400 million. I seize the opportunity to plug  my upcoming debate with Max Schrems over the Privacy Framework.  Paul is surprised to find  even the State Department rising to the defense of section 702 of Foreign Intelligence Surveillance Act (“FISA").  Gus asks whether  automated tip suggestions should be condemned as “dark patterns” and whether the FTC needs to investigate the New York Times’s stubborn refusal to let him cancel his subscription. He also previews California’s  impending Journalism Preservation Act. Download 461st Episode (mp3) You can subscribe to The Cyberlaw Podcast using  iTunes,  Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@gmail.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

This episode of the Cyberlaw Podcast kicks off with a spirited debate over AI regulation. <a href="https://cbpp.georgetown.edu/people/mark-maccarthy/" rel="nofollow" target="_blank">Mark MacCarthy</a> dismisses <a href="https://www.nytimes.com/2023/05/30/technology/ai-threat-warning.html?utm_source=pocket_saves" rel="nofollow" target="_blank"> AI researchers’ recent call for attention to the existential risks</a> posed by AI; he thinks it’s a sci-fi <a href="https://www.independent.co.uk/tech/rishi-sunak-university-of-oxford-san-francisco-government-people-b2349105.html?utm_source=pocket_saves" rel="nofollow" target="_blank"> distraction from the real issues that need regulation</a>—copyright, privacy, fraud, and competition. I’m utterly flummoxed by the determination on the left to insist that existential threats are not worth discussing, at least while other, more immediate regulatory proposals have not been addressed. Mark and I cross swords about whether anything on his list really needs new, AI-specific regulation when Big Content is <a href="https://www.reuters.com/technology/getty-asks-london-court-stop-uk-sales-stability-ai-system-2023-06-01/" rel="nofollow" target="_blank"> already pursuing copyright claims</a> in court, the FTC is already primed to look at AI-enabled fraud and monopolization, and privacy harms are still speculative. <a href="http://redbranchconsulting.com/" rel="nofollow" target="_blank">Paul Rosenzweig</a> reminds us that we are apparently recapitulating <a href="https://archive.ph/02uwY" rel="nofollow" target="_blank">a debate being held behind closed doors</a> in the Biden administration. Paul also points to potentially promising research from OpenAI on <a href="https://www.cnbc.com/2023/05/31/openai-is-pursuing-a-new-way-to-fight-ai-hallucinations.html" rel="nofollow" target="_blank"> reducing AI hallucination</a>. <a href="http://gushurwitz.net/" rel="nofollow" target="_blank">Gus Hurwitz</a> breaks down the week in FTC news. Amazon settled an FTC claim <a href="https://www.nytimes.com/2023/05/31/technology/amazon-25-million-childrens-privacy.html" rel="nofollow" target="_blank"> over children’s privacy</a> and another over security failings <a href="https://www.bloomberg.com/news/articles/2023-05-31/amazon-settles-with-ftc-over-claims-ring-doorbell-spies-on-users#xj4y7vzkg" rel="nofollow" target="_blank"> at Amazon’s Ring doorbell operation</a>. The bigger story is the <a href="https://www.bloomberg.com/news/articles/2023-05-31/meta-wants-ftc-to-ask-court-to-change-child-privacy-settlement#xj4y7vzkg" rel="nofollow" target="_blank"> FTC’s effort to issue a commercial death sentence</a> on Meta’s children’s business for what looks to Gus and me more like a misdemeanor. Meta thinks, with some justice, that the FTC is looking for an excuse to rewrite the 2019 consent decree, something Meta says only a court can do.  Paul flags a batch of China stories: <ul> <li> <a href="https://www.wsj.com/articles/a-chinese-alternative-to-bloomberg-terminals-quietly-limits-information-overseas-bd98cf5e?mod=djemalertNEWS&amp;utm_source=pocket_saves" rel="nofollow" target="_blank"> China’s version of Bloomberg has begun quietly limiting the information about China’s economy that is available to overseas users.</a> </li> <li> <a href="https://www.forbes.com/sites/alexandralevine/2023/05/30/tiktok-creators-data-security-china/?sh=8ac581170488" rel="nofollow" target="_blank">TikTok is accused of storing influencers’ sensitive financial information In China</a>, contrary to its promises. </li> <li> <a href="https://www.bloomberg.com/news/articles/2023-06-02/malaysia-stays-open-to-chinese-firms-in-5g-network-rollout#xj4y7vzkg" rel="nofollow" target="_blank">Malaysia won’t ban Huawei from it 5G network. </a> </li> <li> The <a href="https://www.thecollegefix.com/former-harvard-chair-who-lied-about-chinese-payoff-sentenced-to-two-days-in-prison/?utm_source=pocket_saves" rel="nofollow" target="_blank"> former Harvard chair convicted of lying about taking Chinese money has been sentenced to just two days in prison</a>. </li> <li> And another professor charged and then exonerated of commercial espionage has <a href="https://www.nbcnews.com/news/asian-america/wrongfully-accused-spying-china-professor-wins-appeal-sue-government-rcna86109?utm_source=pocket_saves" rel="nofollow" target="_blank"> won the right to sue the FBI for his arrest</a>. </li> </ul> Gus tells us that Microsoft has <a href="https://urldefense.com/v3/__https:/www.reuters.com/technology/microsoft-flags-over-400-mln-charge-irish-privacy-violation-fine-linkedin-2023-06-01/__;!!ApXA7kLm!xapm62nfZnpsMbxETuWH0jtq_l-PE82U25Z9jzLy69yBx1ZdYxjI37W695hkEoYaeZpFvmsagx1iv68$" rel="nofollow" target="_blank"> effectively lost a data protection case in Ireland</a> and will face a fine of more than $400 million. I seize the opportunity to plug <a href="https://fedsoc.org/events/transatlantic-debate-evaluating-the-eu-us-data-privacy-framework" rel="nofollow" target="_blank"> my upcoming debate with Max Schrems</a> over the Privacy Framework.  Paul is surprised to find <a href="https://therecord.media/failure-to-renew-surveillance-law-costly-for-us-diplomacy-holgren" rel="nofollow" target="_blank"> even the State Department</a> rising to the defense of section 702 of Foreign Intelligence Surveillance Act (“FISA").  Gus asks whether <a href="https://www.businessinsider.com/starbucks-worker-feels-strange-asking-for-tips-2023-5" rel="nofollow" target="_blank"> automated tip suggestions</a> should be condemned as “dark patterns” and whether the FTC needs to investigate the New York Times’s stubborn refusal to let him cancel his subscription. He also previews California’s <a href="https://www.sacbee.com/news/politics-government/capitol-alert/article275992871.html" rel="nofollow" target="_blank"> impending Journalism Preservation Act</a>. <a href="https://www.steptoe.com/podcasts/TheCyberlawPodcast-461.mp3" rel="nofollow" target="_blank">Download 461st Episode (mp3)</a> You can subscribe to The Cyberlaw Podcast using <a href="https://itunes.apple.com/us/podcast/steptoe-cyberlaw-podcast/id830593115?mt=2" rel="nofollow" target="_blank"> iTunes</a>, <a href="https://play.google.com/music/listen#/ps/Ikx2d2ncjvw6zuoq3zh4qp2i7qu" rel="nofollow" target="_blank"> Google Play</a>, <a href="https://open.spotify.com/show/3Co2wdTUaZr4Xqnlxs4soG" rel="nofollow" target="_blank">Spotify</a>, <a href="http://pcasts.in/steptoe" rel="nofollow" target="_blank">Pocket Casts</a>, or our <a href="http://www.steptoe.com/feed-Cyberlaw.rss" rel="nofollow" target="_blank">RSS feed.</a> As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with <a href="https://twitter.com/stewartbaker" rel="nofollow" target="_blank">@stewartbaker</a> on Twitter. Send your questions, comments, and suggestions for topics or interviewees to <a href="mailto:CyberlawPodcast@gmail.com">CyberlawPodcast@gmail.com</a>. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Debating AI Regulation

Jimmy Wales

In this bonus episode of the Cyberlaw Podcast, I interview Jimmy Wales, the cofounder of Wikipedia. Wikipedia is a rare survivor from the Internet Hippie Age, coexisting like a great herbivorous dinosaur with Facebook, Twitter, and the other carnivorous mammals of Web 2.0. Perhaps not coincidentally, Jimmy is the most prominent founder of a massive internet institution not to become a billionaire. We explore why that is, and how he feels about it.  I ask Jimmy whether Wikipedia’s model is sustainable, and what new challenges lie ahead for the online encyclopedia. We explore the claim that Wikipedia has a lefty bias, whether a neutral point of view can be maintained by including only material from trusted sources, and I ask Jimmy about a concrete, and in my view weirdly biased, entry in Wikipedia on “Communism.” We close with an exploration of the opportunities and risks posed for Wikipedia from ChatGPT and other large language AI models.   Download 460th Episode (mp3)  You can subscribe to The Cyberlaw Podcast using  iTunes,  Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@gmail.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

In this bonus episode of the Cyberlaw Podcast, I interview <a href="https://en.wikipedia.org/wiki/Jimmy_Wales" rel="nofollow" target="_blank">Jimmy Wales</a>, the cofounder of <a href="https://en.wikipedia.org/wiki/Main_Page" rel="nofollow" target="_blank">Wikipedia.</a> Wikipedia is a rare survivor from the Internet Hippie Age, coexisting like a great herbivorous dinosaur with Facebook, Twitter, and the other carnivorous mammals of Web 2.0. Perhaps not coincidentally, Jimmy is the most prominent founder of a massive internet institution not to become a billionaire. We explore why that is, and how he feels about it.  I ask Jimmy whether Wikipedia’s model is sustainable, and what new challenges lie ahead for the online encyclopedia. We explore the claim that Wikipedia has a lefty bias, whether a neutral point of view can be maintained by including only material from trusted sources, and I ask Jimmy about a concrete, and in my view weirdly biased, entry in Wikipedia on “Communism.” We close with an exploration of the opportunities and risks posed for Wikipedia from ChatGPT and other large language AI models.   <a href="https://www.steptoe.com/podcasts/TheCyberlawPodcast-460.mp3" rel="nofollow" target="_blank">Download 460th Episode (mp3)</a> You can subscribe to The Cyberlaw Podcast using <a href="https://itunes.apple.com/us/podcast/steptoe-cyberlaw-podcast/id830593115?mt=2" rel="nofollow" target="_blank"> iTunes</a>, <a href="https://play.google.com/music/listen#/ps/Ikx2d2ncjvw6zuoq3zh4qp2i7qu" rel="nofollow" target="_blank"> Google Play</a>, <a href="https://open.spotify.com/show/3Co2wdTUaZr4Xqnlxs4soG" rel="nofollow" target="_blank">Spotify</a>, <a href="http://pcasts.in/steptoe" rel="nofollow" target="_blank">Pocket Casts</a>, or our <a href="http://www.steptoe.com/feed-Cyberlaw.rss" rel="nofollow" target="_blank">RSS feed.</a> As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with <a href="https://twitter.com/stewartbaker" rel="nofollow" target="_blank">@stewartbaker</a> on Twitter. Send your questions, comments, and suggestions for topics or interviewees to <a href="mailto:CyberlawPodcast@gmail.com">CyberlawPodcast@gmail.com</a>. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Interviewing Jimmy Wales Cofounder of Wikipedia

A weekly podcast on cybersecurity and privacy from the cyberlaw practice at Steptoe and Johnson. Featuring Stewart Baker and Michael Vatis.

This episode of the Cyberlaw Podcast features the second half of my interview with Paul Stephan, author of The World Crisis and International Law. But it begins the way many recent episodes have begun, with the latest AI news. And, since it’s so squarely in scope for a cyberlaw podcast, we devote some time to the so-appalling- you-have-to-laugh-to keep-from-crying story of the lawyer who  relied on ChatGPT to write his brief. As Eugene Volokh noted in his  post, the model returned exactly the case law the lawyer wanted—because it made up the cases, the citations, and even the quotes. The lawyer said he had no idea that AI would do such a thing. I cast a skeptical eye on that excuse, since when challenged by the court to produce the cases he relied on, the lawyer turned not to Lexis-Nexis or Westlaw but to ChatGPT, which this time made up eight cases on point. And when the lawyer asked, “Are the other cases you provided fake,” the model denied it. Well, all right then. Who among us has not asked Westlaw, “Are the cases you provided fake?” Somehow, I can’t help suspecting that the lawyer’s claim to be an innocent victim of ChatGPT is going to get a closer look before this story ends. So if you’re wondering  whether AI poses existential risk, the answer for at least one lawyer’s license is almost certainly “yes.” But the bigger story of the week was the cries from Google and Microsoft leadership for government regulation. Jeffery Atik and Richard Stiennon weigh in. Microsoft’s President Brad Smith has, as usual, written a thoughtful  policy paper on what AI regulation might look like. And they point out that,  as usual, Smith is advocating for a process that Microsoft could master pretty easily. Google’s Sundar Pichai also  joins the “regulate me” party, but a bit half-heartedly. I argue that the best way to judge Silicon Valley’s confidence in the accuracy of AI is by asking when Google and Apple will be willing to use AI to identify photos of gorillas as gorillas. Because if there’s anything close to an extinction event for those companies it would be rolling out an AI that  once again fails to differentiate between people and apes.  Moving from policy to tech, Richard and I talk about Google’s  integration of AI into search; I see some glimmer of explainability and accuracy in Google’s willingness to provide citations (real ones, I presume) for its answers. And on the same topic, the National Academy of Sciences has posted research suggesting that  explainability might not be quite as impossible as researchers once thought. Jeffery takes us through the latest chapters in the U.S.—China decoupling story. China has retaliated, surprisingly weakly, for U.S. moves to cut off high-end chip sales to China. It has  banned sales of U.S. - based Micron memory chips to critical infrastructure companies. In the long run, the chip wars may be  the disaster that Invidia’s CEO foresees. Jeffery and I agree that Invidia has much to fear from a Chinese effort to build a national champion to compete in AI chipmaking. Meanwhile, the Biden administration is building a new model for  international agreements in an age of decoupling and industrial policy. Whether its effort to build a China-free IT supply chain will succeed is an open question, but we agree that it marks an end to the old free-trade agreements rejected by both former President Trump and President Biden. China, meanwhile, is overplaying its hand in Africa. Richard notes reports that  Chinese hackers attacked the Kenyan government when Kenya looked like it wouldn’t be able to repay China’s infrastructure loans. As Richard points out, lending money to a friend rarely works out. You are likely to lose both the friend and the money.  Finally, Richard and Jeffery both opine on Irelands imposing—under protest—of a  $1.3 billion fine on Facebook for sending data to the United States despite the Court of Justice of the European Union’s (CJEU) two Schrems decisions. We agree that the order simply sets a deadline for the U.S. and the EU to close their deal on a third effort to satisfy the CJEU that U.S. law is “adequate” to protect the rights of Europeans. Speaking of which, anyone who’s enjoyed my rants about the EU will want to tune in for  a June 15 Teleforum in which Max Schrems and I will  debate the latest privacy framework. If we can, we’ll release it as a bonus episode of this podcast, but listening live should be even more fun! Download 459th Episode (mp3) You can subscribe to The Cyberlaw Podcast using  iTunes,  Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@gmail.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

This episode of the Cyberlaw Podcast features the second half of my interview with <a href="https://www.law.virginia.edu/faculty/profile/pbs/1211911" rel="nofollow" target="_blank">Paul Stephan,</a> author of <a href="https://www.amazon.com/World-Crisis-International-Law/dp/1009320998" rel="nofollow" target="_blank">The World Crisis and International Law</a>. But it begins the way many recent episodes have begun, with the latest AI news. And, since it’s so squarely in scope for a cyberlaw podcast, we devote some time to the so-appalling- you-have-to-laugh-to keep-from-crying story of the lawyer who <a href="https://reason.com/volokh/2023/05/27/a-lawyers-filing-is-replete-with-citations-to-non-existent-cases-thanks-chatgpt/?utm_source=pocket_saves" rel="nofollow" target="_blank"> relied on ChatGPT to write his brief</a>. As Eugene Volokh noted in his <a href="https://reason.com/volokh/2023/05/27/chatgpt-coming-to-court-by-way-of-self-represented-litigants/" rel="nofollow" target="_blank"> post,</a> the model returned exactly the case law the lawyer wanted—because it made up the cases, the citations, and even the quotes. The lawyer said he had no idea that AI would do such a thing. I cast a skeptical eye on that excuse, since when challenged by the court to produce the cases he relied on, the lawyer turned not to Lexis-Nexis or Westlaw but to ChatGPT, which this time made up eight cases on point. And when the lawyer asked, “Are the other cases you provided fake,” the model denied it. Well, all right then. Who among us has not asked Westlaw, “Are the cases you provided fake?” Somehow, I can’t help suspecting that the lawyer’s claim to be an innocent victim of ChatGPT is going to get a closer look before this story ends. So if you’re wondering <a href="https://www.washingtonpost.com/technology/2023/05/20/ai-existential-risk-debate/?utm_source=pocket_saves" rel="nofollow" target="_blank"> whether AI poses existential risk</a>, the answer for at least one lawyer’s license is almost certainly “yes.” But the bigger story of the week was the cries from Google and Microsoft leadership for government regulation. <a href="https://www.lls.edu/faculty/facultylista-b/jefferyatik/" rel="nofollow" target="_blank">Jeffery Atik</a> and <a href="https://it-harvest.com/" rel="nofollow" target="_blank">Richard Stiennon</a> weigh in. Microsoft’s President Brad Smith has, as usual, written a thoughtful <a href="https://blogs.microsoft.com/on-the-issues/2023/05/25/how-do-we-best-govern-ai/?utm_source=pocket_saves" rel="nofollow" target="_blank"> policy paper</a> on what AI regulation might look like. And they point out that, <a href="https://www.washingtonpost.com/technology/2023/05/25/brad-smith-microsoft-ai/?utm_source=pocket_saves" rel="nofollow" target="_blank"> as usual, Smith is advocating for a process that Microsoft could master</a> pretty easily. Google’s Sundar Pichai also <a href="https://www.todayonline.com/commentary/commentary-building-ai-responsibly-only-race-really-matters-says-google-ceo-2178426?utm_source=pocket_saves" rel="nofollow" target="_blank"> joins the “regulate me” party</a>, but a bit half-heartedly. I argue that the best way to judge Silicon Valley’s confidence in the accuracy of AI is by asking when Google and Apple will be willing to use AI to identify photos of gorillas as gorillas. Because if there’s anything close to an extinction event for those companies it would be rolling out an AI that <a href="https://www.nytimes.com/2023/05/22/technology/ai-photo-labels-google-apple.html?utm_source=pocket_saves" rel="nofollow" target="_blank"> once again fails to differentiate between people and apes</a>.  Moving from policy to tech, Richard and I talk about Google’s <a href="https://9to5google.com/2023/05/25/google-search-generative-experience/?utm_source=pocket_saves" rel="nofollow" target="_blank"> integration of AI into search</a>; I see some glimmer of explainability and accuracy in Google’s willingness to provide citations (real ones, I presume) for its answers. And on the same topic, the National Academy of Sciences has posted research suggesting that <a href="https://www.pnas.org/doi/10.1073/pnas.2307432120?utm_source=pocket_saves" rel="nofollow" target="_blank"> explainability might not be quite as impossible</a> as researchers once thought. Jeffery takes us through the latest chapters in the U.S.—China decoupling story. China has retaliated, surprisingly weakly, for U.S. moves to cut off high-end chip sales to China. It has <a href="https://www.msn.com/en-us/money/other/china-bars-purchases-of-micron-chips-in-escalation-of-us-clash/ar-AA1btFat?utm_source=pocket_saves" rel="nofollow" target="_blank"> banned sales of U.S. - based Micron memory chips</a> to critical infrastructure companies. In the long run, the chip wars may be <a href="https://www.washingtonexaminer.com/policy/technology/nvidia-ceo-us-china-chip-war?utm_source=pocket_saves" rel="nofollow" target="_blank"> the disaster that Invidia’s CEO foresees</a>. Jeffery and I agree that Invidia has much to fear from a Chinese effort to build a national champion to compete in AI chipmaking. Meanwhile, the Biden administration is building a new model for <a href="https://www.nytimes.com/2023/05/27/business/economy/biden-indo-pacific-trade-deal.html" rel="nofollow" target="_blank"> international agreements in an age of decoupling and industrial policy</a>. Whether its effort to build a China-free IT supply chain will succeed is an open question, but we agree that it marks an end to the old free-trade agreements rejected by both former President Trump and President Biden. China, meanwhile, is overplaying its hand in Africa. Richard notes reports that <a href="https://www.reuters.com/world/africa/chinese-hackers-attacked-kenyan-government-debt-strains-grew-2023-05-24/?utm_source=pocket_saves" rel="nofollow" target="_blank"> Chinese hackers attacked the Kenyan government</a> when Kenya looked like it wouldn’t be able to repay China’s infrastructure loans. As Richard points out, lending money to a friend rarely works out. You are likely to lose both the friend and the money.  Finally, Richard and Jeffery both opine on Irelands imposing—<a href="https://www.politico.eu/article/record-meta-fine-masks-shortcomings-of-europes-privacy-regime/" rel="nofollow" target="_blank">under protest</a>—of a <a href="https://www.wsj.com/articles/meta-fined-1-3-billion-over-data-transfers-to-u-s-b53dbb04?mod=djemalertNEWS&amp;utm_source=pocket_saves" rel="nofollow" target="_blank"> $1.3 billion fine on Facebook</a> for sending data to the United States despite the Court of Justice of the European Union’s (CJEU) two Schrems decisions. We agree that the order simply sets a deadline for the U.S. and the EU to close their deal on a third effort to satisfy the CJEU that U.S. law is “adequate” to protect the rights of Europeans. Speaking of which, anyone who’s enjoyed my rants about the EU will want to tune in for <a href="https://fedsoc.org/events/transatlantic-debate-evaluating-the-eu-us-data-privacy-framework" rel="nofollow" target="_blank"> a June 15 Teleforum in which Max Schrems and I will  debate the latest privacy framework</a>. If we can, we’ll release it as a bonus episode of this podcast, but listening live should be even more fun! <a href="https://www.steptoe.com/podcasts/TheCyberlawPodcast-459.mp3" rel="nofollow" target="_blank">Download 459th Episode (mp3)</a> You can subscribe to The Cyberlaw Podcast using <a href="https://itunes.apple.com/us/podcast/steptoe-cyberlaw-podcast/id830593115?mt=2" rel="nofollow" target="_blank"> iTunes</a>, <a href="https://play.google.com/music/listen#/ps/Ikx2d2ncjvw6zuoq3zh4qp2i7qu" rel="nofollow" target="_blank"> Google Play</a>, <a href="https://open.spotify.com/show/3Co2wdTUaZr4Xqnlxs4soG" rel="nofollow" target="_blank">Spotify</a>, <a href="http://pcasts.in/steptoe" rel="nofollow" target="_blank">Pocket Casts</a>, or our <a href="http://www.steptoe.com/feed-Cyberlaw.rss" rel="nofollow" target="_blank">RSS feed.</a> As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with <a href="https://twitter.com/stewartbaker" rel="nofollow" target="_blank">@stewartbaker</a> on Twitter. Send your questions, comments, and suggestions for topics or interviewees to <a href="mailto:CyberlawPodcast@gmail.com">CyberlawPodcast@gmail.com</a>. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

When AI Poses an Existential Risk to Your Law License

This episode features part 1 of our two-part interview with Paul Stephan, author of  The World Crisis and International Law—a deeper and more entertaining read than the title suggests. Paul lays out the long historical arc that links the 1980s to the present day. It’s not a pretty picture, and it gets worse as he ties those changes to the demands of the Knowledge Economy. How will these profound political and economic clashes resolve themselves?  We’ll cover that in part 2. Meanwhile, in this episode of the Cyberlaw Podcast I tweak Sam Altman for his  relentless embrace of regulation for his industry during testimony last week in the Senate.  I compare him to another Sam with a similar regulation-embracing approach to Washington, but Chinny Sharma thinks it’s more accurate to say he did the opposite of everything Mark Zuckerberg did in past testimony. Chinny and Sultan Meghji unpack some of Altman’s proposals, from a new government agency to license large AI models, to safety standards and audit. I mock Sen. Richard Blumenthal, D-Conn., for panicking that “Europe is ahead of us” in industry-killing regulation. That earns him immortality in the form of a new Cybertoon, left. Speaking of Cybertoonz, I note that an earlier  Cybertoon scooped a prominent Wall Street Journal article covering bias in AI models was scooped – by two weeks.  Paul explains the  Supreme Court’s ruling on social media liability for assisting ISIS, and why it didn’t tell us anything of significance about section 230.  Chinny and I analyze reports that the  FBI misused its access to a section 702 database.  All of the  access mistakes came before the latest round of procedural reforms, but on reflection, I think the fault lies with the Justice Department and the Director of National Intelligence, who came up with access rules that all but guarantee mistakes and don’t ensure that the database will be searched when security requires it.  Chinny reviews a bunch of privacy scandal wannabe stories   The UK flap over efforts to create a  modern version of pen/trap records.   Two surveillance camera stories,     one that documents the use of  surveillance cameras and facial recognition used to monitor public housing residents. In a rare moment of “check your privilege” one-upsmanship, I chide Chinny for not honoring the needs of public housing residents who value security from crime above their privacy in the laundry room, and   another on the more or less inevitable networking of cheap surveillance cameras in the suburbs    And finally, a government privacy scandal ripped from the headlines of the 1920s: It turns out that the  U.S. Post Office can keep track of what’s on the outside of the envelopes it delivers.   Download the 458th Episode (mp3)  You can subscribe to The Cyberlaw Podcast using  iTunes,  Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@gmail.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

This episode features part 1 of our two-part interview with <a href="https://www.law.virginia.edu/faculty/profile/pbs/1211911" rel="nofollow" target="_blank">Paul Stephan,</a> author of <a href="https://www.amazon.com/World-Crisis-International-Law/dp/1009320998" rel="nofollow" target="_blank"> The World Crisis and International Law</a>—a deeper and more entertaining read than the title suggests. Paul lays out the long historical arc that links the 1980s to the present day. It’s not a pretty picture, and it gets worse as he ties those changes to the demands of the Knowledge Economy. How will these profound political and economic clashes resolve themselves?  We’ll cover that in part 2. Meanwhile, in this episode of the Cyberlaw Podcast I tweak Sam Altman for his <a href="https://www.washingtonpost.com/technology/2023/05/16/ai-congressional-hearing-chatgpt-sam-altman/?utm_source=pocket_saves" rel="nofollow" target="_blank"> relentless embrace</a> of regulation for his industry during testimony last week in the Senate.  I compare him to another Sam with a similar regulation-embracing approach to Washington, but <a href="https://law.utexas.edu/faculty/chinmayi-sharma/" rel="nofollow" target="_blank">Chinny Sharma</a> thinks it’s more accurate to say he did the opposite of everything Mark Zuckerberg did in past testimony. Chinny and <a href="https://scholars.duke.edu/person/sultan" rel="nofollow" target="_blank">Sultan Meghji</a> unpack some of Altman’s proposals, from a new government agency to license large AI models, to safety standards and audit. I mock Sen. Richard Blumenthal, D-Conn., for panicking that “Europe is ahead of us” in industry-killing regulation. That earns him immortality in the form of a new Cybertoon, left. Speaking of Cybertoonz, I note that an earlier <a href="https://reason.com/volokh/2023/05/08/the-white-house-holds-an-ai-summit/" rel="nofollow" target="_blank"> Cybertoon</a> scooped a prominent Wall Street Journal article covering bias in AI models was scooped – by two weeks.  Paul explains the <a href="https://www.cnn.com/2023/05/18/politics/supreme-court-twitter-google-social-media?utm_source=pocket_saves" rel="nofollow" target="_blank"> Supreme Court’s ruling on social media liability for assisting ISIS</a>, and why it didn’t tell us anything of significance about section 230.  Chinny and I analyze reports that the <a href="https://www.washingtonpost.com/national-security/2023/05/19/fbi-digital-surveillance-misuse-jan6-blm/" rel="nofollow" target="_blank"> FBI misused its access to a section 702 database</a>.  All of the <a href="https://www.intel.gov/ic-on-the-record-database/results/1259-release-of-two-fisc-decisions-authorizing-novel-intelligence-collection?utm_source=pocket_saves" rel="nofollow" target="_blank"> access mistakes</a> came before the latest round of procedural reforms, but on reflection, I think the fault lies with the Justice Department and the Director of National Intelligence, who came up with access rules that all but guarantee mistakes and don’t ensure that the database will be searched when security requires it.  Chinny reviews a bunch of privacy scandal wannabe stories <ul> <li> The UK flap over efforts to create a <a href="https://www.wired.com/story/internet-connection-records-uk-surveillance/?bxid=61a8d06ebba1581e296c1089&amp;cndid=67527943&amp;esrc=AUTO_PRINT&amp;mbid=mbid%3DCRMWIR012019%0A%0A&amp;source=Email_0_EDT_WIR_NEWSLETTER_0_DAILY_ZZ&amp;utm_brand=wired&amp;utm_mailing=WIR_Daily_051523&amp;utm_source=pocket_saves" rel="nofollow" target="_blank"> modern version of pen/trap records</a>. </li> <li> Two surveillance camera stories,  </li> <ul> <li> one that documents the use of <a href="https://urldefense.com/v3/__https:/www.washingtonpost.com/business/2023/05/16/surveillance-cameras-public-housing/?utm_source=pocket_saves__;!!ApXA7kLm!2mlgE4fX-uXTFTjH5qRpntT8GY611dL3e4QynLcv1wzx1ecRe1UD7SQHqVMGzo3NFQAEYQETJzDG4tPbsfHRiMk$" rel="nofollow" target="_blank"> surveillance cameras and facial recognition used to monitor public housing residents.</a> In a rare moment of “check your privilege” one-upsmanship, I chide Chinny for not honoring the needs of public housing residents who value security from crime above their privacy in the laundry room, and </li> <li> another on the more or less inevitable networking of cheap surveillance cameras in the suburbs </li> </ul> <li> And finally, a government privacy scandal ripped from the headlines of the 1920s: It turns out that the <a href="https://www.wired.com/story/usps-mail-surveillance-letter/?bxid=61a8d06ebba1581e296c1089&amp;cndid=67527943&amp;esrc=AUTO_PRINT&amp;mbid=mbid%3DCRMWIR012019%0A%0A&amp;source=Email_0_EDT_WIR_NEWSLETTER_0_DAILY_ZZ&amp;utm_brand=wired&amp;utm_mailing=WIR_Daily_051823&amp;utm_source=pocket_saves" rel="nofollow" target="_blank"> U.S. Post Office can keep track</a> of what’s on the outside of the envelopes it delivers. </li> </ul> <a href="https://www.steptoe.com/podcasts/TheCyberlawPodcast-458.mp3" rel="nofollow" target="_blank">Download the 458th Episode (mp3)</a> You can subscribe to The Cyberlaw Podcast using <a href="https://itunes.apple.com/us/podcast/steptoe-cyberlaw-podcast/id830593115?mt=2" rel="nofollow" target="_blank"> iTunes</a>, <a href="https://play.google.com/music/listen#/ps/Ikx2d2ncjvw6zuoq3zh4qp2i7qu" rel="nofollow" target="_blank"> Google Play</a>, <a href="https://open.spotify.com/show/3Co2wdTUaZr4Xqnlxs4soG" rel="nofollow" target="_blank">Spotify</a>, <a href="http://pcasts.in/steptoe" rel="nofollow" target="_blank">Pocket Casts</a>, or our <a href="http://www.steptoe.com/feed-Cyberlaw.rss" rel="nofollow" target="_blank">RSS feed.</a> As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with <a href="https://twitter.com/stewartbaker" rel="nofollow" target="_blank">@stewartbaker</a> on Twitter. Send your questions, comments, and suggestions for topics or interviewees to <a href="mailto:CyberlawPodcast@gmail.com">CyberlawPodcast@gmail.com</a>. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Sam Altman-Fried Comes to Washington

Maury Shenk opens this episode with an exploration of three efforts to overcome notable gaps in the performance of large language AI models.  OpenAI has developed a tool meant to address the models’ lack of explainability. It uses, naturally, another large language model to identify what makes individual neurons fire the way they do. Maury is skeptical that this is a path forward, but it’s nice to see someone trying. The other effort, Anthropic’s  creation of an explicit “constitution” of rules for its models, is more familiar and perhaps more likely to succeed. We also look at the use of  “open source” principles to overcome the massive cost of developing new models and then training them. That has proved to be a surprisingly successful fast-follower strategy thanks to a few publicly available models and datasets. The question is whether those resources will continue to be available as competition heats up. The European Union has to hope that open source will succeed, because the entire continent is a desert when it comes to big institutions making the big investments that look necessary to compete in the field. Despite (or maybe because) it has no AI companies to speak of, the EU is moving forward with its AI Act, an attempt to do for AI what the EU did for privacy with GDPR. Maury and I doubt the AI Act will have the same impact, at least outside Europe. Partly that’s because Europe doesn’t have the same jurisdictional hooks in AI as in data protection. It is essentially regulating what AI can be sold inside the EU, and companies are quite willing to develop their products for the rest of the world and bolt on European use restrictions as an afterthought. In addition, the AI Act, which started life as a coherent if aggressive policy about high risk models, has collapsed into  a welter of half-thought-out improvisations in response to the unanticipated success of ChatGPT. Anne-Gabrielle Haie is more friendly to the EU’s data protection policies, and she takes us through a  group of  legal  rulings that will shape liability for data protection violations. She also notes the potentially protectionist impact of a recent EU proposal to say that U.S. companies cannot offer secure cloud computing in Europe  unless they partner with a European cloud provider. Paul Rosenzweig introduces us to one of the  U.S. government’s most impressive technical achievements in cyberdefense—tracking down, reverse engineering, and then killing  Snake, one of Russia’s best hacking tools. Paul and I chew over China’s most recent self-inflicted wound in attracting global investment—the raid on Capvision. I agree that it’s going to discourage investors who need information before they part with their cash. But I offer a lukewarm justification for China’s fear that Capvision’s business model encourages leaks. Maury reviews  Chinese tech giant Baidu’s ChatGPT-like search add-on. I ask whether we can ever trust models like ChatGPT for search, given their love affair with plausible falsehoods. Paul reviews the technology that will be needed to meet what’s looking like a national trend to   require social media age verification. Maury reviews  the ruling upholding the lawfulness of the UK’s interception of Encrochat users. And Paul describes  the latest crimeware for phones, this time centered in Italy. Finally, in quick hits:   I note that both the  director and the career  deputy director are likely to leave NSA in the next several months.     And Maury and I both enthuse over Google’s new “passkey” technology.  Download the 457th Episode (mp3) You can subscribe to The Cyberlaw Podcast using  iTunes,  Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@gmail.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

<a href="https://www.steptoe.com/en/lawyers/maury-shenk.html" rel="nofollow" target="_blank">Maury Shenk</a> opens this episode with an exploration of three efforts to overcome notable gaps in the performance of large language AI models. <a href="https://techcrunch.com/2023/05/09/openais-new-tool-attempts-to-explain-language-models-behaviors/?utm_source=pocket_saves" rel="nofollow" target="_blank"> OpenAI has developed a tool</a> meant to address the models’ lack of explainability. It uses, naturally, another large language model to identify what makes individual neurons fire the way they do. Maury is skeptical that this is a path forward, but it’s nice to see someone trying. The other effort, Anthropic’s <a href="https://www.theverge.com/2023/5/9/23716746/ai-startup-anthropic-constitutional-ai-safety" rel="nofollow" target="_blank"> creation of an explicit “constitution”</a> of rules for its models, is more familiar and perhaps more likely to succeed. We also look at the use of <a href="https://www.technologyreview.com/2023/05/12/1072950/open-source-ai-google-openai-eleuther-meta/?utm_source=pocket_saves" rel="nofollow" target="_blank"> “open source” principles</a> to overcome the massive cost of developing new models and then training them. That has proved to be a surprisingly successful fast-follower strategy thanks to a few publicly available models and datasets. The question is whether those resources will continue to be available as competition heats up. The European Union has to hope that open source will succeed, because the entire continent is a desert when it comes to big institutions making the big investments that look necessary to compete in the field. Despite (or maybe because) it has no AI companies to speak of, the EU is moving forward with its AI Act, an attempt to do for AI what the EU did for privacy with GDPR. Maury and I doubt the AI Act will have the same impact, at least outside Europe. Partly that’s because Europe doesn’t have the same jurisdictional hooks in AI as in data protection. It is essentially regulating what AI can be sold inside the EU, and companies are quite willing to develop their products for the rest of the world and bolt on European use restrictions as an afterthought. In addition, the AI Act, which started life as a coherent if aggressive policy about high risk models, has collapsed into <a href="https://www.europarl.europa.eu/news/en/press-room/20230505IPR84904/ai-act-a-step-closer-to-the-first-rules-on-artificial-intelligence" rel="nofollow" target="_blank"> a welter of half-thought-out improvisations</a> in response to the unanticipated success of ChatGPT. <a href="https://www.steptoe.com/en/lawyers/anne-gabrielle-haie.html" rel="nofollow" target="_blank">Anne-Gabrielle Haie</a> is more friendly to the EU’s data protection policies, and she takes us through a <a href="https://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=272977&amp;pageIndex=0&amp;doclang=FR&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=5577174#Footref7" rel="nofollow" target="_blank"> group</a> of <a href="https://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=272981&amp;pageIndex=0&amp;doclang=EN&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=5610345" rel="nofollow" target="_blank"> legal</a> <a href="https://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=273284&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=3187740" rel="nofollow" target="_blank"> rulings</a> that will shape liability for data protection violations. She also notes the potentially protectionist impact of a recent EU proposal to say that U.S. companies cannot offer secure cloud computing in Europe <a href="https://www.reuters.com/technology/eu-draft-rules-propose-tougher-cybersecurity-labelling-rules-amazon-google-2023-05-09/?utm_source=pocket_saves" rel="nofollow" target="_blank"> unless they partner with a European cloud provider.</a> <a href="http://redbranchconsulting.com/" rel="nofollow" target="_blank">Paul Rosenzweig</a> introduces us to one of the <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a?utm_source=pocket_saves" rel="nofollow" target="_blank"> U.S. government’s most impressive technical achievements</a> in cyberdefense—tracking down, reverse engineering, and then killing <a href="https://cyberscoop.com/fbi-disrupts-russian-cyber-espionage-tool/?utm_source=pocket_saves" rel="nofollow" target="_blank"> Snake</a>, one of Russia’s best hacking tools. Paul and I chew over China’s most recent self-inflicted wound in attracting global investment—<a href="https://www.nytimes.com/2023/05/08/business/capvision-china-espionage-law.html?utm_source=pocket_saves" rel="nofollow" target="_blank">the raid on Capvision</a>. I agree that it’s going to discourage investors who need information before they part with their cash. But I offer a lukewarm justification for China’s fear that Capvision’s business model encourages leaks. Maury reviews <a href="https://www.scmp.com/tech/big-tech/article/3220351/chinese-tech-giant-baidu-embeds-chatgpt-service-flagship-search-engine-global-race-bring-similar" rel="nofollow" target="_blank"> Chinese tech giant Baidu’s ChatGPT-like search add-on.</a> I ask whether we can ever trust models like ChatGPT for search, given their love affair with plausible falsehoods. Paul reviews the technology that will be needed to meet what’s looking like a national trend to <a href="https://cyberscoop.com/age-verfication-schatz-cotton-social-media/?utm_source=pocket_saves" rel="nofollow" target="_blank">  require social media age verification.</a> Maury reviews <a href="https://twitter.com/AlexMartin/status/1656622126206517250?utm_source=pocket_saves" rel="nofollow" target="_blank"> the ruling</a> upholding the lawfulness of the UK’s interception of Encrochat users. And Paul describes <a href="https://www.vice.com/en/article/88xgjz/inside-italian-mafias-encrypted-phone-no1bc?utm_source=pocket_saves" rel="nofollow" target="_blank"> the latest crimeware for phones</a>, this time centered in Italy. Finally, in quick hits: <ul> <li> I note that both the <a href="https://www.wsj.com/articles/nsa-chief-paul-nakasone-has-said-he-expects-to-step-down-in-coming-months-7c21681f?utm_source=pocket_saves" rel="nofollow" target="_blank"> director</a> and the career <a href="https://therecord.media/nsa-deputy-expected-to-step-down?utm_source=pocket_saves" rel="nofollow" target="_blank"> deputy director</a> are likely to leave NSA in the next several months.    </li> <li>And Maury and I both enthuse over <a href="https://www.wired.com/story/google-passkey-password-replacement/" rel="nofollow" target="_blank">Google’s new “passkey” technology</a>.</li> </ul> <a href="https://www.steptoe.com/podcasts/TheCyberlawPodcast-457.mp3" rel="nofollow" target="_blank">Download the 457th Episode (mp3)</a> You can subscribe to The Cyberlaw Podcast using <a href="https://itunes.apple.com/us/podcast/steptoe-cyberlaw-podcast/id830593115?mt=2" rel="nofollow" target="_blank"> iTunes</a>, <a href="https://play.google.com/music/listen#/ps/Ikx2d2ncjvw6zuoq3zh4qp2i7qu" rel="nofollow" target="_blank"> Google Play</a>, <a href="https://open.spotify.com/show/3Co2wdTUaZr4Xqnlxs4soG" rel="nofollow" target="_blank">Spotify</a>, <a href="http://pcasts.in/steptoe" rel="nofollow" target="_blank">Pocket Casts</a>, or our <a href="http://www.steptoe.com/feed-Cyberlaw.rss" rel="nofollow" target="_blank">RSS feed.</a> As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with <a href="https://twitter.com/stewartbaker" rel="nofollow" target="_blank">@stewartbaker</a> on Twitter. Send your questions, comments, and suggestions for topics or interviewees to <a href="mailto:CyberlawPodcast@gmail.com">CyberlawPodcast@gmail.com</a>. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

EUthanizing AI

The “godfather of AI” has left Google, offering warnings about  the existential risks for humanity of the technology. Mark MacCarthy calls those risks a fantasy, and a debate breaks out between Mark, Nate Jones, and me. There’s more agreement on  the White House summit on AI risks, which seems to have followed Mark’s “let’s worry about tomorrow tomorrow” prescription. I think existential risks are a bigger concern, but I am deeply skeptical about other efforts to regulate AI, especially for bias, as  readers of Cybertoonz know. I argue again that regulatory efforts to eliminate bias are an ill-disguised effort to impose quotas more widely, which provokes lively pushback from Jim Dempsey and Mark. Other prospective AI regulators, from the Federal Trade Commission (FTC)’s  Lina Khan to the  Italian data protection agency, come in for commentary. I’m struck by the caution both have shown, perhaps due to their recognizing  the difficulty of applying old regulatory frameworks to this new technology. It’s not, I suspect, because Lina Khan’s FTC has lost its enthusiasm for pushing the law further than it can be pushed. This week’s example of litigation overreach at the FTC include  a dismissed complaint in a location data case against Kochava, and a  wildly disproportionate ‘remedy” for what look like Facebook foot faults in complying with an earlier FTC order.  Jim brings us up to date on a  slew of new state privacy laws in Montana, Indiana, and Tennessee. Jim sees them as  business-friendly alternatives to General Data Protection Regulation (GDPR) and California’s privacy law. Mark reviews Pornhub’s reaction to the Utah law on kids’ access to porn. He thinks age verification requirements are due for another look by the courts.   Jim explains the  state appellate court decision ruling that the NotPetya attack on Merck was not an act of war and thus not excluded from its insurance coverage. Nate and I recommend Kim Zetter’s revealing story on the  SolarWinds hack. The details help to explain why the Cyber Safety Review Board hasn’t examined SolarWinds—and why it absolutely has to—because the full story is going to embarrass a lot of powerful institutions. In quick hits,    Mark makes a bold prediction about the fate of  Canada’s law requiring Google and Facebook to pay when they link to Canadian media stories: Just like in Australia, the tech giants and the industry will reach a deal.    Jim and I comment on the three-year probation sentence for Joe Sullivan in the Uber “misprision of felony” case—and the sentencing judge’s wide-ranging commentary.    I savor the impudence of the  hacker who has broken into Russian intelligence’s bitcoin wallets and burned the money to post messages doxing the agencies involved.   And for those who missed it, Rick Salgado and I wrote  a Lawfare article on why CISOs should support renewal of Foreign Intelligence Surveillance Act (FISA) section 702, and  Metacurity named it one of the week’s “Best Infosec-related Long Reads.”    Download 456th Episode (mp3)  You can subscribe to The Cyberlaw Podcast using  iTunes,  Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@gmail.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

The “godfather of AI” has left Google, offering warnings about <a href="https://www.nytimes.com/2023/05/01/technology/ai-google-chatbot-engineer-quits-hinton.html?utm_source=pocket_saves" rel="nofollow" target="_blank"> the existential risks for humanity of the technology</a>. <a href="https://cbpp.georgetown.edu/people/mark-maccarthy/" rel="nofollow" target="_blank">Mark MacCarthy</a> calls those risks a fantasy, and a debate breaks out between Mark, <a href="https://culperpartners.com/" rel="nofollow" target="_blank">Nate Jones,</a> and me. There’s more agreement on <a href="https://www.reuters.com/technology/google-microsoft-openai-ceos-attend-white-house-ai-meeting-official-2023-05-02/?utm_source=pocket_saves" rel="nofollow" target="_blank"> the White House summit</a> on AI risks, which seems to have followed Mark’s “let’s worry about tomorrow tomorrow” prescription. I think existential risks are a bigger concern, but I am deeply skeptical about other efforts to regulate AI, especially for bias, as <a href="https://reason.com/volokh/2023/05/08/the-white-house-holds-an-ai-summit/" rel="nofollow" target="_blank"> readers of Cybertoonz know</a>. I argue again that regulatory efforts to eliminate bias are an ill-disguised effort to impose quotas more widely, which provokes lively pushback from <a href="https://cyber.fsi.stanford.edu/people/james-x-dempsey" rel="nofollow" target="_blank">Jim Dempsey</a> and Mark. Other prospective AI regulators, from the Federal Trade Commission (FTC)’s <a href="https://www.nytimes.com/2023/05/03/opinion/ai-lina-khan-ftc-technology.html?utm_source=pocket_saves" rel="nofollow" target="_blank"> Lina Khan</a> to the <a href="https://www.theverge.com/2023/5/5/23709833/openai-chatgpt-gdpr-ai-regulation-europe-eu-italy" rel="nofollow" target="_blank"> Italian data protection agency</a>, come in for commentary. I’m struck by the caution both have shown, perhaps due to their recognizing <a href="https://www.theguardian.com/technology/2023/may/04/eu-urged-to-protect-grassroots-ai-research-or-risk-losing-out-to-us?utm_source=pocket_saves" rel="nofollow" target="_blank"> the difficulty of applying</a> old regulatory frameworks to this new technology. It’s not, I suspect, because Lina Khan’s FTC has lost its enthusiasm for pushing the law further than it can be pushed. This week’s example of litigation overreach at the FTC include <a href="https://www.nytimes.com/2023/05/05/business/ftc-kochava-location-data.html?utm_source=pocket_saves" rel="nofollow" target="_blank"> a dismissed complaint in a location data case against Kochava</a>, and a <a href="https://www.cnbc.com/2023/05/03/ftc-proposes-barring-meta-from-monetizing-kids-data.html?utm_source=pocket_saves" rel="nofollow" target="_blank"> wildly disproportionate ‘remedy”</a> for what look like Facebook foot faults in complying with an earlier FTC order.  Jim brings us up to date on a <a href="https://urldefense.com/v3/__https:/fpf.org/blog/tenn-makes-nine-tennessee-information-protection-act-set-to-become-newest-comprehensive-state-privacy-law/__;!!ApXA7kLm!zV0_YuUlKhtu8JRAbT30meixL1EjWb-Y80IqUS_YTbSTaddpAgomGjG_waN58-luHzkah058ZksJ97Hitg5RGfj8$" rel="nofollow" target="_blank"> slew of new state privacy laws</a> in Montana, Indiana, and Tennessee. Jim sees them as <a href="https://urldefense.com/v3/__https:/www.perkinsonprivacy.com/2023/05/lucky-number-78-and-9-indiana-passes-privacy-law-with-tennessee-and-montana-hot-on-its-heels/__;!!ApXA7kLm!zV0_YuUlKhtu8JRAbT30meixL1EjWb-Y80IqUS_YTbSTaddpAgomGjG_waN58-luHzkah058ZksJ97HitsyGJJCH$" rel="nofollow" target="_blank"> business-friendly alternatives</a> to General Data Protection Regulation (GDPR) and California’s privacy law. Mark reviews <a href="https://urldefense.com/v3/__https:/www.vice.com/en/article/93kbkv/pornhub-blocks-utah-age-verification?utm_source=pocket_saves__;!!ApXA7kLm!2nTtspYuzO-4GRaO4B5jw-OIYkgd-wgaFT1kPOFWfjrIUH8e1Qr2uzds0H2zCyTeyus8mjtfPIZ0iMGG3tNGkA$" rel="nofollow" target="_blank">Pornhub’s reaction to the Utah law on kids’ access to porn.</a> He thinks age verification requirements are due for another look by the courts.   Jim explains the <a href="https://www.wsj.com/articles/mercks-insurers-on-the-hook-in-1-4-billion-notpetya-attack-court-says-528aeb01?utm_source=pocket_saves" rel="nofollow" target="_blank"> state appellate court decision</a> ruling that the NotPetya attack on Merck was not an act of war and thus not excluded from its insurance coverage. Nate and I recommend Kim Zetter’s revealing story on the  <a href="https://www.wired.com/story/the-untold-story-of-solarwinds-the-boldest-supply-chain-hack-ever/?utm_source=pocket_saves" rel="nofollow" target="_blank">SolarWinds hack.</a> The details help to explain why the Cyber Safety Review Board hasn’t examined SolarWinds—and why it absolutely has to—because the full story is going to embarrass a lot of powerful institutions. In quick hits,  <ul> <li> Mark makes a bold prediction about the fate of <a href="https://www.reuters.com/business/media-telecom/canada-online-news-bill-is-unreasonable-google-executive-says-2023-05-03/" rel="nofollow" target="_blank"> Canada’s law requiring Google and Facebook to pay</a> when they link to Canadian media stories: Just like in Australia, the tech giants and the industry will reach a deal.  </li> <li> Jim and I comment on the three-year probation sentence for Joe Sullivan in the Uber “misprision of felony” case—and the sentencing judge’s wide-ranging commentary.  </li> <li> I savor the impudence of the <a href="https://www.coindesk.com/business/2023/04/27/russian-bitcoin-wallets-allegedly-exposed-by-apparent-hacker/?utm_source=pocket_saves" rel="nofollow" target="_blank"> hacker who has broken into Russian intelligence’s bitcoin wallets</a> and burned the money to post messages doxing the agencies involved. </li> <li> And for those who missed it, Rick Salgado and I wrote <a href="https://www.lawfareblog.com/cisos-dont-ignore-fisa-section-702-debate" rel="nofollow" target="_blank"> a Lawfare article</a> on why CISOs should support renewal of Foreign Intelligence Surveillance Act (FISA) section 702, and <a href="https://metacurity.substack.com/p/best-infosec-related-long-reads-of-6a2" rel="nofollow" target="_blank"> Metacurity</a> named it one of the week’s “Best Infosec-related Long Reads.”  </li> </ul> <a href="https://www.steptoe.com/podcasts/TheCyberlawPodcast-456.mp3" rel="nofollow" target="_blank">Download 456th Episode (mp3)</a> You can subscribe to The Cyberlaw Podcast using <a href="https://itunes.apple.com/us/podcast/steptoe-cyberlaw-podcast/id830593115?mt=2" rel="nofollow" target="_blank"> iTunes</a>, <a href="https://play.google.com/music/listen#/ps/Ikx2d2ncjvw6zuoq3zh4qp2i7qu" rel="nofollow" target="_blank"> Google Play</a>, <a href="https://open.spotify.com/show/3Co2wdTUaZr4Xqnlxs4soG" rel="nofollow" target="_blank">Spotify</a>, <a href="http://pcasts.in/steptoe" rel="nofollow" target="_blank">Pocket Casts</a>, or our <a href="http://www.steptoe.com/feed-Cyberlaw.rss" rel="nofollow" target="_blank">RSS feed.</a> As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with <a href="https://twitter.com/stewartbaker" rel="nofollow" target="_blank">@stewartbaker</a> on Twitter. Send your questions, comments, and suggestions for topics or interviewees to <a href="mailto:CyberlawPodcast@gmail.com">CyberlawPodcast@gmail.com</a>. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

How worried should we be about “existential” AI risk?

We open this episode of the Cyberlaw Podcast with some actual news about the debate over renewing section 702 of FISA. That’s the law that allows the government to target foreigners for a national security purpose and to intercept their communications in and out of the U.S. A lot of attention has been focused on what happens to those communications after they’ve been intercepted and stored, and particularly whether the FBI should get a second court authorization—maybe even a warrant based on probable cause—to search for records about an American. Michael J. Ellis reports that the Office of the Director of National Intelligence  has released new data on such FBI searches. Turns out, they’ve dropped from almost 3 million last year to nearly 120 thousand this year. In large part the drop reflects the tougher restrictions imposed by the FBI on such searches. Those restrictions were also  made public this week. It has also emerged that  the government is using section 702 millions of times a year to identify the victims of cyberattacks (makes sense: foreign hackers are often a national security concern, and their whole business model is to use U.S. infrastructure to communicate [in a very special way] with U.S. networks.) So it turns out that all those civil libertarians who want to make it hard for the government to search 702 for the names of Americans are proposing ways to slow down and complicate the process of warning hacking victims. Thanks a bunch, folks!  Justin Sherman covers China’s push to attack and even take over enemy (U.S.) satellites.  This story is apparently drawn from the Discord leaks, and it has the ring of truth. I opine that the Defense Department has gotten a little too comfortable waging war against people who don’t really have an army, and that the Ukraine conflict shows how much tougher things get when there’s an organized military on the other side. (Again, credit for our artwork goes to Bing Image Creator.) Adam Candeub flags  the next Supreme Court case to nibble away at the problem of social media and the law. We can look forward to an argument next year about the constitutionality of public officials blocking people who post mean comments on the officials’ Facebook pages.  Justin and I break down a story about whether  Twitter is complying with more government demands under Elon Musk. The short answer is yes. This leads me to ask why we expect social media companies to spend large sums fighting government takedown and surveillance requests when it’s much cheaper just to comply. So far, the answer has been that mainstream media and Good People Everywhere will criticize companies that don’t fight. But with criticism of Elon Musk’s Twitter already turned up to 11, that’s not likely to persuade him. Adam and I are impressed by  Citizen Labs’ report on search censorship in China. We’d both kind of like to see Citizen Lab do the same thing for U.S. censorship, which somehow gets less transparency. If you suspect that’s because there’s more censorship than U.S. companies want to admit, here’s a straw in the wind: Citizen Lab reports that the one American company still providing search services in China, Microsoft Bing, is actually more aggressive about stifling political speech than China’s main search engine, Baidu. This fits with my discovery that Bing’s Image Creator refused to construct an image using Taiwan’s flag. (It was OK using U.S. and German flags, but not China’s.) I also credit Microsoft for fixing that particular bit of overreach: You can now create images with both Taiwanese and Chinese flags.  Adam covers the EU’s enthusiasm for regulating other countries’ companies. It has designated  19 tech giants as subject to its online content rules. Of the 19, one is a European company, and two are Chinese (counting TikTok). The rest are American companies.  I cover a case that I think could be a big problem for the Biden administration as it ramps up its campaign for cybersecurity regulation. Iowa and a couple of other states  are suing to block the Environmental Protection Agency’s legally questionable effort to impose cybersecurity requirements on public water systems, using an “interpretation” of a law that doesn’t say much about cybersecurity into a law that never had it before. Michael Ellis and I cover the story detailing a former NSA director’s business ties to Saudi Arabia—and expand it to confess our unease at the number of generals and admirals moving from command of U.S. forces to a consulting gig with the countries they were just negotiating with. Recent restrictions on the revolving door for intelligence officers gets a mention. Adam covers  the Quebec decision awarding $500 thousand to a man who couldn’t get Google to consistently delete a false story portraying him as a pedophile and conman. Justin and I debate whether Meta’s Reels feature has what it takes to be a plausible TikTok competitor? Justin is skeptical. I’m a little less so. Meta’s claims about the success of Reels aren’t entirely persuasive, but perhaps it’s too early to tell. The D.C. Circuit has  killed off the state antitrust case trying to undo Meta’s long-ago acquisition of WhatsApp and Instagram. The states waited too long, the court held. That doctrine doesn’t apply the same way to the Federal Trade Commission (FTC), which will get to pursue a lonely battle against long odds for years. If the FTC is going to keep sending its lawyers into battle like conscripts in Bakhmut, I ask, when will the commission start recruiting in Russian prisons? That was fast. Adam tells us that the  Brazil court order banning on Telegram because it wouldn’t turn over information on neo-Nazi groups has  been overturned on appeal. But Telegram isn’t out of the woods. The appeal court left in place fines of $200 thousand a day for noncompliance.    And in another regulatory walkback, Italy’s privacy watchdog is letting  ChatGPT back into the country. I suspect the Italian government of cutting a deal to save face as it abandons its initial position on ChatGPT’s scraping of public data to train the model. Finally, in policies I wish they would walk back, four U.S. regulatory agencies claimed (plausibly) that  they had authority to bring bias claims against companies using AI in a discriminatory fashion. Since I don’t see any way to bring those claims without arguing that any deviation from proportional representation constitutes discrimination, this feels like a surreptitious introduction of quotas into several new parts of the economy, just as the Supreme Court seems poised to cast doubt on such quotas in higher education.  Download 455th Episode (mp3) You can subscribe to The Cyberlaw Podcast using iTunes,  Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@gmail.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

We open this episode of the Cyberlaw Podcast with some actual news about the debate over renewing section 702 of FISA. That’s the law that allows the government to target foreigners for a national security purpose and to intercept their communications in and out of the U.S. A lot of attention has been focused on what happens to those communications after they’ve been intercepted and stored, and particularly whether the FBI should get a second court authorization—maybe even a warrant based on probable cause—to search for records about an American. <a href="https://www.heritage.org/staff/michael-j-ellis" rel="nofollow" target="_blank">Michael J. Ellis</a> reports that the Office of the Director of National Intelligence <a href="https://www.foxnews.com/politics/odni-report-reveals-significant-decline-fbi-queries-us-citizens-under-fisa-702-last-year" rel="nofollow" target="_blank"> has released new data</a> on such FBI searches. Turns out, they’ve dropped from almost 3 million last year to nearly 120 thousand this year. In large part the drop reflects the tougher restrictions imposed by the FBI on such searches. Those restrictions were also <a href="https://www.lawfareblog.com/fbi-publishes-fisa-query-guidance-2021" rel="nofollow" target="_blank"> made public</a> this week. It has also emerged that <a href="https://www.washingtonpost.com/politics/2023/04/27/chinese-russian-hackers-are-making-moves-heres-how-nsa-is-trying-counter-them/?utm_source=pocket_saves" rel="nofollow" target="_blank"> the government is using section 702 millions of times a year to identify the victims of cyberattacks</a> (makes sense: foreign hackers are often a national security concern, and their whole business model is to use U.S. infrastructure to communicate [in a very special way] with U.S. networks.) So it turns out that all those civil libertarians who want to make it hard for the government to search 702 for the names of Americans are proposing ways to slow down and complicate the process of warning hacking victims. Thanks a bunch, folks! <a href="https://www.globalcyberstrategies.com/#:~:text=Global%20Cyber%20Strategies%20is%20a%20Washington%2C%20DC-based%20research,Project%20Strategizing%205%20Communications%20Planning%206%20Expert%20Network" rel="nofollow" target="_blank"> Justin Sherman</a> covers China’s push to attack and even take over enemy (U.S.) satellites. <a href="https://arstechnica.com/information-technology/2023/04/china-building-cyberweapons-to-hijack-enemy-satellites-says-us-leak/?comments=1&amp;comments-page=1&amp;utm_source=pocket_saves" rel="nofollow" target="_blank"> This story</a> is apparently drawn from the Discord leaks, and it has the ring of truth. I opine that the Defense Department has gotten a little too comfortable waging war against people who don’t really have an army, and that the Ukraine conflict shows how much tougher things get when there’s an organized military on the other side. (Again, credit for our artwork goes to Bing Image Creator.) <a href="https://www.law.msu.edu/faculty_staff/profile.php?prof=370" rel="nofollow" target="_blank">Adam Candeub</a> flags <a href="https://www.reuters.com/legal/us-supreme-court-decide-if-public-officials-can-block-critics-social-media-2023-04-24/" rel="nofollow" target="_blank"> the next Supreme Court case</a> to nibble away at the problem of social media and the law. We can look forward to an argument next year about the constitutionality of public officials blocking people who post mean comments on the officials’ Facebook pages.  Justin and I break down a story about whether <a href="https://restofworld.org/2023/elon-musk-twitter-government-orders/" rel="nofollow" target="_blank"> Twitter is complying with more government demands under Elon Musk</a>. The short answer is yes. This leads me to ask why we expect social media companies to spend large sums fighting government takedown and surveillance requests when it’s much cheaper just to comply. So far, the answer has been that mainstream media and Good People Everywhere will criticize companies that don’t fight. But with criticism of Elon Musk’s Twitter already turned up to 11, that’s not likely to persuade him. Adam and I are impressed by <a href="https://urldefense.com/v3/__https:/citizenlab.ca/2023/04/a-comparison-of-search-censorship-in-china/__;!!ApXA7kLm!0nFDLc2vXSxIUk5XVx6KCo6O3ACaPWzcJaAgrn02Z7K9trEReUi4j1aCGOz15JLh61FPbI-S0gQF98OVHjMP$" rel="nofollow" target="_blank"> Citizen Labs’ report</a> on search censorship in China. We’d both kind of like to see Citizen Lab do the same thing for U.S. censorship, which somehow gets less transparency. If you suspect that’s because there’s more censorship than U.S. companies want to admit, here’s a straw in the wind: Citizen Lab reports that the one American company still providing search services in China, Microsoft Bing, is actually more aggressive about stifling political speech than China’s main search engine, Baidu. This fits with my discovery that Bing’s Image Creator refused to construct an image using Taiwan’s flag. (It was OK using U.S. and German flags, but not China’s.) I also credit Microsoft for fixing that particular bit of overreach: You can now create images with both Taiwanese and Chinese flags.  Adam covers the EU’s enthusiasm for regulating other countries’ companies. It has designated <a href="https://www.reuters.com/technology/google-amazon-meta-microsoft-15-others-subject-eu-content-rules-2023-04-25/" rel="nofollow" target="_blank"> 19 tech giants as subject to its online content rules.</a> Of the 19, one is a European company, and two are Chinese (counting TikTok). The rest are American companies.  I cover a case that I think could be a big problem for the Biden administration as it ramps up its campaign for cybersecurity regulation. Iowa and a couple of other states <a href="https://www.iowaattorneygeneral.gov/newsroom/attorney-general-bird-sues-biden-administration-over-new-cybersecurity-regulations-for-public-water?utm_source=pocket_saves" rel="nofollow" target="_blank"> are suing to block</a> the Environmental Protection Agency’s legally questionable effort to impose cybersecurity requirements on public water systems, using an “interpretation” of a law that doesn’t say much about cybersecurity into a law that never had it before. Michael Ellis and I cover the story detailing a <a href="https://archive.is/SeQRV" rel="nofollow" target="_blank">former NSA director’s business ties to Saudi Arabia</a>—and expand it to confess our unease at the number of generals and admirals moving from command of U.S. forces to a consulting gig with the countries they were just negotiating with. Recent restrictions on the revolving door for intelligence officers gets a mention. Adam covers <a href="https://arstechnica.com/tech-policy/2023/04/man-battling-google-wins-500k-for-search-result-links-calling-him-a-pedophile/?utm_source=pocket_saves" rel="nofollow" target="_blank"> the Quebec decision awarding $500 thousand</a> to a man who couldn’t get Google to consistently delete a false story portraying him as a pedophile and conman. Justin and I debate whether Meta’s Reels feature has what it takes to be a plausible TikTok competitor? Justin is skeptical. I’m a little less so. <a href="https://techcrunch.com/2023/04/26/meta-says-time-spent-on-instagram-grew-24-thanks-to-tiktok-style-ai-reel-recommendations/" rel="nofollow" target="_blank">Meta’s claims about the success of Reels</a> aren’t entirely persuasive, but perhaps it’s too early to tell. The D.C. Circuit has <a href="https://www.law360.com/technology/articles/1601782?nl_pk=8a4ebbfd-6806-4594-bba0-c159fe215eff&amp;nlaidx=0&amp;nlsidx=0&amp;read_more=1&amp;utm_source=pocket_saves" rel="nofollow" target="_blank"> killed off the state antitrust case</a> trying to undo Meta’s long-ago acquisition of WhatsApp and Instagram. The states waited too long, the court held. That doctrine doesn’t apply the same way to the Federal Trade Commission (FTC), which will get to pursue a lonely battle against long odds for years. If the FTC is going to keep sending its lawyers into battle like conscripts in Bakhmut, I ask, when will the commission start recruiting in Russian prisons? That was fast. Adam tells us that the <a href="https://www.bloomberg.com/news/articles/2023-04-26/brazil-court-orders-ban-on-telegram-over-neo-nazi-content?leadSource=uverify%20wall" rel="nofollow" target="_blank"> Brazil court order banning on Telegram</a> because it wouldn’t turn over information on neo-Nazi groups has <a href="https://www.reuters.com/technology/brazil-court-lifts-telegram-suspension-not-complying-with-order-neo-nazi-groups-2023-04-29/?utm_source=pocket_saves" rel="nofollow" target="_blank"> been overturned on appeal</a>. But Telegram isn’t out of the woods. The appeal court left in place fines of $200 thousand a day for noncompliance.    And in another regulatory walkback, Italy’s privacy watchdog is letting <a href="https://apnews.com/article/chatgpt-openai-data-privacy-italy-b9ab3d12f2b2cfe493237fd2b9675e21" rel="nofollow" target="_blank"> ChatGPT back into the country.</a> I suspect the Italian government of cutting a deal to save face as it abandons its initial position on ChatGPT’s scraping of public data to train the model. Finally, in policies I wish they would walk back, four U.S. regulatory agencies claimed (plausibly) that <a href="https://www.cnbc.com/2023/04/25/us-regulators-warn-they-already-have-the-power-to-go-after-ai-bias.html?utm_source=pocket_saves" rel="nofollow" target="_blank"> they had authority to bring bias claims</a> against companies using AI in a discriminatory fashion. Since I don’t see any way to bring those claims without arguing that any deviation from proportional representation constitutes discrimination, this feels like a surreptitious introduction of quotas into several new parts of the economy, just as the Supreme Court seems poised to cast doubt on such quotas in higher education.  <a href="https://www.steptoe.com/podcasts/TheCyberlawPodcast-455.mp3" rel="nofollow" target="_blank">Download 455th Episode (mp3)</a> You can subscribe to The Cyberlaw Podcast using <a href="https://itunes.apple.com/us/podcast/steptoe-cyberlaw-podcast/id830593115?mt=2" rel="nofollow" target="_blank">iTunes</a>, <a href="https://play.google.com/music/listen#/ps/Ikx2d2ncjvw6zuoq3zh4qp2i7qu" rel="nofollow" target="_blank"> Google Play</a>, <a href="https://open.spotify.com/show/3Co2wdTUaZr4Xqnlxs4soG" rel="nofollow" target="_blank">Spotify</a>, <a href="http://pcasts.in/steptoe" rel="nofollow" target="_blank">Pocket Casts</a>, or our <a href="http://www.steptoe.com/feed-Cyberlaw.rss" rel="nofollow" target="_blank">RSS feed.</a> As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with <a href="https://twitter.com/stewartbaker" rel="nofollow" target="_blank">@stewartbaker</a> on Twitter. Send your questions, comments, and suggestions for topics or interviewees to <a href="mailto:CyberlawPodcast@gmail.com">CyberlawPodcast@gmail.com</a>. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Does the government need a warrant to warn me about a cyberattack?

The latest episode of The Cyberlaw Podcast was not created by chatbots (we swear!). Guest host Brian Fleming, along with guests  Jay Healey, Maury Shenk, and Nick Weaver, discuss the latest news on the AI revolution including  Google’s efforts to protect its search engine dominance, a fascinating look at the  websites that feed tools like ChatGPT (leading some on the panel to argue that quality over quantity should be goal), and  a possible regulatory speed bump for total AI world domination, at least as far as the EU’s General Data Privacy Regulation is concerned. Next, Jay lends some perspective on where we’ve been and where we’re going with respect to cybersecurity by reflecting on some notable recent and upcoming anniversaries. The panel then discusses recent charges brought by the Justice Department, and two arrests, aimed at  China’s alleged attempt to harass dissidents living in the U.S. (including with fake social media accounts) and ponders how much of Russia’s playbook China is willing to adopt. Nick and Brian then discuss the  Securities and Exchange Commission’s complaint against Bittrex and what it could portend for others in the crypto space and, more broadly, the future of crypto regulation and enforcement in the U.S. Maury then discusses the  new EU-wide crypto regulations, and what the EU’s approach to regulating this industry could mean going forward. The panel then takes a hard look at an  alarming story out of Taiwan and debates what the recent “invisible blockade” on Matsu means for China’s future designs on the island and Taiwan’s ability to bolster the resiliency of its communications infrastructure. Finally, Nick covers a recent report on the  Mexican government’s continued reliance on Pegasus spyware. To wrap things up in the week’s quick hits, Jay proposes  updating the Insurrection Act to avoid its use as a justification for deploying military cyber capabilities against U.S. citizens, Nick discusses the dangers of  computer generated swatting services, Brian highlights the  recent Supreme Court argument that may settle whether online stalking is a “true threat” v. protected First Amendment activity, and, last but not least, Nick checks in on  Elon Musk’s threat to sue Microsoft after Twitter is dropped from its ad platform. Download 454th Episode (mp3) You can subscribe to The Cyberlaw Podcast using  iTunes,  Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

The latest episode of The Cyberlaw Podcast was not created by chatbots (we swear!). Guest host Brian Fleming, along with guests <a href="https://www.sipa.columbia.edu/communities-connections/faculty/jason-healey" rel="nofollow" target="_blank"> Jay Healey</a>, <a href="https://www.steptoe.com/en/lawyers/maury-shenk.html" rel="nofollow" target="_blank">Maury Shenk</a>, and <a href="http://www1.icsi.berkeley.edu/~nweaver/" rel="nofollow" target="_blank">Nick Weaver</a>, discuss the latest news on the AI revolution including <a href="https://www.nytimes.com/2023/04/16/technology/google-search-engine-ai.html?utm_source=pocket_saves" rel="nofollow" target="_blank"> Google’s efforts</a> to protect its search engine dominance, a fascinating look at the <a href="https://www.washingtonpost.com/technology/interactive/2023/ai-chatbot-learning/" rel="nofollow" target="_blank"> websites that feed tools like ChatGPT</a> (leading some on the panel to argue that quality over quantity should be goal), and <a href="https://www.technologyreview.com/2023/04/19/1071789/openais-hunger-for-data-is-coming-back-to-bite-it/?utm_source=pocket_saves" rel="nofollow" target="_blank"> a possible regulatory speed bump for total AI world domination</a>, at least as far as the EU’s General Data Privacy Regulation is concerned. Next, Jay lends some perspective on where we’ve been and where we’re going with respect to cybersecurity by reflecting on some notable recent and upcoming anniversaries. The panel then discusses recent charges brought by the Justice Department, and two arrests, aimed at <a href="https://www.wsj.com/articles/china-security-unit-targeted-u-s-with-fake-social-media-scheme-prosecutors-allege-527b6528?mod=djemalertNEWS&amp;utm_source=pocket_saves" rel="nofollow" target="_blank"> China’s alleged attempt to harass dissidents living in the U.S.</a> (including with fake social media accounts) and ponders how much of Russia’s playbook China is willing to adopt. Nick and Brian then discuss the <a href="https://www.coindesk.com/policy/2023/04/17/crypto-exchange-bittrex-violated-federal-laws-sec-charges-in-lawsuit/?utm_source=pocket_saves" rel="nofollow" target="_blank"> Securities and Exchange Commission’s complaint against Bittrex</a> and what it could portend for others in the crypto space and, more broadly, the future of crypto regulation and enforcement in the U.S. Maury then discusses the <a href="https://www.bloomberg.com/news/articles/2023-04-20/eu-s-mica-crypto-regulations-clear-final-parliament-vote?leadSource=uverify%20wall" rel="nofollow" target="_blank"> new EU-wide crypto regulations</a>, and what the EU’s approach to regulating this industry could mean going forward. The panel then takes a hard look at an <a href="https://thediplomat.com/2023/04/after-chinese-vessels-cut-matsu-internet-cables-taiwan-shows-its-communications-resilience/?utm_source=pocket_saves" rel="nofollow" target="_blank"> alarming story out of Taiwan</a> and debates what the recent “invisible blockade” on Matsu means for China’s future designs on the island and Taiwan’s ability to bolster the resiliency of its communications infrastructure. Finally, Nick covers a recent report on the <a href="https://www.nytimes.com/2023/04/18/world/americas/pegasus-spyware-mexico.html?utm_source=pocket_saves" rel="nofollow" target="_blank"> Mexican government’s continued reliance on Pegasus spyware</a>. To wrap things up in the week’s quick hits, Jay proposes <a href="https://www.defenseone.com/ideas/2020/09/could-trump-deploy-us-cyber-command-against-protestors/168342/" rel="nofollow" target="_blank"> updating the Insurrection Act</a> to avoid its use as a justification for deploying military cyber capabilities against U.S. citizens, Nick discusses the dangers of <a href="https://www.vice.com/en/article/k7z8be/torswats-computer-generated-ai-voice-swatting?utm_source=pocket_saves" rel="nofollow" target="_blank"> computer generated swatting services</a>, Brian highlights the <a href="https://www.fastcompany.com/90881970/supreme-court-to-decide-when-social-media-stalking-illegal" rel="nofollow" target="_blank"> recent Supreme Court argument</a> that may settle whether online stalking is a “true threat” v. protected First Amendment activity, and, last but not least, Nick checks in on <a href="https://www.pcmag.com/news/elon-musk-threatens-to-sue-microsoft-after-it-drops-twitter-from-ad-platform?utm_source=pocket_saves" rel="nofollow" target="_blank"> Elon Musk’s threat to sue Microsoft</a> after Twitter is dropped from its ad platform. <a href="https://www.steptoe.com/podcasts/TheCyberlawPodcast-454.mp3" rel="nofollow" target="_blank">Download 454th Episode (mp3)</a> You can subscribe to The Cyberlaw Podcast using <a href="https://itunes.apple.com/us/podcast/steptoe-cyberlaw-podcast/id830593115?mt=2" rel="nofollow" target="_blank"> iTunes</a>, <a href="https://play.google.com/music/listen#/ps/Ikx2d2ncjvw6zuoq3zh4qp2i7qu" rel="nofollow" target="_blank"> Google Play</a>, <a href="https://open.spotify.com/show/3Co2wdTUaZr4Xqnlxs4soG" rel="nofollow" target="_blank">Spotify</a>, <a href="http://pcasts.in/steptoe" rel="nofollow" target="_blank">Pocket Casts</a>, or our <a href="http://www.steptoe.com/feed-Cyberlaw.rss" rel="nofollow" target="_blank">RSS feed.</a> As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with <a href="https://twitter.com/stewartbaker" rel="nofollow" target="_blank">@stewartbaker</a> on Twitter. Send your questions, comments, and suggestions for topics or interviewees to <a href="mailto:CyberlawPodcast@steptoe.com">CyberlawPodcast@steptoe.com</a>. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

It’s the Data (Not the Model), Stupid!

Every government on the planet announced last week an ambition to regulate artificial intelligence. Nate Jones and Jamil Jaffer take us through the announcements. What’s particularly discouraging is the lack of imagination, as governments dusted off their old prejudices to handle this new problem. Europe is  obsessed with data protection, the Biden administration just wants to  talk and wait and talk some more, while China must have asked ChatGPT to assemble  every regulatory proposal for AI ever made by anyone and translate it into Chinese law.  Meanwhile, companies trying to satisfy everyone are imposing weird limits on their AI, such as Microsoft’s rule that asking for an image of Taiwan’s flag is a violation of its terms of service. (For the record, so is asking for China’s flag but not asking for an American or German flag.) Matthew Heiman and Jamil take us through the strange case of the airman who leaked classified secrets  on Discord. Jamil thinks we brought this on ourselves by not taking past leaks sufficiently seriously. Jamil and I cover the imminent  Montana statewide ban on TikTok. He thinks it’s a harbinger; I think it may be a distraction that, like Trump’s ban, produces more hostile judicial rulings. Nate unpacks the California Court of Appeals’  unpersuasive opinion on law enforcement use of geofencing warrants. Matthew and I dig into the  unanimous Supreme Court decision that should have independent administrative agencies like the Federal Trade Commission and Securities and Exchange Commission trembling. The court held that litigants don’t need to wend their way through years of proceedings in front of the agencies before they can go to court and challenge the agencies’ constitutional status. We both think that this is just the first shoe to drop. The next will be a  full-bore challenge to the constitutionality of agencies beholden neither to the executive or Congress. If the FTC loses that one, I predict, the old socialist realist statue “Man Controlling Trade” that graces its entry may be replaced by one that PETA and the Chamber of Commerce would like better. Bing’s Image Creator allowed me to illustrate that possible outcome. See attached.  In quick hits:    I update listeners on the fight over renewal of Section 702 of the Foreign Intelligence Surveillance Act and the  FBI’s search of its 702 database for messages about Congressman Darin LaHood (R-Ill.). It’s far from a scandal, and it may show that the whole effort to treat such searches as shocking privacy intrusions is bogus.     Hackers have claimed deep access to Western Digital systems. The good news is that they seem unable to encrypt it all, so they’re relying on doxing threats to earn the ransom they want.   The Indian government has given itself authority to “fact check and order the deletion of social media posts. Nobody thinks that’s a good idea, but when I ask whether it’s all that different from the CDC/social media alliance that suppressed true information during COVID times, Jamil disagrees. If you’ve missed our conservative catfights, this is a taste of things to come.   Download 453rd Episode (mp3) You can subscribe to The Cyberlaw Podcast using iTunes,  Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Every government on the planet announced last week an ambition to regulate artificial intelligence. <a href="https://culperpartners.com/" rel="nofollow" target="_blank">Nate Jones</a> and <a href="https://nationalsecurity.gmu.edu/about-us/faculty/jamil-jaffer/" rel="nofollow" target="_blank">Jamil Jaffer</a> take us through the announcements. What’s particularly discouraging is the lack of imagination, as governments dusted off their old prejudices to handle this new problem. Europe is <a href="https://www.reuters.com/technology/european-data-protection-board-discussing-ai-policy-thursday-meeting-2023-04-13/?utm_source=pocket_saves" rel="nofollow" target="_blank"> obsessed with data protection</a>, the Biden administration just wants to <a href="https://www.wsj.com/articles/biden-administration-weighs-possible-rules-for-ai-tools-like-chatgpt-46f8257b?mod=djemalertNEWS&amp;utm_source=pocket_saves" rel="nofollow" target="_blank"> talk and wait and talk some more</a>, while China must have asked ChatGPT to assemble <a href="https://www.theregister.com/2023/04/12/china_ai_regulation/?utm_source=pocket_saves" rel="nofollow" target="_blank"> every regulatory proposal for AI ever made by anyone</a> and translate it into Chinese law.  Meanwhile, companies trying to satisfy everyone are imposing weird limits on their AI, such as Microsoft’s rule that <a href="https://www.linkedin.com/in/stewartbaker/" rel="nofollow" target="_blank">asking for an image of Taiwan’s flag</a> is a violation of its terms of service. (For the record, so is asking for China’s flag <a href="https://twitter.com/stewartbaker/status/1648320715165138944" rel="nofollow" target="_blank">but not asking for an American or German flag.</a>) <a href="https://nationalsecurity.gmu.edu/matthew-r-a-heiman/" rel="nofollow" target="_blank">Matthew Heiman</a> and Jamil take us through the strange case of the airman who leaked classified secrets <a href="https://www.washingtonpost.com/national-security/2023/04/12/discord-leaked-documents/?utm_source=pocket_saves" rel="nofollow" target="_blank"> on Discord</a>. Jamil thinks we brought this on ourselves by not taking past leaks sufficiently seriously. Jamil and I cover the imminent <a href="https://www.wsj.com/articles/montana-lawmakers-approve-statewide-ban-on-tiktok-17dc0ea6?mod=djemalertNEWS&amp;utm_source=pocket_saves" rel="nofollow" target="_blank"> Montana statewide ban on TikTok</a>. He thinks it’s a harbinger; I think it may be a distraction that, like Trump’s ban, produces more hostile judicial rulings. Nate unpacks the California Court of Appeals’ <a href="https://webservices.courthousenews.com/sites/Data/AppellateOpinionUploads/2023-13-4--12-37-43-Geofence%20search%20B318310.PDF?utm_source=pocket_saves" rel="nofollow" target="_blank"> unpersuasive opinion on law enforcement use of geofencing warrants</a>. Matthew and I dig into the <a href="https://www.law360.com/technology/articles/1574865?nl_pk=8a4ebbfd-6806-4594-bba0-c159fe215eff&amp;nlaidx=0&amp;nlsidx=0&amp;read_more=1&amp;utm_source=pocket_saves" rel="nofollow" target="_blank"> unanimous Supreme Court decision</a> that should have independent administrative agencies like the Federal Trade Commission and Securities and Exchange Commission trembling. The court held that litigants don’t need to wend their way through years of proceedings in front of the agencies before they can go to court and challenge the agencies’ constitutional status. We both think that this is just the first shoe to drop. The next will be a <a href="https://urldefense.com/v3/__https:/www.law360.com/technology/articles/1597183?nl_pk=8a4ebbfd-6806-4594-bba0-c159fe215eff&amp;utm_source=newsletter&amp;utm_medium=email&amp;utm_campaign=technology&amp;utm_content=2023-04-17&amp;nlsidx=0&amp;nlaidx=0__;!!ApXA7kLm!3-rkkLTSJrBGuxn95um7HqNriGefwKeZuPwkDOJh7ktltjZQfNHqApjYC-6AxtqzvuWvEbYHOD9oR_Qnz2A$" rel="nofollow" target="_blank"> full-bore challenge to the constitutionality of agencies</a> beholden neither to the executive or Congress. If the FTC loses that one, I predict, the old socialist realist statue <a href="https://en.wikipedia.org/wiki/Man_Controlling_Trade" rel="nofollow" target="_blank">“Man Controlling Trade</a>” that graces its entry may be replaced by one that PETA and the Chamber of Commerce would like better. Bing’s Image Creator allowed me to illustrate that possible outcome. See attached.  In quick hits:  <ul> <li> I update listeners on the fight over renewal of Section 702 of the Foreign Intelligence Surveillance Act and the <a href="https://www.nytimes.com/2023/04/13/us/politics/fbi-darin-lahood.html" rel="nofollow" target="_blank"> FBI’s search of its 702 database</a> for messages about Congressman Darin LaHood (R-Ill.). It’s far from a scandal, and it may show that the whole effort to treat such searches as shocking privacy intrusions is bogus.  </li> <li> <a href="https://techcrunch.com/2023/04/13/hackers-claim-vast-access-to-western-digital-systems/?utm_source=pocket_saves" rel="nofollow" target="_blank"> Hackers have claimed deep access to Western Digital systems.</a> The good news is that they seem unable to encrypt it all, so they’re relying on doxing threats to earn the ransom they want. </li> <li> The <a href="https://restofworld.org/2023/indian-government-fact-check-delete-social-media/?utm_source=pocket_saves" rel="nofollow" target="_blank">Indian government has given itself authority to “fact check and order the deletion of social media posts</a>. Nobody thinks that’s a good idea, but when I ask whether it’s all that different from the CDC/social media alliance that suppressed true information during COVID times, Jamil disagrees. If you’ve missed our conservative catfights, this is a taste of things to come. </li> </ul> <a href="https://www.steptoe.com/podcasts/TheCyberlawPodcast-453.mp3" rel="nofollow" target="_blank">Download 453rd Episode (mp3)</a> You can subscribe to The Cyberlaw Podcast using <a href="https://itunes.apple.com/us/podcast/steptoe-cyberlaw-podcast/id830593115?mt=2" rel="nofollow" target="_blank">iTunes</a>, <a href="https://play.google.com/music/listen#/ps/Ikx2d2ncjvw6zuoq3zh4qp2i7qu" rel="nofollow" target="_blank"> Google Play</a>, <a href="https://open.spotify.com/show/3Co2wdTUaZr4Xqnlxs4soG" rel="nofollow" target="_blank">Spotify</a>, <a href="http://pcasts.in/steptoe" rel="nofollow" target="_blank">Pocket Casts</a>, or our <a href="http://www.steptoe.com/feed-Cyberlaw.rss" rel="nofollow" target="_blank">RSS feed.</a> As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with <a href="https://twitter.com/stewartbaker" rel="nofollow" target="_blank">@stewartbaker</a> on Twitter. Send your questions, comments, and suggestions for topics or interviewees to <a href="mailto:CyberlawPodcast@steptoe.com">CyberlawPodcast@steptoe.com</a>. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

The international regulatory dogpile

We do a long take on some of the AI safety reports that have been issued in recent weeks. Jeffery Atik first takes us through  the basics of attention based AI, and then into reports from  OpenAI and  Stanford on AI safety. Exactly what AI safety covers remains opaque (and toxic, in my view, after the ideological purges committed by Silicon Valley’s “trust and safety” bureaucracies) but there’s no doubt that a potential existential issue lurks below the surface of the most ambitious efforts. Whether ChatGPT’s stochastic parroting will ever pose a threat to humanity or not, it clearly poses a  threat to a lot of people’s reputations, Nick Weaver reports. One of the biggest intel leaks of the last decade may not have anything to do with cybersecurity. Instead, the disclosure of multiple highly classified documents seems to have depended on the ability  to fold, carry, and photograph the documents. While there’s some evidence that the Russian government may have piggybacked on the leak to sow disinformation, Nick says, the real puzzle is the leaker’s motivation. That leads us to the question whether being a griefer is grounds for losing your clearance.   Paul Rosenzweig educates us about the Restricting the Emergence of Security Threats that Risk Information and Communications Technology (RESTRICT) Act, which would empower the administration to limit or ban TikTok. He highlights the most prominent argument against the bill, which is, no surprise, the discretion the act would confer on the executive branch. The bill’s authors, Sen. Mark Warner (D-Va.) and Sen. John Thune (R-S.D.), have  responded to this criticism, but it looks as though they’ll be offering substantive limits on executive discretion only in the heat of Congressional action.  Nick is impressed by the law enforcement operation to shutter  Genesis Market, where credentials were widely sold to hackers. The  data seized by the FBI in the operation will pay dividends for years.   I give a warning to anyone who has left a sensitive intelligence job to work in the private sector: If your new employer has ties to a foreign government,  the Director of National Intelligence has issued a new directive that (sort of) puts you on notice that  you could be violating federal law. The directive means the intelligence community will do a pretty good job of telling its employees when they take a job that comes with post-employment restrictions, but IC alumni are so far getting very little guidance.  Nick exults in the tough tone taken by the Treasury in its report on  the illicit finance risk in decentralized finance. Paul and I cover Utah’s bill requiring teens to get parental approval to join social media sites. After twenty years of mocking red states for trying to control the internet’s impact on kids, it looks to me as though Knowledge Class parents are getting worried for their own kids. When the idea of age-checking internet users gets endorsed by the UK, Utah, and  the New Yorker, I suggest, those arguing against the proposal may have a tougher time than they did in the 90s.  And in quick hits:    Nick comments on the  massive 3CX supply-chain hack, which seems to have been a fishing-with-dynamite effort to steal a few people’s cryptocurrency.   I raise doubts about a much-cited claim that a Florida city’s water system was the victim of a cyber attack.   Nick unloads on Elon Musk for drawing a German investigation over  Twitter’s failure to promptly remove hate speech.   Paul and I note the UK’s most recent paper on  how to exercise cyber power responsibly.     And Nick and I puzzle over the conflict between  the Biden administration  and the New York Times about a spyware contract that supposedly undermined the administration’s stance on spyware.   Download 452nd Episode (mp3)  You can subscribe to The Cyberlaw Podcast using  iTunes,  Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

We do a long take on some of the AI safety reports that have been issued in recent weeks. <a href="https://www.lls.edu/faculty/facultylista-b/jefferyatik/" rel="nofollow" target="_blank">Jeffery Atik</a> first takes us through <a href="https://urldefense.com/v3/__https:/humanoid.tools/articles/attention-is-all-you-need-by-vaswani-et-al-2017-for-dummies/?utm_source=pocket_saves__;!!ApXA7kLm!1xQgkfCKZjR3S9Bw2Jl6nVsyHpapK5sOGfPxo9Bb65cBPnxjKzE0D2XK_iV5tT90J__uI-pVHGxlLohvRQTb7Q$" rel="nofollow" target="_blank"> the basics of attention based AI</a>, and then into reports from <a href="https://urldefense.com/v3/__https:/openai.com/blog/our-approach-to-ai-safety?utm_source=pocket_saves__;!!ApXA7kLm!1xQgkfCKZjR3S9Bw2Jl6nVsyHpapK5sOGfPxo9Bb65cBPnxjKzE0D2XK_iV5tT90J__uI-pVHGxlLogfzWwNYA$" rel="nofollow" target="_blank"> OpenAI</a> and <a href="https://urldefense.com/v3/__https:/aiindex.stanford.edu/report/?utm_source=pocket_saves__;!!ApXA7kLm!1xQgkfCKZjR3S9Bw2Jl6nVsyHpapK5sOGfPxo9Bb65cBPnxjKzE0D2XK_iV5tT90J__uI-pVHGxlLojk10iPyA$" rel="nofollow" target="_blank"> Stanford</a> on AI safety. Exactly what AI safety covers remains opaque (and toxic, in my view, after the ideological purges committed by Silicon Valley’s “trust and safety” bureaucracies) but there’s no doubt that a potential existential issue lurks below the surface of the most ambitious efforts. Whether ChatGPT’s stochastic parroting will ever pose a threat to humanity or not, it clearly poses a <a href="https://www.washingtonpost.com/technology/2023/04/05/chatgpt-lies/?utm_source=pocket_saves" rel="nofollow" target="_blank"> threat to a lot of people’s reputations</a>, <a href="http://www1.icsi.berkeley.edu/~nweaver/" rel="nofollow" target="_blank">Nick Weaver</a> reports. One of the biggest intel leaks of the last decade may not have anything to do with cybersecurity. Instead, the disclosure of multiple highly classified documents seems to have depended on the ability <a href="https://urldefense.com/v3/__https:/www.bellingcat.com/news/2023/04/09/from-discord-to-4chan-the-improbable-journey-of-a-us-defence-leak/__;!!ApXA7kLm!wgA86akG-cDGMIOoyVAfx0nSuq1b57crNYa_sFHwgWve24hPQC8PncqcyYthpuIW3J17JRpUFeAZGanxLYrwZH0$" rel="nofollow" target="_blank"> to fold, carry, and photograph the documents</a>. While there’s some evidence that the Russian government may have piggybacked on the leak to sow disinformation, Nick says, the real puzzle is the leaker’s motivation. That leads us to the question whether being a griefer is grounds for losing your clearance.   <a href="http://redbranchconsulting.com/" rel="nofollow" target="_blank">Paul Rosenzweig</a> educates us about the Restricting the Emergence of Security Threats that Risk Information and Communications Technology (RESTRICT) Act, which would empower the administration to limit or ban TikTok. He highlights the most prominent argument against the bill, which is, no surprise, the discretion the act would confer on the executive branch. The bill’s authors, Sen. Mark Warner (D-Va.) and Sen. John Thune (R-S.D.), have <a href="https://www.wsj.com/articles/our-bill-is-the-best-way-to-counter-the-tiktok-threat-restrict-act-ban-national-security-congress-trump-20b5ac27?utm_source=pocket_saves" rel="nofollow" target="_blank"> responded to this criticism</a>, but it looks as though they’ll be offering substantive limits on executive discretion only in the heat of Congressional action.  Nick is impressed by the law enforcement operation to shutter <a href="https://therecord.media/genesis-market-takedown-cybercrime?utm_source=pocket_saves" rel="nofollow" target="_blank"> Genesis Market, where credentials were widely sold to hackers</a>. The <a href="https://therecord.media/genesis-market-fbi-access-backend-servers?utm_source=pocket_saves" rel="nofollow" target="_blank"> data seized by the FBI in the operation</a> will pay dividends for years.   I give a warning to anyone who has left a sensitive intelligence job to work in the private sector: If your new employer has ties to a foreign government, <a href="https://www.dni.gov/index.php/newsroom/press-releases/press-releases-2023/item/2368-issuance-of-intelligence-community-directive-712-requirements-for-certain-employment-activities-by-former-intelligence-community-employees?utm_source=pocket_saves" rel="nofollow" target="_blank"> the Director of National Intelligence has issued a new directive</a> that (sort of) puts you on notice that <a href="https://www.dni.gov/files/documents/ICD/ICD_712.pdf?utm_source=pocket_saves" rel="nofollow" target="_blank"> you could be violating federal law</a>. The directive means the intelligence community will do a pretty good job of telling its employees when they take a job that comes with post-employment restrictions, but IC alumni are so far getting very little guidance.  Nick exults in the tough tone taken by the Treasury in its report on <a href="https://home.treasury.gov/system/files/136/DeFi-Risk-Full-Review.pdf?utm_source=pocket_saves" rel="nofollow" target="_blank"> the illicit finance risk in decentralized finance</a>. Paul and I cover<a href="https://www.cnn.com/2023/03/23/tech/utah-social-media-regulation-act/index.html" rel="nofollow" target="_blank"> Utah’s bill requiring teens to get parental approval to join social media sites</a>. After twenty years of mocking red states for trying to control the internet’s impact on kids, it looks to me as though Knowledge Class parents are getting worried for their own kids. When the idea of age-checking internet users gets endorsed by the UK, Utah, and <a href="https://www.newyorker.com/news/our-columnists/the-case-for-banning-children-from-social-media?utm_source=pocket_saves" rel="nofollow" target="_blank"> the New Yorker</a>, I suggest, those arguing against the proposal may have a tougher time than they did in the 90s.  And in quick hits:  <ul> <li> Nick comments on the <a href="https://www.wired.com/story/3cx-supply-chain-attack-north-korea-cryptocurrency-targets/?utm_source=pocket_saves" rel="nofollow" target="_blank"> massive 3CX supply-chain hack</a>, which seems to have been a fishing-with-dynamite effort to steal a few people’s cryptocurrency. </li> <li> I raise doubts about a much-cited claim that a <a href="https://gcn.com/cybersecurity/2023/03/florida-city-water-cyber-incident-allegedly-caused-employee-error/384267/" rel="nofollow" target="_blank">Florida city’s water system was the victim of a cyber attack</a>. </li> <li> Nick unloads on Elon Musk for drawing a German investigation over <a href="https://techcrunch.com/2023/04/04/twitter-netzdg-germany/?utm_source=pocket_saves" rel="nofollow" target="_blank"> Twitter’s failure to promptly remove hate speech</a>. </li> <li> Paul and I note the UK’s most recent paper on <a href="https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1148278/Responsible_Cyber_Power_in_Practice.pdf?utm_source=pocket_saves" rel="nofollow" target="_blank"> how to exercise cyber power responsibly</a>.   </li> <li> And Nick and I puzzle over the conflict between <a href="https://subscriber.politicopro.com/newsletter/2023/04/white-house-pushes-back-on-spyware-allegations-00090288?utm_source=pocket_saves" rel="nofollow" target="_blank"> the Biden administration</a> <a href="https://www.nytimes.com/2023/04/02/us/politics/nso-contract-us-spy.html?utm_source=pocket_saves" rel="nofollow" target="_blank"> and the New York Times</a> about a spyware contract that supposedly undermined the administration’s stance on spyware. </li> </ul> <a href="https://www.steptoe.com/podcasts/TheCyberlawPodcast-452.mp3" rel="nofollow" target="_blank">Download 452nd Episode (mp3)</a> You can subscribe to The Cyberlaw Podcast using <a href="https://itunes.apple.com/us/podcast/steptoe-cyberlaw-podcast/id830593115?mt=2" rel="nofollow" target="_blank"> iTunes</a>, <a href="https://play.google.com/music/listen#/ps/Ikx2d2ncjvw6zuoq3zh4qp2i7qu" rel="nofollow" target="_blank"> Google Play</a>, <a href="https://open.spotify.com/show/3Co2wdTUaZr4Xqnlxs4soG" rel="nofollow" target="_blank">Spotify</a>, <a href="http://pcasts.in/steptoe" rel="nofollow" target="_blank">Pocket Casts</a>, or our <a href="http://www.steptoe.com/feed-Cyberlaw.rss" rel="nofollow" target="_blank">RSS feed.</a> As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with <a href="https://twitter.com/stewartbaker" rel="nofollow" target="_blank">@stewartbaker</a> on Twitter. Send your questions, comments, and suggestions for topics or interviewees to <a href="mailto:CyberlawPodcast@steptoe.com">CyberlawPodcast@steptoe.com</a>. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

What Makes AI Safe?

Dmitri Alperovitch joins the Cyberlaw Podcast to discuss the state of semiconductor decoupling between China and the West. It’s a broad movement, fed by both sides. China has announced  that it’s investigating Micron to see if its memory chips should still be allowed into China’s supply chain (spoiler: almost certainly not). Japan has  tightened up its chip-making export control rules, which will align it with U.S. and Dutch restrictions, all with the aim of slowing China’s ability to make the most powerful chips. Meanwhile,  South Korea is boosting its chipmakers with new tax breaks, and  Huawei is reporting a profit squeeze. The Biden administration spent much of last week on spyware policy, Winnona DeSombre Berners reports. How much it actually accomplished isn’t clear. The  spyware executive order restricts U.S. government purchases of surveillance tools that threaten U.S. security or that have been misused against civil society targets. And a group of like-minded nations have set forth  the principles they think should govern sales of spyware. But it’s not as though countries that want spyware are going to have a tough time finding, I observe, despite all the virtue signaling. Case in point:  Iran is getting plenty of new surveillance tech from Russia these days. And spyware campaigns  continue to proliferate.  Winnona and Dmitri nominate North Korea for the title “Most Innovative Cyber Power,” acknowledging its  creative use of social engineering to steal cryptocurrency and gain access to U.S. policy influencers. Dmitri covers the TikTok beat, including the prospects of the Restricting the Emergence of Security Threats that Risk Information and Communications Technology (RESTRICT) Act., which he still rates high despite some criticism from the right. Winnona and I debate the need for another piece of legislation given the breadth of CFIUS review and International Emergency Economic Powers Act sanctions.  Dmitri and I note the arrival of GPT-4 cybersecurity, as  Microsoft introduces “Security Copilot.” We question whether this will turn out to be a game changer, but it does suggest that bespoke AI tools could play a role in cybersecurity (and pretty much everything else.)  In other AI news, Dmitri and I wonder at Italy’s decision to  cut itself off from access to ChatGPT by claiming that it violates Italian data protection law. That may turn out to be a hard case to prove, especially since the regulator has no clear jurisdiction over OpenAI, which is now selling nothing in Italy. In the same vein, there may be a safety reason to be worried by how fast AI is proceeding these days, but the letter  proposing a six-month pause for more safety review  is hardly persuasive—specially in a world where “safety” seems to mostly be about stamping out bad pronouns.  In news Nick Weaver will kick himself for missing, Binance is facing  a bombshell complaint from the Commodities Futures Trading Commission (CFTC) (the Binance response is  here). The CFTC clearly had access to the suicidally candid messages exchanged among Binance’s compliance team. I predict criminal indictments in the near future and wonder if the CFTC’s taking the lead on the issue has given it a jurisdictional leg up on the SEC in the turf fight over who regulates cryptocurrency. Finally, we close with a review of a  book arguing that pretty much anyone who ever uttered the words  “China’s peaceful rise” was the victim of a well-planned and  highly successful Chinese influence operation. Download 451st Episode (mp3) You can subscribe to The Cyberlaw Podcast using iTunes,  Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

<a href="https://silverado.org/" rel="nofollow" target="_blank">Dmitri Alperovitch</a> joins the Cyberlaw Podcast to discuss the state of semiconductor decoupling between China and the West. It’s a broad movement, fed by both sides. China has announced <a href="https://www.reuters.com/technology/china-conduct-cybersecurity-review-chipmaker-microns-products-2023-03-31/" rel="nofollow" target="_blank"> that it’s investigating Micron</a> to see if its memory chips should still be allowed into China’s supply chain (spoiler: almost certainly not). Japan has <a href="https://www.reuters.com/technology/japan-restrict-chipmaking-equipment-exports-aligning-it-with-us-china-curbs-2023-03-31/" rel="nofollow" target="_blank"> tightened up its chip-making export control rules</a>, which will align it with U.S. and Dutch restrictions, all with the aim of slowing China’s ability to make the most powerful chips. Meanwhile, <a href="https://www.bloomberg.com/news/articles/2023-03-29/south-korea-to-pass-its-own-chips-act-amid-us-china-friction#xj4y7vzkg" rel="nofollow" target="_blank"> South Korea is boosting its chipmakers</a> with new tax breaks, and <a href="https://www.cnbc.com/2023/03/31/huawei-earnings-2022-biggest-profit-decline-since-2011-revenue-flat.html" rel="nofollow" target="_blank"> Huawei is reporting a profit squeeze</a>. The Biden administration spent much of last week on spyware policy, <a href="https://www.atlanticcouncil.org/expert/winnona-desombre-bernsen/" rel="nofollow" target="_blank">Winnona DeSombre Berners</a> reports. How much it actually accomplished isn’t clear. The <a href="https://www.wsj.com/articles/biden-restricts-use-of-commercial-hacking-tools-by-u-s-agencies-f0a4afda?mod=djemalertNEWS" rel="nofollow" target="_blank"> spyware executive order</a> restricts U.S. government purchases of surveillance tools that threaten U.S. security or that have been misused against civil society targets. And a group of like-minded nations have set forth <a href="https://www.reuters.com/technology/us-partner-countries-call-controls-counter-misuse-spyware-2023-03-30/?utm_source=pocket_saves" rel="nofollow" target="_blank"> the principles they think should govern sales of spyware</a>. But it’s not as though countries that want spyware are going to have a tough time finding, I observe, despite all the virtue signaling. Case in point: <a href="https://www.wsj.com/articles/russia-supplies-iran-with-cyber-weapons-as-military-cooperation-grows-b14b94cd?mod=djemalertNEWS" rel="nofollow" target="_blank"> Iran is getting plenty</a> of new surveillance tech from Russia these days. And spyware campaigns <a href="https://therecord.media/spyware-google-italy-malaysia-kazakhstan-uae" rel="nofollow" target="_blank"> continue to proliferate</a>.  Winnona and Dmitri nominate North Korea for the title “Most Innovative Cyber Power,” acknowledging its <a href="https://www.washingtonpost.com/world/2023/03/28/north-korea-hackers-phishing-attack/?utm_source=pocket_saves" rel="nofollow" target="_blank"> creative use of social engineering</a> to steal cryptocurrency and gain access to U.S. policy influencers. Dmitri covers the TikTok beat, including the prospects of the Restricting the Emergence of Security Threats that Risk Information and Communications Technology (RESTRICT) Act., which he still rates high despite some criticism from the right. Winnona and I debate the need for another piece of legislation given the breadth of CFIUS review and International Emergency Economic Powers Act sanctions.  Dmitri and I note the arrival of GPT-4 cybersecurity, as <a href="https://www.theverge.com/2023/3/28/23659711/microsoft-security-copilot-gpt-4-ai-tool-features" rel="nofollow" target="_blank"> Microsoft introduces “Security Copilot.”</a> We question whether this will turn out to be a game changer, but it does suggest that bespoke AI tools could play a role in cybersecurity (and pretty much everything else.)  In other AI news, Dmitri and I wonder at Italy’s decision to <a href="https://www.politico.eu/article/italian-privacy-regulator-bans-chatgpt/" rel="nofollow" target="_blank"> cut itself off from access to ChatGPT</a> by claiming that it violates Italian data protection law. That may turn out to be a hard case to prove, especially since the regulator has no clear jurisdiction over OpenAI, which is now selling nothing in Italy. In the same vein, there may be a safety reason to be worried by how fast AI is proceeding these days, but the letter <a href="https://www.vice.com/en/article/qjvppm/the-open-letter-to-stop-dangerous-ai-race-is-a-huge-mess" rel="nofollow" target="_blank"> proposing a six-month pause</a> for more safety review  is hardly persuasive—specially in a world where “safety” seems to mostly be about stamping out bad pronouns.  In news <a href="http://www1.icsi.berkeley.edu/~nweaver/" rel="nofollow" target="_blank">Nick Weaver</a> will kick himself for missing, Binance is facing <a href="https://downloads.coindesk.com/legal/cftc_v_binance.pdf?utm_source=pocket_saves" rel="nofollow" target="_blank"> a bombshell complaint</a> from the Commodities Futures Trading Commission (CFTC) (the Binance response is <a href="https://www.binance.com/en/blog/from-cz/czs-response-to-the-cftc-complaint-2408916493005890282" rel="nofollow" target="_blank"> here</a>). The CFTC clearly had access to the suicidally candid messages exchanged among Binance’s compliance team. I predict criminal indictments in the near future and wonder if the CFTC’s taking the lead on the issue has given it a jurisdictional leg up on the SEC in the turf fight over who regulates cryptocurrency. Finally, we close with a review of a  book arguing that pretty much anyone who ever uttered the words  “China’s peaceful rise” was the victim of a well-planned and <a href="https://www.lawfareblog.com/how-chinas-spies-fooled-america-wanted-be-fooled" rel="nofollow" target="_blank"> highly successful Chinese influence operation</a>. <a href="https://www.steptoe.com/podcasts/TheCyberlawPodcast-451.mp3" rel="nofollow" target="_blank">Download 451st Episode (mp3)</a> You can subscribe to The Cyberlaw Podcast using <a href="https://itunes.apple.com/us/podcast/steptoe-cyberlaw-podcast/id830593115?mt=2" rel="nofollow" target="_blank">iTunes</a>, <a href="https://play.google.com/music/listen#/ps/Ikx2d2ncjvw6zuoq3zh4qp2i7qu" rel="nofollow" target="_blank"> Google Play</a>, <a href="https://open.spotify.com/show/3Co2wdTUaZr4Xqnlxs4soG" rel="nofollow" target="_blank">Spotify</a>, <a href="http://pcasts.in/steptoe" rel="nofollow" target="_blank">Pocket Casts</a>, or our <a href="http://www.steptoe.com/feed-Cyberlaw.rss" rel="nofollow" target="_blank">RSS feed.</a> As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with <a href="https://twitter.com/stewartbaker" rel="nofollow" target="_blank">@stewartbaker</a> on Twitter. Send your questions, comments, and suggestions for topics or interviewees to <a href="mailto:CyberlawPodcast@steptoe.com">CyberlawPodcast@steptoe.com</a>. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Letting the Chips Fall

The Capitol Hill hearings featuring TikTok’s CEO lead off episode 450 of the Cyberlaw Podcast. The CEO handled  the endless stream of Congressional accusations and suspicion about as well as could have been expected.  And it did him as little good as a cynic would have expected.  Jim Dempsey and Mark MacCarthy think Congress is moving toward action on Chinese IT products—probably in the form of  the bipartisan Restricting the Emergence of Security Threats that Risk Information and Communications Technology (RESTRICT) Act. But passing legislation and actually doing something about China’s IT successes are two very different things. The FTC is jumping into the arena on cloud services, Mark tells us, and it can’t escape its DNA—dwelling on possible industry concentration and lock-in and not asking much about the national security implications of knocking off a bunch of American cloud providers when the alternatives are largely Chinese cloud providers. The FTC’s myopia means that the administration won’t get as much help as it could from the FTC on cloud security measures. I reissue my standard objection to the FTC’s refusal to follow the FCC’s lead in deferring on national security to executive branch concerns. Mark and I disagree about whether the FTC Act forces the Commission to limit itself to consumer protection. Jim Dempsey reviews the latest AI releases,  including Google’s Bard, which seems to have many of the same hallucination problems as OpenAI’s engines. Jim and I debate what I consider the wacky and unjustified fascination in the press with catching AI engaging in wrong think. I believe it’s just a mechanism for justifying the imposition of left-wing values on AI’s output —which already scores left/libertarian on 14 of 15 standard tests for identifying ideological affiliation. Similarly, I question the effort to stop AI from hallucinating footnotes in support of its erroneous facts. If ever there were a case for generative AI correction of AI errors, the fake citation problem seems like a natural. Speaking of Silicon Valley’s lying problem, Mark reminds us that social media is absolutely immune for user speech, even after it gets notice that the speech is harmful and false. He reminds us of his  thoughtful argument in favor of tweaking section 230 to more closely resemble the notice and action obligations found in the Digital Millennium Copyright Act (DMCA). I argue that the DMCA has not so much solved the incentives for overcensoring speech as it has surrendered to them.   Jim introduces us to an emerging trend in state privacy law: bills that industry supports. Iowa’s new law is the exemplar; Jim questions whether it will satisfy users in the long run.   I summarize  Hachette v. Internet Archive, in which Judge John G. Koeltl delivers a harsh rebuke to internet hippies everywhere, ruling that the Internet Archive violated copyright in its effort to create a digital equivalent to public library lending. The judge’s lesson for the rest of us: You might think fair use is a thing, but it’s not. Get over it. In quick hits,    I note that the Cyberlaw Podcast scooped WIRED in  covering the GSA’s lies about the security of login.gov and its later effort to justify those lies by invoking “equity”—currently replacing patriotism as the last resort of scoundrels.   And I offer a brief, nostalgic requiem for Toshiba, which is being  broken up for scrap by what’s left of Japan Inc. Thirty years ago, Toshiba was treated on the Hill like Huawei is today – a scary and unstoppable competitor who threatened the American way of life.  Now, not so much.    Download 450th Episode (mp3) You can subscribe to The Cyberlaw Podcast using iTunes,  Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

The Capitol Hill hearings featuring TikTok’s CEO lead off episode 450 of the Cyberlaw Podcast. The CEO handled <a href="https://www.wsj.com/articles/tiktok-ban-ceo-congress-hearing-4bca3e2a?mod=hp_lead_pos1&amp;utm_source=pocket_saves" rel="nofollow" target="_blank"> the endless stream of Congressional accusations and suspicion</a> about as well as could have been expected.  And it did him as little good as a cynic would have expected. <a href="https://www.law.berkeley.edu/our-faculty/faculty-profiles/james-dempsey/#tab_profile" rel="nofollow" target="_blank"> Jim Dempsey</a> and <a href="https://cbpp.georgetown.edu/people/mark-maccarthy/" rel="nofollow" target="_blank">Mark MacCarthy</a> think Congress is moving toward action on Chinese IT products—probably in the form of <a href="https://www.lawfareblog.com/two-new-bills-tiktok-and-beyond-data-act-and-restrict-act?utm_source=pocket_saves" rel="nofollow" target="_blank"> the bipartisan Restricting the Emergence of Security Threats that Risk Information and Communications Technology (RESTRICT) Act</a>. But passing legislation and actually doing something about China’s IT successes are two very different things. The FTC <a href="https://risky.biz/RBNEWS127/" rel="nofollow" target="_blank">is jumping into the arena on cloud services</a>, Mark tells us, and it can’t escape its DNA—dwelling on possible industry concentration and lock-in and not asking much about the national security implications of knocking off a bunch of American cloud providers when the alternatives are largely Chinese cloud providers. The FTC’s myopia means that the administration won’t get as much help as it could from the FTC on cloud security measures. I reissue my standard objection to the FTC’s refusal to follow the FCC’s lead in deferring on national security to executive branch concerns. Mark and I disagree about whether the FTC Act forces the Commission to limit itself to consumer protection. Jim Dempsey reviews the latest AI releases, <a href="https://www.nytimes.com/2023/03/21/technology/google-bard-chatbot.html?utm_source=pocket_saves" rel="nofollow" target="_blank"> including Google’s Bard</a>, which seems to have many of the same hallucination problems as OpenAI’s engines. Jim and I debate what I consider the wacky and unjustified fascination in the press with catching AI engaging in wrong think. I believe it’s just a mechanism for justifying the imposition of left-wing values on AI’s output —which <a href="https://www.mdpi.com/2076-0760/12/3/148?utm_source=pocket_saves" rel="nofollow" target="_blank">already scores left/libertarian on 14 of 15 standard tests</a> for identifying ideological affiliation. Similarly, I question the effort to stop AI from hallucinating footnotes in support of its erroneous facts. If ever there were a case for generative AI correction of AI errors, the fake citation problem seems like a natural. Speaking of Silicon Valley’s lying problem, Mark reminds us that social media is absolutely immune for user speech, even after it gets notice that the speech is harmful and false. He reminds us of his <a href="https://www.lawfareblog.com/congress-should-reform-section-230-light-oral-argument-gonzalez?utm_source=pocket_saves" rel="nofollow" target="_blank"> thoughtful argument</a> in favor of tweaking section 230 to more closely resemble the notice and action obligations found in the Digital Millennium Copyright Act (DMCA). I argue that the DMCA has not so much solved the incentives for overcensoring speech as it has surrendered to them.   Jim introduces us to an emerging trend in state privacy law: bills that industry supports. <a href="https://urldefense.com/v3/__https:/iapp.org/news/a/iowa-set-to-finalize-sixth-us-comprehensive-state-privacy-law/__;!!ApXA7kLm!1og6jlUjqvymESEsSV_trIl232CNv5VKkM8cFnNr1y-k35RILHlV2HCohzvfFg8oK2K6e_xozlphQcAY9GfY$" rel="nofollow" target="_blank">Iowa’s new law is the exemplar</a>; Jim questions whether it will satisfy users in the long run.   I summarize <a href="https://storage.courtlistener.com/recap/gov.uscourts.nysd.537900/gov.uscourts.nysd.537900.188.0.pdf?utm_source=pocket_saves" rel="nofollow" target="_blank"> Hachette v. Internet Archive</a>, in which Judge John G. Koeltl delivers a harsh rebuke to internet hippies everywhere, ruling that the Internet Archive violated copyright in its effort to create a digital equivalent to public library lending. The judge’s lesson for the rest of us: You might think fair use is a thing, but it’s not. Get over it. In quick hits,  <ul> <li> I note that the Cyberlaw Podcast scooped WIRED in <a href="https://www.wired.com/story/a-us-agency-rejected-face-recognition-and-landed-in-big-trouble/?utm_source=pocket_saves" rel="nofollow" target="_blank"> covering the GSA’s lies about the security of login.gov</a> and its later effort to justify those lies by invoking “equity”—currently replacing patriotism as the last resort of scoundrels. </li> <li> And I offer a brief, nostalgic requiem for Toshiba, which is being <a href="https://www.reuters.com/markets/deals/toshiba-board-agrees-accept-jips-153-bln-buyout-proposal-nikkei-2023-03-23/?utm_source=pocket_saves" rel="nofollow" target="_blank"> broken up for scrap by what’s left of Japan Inc</a>. Thirty years ago, Toshiba was treated on the Hill like Huawei is today – a scary and unstoppable competitor who threatened the American way of life.  Now, not so much.  </li> </ul> <a href="https://www.steptoe.com/podcasts/TheCyberlawPodcast-450.mp3" rel="nofollow" target="_blank">Download 450th Episode (mp3)</a> You can subscribe to The Cyberlaw Podcast using <a href="https://itunes.apple.com/us/podcast/steptoe-cyberlaw-podcast/id830593115?mt=2" rel="nofollow" target="_blank">iTunes</a>, <a href="https://play.google.com/music/listen#/ps/Ikx2d2ncjvw6zuoq3zh4qp2i7qu" rel="nofollow" target="_blank"> Google Play</a>, <a href="https://open.spotify.com/show/3Co2wdTUaZr4Xqnlxs4soG" rel="nofollow" target="_blank">Spotify</a>, <a href="http://pcasts.in/steptoe" rel="nofollow" target="_blank">Pocket Casts</a>, or our <a href="http://www.steptoe.com/feed-Cyberlaw.rss" rel="nofollow" target="_blank">RSS feed.</a> As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with <a href="https://twitter.com/stewartbaker" rel="nofollow" target="_blank">@stewartbaker</a> on Twitter. Send your questions, comments, and suggestions for topics or interviewees to <a href="mailto:CyberlawPodcast@steptoe.com">CyberlawPodcast@steptoe.com</a>. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

China in the Bull Shop

This is my go to podcast for technology and law related issues. Stewart does a great job of orchestrating the discussion and bringing out the fun and interesting bits.

This podcast is a must for technology lawyers

Excellent podcast&#39;s!   Very up to date and excellent guests.

Customer

The Cyberlaw Podcast

The Best Multi-Part Documentaries, with documentaries on Obama, Federer vs Nadal, the making of Star Wars, Netflix vs Blockbuster and more. Add episodes you're interested into your queue below!

Best Multi-Part Documentaries

The best podcast episodes on parenting. Interviewing experts and talking through common issues surrounding parenting. This topic is filled with important lessons and insights for anyone listening. Add episodes you're interested into your queue below!