We interview Ben Buchanan about his new book, The Hacker and the State: Cyber Attacks and the New Normal of Geopolitics. This is Ben’s second book and second interview on the podcast about international conflict and cyber weapons. It’s safe to say that America’s strategic posture hasn’t improved. We face more adversaries with more tools and a considerably greater appetite for cyber adventurism. Ben recaps some of the stories that were undercovered in the US press when they occurred. The second large attack on Ukraine’s grid, for example, was little noticed during the US election of 2016, but it appears more ominous after a recent analysis of the tools used, and perhaps most importantly, those available to the GRU but not used. Meanwhile, the US is not making much progress in cyberspace on the basic requirement of a great power, which is making our enemies fear us.

Continue Reading Episode 301: Ratchet to Disaster

The California Consumer Privacy Act (CCPA) has been in effect only since January 1, but it has already been cited in a lawsuit, apparently for the first time. On February 3, plaintiffs filed a class action complaint in the US District Court for the Northern District of California against retailer Hanna Andersson, LLC and Salesforce.com, Inc., over a data breach suffered by Hanna Andersson. The complaint makes only passing reference to the CCPA and does not rely on it as the basis for a claim, because the breach happened in 2019, before the CCPA took effect. Still, the citation is worth noting, since the CCPA provides for statutory damages where a company’s failure to implement reasonable security practices results in a data breach. The CCPA thus promises to make data breaches much more costly for victim companies. Retailers and other companies should look at the citation of the CCPA in Barnes v. Hanna Andersson, LLC as a shot across the bow, and be sure that their data security practices are up to snuff.

The complaint in Barnes states simply that Hanna Andersson customers’ injuries “may include…deprivation of rights they possess under the California Unfair Competition Law (Cal. Bus. & Prof. Code § 17200) and California Consumer Privacy Act (Cal. Civ. Code § 1798.100, et seq.).” It also later says that plaintiffs “reserve the right to amend th[e] Complaint as of right to seek damages and relief under Cal. Civ. Code § 1798.100, et seq.” It is not clear how the plaintiffs might attempt to apply the CCPA to actions that took place before the statute’s effective date. But never underestimate the creativity of plaintiffs’ lawyers.

 

In breaking news from 1995, the Washington Post takes advantage of a leaked CIA history paper to retell the remarkable tale of Crypto AG, a purveyor of encryption products to dozens of governments – and allegedly a wholly controlled subsidiary of US and German intelligence. Nick Weaver, Paul Rosenzweig, and I are astonished at the derring-do and unapologetic enthusiasm for intelligence collection. I mean, really: The Pope?

This week’s interview is with Jonathan Reiber, a writer and strategist in Oakland, California, and former Chief Strategy Officer for Cyber Policy and Speechwriter at the Department of Defense, currently senior advisor at Technology for Global Security and visiting scholar at the UC Berkeley Center for Long-Term Cybersecurity. His recent report offers a candid view of strained relations between Silicon Valley and the Pentagon. The interview explores the reasons for that strain, the importance of bridging the gap, and how that can best be done.

Continue Reading Episode 300: Wiretapping the Pope

On February 7, 2020, California Attorney General (AG) Xavier Becerra released a second version of draft regulations implementing and interpreting the California Consumer Privacy Act (CCPA). The second iteration of the Attorney General’s draft regulations contain numerous important changes from the initial draft, some of which are summarized in this alert. One of the most disappointing aspects of the new draft, particularly for retailers, is that the AG seems to have doubled down on the requirement that businesses explain the method that they use for determining what “financial incentives” they offer consumers for the collection of their personal information, such as through loyalty programs—a requirement that seems based on a misapprehension of how such programs actually work.

Click here to read the most significant changes to the Attorney General’s draft regulations.

 

 

The next trade war will be over transatlantic data flows, and it will make the fight with China look like a picnic. That’s the subject of this episode’s interview. The European Court of Justice is poised to go nuclear – to cut off US companies’ access to European customer data unless the US lets European courts and data protection agencies refashion its intelligence capabilities according to standards no European government has ever been required to meet. It is Europe in full neocolonial mode, but it has sailed below the radar, disguised as an abstruse European legal fight. Maury Shenk and I interview Peter Swire on the Schrems cases that look nearly certain to provoke a transatlantic trade and intelligence crisis. Actually, Maury interviews Peter, and I throw bombs into the conversation. But if ever there were a cyberlaw topic that deserves more bomb-throwing, this is it.

Continue Reading Episode 299: The European Court of Justice Is About to Kick Off a Massive US-EU Trade War

 

Nick Weaver and I debate Sens. Graham and Blumenthal’s EARN IT Act, a proposal to require that social media firms follow best practices on preventing child abuse. If they don’t, they won’t get full Section 230 immunity from liability for recklessly allowing the abuse. Nick thinks the idea is ill-conceived and doomed to fail. I think there’s a core of sense to the proposal, which simply asks that Silicon Valley firms who are reckless about child abuse on their networks pay for the social costs they’re imposing on society. Since the bill gives the attorney general authority to modify the best practices submitted by a commission of industry, academic, and civic representatives, critics are sure that the final product will reduce corporate incentives to offer end-to-end encryption.

Continue Reading Episode 298: Bill Barr as Bogeyman

 

This episode features an interview on the Bezos phone flap with David Kaye and Alex Stamos. David is a UN Special Rapporteur and clinical professor of law at UC Irvine who first drew attention to an FTI Consulting report concluding that the Saudis did hack Bezos’ phone. Alex is director of the Stanford Internet Observatory and was the CSO at Facebook; he thinks the technical case against the Saudis needs work, and he calls for a supplemental forensic review of the phone.

Continue Reading Episode 297: Did the Saudi Crown Prince hack Jeff Bezos’s phone?

 

This week’s episode includes an interview with Bruce Schneier about his recent op-ed on privacy. Bruce and I are both dubious about the current media trope that facial recognition technology was spawned by the Antichrist. He notes that what we are really worried about is a lot bigger than facial recognition and offers ways in which the law could address our deeper worry. I’m less optimistic about our ability to write or enforce laws designed to restrict use of information that gets cheaper to collect, to correlate, and to store every year. It’s a good, civilized exchange.

Continue Reading Episode 296: Is CCPA short for “Law of Unintended Consequences”?

 

There’s a fine line between legislation addressing deepfakes and legislation that is itself a deep fake. Nate Jones reports on the only federal legislation addressing the problem so far. I claim that it is well short of a serious regulatory effort – and pretty close to a fake law.

In contrast, India seems serious about imposing liability on companies whose unbreakable end-to-end crypto causes harm, at least to judge from the howls of the usual defenders of such crypto. David Kris explains how the law will work. I ask why Silicon Valley gets to impose the externalities of encryption-facilitated crime on society without consequence when we’d never allow tech companies to say that society should pick up the tab for their pollution because their products are so cool. In related news, the FBI may be turning the Pensacola military terrorism attack into a slow-motion replay of the San Bernardino fight with Apple, this time with more top cover.

Continue Reading Episode 295: The line between deepfake legislation and deeply fake legislation

 

For this special edition of the Cyberlaw Podcast, we’ve convened a panel of experts on intelligence and surveillance legal matters. We take a look at the Department of Justice Inspector General’s report on the FBI’s use of FISA applications – and the many errors in those applications. We also touch on FBI Director Wray’s response, as well as a public order issued by the Foreign Intelligence Surveillance Court. We wrap up with thoughts on how to resolve some of the issues identified by the IG’s report and suggestions for improving the FISA process.

Continue Reading Episode 294: Examining the DOJ Inspector General’s FBI-FISA Report