Our interview is with Bruce Schneier, who has coauthored a paper about how to push security back up the Internet-of-things supply chain: The reverse cascade: Enforcing security on the global IoT supply chain. His solution is hard on IOT affordability and hard on big retailers and other middlemen, who will face new
Privacy Regulation
California Attorney General Releases Third Draft of CCPA Regulations
On March 11, California Attorney General (AG) Xavier Becerra released a third version of draft regulations implementing the California Consumer Privacy Act (CCPA). The third draft contains relatively minor changes from the second draft, which was released in February, suggesting that the AG is close to finalizing the regulations, and that enforcement is likely to begin on schedule on July 1, 2020.
…
Continue Reading California Attorney General Releases Third Draft of CCPA Regulations
Episode 303: Another merger the FTC should block
This is a bonus episode of the Cyberlaw Podcast – a freestanding interview of Noah Phillips, a Commissioner of the Federal Trade Commission. The topic of the interview is whether privacy and antitrust analysis should be merged, especially in the context of Silicon Valley and its social media platforms. Commissioner Phillips, who has devoted considerable attention to the privacy side of the FTC’s jurisdiction, recently delivered a speech on the topic and telegraphed his doubts in the title: “Should We Block This Merger? Some Thoughts on Converging Antitrust and Privacy.” Subject to the usual Cyberlaw Podcast injunction that he speaks only for himself and not his institution or relatives, Commissioner Phillips lays out the very real connections between personal data and industry dominance as well as the complexities that come from trying to use antitrust to solve privacy problems. Among the complexities: the key to more competition among social media giants could well be more sharing between companies of the personal data that fuels their network effects, and corporate sharing of personal data is what privacy advocates have spent a decade crusading against. It’s a wide-ranging interview, touching on, among other things, whether antitrust can be used to solve Silicon Valley’s censorship problem (he’s skeptical) and what he thinks of suggestions in Europe that perhaps the Schrems problem can be solved by declaring that post-CCPA California meets EU data privacy standards. Commissioner Phillips is bemused; I conclude that this is just Europe seeking revenge for President Trump’s Brexit support by promoting “Calexit.”…
Continue Reading Episode 303: Another merger the FTC should block
CCPA Makes First Court Appearance
The California Consumer Privacy Act (CCPA) has been in effect only since January 1, but it has already been cited in a lawsuit, apparently for the first time. On February 3, plaintiffs filed a class action complaint in the US District Court for the Northern District of California against retailer Hanna Andersson, LLC and Salesforce.com,…
Companies Are Ready and Willing to Comply with CCPA – But First, They Need to Know How
Recently, Meegan Brooks, an associate in our San Francisco office, published an article on the California Consumer Privacy Act. Below is an excerpt. You can read the full article here.
…
Continue Reading Companies Are Ready and Willing to Comply with CCPA – But First, They Need to Know How
Episode 233: Outing the GRU
In this news-only episode, Nick Weaver and I muse over the outing of a GRU colonel for the nerve agent killings in the United Kingdom. I ask the question that is surely being debated inside MI6 today: Now that he’s been identified, should British intelligence make it their business to execute Col. Chepiga?…
Steptoe Cyberlaw Podcast – Interview with Michael Daniel
156: Interview with Michael Daniel
Our interview is with Michael Daniel, former Special Assistant to the President and Cybersecurity Coordinator at the White House and current President of the Cyber Threat Alliance. We ask Michael how the new guys are doing in his job, what he most regrets not getting done, why we didn’t float…
Steptoe Cyberlaw Podcast – Interview with Kevin Kelly
Our guest for episode 119 is Kevin Kelly, founding executive editor of Wired Magazine and author of The Inevitable: Understanding the 12 Technological Forces that will Shape our Future. Kevin and I share many views – from skepticism about the recording industry’s effort to control their digital files to a similar skepticism about EFF’s effort to control private data – but he is California sunny and I am East Coast dark about where emerging technology trends are taking us. The conversation ranges from Orwell and the Wayback Machine to the disconcerting fluidity and eternal noobie-ness of today’s technological experience. In closing Kevin sketches a quick but valuable glimpse of where technology could take us if it comes from Shenzhen rather than Mountain View, as it likely will.
Continue Reading Steptoe Cyberlaw Podcast – Interview with Kevin Kelly
FAR Council Issues Rule on Basic Safeguarding of Covered Contractor Information Systems
On May 16, four years after issuing a proposed rule, the FAR Council issued a final cybersecurity-related rule that reaches deep into the supply chain and is applicable to virtually all government contractors and subcontractors. The rule establishes a new FAR subpart 4.19 and a clause 52.204-21, both of which are entitled “Basic Safeguarding of Covered Contractor Information Systems.” The rule is effective for solicitations issued on or after June 15, 2016. A copy is available here.
Continue Reading FAR Council Issues Rule on Basic Safeguarding of Covered Contractor Information Systems
Steptoe Cyberlaw Podcast – Interview with Patrick Gray
Our guest, Patrick Gray, is the host of the excellent Risky Business security podcast. He introduces us to the cybersecurity equivalent of decapitation by paper cut and offers a technologist’s take on multiple policy and legal issues. In the news roundup, Michael explains the many plaintiff-friendly rulings obtained by the banks suing Home Depot over its data breach. We wonder whether the rulings are so plaintiff-friendly that the banks will eventually regret their successes. Michael also explains just how deliberately meaningless is the Supreme Court decision in Spokeo, Inc. v. Robins.…
Continue Reading Steptoe Cyberlaw Podcast – Interview with Patrick Gray