By CHHS Extern Alexandra Barczak

U.S. lawmakers have introduced legislation called the Banning Surveillance Advertising Act, designed to prohibit advertisers and advertising facilitators, such as Google and Facebook, from using personal data to create targeted advertisements, with the exception of broad location targeting. It further protects against advertisers using a protected class of information, such as race, gender, and religion, and personal data purchased from data brokers, by prohibiting advertisers from targeting ads based on this information. Enforcement would be through state attorneys general, private lawsuits, and the Federal Trade Commission. However, in the age of Big Tech, is this actually feasible?

Big Tech, a term coined to mean the major players in the technological world, often indicates the “Big Five” which hold the most influence in the technological market: Amazon, Apple, Facebook/Meta, Google/Alphabet, and Microsoft. While each of the Big Five has a sphere that they dominate, such as Facebook with social media, Google with a search engine, and Apple with communication devices like mobile phones and laptops, there is a common thread amongst them all – they are constantly using our data, whether that be through asking for it, tracking it on their own, or buying it from another company/data broker. Our online movements are continuously being monitored under the guise of better serving the users, with typical collection including information such as your name, email, phone number, IP address, device you are using, times you are using your device, what you are doing while on your device, location, and more. Having this data allows these companies to better predict user behavior by using it to build a profile based on past user movements to anticipate future movements by giving you the content you want to see, showing you relevant ads, personalizing your experience, etc. Such pervasive collection and tracking have thus coined the term “surveillance.”

To many, this may not be a threatening prospect, but to others, online tracking is highly concerning. As the reasoning behind the Banning Surveillance Advertising Act points out, “Personal data is abused to target ads with major societal harms, including voter suppression, racist housing discrimination, sexist employment exclusions, political manipulation, and threats to national security. Surveillance advertising also invades privacy and threaten civil liberties, such as by tracking which place of worship individuals attend and whether they participated in protests and then selling this information to advertisers.” It is even more troubling that this sacrifice in personal privacy and security is done simply for the financial gain of these already profitable giants.

The Banning Surveillance Advertising Act is notably introduced exclusively by Democrats (Representatives Anna G. Eshoo (D-CA) and Jan Schakowsky (D-IL) and Senators Ron Wyden (D-OR) and Cory Booker (D-NJ)) and is said to be supported by leading public interest organizations, academics, and companies with privacy-preserving business models. Some of those cited in support include the Center for Digital Democracy, Accountable Tech, Fight for the Future, Anti-Defamation League, and Ekō. While there seems to be strength in support, there is likely equal, if not more, strength in opposition. Big Tech itself has created monopolies in their respective fields, with use of their products and systems becoming a necessity in everyday life. This power has created concern amongst the general population and the government of what exactly Big Tech can accomplish. Such dominating digital infrastructures have the capability to influence societies, economics, national security, and politics, just as Big Oil, Big Banks, or Big Pharma did in the past and arguably still do. Thus, it is entirely plausible that the resources of Big Tech will be used against this bill. It would not be the first time. For example, in 2022, lobbyists on behalf of Amazon, Apple, Meta, and Google parent company Alphabet spent millions opposing two antitrust bipartisan bills targeting Big Tech, the Open App Markets Act and the American Innovation Choice Online Act. Though the response to a bill about advertising may not be as extreme as the response to antitrust regulation, Big Tech would still likely involve itself and its resources in advocating against passing such legislation. Money talks, and Big Tech has money to spare – money which will be directed at the individuals and organizations that will lobby to block activity that will interfere with their business models; business models which all include targeted advertising as a source of revenue.

While the introduction of this bill could be considered a step in the right direction to preserving our online privacy, it also serves as a reminder that digital privacy, though a hot topic, is becoming increasingly politicized with little concrete movement at the federal level. Just note how long it has taken for a bipartisan federal privacy law to be introduced – and that, the American Data Privacy Protection Act, still did not pass. This is already the second attempt at the introduction of the Banning Surveillance Advertising Act. In January 2022, Congresswoman Eshoo (D-CA), Congresswoman Schakowsky (D-Ill.), and Senator Booker (D-NJ), introduced a similar bill with the same title which was unsuccessful. In both the House and Senate, the bill never got past the introduction stage. The House referred it to the Subcommittee on Consumer Protection and Commerce with no further movement, and the Senate read it twice and referred it to the Committee on Commerce, Science, and Transportation with no further movement.

With the power Big Tech holds across society and politics, the bill, which threatens a revenue stream for these organizations, will likely face strong resistance, backed with deep pockets. To realistically have a chance at gaining any traction, a bipartisan push would have to be made with representatives and organizations from all political parties making this an issue to care about. It, therefore, seems like there will be a long road ahead for the Banning Surveillance Advertising Act.

By CHHS Extern Daniela Eppler

Since the launch of ChatGPT in November 2022, people’s interest in artificial intelligence (AI) has been heightened. There has been excitement surrounding the capabilities of powerful AI tools and their ability to contribute to innovations across industries, such as enhancing telemedicine, improving customer service, and predicting passenger demand to optimize public transportation schedules. This excitement has also been coupled with concerns about potential threats to cybersecurity and national security, particularly related to relying on AI generated information and data privacy risks. The undeniable potential of ChatGPT and similar AI tools like it in fields like scientific research, business, and intelligence analysis has sparked interest around the world. Although the power and novelty of these tools may be overwhelming and alarming for some, they are the future and hold the key to unlocking previously unobtainable innovations.

Despite this excitement, a California law firm recently filed a class-action lawsuit against OpenAI over their use of people’s data to train the chatbot, ChatGPT. The lawsuit claims that OpenAI violated the rights of millions of internet users by using their publicly available internet data without consent to create the bot and to generate large profits. Specifically, while OpenAI is projected to reach $1 billion in revenue by the end of 2023, the lawsuit claims that ChatGPT relies on the consumption of “billions of words never signed off on” by the owners. Companies like Google, Facebook, Microsoft have taken similar actions to train their own AI models, but OpenAI is the only company currently facing legal action. Larger technology companies, like Facebook, have faced recent lawsuits concerning their deception of users in their ability to control the privacy of their personal information shared with the company. However, the question remains whether people should be concerned about AI companies using publicly available data to develop powerful tools and generate large profits. AI developers have argued that their use of data from the internet should fall under the “fair use” exception in copyright law. The class action lawsuit will largely be centered around whether the use of the data meets the requirements for “fair use”.

As we await the outcome of this lawsuit, it is important to consider the implications of restricting AI developers’ access to publicly available internet data for the development of AI tools. Despite the disruptive nature of the release of tools like ChatGPT, it is difficult to deny the endless pathways for advances that have been unlocked across various industries, like the acceleration of drug discoveries and early disease detection in the health industry, improved fraud detection and faster and more accurate trade executions in the finance industry, and supply chain optimization and product defect detection in the manufacturing industry, to name a few. AI tools directly rely  on ingesting huge volumes of complex data and without access to the volume and diversity of publicly available internet data, it is likely that their capabilities would be curtailed. Although copyright and privacy issues are important, it is essential to consider the implications of stifling the development of AI tools like ChatGPT and impeding the development of similar tools in the future.

By CHHS Extern Barbara Key

In the 2023 National Cybersecurity Strategy, the White House stated, “Together with our allies and partners, the U.S. will disrupt and dismantle threat actors by addressing the ransomware threat through a comprehensive Federal approach, in step with our international partners.”  To that end, a recent Joint Advisory by the U.S. Cybersecurity and Infrastructure Security Agency and its U.S. and international partners, highlights the threat posed by ransomware threat actors using LockBit – which functions as a Ransomware-as-a-Service model where affiliates are recruited to conduct ransomware attacks using LockBit ransomware tools and infrastructure. Although ransomware impacts all sectors, the FBI warned that the federal government is particularly concerned about its impact on government and other critical infrastructure networks because these types of attacks can delay a police or fire department’s response to an emergency or prevent a hospital from accessing lifesaving equipment.

In addition to the impacts of ransomware on government and other critical infrastructure, recently, Verizon released the results of its 16^th annual Data Breach Investigations Report (2023 DBIR), which highlighted the soaring costs of ransomware with 95% of incidents that experienced a loss costing between $1 and 2.25 million. 

Despite these warnings, in late May, Clop – a Russian ransomware gang, executed a sprawling hacking campaign that targeted major U.S. universities and state governments in which they gave victims until 14 June to discuss a ransom before they would start publishing data from companies they claim to have hacked. Furthermore, CNN reported, on 15 June several U.S. federal government agencies were hit in a global cyberattack by the same Russian criminals. While no ransom demands have been made of federal agencies, this hacking campaign, which exfiltrates employee sensitive information, mounts pressure on federal officials who pledged to put a dent in the scourge of ransomware attacks that have crippled schools, hospitals and local governments across the U.S.

With damage related to cybercrime projected to hit $10 trillion annually by 2025, the White House declared, in a 27 June memorandum to the Heads of executive departments and agencies, “Ransomware is a threat to national security, public safety, and economic prosperity.” Further, the Administration re-stated its commitment to mounting disruption campaigns, which use tools of national power to make malicious actors incapable of threatening the U.S. security, safety, and economy, and other efforts that are so targeted that they render ransomware no longer profitable. However, beyond its profitability, according to the  Arms Control Association, based on the 2018 Nuclear Posture Review’s claim that an enemy cyberattack on U.S. nuclear command, control, and communications (NC3) facilities would constitute a “non-nuclear strategic attack” of sufficient magnitude to justify the use of nuclear weapons in response, new hybrid ransomware attacks such as  RedEnergy – which unveils a powerful blend of stealthy data theft and encryption designed to cause extensive harm and establish complete control over its targets, “could lead to a major conflict and possibly nuclear war.”

By CHHS Extern Peter Scheffel

National security and privacy concerns have grown with the advent of the internet and the subsequent shift to online-embedded life. Today, a functioning member of society enjoys arguably all of life’s necessary societal connections in a format digitally connected through hundreds of miles of fiber-optic cable and continent-spanning servers. To the average U.S. citizen, finances, education, entertainment, consumer habits, and much more have a close linkage with the digital world.

Recently, the social media app TikTok has been under discussion in Congress due to both privacy and national security concerns directed at TikTok’s connections to China, and the ongoing geopolitical tensions currently escalating between the U.S. and China. TikTok is owned by ByteDance, a Chinese company based in Beijing, though allegations assert TikTok and ByteDance as being functionally the same company, sharing chat applications, data analysis mechanisms, and managerial contact. Given the growth in geopolitical tension between the U.S. and China, questions have been raised as to the amount of data TikTok collects and to what extent Chinese authorities have channels with which to access TikTok’s U.S. data. While such privacy and national security concerns have merit, especially considering the lack of transparency in what TikTok data China has access to and the risk of algorithm manipulation China could be utilizing for U.S. users, an outright ban of TikTok in the U.S. would be a mistake.

Given the speed with which legislation has been drawn up to potentially ban TikTok, what concerns are being discussed? Privacy and national security concerns grew further in early March of 2023, after Senator Josh Hawley sent a letter to Treasury Secretary Janet Yellen seeking review of whistleblower allegations which had been brought to Senator Hawley. These allegations included Chinese Communist Party (CCP) members being able to toggle between U.S. and Chinese TikTok data with ease despite the supposed separation between U.S. and Chinese TikTok. This includes alleged access to U.S. citizen user data and most concerning: personal location. Other allegations detailed China-based employees being able to access U.S. data with simple managerial approval and that TikTok continues to maintain near constant contact with ByteDance, the China-based parent company. Other possible abuses the CCP could engage in using U.S. TikTok user data include increasing cyberespionage and hacking efforts based on the accessed data, especially with the data’s potential to benefit social engineering attacks (a cyber-attack chiefly built around how people think and behave, manipulating human error to gain access), which are often incredibly successful if prior intelligence has been gathered on the target. Also, psychological manipulation via algorithm bias, as TikTok has not shared how its algorithm functions leading to allegations the algorithm is biased in reinforcing/influencing negative content on America’s population.

Government cybersecurity officials share in the growing concern surrounding TikTok, with a focus on national security. Rob Joyce, who leads the U.S. National Security Agency’s cybersecurity division, has likened TikTok to a “Trojan Horse” which carries long term security concerns years into the future given the questions surrounding CCP access to and manipulation of data on the 150 million U.S. TikTok users. In 2022 four ByteDance employees were discovered to have accessed U.S. reporters’ data which has led to Department of Justice investigations into journalist surveillance by ByteDance. Though the employees were later fired, the fact that such surveillance took place has increased the pressure for Congress to act by banning or forcing the sale of TikTok in the United States. TikTok’s CEO Zi Chew did recently testify before Congress, but his testimony only further escalated the concern and the feeling around Congress that something ought to be done. On one occasion, Chew replied to a question on if ByteDance, TikTok’s parent company had spied on Americans at the behest of the CCP by stating that “I don’t think ‘spying’ is the right way to describe it.” Chew was also unable to definitively make a commitment TikTok would not sell data or if any data is currently being sold, responding “I can get back to you on the details.” On if TikTok would commit to not focus on targeting people under the age of 17, Chew replied that “It’s something we can look into and get back to you.”

Counter arguments include that TikTok is no different than other large social media apps in terms of “risk” of data being used or sold. While some truth may exist in this argument, such an argument does not differentiate between the U.S. based companies and TikTok. Of particular concern are the Chinese laws which enable the CCP to compel companies based in Beijing like TikTok, to share data. And even without the legal ability, given the rising competitive technological atmosphere between China and the U.S., it would not be surprising for the CCP to utilize coercion against ByteDance to access TikTok user data. This highlights the main difference in the comparison argument: China is a rival in many respects due to ongoing economic and national security tensions. Thus, unlike Instagram or Facebook, TikTok’s data, whether or not purposefully, carries a higher risk of problematic use simply due to its potential connection to the CCP. China is more adversary than ally in terms of national security currently. Now, such national security concerns have led to action, with the U.S. banning TikTok on government devices. But while this covers national security to an extent, further calls for banning of the app overall is a mistake for reasons beyond the argument that it collects data like U.S. social media companies.

To pursue an outright ban would be ill-advised. Even assuming such a ban would overcome already established legal concerns addressed during the Trump Administration’s failed attempts; it would set a new concerning precedent on government control over technology and what information, speech, and communication means Americans have access to in the name of “privacy” as defined and controlled by Congress. Banning TikTok is a drastic response to concerns that while real, lack sufficient corroboration to warrant such an extreme remedy. Principles matter in times of tension and peace, and the United States ought not mimic China’s policies to ban foreign apps (YouTube, WhatsApp) in order to punish and compete against China. While some have argued that this is precisely what needs to happen; sacrificing the idea of an open internet (as China has), in order to control and punish countries as well as control what and how a populace communicates; this is not a strong enough answer to overcome the dangers in broadening the ability of the U.S. government to control what technology its citizens can communicate with. This response of banning TikTok, even if never carried out, is a clear reminder of how a hastened legislative response to combat foreign powers can quicken the pace to adopt the very ideals such legislation would be drawn up to defeat. As James Madison penned in a 1798 letter: “Perhaps it is a universal truth that the loss of liberty at home is to be charged to provisions agst. [against] danger real or pretended from abroad.”

By CHHS Extern Kimberly Gainey

The oft discussed and much anticipated National Cybersecurity Strategy addresses cybersecurity regulatory harmonization with two paragraphs entitled “Harmonize and Streamline New and Existing Regulation.” The Strategy instructs regulators, when feasible, “to harmonize not only regulations and rules, but also assessments and audits of regulated entities.” However, it diverges from a Presidential advisory committee recommendation by designating the Office of National Cyber Director (ONCD), coordinating with the Office of Management and Budget, to lead these efforts, rather than a newly created office within the Cybersecurity and Infrastructure Security Agency (CISA). It is perhaps unsurprising that ONCD received the nod, given their involvement drafting the National Cybersecurity Strategy and the role of the National Cyber Director “as a principal advisor” on cybersecurity policy and strategy to the President.

However, one wonders about the wisdom of this decision on the heels of the retirement of the National Cyber Director Chris Inglis last month, leaving big shoes to fill for the former deputy, now Acting National Cyber Director Kemba Eneas Walden. Serving as the first National Cyber Director, Inglis brought decades of experience in the federal government in a variety of positions at the National Security Agency and the Department of Defense. Praised as a “tremendous leader” and “the best person for the job,” CISA Chief of Staff Kiersten Todt remarked on Inglis’ establishment of ONCD and unifying influence; in “a short period of time, he established an office and a reputation and this ability to unify in many ways, this interagency process and he has been such a tremendous partner to CISA.”

In contrast to two paragraphs in the National Cybersecurity Strategy, another option is presented within a 27 page report after years of study by the committee charged with providing “the best possible industry advice” to the President to assure “the availability and reliability of telecommunications services,” along with other national security and emergency preparedness challenges, which issued several recommendations to ensure internet resilience. The clear theme, per Politico, is “to coax, cajole and needle agencies toward consistent, or ‘harmonized,’ cybersecurity regulations.” The President’s National Security Telecommunications Advisory Committee (NSTAC) released the draft report in anticipation of a meeting where they approved the Strategy for Increasing Trust in the Information and Communications Technology (ICT) and Services Ecosystem, voting to send it to the President for consideration per the Washington Post. The report represents the culmination of a multi-phase study on “Enhancing Internet Resilience in 2021 and Beyond.” After a series of significant cybersecurity incidents, the White House tasked the NSTAC with three crucial cybersecurity topics “foundational” to national security and emergency preparedness. Prior phases developed recommendations regarding those three topics: 1) Software Assurance in the Information and Communications Technology and Services Supply Chain (November 2021); 2) Zero Trust and Trusted Identity Management (February 2022); and 3) Information Technology and Operational Technology Convergence (August 2022). Building from earlier recommendations, the draft report contains a veritable treasure trove of information. For those unable to delve into the 27 page report and appendices, here are the main nuggets.

Attracting immediate attention, several recommendations encourage harmonizing cybersecurity regulations and requirements. First up, recommending that CISA establish the Office of Cybersecurity Regulatory Harmonization (OCRH) to “institutionalize and expand upon existing harmonization efforts” of existing government forums, which lack “the required combination of mission, expertise, and resources that can address the scale of the challenge.” To elucidate the need to establish the OCRH, the report highlights two government entities attempting to address this issue, at least in part. First, the intergovernmental Cyber Incident Reporting Council established to “coordinate, deconflict, and harmonize federal incident reporting requirements, including those issued through regulations.” Note that the Cyber Incident Reporting Council’s mission is limited to incident reporting. Second, the federal interagency Cybersecurity Forum for Independent and Executive Branch Regulators critiqued for lacking the dedicated staffing necessary to develop expertise across sectors as most participating officials juggle Forum participation on top of various responsibilities for their home agencies. This may explain why the Forum has only held one meeting since it was relaunched in February 2022 under Federal Communications Commission (FCC) leadership, after several years of inactivity.

Resolving the dearth of dedicated staff and resources by forming and funding OCRH “would create an institutionalized source of in-depth cybersecurity regulatory expertise across sectors that does not currently exist within the federal government,” which is one of OCRH’s responsibilities. Other OCRH responsibilities include creating resources for regulators to use to develop cybersecurity requirements that leverage consensus standards where possible and providing regulators with technical assistance during rulemaking. These responsibilities respond to “[a] recurring challenge that . . . even though most regulations cite consensus standards as the basis for their requirements, variations in implementations across regulators often result in divergent requirements. Developing regulatory resources that provide common language that could be used across sectors could address the challenge.” OCRH’s first task would involve coordinating with the National Institute of Standards and Technology “to publish a public report that catalogs existing cybersecurity requirements across sectors, analyzes how they align or diverge from consensus standards down to the control level, and identifies opportunities to drive harmonization.”

Unlike the National Cybersecurity Strategy, the NSTAC report explains why CISA was selected to house the OCRH:  “primarily because the responsibilities are well aligned with CISA’s role as National Coordinator for critical infrastructure security and resilience, which includes ensuring a unified approach to cyber risk management . . . .” The OCRH also aligns with CISA’s preference to remain non-regulatory as it “would act only in an advisory capacity in support of other federal government regulators.” CISA Director Jen Easterly describes regulation as “one tool” for federal officials, “not a panacea,” which she has previously disavowed in favor of partnerships: “I am certainly not a proponent of regulation, because we’re a voluntary agency.”

Two other recommendations in the NSTAC report involve regulatory harmonization, specifically creating policies and processes to encourage:  1) regulation harmonization and 2) federal government cybersecurity requirement harmonization and drive consensus standards development, listing suggested Presidential actions for federal agencies. The NSTAC Report’s remaining recommendations are to advance the adoption of Post Quantum Cryptography and further work done in earlier phases by: creating and improving transparent procurement language to encourage vendor security best practices; enhancing CISA’s Continuous Diagnostics and Mitigation Program; and maximizing automation and reuse of evidence in federal compliance with the Federal Information Security Management Act.

Response to the NSTAC report, prior to being overrun by a deluge of coverage around the National Cybersecurity Strategy, was positive. United States House of Representatives Committee on Homeland Security Chairman Mark Green welcomed the emphasis on regulatory harmonization, citing “duplicative and burdensome regulatory obligations, most of which stem from the White House push for cross-sector mandates.” Chairman Green expressed enthusiasm for “pursuing strong oversight over this Administration’s scattershot cybersecurity regulations this Congress and . . . working with CISA to ensure the red tape doesn’t strangle industry,” referring to “Cyber Incident Reporting for Critical Infrastructure Act rulemaking.” However, American Banker reported that while many share the goal of regulatory harmonization, many barriers may hinder achievement including the lack of authority to harmonize a variety of state-level requirements. Further, expanding CISA’s role to include advising on regulations may change political dynamics, negatively affecting the support CISA currently receives in conjunction with its “primarily operational role in improving cybersecurity across all levels of government and providing resources that private enterprises can use to improve their own cybersecurity.”

Pursuant to the National Cybersecurity Strategy, the Acting National Cyber Director will likely encounter similar difficulties and faces the daunting prospect of leading regulatory harmonization on a national and international scale. The Strategy calls for the pursuit, when necessary, of “cross-border regulatory harmonization to prevent cybersecurity requirements from impeding digital trade flows.” Despite consensus around the value of regulatory harmonization, the path toward realization remains murky.