Further Reading, Other Developments, and Coming Events (11 February 2021)

Further Reading

• “3G Could End This Year. For People Who Rely on Basic Phones, That’s a Big Problem.” By Hannah Frishberg — OneZero. The major telecommunications carriers will soon shut down their 3G coverage and with it, the last of the “dumb” phones will theoretically no longer work. There are other issues, however. In some rural areas 4G is spotty when available.
• “‘It let white supremacists organize’: the toxic legacy of Facebook’s Groups” By Kari Paul — The Guardian. Who knew that stacking up dry wood, dousing it in lighter fluid, and keeping an open flame nearby would lead to bad results? In the same vein, who knew that putting together an algorithm that pushed people to join groups, the prevalence of extremist and white supremacist groups, and little to no oversight or policing of these groups would result in an explosion of radicalization on Facebook? Only Nostradamus could have seen this coming. And, shockingly, experts and critics of Facebook are not impressed with the latest layout of deck chairs on the proverbial Titanic in response to the extremism the platform helped bring about.
• “World Wide Web inventor Tim Berners-Lee takes on Google, Facebook, Amazon to fix the internet” By Michael Braga — USA Today. Tim Berners-Lee and John Bruce have started Inrupt.com a new paradigm that would allow people to essentially store their personal data in pods that platforms would have to request permission to use. They are banking that this shift could lead to the decline in dominance of Google, Apple, Facebook, Amazon and Microsoft (GAFAM).
• “Biden’s whole-of-National Security Council strategy” By Bethany Allen-Ebrahimian — Axios. This is a good overview of how the National Security Council has been remade to focus on the People’s Republic of China (PRC) across its entire remit. How this translates into policy remains to be seen.
• “Amazon’s anti-union blitz stalks Alabama warehouse workers everywhere, even the bathroom” By Jay Greene — The Washington Post. As it has in the past, Amazon is going all out to stop a facility in Alabama from forming a union. Ballots are currently being cast by mail. If a union is certified, it would be the first in the United States at an Amazon facility.  

Other Developments

• 37 Democratic Senators wrote the acting chair of the Federal Communications Commission (FCC) to “utilize the E-Rate program to start bridging the “homework gap” without delay.” A few days earlier, the FCC announced that it is “seeking comment on several petitions requesting permission to use E-Rate program funds to support remote learning during the pandemic.” Comments are due by 16 February and reply comments are due by 23 February. Nonetheless, the group of Senators, led by Senator Ed Markey (D-MA) and new Senate Commerce, Science, and Transportation Committee Chair Maria Cantwell (D-WA), asserted to acting FCC Chair Jessica Rosenworcel:
  • As we approach the one year-anniversary of this public health crisis, studies indicate that as many as 12 million children in the United States still lack internet access at home and are unable to participate in online learning. These students are disproportionally from communities of color, low-income households, Tribal lands, and rural areas. Despite our repeated call to address this homework gap, your predecessor at the FCC refused to use the emergency authority available to the Chair and resources available through the E-Rate program to connect these vulnerable children. This mistake allowed far too many students to fall behind in their education.
  • We appreciate that you have already recognized the FCC’s ability to act, including by asserting in congressional testimony that “the FCC could use E-Rate right now to provide every school library with Wi-Fi hotspots and other connectivity devices to loan out to students who lack reliable internet access at home.” In accordance with this statement, we urge you to now use your new leadership of the FCC to depart from the prior Commission’s erroneous position. Specifically, we request that you leverage the E-Rate program to begin providing connectivity and devices for remote learning. Although the funds currently available through the E-Rate will not be enough to connect every student across the country, your prompt action would provide an essential down payment. From there, Congress must provide the resources needed to finish the job by passing our Emergency Educational Connections Act, legislation that would appropriate billions more to be delivered through the E-Rate program to help close the homework gap during the pandemic.
• Two Senators and Eight Representatives, all Democrats, “asked the National Security Agency (NSA) to explain the NSA’s actions to protect the government from supply chain attacks, like the recent SolarWinds hack, in which malicious code is snuck into commercial software used by the government” per their press release. They recited the history of a compromised encryption algorithm the NSA pressed on the National Institute of Standards and Technology (NIST) to publish as a government standard even though it contained a backdoor NSA created. Juniper, a networking company, started using this encryption algorithm a few years afterwards without knowing of the NSA’s action. The letter presses the NSA to turn over information about the subsequent hack of Juniper, which the Members implicitly compare to SolarWinds. Senators Ron Wyden (D-OR) and Cory Booker (D-NJ) and Representatives Pramila Jayapal (D-WA), Tom Malinowski (D-NJ), Ted Lieu (D-CA), Stephen Lynch (D-MA), Bill Foster (D-IL), Suzan DelBene (D-WA), Yvette Clarke (D-NY), and Anna Eshoo (D-CA) signed the letter. They claimed:
  • The recent SolarWinds hack has brought attention to the vulnerability of the government to supply chain attacks. However, five years ago another vendor to the U.S. government – Juniper Networks – revealed it also inadvertently delivered software updates containing malicious code. 
  • In 2015, Juniper revealed a security breach in which hackers modified the software the company delivered to its customers. Researchers subsequently discovered that Juniper had been using an NSA-designed encryption algorithm, which experts had long argued contained a backdoor, and that the hackers modified the key to this backdoor.
  • However, despite promising a full investigation after it announced the breach, Juniper has never publicly accounted for the incident.
  • The Members “asked the NSA to answer the following questions
    • After Juniper’s 2015 public disclosure that it inadvertently delivered software updates and products to customers containing malicious code, what actions did NSA take to protect itself, the Department of Defense, and the U.S. government from future software supply chain hacks? For each action, please identify why it was not successful in preventing the compromise of numerous government agencies in 2020 by a malware-laden update delivered by SolarWinds.
    • In the summer of 2018, during an unclassified briefing with Senator Wyden’s office, senior NSA officials revealed the existence of a “lessons learned” report on the Dual_EC_DRBG algorithm. Senator Wyden’s office has repeatedly requested this report, but NSA has yet to provide it. Please provide us with a copy of this report and any official historical reports that describe this algorithm, its development, and subsequent exploitation.
    • At the time that NSA submitted Dual_EC_DRBG to NIST for certification, did NSA know the algorithm contained a backdoor?
    • According to the NIST cryptographer’s postmortem, NSA informed NIST in 2005 that it selected the “Q” value that was published in the NIST Duel_EC_DRBG standard in a “secure, classified way.” Was this statement accurate? Please explain.
    • Juniper has confirmed that it added support for Dual_EC_DRBG “at the request of a customer,” but refused to identify that customer, or even confirm whether that customer was a U.S. government agency. Did NSA request that Juniper include in its products the Dual_EC_DRBG algorithm, P and Q values which were different from those published by NIST, or another NSA-designed encryption standard named Extended Random?
    • What statutory legal authority, if any, would permit NSA to introduce vulnerabilities into U.S. government approved algorithms certified by NIST and to keep those vulnerabilities hidden from NIST?
    • Would efforts by NSA to introduce backdoors or other vulnerabilities into government standards require the approval of the NSA Director, an inter-agency consultation, including input from the Cybersecurity and Infrastructure Security Agency, the Department of Commerce, the Federal Trade Commission, and the Federal Communications Commission? Would they require notification to the Congressional intelligence committees or an order from the Foreign Intelligence Surveillance Court? If no, please explain why.
• The National Telecommunications and Information Administration (NTIA) has been holding a series of “Tribal Consultations for input on implementation of the Tribal Broadband Connectivity Program (TBCP),” a program seeded with $1 billion in the “Consolidated Appropriations Act, 2021” (P.L. 116-260).
  • In a letter, the NTIA explained:
    • The Act directs NTIA to make grants available to eligible entities within short time frames. NTIA is committed to holding consultation sessions expeditiously to ensure that your input informs the new grant program prior to the application process. In accordance with Commerce’s tribal consultation policy, I am inviting you and/or a tribal representative to participate in the virtual National Tribal Consultation to provide your advice and insights as NTIA staff are working through the critical issues related to the program.
  • In its presentation on the TBCP, the NTIA explained the provisions in the Consolidated Appropriations Act, 2021:
    • Section 905(c)(5) stipulates the following eligible uses of grant funds:
      • broadband infrastructure deployment, including support for the establishment of carrier-neutral submarine cable landing stations;
      • affordable broadband programs, including—–providing free or reduced-cost broadband service; and –preventing disconnection of existing broadband service;
      • distance learning;
      • telehealth;
      • digital inclusion efforts; and
      • broadband adoption activities.
    • Section 905(c)(6) caps the amount of grand funds to be used for administrative expenses:
      • An eligible entity may use not more than 2 percent of grant funds received under this subsection for administrative purposes.
    • Section 905(c)(8) provides information about broadband infrastructure deployment:
      • In using grant funds received under this subsection for new construction of broadband infrastructure, an eligible entity shall prioritize projects that deploy broadband infrastructure to unserved households.
    • Section 905(c)(3)(A) mandates that grant funds are awarded on an equitable basis:
    • The amounts appropriated under subsection (b)(1) shall be made available to eligible entities on an equitable basis, and not less than 3 percent of those amounts shall be made available for the benefit of Native Hawaiians.
• The Department of Health and Human Services (HHS) issued an “Artificial Intelligence (AI)” that establishes an AI Council “to support AI governance, strategy execution, and development of strategic AI priorities across the enterprise…[and] has complementary objectives to:
  • Communicate and champion the Department’s AI vision and ambition
  • Execute and govern the implementation of the enterprise AI strategy and key strategic priorities to scale AI across the Department
  • HHS further explained:
    • To achieve HHS’s ambition, this enterprise AI strategy will set forth an approach and focus areas intended to encourage and enable Department-wide familiarity, comfort, and fluency with AI technology and its potential (AI adoption), the application of best practices and lessons learned from piloting and implementing AI capabilities to additional domains and use cases across HHS (AI scaling), and increased speed at which HHS adopts and scales AI (AI acceleration).
    • Ultimately, this strategy is the first step towards transforming HHS into an AI fueled enterprise. This strategy lays the foundation upon which the AI Council can use to drive change across the Department by encouraging the application of AI to promote advances in the sciences, public health, and social services—improving the quality of life for all Americans.
• The New York State Department of Financial Services (NYDFS) issued “a new Cyber Insurance Risk Framework…[that] outlines industry best practices for New York-regulated property/casualty insurers that write cyber insurance to effectively manage their cyber insurance risk.” The NYDFS claimed the framework “is the first guidance by a U.S. regulator on cyber insurance” in its press release. NYDFS asserted:
  • The Framework is a result of DFS’s ongoing dialogue with the insurance industry and experts on cyber insurance, including meetings with insurers, insurance producers, cyber experts, and insurance regulators across the U.S. and Europe.  Building on DFS’s longstanding work fostering a strong and resilient insurance market that protects New Yorkers, the Framework furthers DFS’s commitment to improving cybersecurity for consumers and the industry.  DFS’s first-in-the-nation Cybersecurity Regulation took effect in March 2017.  In 2019, DFS was also the first financial services regulator to create a Cybersecurity Division to oversee all aspects of its cybersecurity regulation and policy.
  • The NYDFS claimed:
    • The growing risk makes cyber insurance protection more important than ever, while at the same time creating new challenges for insurers managing that risk.  DFS advises New York-regulated property/casualty insurers offering cyber insurance to establish a formal strategy for measuring cyber insurance risk that is directed and approved by its board or other governing entity.  The strategy should be proportionate with each insurer’s risk based on the insurer’s size, resources, geographic distribution, and other factors. Insurers are encouraged to incorporate the following best practices into their risk strategy:
    • Manage and eliminate exposure to “silent” cyber insurance risk, which results from an insurer’s obligation to cover loss from a cyber incident under a policy that does not explicitly mention cyber incidents;
    • Evaluate systemic risk, including the impact of catastrophic cyber events on third party service providers like the recently discovered SolarWinds supply chain attack;
    • Rigorously measure insured risk by using a data-driven approach to assess potential gaps and vulnerabilities in insureds’ cybersecurity;
    • Educate insureds and insurance producers about the value of cybersecurity measures and the need for, benefits of, and limitations to cyber insurance;
    • Obtain cybersecurity expertise through strategic recruiting and hiring practices; and
    • Require notice to law enforcement in the event of a cyber attack.
• The National Counterintelligence and Security Center (NCSC) published a fact sheet titled “China’s Collection Of Genomic And Other Healthcare Data From  America: Risks To Privacy And U.S. Economic And National Security.” The NCSC stated:
  • Would you want your DNA or other healthcare data going to an authoritarian regime with a record of exploiting DNA for repression and surveillance? For years, the People’s Republic of China (PRC) has collected large healthcare data sets from the U.S. and nations around the globe, through both legal and illegal means, for purposes only it can control. While no one begrudges a nation conducting research to improve medical treatments, the PRC’s mass collection of DNA at home has helped it carry out human rights abuses against domestic minority groups and support state surveillance. The PRC’s collection of healthcare data from America poses equally serious risks, not only to the privacy of Americans, but also to the economic and national security of the U.S.
  • The NCSC identified the “Implications for Privacy and U.S. National Security:”
    • China’s access to U.S. healthcare and genomic data poses serious privacy and national security risks to the U.S.
      • Through its cyber intrusions in recent years, the PRC has already obtained the Personal Identifying Information (PII) of much of the U.S. population.
      • Recent breaches attributed to the PRC government or to cyber actors based in China include the theft of personnel records of roughly 21 million individuals from the U.S. Office of Personnel Management; the theft from Marriott hotels of roughly 400 million records; the theft of data from Equifax on roughly 145 million people; and the theft of data from Anthem on roughly 78 million people.
    • Furthermore, under the PRC’s national security laws, Chinese companies are compelled to share data they have collected with the PRC government. Article 7 of China’s 2017 National Intelligence Law, for instance, mandates that all Chinese companies and citizens shall support, assist, and cooperate with Chinese national intelligence efforts, and guard the secrecy of any national intelligence work that they are aware of. There is no mechanism for Chinese companies to refuse their government’s requests for data.
    • The combination of stolen PII, personal health information, and large genomic data sets collected from abroad affords the PRC vast opportunities to precisely target individuals in foreign governments, private industries, or other sectors for potential surveillance, manipulation, or extortion.
      • For instance, vulnerabilities in specific individuals revealed by genomic data or health records could be used to help target these individuals. Data associated with an embarrassing addiction or mental illness could be leveraged for blackmail. Combine this information with stolen credit data indicating bankruptcy or major debt and the tools for exerting leverage increase. Such data sets could help the PRC not only recruit individuals abroad, but also act against foreign dissidents.
  • The NCSC also named the “Economic Implications for the United States:”
    • Aside from these immediate privacy risks, China’s access to U.S. health and genomic data poses long-term economic challenges for the United States.
    • The PRC’s acquisition of U.S. healthcare data is helping to fuel China’s Artificial Intelligence and precision medicine industries, while the PRC severely restricts U.S. and other foreign access to such data from China, putting America’s roughly $100 billion biotech industry at a disadvantage.
    • Over time, this dynamic could allow China to outpace U.S. biotech firms with important new drugs and health treatments and potentially displace American firms as global biotech leaders.
    • Although new medicines coming out of China could benefit U.S. patients, America could be left more dependent on Chinese innovation and drug development for its cures, leading to a transfer of wealth, co-opting of new businesses and greater job opportunities in China.
• The New York University Stern Center for Business and Human Rights (Center) issued a report titled “False Accusation: The Unfounded Claim that Social Media Companies Censor Conservatives” that concludes “[e]ven anecdotal evidence of supposed bias tends to crumble under close examination.” The Center stated:
  • Conservatives commonly accuse the major social media companies of censoring the political right. In response to Twitter’s decision on January 8, 2021, to exclude him from the platform, then-President Donald Trump accused the company of “banning free speech” in coordination with “the Democrats and Radical Left.”
  • This accusation—that social media platforms suppress conservatives— riles a Republican base that has long distrusted the mainstream media and is prone to seeing public events as being shaped by murky liberal plots. On a policy level, the bias claim serves as a basis for Republican attacks on Section 230 of the Communications Decency Act, the federal law that protects platforms from liability associated with user posts and content moderation decisions.
  • But the claim of anti-conservative animus is itself a form of disinformation: a falsehood with no reliable evidence to support it. No trustworthy large-scale studies have determined that conservative content is being removed for ideological reasons or that searches are being manipulated to favor liberal interests.
  • The Center offered these recommendations:
    • For the social media industry:
      • 1) Provide greater disclosure for content moderation actions. The platforms should give an easily under- stood explanation every time they sanction a post or account, as well as a readily available means to appeal enforcement actions. Greater transparency—such as that which Twitter and Facebook offered when they took action against President Trump in January—would help to defuse claims of political bias, while clarifying the boundaries of acceptable user conduct.
      • 2) Offer users a choice among content moderation algorithms. Users would have greater agency if they were offered a menu of choices among algorithms. Under this system, each user would be given the option of retaining the existing moderation algorithm or choosing one that screens out harmful content more vigorously. The latter option also would provide enhanced engagement by human moderators operating under more restrictive policies. If users had the ability to select from among several systems, they would be empowered to choose an algorithm that reflects their values and preferences.
      • 3) Undertake more vigorous, targeted human moderation of influential accounts. To avoid high-profile moderation mistakes, the platforms should significantly increase the number of full-time employees working directly for them who would help to create a more rigorous human-led moderation channel for the most influential accounts. To supervise this and other important issues related to policing content, we recommend that the platforms each hire a senior executive—a content overseer—who reports directly to the CEO or COO.
      • 4) Release more data for researchers. More granular disclosure would allow academics and civil society researchers to identify enforcement patterns, such as whether content is being removed for ideological reasons. This greater transparency should include the nature of any content that is removed, the particular rule(s) a post violated, how the platform became aware of noncompliance (user report versus algorithmic moderation), and how any appeals were resolved.
    • For the Biden administration:
      • 5) Pursue a constructive reform agenda for social media. This will require the federal government to press Facebook, Google, and Twitter to improve content policies and their enforcement, even as the government pursues pending antitrust lawsuits against Facebook and Google. The industry, for its part, must strive with urgency to do a better job of protecting users and society at large from harmful content—progress that can’t wait for the resolution of what might be years-long antitrust court battles.
      • 6) Work with Congress to update Section 230. The controversial law should be amended so that its liability shield is conditional, based on social media companies’ acceptance of a range of new responsibilities related to policing content. One of the new platform obligations could be ensuring that algorithms involved in content ranking and recommendation not favor sensationalistic or unreliable material in pursuit of user engagement.
      • 7) Create a new Digital Regulatory Agency. The false claim of anti-conservative bias has contributed to widespread distrust of the platforms’ willingness and ability to govern their sites. A new independent authority, charged with enforcing the responsibilities of a revised Section 230, could begin to rebuild that eroded trust. As an alternative, expanded jurisdiction and funding for social media oversight could be directed to an existing agency such as the Federal Trade Commission or Federal Communications Commission.

Coming Events

• The House Judiciary Committee’s Antitrust, Commercial, and Administrative Law Subcommittee will hold a hearing titled “Justice Restored: Ending Forced Arbitration and Protecting Fundamental Rights” on 11 February.
• The Federal Communications Commission’s (FCC) acting Chair Jessica Rosenworcel will hold a virtual Roundtable on Emergency Broadband Benefit Program on 12 February “a new a program that would enable eligible households to receive a discount on the cost of broadband service and certain connected devices during the COVID-19 pandemic.” The FCC also noted “[i]n the Consolidated Appropriations Act of 2021, Congress appropriated $3.2 billion” for the program.
• On 17 February, the Federal Communications Commission (FCC) will hold an open meeting, its first under acting Chair Jessica Rosenworcel, with this tentative agenda:
  • Presentation on the Emergency Broadband Benefit Program. The Commission will hear a presentation on the creation of an Emergency Broadband Benefit Program. Congress charged the FCC with developing a new $3.2 billion program to help Americans who are struggling to pay for internet service during the pandemic.
  • Presentation on COVID-19 Telehealth Program. The Commission will hear a presentation about the next steps for the agency’s COVID-19 Telehealth program. Congress recently provided an additional $249.95 million to support the FCC’s efforts to expand connected care throughout the country and help more patients receive health care safely.
  • Presentation on Improving Broadband Mapping Data. The Commission will hear a presentation on the work the agency is doing to improve its broadband maps. Congress directly appropriated $65 million to help the agency develop better data for improved maps.
  • Addressing 911 Fee Diversion. The Commission will consider a Notice of Proposed Rulemaking that would implement section 902 of the Don’t Break Up the T-Band Act of 2020, which requires the Commission to take action to help address the diversion of 911 fees by states and other jurisdictions for purposes unrelated to 911. (PS Docket Nos. 20-291, 09-14)
  • Implementing the Secure and Trusted Communications Networks Act. The Commission will consider a Third Further Notice of Proposed Rulemaking that proposes to modify FCC rules consistent with changes that were made to the Secure and Trusted Communications Networks Act in the Consolidated Appropriations Act, 2021. (WC Docket No. 18-89)
• On 27 July, the Federal Trade Commission (FTC) will hold PrivacyCon 2021.

© Michael Kans, Michael Kans Blog and michaelkans.blog, 2019-2021. Unauthorized use and/or duplication of this material without express and written permission from this site’s author and/or owner is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given to Michael Kans, Michael Kans Blog, and michaelkans.blog with appropriate and specific direction to the original content.

Photo by cottonbro from Pexels