Lemley on data security and hacker threats

Note: this is post #4 of a multi-part series.

Thus far, we have seen how proposals to reform “Section 230 Immunity” or to regulate the Internet advertising market are either contradictory or likely to backfire (see here re: § 230 and here re: ads). What about the problem of black hat hackers and data breaches? Why can’t we use the law to protect or at least enhance user privacy and the security of user data from external hacking threats? Alas, here is another area where our lofty legal rhetoric and growing calls for regulation fail to match up to our technological reality. If anything, as I shall explain below, it is the government who represents the greatest threat to our data privacy!

As Lemley notes in Part 1 of his paper (p. 318), “we want to stop [black hat] hacks and data breaches.” By way of example, in July of 2019 Facebook agreed to pay a $5 Billion fine to the Federal Trade Commission for allowing private user data to be exposed (see here, for instance), and numerous States have enacted local laws imposing legal liability on companies with insecure data- and information-protection systems. (On this note, see the sources in footnote 63 of Lemley’s paper.) But here’s the rub: when tech companies respond to our demand for privacy by providing strong end-to-end encryption platforms like WhatsApp or secure devices like the Apple iPhone, it is the government — specifically, law enforcement agencies — who ends up objecting to and thwarting these technological privacy protections!

Once again, Professor Lemley is worth quoting in full (p. 319, footnotes omitted, emphasis added): “Law enforcement, it turns out, wants to make sure it has a back door into our phones and our text messages, and if there isn’t one it has even tried to force tech companies to build it. This is a battle that has been continuing for a quarter century, since the government tried to build a backdoor into digital phone technology in the 1990s. The issue then was secret communications supporting terrorism, while more recently it tends to be child sexual abuse or, even more recently, white supremacy. But the claim is the same: People will use encryption to hide the bad things they are doing, so law enforcement must have the power to break encryption.”

I will sum up by restating the irony of this perverse state of affairs: (a) Hackers are a threat, and people want to protect their communications and their devices; (b) private tech companies build end-to-end encrypted systems to thwart hackers and meet this legitimate demand for privacy; (c) government agencies, however, insist on a “back door” to maintain their snooping powers, making it easier for hackers to access our data. But we can’t have it both ways. As Professor Lemley correctly points out toward the end of Part 1 of his paper, when we use law to require encrypted platforms and devices to have “backdoors” for law enforcement agencies, we are also inevitably making those same systems more vulnerable to black hat hackers!

I will proceed to Part 2 of Lemley’s two-part paper next week, beginning on Monday, Oct. 4.

Backdoor To WhatsApp End-To-End Encryption | by d'wise one | Chip-Monks |  Medium
* except, of course, the government.

Posted in Uncategorized | Leave a comment

Twitter Tuesday: @threadapalooza

I am interrupting my review of Mark Lemley’s excellent paper on “The contradictions of platform regulation” to introduce you to @threadapalooza (see screenshot below), which contains an impressive collection of 100-Tweet mega-threads, and to @ZoharAtkins, a poet, thinker, and rabbi, whose wonderful work frequently appears on the “Threadapalooza” site. For my part, I did not know until recently that 100-Tweet threads were a thing, but they are, and Zohar Atkins in particular is one of its most prolific and thought-provoking practitioners. For your reference, here is a link to a collection of six previous Zohar Atkins threadapaloozas, but there are many more worth taking the time to read, including mega-threads on Gadamer, Spinoza, and Martin Buber, just to name a few.

Screen Shot 2021-09-28 at 9.39.25 AM

Posted in Uncategorized | Leave a comment

Google and Facebook dominate the ad market; so what?

Note: This is post #3 in a multi-part series.

Another embarrassing contradiction identified by Mark Lemley in Part 1 of his excellent new paper on “The Contradictions of Platform Regulation” involves the use of antitrust law to police or regulate the Internet advertising market.

In brief, the proponents of Internet regulation like to point out how the Internet ad market market is dominated by Google and Facebook. (See, for example, the infographic below.) But as Professor Lemley astutely observes (p. 313-314, emphasis and exclamation point added), “it’s a bit awkward to point to multiple ‘monopolists’ in a single market“! Be that as it may, the proponents of Internet regulation are worried about about the practical effects of Google and Facebook’s dominance of the Internet ad market. Specifically, one concern is that both Google and Facebook collect enormous amounts of data about its end users in order to sell targeted ads to them. An additional worry is that traditional news outlets (i.e. broadcast and print media) now have a more difficult time selling ads themselves. (On this latter point, see the sources in footnote 37 of Lemley’s paper.)

The glaring problem with these concerns, however, is that the proponents of Internet regulation have not thought through the likely consequences of introducing more competition into the Internet advertising market. To see why, let’s take their main argument at face value: let’s accept for the sake of argument the claim that Google and Facebook are monopolists that dominate the Internet advertising market. If Google and Facebook were really monopolists in the ad market, then we would expect them to be charging a premium for ad space on their platforms; that is, we would expect to see them selling ads at higher than competitive prices. But if that were really true, this state of affairs would then present a golden opportunity for other firms (including traditional news outlets) to more effectively compete with Google and Facebook by selling ad space at lower prices.

Further, the proponents of Internet regulation must grapple with an even more fundamental problem. Again, let assume that Google and Facebook are monopolists in the Internet ad market. (Although it bears repeating that this is an absurd claim on its face (see boldface quote above), let’s go ahead and ignore logic for now.) If this were really true, then we would expect to see fewer ads overall, which would be a good thing for most end users! Why would we expect to see fewer ads if Google and Facebook were monopolists? Because demand curves slope downwards. In words: when monopolists sell their ad space at higher than competitive prices, ad agencies buy fewer ads. On this note, Lemley is worth quoting in full (p. 315):

“… many of the people actually complaining about the dominance of digital advertising are likely to be helped, not hurt, by that dominance. If Google and/or Facebook are advertising space monopolists, they are charging more money for ad space than they would in a competitive market and offering fewer ads as a result. That means they are selling your consumer data to fewer people at a higher price than they and others would if the advertising market were competitive. Advertisers might not like that, but most consumers probably would. Intervening to bring competition to digital advertising—whether by breaking up the platform giants or opening up their data troves to competitors—means that more companies will compete to sell more of your personal data to advertisers for less money.”

Okay, but what about privacy? I will continue my review of Lemley’s paper in my next post and show how proposed privacy regulations are fundamentally contradictory as well.

The Dominance of Google and Facebook in One Chart
And?
Posted in Uncategorized | 2 Comments

Lemley on the Politics of Section 230 Reform

Note: this is post #2 in a multi-part series.

Mark Lemley begins Part 1 of his Internet platform paper with the following observation (p. 305, emphasis added): “Everyone wants [to regulate] tech companies …. But dig a little deeper, and the demands [for regulation] are not just diverse, but often flatly contradictory.” Perhaps the best example of this problem is the issue of “Section 230 Immunity”, a pivotal provision of Internet law enacted by Congress as part of the Communications Decency Act of 1996 and codified at 47 U.S.C. § 230.

In brief, courts have generally held that, with a few well-defined exceptions, big tech companies are not legally liable for the content posted on their platforms under Section 230. As a result, as Professor Lemley correctly notes, Section 230 Immunity has in recent times become the biggest target of regulatory reform. The problem, however, is that the various legislative proposals for amending or even repealing Section 230 are flat out contradictory!

On the one hand, “liberals” want to amend or repeal Section 230 to order to give big tech firms an incentive to weed out fake news and hate speech from their platforms, i.e. to engage in more aggressive content moderation policies. As Lemley puts it (p. 307), “The goal of Democratic section 230 reforms is to encourage platforms to more closely police the content of their sites ….” On the other hand, “conservatives” have the opposite goal: they want to restrain the ability of these platforms to censor speech via their content moderation policies, or in Lemley’s words (p. 308), “Republican proposals would treat the platforms as government actors subject to the First Amendment and liable for removing content unless it was not constitutionally protected.”

In other words, to restate Lemley’s main point (p. 310), “Both parties want to eliminate or restrict section 230 in order to change how platform intermediaries filter content. But they want that change to have diametrically opposed effects.” Alas, Section 230 is not the only example of this problem. Following Lemley’s lead, I will provide additional examples of the problem of contradictory Internet regulation in my next few posts …

Does Section 230 Have Limits? - WSJ
Image credit: Martin Kozlowski
Posted in Uncategorized | 1 Comment

Two cheers for Mark Lemley

This is the first blog post in a multi-part series.

Has the time come to regulate the Internet or to break up the big tech companies into smaller firms? In the introduction to his excellent paper “The contradictions of platform regulation” (pp. 304-305), my colleague and new friend Mark Lemley identifies several concerns that many people have about social media and other big tech platforms:

  1. The fact that “[w]e spend much of our lives online—even more today in the wake of the pandemic”;
  2. “the rise of hate speech and misinformation online”;
  3. “growing fears about the loss of privacy”;
  4. the increasing feeling that Big tech platforms like Google and Facebook have for all practical purposes become “entrenched” monopolists, including the many “instances of aggressive behavior by incumbents designed to disadvantage competitors”; and
  5. “the out-sized influence these [tech giants] have come to have on almost all aspects of our lives”.

These are legitimate worries, but is government regulation or antitrust law an effective way of addressing these concerns? Professor Lemley’s contribution to this discussion is to point out that existing calls for regulation will not only produce unintended and perverse consequences; these calls for regulation are in many instances contradictory or self-defeating! I will continue my review of Prof Lemley’s paper and provide some specific examples of this problem — the problem of contradictory Internet regulations — in my next post.

What Does Big Tech Know About You? Basically Everything | PCMag

Posted in Uncategorized | Leave a comment

Taxonomy of U.S. road sign designs

Check out this report by Kurt Kohlstedt titled “American Highways 101: Visual Guide to U.S. Road Sign Designs & Numbering Systems”.

Posted in Uncategorized | Leave a comment

Sunday Syllabus: Thinking about Abortion

Stephen E. Sachs, a professor at the Harvard Law School, is leading a discussion group for 1Ls on the law and ethics of abortion. This informal discussion group meets four times during the fall semester, and here is a link to Professor Sach’s elegant three-page syllabus. (You may click on each individual page below to enlarge the page.)

Posted in Uncategorized | Leave a comment

The Evolution of Singapore’s Street Lighting — Remember Singapore

Source: Remember Singapore (9/24)

For the first half of the 19th century, much of Singapore was covered in darkness at night. Although there were candles, oil and kerosene lamps, they were unable to illuminate large areas and were mostly confined to localised spaces such as houses and offices. Oil Lamps The first street lamps were apparently set up in […]

The Evolution of Singapore’s Street Lighting — Remember Singapore
Posted in Uncategorized | Leave a comment

Moon Art

Check out this beautiful collage of the Moon in 48 different hues. This original work of “Moon art” was created by Marcella Giulia Pace. (More details about her project are available here; hat tip: Kottke.)

Posted in Uncategorized | Leave a comment

Social Media Regulation Redux

I recently reviewed Jack Balkin’s paper on social media regulation and ended up giving it a mere “D minus” (see here, for example). But what would an “A plus” platform regulation paper look like? In a word, it would look like this. To the point, in the same volume in which Balkin’s sub-par paper appears, Stanford law professor Mark Lemley has published an excellent essay titled “The Contradictions of Platform Regulation“, which is, simply put, one of the best papers on Internet regulation that I have read thus far. Lemley’s work is deserving of more attention, so I will begin writing up a multi-part review of Professor Lemley’s new paper starting on Monday of next week …

Immediate Self-Contradiction - TV Tropes
Posted in Uncategorized | Leave a comment