Computer Law Commons^™

Cybersecurity Risk Shifting, Deborah R. Farringer

Vanderbilt Journal of Entertainment & Technology Law

The Change Healthcare cyberattack of 2024 paralyzed the health care system for months, creating an exceedingly far reaching and devastating impact on providers, suppliers, and patients across the country. While the scope of the attack was unprecedented, the cyberattack itself was not new, unique, or isolated. Indeed, this attack came just months after the close of a year in which the United States’ Department of Health and Human Services’ Office for Civil Rights (OCR) recorded the highest number of reported breaches of protected health information and the highest number of breached records. With a medical record fetching nearly four times …

The Privacy Law Jigsaw: Piecing Together Legal Compliance When Pieces Don’T Fit, Roy Wyman, Wesley Mcculloch

Vanderbilt Journal of Entertainment & Technology Law

Over the past six years the United States has shifted from a relatively stable and laissez-faire privacy regime, anchored by a few, sector-specific federal statutes such as the Health Insurance Portability and Accountability Act, to an increasingly fragmented landscape dominated by numerous state-level consumer privacy laws. While these laws share commonalities, they also vary in important ways. This Article analyzes that patchwork legal regime and its impact on businesses through four points of friction: (i) statutory applicability and thresholds; (ii) notice-and-choice requirements; (iii) individual data-management rights; and (iv) controller–processor contracting obligations. This Article further explores how modern service-delivery models, especially …

Reconceiving Safety Regulation For Ai And Ml Medical Software, Barbara J. Evans, Eric S. Rosenthal, Azra Bihorac

Vanderbilt Journal of Entertainment & Technology Law

This article explores the challenges of regulating AI and ML clinical decision support tools intended to assist trained health care professionals in delivering clinical care. Two old, twentieth-century regulatory models have dominated discussions of medical AI policy since 2013. Thinking inside these old regulatory boxes has not produced effective regulatory solutions to address the novel risks AI poses in clinical care. The first regulatory box treats software as a medical device, which tasks medical device regulators with making software safe but neglects the crucial roles physicians, nurses, administrators, medical practice regulators, and other health oversight bodies must also play to …

Data Portability Revisited: Toward The Human-Centric, Ai-Driven Data Ecosystems Of Tomorrow, Mark Fenwick Professor Of International Business Law, Michael Fertik Managing Partner, Paulius Jurcys Senior Lecturer, Timo Minssen Professor Of Law

Vanderbilt Journal of Entertainment & Technology Law

This Article critically examines the contemporary regulatory framework and discourse surrounding data portability in the United States. Using recent regulatory developments in the European Union as an illustration, this Article suggests that although data access and portability are identified as vital issues in multiple policy instruments, in its current iteration, at least, legal conceptions of portability continue to reinforce the interests of service providers and data controller enterprises rather than individual end users. This Article argues that a paradigm shift toward a more human-centric data approach to data governance must occur, under which data would be recognized as fundamental to …

Ten Thousand Ai Systems Typing On Keyboards: Generative Ai In Patent Applications And Preemptive Prior Art

Vanderbilt Journal of Entertainment & Technology Law

Generative AI makes it possible to create unlimited amounts of text at essentially zero cost. While this technology has many benefits, it can also be used in ways that undermine the goals of the patent system. This Article identifies policy solutions to address the potentially anti-innovative application of generative AI in several patent-related contexts. First, it examines the use of AI to publish massive online databases of preemptive prior art intended to foreclose patentability. This Article argues that computer-generated invention descriptions published without any substantive nexus to human understanding of their contents should not count as “printed publications” under US …

Regulation Priorities For Artificial Intelligence Foundation Models, Matthew R. Gaske

Vanderbilt Journal of Entertainment & Technology Law

This Article responds to the call in technology law literature for high-level frameworks to guide regulation of the development and use of Artificial Intelligence (AI) technologies. Accordingly, it adapts a generalized form of the fintech Innovation Trilemma framework to argue that a regulatory scheme can prioritize only two of three aims when considering AI oversight: (1) promoting innovation, (2) mitigating systemic risk, and (3) providing clear regulatory requirements. Specifically, this Article expressly connects legal scholarship to research in other fields focusing on foundation model AI systems and explores this kind of system’s implications for regulation priorities from the geopolitical and …

A Compulsory Solution To The Machine Problem: Recognizing Artificial Intelligence As Inventors In Patent Law, Cole G. Merritt

Vanderbilt Journal of Entertainment & Technology Law

Artificial Intelligence (AI) is already disrupting and will likely continue to disrupt many industries. Despite the role AI already plays, AI systems are becoming increasingly powerful. Ultimately, these systems may become a powerful tool that can lead to the discovery of important inventions or significantly reduce the time required to discover these inventions. Even now, AI systems are independently inventing. However, the resulting AI-generated inventions are unable to receive patent protection under current US patent law. This unpatentability may lead to inefficient results and ineffectively serves the goals of patent law.

To embrace the development and power of AI, Congress …

The Death Of The Legal Subject, Katrina Geddes

Vanderbilt Journal of Entertainment & Technology Law

The law is often engaged in prediction. In the calculation of tort damages, for example, a judge will consider what the tort victim’s likely future earnings would have been, but for their particular injury. Similarly, when considering injunctive relief, a judge will assess whether the plaintiff is likely to suffer irreparable harm if a preliminary injunction is not granted. And for the purposes of a child custody evaluation, a judge will consider which parent will provide an environment that is in the best interests of the child.

Relative to other areas of law, criminal law is oversaturated with prediction. Almost …

The Data Trust Solution To Data Sharing Problems, Kimberly A. Houser, John W. Bagby

Vanderbilt Journal of Entertainment & Technology Law

A small number of large companies hold most of the world’s data. Once in the hands of these companies, data subjects have little control over the use and sharing of their data. Additionally, this data is not generally available to small and medium enterprises or organizations who seek to use it for social good. A number of solutions have been proposed to limit Big Tech “power,” including antitrust actions and stricter privacy laws, but these measures are not likely to address both the oversharing and under-sharing of personal data. Although the data trust concept is being actively explored in the …

“Computer Says No!”: The Impact Of Automation On The Discretionary Power Of Public Officers, Doa A. Elyounes

Vanderbilt Journal of Entertainment & Technology Law

The goal of this Article is to unpack the “human in the loop” requirement in the process of automation. It will analyze the impact of automation on street-level bureaucrats and lay out the steps policy makers need to take into account to ensure that meaningful human discretion is maintained. This issue is examined by comparing two algorithms related to the use of automation to detect and investigate fraud in welfare benefits. The first algorithm is used by Michigan’s Unemployment Insurance Agency for detecting and investigating unemployment fraud. This is a draconian algorithm with the ability to automatically decide to cut …

Algorithmic Opacity, Private Accountability, And Corporate Social Disclosure In The Age Of Artificial Intelligence, Sylvia Lu

Vanderbilt Journal of Entertainment & Technology Law

Today, firms develop machine-learning algorithms to control human decisions in nearly every industry, creating a structural tension between commercial opacity and democratic transparency. In many of their commercial applications, advanced algorithms are technically complicated and privately owned, which allows them to hide from legal regimes and prevents public scrutiny. However, they may demonstrate their negative effects—erosion of democratic norms, damages to financial gains, and extending harms to stakeholders—without warning. Nevertheless, because the inner workings and applications of algorithms are generally incomprehensible and protected as trade secrets, they can be completely shielded from public surveillance. One of the solutions to this …

The Very Brief History Of Decentralized Blockchain Governance, Michael Abramowicz

Vanderbilt Journal of Entertainment & Technology Law

A new form of blockchain governance involving the use of formal games that incentivize participants to identify focal resolutions to normative questions is emerging. This symposium contribution provides a brief survey of the literature proposing and critiquing the use of such mechanisms of decentralized decision-making, and it evaluates early laboratory and real-world experiments with this approach.

People V. Robots: A Roadmap For Enforcing California's New Online Bot Disclosure Act, Barry Stricke

Vanderbilt Journal of Entertainment & Technology Law

Bots are software applications that complete tasks automatically. A bot's communication is disembodied, so humans can mistake it for a real person, and their misbelief can be exploited by the bot owner to deploy malware or phish personal data. Bots also pose as consumers posting online product reviews or spread (often fake) news, and a bot owner can coordinate multiple social-network accounts to trick a network's "trending" algorithms, boosting the visibility of specific content, sowing and exacerbating controversy, or fabricating an impression of mass individual consensus. California's 2019 Bolstering Online Transparency Act (the "CA Bot Act') imposes conspicuous disclosure requirements …

Cybersecurity And The Protection Of Digital Assets: Assessing The Role Of International Investment Law And Arbitration, Julien Chaisse, Cristen Bauer

Vanderbilt Journal of Entertainment & Technology Law

The digital era provides many opportunities, yet it also presents several unique challenges with regard to cybersecurity and the protection of digital assets. Cybercrime has changed the international legal landscape as nations, businesses, and legislators grapple with how to deal with this rapidly evolving, multifaceted problem. As there is no international mechanism for protection of foreign investors in this regard, some scholars are advocating for the use of Bilateral Investment Treaties (BITs) as part of a 'olycentric" approach to cyber peace. With an uptick in digital development and more development on the horizon, it will be important to establish what …

Neuroscience, Artificial Intelligence, And The Case Against Solitary Confinement, Francis X. Shen

Vanderbilt Journal of Entertainment & Technology Law

Prolonged solitary confinement remains in widespread use in the United States despite many legal challenges. A difficulty when making the legal case against solitary confinement is proffering sufficiently systematic and precise evidence of the detrimental effects of the practice on inmates' mental health. Given this need for further evidence, this Article explores how neuroscience and artificial intelligence (AI) might provide new evidence of the effects of solitary confinement on the human brain.

This Article argues that both neuroscience and AI are promising in their potential ability to present courts with new types of evidence on the effects of solitary confinement …

The Bot Legal Code: Developing A Legally Compliant Artificial Intelligence, Edmund Mokhtarian

Vanderbilt Journal of Entertainment & Technology Law

The advent of sophisticated artificial intelligence (AI) agents, or bots, raises the question: How do we ensure that these bots act appropriately? Within a decade, AI will be ubiquitous, with billions of active bots influencing nearly every industry and daily activity. Given the extensiveness of AI activity, it will be nearly impossible to explicitly program bots with detailed instructions on permitted and prohibited actions, particularly as they face unpredictable, novel situations. Rather, if risks to humans are to be mitigated, bots must have some overriding moral or legal compass--a set of "AI Laws"--to allow them to adapt to whatever scenarios …

Differential Privacy: A Primer For A Non-Technical Audience, Alexandra Wood, Micah Altman, Aaron Bembenek, Mark Bun, Marco Gaboardi, James Honaker, Kobbi Nissim, David R. O'Brien, Thomas Steinke, Salil Vadhan

Vanderbilt Journal of Entertainment & Technology Law

Differential privacy is a formal mathematical framework for quantifying and managing privacy risks. It provides provable privacy protection against a wide range of potential attacks, including those currently unforeseen. Differential privacy is primarily studied in the context of the collection, analysis, and release of aggregate statistics. These range from simple statistical estimations, such as averages, to machine learning. Tools for differentially private analysis are now in early stages of implementation and use across a variety of academic,industry, and government settings. Interest in the concept is growing among potential users of the tools, as well as within legal and policy communities, …

A Free Ride: Data Brokers'rent-Seeking Behavior And The Future Of Data Inequality, Krishnamurty Muralidhar, Laura Palk

Vanderbilt Journal of Entertainment & Technology Law

Historically, researchers obtained data from independent studies and government data. However, as public outcry for privacy regarding the government's maintenance of data has increased, the discretionary release of government data has decreased or become so anonymized that its relevance is limited. Research necessarily requires access to complete and accurate data. As such, researchers are turning to data brokers for the same, and often more, data than they can obtain from the government. Data brokers base their products and services on data gathered from a variety of free public sources and via the government-created Internet. Data brokers then recategorize the existing …

Virtual Reality Exceptionalism, Gilad Yadin

Vanderbilt Journal of Entertainment & Technology Law

Virtual reality is here. In just a few years, the technology moved from science fiction to the Internet, from specialized research facilities to living rooms. These new virtual reality environments are connected, collaborative, and social-built to deliver a subjective psychological effect that believably simulates spatial physical reality. Cognitive research shows that this effect is powerful enough that virtual reality users act and interact in ways that mirror real-world social and moral norms and behavior.

Contemporary cyberlaw theory is largely based on the notion that cyberspace is exceptional enough to warrant its own specific rules. This premise, a descendant of early …

Linking The Public Benefit To The Corporation: Blockchain As A Solution For Certification In An Age Of "Do-Good" Business, Margaret D. Fowler

Vanderbilt Journal of Entertainment & Technology Law

As part of its now-infamous emissions scandal, Volkswagen spent tens of millions of dollars on advertising geared toward environmentally conscious consumers. The scandal is an example of "greenwashing," which, along with the corresponding term "fairwashing," represents the information asymmetry present in product markets that involve claims of social and environmental responsibility in companies' production practices. As consumers and investors demand responsible production practices from both traditional corporations and entities organized under the newer corporate form known as public benefit corporations (PBCs), it becomes even more important to verify that those entities' supply chains are, in fact, meeting standards for the …

Corporate Cybersecurity: The International Threat To Private Networks And How Regulations Can Mitigate It, Eric J. Hyla

Vanderbilt Journal of Entertainment & Technology Law

Cyberattacks are occurring at an accelerating pace. Foreign nations are increasingly utilizing hacking as a tool for economic gain, acts of aggression, or international political expression. At risk are US consumers'personal data, private firms' bottom line, and the economies'integrity. In response, federal and state lawmakers have issued a series of disparate, uncoordinated policies seeking to strengthen cybersecurity practices. However, recent events indicate that these policies are less than ideal. This Note suggests that a unified response to cybersecurity is required and calls for the establishment of a single, central federal agency with authority over all cybersecurity regulations. Such an agency …

Augmenting Property Law: Applying The Right To Exclude In The Augmented Reality Universe, Samuel Mallick

Vanderbilt Journal of Entertainment & Technology Law

This Note considers whether and to what extent the property right to exclude applies to virtual space in the augmented reality (AR) universe. It provides an overview of AR's development and uses, as well as a review of property law concerning the right to exclude. By considering the consequences of previously proposed regulatory schemes in light of four hypothetical AR applications, this Note demonstrates that these solutions do not adequately balance the societal benefit achievable through free development of AR applications with landowners' absolute rights to exclude others from their property. This Note proposes adoption of an adjusted "open-range" common …

On Climate Change And Cyber Attacks: Leveraging Polycentric Governance To Mitigate Global Collective Action Problems, Scott J. Shackelford

Vanderbilt Journal of Entertainment & Technology Law

Although cyberspace and the atmosphere are distinct arenas, they share similar problems of overuse, difficulties of enforcement, and challenges of collective inaction and free riders. With weather patterns changing, global sea levels rising, and temperatures set to exceed 1.5 degrees Celsius by 2100, climate change is a problem that affects the entire world. Yet its benefits are dispersed, and its harms are often concentrated. Similarly, much of the cost of cyber attacks is focused in a few nations even as others are becoming havens for cybercriminals. Yet it is also true that actions taken by a multiplicity of actors on …

Just What The Doctor Ordered: Protecting Privacy Without Impeding Development Of Digital Pills, Amelia R. Montgomery

Vanderbilt Journal of Entertainment & Technology Law

Using technology, humans are receiving more and more information about the world around them via the Internet of Things, and the next area of connection will be the inside of the human body. Several forms of "digital pills" that send information from places like the human digestive tract or bloodstream are being developed, with a few already in use. These pills could stand to provide information that could drastically improve the lives of many people, but they also have privacy and data security implications that could put consumers at great risk. This Note analyzes these risks and suggests that short-term …

Keeping Ai Legal, Amitai Etzioni, Oren Etzioni

Vanderbilt Journal of Entertainment & Technology Law

AI programs make numerous decisions on their own, lack transparency, and may change frequently. Hence, unassisted human agents, such as auditors, accountants, inspectors, and police, cannot ensure that AI-guided instruments will abide by the law. This Article suggests that human agents need the assistance of AI oversight programs that analyze and oversee operational AI programs. This Article asks whether operational AI programs should be programmed to enable human users to override them; without that, such a move would undermine the legal order. This Article also points out that AI operational programs provide high surveillance capacities and, therefore, are essential for …

From State Street Bank To Cls Bank And Back: Reforming Software Patents To Promote Innovation, Parker Hancock

Vanderbilt Journal of Entertainment & Technology Law

For the past several decades, the Supreme Court and Federal Circuit have struggled to determine if, and under what circumstances, software is patentable. Once again, the Federal Circuit had an opportunity to provide clarity when it granted en banc review in CLS Bank. The resulting opinion contained a cursory per curiam decision and numerous concurrences and dissents, showing that the question is far from answered. Ultimately, the struggle over software patentability is not itself the problem, but a symptom of other problems in the patent system. Specifically, other substantive requirements of patentability are not weeding out overly broad patents because …

Man Versus Machine Review: The Showdown Between Hordes Of Discovery Lawyers And A Computer-Utilizing Predictive-Coding Technology, Nicholas Barry

Vanderbilt Journal of Entertainment & Technology Law

The discovery process is regularly capturing millions of pages of documents. Electronic storage is making storing documents cheaper and easier. When litigation begins, however, sorting through this massive amount of electronically stored information is costly and time intensive. Keyword searches are a start to managing the growing amount of electronic documents, but the discovery process is still falling behind in efficiency. Predictive coding could change all that.

Predictive coding is capable of solving the time-intensive nature (and resultant growing cost) of processing discovery documents. Predictive coding is faster, cheaper, and more accurate than traditional linear document review, the current "gold …

Compelled Production Of Encrypted Data, John E.D. Larkin

Vanderbilt Journal of Entertainment & Technology Law

There is a myth that shadowy and powerful government agencies can crack the encryption software that criminals use to protect computers filled with child pornography and stolen credit card numbers. The reality is that cheap or free encryption programs can place protected data beyond law enforcement's reach. If courts seriously mean to protect the victims of Internet crime--all too often children--then Congress must adopt a legal mechanism to remedy the technological deficiency.

To date, police and prosecutors have relied on subpoenas to either compel defendants to produce their password, or to decipher their protected data. This technique has been met …

Hacking For Lulzi: Employing Expert Hackers To Combat Cyber Terrorism, Swathi Padmanabhan

Vanderbilt Journal of Entertainment & Technology Law

Because hacking collectives Anonymous and LulzSec have routinely breached supposedly secure computer networks--including Visa, MasterCard, and the Central Intelligence Agency--the threat of cyber terrorism has become more prominent. Many US industries and companies depend on online communication and information storage. If terrorists compromise these capabilities, they could cripple the US economy and perhaps even cause widespread fatalities. Members of Anonymous and LulzSec lack the necessary intent to be prosecuted as cyber terrorists because they hack not to cause fear, but rather to create laughter. Their method of posting all necessary instructions and information regarding intended targets on online message boards …

Cloudy Privacy Protections: Why The Stored Communications Act Fails To Protect The Privacy Of Communications Stored In The Cloud, Ilana R. Kattan

Vanderbilt Journal of Entertainment & Technology Law

The advent of new communications technologies has generated debate over the applicability of the Fourth Amendment's warrant requirement to communications sent through, and stored in, technologies not anticipated by the Framers. In 1986, Congress responded to perceived gaps in the protections of the warrant requirement as applied to newer technologies, such as email, by passing the Stored Communications Act (SCA). As originally enacted, the SCA attempted to balance the interests of law enforcement against individual privacy rights by dictating the mechanisms by which the government could compel a particular service provider to disclose communications stored on behalf of its customers. …