National Security Law Commons^™

Jurisdiction, The Internet, And The Good Faith Exception: Controversy Over The Government’S Use Of Network Investigative Techniques, Maureen Weidman

Dickinson Law Review (2017-Present)

In February 2015, the FBI discovered a website dedicated to child pornography located on the Tor Network, a network designed to protect its users’ identities on the Internet. Due to the structure of the Tor Network, the FBI could not take down the website and identify users who previously accessed the website. Instead, the FBI kept the website operational for 30 days and applied for a search warrant in the Eastern District of Virginia to use a device called a Network Investigative Technique (“NIT”). This device operated similarly to malware and “attached” to computers accessing the website, allowing the government …

Section 230’S Liability Shield In The Age Of Online Terrorist, Jaime M. Freilich

Brooklyn Law Review

In recent years, “home grown” terrorists—individuals inspired to violence after watching terrorist videos online—have been responsible for devastating attacks in the United States and across Europe. Such terrorist propaganda falls outside the realm of the First Amendment’s protection because it has been proven to indoctrinate attackers, thus inciting imminent lawless action. Seizing on this, victims’ families have brought suits alleging that social media platforms, including Twitter, Facebook, and Google, provided material support to terrorists in violation of the Anti-Terrorism Act (ATA). The Communications Decency Act (CDA), however, has served as an impenetrable shield against these claims, protecting social media companies …

Deepfake Videos: When Seeing Isn't Believing, Holly Kathleen Hall

Catholic University Journal of Law and Technology

Videos, known as deepfakes, use readily available software to create a work that shows people saying and doing things they may never have uttered or engaged in. The technology making the videos appear very authentic is advancing at such a rate that people may not be able to detect if the videos are fact or fiction. Given the hasty acceptance of other forms of fake news in society, deepfake videos have the ability to affect the nature of information the public receives about candidates and policies. This study examines the potential use of deepfake videos in the democratic process, analyzes …

Typhoid Mario: Video Game Piracy As Viral Vector And National Security Threat, Andrew V. Moshirnia

Indiana Law Journal

Current academic and policy discussions regarding video game piracy focus on the economic losses inherent to copyright infringement. Unfortunately, this approach neglects the most significant implication of video game piracy: malware distribution. Copyright-motivated efforts to shut down file-sharing sites do little to reduce piracy and actually increase viral malware infection. Pirated video games are an ideal delivery device for malware, as users routinely launch unverified programs and forego virus detection. The illicit nature of the transaction forces users to rely almost entirely on the reputation of websites, uploaders, and other users to determine if a file is safe to download. …

Too-Big-To-Fail 2.0? Digital Service Providers, Nizan Geslevich Packin

Indiana Law Journal

The Article explains why addressing Too-Big-To-Fail 2.0 has not yet become a political and societal priority. First, digital service providers are technology companies, which, many believe, are shaped by market forces such that they fail and succeed in equal measure without producing negative ripple effects on the economy or society. Second, technology giants are not as carefully regulated as banks becauseunlike banks, they do not take insured deposits backed by the government. Third, even heavily regulated financial institutions have not been required until recently to focus on cybersecurity. Finally, some believe that there is no point in worrying about Too-Big-To-Fail …

"We Only Spy On Foreigners": The Myth Of A Universal Right To Privacy And The Practice Of Foreign Mass Surveillance, Asaf Lubin

Articles by Maurer Faculty

The digital age brought with it a new epoch in global political life, one neatly coined by Professor Philip Howard as the “pax technica.” In this new world order, government and industry are “tightly bound” in technological and security arrangements that serve to push forward an information and cyber revolution of unparalleled magnitude. While the rise of information technologies tells a miraculous story of triumph over the physical constraints that once shackled mankind, these very technologies are also the cause of grave concern. Intelligence agencies have been recently involved in the exercise of global indiscriminate surveillance, which purports to go …

Global Cybersecurity, Surveillance, And Privacy: The Obama Administration's Conflicted Legacy, Peter Margulies

Indiana Journal of Global Legal Studies

To analyze the Obama administration's cyber efforts, this Article proposes a paradigm of stewardship with both discursive and structural dimensions. Discursive stewardship refers to the Executive's openness to dialogue with other stakeholders. Structural stewardship refers to the domestic and transnational distribution of decisional authority, including checks and balances that guard against the excesses of unilateral action. The Article concludes that the Obama administration made substantial progress in each of these realms. However, the outsized role of law enforcement agendas and dearth of clearly articulated checks on transnational surveillance drove headwinds that limited forward movement.

Send Us The Bitcoin Or Patients Will Die: Addressing The Risks Of Ransomware Attacks On Hospitals, Deborah R. Farringer

Seattle University Law Review

Part I of this Article describes how the healthcare industry has arrived in this place of vulnerability, including (1) the history of the movement toward EHRs through HIPAA, (2) HIPAA’s meaningful use regulations and the background of current ransomware attacks, and (3) the distinctions between these attacks and other security breaches that have plagued large insurers and health systems within the last five years. Next, Part II will examine current industry culture when it comes to cybersecurity and review current legal and business approaches to address this growing threat. Then, Part III will argue that, while the current laws—including HIPAA …

Automating Threat Sharing: How Companies Can Best Ensure Liability Protection When Sharing Cyber Threat Information With Other Companies Or Organizations, Ari Schwartz, Sejal C. Shah, Matthew H. Mackenzie, Sheena Thomas, Tara Sugiyama Potashnik, Bri Law

University of Michigan Journal of Law Reform

This Article takes an in-depth look at the evolution of cybersecurity information sharing legislation, leading to the recent passage of the Cybersecurity Information Sharing Act (CISA) and offers insights into how automated information sharing mechanisms and associated requirements implemented pursuant to CISA can be leveraged to help ensure liability protections when engaging in cyber threat information sharing with and amongst other non-federal government entities.

The 2016 Amendments To Criminal Rule 41: National Search Warrants To Seize Cyberspace, "Particularly" Speaking, Devin M. Adams

University of Richmond Law Review

No abstract provided.

Keynote Address: The Digital Forevermore, Thomas J. Ridge

University of Richmond Law Review

No abstract provided.

Digital Technology And Analog Law: Cellular Location Data, The Third-Party Doctrine, And The Law's Need To Evolve, Justin Hill

University of Richmond Law Review

No abstract provided.

Newsroom: Cybersecurity: Obama's Conflicted Legacy 02-17-2017, Peter Margulies

Life of the Law School (1993- )

No abstract provided.

Standing After Snowden: Lessons On Privacy Harm From National Security Surveillance Litigation, Margot E. Kaminski

Publications

Article III standing is difficult to achieve in the context of data security and data privacy claims. Injury in fact must be "concrete," "particularized," and "actual or imminent"--all characteristics that are challenging to meet with information harms. This Article suggests looking to an unusual source for clarification on privacy and standing: recent national security surveillance litigation. There we can find significant discussions of what rises to the level of Article III injury in fact. The answers may be surprising: the interception of sensitive information; the seizure of less sensitive information and housing of it in a database for analysis; and …

Cybersecurity, Identity Theft, And Standing Law: A Framework For Data Breaches Using Substantial Risk In A Post-Clapper World, James C. Chou

American University National Security Law Brief

No abstract provided.

Social Justice And Silicon Valley: A Perspective On The Apple-Fbi Case And The “Going Dark” Debate, Charles J. Dunlap Jr.

Faculty Scholarship

No abstract provided.

Cyber Strategy & Policy: International Law Dimensions, Matthew C. Waxman

Faculty Scholarship

Important international law questions for formulating cyber strategy and policy include whether and when a cyber-attack amounts to an “act of war,” or, more precisely, an “armed attack” triggering a right of self-defense, and how the international legal principle of “sovereignty” could apply to cyber activities. International law in this area is not settled. There is, however, ample room within existing international law to support a strong cyber strategy, including a powerful deterrent. The answers to many international law questions discussed below depend on specific, case-by-case facts, and are likely to be highly contested for a long time to come. …

"Cybervandalism" Or "Digital Act Of War?" America's Muddled Approach To Cyber Incidents Will Not Deter More Crises, Charles J. Dunlap Jr.

Faculty Scholarship

If experts say a "malicious [cyber] code"' has "similar effects" to a "physical bomb,"' and that code actually causes "a stunning breach of global internet stability," is it really accurate to call that event merely an instance of a "cyber attack"?

Moreover, can you really expect to deter state and non-state actors from employing such code and similarly hostile cyber methodologies if all they think that they are risking is being labeled as a cyber-vandal subject only to law enforcement measures? Or might they act differently if it were made clear to them that such activity is considered an "armed …

Governance By Proxy: Cyber Challenges To Civil Liberties, Niva Elkin-Koren, Eldar Haber

Brooklyn Law Review

No abstract provided.

Data Institutionalism: A Reply To Andrew Woods, Zachary D. Clopton

Cornell Law Faculty Publications

In "Against Data Exceptionalism," Andrew K. Woods explores “one of the greatest societal and technological shifts in recent years,” which manifests in the “same old” questions about government power. The global cloud is an important feature of modern technological life that has significant consequences for individual privacy, law enforcement, and governance. Yet, as Woods suggests, the legal challenges presented by the cloud have analogies in age-old puzzles of public and private international law.

Identifying these connections is a conceptual advance, and this contribution should not be understated. But, to my mind, the most telling statement in Woods’s excellent article comes …

Time To Rethink Cybersecurity Reform: The Opm Data Breach And The Case For Centralized Cybersecurity Infrastructure, Zachary Figueroa

Catholic University Journal of Law and Technology

No abstract provided.

Decrypting Our Security: A Bipartisan Argument For A Rational Solution To The Encryption Challenge, Jamil N. Jaffer, Daniel J. Rosenthal

Catholic University Journal of Law and Technology

No abstract provided.

Securing The Smart Grid: Protecting National Security And Privacy Through Mandatory, Enforcable Interoperability Standards, Christopher Bosch

Fordham Urban Law Journal

No abstract provided.

Spying, Ronald Griffin

Faculty Books and Book Contributions

Ronald C. Griffin’s paper Spying, which is the third paper in the book Selected Issues in Modern Jurisprudence, edited by David A. Frenkel, begins with the finding in the Church Committee Report in the USA. It spotlights Edward Snowden’s disclosure about the NSA, reviews pertinent laws about spying and parades some suggestions and recommendation to curb government excesses.

Applying The Law Of Neutrality While Transitioning The Seas Of Cyberspace, Danielle Higson

American University National Security Law Brief

No abstract provided.

After Snowden: Regulating Technology-Aided Surveillance In The Digital Age, David Cole

Georgetown Law Faculty Publications and Other Works

Imagine a state that compels its citizens to inform it at all times of where they are, who they are with, what they are doing, who they are talking to, how they spend their time and money, and even what they are interested in. None of us would want to live there. Human rights groups would condemn the state for denying the most basic elements of human dignity and freedom. Student groups would call for boycotts to show solidarity. We would pity the offending state's citizens for their inability to enjoy the rights and privileges we know to be essential …

The Art Of Nailing Jell-O To The Wall: Reassessing The Political Power Of The Internet, Bryan Druzin, Jessica Li

Journal of Law and Policy

Political observers commonly argue that, given the unique characteristics of the Internet, democratization is an inevitability of its widespread use. The critical role that social media played in the wave of demonstrations, protests, and revolutions that swept across the Arab world in 2011 cemented this perception in the minds of many. Yet China defies this simplistic paradigm—China has been stunningly successful at constraining the political power of its Internet. We argue that the political importance of Internet technology has been overstated, particularly with respect to China. As support for this thesis, we cite recent political events in Hong Kong known …

Standing Up For Their Data: Recognizing The True Nature Of Injuries In Data Breach Claims To Afford Plaintiffs Article Iii Standing, Andrew Braunstein

Journal of Law and Policy

Over the last several years, data breaches have become increasingly more common, due in no small part to the failures of organizations charged with storing and protecting personal data. Consumers whose data has fallen victim to these breaches are more often turning to federal courts in attempts to be made whole from the loss of their information, whether simple credit card information or, as breaches become more sophisticated, social security information, medical and financial records, and more. These consumers are often being turned away from the courthouse, however, due to a failure of many federal courts to find that the …

The Intersection Of "Internet Terrorism" And "Individual Privacy" In The Context Of The First Amendment, Amanda Leonard

American University National Security Law Brief

No abstract provided.

Known Unknowns: State Cyber Operations, Cyber Warfare, And The Jus Ad Bellum, Peter Z. Stockburger

American University International Law Review

No abstract provided.