[00:03.040 --> 00:06.720]  Welcome to the Ethics Village. I'm Andrea Matwishan from Penn State,
[00:06.720 --> 00:11.440]  and we are incredibly lucky to have with us today Liesl Bogan from Tech Congress.
[00:11.440 --> 00:16.180]  Welcome, Liesl. Thank you for having me. I'm so excited. Thanks for joining us.
[00:16.180 --> 00:21.900]  So I'm gonna not talk at all after this, but if you wouldn't mind just telling us
[00:21.980 --> 00:25.480]  a little bit about yourself, how you got involved with tech policy, some of the
[00:25.480 --> 00:29.220]  exciting jobs you've had, and what you've learned from them, and
[00:29.220 --> 00:32.040]  how someone who's interested in following in your footsteps
[00:32.040 --> 00:37.280]  might be able to also get involved in tech policy work. And then after that,
[00:37.280 --> 00:43.020]  I look forward to your talk. Great. Thank you so much. Well, I have been
[00:43.020 --> 00:46.740]  working in technology for quite a while, but I didn't start there.
[00:46.740 --> 00:50.840]  My original intent was to do more global affairs, foreign policy work,
[00:50.840 --> 00:55.400]  and I did some of that, but I began working in new media technologies
[00:55.400 --> 01:01.100]  out of grad school, and then I was able to do a research fellowship
[01:01.100 --> 01:06.400]  at Stanford University, originally on international institutions, but then
[01:06.400 --> 01:12.500]  I began work on cybersecurity through that research, and we did a number
[01:12.500 --> 01:15.240]  of projects related to cybersecurity and technology.
[01:15.720 --> 01:20.040]  And then at the same time, when former Secretary of State Condoleezza Rice
[01:20.040 --> 01:25.820]  was coming out of office, she hired me to start with her a new consulting
[01:25.820 --> 01:29.220]  firm, and it was a boutique consulting firm, and it had technology
[01:30.120 --> 01:34.860]  clients from the Silicon Valley and large international banks and other
[01:34.860 --> 01:40.520]  organizations that needed help navigating complex challenges in emerging
[01:40.520 --> 01:43.620]  markets all over the world. So I was able to combine some of my
[01:43.620 --> 01:47.480]  economics background with this new technology expertise that I had to
[01:47.480 --> 01:52.240]  help do strategies for clients. At the same time, I was doing research
[01:52.240 --> 01:55.940]  at Stanford in a number of areas, particularly focused on cybersecurity.
[01:55.940 --> 02:00.520]  And then after that, I went to a tech company for a bit, and from there,
[02:00.520 --> 02:05.680]  I went back to Stanford. I was doing a lot of tech policy advising from
[02:05.680 --> 02:09.280]  that perspective because I had worked with senior government officials
[02:09.280 --> 02:13.440]  because the consulting firm was with former National Security Advisor
[02:13.940 --> 02:18.980]  Steve Hadley and former Secretary of Defense Robert Gates, and so the
[02:18.980 --> 02:24.520]  firm was Rice-Hadley-Gates. And so at Stanford, I was briefing members
[02:24.520 --> 02:28.300]  of Congress on big data issues, privacy, technology, and national
[02:28.300 --> 02:33.720]  security. And then from there, I went back to the private sector where I
[02:33.720 --> 02:37.680]  worked on global strategy for cybersecurity at a large professional
[02:37.680 --> 02:42.080]  services firm. And then following three years of that work and recognizing
[02:42.080 --> 02:46.160]  the importance of technology in the entire infrastructure in which we
[02:46.160 --> 02:53.960]  operate as citizens, I was compelled to join Tech Congress, which is a
[02:53.960 --> 02:59.020]  career technologist on the Hill. The fellowship is called the Congressional
[02:59.020 --> 03:02.780]  Innovation Fellowship, and I was a senior fellow in the office of
[03:02.780 --> 03:06.880]  Senator Mark Warner last year, and I advised and supported on national
[03:06.880 --> 03:12.840]  security issues, cybersecurity, and technology. After that, I was hired by
[03:12.840 --> 03:16.640]  Tech Congress to lead a new initiative by the organization, which is called
[03:16.640 --> 03:20.800]  the Congressional Digital Service, and that is an attempt to place
[03:20.800 --> 03:25.680]  developers on the Hill to help Congress deal with the COVID crisis
[03:25.680 --> 03:30.900]  currently. And I've been working in this research space for a long time,
[03:30.900 --> 03:34.700]  and I'm very excited to discuss cybersecurity and disinformation and
[03:35.220 --> 03:39.840]  some of the tactics and methods that are currently in use today, but also the
[03:39.840 --> 03:44.560]  legislative efforts to counter them. So with that, I will share... oh, how can
[03:44.560 --> 03:47.760]  you get interested? Sorry, I left that out. How can those of you who are
[03:47.760 --> 03:50.380]  interested in getting into this space? There are a number of ways you can do
[03:50.380 --> 03:54.720]  that. I think finding mentors is extremely important.
[03:54.720 --> 03:57.400]  I was really fortunate to have incredible mentors who
[03:57.400 --> 04:00.780]  pointed me in different directions than I may have thought of myself.
[04:00.800 --> 04:04.040]  Secondly, I think if you can look for fellowships
[04:04.040 --> 04:08.040]  or research internships or ways to sort of get in on the ground floor, it's
[04:08.040 --> 04:11.420]  really important. In terms of technology development, if
[04:11.420 --> 04:14.660]  you don't have tech skills, there are plenty of boot camps you can join. If you
[04:14.660 --> 04:20.360]  don't want to do a formal degree, you can take classes online. There are a
[04:20.360 --> 04:22.520]  lot of different courses that will teach you how to do information security
[04:22.520 --> 04:26.940]  or programming or coding from a variety of different perspectives
[04:26.940 --> 04:30.400]  and disciplines. I think getting involved in the
[04:30.400 --> 04:34.820]  information security ecosystem in terms of...
[04:34.820 --> 04:37.800]  there's a lot of InfoSec people on Twitter and
[04:37.800 --> 04:42.780]  on blogs and think tanks. I would also encourage you to look into
[04:42.780 --> 04:45.900]  Civic Tech, which is something I wasn't really familiar with until I was
[04:45.900 --> 04:48.980]  introduced to Tech Congress. But this is a group of technologists who
[04:48.980 --> 04:52.200]  are trying to work to make technology work better for the public.
[04:52.200 --> 04:55.700]  And I think that's a really important initiative and really important effort
[04:56.220 --> 04:59.900]  and something that I am committed to. Because I think the last few years have
[04:59.900 --> 05:03.820]  shown us technology can be an incredible force multiplier for good, but it can also
[05:03.820 --> 05:07.220]  be something that does quite a bit of bad in the world. And so
[05:07.760 --> 05:11.000]  belonging to organizations that are really looking at things from an ethical
[05:11.520 --> 05:15.880]  and public service perspective is really important and I think incredibly
[05:15.880 --> 05:19.660]  valuable. So that's... that would be my advice and
[05:19.660 --> 05:22.100]  feel free to contact me if you have any other questions.
[05:22.120 --> 05:34.350]  I'm going to share my screen. So we're going to talk about
[05:34.350 --> 05:37.890]  disinformation and security. These are obviously two different
[05:38.390 --> 05:40.550]  disciplines, but I'm going to talk about how they
[05:40.550 --> 05:44.490]  intersect and then what we do with them from a legislative perspective.
[05:44.610 --> 05:47.390]  I'll briefly give you a history of disinformation,
[05:47.390 --> 05:51.370]  some of the methods and tactics that are used, why
[05:51.370 --> 05:54.930]  I think we should take a more of a security versus a content approach
[05:54.930 --> 05:58.750]  to the problem, some of the global regulatory efforts that are in use
[05:58.750 --> 06:01.070]  today, and then what the U.S. regulatory
[06:01.070 --> 06:07.470]  approach to methods and tactics is currently. So the history of
[06:07.470 --> 06:12.170]  disinformation is very old. It goes back into the
[06:12.170 --> 06:17.290]  1800s. Russia had monitored all internal and external communications, including
[06:17.290 --> 06:21.850]  those clear way back until
[06:21.850 --> 06:27.430]  way back until they were in the tsars. In the 19th century, Russia, the
[06:27.430 --> 06:31.110]  Ministry of Internal Affairs had a cryptanalytic division that
[06:31.110 --> 06:33.910]  analyzes encrypted, potentially anti-tsarist
[06:33.910 --> 06:38.210]  communications using code books that were purchased on the black market.
[06:38.210 --> 06:41.870]  This sort of dark information market existed not just in Russia but elsewhere,
[06:41.870 --> 06:44.690]  but they were quite good at organizing it.
[06:44.690 --> 06:48.870]  Tsar Alexander I gave credit to a Russian cryptanalyst for the defeat of
[06:48.870 --> 06:52.710]  Napoleon way back in 1812. Although by
[06:52.710 --> 06:59.670]  the early 1900s, Russian cryptography was far superior to
[06:59.670 --> 07:03.250]  any other world power, some of their disinformation tactics
[07:04.550 --> 07:08.070]  developed by the Russians after World War II were then gleaned
[07:08.070 --> 07:11.890]  from Russia by the military, German military,
[07:11.890 --> 07:16.110]  and the German military had a division that was dedicated to creating
[07:16.110 --> 07:19.790]  false military plans that were intended to confuse
[07:19.790 --> 07:23.790]  the enemy. So some people will trace disinformation efforts to
[07:24.530 --> 07:28.150]  Nazi Germany. The Russian word for disinformation
[07:28.150 --> 07:34.370]  includes all deception, except for camouflage. They made an
[07:34.370 --> 07:36.370]  exception for camouflage, but it meant any type of
[07:36.370 --> 07:40.810]  deception, and it quickly became part of their military operations
[07:41.530 --> 07:45.590]  with the intent to confuse and pollute the opinion-making process
[07:45.590 --> 07:50.210]  in the West. Many Russians believe that the dissolution of the Soviet Union was
[07:50.210 --> 07:52.130]  due to a deliberate information attack
[07:52.130 --> 07:57.230]  perpetrated by the West, and Timothy L Thomas notes that
[07:57.230 --> 08:01.570]  Russians perceived the Cold War as a war of information in which the West
[08:01.570 --> 08:04.350]  conquered the Soviet Union. So there's this deep
[08:04.350 --> 08:08.030]  sense that information had been weaponized against them, and it
[08:08.030 --> 08:11.310]  was fair play to weaponize it back against the West.
[08:11.470 --> 08:14.830]  So there are different concepts that we'll be talking about today, and they
[08:14.830 --> 08:17.930]  exist within fairly distinct domains that all sort
[08:17.930 --> 08:21.370]  of have overlapping Venn diagrams, although my Venn
[08:21.370 --> 08:25.490]  diagrams are quite overlapping, but those involve information and
[08:25.490 --> 08:30.190]  influence operations, which are often confused with this information. That is
[08:30.190 --> 08:32.590]  the state-sponsored collection of tactical
[08:32.590 --> 08:36.550]  information about an adversary, as well as the dissemination of propaganda in
[08:36.550 --> 08:41.330]  pursuit of a competitive advantage over an opponent. So it's very systematic
[08:41.330 --> 08:45.050]  and very strategic. Disinformation is deliberate, usually
[08:45.050 --> 08:47.970]  state-sponsored, false information used to mislead
[08:47.970 --> 08:52.870]  and deceive. Cybersecurity is a completely different, separate
[08:52.870 --> 08:57.270]  domain, and that is the domain of security that protects networks, devices,
[08:57.270 --> 09:01.170]  and data, as many of you know. But there's also this sort of subset
[09:01.170 --> 09:05.770]  that has become a big part of this discipline, which is what I
[09:05.770 --> 09:09.350]  and others have called cyber-enabled disinformation,
[09:09.350 --> 09:12.650]  and that's using digitized methods to spread
[09:13.290 --> 09:19.470]  deliberate false information intended to deceive. Some of the regulations and
[09:19.470 --> 09:23.870]  authorities that govern these domains are Title 50 of the NDAA,
[09:23.870 --> 09:27.350]  which proposed international standards to U.S. federal regulations,
[09:27.350 --> 09:30.390]  and then there are several other authorities that guide information
[09:30.390 --> 09:35.390]  operations in the intelligence community, throughout international law, within the
[09:35.390 --> 09:41.130]  State Department that they rely on, and a number of other executive agencies.
[09:41.250 --> 09:45.150]  We are just going to discuss the global anti-disinformation and U.S.
[09:45.150 --> 09:48.930]  anti-disinformation regulatory efforts, not sort of the broader frameworks which
[09:48.930 --> 09:53.390]  exist. So this brief history of Russian and
[09:53.390 --> 09:57.350]  Soviet disinformation. In the 1920s and 1930s, the Soviets created
[09:57.350 --> 10:01.130]  an enormous influence in intelligence apparatus across the globe.
[10:01.130 --> 10:04.670]  They were poor, they were relatively weak during that time, but they
[10:04.670 --> 10:08.990]  built these organizations, some of which were overt, some of which were covert,
[10:08.990 --> 10:12.270]  throughout the world, that were able to challenge all the major powers of Europe,
[10:12.270 --> 10:16.350]  and that the United States and most, without the knowledge of the United
[10:16.350 --> 10:20.850]  States and most of Europe. They used this apparatus, it was called,
[10:20.850 --> 10:25.230]  to accomplish a lot in the 1970s and 1980s.
[10:25.270 --> 10:30.430]  They were nearly able to split Europe and split NATO in Europe in the 1980s,
[10:30.430 --> 10:34.510]  and they began those efforts in the last year of the Carter administration, and
[10:34.510 --> 10:37.530]  continued those efforts into the Reagan years.
[10:37.850 --> 10:42.890]  When communication information was digitized, Russia's functional
[10:42.890 --> 10:46.890]  approach to monitoring and manipulating information didn't change.
[10:47.150 --> 10:51.990]  It actually just accelerated it and made it faster and more efficient.
[10:52.430 --> 10:56.530]  But in 1981, Reagan established the Active Measures Working Group to fight
[10:56.530 --> 10:59.710]  back against the global Soviet subversion efforts.
[10:59.710 --> 11:06.590]  This was a really enlightened approach. The Active Measures Working Group
[11:06.590 --> 11:10.370]  was created as an interagency working group, so it was chaired by the State
[11:10.370 --> 11:12.930]  Department, but it included representatives from
[11:12.930 --> 11:16.410]  what was then called the U.S. Information Agency. We don't have one
[11:16.410 --> 11:19.630]  anymore, but I actually think it's quite an important institution.
[11:19.830 --> 11:26.270]  The CIA, the FBI, the DIA, the DOD, and the Arms Control and Disarmament
[11:26.270 --> 11:29.290]  Agency. All of these groups came together to
[11:29.290 --> 11:32.650]  counter Russian disinformation efforts around the world,
[11:32.650 --> 11:36.790]  and they realized that this was a really complex
[11:37.690 --> 11:41.330]  problem, and it required a multi-layered approach.
[11:41.470 --> 11:45.190]  So despite the public interest in the Active Measures Working Group and U.S.
[11:45.190 --> 11:47.850]  successes, because it actually received quite a lot
[11:47.850 --> 11:52.730]  of positive responses from the U.S. public, Americans really liked
[11:52.730 --> 11:56.690]  this effort, but the Soviet Union continued to successfully
[11:57.750 --> 12:00.430]  distribute disinformation. Some examples of that,
[12:00.430 --> 12:05.050]  of those successes include the U.S. claims and beliefs that were spread all
[12:05.050 --> 12:08.170]  over the world that the United States military had
[12:08.170 --> 12:11.830]  created AIDS and released it as a weapon. That story
[12:11.830 --> 12:15.670]  gained considerable traction throughout the world. By the end of 1985,
[12:15.670 --> 12:21.030]  there were articles published in 13 countries that made these claims.
[12:21.070 --> 12:25.430]  In 1986, it hadn't reached 50 countries, so one year later.
[12:25.430 --> 12:30.610]  By 1987, the story had been published over 40 times in official Soviet press
[12:30.610 --> 12:34.090]  and was reprinted or rebroadcast in 80 countries
[12:34.090 --> 12:38.290]  in over 30 different languages, and they didn't retract the story
[12:38.290 --> 12:44.890]  until 1987, but it had already, you know, done its damage quite all over the world.
[12:44.890 --> 12:49.210]  In January of 1987, the Soviets launched another disinformation campaign, so as
[12:49.210 --> 12:51.970]  soon as they retracted that one, they started a new one,
[12:51.970 --> 12:56.170]  or earlier they started a new one that was aimed at convincing people that the
[12:56.170 --> 12:59.390]  CIA had perpetrated the November 1978 mass
[12:59.390 --> 13:04.250]  suicide at Jonestown, Indiana. They also ran false allegations of the
[13:04.250 --> 13:07.910]  United States development and use of biological weapons, and that
[13:07.910 --> 13:11.090]  the United States was importing Latin American children, butchering them, and
[13:11.090 --> 13:13.570]  using their body parts for organ transplants.
[13:13.570 --> 13:17.650]  These stories ran repeatedly in the Soviet press and were picked up worldwide.
[13:17.650 --> 13:20.570]  We'll see how this is similar to events today.
[13:20.570 --> 13:23.930]  So there's the pre-digital Soviet disinformation
[13:24.650 --> 13:28.130]  method and the post-digital toolkit, and they are actually
[13:28.130 --> 13:33.230]  quite similar. So the pre-digital toolkit, they used a lot of forgeries.
[13:33.370 --> 13:35.870]  They often use them to discredit or malign
[13:36.490 --> 13:39.630]  influential figures, particularly those affiliated with the United States
[13:39.630 --> 13:43.830]  Information Agency. In a report to Congress in 1987, it noted
[13:43.830 --> 13:47.110]  that the Soviet Union had mailed a forged letter to the Washington Post
[13:47.110 --> 13:51.070]  and the U.S. News and World Report, who then picked up those stories and ran
[13:51.070 --> 13:53.390]  with them. The document purported to be a letter
[13:53.390 --> 13:56.930]  between U.S. Information Agency official Herbert Romanstein
[13:56.930 --> 14:02.470]  to Senator David F. Durenberger, who was a former chairman of the Senate Select
[14:02.470 --> 14:07.410]  Committee on Intelligence, or SISI. The letter, dated April 29, 1986,
[14:07.410 --> 14:11.210]  described an alleged United States Information Agency campaign to spread
[14:11.210 --> 14:14.890]  this information on the Chernobyl nuclear power plant disaster.
[14:14.890 --> 14:19.150]  It was designed to discredit U.S. government and damage our relationships
[14:19.150 --> 14:23.830]  with Europe. They also used a lot of PR firms.
[14:23.830 --> 14:27.050]  Back in the 1980s, the Washington Post reported that Moscow had approached
[14:27.050 --> 14:31.190]  several PR firms in the United States to help represent their narratives to
[14:31.190 --> 14:34.590]  the U.S. public. They relied significantly on
[14:34.590 --> 14:37.050]  amplification. Disinformation narratives would be
[14:37.050 --> 14:40.790]  circulated domestically and infringe publications and then slowly move toward
[14:40.790 --> 14:43.850]  the mainstream publications, like the Washington Post and U.S. News and World
[14:43.850 --> 14:49.030]  Report and previous examples. There was a lot of media manipulation,
[14:49.030 --> 14:52.950]  the cultivation of reporters, getting reporters to pick up stories,
[14:52.950 --> 14:58.090]  investigate, and report on them. There were a number of
[14:58.090 --> 15:01.150]  front organizations. They were established to look like
[15:01.150 --> 15:05.130]  legitimate organizations, but they actually had disinformation purposes.
[15:05.410 --> 15:09.670]  Then there's the Post Digital Toolkit, which is actually very similar. Again,
[15:09.670 --> 15:13.750]  they're utilizing amplification, PR firms, forgeries,
[15:13.750 --> 15:17.810]  media manipulation, and front organizations. As you can see, this
[15:18.610 --> 15:24.570]  clip is from Twitter, and it was when the Russian Ministry of Foreign Affairs
[15:24.570 --> 15:29.490]  was accusing a white helmets worker of being
[15:29.490 --> 15:36.150]  an agent of Britain's MI6. And they continued to perpetuate this
[15:36.150 --> 15:39.490]  false information and actually did quite a lot of damage to him.
[15:40.870 --> 15:45.750]  This has some contemporary references. So, coronavirus and COVID-19,
[15:45.750 --> 15:51.530]  some recent examples related to a Chinese government official
[15:53.170 --> 15:57.070]  starting to circulate the narrative that the
[15:57.070 --> 16:01.470]  United States military brought the epidemic to war,
[16:01.470 --> 16:04.550]  in spite that being debunked by a number of other
[16:04.550 --> 16:09.010]  sources. Reuters reported on disinformation
[16:09.010 --> 16:12.290]  campaigns by Russia, Russian state media, and pro-Kremlin
[16:12.290 --> 16:17.110]  outlets regarding COVID-19. And they really
[16:17.110 --> 16:21.910]  pointed out that the aim of the Kremlin was to aggravate public health crisis
[16:21.910 --> 16:25.370]  in Western countries, in line with the Kremlin's broader
[16:25.370 --> 16:28.370]  strategy of attempting to subvert European societies.
[16:28.370 --> 16:34.090]  Again, it has a long history of this. We also saw other disinformation
[16:34.090 --> 16:37.770]  on platforms like Twitter. This is an example
[16:37.770 --> 16:43.530]  of the Chinese Communist Party capitalizing on the real rise in
[16:43.530 --> 16:46.070]  racism against Asian Americans in the U.S.
[16:46.070 --> 16:49.450]  Apparently there were a lot of videos of Asian Americans
[16:50.170 --> 16:52.850]  saying that there was a Chinese American brigade
[16:52.850 --> 16:57.490]  had had to be formed because violent white riots were attacking
[16:58.090 --> 17:01.590]  Chinese Americans in Los Angeles. This was proven
[17:01.590 --> 17:05.310]  false, although obviously there is quite a bit of racism being
[17:08.330 --> 17:11.630]  directed toward Asian Americans, unfortunately.
[17:12.490 --> 17:16.250]  Computational influence and digital disinformation. So what do we mean by
[17:16.250 --> 17:20.310]  that? It's kind of a word salad. So it's obviously not just
[17:20.310 --> 17:23.590]  Russia. Every state actor gets involved in this
[17:23.590 --> 17:28.110]  type of information operations. It's Russia, China, India, Iran, Pakistan,
[17:28.110 --> 17:31.970]  Saudi Arabia, and Venezuela have all been identified by social media platforms
[17:32.570 --> 17:35.770]  as being engaged in these methods targeted at other
[17:35.770 --> 17:39.430]  states. And they're not just doing it to the U.S. They do it to each other.
[17:39.430 --> 17:45.110]  It's a global effort. And the things that the platforms have
[17:45.110 --> 17:47.830]  pointed out are the amplification efforts,
[17:47.830 --> 17:51.370]  where they use artificial amplification and media
[17:51.370 --> 17:55.030]  amplification. So those are artificial amplification is when you take
[17:55.630 --> 17:59.870]  a bot or you use some sort of scripted algorithm to
[18:00.650 --> 18:05.550]  make it seem as if something is more popular than it actually is or has a
[18:05.550 --> 18:09.310]  broader audience than it actually has. There's media amplification, so where
[18:09.310 --> 18:14.050]  something starts out marginally as a small story on a blog or
[18:14.050 --> 18:17.110]  website and eventually is migrated through
[18:18.590 --> 18:23.950]  manipulation into more mainstream media forms. There are bot
[18:23.950 --> 18:27.430]  farms. And what bot farms? I'll go into those a little more in a
[18:27.430 --> 18:32.190]  moment. Astro-turfing, troll farms, dark ads, deep fakes,
[18:32.190 --> 18:35.190]  fake accounts, either sock puppets or social bots. Again,
[18:35.190 --> 18:39.430]  the terms and language to describe this type of behavior is evolving as this is
[18:39.430 --> 18:42.530]  sort of a new space. And then this concept of
[18:42.530 --> 18:46.730]  brigading. I'll go into those a little bit more detail in the next slides.
[18:46.730 --> 18:49.290]  So fake accounts, those are quite popular
[18:49.290 --> 18:55.290]  on online platforms. In November of 2019, Facebook grew 5.4 billion accounts that
[18:55.290 --> 18:58.210]  said were fake. It reported up to five percent of its
[18:58.210 --> 19:02.370]  monthly user base, so nearly 2.5 billion were fake accounts.
[19:02.670 --> 19:06.770]  There are a number of sock puppets, which is an online identity used for the
[19:06.770 --> 19:11.050]  purpose of deceiving. So it looks like it's a real person and
[19:11.050 --> 19:15.290]  then it isn't actually. The CEO of Whole Foods
[19:15.290 --> 19:18.990]  was convicted of engaging in this behavior in 2007.
[19:18.990 --> 19:21.990]  The CEO of Hollinger International was found guilty of mail fraud and
[19:21.990 --> 19:28.070]  obstruction of justice as well. The social bots are sometimes
[19:28.070 --> 19:31.450]  described as algorithmic software programs designed to interact with humans,
[19:31.450 --> 19:34.090]  so like chatbots, but in this case they often
[19:34.090 --> 19:39.190]  have more autonomy. And those aren't always nefarious, but
[19:39.190 --> 19:41.470]  sometimes they can be when people don't know
[19:41.470 --> 19:45.950]  what they're interacting with. And much of this can sometimes be
[19:45.950 --> 19:50.050]  very positive, really great, it's just oftentimes when it's used with a
[19:50.050 --> 19:55.810]  nefarious or manipulative intent it becomes problematic. So
[19:55.810 --> 20:00.450]  this is a quick clip of a video made by an American YouTube channel
[20:00.450 --> 20:04.210]  called cleantv.com and it was reposted by a Russia-linked Facebook page called
[20:04.210 --> 20:06.730]  Secured Borders. And so you see a lot of
[20:06.730 --> 20:12.950]  cross-platform pollination as well with these. So amplification, this is a
[20:12.950 --> 20:14.090]  another area where there's a lot of studies that are going into
[20:14.090 --> 20:17.750]  how artificial amplification, so when you
[20:17.750 --> 20:21.410]  take information or narrative and you use a
[20:21.410 --> 20:25.330]  scripted method to distribute it more widely than it
[20:25.330 --> 20:29.210]  than it normally would, and that's often used
[20:29.210 --> 20:32.890]  often by using fake accounts or bots which aren't even
[20:32.890 --> 20:38.270]  real accounts. There's media or platform amplification like I discussed before
[20:38.270 --> 20:40.310]  where, you know, it migrates from fringed
[20:40.310 --> 20:42.050]  platforms to mainstream media platforms. An example
[20:42.050 --> 20:46.110]  of amplification having really dire consequences is
[20:46.110 --> 20:53.750]  the case of Facebook in Burma. And so the Rohingya Muslims in
[20:53.750 --> 20:57.310]  Burma and Myanmar were driven out of the country. They were raped and slaughtered
[20:57.310 --> 21:00.110]  by the military in a genocide that was orchestrated
[21:00.110 --> 21:02.990]  through artificial amplification of this information. So it was
[21:05.110 --> 21:08.470]  and some of it was done by the military. They were creating fake accounts
[21:08.470 --> 21:10.610]  spreading false information about the Rohingya
[21:10.610 --> 21:14.890]  and Facebook wasn't able to shut that down before
[21:14.890 --> 21:18.290]  many of them had been slaughtered.
[21:18.770 --> 21:21.590]  Bot farms and wet bot farms, those are
[21:24.290 --> 21:29.390]  they're entities that are created by a scripted behavior that enable machines
[21:29.390 --> 21:33.330]  to do rote operations to upvote or download music or videos or products
[21:33.330 --> 21:37.450]  online or to otherwise automatically create the false impression of popularity
[21:37.450 --> 21:40.510]  or the false impression of an audience that may not actually
[21:40.510 --> 21:46.370]  exist. Wet bot farms are people who engage in similar rote operations to
[21:46.370 --> 21:49.330]  accomplish a task like upvoting music or downloading videos. So
[21:49.330 --> 21:52.950]  it's not a script that's running, it's an actual person that's following
[21:53.470 --> 21:58.870]  direction. And those two play a particularly destructive role when used
[21:58.870 --> 22:02.670]  to falsely amplify messages that are destructive, but it's
[22:02.670 --> 22:06.230]  also a false form of approval. So you may not, you may
[22:06.230 --> 22:11.990]  purchase a product on Amazon thinking that it has x
[22:11.990 --> 22:15.530]  numbers of positive reviews when many of those reviews might not actually be
[22:15.530 --> 22:19.150]  positive or a piece of music may seem incredibly
[22:19.150 --> 22:23.230]  popular, but like here's an example.
[22:23.910 --> 22:30.330]  So these are all cell phones that are playing music or
[22:30.330 --> 22:34.130]  they're downloading apps or they're upvoting music.
[22:34.910 --> 22:38.130]  But as you can see, these aren't actual people
[22:38.130 --> 22:44.790]  connected to those. It's a bunch of cell phones that are doing
[22:44.790 --> 22:48.030]  it with a scripted behavior that's connected to all of them.
[22:51.270 --> 22:56.550]  So troll farms and brigading. You can use bot farms, but you can also use
[22:56.550 --> 23:02.010]  sock puppets, which is a sort of new term, but Oxford researchers called fake
[23:02.010 --> 23:06.030]  armies of fake online influencers manufactured
[23:06.030 --> 23:09.870]  consensus. So that's when it looks like a ton of
[23:09.870 --> 23:13.070]  people agree or think one thing about something,
[23:13.070 --> 23:17.670]  but it's actually not a ton of people. It's a fake army of
[23:18.330 --> 23:23.450]  influencers. Troll farms usually refer to state-sponsored anonymous accounts for
[23:23.450 --> 23:26.190]  stock puppets or bots that engage in biased
[23:26.190 --> 23:28.510]  commentary. Brigading, that's when they can
[23:29.430 --> 23:34.210]  identify a target and gang up on them or that attempt to drown out online
[23:34.210 --> 23:39.370]  commentary by sheer volume through harassment or other methods. And
[23:39.370 --> 23:42.990]  brigading is an online harassment technique.
[23:42.990 --> 23:46.310]  There's a vote brigading as well. It's a massively coordinated online voting
[23:46.310 --> 23:50.770]  either with scores or approval ratings and
[23:50.770 --> 23:55.050]  it creates a false impression of approval where there maybe isn't
[23:55.050 --> 24:00.330]  such an impression. And there is often tied to what people call perception
[24:00.330 --> 24:04.210]  hacking. So there's astroturfing as well. This
[24:04.210 --> 24:07.150]  was a term coined in 1985 by Senator Lloyd
[24:07.150 --> 24:10.810]  Vincent of Texas and it occurs both online and offline. It's a political
[24:10.810 --> 24:14.830]  activity designed to appear as if it's
[24:14.830 --> 24:18.890]  unsolicited or autonomous political engagement. So people will be
[24:18.890 --> 24:23.890]  paid to express their opinions, paid to show up at a town hall, paid to
[24:23.890 --> 24:26.510]  create the impression of an organic grassroots effort when
[24:26.510 --> 24:31.210]  in fact it's not that. Several American corporations and political campaigns
[24:31.210 --> 24:35.710]  have engaged in astroturfing and it's often difficult from an
[24:35.710 --> 24:38.330]  intellectual, academic, or practical perspective to
[24:38.330 --> 24:43.190]  distinguish it from certain types of advertising. There
[24:43.190 --> 24:46.770]  is this concept called dark ads and what it is
[24:46.770 --> 24:51.050]  are precisely targeted ads that don't show up on a user's timeline or feed
[24:51.050 --> 24:55.450]  organically. Facebook invented them but all platforms use them. So following
[24:55.450 --> 24:58.570]  Cambridge Analytica and blowback from the platform's role in the Brexit
[24:58.570 --> 25:01.630]  campaign, Facebook and Twitter developed an ad transparency tool
[25:01.630 --> 25:05.690]  that allows all ads run on the platform to be visible.
[25:05.770 --> 25:09.770]  Targeted online advertising, algorithmic bias, and discrimination are highly
[25:09.770 --> 25:13.750]  problematic. And we have examples of these. They'll
[25:13.750 --> 25:16.690]  create a psychographic profile of someone. So if you see
[25:16.690 --> 25:22.170]  here in this slide, you can drill down the specific type of
[25:22.170 --> 25:25.410]  consumer that you want to advertise to or political
[25:26.710 --> 25:30.870]  participant that you want to target by saying a French and English speaking
[25:30.870 --> 25:33.930]  woman ages between the ages of 31 and 56
[25:33.930 --> 25:36.770]  located in the 10 mile radius of Boston, Massachusetts
[25:36.770 --> 25:40.370]  who works either from home or from a small office in the retail production
[25:40.370 --> 25:43.330]  industry. I mean if you look through this, this drills down to their
[25:43.330 --> 25:46.030]  their fit moms and green moms. They have great
[25:46.030 --> 25:50.570]  grade school kids. They live in a condo down to the exact square feet of that
[25:50.570 --> 25:53.270]  condo. What they enjoy doing for their
[25:53.870 --> 25:57.090]  activities. And you can get even to the types of
[25:57.090 --> 26:01.130]  travel apps and specific types of travel that are on their phone and that they've
[26:01.130 --> 26:03.770]  used. And this is a level of specificity that
[26:05.010 --> 26:09.450]  a lot of consumers aren't aware is being used against them to target
[26:10.010 --> 26:14.810]  ads to them. There's this other concept of deep fakes, shallow fakes.
[26:14.810 --> 26:18.490]  So deep fakes use artificial intelligence or fake videos or photos of
[26:18.490 --> 26:22.090]  real people. And it often uses neural network AI.
[26:22.090 --> 26:25.650]  There's three types. There are three types. Generative,
[26:25.650 --> 26:30.210]  adversarial networks, GANs, autoencoders, and VAEs, variational
[26:30.210 --> 26:34.910]  autoencoders. Google's DeepMind showed that the VAE
[26:34.910 --> 26:38.530]  could outperform GANs on face generation.
[26:38.530 --> 26:42.390]  Variational autoencoders are capable of both compressing data like an auto
[26:42.390 --> 26:45.510]  encoder and synthesizing data like a GAN. However,
[26:45.510 --> 26:48.750]  GANs generate data in fine granular detail and images
[26:49.330 --> 26:54.570]  created by VAEs tend to be more blurred. Shallow fakes are doctored videos that
[26:54.570 --> 26:57.830]  are less dramatic like the speaker Pelosi video.
[26:58.490 --> 27:01.030]  And what researchers have been telling us is that
[27:01.270 --> 27:04.210]  a lot of the time what the hardest part about deep fakes actually
[27:04.210 --> 27:09.990]  often isn't the images but the voices and the sounds and getting
[27:09.990 --> 27:14.810]  those to mimic the actual intonations. Here's an example
[27:14.810 --> 27:18.290]  of a deep fake. At the beginning, before anything, you get
[27:18.290 --> 27:22.610]  together and you read through the script. And so it's like, you know, all these
[27:22.610 --> 27:26.250]  heavyweights like, you know, Ben Stiller, Jack Black, Robert
[27:26.250 --> 27:29.030]  Denny Jr. Everybody at the end is like me.
[27:29.030 --> 27:32.410]  You know, like, hey, happy to be here, guys.
[27:34.010 --> 27:37.450]  And some other supporting guys. And then Tom Cruise walks in
[27:37.990 --> 27:42.070]  and even those guys are like, whoa, and he's super stoked to be there.
[27:42.110 --> 27:48.010]  You know, he's like, yeah, oh, oh, you know, like, he's like, wow.
[27:49.670 --> 27:55.010]  He's immediately excited when he walks into a room.
[27:55.010 --> 27:58.590]  And so he comes over and he sits next to me and I think he had been
[27:58.590 --> 28:01.190]  briefed on some of the supporting guys, but
[28:02.090 --> 28:06.690]  he was like trying to place me, you know. So he sat down next to me. He's like, I
[28:11.630 --> 28:12.950]  love your work.
[28:14.870 --> 28:19.050]  And I went, oh, thanks. I love your work, too, Tom Cruise.
[28:21.170 --> 28:23.410]  So as you can see, it's a very impressive
[28:25.870 --> 28:30.370]  manipulation of that media. So some of the technical issues with
[28:30.370 --> 28:33.530]  addressing this information, as considered by Congress,
[28:33.530 --> 28:39.250]  are the identity validation piece, financial transactions, spoofing, VPNs,
[28:39.250 --> 28:44.730]  bot detection technologies, SAM detection, and sentiment analysis,
[28:44.730 --> 28:52.030]  network analysis, and behavior analysis. I'll just briefly...
[28:52.030 --> 28:56.890]  I think all of these involve constitutional rights. So identity
[28:56.890 --> 29:00.230]  validation, forcing individuals to validate their
[29:00.230 --> 29:03.870]  identity online, has a lot of benefits for a variety of groups, but also has a
[29:03.870 --> 29:06.430]  lot of problems for those who believe in the
[29:06.430 --> 29:10.230]  First Amendment right to anonymity online. Financial
[29:10.230 --> 29:13.250]  transactions are difficult because they're layered
[29:13.250 --> 29:16.590]  on many of these platforms, so it's not always clear who made the payments and
[29:16.590 --> 29:20.450]  where they came from. Another problem that members of
[29:20.450 --> 29:24.130]  Congress thought, well, if you just identify the individual where they are
[29:24.130 --> 29:28.290]  based, are they in the U.S., are they in the U.S., or are they in, you
[29:28.290 --> 29:32.270]  I've had a number of members say, like, if I'm in engaging with somebody, I want
[29:32.270 --> 29:34.270]  to know if I'm talking to an American or if I'm
[29:34.270 --> 29:38.710]  if I'm talking to a Russian operative. Well, the problem with that is that you
[29:38.710 --> 29:42.010]  can't always tell. There's spoofing, you can use VPNs,
[29:42.450 --> 29:46.030]  and people all over the world use these. Bot detection technologies have
[29:46.030 --> 29:49.250]  developed considerably. There is an enormous amount of,
[29:49.250 --> 29:52.470]  depending on how you define bot, but there there's an incredible amount of
[29:52.470 --> 29:55.430]  work that has been done in this space, and the techniques are very
[29:55.430 --> 30:00.290]  sophisticated, but at the same time, things get through. There's also spam
[30:00.290 --> 30:04.530]  detection and sentiment analysis. These also involve constitutional
[30:04.530 --> 30:09.810]  considerations given the privacy issues involved in
[30:09.810 --> 30:14.750]  sentiment analysis, and that's where certain types of language can be,
[30:14.750 --> 30:18.010]  and behavior online can be analyzed to assess whether or not you
[30:18.010 --> 30:21.090]  are positive towards something or negative. It works really
[30:21.090 --> 30:23.690]  well with some of the targeted advertising.
[30:24.450 --> 30:27.050]  Obviously, network and behavioral analysis, those are
[30:27.050 --> 30:32.070]  those are ways to look at the kind of broader infrastructure in which some of
[30:32.070 --> 30:35.770]  this activity is happening, and Congress does consider it when
[30:35.770 --> 30:38.530]  they're thinking about bills and ways to control some of this,
[30:38.530 --> 30:43.530]  some of the problems that are created by some of this behavior online.
[30:44.250 --> 30:47.990]  So there are a lot of First Amendment issues with addressing disinformationist
[30:47.990 --> 30:51.210]  content, and so I think going after the
[30:51.210 --> 30:54.770]  content on these platforms is never the right approach. Doing a
[30:54.770 --> 30:59.770]  content-neutral approach is always best, if possible, because of
[30:59.770 --> 31:02.190]  the First Amendment. So the First Amendment issues involved in regulating
[31:02.450 --> 31:05.010]  disinformation online include the right of the users,
[31:05.010 --> 31:08.910]  but also includes the right of the companies, and it protects,
[31:08.910 --> 31:12.990]  the First Amendment protects anonymity. It protects against compelled speech. The
[31:12.990 --> 31:17.930]  government can't make you say anything. So often, companies will fight disclosure
[31:17.930 --> 31:20.390]  laws that are often well-intended efforts at
[31:20.390 --> 31:23.810]  transparency, but because the government can't compel you
[31:23.810 --> 31:27.970]  to speak about something, they'll fight it. SCOTUS has historically
[31:27.970 --> 31:31.370]  allowed greater regulation of commercial speech, but since the 70s, it has
[31:31.370 --> 31:35.950]  been increasingly protective of commercial speech, which has been an
[31:35.950 --> 31:38.870]  interesting development. And SCOTUS, the Supreme Court of the
[31:38.870 --> 31:41.770]  United States, has sometimes upheld laws that regulate speech
[31:41.770 --> 31:46.010]  if it's part of a larger regulatory scheme focused on conduct,
[31:46.010 --> 31:50.790]  and only incidentally, verbal speech. It's also allowed regulation of speech
[31:50.790 --> 31:53.770]  in a commercial context if there's a reasonable government interest in
[31:53.770 --> 31:58.590]  compelling factual and uncontroversial information. So I say
[31:58.590 --> 32:02.490]  that addressing disinformation is a security rather than
[32:03.110 --> 32:07.450]  a content problem. So over the history of cybersecurity and infrastructure
[32:07.450 --> 32:11.110]  security, we've developed this perimeterless
[32:11.110 --> 32:13.630]  security. So organizations realize that traditional perimeters
[32:13.630 --> 32:17.310]  for information security, like firewalls, signature-based anti-malware,
[32:17.310 --> 32:20.250]  those approaches were becoming less effective, particularly as you have a
[32:20.250 --> 32:24.050]  more mobile workforce. So traditional cybersecurity defenses
[32:24.050 --> 32:27.770]  leave organizations vulnerable to what many call the Maginot Line
[32:27.770 --> 32:31.370]  problem. And the Maginot Line was a military
[32:31.370 --> 32:36.450]  work of genius. It was this wall that was supposed to surround
[32:36.450 --> 32:40.070]  France, and everyone thought it was impenetrable,
[32:40.070 --> 32:43.610]  but the bottom piece was supposed to be this forest that nobody could
[32:43.610 --> 32:45.890]  get through, but the Germans just went around the wall.
[32:46.350 --> 32:50.290]  And in many cases, organizations would design their cybersecurity
[32:50.290 --> 32:53.730]  infrastructure in such a way that they had, well, we have the best firewalls,
[32:53.730 --> 32:56.770]  we have the best security, and then an adversary would just go
[32:56.770 --> 33:01.490]  around it or move laterally within it. So I think that content and
[33:01.490 --> 33:05.550]  speech is a Maginot Line, that when we attack content or narrowly-scoped
[33:05.550 --> 33:08.750]  methods of deterrence without thinking about the infrastructure or the
[33:08.750 --> 33:11.890]  consequences, I think state actors can simply go
[33:11.890 --> 33:16.970]  around our defenses. And I also think it looks like when
[33:16.970 --> 33:20.630]  some of the legislation considered to address some of these problems can often
[33:20.630 --> 33:23.790]  look like the authoritarian laws we have seen
[33:23.790 --> 33:26.830]  in other parts of the world. And I'm going to briefly go over those.
[33:27.870 --> 33:31.990]  So global regulation of disinformation. There are 54 countries
[33:31.990 --> 33:34.990]  have introduced legislation to address disinformation online.
[33:34.990 --> 33:38.210]  16 of them have enacted or introduced some form of fake news or
[33:38.210 --> 33:43.850]  misinformation laws. France, Belarus, Bangladesh, China, Kenya,
[33:43.850 --> 33:50.230]  Burkina Faso, Malaysia, Cambodia, Vietnam, Thailand, Egypt, Germany,
[33:50.230 --> 33:53.890]  India, Myanmar, Singapore, and the United States.
[33:54.210 --> 33:56.510]  So France's... I'm going to go over just a few. I'm not going to make you go
[33:56.510 --> 33:59.150]  through all these countries. I'll just go through a few. But France's
[33:59.150 --> 34:03.350]  disinformation law emerged as a number of disinformation
[34:03.350 --> 34:07.470]  efforts were directed toward the French president.
[34:07.470 --> 34:11.810]  In 2018, they passed a law that provides a definition of fake news, which is
[34:11.810 --> 34:16.150]  inexact allegations or imputations for news that falsely reports facts
[34:16.150 --> 34:19.470]  with the aim of changing the sincerity of a vote.
[34:19.470 --> 34:23.570]  It's designed to enact strict rules on the media during electoral campaigns and
[34:23.570 --> 34:26.610]  more specifically in a three-month proceeding in the vote.
[34:26.910 --> 34:31.470]  They made changes to the draft law in July 2018 to account for satire.
[34:31.470 --> 34:34.730]  So as you can see, like, satire would have definitely fallen under
[34:34.730 --> 34:38.170]  some of those restrictions, so they had to make a change.
[34:38.470 --> 34:42.070]  The legislation gives authorities the power to remove fake content spread via
[34:42.070 --> 34:45.550]  social media and block the sites that publish it, as well as enforce more
[34:45.550 --> 34:48.290]  financial transparency for sponsored content.
[34:48.330 --> 34:51.830]  In the three months before the election period, it builds upon an 1881 law that
[34:51.830 --> 34:54.970]  outlines dissemination of false news. There's a long history of
[34:54.970 --> 34:57.730]  false news in the world, as well as disinformation.
[34:58.690 --> 35:01.870]  As you can see, it has three major provisions and it borrows from
[35:01.870 --> 35:05.170]  the Honest Ads Act, actually, of the United States. So what's also interesting
[35:05.170 --> 35:08.270]  is that a lot of legislatures around the world, whether
[35:08.270 --> 35:11.490]  they're democratic or not, will borrow from each other's
[35:11.490 --> 35:14.830]  legislation. And in this case, they use some provisions from the Honest
[35:14.830 --> 35:19.030]  Ad Act to apply existing standards for TV and radio and apply them to social
[35:19.030 --> 35:21.290]  media, which I actually think is a fantastic idea.
[35:22.310 --> 35:26.130]  It allows political candidates to sue for removal of contested material,
[35:26.130 --> 35:29.730]  but again, because it is a restriction on speech, it is hot...
[35:29.730 --> 35:33.370]  the whole bill is hotly contested. Singapore has an anti-
[35:33.370 --> 35:38.770]  misinformation law, and this one criminalizes the dissemination of false
[35:38.770 --> 35:41.030]  information online. It is one of the more comprehensive
[35:41.030 --> 35:45.510]  and aggressive pieces of legislation in the world.
[35:45.550 --> 35:49.310]  It passed 72 to 9 in Singapore's parliament, and it makes it illegal to
[35:49.310 --> 35:51.850]  spread false statements of fact in Singapore
[35:51.850 --> 35:55.610]  that compromise security, public tranquility, which I find
[35:55.610 --> 35:58.650]  particularly problematic, public safety, and the country's
[35:58.650 --> 36:03.350]  relations with other nations. It punishes people who post false
[36:03.350 --> 36:07.190]  information with heavy fines and even jail time.
[36:07.550 --> 36:11.590]  This law has been condemned by a number of human rights groups and
[36:11.590 --> 36:14.090]  publications for unduly limiting free speech.
[36:14.090 --> 36:16.650]  It lets the government demand publication of corrections alongside
[36:16.650 --> 36:20.290]  allegedly false claims. It also outlaws the spread of
[36:20.290 --> 36:23.610]  misinformation on private messaging apps and gives the government the power to
[36:23.610 --> 36:26.290]  remove false content that undermines public trust, so it increases
[36:26.290 --> 36:29.890]  surveillance tenfold, although it's obviously a
[36:29.890 --> 36:34.010]  surveillance state as it is. It is quite comprehensive, but what's
[36:34.010 --> 36:37.730]  also problematic is that I found in the law itself it utilizes
[36:37.730 --> 36:42.590]  terms that were published by the social media platforms, things like
[36:44.110 --> 36:47.570]  coordinated inauthentic behavior, CIB. That type of
[36:47.570 --> 36:50.990]  language originates with U.S. companies and then it's adopted
[36:50.990 --> 36:55.670]  by foreign states for their legislations to regulate behaviors in perhaps a way
[36:55.670 --> 36:58.730]  that maybe the social media companies weren't necessarily intending.
[37:00.410 --> 37:04.070]  The U.S. regulatory efforts on disinformation,
[37:04.070 --> 37:07.670]  because of all the constraints that I mentioned before, the complexity of the
[37:07.670 --> 37:11.810]  language issues, the different domains that they operate,
[37:11.810 --> 37:14.970]  there are a number of ways why it's been harder for the government to
[37:15.690 --> 37:19.710]  legislate on some of this activity. First of all,
[37:19.710 --> 37:22.790]  when it comes to social media companies, the government is...
[37:24.190 --> 37:26.790]  the social media companies are not the government.
[37:26.870 --> 37:30.010]  They're not violating the First Amendment by imposing restrictions on
[37:30.010 --> 37:33.430]  speech. It's when the government forces a social media company to impose those
[37:33.430 --> 37:37.270]  restrictions that there's a lot of legal problems that Dr.
[37:37.270 --> 37:39.230]  Matwishan could probably elaborate on much better than
[37:39.230 --> 37:44.190]  I could. Some of these provisions are the Countering Foreign Propaganda and
[37:44.190 --> 37:47.290]  Disinformation Act. That was included in the National
[37:47.290 --> 37:54.750]  Defense Authorization Act in 2017. The H.R. 5910,
[37:54.750 --> 37:58.350]  Defend Against Russian Disinformation and Aggression Act.
[37:58.410 --> 38:02.470]  We have the Honest Ads Act, the Deepfake Report Act, the Malicious Deepfake
[38:02.470 --> 38:06.730]  Prohibition Act in 2018, and Defending each... this is a
[38:06.730 --> 38:11.650]  deepfake, so they turned it into an acronym, which is quite clever.
[38:11.650 --> 38:13.490]  Again, Congress wants to act on some of these
[38:13.490 --> 38:17.270]  bad behaviors that are having negative consequences,
[38:17.270 --> 38:20.830]  and they've been doing a lot more in the last few years.
[38:20.830 --> 38:26.430]  But again, it's quite complex. So this bill, Countering Foreign Propaganda
[38:26.430 --> 38:30.630]  in the NDAA, that was introduced by Senator Rob Portman and Senator Murphy.
[38:30.630 --> 38:34.310]  The bill created a grant program for NGOs, think tanks, civil society, and
[38:34.310 --> 38:36.670]  other active groups outside of government who are engaged in
[38:36.670 --> 38:43.410]  counter-propaganda-related work. I actually think we need to do... this
[38:43.410 --> 38:47.290]  great under the State Department, but I do think we need some form of a
[38:47.290 --> 38:51.210]  U.S. Information Agency, just to take a more holistic approach,
[38:51.210 --> 38:55.310]  so that it requires that all executive agencies,
[38:55.310 --> 39:00.410]  like the former Working Group, come together and consider solutions
[39:00.410 --> 39:07.190]  for this ecosystem in a coordinated manner.
[39:07.190 --> 39:10.770]  We had the Honest Ads Act, as I mentioned, adopted by France. It was introduced by
[39:10.770 --> 39:15.290]  Senator Klobuchar, Senator Lindsey Graham, and Senator Warner in 2018.
[39:15.330 --> 39:18.990]  And it helps prevent foreign interference in election advertising.
[39:19.010 --> 39:22.130]  And it amends the definition of electioneering communication
[39:22.130 --> 39:26.630]  in the Bipartisan Campaign Reform Act of 2002 to include paid internet and
[39:26.630 --> 39:30.170]  digital advertisements. A lot of these problems are a result of
[39:30.170 --> 39:34.950]  old legislation not being updated for new technologies. I encountered this
[39:34.950 --> 39:41.390]  early on in my career at a studio in Hollywood. They had
[39:42.090 --> 39:46.030]  a whole framework for television and music rights,
[39:46.030 --> 39:50.870]  but that was pre-digital. And when we had introduced streaming and downloading,
[39:50.870 --> 39:54.070]  all the licenses that applied to television shows,
[39:54.070 --> 39:58.770]  movies, their music that accompanied them, those were all completely outdated.
[39:58.770 --> 40:02.950]  So when we started analyzing that, and how do you... you can't go through and
[40:02.950 --> 40:07.310]  renegotiate every single license. Most of the studios in Hollywood, the one
[40:07.310 --> 40:11.390]  I worked at, but as well as many others, renegotiated those licenses based on a
[40:11.390 --> 40:15.630]  framework that looked at the new media technology landscape and said
[40:15.630 --> 40:21.870]  a download is equivalent to a VHS, for example, and
[40:21.870 --> 40:25.470]  streaming is equivalent to a broadcast license.
[40:25.470 --> 40:28.410]  So they were able to expedite some of the framework,
[40:28.410 --> 40:31.650]  expedite some of the licensing in that way. But I think a lot of legislation
[40:31.650 --> 40:36.030]  in Congress right now could be expedited if we simply
[40:36.030 --> 40:39.550]  updated some of the older legislation for a new
[40:39.550 --> 40:43.370]  technology environment. Because as you know, technology moves very, very quickly.
[40:44.730 --> 40:47.110]  So yeah, these are the other requirements.
[40:47.170 --> 40:51.150]  And it also, you know, required them to make every reasonable effort to ensure
[40:51.150 --> 40:53.310]  that foreign individuals and entities are not purchasing
[40:54.050 --> 40:57.670]  political advertisements in order to influence the American electorate.
[40:57.670 --> 41:01.510]  Seems like a small ask, but as again, the purchasing
[41:01.510 --> 41:05.650]  piece of this is quite difficult sometimes online, trying to validate
[41:05.650 --> 41:10.210]  who's buying what and how. The Deep Fakes Report Act was passed in
[41:10.210 --> 41:12.530]  the Senate by unanimous consent, which means that
[41:12.530 --> 41:17.450]  it was introduced and everyone, something that passes by unanimous
[41:17.450 --> 41:20.010]  consent, if no one objects, then it passes.
[41:20.090 --> 41:23.530]  And it was passed by Senator Portman, Schatz,
[41:23.530 --> 41:28.730]  Joni Ernst, Martin Heinrich, Senator Gardner, Senator Peters, Senator Rounds,
[41:28.730 --> 41:31.870]  and Senator Hassan. And that required the
[41:31.870 --> 41:34.850]  Department of Homeland Security to publish an annual report on the use of
[41:34.850 --> 41:38.290]  deepfake technologies that would be required to include an assessment of how
[41:38.290 --> 41:40.590]  both foreign governments and domestic groups
[41:40.590 --> 41:44.790]  are using deepfakes and digital forgeries to harm national security and
[41:44.790 --> 41:48.770]  mislead the American people. Now that's just a report, and Congress will do this
[41:48.870 --> 41:52.550]  a lot. They'll issue a... they'll pass something that requires an
[41:52.550 --> 41:55.790]  executive agency to create a report to help inform the public a little bit
[41:55.790 --> 41:56.590]  better.
[42:00.590 --> 42:04.110]  So this is the Malicious Deepfake Prohibition Act. It was introduced by
[42:04.110 --> 42:08.290]  Senator Ben Sasse in 2018, and it was supposed to create a new
[42:08.290 --> 42:11.550]  criminal offense related to the creation or distribution of fake electronic media
[42:11.550 --> 42:14.490]  records. It was criticized at the time for being
[42:15.130 --> 42:20.550]  sloppy and poorly thought through, but in fairness to them, you know, these
[42:20.550 --> 42:25.350]  are brand new concepts and ideas and, you know,
[42:26.390 --> 42:29.250]  there may be flaws, but the... but I do think that
[42:29.990 --> 42:34.370]  Congress just needs better resources to help them inform their decisions.
[42:36.210 --> 42:39.690]  There's the Defending Each and Every Person from False Appearances by Keeping
[42:39.690 --> 42:42.890]  Exploitation Subject to Accountability Act of 2019.
[42:43.010 --> 42:47.310]  This was... would require intentionally deceptive content creators to label
[42:47.310 --> 42:50.350]  videos with the digital watermark and written disclaimer informing
[42:50.350 --> 42:52.930]  its viewers that the content has been manipulated.
[42:53.690 --> 42:58.010]  That is... it does provide a legal course of action against content creators while
[42:58.010 --> 42:59.650]  also giving people who have been portrayed
[42:59.650 --> 43:02.470]  in deepfake videos a private right of action.
[43:03.670 --> 43:07.150]  Some of this was considered unenforceable, as
[43:07.150 --> 43:12.290]  we go into that. The Defend Against Russian Disinformation Aggression Act.
[43:12.290 --> 43:14.410]  This bill has included a package of bills in the House
[43:15.630 --> 43:19.470]  to secure America from Russian Interference Act of 2018, and it
[43:19.470 --> 43:24.110]  includes 17 bills to address subversive Russian activities.
[43:24.130 --> 43:26.590]  Congress... when people say Congress doesn't do anything, it's not entirely
[43:26.590 --> 43:29.190]  true. They wrote 17 bills to try to address
[43:29.190 --> 43:32.830]  the problem. It included legislation to codify the
[43:32.830 --> 43:36.150]  State Department Sanctions Office, and it required reporting on Putin's fake
[43:36.150 --> 43:40.510]  accounts and authorized... enhanced NATO cooperation, which is... I
[43:40.510 --> 43:43.390]  think allied cooperation is really important.
[43:43.390 --> 43:47.510]  The 2020 Technology Legislative Agenda. These are just some of the things that
[43:47.510 --> 43:52.270]  early in 2020 we identified as, you know,
[43:52.270 --> 43:55.510]  efforts that Congress would try to tackle. And this was before COVID,
[43:55.510 --> 44:01.810]  and, you know, another crisis had... a social justice crisis had
[44:01.810 --> 44:05.050]  emerged. So that includes trying to craft a federal
[44:05.050 --> 44:08.830]  data privacy framework, a greater shift toward consumer protection rather than
[44:08.830 --> 44:14.090]  disinformation protection. We... I suspected that House is still
[44:14.090 --> 44:17.270]  actively considering breaking up the... well, they are actively considering
[44:17.270 --> 44:20.250]  breaking up the big technology companies, and you may have seen the hearing more
[44:20.250 --> 44:24.050]  recently. We highlighted COPPRA, the Consumer
[44:24.050 --> 44:27.610]  Online Protection Act. Senator Cantwell torpedoed this a few
[44:27.610 --> 44:30.670]  times in 2018, but the sticking point remains that the private right of action
[44:30.670 --> 44:33.110]  for consumers if platforms misuse their data
[44:33.110 --> 44:37.850]  is a non-starter for Republicans. The House version of the Honest Ads Act will
[44:37.850 --> 44:42.390]  continue to be debated. Senator Warner introduced the Detour
[44:42.390 --> 44:46.670]  Act, the Access Act, and Josh Hawley... and with Josh Hawley, the Smart Act.
[44:46.730 --> 44:52.150]  The Detour Act is about dark patterns. That was to try to
[44:52.150 --> 44:56.770]  address manipulative design on websites.
[44:56.770 --> 45:01.550]  The Access Act was an interoperability bill. The senator wanted to make it
[45:01.550 --> 45:04.450]  easier to move your data from one platform to another.
[45:04.450 --> 45:07.890]  And I think we'll continue to see this movement toward
[45:07.890 --> 45:10.850]  the incremental breaking up of large tech companies and or
[45:10.850 --> 45:14.690]  antitrust reform, but I think the tone of the 2020 legislative agenda
[45:14.690 --> 45:18.790]  has shifted due to COVID and families trying to work from home and relying so
[45:18.790 --> 45:22.350]  heavily on technology. So I just want to ensure that that's
[45:22.350 --> 45:28.510]  probably going to continue to shape the public debate. And that is all I have.
[45:30.890 --> 45:32.950]  There we go. Thank you.
[45:34.490 --> 45:39.330]  Thank you so much, Liesl, for joining us today and for that amazing talk.
[45:39.330 --> 45:44.750]  And Q&A with you follows after this. Thanks so much.