WEBVTT 00:03.040 --> 00:04.820 Welcome to the Ethics Village. 00:04.820 --> 00:11.440 I'm Andrea Matwishan from Penn State, and we are incredibly lucky to have with us today Liesl Bogan from Tech Congress. 00:11.440 --> 00:12.400 Welcome, Liesl. 00:12.720 --> 00:14.340 Thank you for having me. 00:14.340 --> 00:14.920 I'm so excited. 00:14.920 --> 00:16.180 Thanks for joining us. 00:16.180 --> 00:35.880 So I'm gonna not talk at all after this, but if you wouldn't mind just telling us a little bit about yourself, how you got involved with tech policy, some of the exciting jobs you've had, and what you've learned from them, and how someone who's interested in following in your footsteps might be able to also get involved in tech policy work. 00:35.880 --> 00:39.080 And then after that, I look forward to your talk. 00:39.340 --> 00:39.900 Great. 00:39.900 --> 00:41.200 Thank you so much. 00:41.200 --> 00:46.740 Well, I have been working in technology for quite a while, but I didn't start there. 00:46.740 --> 01:06.000 My original intent was to do more global affairs, foreign policy work, and I did some of that, but I began working in new media technologies out of grad school, and then I was able to do a research fellowship at Stanford University, originally on international institutions, 01:06.000 --> 01:15.240 but then I began work on cybersecurity through that research, and we did a number of projects related to cybersecurity and technology. 01:15.720 --> 01:42.000 And then at the same time, when former Secretary of State Condoleezza Rice was coming out of office, she hired me to start with her a new consulting firm, and it was a boutique consulting firm, and it had technology clients from the Silicon Valley and large international banks and other organizations that needed help navigating complex challenges in emerging markets all over the world. 01:42.000 --> 01:50.680 So I was able to combine some of my economics background with this new technology expertise that I had to help do strategies for clients. 01:50.760 --> 01:55.940 At the same time, I was doing research at Stanford in a number of areas, particularly focused on cybersecurity. 01:55.940 --> 02:02.000 And then after that, I went to a tech company for a bit, and from there, I went back to Stanford. 02:02.020 --> 02:20.700 I was doing a lot of tech policy advising from that perspective because I had worked with senior government officials because the consulting firm was with former National Security Advisor Steve Hadley and former Secretary of Defense Robert Gates, and so the firm was Rice-Hadley-Gates. 02:21.040 --> 02:29.440 And so at Stanford, I was briefing members of Congress on big data issues, privacy, technology, and national security. 02:29.620 --> 02:39.200 And then from there, I went back to the private sector where I worked on global strategy for cybersecurity at a large professional services firm. 02:39.200 --> 02:56.160 And then following three years of that work and recognizing the importance of technology in the entire infrastructure in which we operate as citizens, I was compelled to join Tech Congress, which is a career technologist on the Hill. 02:56.280 --> 03:09.860 The fellowship is called the Congressional Innovation Fellowship, and I was a senior fellow in the office of Senator Mark Warner last year, and I advised and supported on national security issues, cybersecurity, and technology. 03:09.980 --> 03:26.660 After that, I was hired by Tech Congress to lead a new initiative by the organization, which is called the Congressional Digital Service, and that is an attempt to place developers on the Hill to help Congress deal with the COVID crisis currently. 03:27.560 --> 03:42.120 And I've been working in this research space for a long time, and I'm very excited to discuss cybersecurity and disinformation and some of the tactics and methods that are currently in use today, but also the legislative efforts to counter them. 03:42.300 --> 03:45.500 So with that, I will share... oh, how can you get interested? 03:45.500 --> 03:46.460 Sorry, I left that out. 03:46.460 --> 03:49.100 How can those of you who are interested in getting into this space? 03:49.100 --> 03:50.580 There are a number of ways you can do that. 03:50.580 --> 03:54.720 I think finding mentors is extremely important. 03:54.720 --> 04:00.780 I was really fortunate to have incredible mentors who pointed me in different directions than I may have thought of myself. 04:00.800 --> 04:09.140 Secondly, I think if you can look for fellowships or research internships or ways to sort of get in on the ground floor, it's really important. 04:09.440 --> 04:14.480 In terms of technology development, if you don't have tech skills, there are plenty of boot camps you can join. 04:14.480 --> 04:18.980 If you don't want to do a formal degree, you can take classes online. 04:18.980 --> 04:28.520 There are a lot of different courses that will teach you how to do information security or programming or coding from a variety of different perspectives and disciplines. 04:28.640 --> 04:34.820 I think getting involved in the information security ecosystem in terms of... 04:34.820 --> 04:40.820 there's a lot of InfoSec people on Twitter and on blogs and think tanks. 04:40.820 --> 04:47.180 I would also encourage you to look into Civic Tech, which is something I wasn't really familiar with until I was introduced to Tech Congress. 04:47.180 --> 04:52.200 But this is a group of technologists who are trying to work to make technology work better for the public. 04:52.200 --> 04:58.360 And I think that's a really important initiative and really important effort and something that I am committed to. 04:58.360 --> 05:06.900 Because I think the last few years have shown us technology can be an incredible force multiplier for good, but it can also be something that does quite a bit of bad in the world. 05:06.900 --> 05:16.680 And so belonging to organizations that are really looking at things from an ethical and public service perspective is really important and I think incredibly valuable. 05:17.280 --> 05:22.100 So that's... that would be my advice and feel free to contact me if you have any other questions. 05:22.120 --> 05:23.980 I'm going to share my screen. 05:33.150 --> 05:36.190 So we're going to talk about disinformation and security. 05:36.190 --> 05:44.490 These are obviously two different disciplines, but I'm going to talk about how they intersect and then what we do with them from a legislative perspective. 05:44.610 --> 06:00.750 I'll briefly give you a history of disinformation, some of the methods and tactics that are used, why I think we should take a more of a security versus a content approach to the problem, some of the global regulatory efforts that are in use today, and then what the U.S. 06:00.750 --> 06:05.730 regulatory approach to methods and tactics is currently. 06:06.310 --> 06:09.330 So the history of disinformation is very old. 06:09.330 --> 06:13.490 It goes back into the 1800s. 06:13.490 --> 06:24.370 Russia had monitored all internal and external communications, including those clear way back until way back until they were in the tsars. 06:24.870 --> 06:38.210 In the 19th century, Russia, the Ministry of Internal Affairs had a cryptanalytic division that analyzes encrypted, potentially anti-tsarist communications using code books that were purchased on the black market. 06:38.210 --> 06:44.690 This sort of dark information market existed not just in Russia but elsewhere, but they were quite good at organizing it. 06:44.690 --> 06:51.650 Tsar Alexander I gave credit to a Russian cryptanalyst for the defeat of Napoleon way back in 1812. 06:51.830 --> 07:21.230 Although by the early 1900s, Russian cryptography was far superior to any other world power, some of their disinformation tactics developed by the Russians after World War II were then gleaned from Russia by the military, German military, and the German military had a division that was dedicated to creating false military plans that were intended to confuse the enemy. 07:21.230 --> 07:26.010 So some people will trace disinformation efforts to Nazi Germany. 07:26.190 --> 07:34.050 The Russian word for disinformation includes all deception, except for camouflage. 07:34.050 --> 07:47.050 They made an exception for camouflage, but it meant any type of deception, and it quickly became part of their military operations with the intent to confuse and pollute the opinion-making process in the West. 07:47.050 --> 08:03.550 Many Russians believe that the dissolution of the Soviet Union was due to a deliberate information attack perpetrated by the West, and Timothy L Thomas notes that Russians perceived the Cold War as a war of information in which the West conquered the Soviet Union. 08:03.550 --> 08:11.310 So there's this deep sense that information had been weaponized against them, and it was fair play to weaponize it back against the West. 08:11.470 --> 08:26.530 So there are different concepts that we'll be talking about today, and they exist within fairly distinct domains that all sort of have overlapping Venn diagrams, although my Venn diagrams are quite overlapping, but those involve information and influence operations, 08:26.530 --> 08:29.350 which are often confused with this information. 08:29.550 --> 08:40.410 That is the state-sponsored collection of tactical information about an adversary, as well as the dissemination of propaganda in pursuit of a competitive advantage over an opponent. 08:40.590 --> 08:43.030 So it's very systematic and very strategic. 08:43.030 --> 08:49.310 Disinformation is deliberate, usually state-sponsored, false information used to mislead and deceive. 08:49.930 --> 08:59.190 Cybersecurity is a completely different, separate domain, and that is the domain of security that protects networks, devices, and data, as many of you know. 08:59.270 --> 09:18.050 But there's also this sort of subset that has become a big part of this discipline, which is what I and others have called cyber-enabled disinformation, and that's using digitized methods to spread deliberate false information intended to deceive. 09:18.050 --> 09:26.070 Some of the regulations and authorities that govern these domains are Title 50 of the NDAA, which proposed international standards to U.S. 09:26.070 --> 09:41.130 federal regulations, and then there are several other authorities that guide information operations in the intelligence community, throughout international law, within the State Department that they rely on, and a number of other executive agencies. 09:41.250 --> 09:45.150 We are just going to discuss the global anti-disinformation and U.S. 09:45.150 --> 09:49.970 anti-disinformation regulatory efforts, not sort of the broader frameworks which exist. 09:50.950 --> 09:54.190 So this brief history of Russian and Soviet disinformation. 09:54.190 --> 10:01.130 In the 1920s and 1930s, the Soviets created an enormous influence in intelligence apparatus across the globe. 10:01.130 --> 10:14.530 They were poor, they were relatively weak during that time, but they built these organizations, some of which were overt, some of which were covert, throughout the world, that were able to challenge all the major powers of Europe, and that the United States and most, 10:14.530 --> 10:17.790 without the knowledge of the United States and most of Europe. 10:17.930 --> 10:25.230 They used this apparatus, it was called, to accomplish a lot in the 1970s and 1980s. 10:25.270 --> 10:37.530 They were nearly able to split Europe and split NATO in Europe in the 1980s, and they began those efforts in the last year of the Carter administration, and continued those efforts into the Reagan years. 10:37.850 --> 10:46.890 When communication information was digitized, Russia's functional approach to monitoring and manipulating information didn't change. 10:47.150 --> 10:51.990 It actually just accelerated it and made it faster and more efficient. 10:52.430 --> 10:59.710 But in 1981, Reagan established the Active Measures Working Group to fight back against the global Soviet subversion efforts. 10:59.710 --> 11:04.130 This was a really enlightened approach. 11:04.950 --> 11:14.570 The Active Measures Working Group was created as an interagency working group, so it was chaired by the State Department, but it included representatives from what was then called the U.S. 11:14.570 --> 11:15.750 Information Agency. 11:15.750 --> 11:19.630 We don't have one anymore, but I actually think it's quite an important institution. 11:19.830 --> 11:27.270 The CIA, the FBI, the DIA, the DOD, and the Arms Control and Disarmament Agency. 11:27.510 --> 11:41.330 All of these groups came together to counter Russian disinformation efforts around the world, and they realized that this was a really complex problem, and it required a multi-layered approach. 11:41.470 --> 11:45.190 So despite the public interest in the Active Measures Working Group and U.S. 11:45.190 --> 11:50.290 successes, because it actually received quite a lot of positive responses from the U.S. 11:50.290 --> 11:59.190 public, Americans really liked this effort, but the Soviet Union continued to successfully distribute disinformation. 11:59.190 --> 12:02.390 Some examples of that, of those successes include the U.S. 12:02.950 --> 12:11.050 claims and beliefs that were spread all over the world that the United States military had created AIDS and released it as a weapon. 12:11.050 --> 12:13.690 That story gained considerable traction throughout the world. 12:13.690 --> 12:21.030 By the end of 1985, there were articles published in 13 countries that made these claims. 12:21.070 --> 12:25.430 In 1986, it hadn't reached 50 countries, so one year later. 12:25.430 --> 12:44.890 By 1987, the story had been published over 40 times in official Soviet press and was reprinted or rebroadcast in 80 countries in over 30 different languages, and they didn't retract the story until 1987, but it had already, you know, done its damage quite all over the world. 12:44.890 --> 13:00.630 In January of 1987, the Soviets launched another disinformation campaign, so as soon as they retracted that one, they started a new one, or earlier they started a new one that was aimed at convincing people that the CIA had perpetrated the November 1978 mass suicide at Jonestown, 13:00.630 --> 13:01.390 Indiana. 13:01.410 --> 13:13.570 They also ran false allegations of the United States development and use of biological weapons, and that the United States was importing Latin American children, butchering them, and using their body parts for organ transplants. 13:13.570 --> 13:17.650 These stories ran repeatedly in the Soviet press and were picked up worldwide. 13:17.650 --> 13:20.570 We'll see how this is similar to events today. 13:20.570 --> 13:29.670 So there's the pre-digital Soviet disinformation method and the post-digital toolkit, and they are actually quite similar. 13:29.670 --> 13:33.230 So the pre-digital toolkit, they used a lot of forgeries. 13:33.370 --> 13:41.250 They often use them to discredit or malign influential figures, particularly those affiliated with the United States Information Agency. 13:41.270 --> 13:47.910 In a report to Congress in 1987, it noted that the Soviet Union had mailed a forged letter to the Washington Post and the U.S. 13:47.910 --> 13:51.910 News and World Report, who then picked up those stories and ran with them. 13:51.910 --> 13:54.270 The document purported to be a letter between U.S. 13:54.270 --> 13:59.630 Information Agency official Herbert Romanstein to Senator David F. 13:59.630 --> 14:04.690 Durenberger, who was a former chairman of the Senate Select Committee on Intelligence, or SISI. 14:04.790 --> 14:14.890 The letter, dated April 29, 1986, described an alleged United States Information Agency campaign to spread this information on the Chernobyl nuclear power plant disaster. 14:14.890 --> 14:17.410 It was designed to discredit U.S. 14:17.410 --> 14:20.730 government and damage our relationships with Europe. 14:21.370 --> 14:23.830 They also used a lot of PR firms. 14:23.830 --> 14:31.630 Back in the 1980s, the Washington Post reported that Moscow had approached several PR firms in the United States to help represent their narratives to the U.S. 14:31.630 --> 14:32.430 public. 14:32.990 --> 14:35.730 They relied significantly on amplification. 14:35.730 --> 14:43.470 Disinformation narratives would be circulated domestically and infringe publications and then slowly move toward the mainstream publications, like the Washington Post and U.S. 14:43.470 --> 14:45.930 News and World Report and previous examples. 14:46.350 --> 14:56.410 There was a lot of media manipulation, the cultivation of reporters, getting reporters to pick up stories, investigate, and report on them. 14:56.770 --> 14:59.310 There were a number of front organizations. 14:59.310 --> 15:05.130 They were established to look like legitimate organizations, but they actually had disinformation purposes. 15:05.410 --> 15:09.270 Then there's the Post Digital Toolkit, which is actually very similar. 15:09.270 --> 15:16.890 Again, they're utilizing amplification, PR firms, forgeries, media manipulation, and front organizations. 15:16.890 --> 15:32.530 As you can see, this clip is from Twitter, and it was when the Russian Ministry of Foreign Affairs was accusing a white helmets worker of being an agent of Britain's MI6. 15:33.450 --> 15:39.490 And they continued to perpetuate this false information and actually did quite a lot of damage to him. 15:40.870 --> 15:43.810 This has some contemporary references. 15:43.810 --> 16:05.930 So, coronavirus and COVID-19, some recent examples related to a Chinese government official starting to circulate the narrative that the United States military brought the epidemic to war, in spite that being debunked by a number of other sources. 16:06.730 --> 16:14.890 Reuters reported on disinformation campaigns by Russia, Russian state media, and pro-Kremlin outlets regarding COVID-19. 16:15.530 --> 16:28.370 And they really pointed out that the aim of the Kremlin was to aggravate public health crisis in Western countries, in line with the Kremlin's broader strategy of attempting to subvert European societies. 16:28.370 --> 16:31.830 Again, it has a long history of this. 16:31.830 --> 16:36.670 We also saw other disinformation on platforms like Twitter. 16:36.670 --> 16:46.070 This is an example of the Chinese Communist Party capitalizing on the real rise in racism against Asian Americans in the U.S. 16:46.070 --> 17:00.010 Apparently there were a lot of videos of Asian Americans saying that there was a Chinese American brigade had had to be formed because violent white riots were attacking Chinese Americans in Los Angeles. 17:00.010 --> 17:05.310 This was proven false, although obviously there is quite a bit of racism being 17:08.330 --> 17:11.630 directed toward Asian Americans, unfortunately. 17:12.490 --> 17:15.250 Computational influence and digital disinformation. 17:15.250 --> 17:16.490 So what do we mean by that? 17:16.490 --> 17:18.330 It's kind of a word salad. 17:18.330 --> 17:20.990 So it's obviously not just Russia. 17:20.990 --> 17:25.250 Every state actor gets involved in this type of information operations. 17:25.250 --> 17:36.670 It's Russia, China, India, Iran, Pakistan, Saudi Arabia, and Venezuela have all been identified by social media platforms as being engaged in these methods targeted at other states. 17:36.670 --> 17:37.930 And they're not just doing it to the U.S. 17:37.930 --> 17:39.430 They do it to each other. 17:39.430 --> 17:42.390 It's a global effort. 17:42.810 --> 17:52.450 And the things that the platforms have pointed out are the amplification efforts, where they use artificial amplification and media amplification. 17:52.450 --> 18:07.390 So those are artificial amplification is when you take a bot or you use some sort of scripted algorithm to make it seem as if something is more popular than it actually is or has a broader audience than it actually has. 18:07.390 --> 18:23.090 There's media amplification, so where something starts out marginally as a small story on a blog or website and eventually is migrated through manipulation into more mainstream media forms. 18:23.090 --> 18:24.490 There are bot farms. 18:24.490 --> 18:25.650 And what bot farms? 18:25.650 --> 18:27.590 I'll go into those a little more in a moment . 18:27.590 --> 18:34.610 Astro-turfing, troll farms, dark ads, deep fakes, fake accounts, either sock puppets or social bots. 18:34.610 --> 18:41.030 Again, the terms and language to describe this type of behavior is evolving as this is sort of a new space. 18:41.030 --> 18:42.690 And then this concept of brigading . 18:42.690 --> 18:45.950 I'll go into those a little bit more detail in the next slides. 18:46.310 --> 18:51.350 So fake accounts, those are quite popular on online platforms. 18:51.350 --> 18:56.510 In November of 2019, Facebook grew 5.4 billion accounts that said were fake. 18:56.510 --> 19:02.370 It reported up to five percent of its monthly user base, so nearly 2.5 billion were fake accounts. 19:02.670 --> 19:07.870 There are a number of sock puppets, which is an online identity used for the purpose of deceiving. 19:07.870 --> 19:13.010 So it looks like it's a real person and then it isn't actually. 19:13.170 --> 19:18.990 The CEO of Whole Foods was convicted of engaging in this behavior in 2007. 19:18.990 --> 19:25.630 The CEO of Hollinger International was found guilty of mail fraud and obstruction of justice as well. 19:26.290 --> 19:35.530 The social bots are sometimes described as algorithmic software programs designed to interact with humans, so like chatbots, but in this case they often have more autonomy. 19:36.570 --> 19:43.290 And those aren't always nefarious, but sometimes they can be when people don't know what they're interacting with. 19:43.430 --> 19:53.970 And much of this can sometimes be very positive, really great, it's just oftentimes when it's used with a nefarious or manipulative intent it becomes problematic. 19:54.270 --> 20:04.210 So this is a quick clip of a video made by an American YouTube channel called cleantv.com and it was reposted by a Russia-linked Facebook page called Secured Borders. 20:04.210 --> 20:08.490 And so you see a lot of cross-platform pollination as well with these. 20:08.490 --> 20:26.650 So amplification, this is a another area where there's a lot of studies that are going into how artificial amplification, so when you take information or narrative and you use a scripted method to distribute it more widely than it than it normally would, 20:26.650 --> 20:33.530 and that's often used often by using fake accounts or bots which aren't even real accounts . 20:34.310 --> 20:41.470 There's media or platform amplification like I discussed before where, you know, it migrates from fringed platforms to mainstream media platforms. 20:41.470 --> 20:51.450 An example of amplification having really dire consequences is the case of Facebook in Burma. 20:51.510 --> 20:56.450 And so the Rohingya Muslims in Burma and Myanmar were driven out of the country. 20:56.450 --> 21:02.590 They were raped and slaughtered by the military in a genocide that was orchestrated through artificial amplification of this information. 21:02.590 --> 21:07.430 So it was and some of it was done by the military. 21:07.430 --> 21:18.290 They were creating fake accounts spreading false information about the Rohingya and Facebook wasn't able to shut that down before many of them had been slaughtered. 21:18.770 --> 21:41.670 Bot farms and wet bot farms, those are they're entities that are created by a scripted behavior that enable machines to do rote operations to upvote or download music or videos or products online or to otherwise automatically create the false impression of popularity or the false impression of an audience that may not actually exist. 21:42.230 --> 21:49.250 Wet bot farms are people who engage in similar rote operations to accomplish a task like upvoting music or downloading videos. 21:49.250 --> 21:54.590 So it's not a script that's running, it's an actual person that's following direction. 21:54.870 --> 22:05.110 And those two play a particularly destructive role when used to falsely amplify messages that are destructive, but it's also a false form of approval. 22:05.110 --> 22:23.230 So you may not, you may purchase a product on Amazon thinking that it has x numbers of positive reviews when many of those reviews might not actually be positive or a piece of music may seem incredibly popular, but like here's an example. 22:23.910 --> 22:34.130 So these are all cell phones that are playing music or they're downloading apps or they're upvoting music. 22:34.910 --> 22:39.750 But as you can see, these aren't actual people connected to those. 22:40.770 --> 22:48.030 It's a bunch of cell phones that are doing it with a scripted behavior that's connected to all of them. 22:51.270 --> 22:53.590 So troll farms and brigading. 22:53.610 --> 23:07.390 You can use bot farms, but you can also use sock puppets, which is a sort of new term, but Oxford researchers called fake armies of fake online influencers manufactured consensus. 23:07.690 --> 23:15.070 So that's when it looks like a ton of people agree or think one thing about something, but it's actually not a ton of people. 23:15.190 --> 23:19.510 It's a fake army of influencers. 23:19.690 --> 23:27.070 Troll farms usually refer to state-sponsored anonymous accounts for stock puppets or bots that engage in biased commentary. 23:27.070 --> 23:38.990 Brigading, that's when they can identify a target and gang up on them or that attempt to drown out online commentary by sheer volume through harassment or other methods. 23:39.110 --> 23:42.990 And brigading is an online harassment technique. 23:42.990 --> 23:44.510 There's a vote brigading as well. 23:44.510 --> 23:56.630 It's a massively coordinated online voting either with scores or approval ratings and it creates a false impression of approval where there maybe isn't such an impression. 23:57.230 --> 24:01.270 And there is often tied to what people call perception hacking. 24:01.270 --> 24:04.070 So there's astroturfing as well. 24:04.070 --> 24:10.370 This was a term coined in 1985 by Senator Lloyd Vincent of Texas and it occurs both online and offline. 24:10.370 --> 24:18.130 It's a political activity designed to appear as if it's unsolicited or autonomous political engagement. 24:18.130 --> 24:28.730 So people will be paid to express their opinions, paid to show up at a town hall, paid to create the impression of an organic grassroots effort when in fact it's not that. 24:28.930 --> 24:41.750 Several American corporations and political campaigns have engaged in astroturfing and it's often difficult from an intellectual, academic, or practical perspective to distinguish it from certain types of advertising. 24:42.510 --> 24:52.550 There is this concept called dark ads and what it is are precisely targeted ads that don't show up on a user's timeline or feed organically. 24:52.630 --> 24:55.010 Facebook invented them but all platforms use them. 24:55.010 --> 25:05.690 So following Cambridge Analytica and blowback from the platform's role in the Brexit campaign, Facebook and Twitter developed an ad transparency tool that allows all ads run on the platform to be visible. 25:05.770 --> 25:10.930 Targeted online advertising, algorithmic bias, and discrimination are highly problematic. 25:11.030 --> 25:12.970 And we have examples of these. 25:13.150 --> 25:16.150 They'll create a psychographic profile of someone. 25:16.150 --> 25:36.330 So if you see here in this slide, you can drill down the specific type of consumer that you want to advertise to or political participant that you want to target by saying a French and English speaking woman ages between the ages of 31 and 56 located in the 10 mile radius of Boston, 25:36.330 --> 25:40.850 Massachusetts who works either from home or from a small office in the retail production industry. 25:40.850 --> 25:45.550 I mean if you look through this, this drills down to their their fit moms and green moms. 25:45.550 --> 25:47.370 They have great grade school kids. 25:47.370 --> 25:51.410 They live in a condo down to the exact square feet of that condo. 25:51.410 --> 25:54.910 What they enjoy doing for their activities. 25:55.170 --> 26:01.870 And you can get even to the types of travel apps and specific types of travel that are on their phone and that they've used. 26:01.870 --> 26:11.550 And this is a level of specificity that a lot of consumers aren't aware is being used against them to target ads to them. 26:11.630 --> 26:14.810 There's this other concept of deep fakes, shallow fakes. 26:14.810 --> 26:19.310 So deep fakes use artificial intelligence or fake videos or photos of real people. 26:19.310 --> 26:22.090 And it often uses neural network AI. 26:22.090 --> 26:23.350 There's three types. 26:23.350 --> 26:24.890 There are three types. 26:24.890 --> 26:31.770 Generative, adversarial networks, GANs, autoencoders, and VAEs, variational autoencoders. 26:32.390 --> 26:38.530 Google's DeepMind showed that the VAE could outperform GANs on face generation. 26:38.530 --> 26:44.650 Variational autoencoders are capable of both compressing data like an auto encoder and synthesizing data like a GAN. 26:44.650 --> 26:52.190 However, GANs generate data in fine granular detail and images created by VAEs tend to be more blurred. 26:52.650 --> 26:57.830 Shallow fakes are doctored videos that are less dramatic like the speaker Pelosi video. 26:58.490 --> 27:13.670 And what researchers have been telling us is that a lot of the time what the hardest part about deep fakes actually often isn't the images but the voices and the sounds and getting those to mimic the actual intonations. 27:13.910 --> 27:15.770 Here's an example of a deep fake. 27:15.770 --> 27:20.170 At the beginning, before anything, you get together and you read through the script. 27:20.510 --> 27:27.210 And so it's like, you know, all these heavyweights like, you know, Ben Stiller, Jack Black, Robert Denny Jr. 27:27.210 --> 27:29.030 Everybody at the end is like me. 27:29.030 --> 27:32.410 You know, like, hey, happy to be here, guys. 27:34.010 --> 27:35.490 And some other supporting guys. 27:35.490 --> 27:42.070 And then Tom Cruise walks in and even those guys are like, whoa, and he's super stoked to be there. 27:42.110 --> 27:48.010 You know, he's like, yeah, oh, oh, you know, like, he's like, wow. 27:49.670 --> 27:55.010 He's immediately excited when he walks into a room. 27:55.010 --> 28:04.690 And so he comes over and he sits next to me and I think he had been briefed on some of the supporting guys, but he was like trying to place me, you know. 28:04.870 --> 28:06.090 So he sat down next to me. 28:06.090 --> 28:06.690 He's like, I 28:11.630 --> 28:12.950 love your work. 28:14.870 --> 28:16.370 And I went, oh, thanks. 28:16.370 --> 28:19.050 I love your work, too, Tom Cruise. 28:21.170 --> 28:28.310 So as you can see, it's a very impressive manipulation of that media. 28:28.710 --> 28:46.330 So some of the technical issues with addressing this information, as considered by Congress, are the identity validation piece, financial transactions, spoofing, VPNs, bot detection technologies, SAM detection, and sentiment analysis, network analysis, 28:46.330 --> 28:49.090 and behavior analysis. 28:49.730 --> 28:52.030 I'll just briefly... 28:52.030 --> 28:56.390 I think all of these involve constitutional rights. 28:56.390 --> 29:08.930 So identity validation, forcing individuals to validate their identity online, has a lot of benefits for a variety of groups, but also has a lot of problems for those who believe in the First Amendment right to anonymity online. 29:09.290 --> 29:17.730 Financial transactions are difficult because they're layered on many of these platforms, so it's not always clear who made the payments and where they came from. 29:18.250 --> 29:32.010 Another problem that members of Congress thought, well, if you just identify the individual where they are based , are they in the U.S., are they in the U.S., or are they in, you I've had a number of members say, like, if I'm in engaging with somebody, 29:32.010 --> 29:36.390 I want to know if I'm talking to an American or if I'm if I'm talking to a Russian operative. 29:36.490 --> 29:39.610 Well, the problem with that is that you can't always tell. 29:39.610 --> 29:44.770 There's spoofing, you can use VPNs, and people all over the world use these. 29:44.770 --> 29:47.290 Bot detection technologies have developed considerably. 29:47.290 --> 29:58.690 There is an enormous amount of, depending on how you define bot, but there there's an incredible amount of work that has been done in this space, and the techniques are very sophisticated, but at the same time, things get through. 29:59.110 --> 30:02.030 There's also spam detection and sentiment analysis. 30:02.030 --> 30:20.190 These also involve constitutional considerations given the privacy issues involved in sentiment analysis, and that's where certain types of language can be, and behavior online can be analyzed to assess whether or not you are positive towards something or negative. 30:20.190 --> 30:23.690 It works really well with some of the targeted advertising. 30:24.450 --> 30:38.530 Obviously, network and behavioral analysis, those are those are ways to look at the kind of broader infrastructure in which some of this activity is happening, and Congress does consider it when they're thinking about bills and ways to control some of this, 30:38.530 --> 30:43.530 some of the problems that are created by some of this behavior online. 30:44.250 --> 30:54.270 So there are a lot of First Amendment issues with addressing disinformationist content, and so I think going after the content on these platforms is never the right approach. 30:54.270 --> 31:00.350 Doing a content -neutral approach is always best, if possible, because of the First Amendment. 31:00.350 --> 31:10.670 So the First Amendment issues involved in regulating disinformation online include the right of the users, but also includes the right of the companies, and it protects, the First Amendment protects anonymity. 31:10.670 --> 31:12.370 It protects against compelled speech. 31:12.370 --> 31:14.590 The government can't make you say anything. 31:14.590 --> 31:27.010 So often, companies will fight disclosure laws that are often well-intended efforts at transparency, but because the government can't compel you to speak about something, they'll fight it. 31:27.010 --> 31:37.210 SCOTUS has historically allowed greater regulation of commercial speech, but since the 70s, it has been increasingly protective of commercial speech, which has been an interesting development. 31:37.430 --> 31:48.670 And SCOTUS, the Supreme Court of the United States, has sometimes upheld laws that regulate speech if it's part of a larger regulatory scheme focused on conduct, and only incidentally, verbal speech. 31:48.950 --> 31:57.610 It's also allowed regulation of speech in a commercial context if there's a reasonable government interest in compelling factual and uncontroversial information. 31:57.610 --> 32:04.250 So I say that addressing disinformation is a security rather than a content problem. 32:04.250 --> 32:11.630 So over the history of cybersecurity and infrastructure security, we've developed this perimeterless security. 32:11.630 --> 32:21.690 So organizations realize that traditional perimeters for information security, like firewalls, signature-based anti-malware, those approaches were becoming less effective, particularly as you have a more mobile workforce. 32:21.850 --> 32:28.330 So traditional cybersecurity defenses leave organizations vulnerable to what many call the Maginot Line problem . 32:28.430 --> 32:31.890 And the Maginot Line was a military work of genius. 32:31.890 --> 32:45.890 It was this wall that was supposed to surround France , and everyone thought it was impenetrable, but the bottom piece was supposed to be this forest that nobody could get through, but the Germans just went around the wall. 32:46.350 --> 32:58.970 And in many cases, organizations would design their cybersecurity infrastructure in such a way that they had, well, we have the best firewalls, we have the best security, and then an adversary would just go around it or move laterally within it. 32:59.650 --> 33:13.250 So I think that content and speech is a Maginot Line, that when we attack content or narrowly-scoped methods of deterrence without thinking about the infrastructure or the consequences, I think state actors can simply go around our defenses. 33:13.870 --> 33:24.930 And I also think it looks like when some of the legislation considered to address some of these problems can often look like the authoritarian laws we have seen in other parts of the world. 33:24.930 --> 33:26.830 And I'm going to briefly go over those. 33:27.870 --> 33:30.970 So global regulation of disinformation. 33:30.970 --> 33:34.990 There are 54 countries have introduced legislation to address disinformation online. 33:34.990 --> 33:39.950 16 of them have enacted or introduced some form of fake news or misinformation laws. 33:40.250 --> 33:53.890 France, Belarus, Bangladesh, China, Kenya, Burkina Faso, Malaysia, Cambodia, Vietnam, Thailand, Egypt, Germany, India, Myanmar, Singapore, and the United States. 33:54.210 --> 33:55.830 So France's... I'm going to go over just a few. 33:55.830 --> 33:57.470 I'm not going to make you go through all these countries. 33:57.470 --> 33:58.550 I'll just go through a few. 33:58.550 --> 34:07.470 But France's disinformation law emerged as a number of disinformation efforts were directed toward the French president. 34:07.470 --> 34:19.470 In 2018, they passed a law that provides a definition of fake news, which is inexact allegations or imputations for news that falsely reports facts with the aim of changing the sincerity of a vote. 34:19.470 --> 34:26.610 It's designed to enact strict rules on the media during electoral campaigns and more specifically in a three-month proceeding in the vote. 34:26.910 --> 34:31.470 They made changes to the draft law in July 2018 to account for satire. 34:31.470 --> 34:38.170 So as you can see, like, satire would have definitely fallen under some of those restrictions, so they had to make a change. 34:38.470 --> 34:48.290 The legislation gives authorities the power to remove fake content spread via social media and block the sites that publish it, as well as enforce more financial transparency for sponsored content. 34:48.330 --> 34:53.950 In the three months before the election period, it builds upon an 1881 law that outlines dissemination of false news. 34:53.950 --> 34:57.730 There's a long history of false news in the world, as well as disinformation. 34:58.690 --> 35:04.250 As you can see, it has three major provisions and it borrows from the Honest Ads Act, actually, of the United States. 35:04.250 --> 35:12.150 So what's also interesting is that a lot of legislatures around the world, whether they're democratic or not, will borrow from each other's legislation. 35:12.150 --> 35:21.290 And in this case, they use some provisions from the Honest Ad Act to apply existing standards for TV and radio and apply them to social media, which I actually think is a fantastic idea. 35:22.310 --> 35:29.730 It allows political candidates to sue for removal of contested material, but again, because it is a restriction on speech, it is hot... 35:29.730 --> 35:31.950 the whole bill is hotly contested. 35:31.950 --> 35:39.690 Singapore has an anti- misinformation law, and this one criminalizes the dissemination of false information online. 35:39.690 --> 35:45.510 It is one of the more comprehensive and aggressive pieces of legislation in the world. 35:45.550 --> 36:00.770 It passed 72 to 9 in Singapore's parliament, and it makes it illegal to spread false statements of fact in Singapore that compromise security, public tranquility, which I find particularly problematic, public safety, and the country's relations with other nations. 36:01.130 --> 36:07.190 It punishes people who post false information with heavy fines and even jail time. 36:07.550 --> 36:14.090 This law has been condemned by a number of human rights groups and publications for unduly limiting free speech. 36:14.090 --> 36:18.730 It lets the government demand publication of corrections alongside allegedly false claims. 36:18.890 --> 36:31.290 It also outlaws the spread of misinformation on private messaging apps and gives the government the power to remove false content that undermines public trust, so it increases surveillance tenfold, although it's obviously a surveillance state as it is. 36:31.350 --> 36:46.150 It is quite comprehensive, but what's also problematic is that I found in the law itself it utilizes terms that were published by the social media platforms, things like coordinated inauthentic behavior, CIB. 36:46.150 --> 36:48.710 That type of language originates with U.S. 36:48.710 --> 36:58.730 companies and then it's adopted by foreign states for their legislations to regulate behaviors in perhaps a way that maybe the social media companies weren't necessarily intending. 37:00.410 --> 37:01.170 The U.S. 37:01.170 --> 37:17.570 regulatory efforts on disinformation, because of all the constraints that I mentioned before, the complexity of the language issues, the different domains that they operate, there are a number of ways why it's been harder for the government to legislate on some of this activity. 37:17.570 --> 37:22.790 First of all, when it comes to social media companies, the government is... 37:24.190 --> 37:26.790 the social media companies are not the government. 37:26.870 --> 37:30.410 They're not violating the First Amendment by imposing restrictions on speech. 37:30.410 --> 37:37.270 It's when the government forces a social media company to impose those restrictions that there's a lot of legal problems that Dr. 37:37.270 --> 37:40.370 Matwishan could probably elaborate on much better than I could. 37:40.810 --> 37:45.210 Some of these provisions are the Countering Foreign Propaganda and Disinformation Act. 37:45.210 --> 37:51.710 That was included in the National Defense Authorization Act in 2017. 37:52.250 --> 37:53.010 The H.R. 37:53.970 --> 37:58.350 5910, Defend Against Russian Disinformation and Aggression Act. 37:58.410 --> 38:09.510 We have the Honest Ads Act, the Deepfake Report Act, the Malicious Deepfake Prohibition Act in 2018, and Defending each... this is a deepfake , so they turned it into an acronym, which is quite clever. 38:10.410 --> 38:20.830 Again, Congress wants to act on some of these bad behaviors that are having negative consequences, and they've been doing a lot more in the last few years. 38:20.830 --> 38:23.170 But again, it's quite complex. 38:23.430 --> 38:30.630 So this bill, Countering Foreign Propaganda in the NDAA, that was introduced by Senator Rob Portman and Senator Murphy. 38:30.630 --> 38:38.670 The bill created a grant program for NGOs, think tanks, civil society, and other active groups outside of government who are engaged in counter-propaganda-related work. 38:38.670 --> 38:47.490 I actually think we need to do... this great under the State Department, but I do think we need some form of a U .S. 38:47.490 --> 39:04.090 Information Agency, just to take a more holistic approach, so that it requires that all executive agencies, like the former Working Group, come together and consider solutions for this ecosystem in a coordinated manner. 39:06.630 --> 39:09.890 We had the Honest Ads Act, as I mentioned, adopted by France. 39:09.890 --> 39:15.290 It was introduced by Senator Klobuchar, Senator Lindsey Graham, and Senator Warner in 2018. 39:15.330 --> 39:18.990 And it helps prevent foreign interference in election advertising. 39:19.010 --> 39:28.070 And it amends the definition of electioneering communication in the Bipartisan Campaign Reform Act of 2002 to include paid internet and digital advertisements. 39:28.070 --> 39:34.270 A lot of these problems are a result of old legislation not being updated for new technologies. 39:34.270 --> 39:40.930 I encountered this early on in my career at a studio in Hollywood. 39:40.930 --> 39:47.450 They had a whole framework for television and music rights, but that was pre-digital. 39:47.450 --> 39:58.770 And when we had introduced streaming and downloading, all the licenses that applied to television shows, movies, their music that accompanied them, those were all completely outdated. 39:58.770 --> 40:05.310 So when we started analyzing that, and how do you... you can't go through and renegotiate every single license. 40:05.470 --> 40:24.750 Most of the studios in Hollywood, the one I worked at, but as well as many others, renegotiated those licenses based on a framework that looked at the new media technology landscape and said a download is equivalent to a VHS, for example, and streaming is equivalent to a broadcast license. 40:24.750 --> 40:30.030 So they were able to expedite some of the framework, expedite some of the licensing in that way. 40:30.030 --> 40:40.790 But I think a lot of legislation in Congress right now could be expedited if we simply updated some of the older legislation for a new technology environment. 40:40.790 --> 40:43.370 Because as you know, technology moves very, very quickly. 40:44.730 --> 40:47.110 So yeah, these are the other requirements. 40:47.170 --> 40:57.670 And it also, you know, required them to make every reasonable effort to ensure that foreign individuals and entities are not purchasing political advertisements in order to influence the American electorate. 40:57.670 --> 41:07.630 Seems like a small ask, but as again, the purchasing piece of this is quite difficult sometimes online, trying to validate who's buying what and how. 41:07.870 --> 41:20.010 The Deep Fakes Report Act was passed in the Senate by unanimous consent, which means that it was introduced and everyone, something that passes by unanimous consent, if no one objects, then it passes. 41:20.090 --> 41:30.670 And it was passed by Senator Portman, Schatz, Joni Ernst, Martin Heinrich, Senator Gardner, Senator Peters, Senator Rounds, and Senator Hassan. 41:30.670 --> 41:46.650 And that required the Department of Homeland Security to publish an annual report on the use of deepfake technologies that would be required to include an assessment of how both foreign governments and domestic groups are using deepfakes and digital forgeries to harm national security and mislead the American people. 41:46.650 --> 41:49.270 Now that's just a report, and Congress will do this a lot. 41:49.270 --> 41:56.590 They'll issue a... they'll pass something that requires an executive agency to create a report to help inform the public a little bit better. 42:00.590 --> 42:03.310 So this is the Malicious Deepfake Prohibition Act. 42:03.310 --> 42:12.450 It was introduced by Senator Ben Sasse in 2018, and it was supposed to create a new criminal offense related to the creation or distribution of fake electronic media records. 42:12.450 --> 42:34.370 It was criticized at the time for being sloppy and poorly thought through, but in fairness to them, you know, these are brand new concepts and ideas and, you know, there may be flaws, but the... but I do think that Congress just needs better resources to help them inform their decisions. 42:36.210 --> 42:42.890 There's the Defending Each and Every Person from False Appearances by Keeping Exploitation Subject to Accountability Act of 2019. 42:43.010 --> 42:52.930 This was... would require intentionally deceptive content creators to label videos with the digital watermark and written disclaimer informing its viewers that the content has been manipulated. 42:53.690 --> 43:02.470 That is... it does provide a legal course of action against content creators while also giving people who have been portrayed in deepfake videos a private right of action. 43:03.670 --> 43:09.330 Some of this was considered unenforceable, as we go into that. 43:09.450 --> 43:12.290 The Defend Against Russian Disinformation Aggression Act. 43:12.290 --> 43:24.110 This bill has included a package of bills in the House to secure America from Russian Interference Act of 2018, and it includes 17 bills to address subversive Russian activities. 43:24.130 --> 43:27.470 Congress... when people say Congress doesn't do anything, it's not entirely true. 43:27.470 --> 43:30.330 They wrote 17 bills to try to address the problem. 43:30.530 --> 43:43.390 It included legislation to codify the State Department Sanctions Office, and it required reporting on Putin's fake accounts and authorized... enhanced NATO cooperation, which is... I think allied cooperation is really important. 43:43.390 --> 43:46.250 The 2020 Technology Legislative Agenda. 43:46.250 --> 43:54.070 These are just some of the things that early in 2020 we identified as, you know, efforts that Congress would try to tackle. 43:54.070 --> 44:02.830 And this was before COVID, and, you know, another crisis had... a social justice crisis had emerged. 44:02.830 --> 44:10.390 So that includes trying to craft a federal data privacy framework, a greater shift toward consumer protection rather than disinformation protection. 44:12.170 --> 44:21.090 We... I suspected that House is still actively considering breaking up the... well, they are actively considering breaking up the big technology companies, and you may have seen the hearing more recently. 44:22.350 --> 44:25.690 We highlighted COPPRA, the Consumer Online Protection Act. 44:25.990 --> 44:35.870 Senator Cantwell torpedoed this a few times in 2018, but the sticking point remains that the private right of action for consumers if platforms misuse their data is a non-starter for Republicans. 44:36.130 --> 44:39.450 The House version of the Honest Ads Act will continue to be debated. 44:39.750 --> 44:46.670 Senator Warner introduced the Detour Act, the Access Act, and Josh Hawley... and with Josh Hawley, the Smart Act. 44:46.730 --> 44:51.290 The Detour Act is about dark patterns. 44:51.290 --> 44:56.770 That was to try to address manipulative design on websites. 44:56.770 --> 45:00.550 The Access Act was an interoperability bill. 45:00.550 --> 45:04.450 The senator wanted to make it easier to move your data from one platform to another. 45:04.450 --> 45:19.930 And I think we'll continue to see this movement toward the incremental breaking up of large tech companies and or antitrust reform, but I think the tone of the 2020 legislative agenda has shifted due to COVID and families trying to work from home and relying so heavily on technology. 45:19.930 --> 45:25.430 So I just want to ensure that that's probably going to continue to shape the public debate. 45:25.710 --> 45:28.510 And that is all I have. 45:30.890 --> 45:31.950 There we go. 45:31.950 --> 45:32.950 Thank you. 45:34.490 --> 45:39.330 Thank you so much, Liesl, for joining us today and for that amazing talk. 45:39.330 --> 45:43.210 And Q&A with you follows after this. 45:43.470 --> 45:44.750 Thanks so much.