1
00:00:00,000 --> 00:00:03,120
So let's officially start.

2
00:00:03,120 --> 00:00:11,300
And let me welcome you to the 2020 Ethics Village.

3
00:00:11,440 --> 00:00:14,540
It's always lovely to see you.

4
00:00:14,540 --> 00:00:20,980
Privacy and Civil Liberties Oversight Board Member, Travis LeBlanc, that's a mouthful.

5
00:00:21,820 --> 00:00:43,920
Given that we are, as everyone knows, we are all in the midst of a worldwide pandemic, we're doing this virtually this year, obviously would love to see you in person and be having this conversation live in Vegas, but we will make do with technology and see where we go.

6
00:00:44,560 --> 00:00:51,880
So let me give a brief introduction of who you are, and then we'll jump right into questions.

7
00:00:52,220 --> 00:01:16,100
So Travis LeBlanc is a board member of the Privacy and Civil Liberties Oversight Board, and before he was confirmed to what is known as the PCLOB, the acronym for the board, he was appointed by the US Department of Commerce and the European Commission to serve as an arbiter under the EU-US Privacy Shield Framework.

8
00:01:16,700 --> 00:01:33,800
Because the way that the PCLOB is set up, only the chair of the PCLOB is a full-time employee, so to speak, it means that everybody else generally has other full-time jobs, which you do.

9
00:01:33,800 --> 00:01:47,200
You're a partner at Cooley, where you're on the management team of Cooley's litigation department, and you've also served as vice chair of Cooley's cyber, data, and privacy practice.

10
00:01:47,220 --> 00:01:58,240
And Travis is a leading authority on cybersecurity, data privacy, telecommunications, and the regulation of emerging and disruptive technologies.

11
00:01:58,240 --> 00:02:22,400
Now, before all of that, Travis was chief of the FCC, Federal Communication Commission's Enforcement Bureau during the Obama administration, where he spearheaded hundreds of enforcement actions involving consumer issues such as false advertising and the Telephone Consumer Privacy Act,

12
00:02:22,400 --> 00:02:30,500
unfair competition, regulatory compliance, and fraud, waste, and abuse of government programs.

13
00:02:30,500 --> 00:02:54,290
And of note, especially for this conference, he brought the first data security action by the FCC, and he led enforcement actions resulting in fines together totaling over $100 million, which I think was a record for the FCC's Enforcement Bureau.

14
00:02:55,090 --> 00:03:09,120
And before all of that, Travis was a senior advisor to former California Attorney General Kamala D.

15
00:03:09,120 --> 00:03:29,540
Harris and a Special Assistant Attorney General of California, where he oversaw California's complex litigation and policy in areas such as technology regulation, high-tech crime, cybersecurity, privacy, intellectual property, antitrust, and telecommunications.

16
00:03:29,960 --> 00:03:49,600
Indeed, he created the Privacy Unit that is responsible for enforcement of California's Privacy Act and created California's E-Crime Unit, which has the primary mission of investigating and prosecuting multi-jurisdictional criminal organizations, networks,

17
00:03:49,600 --> 00:04:04,480
and groups that perpetrate identity theft crimes, use an electronic device or network to facilitate a crime or commit a crime targeting an electronic device, network, or intellectual property.

18
00:04:04,480 --> 00:04:11,980
And before all of that, he served during the Obama administration as an attorney advisor in the U.S.

19
00:04:11,980 --> 00:04:24,580
Department of Justice's Office of Legal Counsel, which advises the President, Attorney General, and executive branch agencies on the constitutionality and legality of the programs and activities of the U.S.

20
00:04:24,580 --> 00:04:25,280
government.

21
00:04:25,280 --> 00:04:27,080
So welcome.

22
00:04:28,220 --> 00:04:53,680
I'm first gonna focus a bit on your current role as a member of the Privacy and Civil Liberties Oversight Board and ask you, for those watching who may not be familiar with what the PCLOB is and does, whether, could you please give us a little background about the board and the projects that the board has been working on of late?

23
00:04:53,920 --> 00:04:58,760
Well, thank you, Stephanie, for that very kind introduction.

24
00:04:58,760 --> 00:05:05,540
I also want to thank the Ethics Village for having me join you all virtually this year at DEFCON.

25
00:05:05,540 --> 00:05:22,880
I was in Vegas last August and was around DEFCON as it was taking place and got to really see a lot of good friends who I will miss seeing, not being able to see, at least in person, this year.

26
00:05:23,120 --> 00:05:35,840
Listening to you talk about my background, Stephanie, you definitely made me feel like an old man because there are a lot of years that are there going back, but that's okay, that is A-okay.

27
00:05:36,280 --> 00:05:42,300
Maybe it's just that you've done so many things in a short period of time, one could look at it that way.

28
00:05:42,340 --> 00:05:44,160
That's where all my hair went.

29
00:05:44,160 --> 00:05:46,500
That's the explanation for it.

30
00:05:46,840 --> 00:05:53,160
Look, I'm thrilled to be here and to share with folks some of the work that we're doing at the PCLOB.

31
00:05:53,160 --> 00:06:00,340
The Privacy and Civil Liberties Oversight Board is an independent agency within the executive branch.

32
00:06:00,340 --> 00:06:11,500
It was created out of a recommendation from the 9-11 Commission, which, as you all probably may recall, one of the main challenges that the U.S.

33
00:06:11,500 --> 00:06:19,860
faced around 9-11 was the lack of intelligence sharing between the intelligence community and law enforcement.

34
00:06:20,180 --> 00:06:38,820
That resulted in a host of new authorities that built in a number of surveillance tools that could be used by the United States government to help prevent another terrorist attack in the future.

35
00:06:38,820 --> 00:06:46,380
Well, along with those surveillance authorities was a desire to ensure that the privacy and civil liberties of U.S.

36
00:06:46,380 --> 00:06:54,580
persons was being balanced against the use of those authorities to protect the nation from terrorism.

37
00:06:54,580 --> 00:07:03,860
The board is run by five members that are all appointed by the president and confirmed by the United States Senate.

38
00:07:03,860 --> 00:07:09,580
Three are always members of the party of the president.

39
00:07:09,580 --> 00:07:17,040
So currently the majority of the board, three members are Republicans, and then two are Democrats.

40
00:07:17,040 --> 00:07:21,380
I'm one of the Democratic members of the PCLOB.

41
00:07:21,980 --> 00:07:38,440
As Stephanie mentioned, the chairman is full-time, but the other four members are all part-time members, which means we balance our work at the board with employment outside of the government.

42
00:07:38,440 --> 00:07:46,820
In my instance, I'm a partner at a law firm, Cooley, and I have been on the board since last year.

43
00:07:46,820 --> 00:08:01,440
We are in the process of reviewing several projects, but our jurisdiction primarily extends to the programs and activities that are meant to protect the nation against terrorism.

44
00:08:01,800 --> 00:08:03,840
Much of the work that we do is classified.

45
00:08:03,840 --> 00:08:14,400
We all have security clearances at the highest level and are not prevented from gaining access to any information because it is classified.

46
00:08:14,400 --> 00:08:17,020
Our work generally breaks into two buckets.

47
00:08:17,020 --> 00:08:22,120
One bucket is advice, and the other bucket is oversight.

48
00:08:22,240 --> 00:08:44,980
With respect to advice, we are generally in the capacity of being asked by a component of the intelligence community about a program or activity that they are engaging in or are seeking to engage in about the extent to which the program could better protect or does protect privacy and civil liberties of U.S.

49
00:08:44,980 --> 00:08:45,860
persons.

50
00:08:45,860 --> 00:09:12,400
Those advice projects, we typically do not publicize in part because they're often classified, but also in part because we like to incentivize the intelligence community to seek out our counsel and have a little bit of independent advice being provided to them about ways that they can improve the privacy and civil liberties protections of the programs and activities of those components.

51
00:09:12,400 --> 00:09:15,080
The second bucket is our oversight project.

52
00:09:15,080 --> 00:09:29,020
And this is where we often will elect to look at particular programs or activities of the government, and decide which ones are worthy of having the PCLOB's independent oversight.

53
00:09:29,020 --> 00:09:48,060
We have several of those that are ongoing right now, but we've just recently finished up a review of the National Security Agency, the NSA's program to collect call detail records, which you may hear me refer to as CDRs.

54
00:09:48,060 --> 00:10:11,340
But essentially, the NSA, for many years, operated a program where it collected large scale metadata about telephone calls, primarily outside of the, made to numbers outside of the United States, but there were ways in which it could catch calls within the United States.

55
00:10:11,340 --> 00:10:21,760
We found in our report that this program was ineffective, that it was needlessly intrusive into the privacy and civil liberties of U.S.

56
00:10:21,760 --> 00:10:24,820
persons, and that it was extremely expensive.

57
00:10:24,820 --> 00:10:34,180
In the few years that it operated, since 2015, the program cost about $100 million.

58
00:10:34,700 --> 00:10:51,560
And for that $100 million, where they collected a very, very, very large number of details about telephone calls, the NSA produced 15 intelligence reports.

59
00:10:51,560 --> 00:11:01,060
Of those 15 intelligence reports, the Federal Bureau of Investigation, the FBI, concluded that only two had information the FBI was unaware of.

60
00:11:01,060 --> 00:11:07,640
So for years in collecting a massive number of calls by U.S.

61
00:11:07,640 --> 00:11:12,760
persons, there were only 15 reports that were generated from this.

62
00:11:12,760 --> 00:11:19,520
It was sort of shooting, you know, it was literally looking for a needle in a haystack to try and find something.

63
00:11:19,560 --> 00:11:35,260
There were also numerous compliance incidents and data integrity concerns with the program as well, so much so that a little over a year ago, the NSA decided on its own that it should shut the program down.

64
00:11:35,260 --> 00:11:46,960
And we certainly concurred in that decision and put out a report to improve transparency into how this program had operated.

65
00:11:46,960 --> 00:11:51,240
In my view, it was the digital equivalent of the bridge to nowhere.

66
00:11:51,300 --> 00:11:59,200
The NSA has deleted all of the records associated with it and the authority for the program has now expired.

67
00:11:59,460 --> 00:12:07,320
We're doing, in addition to the CDR project, we have several ongoing projects that we're working on right now.

68
00:12:07,660 --> 00:12:16,340
A few examples of those are, we're looking at the use of open source intelligence by the Federal Bureau of Investigation, right?

69
00:12:16,340 --> 00:12:27,940
Essentially gaining access to commercially available databases or how they might mine social media or other open source materials for investigatory purposes.

70
00:12:27,940 --> 00:12:40,860
We are looking at the terrorist watch lists that are out there and, you know, sort of standards around who gets on them, how you get on them, how you get off them, you know, what protections are in place to protect privacy and civil liberties.

71
00:12:40,860 --> 00:12:49,780
We're looking at a Department of Treasury program, the Terrorist Finance Tracking Program, as well to examine that.

72
00:12:49,780 --> 00:13:01,480
And then we are looking at a program operated by DHS, the Department of Homeland Security, looking at biometrics and the use of biometrics in airports.

73
00:13:01,480 --> 00:13:19,860
As many of you may be aware, the Department of Homeland Security uses a series of biometric collection tools in airports, you know, everything from fingerprints to facial recognition technology.

74
00:13:19,860 --> 00:13:39,900
Our project definitely has a huge focus on facial recognition technology and it's used by the Transportation Security Administration, by Customs and Border Protection, and by airlines and others to sort of examine right now what is mostly a pilot program,

75
00:13:39,900 --> 00:13:50,620
but that DHS certainly anticipates rolling out long-term at all entry and exit points in the United States going forward.

76
00:13:50,620 --> 00:13:55,120
So that, Stephanie, is, you know, that's a lot of information about some of the work that we're doing.

77
00:13:55,120 --> 00:14:03,060
I definitely did not share everything, but hopefully that answers the initial question.

78
00:14:03,060 --> 00:14:03,800
Absolutely.

79
00:14:03,800 --> 00:14:06,460
You've given a lot to talk about.

80
00:14:06,460 --> 00:14:13,620
And so let me just dig a little further into two specific things that you mentioned.

81
00:14:14,160 --> 00:14:32,540
The report that this PCLOB produced on the Called Detail Records Program, this, of course, isn't the first time the PCLOB, under different members, I should say, looked at the Called Detail Records Program.

82
00:14:32,920 --> 00:14:51,000
One of the things that caught my eye about the current board's evaluation of this program is you all were really able to shed light on the cost of this program versus the efficacy, the results.

83
00:14:51,000 --> 00:15:10,660
And I think you really illuminated for perhaps the federal government and certainly the public that, you know, one of the things that needs to be considered is whether we're really getting a bang for our buck with these kinds of programs.

84
00:15:10,820 --> 00:15:25,740
So were you surprised at how expensive this program was versus kind of the limited end product that it produced?

85
00:15:26,140 --> 00:15:28,880
Oh, I definitely was surprised about the disparity.

86
00:15:28,880 --> 00:15:36,200
I mean, when I saw 15 reports, and I know everything that had to go into operating this program, I knew it was extremely expensive.

87
00:15:36,200 --> 00:15:48,160
And, you know, as you may be aware, under the statutory authority that was available to the NSA, they had the ability to pay telecommunications carriers to actually participate in the program.

88
00:15:48,160 --> 00:15:53,540
And so, you know, that is an expensive endeavor as well that's involved.

89
00:15:53,540 --> 00:16:07,300
So it was very important to me that we understand the cost of the program, because as we are evaluating, you know, the impact on privacy and civil liberties, we ought to compare that to the effectiveness of the program and also the cost of the program.

90
00:16:07,300 --> 00:16:25,500
You know, a billion dollars to intrude into people's privacy and civil liberties and get almost nothing from it is, you know, is not really worth, you know, the program in terms of advising Congress, you know, about whether or not the program should be extended or advising the executive branch about whether or not it should be ended.

91
00:16:25,500 --> 00:16:41,540
So I do believe that it is critical that we have an understanding of just how much these programs cost so that we can really weigh the benefit of the programs against the expenses to not only the privacy and civil liberties, but also to the public fisc.

92
00:16:42,280 --> 00:16:48,400
So in agreeing with you on that point, I should have said at the beginning that my name is Stephanie Pell.

93
00:16:48,400 --> 00:17:05,140
I'm a professor at West Point, but anything that comes out of my mouth, although this interview is about your views, but anything that happens to come out of my mouth are my views and do not represent the views of the Army, West Point, or the federal government at large.

94
00:17:05,140 --> 00:17:08,300
So anyway, but I agree with you.

95
00:17:09,360 --> 00:17:23,080
So moving on, you mentioned an ongoing project where the P-CLOB is looking at DHS's use of biometric technologies in airports.

96
00:17:23,080 --> 00:17:55,140
I'd like to broaden the biometric technology discussion a little further with you and just recall the story that many of us have read in the Washington Post about a man named Robert Williams, who is an African-American man who was arrested at his home in front of his children and held for a night in jail due to a misidentification based on a facial recognition algorithm.

97
00:17:55,140 --> 00:18:05,820
So in other words, he was arrested based on this misidentification for a crime he did not commit and was held in jail overnight.

98
00:18:06,540 --> 00:18:25,940
And I would say that unfortunately, as horrible as this was, we shouldn't be terribly surprised as we've known for some time that facial recognition technologies disproportionately misidentify people of color and women.

99
00:18:26,080 --> 00:18:40,100
So how would you address the disparate impact that facial recognition technologies have on communities of color and more broadly, what concerns do you have about how the U.S.

100
00:18:40,100 --> 00:18:46,200
government collects and uses information produced by biometric technologies?

101
00:18:46,960 --> 00:18:58,560
We all know and have known for a very long time that facial recognition technology has a propensity to misidentify people of color and women.

102
00:18:58,560 --> 00:19:01,300
There are numerous studies on this.

103
00:19:01,300 --> 00:19:19,560
In 2018, the MIT Media Lab produced a study that found that there was an inability of facial recognition algorithms to identify or misidentify people of color.

104
00:19:19,560 --> 00:19:39,860
Last year, the NIST, which is a federal government agency, put out a report looking at 200 facial recognition algorithms and finding evidence of bias along issues of skin color.

105
00:19:41,300 --> 00:19:53,620
There was bound to be a time, if not many times that have happened, but one that we now know of, where a person of color would be misidentified by a facial recognition algorithm.

106
00:19:53,620 --> 00:19:56,000
I refer to these as race breaches.

107
00:19:56,000 --> 00:20:02,440
This is essentially a breach that is taking place in the algorithm.

108
00:20:02,740 --> 00:20:27,900
I think that going forward, if the government is going to rely upon facial recognition technology, it has a responsibility, a duty, to ensure that people of color, women, are not disproportionately misidentified or adversely impacted by these particular technologies.

109
00:20:28,220 --> 00:20:50,700
Part of that is by making sure that before any facial recognition technology is deployed, that the government or any public authority has given a real strong consideration to the impact that this particular algorithm will have in this particular use case on communities of color.

110
00:20:50,700 --> 00:21:12,840
That means really beginning to think about not just does this particular program impact privacy and civil liberties, but recognizing when that impact disproportionately impacts a particular community and ensuring that the government is taking mitigating steps or taking any steps to remediate that disproportionate impact.

111
00:21:12,840 --> 00:21:24,020
It's about making sure that when we are thinking about the deployment of a technology like a facial recognition technology, that we're thinking about equality.

112
00:21:24,040 --> 00:21:37,220
And that from the beginning, we are building in place protections that are designed to ensure that these programs do not operate in a manner that disproportionately impacts people of color.

113
00:21:37,220 --> 00:21:39,200
I call this equality by design.

114
00:21:39,200 --> 00:21:42,280
Many people may be familiar with the concept of privacy by design.

115
00:21:42,280 --> 00:21:51,780
That is building privacy into a new product so that it respects it from the beginning and doesn't collect any more information, for example, than it needs to.

116
00:21:51,780 --> 00:21:54,380
Well, we ought to do the same thing around civil rights concerns.

117
00:21:54,380 --> 00:22:05,560
We ought to build equality into the very design of the product from the beginning so that ultimately it minimizes any impact that it's going to have on communities.

118
00:22:05,560 --> 00:22:13,480
I don't know that at the end of the day that's ultimately going to solve the problem with bias in facial recognition algorithms.

119
00:22:13,480 --> 00:22:27,800
We've seen a number of corporations over the last two months begin to pull away from their facial recognition products that were being sold or marketed to law enforcement.

120
00:22:27,800 --> 00:22:31,120
IBM, for example, has stepped back from it.

121
00:22:31,120 --> 00:22:35,680
As have Microsoft and Amazon, all making announcements.

122
00:22:35,680 --> 00:22:43,960
And we've seen several cities now and states begin to look at whether to ban facial recognition technology and its use by law enforcement.

123
00:22:43,960 --> 00:22:45,180
San Francisco's done it.

124
00:22:45,180 --> 00:22:46,460
Boston has done it.

125
00:22:46,460 --> 00:22:54,440
In fact, the Massachusetts legislature, it looks prime to ban it in the state for use by law enforcement.

126
00:22:54,440 --> 00:23:12,580
And I think there's no doubt that one of the primary factors that are motivating these companies as well as these governments to limit the use of facial recognition technology is they haven't often gotten the issue of bias along racial lines correct.

127
00:23:12,580 --> 00:23:37,900
And as long as that's there, we have to be mindful about rolling this technology out so that we don't end up in a world where we now have digital biometric technologies that essentially are discriminating against people of color in the same way that so many people of color have experienced for decades or centuries in this country.

128
00:23:37,900 --> 00:23:54,020
We don't want a world where one segment typically has to go through a secondary inspection or additional questions or is presumed guilty just by their image.

129
00:23:54,020 --> 00:23:56,620
That is the world that we're trying to avoid right now.

130
00:23:56,620 --> 00:24:11,980
And the last thing we want to do is hard-code that into the 21st century by beginning to deploy new technologies for the government to use that could ultimately disproportionately impact and be adverse to people of color.

131
00:24:11,980 --> 00:24:46,240
So you are really calling for, it's not a new discussion, but broadening the discussion, not just about privacy by design and looking at the privacy impacts of government use of certain technologies, but a specific focus on how the use of those technologies could have a disparate impact on marginalized or communities of color.

132
00:24:46,240 --> 00:24:56,120
Because if not, we risk using technology to further facilitate racism at scale.

133
00:24:56,620 --> 00:24:57,780
That's exactly right.

134
00:24:57,780 --> 00:25:00,600
These algorithms are created by humans.

135
00:25:00,600 --> 00:25:06,620
These humans may have biases or the way that the algorithm is trained could be biased.

136
00:25:06,620 --> 00:25:08,400
Those are easy examples.

137
00:25:08,400 --> 00:25:19,300
But what I am saying is we shouldn't just think about the impact of a program on this amorphous concept of privacy that really focuses on the privacy of the majority.

138
00:25:19,300 --> 00:25:37,440
When there is a disproportionate impact on vulnerable communities or disproportionate impact on historically disenfranchised or disadvantaged communities, we ought to be looking at that program and scrutinizing it even more.

139
00:25:37,440 --> 00:25:39,280
And I think that's what's missing right now.

140
00:25:39,280 --> 00:25:43,420
What's missing right now is we often just think about privacy writ large.

141
00:25:43,420 --> 00:25:50,900
We don't actually think about how the privacy of the minority is being disparaged by a particular program.

142
00:25:50,900 --> 00:26:05,840
The last thing we want to do is have a world where the privacy and civil liberties of the majority is protected while the privacy and civil liberties of the minority is disregarded or otherwise disproportionately impacted.

143
00:26:05,840 --> 00:26:09,660
We don't want privacy to be a luxury good to anyone.

144
00:26:09,980 --> 00:26:10,840
Right.

145
00:26:11,120 --> 00:26:17,000
And it, you know, at times it's had a tendency to be that way, unfortunately.

146
00:26:17,520 --> 00:26:36,060
So I'd like to now talk with you about a letter you wrote, I believe last month, because we're still in July, to the acting secretary of DHS in your official capacity as a PCLA board member.

147
00:26:36,060 --> 00:26:56,700
And you wrote to express your concerns and to raise questions about a DHS program requiring all air travelers to submit to mandatory DHS-administered temperature checks or thermal imaging before boarding a commercial airline.

148
00:26:56,940 --> 00:27:04,720
What were some of the concerns that you expressed in your letter to the acting secretary of DHS?

149
00:27:04,720 --> 00:27:06,900
And have you received a response?

150
00:27:06,900 --> 00:27:16,040
And my understanding also is that some members of Congress have now taken up this cause and concern with you.

151
00:27:16,260 --> 00:27:19,360
Yeah, I have several concerns about this program.

152
00:27:19,360 --> 00:27:30,840
The plan, as I understand it, is for the TSA to administer temperature checks at security checkpoints in airports.

153
00:27:30,840 --> 00:27:45,780
My understanding is that this has been requested by various airlines, in part because they don't want to administer them and because they don't want to pay for the temperature checks that would be administered.

154
00:27:45,780 --> 00:28:01,100
I have strong concerns about the efficacy of temperature checks or fever checks at detecting whether someone is infected with COVID-19.

155
00:28:01,100 --> 00:28:06,600
As you may know, there are many reasons why someone would have a fever.

156
00:28:06,600 --> 00:28:16,740
COVID-19 is one reason, but there are a host of other reasons that range from an illness to a condition, you know, a heart condition, for example.

157
00:28:16,740 --> 00:28:27,580
Or maybe the person had just been running through the airport to get from the check-in desk to their flight because they're late.

158
00:28:27,580 --> 00:28:44,000
I'm also equally concerned that if someone wanted to suppress their temperature or their fever, that that's also easy to do by taking aspirin or ibuprofen, for example, or just putting a little ice on your head for a little while before you walk up to the checkpoint.

159
00:28:44,000 --> 00:28:54,420
Thirdly, it's not apparent to me that TSA agents are trained in asking questions or administering public health examinations.

160
00:28:54,420 --> 00:28:58,640
And so, you know, it's not...

161
00:28:58,640 --> 00:29:11,280
I have no idea how TSA would plan to train these agents, whose mission is supposed to be the security of air travel, not necessarily the public health of air travel.

162
00:29:11,280 --> 00:29:16,780
I'm not saying that, you know, there aren't public health experts in the government that do have the training to do this.

163
00:29:16,780 --> 00:29:20,860
Namely, you know, the Center for Disease Control, the CDC, would have this expertise.

164
00:29:20,860 --> 00:29:30,500
But the CDC has already publicly stated, or at least, you know, information has been made publicly available, that they don't want to participate in this program because it's not effective.

165
00:29:30,500 --> 00:29:32,820
So there are concerns about efficacy.

166
00:29:32,860 --> 00:29:37,500
There are concerns about, you know, the authority that TSA has to administer this program.

167
00:29:37,500 --> 00:29:41,840
And there are also concerns about the government's collection of this information.

168
00:29:41,840 --> 00:29:43,120
What are they collecting?

169
00:29:43,120 --> 00:29:45,880
What are they going to do with this information?

170
00:29:45,880 --> 00:29:48,160
What database is it going to go into?

171
00:29:48,160 --> 00:29:50,440
And how is this going to impact travel?

172
00:29:50,440 --> 00:29:54,820
Are they going to ban individuals, passengers, from traveling for 14 days?

173
00:29:54,820 --> 00:29:58,740
Are they going to create a no-fly list or add you to the no-fly list?

174
00:29:58,740 --> 00:30:08,660
What happens if you come with a doctor's note that actually says, I just got tested yesterday and I don't have COVID-19 even though I have a fever?

175
00:30:08,660 --> 00:30:15,460
Or, more importantly, you know, who's going to reimburse the individual for the plane ticket that they won't be able to take?

176
00:30:15,460 --> 00:30:18,160
Are they going to be guaranteed refunds by TSA?

177
00:30:18,160 --> 00:30:20,640
Are they going to be guaranteed a seat in 14 days?

178
00:30:20,640 --> 00:30:22,820
What if they're going for their cancer treatment?

179
00:30:22,820 --> 00:30:27,580
Are they going to be denied access to the right to travel to their doctor?

180
00:30:27,760 --> 00:30:33,020
Or are they going to be, you know, told to just go home and stay at home and wait?

181
00:30:33,020 --> 00:30:43,500
It just seems that there are so many questions that not only haven't been answered about what they're collecting and what they're doing with this, but also the impacts and how this is going to impact the traveling public.

182
00:30:43,500 --> 00:30:50,180
I also have concerns about the disproportionate impact that this program may have on people of color.

183
00:30:51,160 --> 00:30:59,300
CDC has put out several reports on how COVID-19 is disproportionately impacting people of color.

184
00:30:59,540 --> 00:31:05,640
African Americans are more likely to die from COVID-19 than are other groups.

185
00:31:05,640 --> 00:31:14,140
African Americans and Latinos are more likely to be hospitalized and Native Americans are more likely to be hospitalized than other groups.

186
00:31:14,140 --> 00:31:32,460
If we assume that COVID-19 disproportionately impacts people of color, then we should assume that a program that is designed to root out COVID-19 is going to ultimately end up disproportionately impacting people of color.

187
00:31:32,460 --> 00:31:53,380
And it is extremely troubling to me that the right to travel and travel by air when in many instances there isn't an adequate substitute that would be available to those folks, that they would somehow be denied the right to travel and that could impact your job,

188
00:31:53,380 --> 00:32:02,560
it could impact your health, it could impact your family or personal situation in ways that are, I think, potentially deeply troubling.

189
00:32:02,560 --> 00:32:07,360
And so I'm hopeful that DHS will rethink this program.

190
00:32:07,360 --> 00:32:18,520
Several members of Congress are also on both sides of the aisle, Republicans and Democrats, seem to be concerned not only about the efficacy but the impact on privacy and civil liberties of this program.

191
00:32:18,520 --> 00:32:28,060
And hopefully TSA and DHS will come to its senses and realize that it shouldn't be in the business of administering temperature checks in airports.

192
00:32:28,060 --> 00:32:54,460
And if they do want to actually increase the actual safety of air travel with respect to COVID-19, there are other measures that numerous experts have reported on that airlines, for example, could take to better secure air travel and to better ensure that it's a healthy experience for all passengers.

193
00:32:55,640 --> 00:33:02,880
Well, I look forward to what, if any, responses are forthcoming.

194
00:33:04,520 --> 00:33:14,060
So, as you mentioned before, the PCLOB had broad discretion and authority to conduct oversight and provide advice to the U.S.

195
00:33:14,060 --> 00:33:30,640
government with respect to the implementation of executive branch policies, procedures, regulations, and information-sharing practices relating to efforts to protect the nation from terrorism in order to ensure that privacy and civil liberties are protected.

196
00:33:30,640 --> 00:33:39,060
So, this authority therefore covers the activities of both law enforcement and intelligence agencies.

197
00:33:39,100 --> 00:33:55,740
And given the scope of the board's discretion within the context of terrorism programs, if you alone could determine the priorities for the PCLOB, what projects would you add to its current slate?

198
00:33:56,260 --> 00:33:58,140
That's a very good question.

199
00:33:58,660 --> 00:33:59,940
There are many.

200
00:33:59,940 --> 00:34:20,000
I think there are so many issues within our jurisdiction for us to look at that, you know, the challenge we really do face is balancing the limited resources we have with the projects that really do stand to benefit from oversight by the PCLOB.

201
00:34:20,000 --> 00:34:25,370
Among the topics that I would prioritize would be stingrays.

202
00:34:25,420 --> 00:34:50,480
Many folks may be aware of the existence of a cell site simulator technology that would allow someone to intercept telephone calls as well as text messages if they, you know, run a stingray near your location.

203
00:34:50,480 --> 00:35:01,740
I think it's important for us to examine the use of stingrays by the intelligence community and the efforts to protect the nation against terrorism.

204
00:35:01,740 --> 00:35:10,120
I'd also think that there'd be some value in the PCLOB looking at when components of the U.S.

205
00:35:10,120 --> 00:35:26,720
government decide to use hacking tools and beginning to think about what standards are around those, who they can be used against, what approvals need to be put in place, how they can be secured to ensure that they don't get into the hands of an adversary,

206
00:35:26,720 --> 00:35:31,800
which unfortunately we've seen happen more than once.

207
00:35:32,400 --> 00:35:38,220
Thirdly, I'd want to look at a full review of the Foreign Intelligence Surveillance Act, FISA.

208
00:35:38,220 --> 00:35:43,580
I think there are a lot of issues there that we could explore.

209
00:35:43,580 --> 00:36:03,080
Everything from the use of foreign intelligence surveillance information in criminal prosecutions to the approvals for those authorities by courts, whether intelligence courts or traditional Article III federal courts, your normal U.S.

210
00:36:03,080 --> 00:36:11,240
District Court, to looking at the amicus program that operates under FISA.

211
00:36:11,240 --> 00:36:18,160
But I think there's just a lot of work around FISA for the board to do, and that itself could be full-time.

212
00:36:18,160 --> 00:36:21,640
I'd also want to look at domestic terrorism issues.

213
00:36:21,640 --> 00:36:30,460
Typically, the board in the past has spent almost all of its energy focused, if not all of it, focused on foreign terrorism, yet we know that the number one threat to U.S.

214
00:36:30,460 --> 00:36:32,280
persons is actually domestic terrorism.

215
00:36:32,280 --> 00:36:34,740
This has been the case for centuries.

216
00:36:34,740 --> 00:36:40,160
This isn't a new evolution, and in fact, every year it's a greater threat.

217
00:36:40,160 --> 00:36:49,060
But we don't spend a lot of time really looking at the privacy and civil liberties impacts around the domestic terrorism.

218
00:36:49,060 --> 00:37:05,200
And then, I think probably finally, I'd want to look at the sharing of national security information with non-national security agencies, such as immigration and customs enforcement.

219
00:37:05,840 --> 00:37:14,620
Really beginning to think about the extent to which national security authorities are being used for non-national security purposes.

220
00:37:14,620 --> 00:37:29,660
And I think that's an important task for us to take because more and more government databases are being created that are intended to integrate consolidate information from a lot of sources, and once they're in there, they're very hard to get out.

221
00:37:29,660 --> 00:37:32,060
It's sticky data once it's in there.

222
00:37:32,060 --> 00:37:40,000
So I think it's important for us to get a greater understanding of a lot of these intelligence-sharing authorities and tools that are being used.

223
00:37:40,120 --> 00:37:49,320
Well, that is certainly a worthwhile and very expansive list of projects.

224
00:37:49,320 --> 00:37:57,680
I will just take moderator's privilege and say perhaps that is an argument for more resources for the Privacy and Civil Liberties Oversight Board.

225
00:37:58,760 --> 00:38:20,880
So, I'll piggyback that comment to the next question and say given the Privacy and Civil Liberties concerns that spring from law enforcement use of new and emerging technologies, you've talked about a number of examples, facial recognition, other biometric technologies,

226
00:38:20,880 --> 00:38:41,560
big data analytics, you mentioned stingrays in a counterterrorism or terrorism-focused context, but could you see an important role for the PCOB to play beyond the specific frame of privacy and civil liberties in the context of protecting our nation from terrorism?

227
00:38:41,560 --> 00:38:59,420
And I guess what I'm asking is, should Congress expand the PCOB's jurisdiction to oversee and address privacy and civil liberties concerns beyond that reach beyond the nation's counterterrorism efforts?

228
00:38:59,740 --> 00:39:08,980
Well, look, far be it for me to decide for Congress what the jurisdiction of our agency should be.

229
00:39:08,980 --> 00:39:16,140
You know, that's a question for Congress and , you know, they regularly consider it.

230
00:39:16,160 --> 00:39:30,640
In my view, privacy and civil liberties concerns have only increased over the last decade or two decades.

231
00:39:30,640 --> 00:39:46,820
And those concerns about government or even corporate surveillance are such that there needs to be some agency that is looking into those issues.

232
00:39:46,820 --> 00:39:55,560
One easy example of that is, you know, everything that's happening right now in COVID-19 and the pandemic.

233
00:39:55,560 --> 00:40:27,060
You know, we have a lot of debate right now about contact tracing and a lot of debate about what authorities are needed for public health agencies to collect data about each of us not only to help find a vaccine but also to be able to go back and contact individuals that someone who's infected may have been in touch with the prior 14 days.

234
00:40:27,060 --> 00:40:35,840
There are a lot of expansive authorities that are being used by government agencies because we are in a pandemic.

235
00:40:35,840 --> 00:40:38,040
Quarantine, for example.

236
00:40:38,040 --> 00:40:42,180
You know, I mean, imagine the impact of a quarantine on privacy and civil liberties.

237
00:40:42,180 --> 00:40:53,600
Yet we don't actually have an agency in the federal government that's tasked with looking at the privacy and civil liberties impacts of all the activities around the pandemic.

238
00:40:53,600 --> 00:40:57,500
What agency is going to look at that, for example?

239
00:40:57,500 --> 00:41:13,080
And we don't have agencies that are devoted towards looking at the privacy, independently looking at the privacy and civil liberties impacts of the general activities of the Federal Bureau of Investigation for example.

240
00:41:13,080 --> 00:41:18,320
So at least in my view, I think it's high time for the United States to have two things.

241
00:41:18,320 --> 00:41:24,040
One is you know, a basic federal privacy legislation.

242
00:41:24,040 --> 00:41:24,700
We need it.

243
00:41:24,700 --> 00:41:38,640
And number two is, you know, an agency or more, or two you know, choose the number of agencies that are committed to the task of protecting the privacy and civil liberties of the U.S.

244
00:41:38,640 --> 00:41:39,100
public.

245
00:41:39,100 --> 00:41:43,460
And that may be in the corporate, but it also, frankly should be in government.

246
00:41:43,460 --> 00:41:54,300
And making sure that there is some independent check out there on the expansive use of surveillance authorities, whether or not they involve terrorism.

247
00:41:57,000 --> 00:42:10,160
So switching gears a bit, as we mentioned at the beginning, in addition to your role as a PCAW board member, you're a partner at the Cooley Law Firm with very interesting privacy and cyber security practice.

248
00:42:10,160 --> 00:42:23,380
And of course, as a practicing lawyer, everything you do in that role is not public and in addition, due to obligations to your clients, there are limitations on what you can discuss publicly.

249
00:42:23,380 --> 00:42:35,220
However, there are two interesting cases involving the Computer Fraud and Abuse Act that you've been litigating, that have received some press coverage.

250
00:42:35,220 --> 00:42:40,580
And to my knowledge, these are the first two cases of their kind.

251
00:42:40,580 --> 00:42:47,040
So the first case that I'm going to refer to is the Broidy case, where on behalf of Mr.

252
00:42:47,040 --> 00:42:55,260
Broidy, you sued the country of Qatar and a number of individuals for their role in hacking and leaking Mr.

253
00:42:55,260 --> 00:42:56,620
Broidy's email.

254
00:42:56,620 --> 00:43:21,280
And as one news outlet reported, quote, this is a case about a hostile intelligence operation undertaken by a foreign nation against American citizens who have spoken out against that country's support for terrorism and who have entered into significant business relationships relating to defense and counterterrorism with a rival nation.

255
00:43:21,280 --> 00:43:45,800
The other case involves a lawsuit by WhatsApp against the NSO group, an Israeli-based spyware firm, alleging that NSO's Pegasus spyware was, among other things, used to hack phone systems of 1,400 users between April 2019 and May 2019.

256
00:43:45,800 --> 00:44:05,600
There are very interesting aspects of both of these cases, but let me ask you, because these cases illustrate how foreign governments are increasingly attacking individuals hacking their phone networks.

257
00:44:05,600 --> 00:44:08,940
What do you think we should do about this problem?

258
00:44:09,820 --> 00:44:17,300
There is no doubt that numerous nation states are targeting U.S.

259
00:44:17,300 --> 00:44:25,100
persons and corporations in hacking campaigns.

260
00:44:25,680 --> 00:44:39,240
Not only are they you know, sometimes they are doing this to gain access to embarrassing information about an individual and then to release it.

261
00:44:39,240 --> 00:44:52,820
Other times, they are using it to gain access to the intellectual property of a company which they will exploit, either by giving it to a competitor or releasing it.

262
00:44:52,820 --> 00:45:00,500
Other times, they are gaining it to... seeking access to engage in a disinformation campaign.

263
00:45:00,520 --> 00:45:22,780
All the while, no matter how much a company or individual invests in cyber security protections and safeguards, many of these nation states have almost unlimited resources and ability to continue to target that entity .

264
00:45:22,980 --> 00:45:30,740
Even when you have the best security, they are likely at some point to find a way in.

265
00:45:30,740 --> 00:45:35,100
And that way in may not be through the CEO.

266
00:45:35,120 --> 00:45:46,540
That way in may be through the CEO's executive assistant or the CISO's spouse may be a way in there.

267
00:45:46,540 --> 00:45:54,620
These are sophisticated campaigns that are being engaged in against Americans.

268
00:45:54,620 --> 00:46:03,280
And when these are brought to the attention of law enforcement, they're limited in what they can do.

269
00:46:03,280 --> 00:46:09,480
Yes, it's possible to indict a Chinese person or two or three.

270
00:46:09,480 --> 00:46:13,580
And someday those people may be brought to justice.

271
00:46:13,580 --> 00:46:25,820
But today, that's not going to stop that company that's been impacted by this from having a lot of trouble as a result of the hack.

272
00:46:25,820 --> 00:46:40,960
And unfortunately, litigation too has its limitations due to a law called the Foreign Sovereign Immunity Act.

273
00:46:40,960 --> 00:46:56,520
The acronyms are all the same, the Foreign Sovereign Immunity Act, which essentially gives any foreign government immunity from litigation in the United States with a couple of exceptions.

274
00:46:56,520 --> 00:47:14,100
It is now time for the United States to really rethink the Foreign Sovereign Immunity Act and to rethink the extent to which it ought to be used as a defense by foreign nation states that hack U.S.

275
00:47:14,100 --> 00:47:16,140
civilians and U.S.

276
00:47:16,140 --> 00:47:17,040
corporations.

277
00:47:17,260 --> 00:47:25,600
And unless the government really steps up to protect us, we are all limited in our ability to do that.

278
00:47:25,600 --> 00:47:33,920
There has been some legislative movement on the Hill looking at this particular issue in Washington, D.C.

279
00:47:33,920 --> 00:47:41,820
I'm hopeful that Congress will be able to address this issue because it's not just that the privacy of U.S.

280
00:47:41,820 --> 00:47:56,800
persons is being put in jeopardy, but there are hundreds of millions, if not billions of dollars that are also being put in jeopardy as a result of the ability of foreign nation states, rogue nations, as well to target U.S.

281
00:47:56,800 --> 00:48:00,140
persons and companies for cyber attacks.

282
00:48:03,140 --> 00:48:25,400
This is a complicated problem to solve and I imagine in addition to what you have mentioned, we're going to have to consider how this reflects of course on U.S.

283
00:48:25,400 --> 00:48:39,200
policy as well and how we engage and use our capabilities with respect to other people in other foreign nations.

284
00:48:39,200 --> 00:48:55,220
So I will not elaborate beyond that, but I want to very much thank you for your time and giving us some deeper insight into the work of the Privacy and Civil Liberties Oversight Board.

285
00:48:55,280 --> 00:49:01,020
Hope to continue this conversation with you in person, maybe in Vegas next year.

286
00:49:01,380 --> 00:49:03,300
Thank you so much, Stephanie.

287
00:49:03,300 --> 00:49:05,140
It was great to see you.

288
00:49:05,140 --> 00:49:10,900
A wonderful conversation and I too hope we can continue this conversation next year in Vegas.

289
00:49:10,900 --> 00:49:12,840
Take care.