start	end	text
0	3120	So let's officially start.
3120	11300	And let me welcome you to the 2020 Ethics Village.
11440	14540	It's always lovely to see you.
14540	17660	Privacy and Civil Liberties Oversight Board Member,
17660	20980	Travis LeBlanc, that's a mouthful.
21820	25260	Given that we are, as everyone knows,
25260	29200	we are all in the midst of a worldwide pandemic,
29200	31540	we're doing this virtually this year,
31540	34400	obviously would love to see you in person
34400	38100	and be having this conversation live in Vegas,
38100	43920	but we will make do with technology and see where we go.
44560	47920	So let me give a brief introduction of who you are,
47920	51880	and then we'll jump right into questions.
52220	55420	So Travis LeBlanc is a board member
55420	58780	of the Privacy and Civil Liberties Oversight Board,
58780	63660	and before he was confirmed to what is known as the PCLOB,
63660	65460	the acronym for the board,
65960	68780	he was appointed by the US Department of Commerce
68780	71660	and the European Commission to serve as an arbiter
71660	76100	under the EU-US Privacy Shield Framework.
76700	80420	Because the way that the PCLOB is set up,
80420	83200	only the chair of the PCLOB
83200	87080	is a full-time employee, so to speak,
87080	88640	it means that everybody else
89440	93800	generally has other full-time jobs, which you do.
93800	95820	You're a partner at Cooley,
95820	97560	where you're on the management team
97560	100260	of Cooley's litigation department,
100260	102760	and you've also served as vice chair
102760	107200	of Cooley's cyber, data, and privacy practice.
107220	110860	And Travis is a leading authority on cybersecurity,
110860	113300	data privacy, telecommunications,
113300	118240	and the regulation of emerging and disruptive technologies.
118240	120760	Now, before all of that,
121560	125300	Travis was chief of the FCC,
125300	129040	Federal Communication Commission's Enforcement Bureau
129040	131320	during the Obama administration,
131320	135080	where he spearheaded hundreds of enforcement actions
135080	138440	involving consumer issues such as false advertising
138440	142400	and the Telephone Consumer Privacy Act,
142400	145520	unfair competition, regulatory compliance,
145520	150500	and fraud, waste, and abuse of government programs.
150500	155480	And of note, especially for this conference,
155480	160720	he brought the first data security action by the FCC,
160720	164920	and he led enforcement actions resulting in fines
164920	169060	together totaling over $100 million,
169060	174290	which I think was a record for the FCC's Enforcement Bureau.
175090	183440	And before all of that, Travis was a senior advisor
183770	189460	to former California Attorney General Kamala D. Harris
189750	193060	and a Special Assistant Attorney General of California,
193190	196840	where he oversaw California's complex litigation
197200	201680	and policy in areas such as technology regulation,
201680	204900	high-tech crime, cybersecurity, privacy,
204900	209540	intellectual property, antitrust, and telecommunications.
209960	212640	Indeed, he created the Privacy Unit
212640	214840	that is responsible for enforcement
214840	217240	of California's Privacy Act
217540	221560	and created California's E-Crime Unit,
221560	224220	which has the primary mission of investigating
224220	229060	and prosecuting multi-jurisdictional criminal organizations,
229060	232920	networks, and groups that perpetrate identity theft crimes,
232920	237420	use an electronic device or network to facilitate a crime
237420	241960	or commit a crime targeting an electronic device,
241960	244480	network, or intellectual property.
244480	246420	And before all of that,
246420	248840	he served during the Obama administration
249350	253300	as an attorney advisor in the U.S. Department of Justice's
253300	255220	Office of Legal Counsel,
255220	257760	which advises the President, Attorney General,
257760	261060	and executive branch agencies on the constitutionality
261060	263540	and legality of the programs and activities
263540	265280	of the U.S. government.
265280	267080	So welcome.
268220	274700	I'm first gonna focus a bit on your current role
274700	278140	as a member of the Privacy and Civil Liberties Oversight Board
278140	282280	and ask you, for those watching who may not be familiar
282660	285540	with what the PCLOB is and does,
285540	287840	whether, could you please give us a little background
287840	290460	about the board and the projects
290460	293680	that the board has been working on of late?
293920	295860	Well, thank you, Stephanie,
295860	298760	for that very kind introduction.
298760	301340	I also want to thank the Ethics Village
301340	305540	for having me join you all virtually this year at DEFCON.
305540	308440	I was in Vegas last August
310280	315200	and was around DEFCON as it was taking place
315200	317180	and got to really see a lot of good friends
317180	320440	who I will miss seeing, not being able to see,
320440	322880	at least in person, this year.
323120	325820	Listening to you talk about my background, Stephanie,
325820	328040	you definitely made me feel like an old man
328790	332620	because there are a lot of years that are there going back,
332620	335840	but that's okay, that is A-okay.
336280	338900	Maybe it's just that you've done so many things
338900	342300	in a short period of time, one could look at it that way.
342340	344160	That's where all my hair went.
344160	346500	That's the explanation for it.
346840	350900	Look, I'm thrilled to be here and to share with folks
350900	353160	some of the work that we're doing at the PCLOB.
353160	355260	The Privacy and Civil Liberties Oversight Board
355260	360340	is an independent agency within the executive branch.
360340	361940	It was created out of a recommendation
361940	364980	from the 9-11 Commission,
364980	368820	which, as you all probably may recall,
368820	372840	one of the main challenges that the U.S. faced around 9-11
372840	375280	was the lack of intelligence sharing
375810	379860	between the intelligence community and law enforcement.
380180	383900	That resulted in a host of new authorities
383900	390380	that built in a number of surveillance tools
390380	394800	that could be used by the United States government
394800	398820	to help prevent another terrorist attack in the future.
398820	400880	Well, along with those surveillance authorities
400880	403580	was a desire to ensure that the privacy
404200	406700	and civil liberties of U.S. persons
406700	411780	was being balanced against the use of those authorities
411780	414580	to protect the nation from terrorism.
414580	418020	The board is run by five members
418940	420960	that are all appointed by the president
420960	423860	and confirmed by the United States Senate.
423860	429580	Three are always members of the party of the president.
429580	431740	So currently the majority of the board,
431740	434500	three members are Republicans,
434500	437040	and then two are Democrats.
437040	441380	I'm one of the Democratic members of the PCLOB.
441980	445100	As Stephanie mentioned, the chairman is full-time,
445100	448680	but the other four members are all part-time members,
448680	451440	which means we balance our work at the board
451440	458440	with employment outside of the government.
458440	462100	In my instance, I'm a partner at a law firm, Cooley,
462680	466820	and I have been on the board since last year.
466820	471960	We are in the process of reviewing several projects,
471960	475160	but our jurisdiction primarily extends
475160	476860	to the programs and activities
476860	481440	that are meant to protect the nation against terrorism.
481800	483840	Much of the work that we do is classified.
483840	487380	We all have security clearances at the highest level
487380	490740	and are not prevented from gaining access
490740	494400	to any information because it is classified.
494400	497020	Our work generally breaks into two buckets.
497020	502120	One bucket is advice, and the other bucket is oversight.
502240	505480	With respect to advice, we are generally in the capacity
505480	510160	of being asked by a component of the intelligence community
510670	514400	about a program or activity that they are engaging in
514400	518960	or are seeking to engage in about the extent
518960	521220	to which the program could better protect
521220	525860	or does protect privacy and civil liberties of U.S. persons.
525860	529880	Those advice projects, we typically do not publicize
529880	532160	in part because they're often classified,
532160	535160	but also in part because we like to incentivize
535160	538820	the intelligence community to seek out our counsel
538820	543340	and have a little bit of independent advice
543340	545640	being provided to them about ways
545640	547300	that they can improve the privacy
547300	549840	and civil liberties protections of the programs
549840	552400	and activities of those components.
552400	555080	The second bucket is our oversight project.
555080	558480	And this is where we often will elect
558480	562040	to look at particular programs
562040	563500	or activities of the government,
563500	565600	and decide which ones are worthy
565600	569020	of having the PCLOB's independent oversight.
569020	572640	We have several of those that are ongoing right now,
572640	576520	but we've just recently finished up a review
576520	580060	of the National Security Agency,
580060	585060	the NSA's program to collect call detail records,
585060	588060	which you may hear me refer to as CDRs.
588060	591480	But essentially, the NSA, for many years,
591480	596700	operated a program where it collected large scale metadata
597960	602440	about telephone calls, primarily outside of the,
602440	606140	made to numbers outside of the United States,
606140	608480	but there were ways in which it could catch calls
608480	611340	within the United States.
611340	615520	We found in our report that this program was ineffective,
615520	618620	that it was needlessly intrusive
618620	622380	into the privacy and civil liberties of U.S. persons,
622380	624820	and that it was extremely expensive.
624820	629900	In the few years that it operated, since 2015,
630400	634180	the program cost about $100 million.
634700	638560	And for that $100 million, where they collected
639660	644840	a very, very, very large number of details
644840	647220	about telephone calls,
647220	651560	the NSA produced 15 intelligence reports.
651560	654360	Of those 15 intelligence reports,
654360	657060	the Federal Bureau of Investigation, the FBI,
657060	659420	concluded that only two had information
659420	661060	the FBI was unaware of.
661060	664300	So for years in collecting a massive number
664300	668320	of calls by U.S. persons,
668920	672760	there were only 15 reports that were generated from this.
672760	674280	It was sort of shooting, you know,
674280	677620	it was literally looking for a needle in a haystack
677620	679520	to try and find something.
679560	683280	There were also numerous compliance incidents
683280	686980	and data integrity concerns with the program as well,
686980	690840	so much so that a little over a year ago,
690840	692960	the NSA decided on its own
692960	695260	that it should shut the program down.
695260	699780	And we certainly concurred in that decision
699780	703020	and put out a report to improve transparency
703700	706960	into how this program had operated.
706960	709320	In my view, it was the digital equivalent
709320	711240	of the bridge to nowhere.
711300	715220	The NSA has deleted all of the records associated with it
715220	719200	and the authority for the program has now expired.
719460	723460	We're doing, in addition to the CDR project,
723460	725280	we have several ongoing projects
725280	727320	that we're working on right now.
727660	730120	A few examples of those are,
730120	733620	we're looking at the use of open source intelligence
733620	736340	by the Federal Bureau of Investigation, right?
736340	737540	Essentially gaining access
737540	739260	to commercially available databases
739260	742160	or how they might mine social media
742160	747940	or other open source materials for investigatory purposes.
747940	750720	We are looking at the terrorist watch lists
751320	753180	that are out there and, you know,
753180	754840	sort of standards around who gets on them,
754840	756780	how you get on them, how you get off them,
756780	758440	you know, what protections are in place
758440	760860	to protect privacy and civil liberties.
760860	764640	We're looking at a Department of Treasury program,
764640	767180	the Terrorist Finance Tracking Program,
767180	769780	as well to examine that.
769780	775820	And then we are looking at a program operated by DHS,
775820	777500	the Department of Homeland Security,
777500	781480	looking at biometrics and the use of biometrics in airports.
781480	784340	As many of you may be aware,
784340	786340	the Department of Homeland Security
786340	792560	uses a series of biometric collection tools in airports,
792560	795280	you know, everything from fingerprints
796100	799860	to facial recognition technology.
799860	802680	Our project definitely has a huge focus
802680	804720	on facial recognition technology
804720	809060	and it's used by the Transportation Security Administration,
809060	811620	by Customs and Border Protection,
811620	814700	and by airlines and others
815060	817480	to sort of examine right now
817480	819900	what is mostly a pilot program,
819900	824780	but that DHS certainly anticipates rolling out long-term
824780	827460	at all entry and exit points
827920	830620	in the United States going forward.
830620	832040	So that, Stephanie, is, you know,
832040	833260	that's a lot of information
833260	835120	about some of the work that we're doing.
835120	837820	I definitely did not share everything,
837820	843060	but hopefully that answers the initial question.
843060	846460	Absolutely. You've given a lot to talk about.
846460	849580	And so let me just dig a little further
849580	853620	into two specific things that you mentioned.
854160	857860	The report that this PCLOB produced
857860	861220	on the Called Detail Records Program,
861220	866820	this, of course, isn't the first time the PCLOB,
866820	869000	under different members, I should say,
869000	872540	looked at the Called Detail Records Program.
872920	876360	One of the things that caught my eye
876360	880940	about the current board's evaluation of this program
880940	885140	is you all were really able to shed light
885140	887760	on the cost of this program
887760	891000	versus the efficacy, the results.
891000	895760	And I think you really illuminated
895760	900780	for perhaps the federal government
900780	903860	and certainly the public that, you know,
903860	906000	one of the things that needs to be considered
906000	908440	is whether we're really getting a bang for our buck
908440	910660	with these kinds of programs.
910820	920280	So were you surprised at how expensive this program was
920280	925740	versus kind of the limited end product that it produced?
926140	928880	Oh, I definitely was surprised about the disparity.
928880	931360	I mean, when I saw 15 reports,
931360	934200	and I know everything that had to go into operating this program,
934200	936200	I knew it was extremely expensive.
936200	937980	And, you know, as you may be aware,
937980	941520	under the statutory authority that was available to the NSA,
941520	944660	they had the ability to pay telecommunications carriers
944660	948160	to actually participate in the program.
948160	953540	And so, you know, that is an expensive endeavor as well that's involved.
953540	957120	So it was very important to me that we understand the cost of the program,
957120	961860	because as we are evaluating, you know, the impact on privacy and civil liberties,
961860	964820	we ought to compare that to the effectiveness of the program
964820	967300	and also the cost of the program.
967300	971040	You know, a billion dollars to intrude into people's privacy and civil liberties
971040	974480	and get almost nothing from it is, you know,
974480	979100	is not really worth, you know, the program in terms of advising Congress,
979100	982220	you know, about whether or not the program should be extended
982220	985500	or advising the executive branch about whether or not it should be ended.
985500	988800	So I do believe that it is critical that we have an understanding
988800	991480	of just how much these programs cost
991480	996980	so that we can really weigh the benefit of the programs against the expenses
996980	1001540	to not only the privacy and civil liberties, but also to the public fisc.
1002280	1004900	So in agreeing with you on that point,
1004900	1008400	I should have said at the beginning that my name is Stephanie Pell.
1008400	1012440	I'm a professor at West Point, but anything that comes out of my mouth,
1012440	1014800	although this interview is about your views,
1014800	1018540	but anything that happens to come out of my mouth are my views
1018540	1023160	and do not represent the views of the Army, West Point,
1023160	1025140	or the federal government at large.
1025140	1028300	So anyway, but I agree with you.
1029360	1034280	So moving on, you mentioned an ongoing project
1034280	1043080	where the P-CLOB is looking at DHS's use of biometric technologies in airports.
1043080	1050440	I'd like to broaden the biometric technology discussion a little further with you
1050440	1056980	and just recall the story that many of us have read
1056980	1061260	in the Washington Post about a man named Robert Williams,
1061260	1066320	who is an African-American man who was arrested at his home in front of his children
1066320	1070700	and held for a night in jail due to a misidentification
1071400	1075140	based on a facial recognition algorithm.
1075140	1079440	So in other words, he was arrested based on this misidentification
1079440	1085820	for a crime he did not commit and was held in jail overnight.
1086540	1092360	And I would say that unfortunately, as horrible as this was,
1092360	1096280	we shouldn't be terribly surprised as we've known for some time
1096280	1102220	that facial recognition technologies disproportionately misidentify
1103180	1105940	people of color and women.
1106080	1110080	So how would you address the disparate impact
1110080	1114160	that facial recognition technologies have on communities of color
1114160	1118440	and more broadly, what concerns do you have
1118440	1123120	about how the U.S. government collects and uses information
1123120	1126200	produced by biometric technologies?
1126960	1130040	We all know and have known for a very long time
1130040	1135040	that facial recognition technology has a propensity
1135040	1138560	to misidentify people of color and women.
1138560	1141300	There are numerous studies on this.
1141300	1147840	In 2018, the MIT Media Lab produced a study that found
1147840	1152920	that there was an inability of facial recognition algorithms
1152920	1159560	to identify or misidentify people of color.
1159560	1166900	Last year, the NIST, which is a federal government agency,
1166900	1172020	put out a report looking at 200 facial recognition algorithms
1172020	1179860	and finding evidence of bias along issues of skin color.
1181300	1185880	There was bound to be a time, if not many times that have happened,
1185880	1190060	but one that we now know of, where a person of color would be
1190060	1193620	misidentified by a facial recognition algorithm.
1193620	1196000	I refer to these as race breaches.
1196000	1202440	This is essentially a breach that is taking place in the algorithm.
1202740	1208360	I think that going forward, if the government is going to rely
1208360	1213080	upon facial recognition technology, it has a responsibility,
1213420	1217760	a duty, to ensure that people of color, women,
1217760	1224360	are not disproportionately misidentified or adversely impacted
1224360	1227900	by these particular technologies.
1228220	1232620	Part of that is by making sure that before any facial
1232620	1236680	recognition technology is deployed, that the government
1236680	1241560	or any public authority has given a real strong consideration
1241560	1246060	to the impact that this particular algorithm will have
1246060	1250700	in this particular use case on communities of color.
1250700	1253680	That means really beginning to think about not just
1253680	1258160	does this particular program impact privacy and civil liberties,
1258160	1262580	but recognizing when that impact disproportionately impacts
1263080	1266080	a particular community and ensuring that the government
1266080	1270560	is taking mitigating steps or taking any steps to remediate
1270560	1272840	that disproportionate impact.
1272840	1275660	It's about making sure that when we are thinking about
1275660	1282020	the deployment of a technology like a facial recognition technology,
1282020	1284020	that we're thinking about equality.
1284040	1287040	And that from the beginning, we are building in place
1287040	1291760	protections that are designed to ensure that these programs
1291760	1295300	do not operate in a manner that disproportionately
1295300	1299200	impacts people of color. I call this equality by design.
1299200	1302280	Many people may be familiar with the concept of privacy by design.
1302280	1305180	That is building privacy into a new product
1305180	1308540	so that it respects it from the beginning and doesn't collect
1308540	1311780	any more information, for example, than it needs to.
1311780	1314380	Well, we ought to do the same thing around civil rights concerns.
1314380	1318280	We ought to build equality into the very design of the product
1318280	1322660	from the beginning so that ultimately it minimizes
1322660	1325560	any impact that it's going to have on communities.
1325560	1328200	I don't know that at the end of the day that's ultimately going
1328200	1333480	to solve the problem with bias in facial recognition algorithms.
1333480	1337080	We've seen a number of corporations over the last two months
1337080	1343460	begin to pull away from their facial recognition products
1343460	1347800	that were being sold or marketed to law enforcement.
1347800	1351120	IBM, for example, has stepped back from it.
1351120	1355680	As have Microsoft and Amazon, all making announcements.
1355680	1359020	And we've seen several cities now and states begin to look
1359020	1361920	at whether to ban facial recognition technology
1361920	1363960	and its use by law enforcement.
1363960	1366460	San Francisco's done it. Boston has done it.
1366460	1370180	In fact, the Massachusetts legislature, it looks prime
1370180	1374440	to ban it in the state for use by law enforcement.
1374440	1378020	And I think there's no doubt that one of the primary factors
1378020	1383140	that are motivating these companies as well as these governments
1383140	1385900	to limit the use of facial recognition technology
1385900	1390240	is they haven't often gotten the issue of bias
1390240	1392580	along racial lines correct.
1392580	1394960	And as long as that's there, we have to be mindful
1394960	1398200	about rolling this technology out so that we don't end up
1398200	1403380	in a world where we now have digital biometric technologies
1403380	1409680	that essentially are discriminating against people of color
1409680	1412420	in the same way that so many people of color have experienced
1412420	1417900	for decades or centuries in this country.
1417900	1423880	We don't want a world where one segment typically has to go
1423880	1427440	through a secondary inspection or additional questions
1427700	1434020	or is presumed guilty just by their image.
1434020	1436620	That is the world that we're trying to avoid right now.
1436620	1438920	And the last thing we want to do is hard-code that
1438920	1443880	into the 21st century by beginning to deploy new technologies
1443880	1446980	for the government to use that could ultimately
1446980	1451980	disproportionately impact and be adverse to people of color.
1451980	1461060	So you are really calling for, it's not a new discussion,
1461060	1465980	but broadening the discussion, not just about privacy
1465980	1469880	by design and looking at the privacy impacts
1469880	1473840	of government use of certain technologies,
1473840	1479060	but a specific focus on how the use of those technologies
1479060	1483940	could have a disparate impact on marginalized
1483940	1486240	or communities of color.
1486240	1491920	Because if not, we risk using technology
1491920	1496120	to further facilitate racism at scale.
1496620	1497780	That's exactly right.
1497780	1500600	These algorithms are created by humans.
1500600	1503260	These humans may have biases or the way
1503260	1506620	that the algorithm is trained could be biased.
1506620	1508400	Those are easy examples.
1508400	1511100	But what I am saying is we shouldn't just think
1511100	1515300	about the impact of a program on this amorphous concept
1515300	1518360	of privacy that really focuses on the privacy
1518360	1519300	of the majority.
1519300	1521740	When there is a disproportionate impact
1521740	1526240	on vulnerable communities or disproportionate impact
1526240	1531960	on historically disenfranchised or disadvantaged communities,
1531960	1534680	we ought to be looking at that program
1534680	1537440	and scrutinizing it even more.
1537440	1539280	And I think that's what's missing right now.
1539280	1541320	What's missing right now is we often just think
1541320	1543420	about privacy writ large.
1543420	1546260	We don't actually think about how the privacy
1546260	1549400	of the minority is being disparaged
1549400	1550900	by a particular program.
1550900	1553620	The last thing we want to do is have a world
1553620	1555400	where the privacy and civil liberties
1555400	1557740	of the majority is protected while the privacy
1557740	1561180	and civil liberties of the minority is disregarded
1561180	1565840	or otherwise disproportionately impacted.
1565840	1569660	We don't want privacy to be a luxury good to anyone.
1569980	1570840	Right.
1571120	1574400	And it, you know, at times it's had a tendency
1574400	1577000	to be that way, unfortunately.
1577520	1580420	So I'd like to now talk with you
1580420	1584060	about a letter you wrote,
1584060	1587740	I believe last month, because we're still in July,
1587740	1590800	to the acting secretary of DHS
1590800	1596060	in your official capacity as a PCLA board member.
1596060	1600080	And you wrote to express your concerns
1600080	1604080	and to raise questions about a DHS program
1604080	1607540	requiring all air travelers to submit
1607540	1611380	to mandatory DHS-administered temperature checks
1611380	1616700	or thermal imaging before boarding a commercial airline.
1616940	1620700	What were some of the concerns that you expressed
1620700	1624720	in your letter to the acting secretary of DHS?
1624720	1626900	And have you received a response?
1626900	1631280	And my understanding also is that some members
1631280	1634140	of Congress have now taken up this cause
1634140	1636040	and concern with you.
1636260	1639360	Yeah, I have several concerns about this program.
1639360	1642580	The plan, as I understand it,
1642580	1647320	is for the TSA to administer temperature checks
1647320	1650840	at security checkpoints in airports.
1650840	1653200	My understanding is that this has been requested
1653200	1657200	by various airlines, in part because
1657200	1658840	they don't want to administer them
1659440	1661680	and because they don't want to pay
1662240	1665780	for the temperature checks that would be administered.
1665780	1670340	I have strong concerns about the efficacy
1670860	1674060	of temperature checks or fever checks
1674060	1681100	at detecting whether someone is infected with COVID-19.
1681100	1683500	As you may know, there are many reasons
1683500	1686600	why someone would have a fever.
1686600	1689160	COVID-19 is one reason, but there are a host
1689160	1692520	of other reasons that range from an illness
1692520	1695760	to a condition, you know, a heart condition,
1695760	1696740	for example.
1696740	1699640	Or maybe the person had just been running
1699640	1703700	through the airport to get from the check-in
1703700	1707580	desk to their flight because they're late.
1707580	1709820	I'm also equally concerned that if someone
1710140	1712920	wanted to suppress their temperature
1712920	1715540	or their fever, that that's also easy to do
1715540	1718380	by taking aspirin or ibuprofen, for example,
1718380	1720080	or just putting a little ice on your head
1720080	1724000	for a little while before you walk up to the checkpoint.
1724000	1726820	Thirdly, it's not apparent to me
1726820	1731420	that TSA agents are trained in asking questions
1731420	1734420	or administering public health examinations.
1734420	1738640	And so, you know, it's not...
1738640	1741300	I have no idea how TSA would plan
1741300	1744400	to train these agents, whose mission
1744400	1748200	is supposed to be the security of air travel,
1748200	1751280	not necessarily the public health of air travel.
1751280	1753060	I'm not saying that, you know, there aren't
1753060	1754940	public health experts in the government
1754940	1756780	that do have the training to do this.
1756780	1758920	Namely, you know, the Center for Disease Control,
1758920	1760860	the CDC, would have this expertise.
1760860	1763800	But the CDC has already publicly stated,
1763800	1765840	or at least, you know, information has been made
1765840	1767540	publicly available, that they don't want
1767540	1770500	to participate in this program because it's not effective.
1770500	1772820	So there are concerns about efficacy.
1772860	1774460	There are concerns about, you know,
1774460	1776720	the authority that TSA has to administer
1776720	1778620	this program. And there are also concerns
1778620	1781840	about the government's collection of this information.
1781840	1783120	What are they collecting?
1783120	1785880	What are they going to do with this information?
1785880	1788160	What database is it going to go into?
1788160	1790440	And how is this going to impact travel?
1790440	1793180	Are they going to ban individuals, passengers,
1793180	1794820	from traveling for 14 days?
1794820	1796300	Are they going to create a no-fly list
1796300	1798740	or add you to the no-fly list?
1798740	1802600	What happens if you come with a doctor's note
1802600	1804880	that actually says, I just got tested yesterday
1804880	1807180	and I don't have COVID-19 even though
1807180	1808660	I have a fever?
1808660	1810700	Or, more importantly, you know,
1810700	1813120	who's going to reimburse the individual
1813120	1815460	for the plane ticket that they won't be able to take?
1815460	1817160	Are they going to be guaranteed refunds
1817160	1819200	by TSA? Are they going to be guaranteed
1819460	1820640	a seat in 14 days?
1820640	1822820	What if they're going for their cancer treatment?
1822820	1824860	Are they going to be denied access to the right
1824860	1827580	to travel to their doctor?
1827760	1830460	Or are they going to be, you know,
1830460	1831440	told to just go home
1831440	1833020	and stay at home and wait?
1833020	1834940	It just seems that there are so many questions
1834940	1836800	that not only haven't been answered
1836800	1838860	about what they're collecting and what they're doing
1838860	1840100	with this, but also the impacts
1840100	1843500	and how this is going to impact the traveling public.
1843500	1844680	I also have concerns
1844680	1847040	about the disproportionate impact
1847040	1848520	that this program may have
1848520	1850180	on people of color.
1851160	1852740	CDC has put out
1852740	1854660	several reports on how
1854660	1857080	COVID-19 is disproportionately
1857080	1859300	impacting people of color.
1859540	1861160	African Americans are more likely
1861160	1863280	to die from COVID-19
1863280	1865640	than are other groups.
1865640	1867420	African Americans and Latinos
1867420	1869180	are more likely to be hospitalized
1869180	1871240	and Native Americans are more likely
1871240	1872900	to be hospitalized than
1872900	1875180	other groups. If we assume
1875180	1877520	that COVID-19
1877520	1879560	disproportionately impacts
1880680	1881420	people
1881420	1883260	of color, then we should assume
1883260	1885340	that a program that is designed
1885340	1887600	to root out COVID-19
1887600	1889220	is going to ultimately
1889220	1891400	end up disproportionately impacting
1891400	1893140	people of color. And it is extremely
1893140	1895280	troubling to me that the
1895280	1897100	right to travel and travel by air
1897100	1899060	when in many instances
1899060	1901440	there isn't an adequate
1901440	1902160	substitute
1903020	1905020	that would be
1905020	1907360	available to those folks,
1907360	1908840	that they would somehow
1908840	1911320	be denied the right to travel
1911320	1913380	and that could impact your job,
1913380	1915200	it could impact your health, it could
1915200	1916840	impact your family or personal
1916840	1918520	situation in ways
1918520	1920380	that are, I think,
1920780	1922560	potentially deeply troubling.
1922560	1924700	And so I'm hopeful that
1924700	1927360	DHS will rethink this program.
1927360	1928460	Several members of Congress
1928460	1930720	are also on both sides
1930720	1933280	of the aisle, Republicans and Democrats,
1933280	1934940	seem to be concerned not only about
1934940	1936660	the efficacy but the impact on
1936660	1938520	privacy and civil liberties of this program.
1938520	1940740	And hopefully TSA and
1940740	1942680	DHS will come to its senses and
1942680	1944700	realize that it shouldn't be in the
1944700	1946500	business of administering temperature checks
1946500	1948760	in airports. And if they
1948760	1951140	do want to actually increase
1951140	1952860	the actual
1952860	1954860	safety of
1954860	1956680	air travel with respect to
1956680	1958820	COVID-19, there are other measures
1958820	1960040	that
1961200	1962640	numerous experts
1962640	1964700	have reported on that
1964700	1967200	airlines, for example,
1967200	1968560	could take to better
1968560	1970800	secure air travel and to better
1970800	1972660	ensure that it's a healthy experience for
1972660	1974460	all passengers.
1975640	1976840	Well, I
1976840	1978740	look forward to
1978740	1980860	what, if any, responses
1980860	1982880	are forthcoming.
1984520	1986760	So, as you mentioned
1986760	1988820	before, the PCLOB
1988820	1990800	had broad discretion and authority
1990800	1992680	to conduct oversight and
1992680	1994620	provide advice to the U.S. government with
1994620	1996460	respect to the implementation of
1996460	1998500	executive branch policies,
1998500	2000600	procedures, regulations, and
2000600	2002320	information-sharing practices
2002320	2004820	relating to efforts to protect the nation
2004820	2006720	from terrorism in order
2006720	2008700	to ensure that privacy and civil
2008700	2010640	liberties are protected.
2010640	2012240	So, this authority
2012240	2014700	therefore covers the activities
2014700	2016620	of both law enforcement and
2016620	2019060	intelligence agencies.
2019100	2020600	And given the
2020600	2022520	scope of the board's discretion
2022520	2024840	within the context of terrorism
2024840	2026760	programs, if you
2026760	2028640	alone could determine the
2028640	2031300	priorities for the PCLOB,
2031300	2032520	what projects
2032520	2035740	would you add to its current slate?
2036260	2036800	That's a very
2036800	2038140	good question.
2038660	2040600	There are many. I think
2040600	2042940	there are so many issues
2042940	2044980	within our jurisdiction
2044980	2046960	for us to look at
2046960	2048920	that, you know, the challenge
2048920	2050600	we really do face is balancing
2050600	2052880	the limited resources
2052880	2054700	we have with the projects
2054700	2056760	that really do stand
2056760	2058440	to benefit from oversight
2058440	2060700	by the PCLOB. Among the
2060700	2062800	topics that I would prioritize
2062800	2065370	would be stingrays.
2065420	2066680	Many folks may be
2066680	2068780	aware of the
2068780	2073040	existence of a
2073040	2073400	cell
2073400	2075410	site simulator technology
2075840	2077130	that would
2077420	2079310	allow someone
2079420	2080910	to intercept
2081680	2083290	telephone calls
2083500	2084820	as well as text messages
2084820	2087060	if they, you know, run
2087360	2088720	a stingray near
2088720	2090980	your location. I think
2090980	2092760	it's important for us to examine
2092760	2094200	the use of stingrays
2094800	2096980	by the intelligence
2096980	2098920	community and the efforts to protect
2098920	2100020	the nation against
2100680	2102520	terrorism. I'd also
2102520	2105040	think that there'd be some value in the PCLOB
2105040	2106040	looking at
2106900	2107500	when
2108700	2111040	components of the U.S. government decide
2111040	2112920	to use hacking tools
2112920	2115180	and beginning to think about what standards
2115180	2117000	are around those, who they can be used
2117000	2118640	against, what
2118640	2121080	approvals need to be put in place,
2121080	2122480	how they can be secured
2123000	2125020	to ensure that they don't get into the
2125020	2126880	hands of an adversary, which
2126880	2128620	unfortunately we've seen
2128620	2130820	happen more than
2130820	2133120	once. Thirdly,
2133740	2134920	I'd want to look at
2135120	2136820	a full review of the Foreign Intelligence
2136820	2138980	Surveillance Act, FISA. I think there are
2139200	2140900	a lot of issues there
2140900	2142320	that we could
2142860	2144680	explore. Everything from
2144680	2146620	the use of foreign intelligence
2146620	2148940	surveillance information in
2148940	2150980	criminal prosecutions to
2150980	2152100	the approvals
2152580	2154960	for those authorities by courts,
2154960	2156520	whether intelligence courts
2156520	2158120	or
2158940	2160400	traditional Article III
2160780	2162380	federal courts, your normal
2162380	2164640	U.S. District Court, to
2164640	2166800	looking at the
2166800	2168400	amicus program
2168400	2170540	that operates
2170540	2172580	under FISA. But I think there's just a lot
2172580	2173980	of work around FISA
2173980	2176500	for the board to do, and that itself
2176500	2178520	could be full-time. I'd
2178520	2180500	also want to look at domestic
2180500	2182380	terrorism issues. Typically, the board
2182380	2184640	in the past has spent almost all of its energy
2184640	2186580	focused, if not all of it, focused
2186580	2188500	on foreign terrorism, yet we know that
2188500	2190460	the number one threat to U.S.
2190460	2192500	persons is actually domestic terrorism. This
2192500	2194740	has been the case for centuries.
2194740	2196400	This isn't a new
2196400	2198580	evolution, and in fact, every year
2198580	2200420	it's a greater threat. But
2200420	2202200	we don't spend a lot of time really
2202200	2204300	looking at the privacy
2204300	2206540	and civil liberties impacts around
2206540	2209060	the domestic terrorism.
2209060	2210400	And then, I think probably
2210400	2212380	finally, I'd want to look
2212380	2213860	at the sharing of
2214480	2216140	national security information
2216140	2218640	with non-national
2218640	2220300	security agencies,
2220300	2222260	such as immigration
2222260	2224080	and customs
2224080	2225200	enforcement.
2225840	2227880	Really beginning to think about
2227880	2230100	the extent to which national security
2230100	2231900	authorities are being used
2231900	2233720	for non-national security
2233720	2235820	purposes. And I think that's an
2235820	2236460	important
2238220	2239960	task for us to take because
2239960	2241920	more and more government databases
2241920	2244240	are being created that are intended to integrate
2244240	2246040	consolidate information
2246040	2248060	from a lot of sources, and once they're
2248060	2250020	in there, they're very hard to get out. It's sticky
2250580	2252060	data once it's in there.
2252060	2254260	So I think it's important for us to get a greater
2254260	2256120	understanding of a lot of these
2256120	2258300	intelligence-sharing authorities and tools
2258300	2260000	that are being used.
2260120	2261760	Well, that is certainly
2263920	2264280	a worthwhile
2264280	2265900	and very
2265900	2268080	expansive list of
2268080	2270020	projects. I will just
2270020	2271960	take moderator's privilege and say
2271960	2273960	perhaps that is an argument for more
2273960	2275840	resources for the Privacy and Civil
2275840	2277680	Liberties Oversight Board.
2278760	2279600	So,
2279600	2281620	I'll piggyback
2281620	2283480	that comment to the next
2283480	2285380	question and say
2285380	2287760	given the Privacy and Civil
2287760	2289640	Liberties concerns that spring
2289640	2291600	from law enforcement use of
2291600	2294500	new and emerging technologies,
2294500	2295060	you've
2295560	2297680	talked about a number of examples,
2297680	2299460	facial recognition, other biometric
2299460	2301380	technologies, big data
2301380	2303360	analytics, you mentioned stingrays
2303360	2305860	in a counterterrorism
2305860	2308120	or terrorism-focused context,
2308120	2310260	but could you see an important
2310260	2312160	role for the PCOB to
2312160	2314320	play beyond the specific
2314320	2316240	frame of privacy
2316240	2318160	and civil liberties in the
2318160	2320140	context of protecting our nation
2320140	2322080	from terrorism? And I guess
2322080	2324200	what I'm asking is, should
2324200	2326200	Congress expand the
2326200	2327540	PCOB's jurisdiction
2327880	2330060	to oversee and address
2330060	2332300	privacy and civil liberties
2332300	2334100	concerns beyond
2334100	2336080	that reach
2336080	2338140	beyond the nation's counterterrorism
2338140	2340280	efforts? Well, look,
2340280	2342220	far be it for me to
2343580	2344340	decide
2344340	2346120	for Congress what
2346120	2348140	the jurisdiction of our agency should
2348140	2350340	be. You know, that's a
2350340	2352640	question for Congress
2352640	2354440	and, you know, they
2354440	2356920	regularly consider it.
2356920	2360000	In my view,
2360000	2360480	privacy
2360480	2362580	and civil liberties
2362580	2364360	concerns have only
2364360	2365040	increased
2366260	2368080	over the last
2368080	2370640	decade or two decades.
2370640	2372600	And those concerns about
2372600	2374260	government or even
2374260	2375480	corporate surveillance
2375480	2377780	are such that
2378440	2380220	there needs to be
2380220	2381300	some agency
2382240	2384320	that is looking
2384320	2386820	into those issues.
2386820	2388680	One easy example
2388680	2390820	of that is,
2390820	2392180	you know, everything that's happening
2392180	2393740	right now in COVID-19
2393900	2396380	and the pandemic. You know, we have
2397020	2398340	a lot of debate right now
2398340	2399880	about contact tracing
2399880	2402020	and a lot of debate about what
2402020	2403960	authorities are needed for
2403960	2406140	public health agencies
2406140	2407780	to collect
2407780	2410680	data about each of us
2410680	2412240	not only to help
2412240	2413820	find a vaccine
2413820	2415840	but also to
2415840	2418080	be able to go back
2418080	2420160	and contact individuals
2420160	2421880	that someone who's
2421880	2423900	infected may have been in
2423900	2426000	touch with the prior 14
2426000	2427960	days. There are
2428400	2429540	a lot of
2430240	2431900	expansive authorities
2431900	2433700	that are being used by government agencies
2433700	2435840	because we are in a pandemic.
2435840	2438040	Quarantine, for example.
2438040	2439840	You know, I mean, imagine the impact of a quarantine
2439840	2442180	on privacy and civil liberties.
2442180	2443740	Yet we don't actually have
2443740	2445880	an agency in the
2445880	2447480	federal government that's tasked
2447480	2449740	with looking at the privacy and civil
2449740	2451580	liberties impacts of all the
2451580	2453600	activities around the pandemic.
2453600	2455520	What agency is going
2455520	2457500	to look at that, for example?
2457500	2459060	And we don't have agencies
2459060	2461480	that are devoted towards looking
2461480	2463220	at the privacy,
2463220	2465120	independently looking at the privacy
2465120	2467080	and civil liberties
2467080	2469440	impacts of the general
2469440	2471480	activities of the Federal Bureau of Investigation
2471480	2473660	for example. So at least
2473660	2475620	in my view, I think it's high time
2475620	2478320	for the United States to have two things.
2478320	2479600	One is
2479600	2481400	you know, a basic
2481400	2484040	federal privacy legislation.
2484040	2485520	We need it. And number two
2485520	2487600	is, you know, an agency
2487600	2489660	or more, or two
2489660	2491260	you know, choose the number of agencies
2491260	2493500	that are committed to the task of
2493500	2495400	protecting the privacy
2495400	2497380	and civil liberties of
2497380	2499680	the U.S. public. And that may
2499680	2501780	be in the corporate, but it also, frankly
2501780	2503460	should be in government.
2503460	2505280	And making sure that there is some
2505280	2507400	independent check out there on
2507400	2509220	the expansive use of
2509220	2511520	surveillance authorities, whether or not
2511520	2512740	they involve
2513400	2514300	terrorism.
2517000	2519460	So switching gears a bit,
2519460	2521360	as we mentioned at the beginning,
2521360	2523600	in addition to your role as a PCAW
2523600	2525240	board member, you're a partner
2525240	2527100	at the Cooley Law Firm with
2527100	2529280	very interesting privacy and cyber security
2529280	2531600	practice. And of course, as a
2531600	2533220	practicing lawyer, everything you do
2533220	2535320	in that role is not public
2535320	2537300	and in addition, due to
2537300	2539440	obligations to your clients,
2539440	2541340	there are limitations on what
2541340	2543380	you can discuss publicly.
2543380	2545220	However, there are
2545220	2547440	two interesting cases involving
2547440	2549400	the Computer Fraud
2549400	2551080	and Abuse Act that you've been
2551080	2552960	litigating, that have received
2552960	2555220	some press coverage.
2555220	2557220	And to my knowledge, these
2557220	2559220	are the first two cases of
2559220	2560860	their kind. So
2560860	2562580	the first case that
2562580	2564720	I'm going to refer to is the Broidy
2564720	2567040	case, where on behalf of Mr.
2567040	2568520	Broidy, you sued the
2568520	2570920	country of Qatar and a number
2570920	2572980	of individuals for their role
2572980	2574540	in hacking and leaking
2574540	2576900	Mr. Broidy's email. And as
2576900	2579860	one news outlet reported,
2579860	2580360	quote,
2580360	2582400	this is a case about a hostile
2582740	2583980	intelligence operation
2584640	2586720	undertaken by a foreign nation
2586720	2588520	against American citizens
2588520	2590740	who have spoken out against
2590740	2592640	that country's support for
2592640	2594540	terrorism and who have entered into
2594540	2596460	significant business relationships
2596460	2598480	relating to defense and
2598480	2600460	counterterrorism with a rival
2600460	2602920	nation. The other case
2602920	2604400	involves
2605160	2606380	a lawsuit by WhatsApp
2606380	2609040	against the NSO group,
2609040	2610620	an Israeli-based spyware
2610620	2612730	firm, alleging that NSO's
2613580	2614920	Pegasus spyware
2614920	2616420	was, among other
2616420	2618560	things, used to hack phone
2618560	2620740	systems of 1,400 users
2620740	2622960	between April 2019
2622960	2625800	and May 2019.
2625800	2626580	There
2626580	2628260	are very interesting aspects
2628260	2630500	of both of these cases, but
2630500	2632800	let me ask
2632800	2634660	you, because these
2634660	2636520	cases illustrate how
2636520	2638760	foreign governments are increasingly
2638760	2640600	attacking individuals
2642220	2642700	hacking
2643180	2644660	their phone
2644660	2646640	networks. What do you think
2646640	2648940	we should do about this problem?
2649820	2650680	There is
2650680	2652640	no doubt that
2652640	2654860	numerous nation states
2654860	2656300	are targeting
2656300	2657740	U.S. persons
2658560	2659900	and corporations
2660740	2661500	in
2662740	2665100	hacking campaigns.
2665680	2666480	Not only are they
2666480	2668700	you know, sometimes they are doing
2668700	2669640	this to
2670740	2671280	gain
2672600	2673480	access
2673480	2675420	to embarrassing information about
2675420	2677140	an individual and then to
2677140	2679240	release it.
2679240	2681420	Other times, they are
2681420	2683180	using it to gain access to the
2683180	2685560	intellectual property of a company
2685560	2687080	which they will
2687080	2688700	exploit, either by
2689240	2691360	giving it to a competitor or
2691360	2693260	releasing it. Other
2693260	2695200	times, they are gaining
2695200	2697480	it to... seeking access
2697480	2699060	to engage in a disinformation
2699060	2700500	campaign.
2700520	2702940	All the while, no matter
2702940	2705550	how much a
2705780	2707450	company or individual
2707960	2710460	invests in
2710460	2712160	cyber security
2712160	2714300	protections and safeguards,
2714300	2715900	many of these nation states
2715900	2718920	have almost unlimited resources
2718920	2720080	and ability
2720080	2721800	to continue to target
2721800	2723760	that entity.
2723760	2726200	Even when you have the best security,
2726200	2726960	they are likely at
2726960	2728960	some point to find
2729300	2730980	a way in. And that
2730980	2733000	way in may not be
2733000	2735100	through the CEO.
2735120	2737080	That way in may be through
2737080	2738740	the CEO's executive assistant
2738740	2740500	or the
2741500	2742360	CISO's
2743040	2745060	spouse may be a way
2745060	2746920	in there. These are
2746920	2748720	sophisticated campaigns
2748720	2750800	that are being engaged
2750800	2753220	in against
2753220	2754620	Americans.
2754620	2756720	And when
2758060	2758740	these
2758740	2760960	are brought to the attention of law enforcement,
2760960	2762700	they're limited in what they
2762700	2764640	can do. Yes, it's
2764640	2765960	possible to indict
2766960	2768540	a Chinese person or two or
2768540	2770500	three. And someday
2770500	2772480	those people may be brought
2772480	2774620	to justice. But today, that's
2774620	2775920	not going to stop that company
2776500	2778380	that's been impacted by this
2778380	2780820	from having
2781160	2782560	a lot of trouble
2782560	2783820	as a result of
2784220	2786200	the hack. And
2786200	2788320	unfortunately, litigation too
2788320	2790360	has its limitations
2790360	2792560	due to a law
2792560	2794340	called the
2795780	2796780	Foreign
2796780	2798640	Sovereign
2798640	2800960	Immunity Act.
2800960	2802520	The acronyms are all
2802520	2804800	the same, the Foreign Sovereign Immunity Act,
2804800	2805300	which
2806620	2808640	essentially gives any
2808640	2810660	foreign government immunity
2810660	2812240	from litigation
2812240	2814600	in the United States with a couple
2814600	2816520	of exceptions.
2816520	2818800	It is now time for the United
2818800	2820160	States to really rethink
2820740	2822720	the Foreign Sovereign
2822720	2824920	Immunity Act and to rethink
2824920	2826680	the extent to which
2826680	2828920	it ought to be used
2828920	2830940	as a defense by
2830940	2832520	foreign nation states that
2832520	2834400	hack U.S. civilians
2834400	2837040	and U.S. corporations.
2837260	2838780	And unless the government really
2838780	2841260	steps up to protect us,
2841260	2842800	we are all limited
2842800	2844860	in our ability to do
2844860	2846480	that. There has been
2847620	2848840	some legislative
2848840	2849900	movement on the Hill
2849900	2852460	looking at this particular issue
2852460	2854560	in Washington, D.C. I'm hopeful
2854560	2856740	that Congress will be able to
2856740	2858320	address this issue because
2858740	2860560	it's not just that the privacy
2860560	2862660	of U.S. persons is being
2862660	2865200	put in jeopardy, but there are
2865200	2866820	hundreds of millions, if
2866820	2868720	not billions of dollars that are
2868720	2871060	also being put in jeopardy as a
2871060	2873300	result of the ability of foreign nation states,
2873300	2875720	rogue nations, as well to
2875720	2877340	target U.S. persons
2877340	2879000	and companies for
2879000	2883860	cyber attacks.
2886500	2889800	This is a complicated problem to solve
2889800	2891240	and I imagine
2891760	2894680	in addition to
2894680	2894880	what you
2894880	2896360	have mentioned,
2896760	2898960	we're going to have to
2898960	2900780	consider
2900780	2903100	how this reflects
2903100	2905400	of course on U.S.
2905400	2906600	policy as well
2906600	2908620	and how we
2908620	2909380	engage
2910780	2912900	and use our capabilities
2912900	2913980	with respect to
2914780	2915240	other
2916820	2919200	people in other foreign nations.
2919200	2920700	So I will not
2920700	2922680	elaborate beyond that, but
2922680	2923920	I want to very much
2924500	2926040	thank you for your time
2926820	2928540	and giving us
2928540	2930900	some deeper insight
2930900	2932560	into the work of the Privacy
2932560	2935220	and Civil Liberties Oversight Board.
2935280	2936500	Hope to continue
2936500	2938360	this conversation with you
2938360	2941020	in person, maybe in Vegas next year.
2941380	2942740	Thank you so much,
2942740	2944140	Stephanie. It was great
2944140	2946280	to see you. A wonderful conversation
2946280	2948360	and I too hope we can continue
2948360	2950900	this conversation next year in Vegas.
2950900	2952840	Take care.