WEBVTT 00:00.000 --> 00:03.120 So let's officially start. 00:03.120 --> 00:11.300 And let me welcome you to the 2020 Ethics Village. 00:11.440 --> 00:14.540 It's always lovely to see you. 00:14.540 --> 00:20.980 Privacy and Civil Liberties Oversight Board Member, Travis LeBlanc, that's a mouthful. 00:21.820 --> 00:43.920 Given that we are, as everyone knows, we are all in the midst of a worldwide pandemic, we're doing this virtually this year, obviously would love to see you in person and be having this conversation live in Vegas, but we will make do with technology and see where we go. 00:44.560 --> 00:51.880 So let me give a brief introduction of who you are, and then we'll jump right into questions. 00:52.220 --> 01:16.100 So Travis LeBlanc is a board member of the Privacy and Civil Liberties Oversight Board, and before he was confirmed to what is known as the PCLOB, the acronym for the board, he was appointed by the US Department of Commerce and the European Commission to serve as an arbiter under the EU-US Privacy Shield Framework. 01:16.700 --> 01:33.800 Because the way that the PCLOB is set up, only the chair of the PCLOB is a full-time employee, so to speak, it means that everybody else generally has other full-time jobs, which you do. 01:33.800 --> 01:47.200 You're a partner at Cooley, where you're on the management team of Cooley's litigation department, and you've also served as vice chair of Cooley's cyber, data, and privacy practice. 01:47.220 --> 01:58.240 And Travis is a leading authority on cybersecurity, data privacy, telecommunications, and the regulation of emerging and disruptive technologies. 01:58.240 --> 02:22.400 Now, before all of that, Travis was chief of the FCC, Federal Communication Commission's Enforcement Bureau during the Obama administration, where he spearheaded hundreds of enforcement actions involving consumer issues such as false advertising and the Telephone Consumer Privacy Act, 02:22.400 --> 02:30.500 unfair competition, regulatory compliance, and fraud, waste, and abuse of government programs. 02:30.500 --> 02:54.290 And of note, especially for this conference, he brought the first data security action by the FCC, and he led enforcement actions resulting in fines together totaling over $100 million, which I think was a record for the FCC's Enforcement Bureau. 02:55.090 --> 03:09.120 And before all of that, Travis was a senior advisor to former California Attorney General Kamala D. 03:09.120 --> 03:29.540 Harris and a Special Assistant Attorney General of California, where he oversaw California's complex litigation and policy in areas such as technology regulation, high-tech crime, cybersecurity, privacy, intellectual property, antitrust, and telecommunications. 03:29.960 --> 03:49.600 Indeed, he created the Privacy Unit that is responsible for enforcement of California's Privacy Act and created California's E-Crime Unit, which has the primary mission of investigating and prosecuting multi-jurisdictional criminal organizations, networks, 03:49.600 --> 04:04.480 and groups that perpetrate identity theft crimes, use an electronic device or network to facilitate a crime or commit a crime targeting an electronic device, network, or intellectual property. 04:04.480 --> 04:11.980 And before all of that, he served during the Obama administration as an attorney advisor in the U.S. 04:11.980 --> 04:24.580 Department of Justice's Office of Legal Counsel, which advises the President, Attorney General, and executive branch agencies on the constitutionality and legality of the programs and activities of the U.S. 04:24.580 --> 04:25.280 government. 04:25.280 --> 04:27.080 So welcome. 04:28.220 --> 04:53.680 I'm first gonna focus a bit on your current role as a member of the Privacy and Civil Liberties Oversight Board and ask you, for those watching who may not be familiar with what the PCLOB is and does, whether, could you please give us a little background about the board and the projects that the board has been working on of late? 04:53.920 --> 04:58.760 Well, thank you, Stephanie, for that very kind introduction. 04:58.760 --> 05:05.540 I also want to thank the Ethics Village for having me join you all virtually this year at DEFCON. 05:05.540 --> 05:22.880 I was in Vegas last August and was around DEFCON as it was taking place and got to really see a lot of good friends who I will miss seeing, not being able to see, at least in person, this year. 05:23.120 --> 05:35.840 Listening to you talk about my background, Stephanie, you definitely made me feel like an old man because there are a lot of years that are there going back, but that's okay, that is A-okay. 05:36.280 --> 05:42.300 Maybe it's just that you've done so many things in a short period of time, one could look at it that way. 05:42.340 --> 05:44.160 That's where all my hair went. 05:44.160 --> 05:46.500 That's the explanation for it. 05:46.840 --> 05:53.160 Look, I'm thrilled to be here and to share with folks some of the work that we're doing at the PCLOB. 05:53.160 --> 06:00.340 The Privacy and Civil Liberties Oversight Board is an independent agency within the executive branch. 06:00.340 --> 06:11.500 It was created out of a recommendation from the 9-11 Commission, which, as you all probably may recall, one of the main challenges that the U.S. 06:11.500 --> 06:19.860 faced around 9-11 was the lack of intelligence sharing between the intelligence community and law enforcement. 06:20.180 --> 06:38.820 That resulted in a host of new authorities that built in a number of surveillance tools that could be used by the United States government to help prevent another terrorist attack in the future. 06:38.820 --> 06:46.380 Well, along with those surveillance authorities was a desire to ensure that the privacy and civil liberties of U.S. 06:46.380 --> 06:54.580 persons was being balanced against the use of those authorities to protect the nation from terrorism. 06:54.580 --> 07:03.860 The board is run by five members that are all appointed by the president and confirmed by the United States Senate. 07:03.860 --> 07:09.580 Three are always members of the party of the president. 07:09.580 --> 07:17.040 So currently the majority of the board, three members are Republicans, and then two are Democrats. 07:17.040 --> 07:21.380 I'm one of the Democratic members of the PCLOB. 07:21.980 --> 07:38.440 As Stephanie mentioned, the chairman is full-time, but the other four members are all part-time members, which means we balance our work at the board with employment outside of the government. 07:38.440 --> 07:46.820 In my instance, I'm a partner at a law firm, Cooley, and I have been on the board since last year. 07:46.820 --> 08:01.440 We are in the process of reviewing several projects, but our jurisdiction primarily extends to the programs and activities that are meant to protect the nation against terrorism. 08:01.800 --> 08:03.840 Much of the work that we do is classified. 08:03.840 --> 08:14.400 We all have security clearances at the highest level and are not prevented from gaining access to any information because it is classified. 08:14.400 --> 08:17.020 Our work generally breaks into two buckets. 08:17.020 --> 08:22.120 One bucket is advice, and the other bucket is oversight. 08:22.240 --> 08:44.980 With respect to advice, we are generally in the capacity of being asked by a component of the intelligence community about a program or activity that they are engaging in or are seeking to engage in about the extent to which the program could better protect or does protect privacy and civil liberties of U.S. 08:44.980 --> 08:45.860 persons. 08:45.860 --> 09:12.400 Those advice projects, we typically do not publicize in part because they're often classified, but also in part because we like to incentivize the intelligence community to seek out our counsel and have a little bit of independent advice being provided to them about ways that they can improve the privacy and civil liberties protections of the programs and activities of those components. 09:12.400 --> 09:15.080 The second bucket is our oversight project. 09:15.080 --> 09:29.020 And this is where we often will elect to look at particular programs or activities of the government, and decide which ones are worthy of having the PCLOB's independent oversight. 09:29.020 --> 09:48.060 We have several of those that are ongoing right now, but we've just recently finished up a review of the National Security Agency, the NSA's program to collect call detail records, which you may hear me refer to as CDRs. 09:48.060 --> 10:11.340 But essentially, the NSA, for many years, operated a program where it collected large scale metadata about telephone calls, primarily outside of the, made to numbers outside of the United States, but there were ways in which it could catch calls within the United States. 10:11.340 --> 10:21.760 We found in our report that this program was ineffective, that it was needlessly intrusive into the privacy and civil liberties of U.S. 10:21.760 --> 10:24.820 persons, and that it was extremely expensive. 10:24.820 --> 10:34.180 In the few years that it operated, since 2015, the program cost about $100 million. 10:34.700 --> 10:51.560 And for that $100 million, where they collected a very, very, very large number of details about telephone calls, the NSA produced 15 intelligence reports. 10:51.560 --> 11:01.060 Of those 15 intelligence reports, the Federal Bureau of Investigation, the FBI, concluded that only two had information the FBI was unaware of. 11:01.060 --> 11:07.640 So for years in collecting a massive number of calls by U.S. 11:07.640 --> 11:12.760 persons, there were only 15 reports that were generated from this. 11:12.760 --> 11:19.520 It was sort of shooting, you know, it was literally looking for a needle in a haystack to try and find something. 11:19.560 --> 11:35.260 There were also numerous compliance incidents and data integrity concerns with the program as well, so much so that a little over a year ago, the NSA decided on its own that it should shut the program down. 11:35.260 --> 11:46.960 And we certainly concurred in that decision and put out a report to improve transparency into how this program had operated. 11:46.960 --> 11:51.240 In my view, it was the digital equivalent of the bridge to nowhere. 11:51.300 --> 11:59.200 The NSA has deleted all of the records associated with it and the authority for the program has now expired. 11:59.460 --> 12:07.320 We're doing, in addition to the CDR project, we have several ongoing projects that we're working on right now. 12:07.660 --> 12:16.340 A few examples of those are, we're looking at the use of open source intelligence by the Federal Bureau of Investigation, right? 12:16.340 --> 12:27.940 Essentially gaining access to commercially available databases or how they might mine social media or other open source materials for investigatory purposes. 12:27.940 --> 12:40.860 We are looking at the terrorist watch lists that are out there and, you know, sort of standards around who gets on them, how you get on them, how you get off them, you know, what protections are in place to protect privacy and civil liberties. 12:40.860 --> 12:49.780 We're looking at a Department of Treasury program, the Terrorist Finance Tracking Program, as well to examine that. 12:49.780 --> 13:01.480 And then we are looking at a program operated by DHS, the Department of Homeland Security, looking at biometrics and the use of biometrics in airports. 13:01.480 --> 13:19.860 As many of you may be aware, the Department of Homeland Security uses a series of biometric collection tools in airports, you know, everything from fingerprints to facial recognition technology. 13:19.860 --> 13:39.900 Our project definitely has a huge focus on facial recognition technology and it's used by the Transportation Security Administration, by Customs and Border Protection, and by airlines and others to sort of examine right now what is mostly a pilot program, 13:39.900 --> 13:50.620 but that DHS certainly anticipates rolling out long-term at all entry and exit points in the United States going forward. 13:50.620 --> 13:55.120 So that, Stephanie, is, you know, that's a lot of information about some of the work that we're doing. 13:55.120 --> 14:03.060 I definitely did not share everything, but hopefully that answers the initial question. 14:03.060 --> 14:03.800 Absolutely. 14:03.800 --> 14:06.460 You've given a lot to talk about. 14:06.460 --> 14:13.620 And so let me just dig a little further into two specific things that you mentioned. 14:14.160 --> 14:32.540 The report that this PCLOB produced on the Called Detail Records Program, this, of course, isn't the first time the PCLOB, under different members, I should say, looked at the Called Detail Records Program. 14:32.920 --> 14:51.000 One of the things that caught my eye about the current board's evaluation of this program is you all were really able to shed light on the cost of this program versus the efficacy, the results. 14:51.000 --> 15:10.660 And I think you really illuminated for perhaps the federal government and certainly the public that, you know, one of the things that needs to be considered is whether we're really getting a bang for our buck with these kinds of programs. 15:10.820 --> 15:25.740 So were you surprised at how expensive this program was versus kind of the limited end product that it produced? 15:26.140 --> 15:28.880 Oh, I definitely was surprised about the disparity. 15:28.880 --> 15:36.200 I mean, when I saw 15 reports, and I know everything that had to go into operating this program, I knew it was extremely expensive. 15:36.200 --> 15:48.160 And, you know, as you may be aware, under the statutory authority that was available to the NSA, they had the ability to pay telecommunications carriers to actually participate in the program. 15:48.160 --> 15:53.540 And so, you know, that is an expensive endeavor as well that's involved. 15:53.540 --> 16:07.300 So it was very important to me that we understand the cost of the program, because as we are evaluating, you know, the impact on privacy and civil liberties, we ought to compare that to the effectiveness of the program and also the cost of the program. 16:07.300 --> 16:25.500 You know, a billion dollars to intrude into people's privacy and civil liberties and get almost nothing from it is, you know, is not really worth, you know, the program in terms of advising Congress, you know, about whether or not the program should be extended or advising the executive branch about whether or not it should be ended. 16:25.500 --> 16:41.540 So I do believe that it is critical that we have an understanding of just how much these programs cost so that we can really weigh the benefit of the programs against the expenses to not only the privacy and civil liberties, but also to the public fisc. 16:42.280 --> 16:48.400 So in agreeing with you on that point, I should have said at the beginning that my name is Stephanie Pell. 16:48.400 --> 17:05.140 I'm a professor at West Point, but anything that comes out of my mouth, although this interview is about your views, but anything that happens to come out of my mouth are my views and do not represent the views of the Army, West Point, or the federal government at large. 17:05.140 --> 17:08.300 So anyway, but I agree with you. 17:09.360 --> 17:23.080 So moving on, you mentioned an ongoing project where the P-CLOB is looking at DHS's use of biometric technologies in airports. 17:23.080 --> 17:55.140 I'd like to broaden the biometric technology discussion a little further with you and just recall the story that many of us have read in the Washington Post about a man named Robert Williams, who is an African-American man who was arrested at his home in front of his children and held for a night in jail due to a misidentification based on a facial recognition algorithm. 17:55.140 --> 18:05.820 So in other words, he was arrested based on this misidentification for a crime he did not commit and was held in jail overnight. 18:06.540 --> 18:25.940 And I would say that unfortunately, as horrible as this was, we shouldn't be terribly surprised as we've known for some time that facial recognition technologies disproportionately misidentify people of color and women. 18:26.080 --> 18:40.100 So how would you address the disparate impact that facial recognition technologies have on communities of color and more broadly, what concerns do you have about how the U.S. 18:40.100 --> 18:46.200 government collects and uses information produced by biometric technologies? 18:46.960 --> 18:58.560 We all know and have known for a very long time that facial recognition technology has a propensity to misidentify people of color and women. 18:58.560 --> 19:01.300 There are numerous studies on this. 19:01.300 --> 19:19.560 In 2018, the MIT Media Lab produced a study that found that there was an inability of facial recognition algorithms to identify or misidentify people of color. 19:19.560 --> 19:39.860 Last year, the NIST, which is a federal government agency, put out a report looking at 200 facial recognition algorithms and finding evidence of bias along issues of skin color. 19:41.300 --> 19:53.620 There was bound to be a time, if not many times that have happened, but one that we now know of, where a person of color would be misidentified by a facial recognition algorithm. 19:53.620 --> 19:56.000 I refer to these as race breaches. 19:56.000 --> 20:02.440 This is essentially a breach that is taking place in the algorithm. 20:02.740 --> 20:27.900 I think that going forward, if the government is going to rely upon facial recognition technology, it has a responsibility, a duty, to ensure that people of color, women, are not disproportionately misidentified or adversely impacted by these particular technologies. 20:28.220 --> 20:50.700 Part of that is by making sure that before any facial recognition technology is deployed, that the government or any public authority has given a real strong consideration to the impact that this particular algorithm will have in this particular use case on communities of color. 20:50.700 --> 21:12.840 That means really beginning to think about not just does this particular program impact privacy and civil liberties, but recognizing when that impact disproportionately impacts a particular community and ensuring that the government is taking mitigating steps or taking any steps to remediate that disproportionate impact. 21:12.840 --> 21:24.020 It's about making sure that when we are thinking about the deployment of a technology like a facial recognition technology, that we're thinking about equality. 21:24.040 --> 21:37.220 And that from the beginning, we are building in place protections that are designed to ensure that these programs do not operate in a manner that disproportionately impacts people of color. 21:37.220 --> 21:39.200 I call this equality by design. 21:39.200 --> 21:42.280 Many people may be familiar with the concept of privacy by design. 21:42.280 --> 21:51.780 That is building privacy into a new product so that it respects it from the beginning and doesn't collect any more information, for example, than it needs to. 21:51.780 --> 21:54.380 Well, we ought to do the same thing around civil rights concerns. 21:54.380 --> 22:05.560 We ought to build equality into the very design of the product from the beginning so that ultimately it minimizes any impact that it's going to have on communities. 22:05.560 --> 22:13.480 I don't know that at the end of the day that's ultimately going to solve the problem with bias in facial recognition algorithms. 22:13.480 --> 22:27.800 We've seen a number of corporations over the last two months begin to pull away from their facial recognition products that were being sold or marketed to law enforcement. 22:27.800 --> 22:31.120 IBM, for example, has stepped back from it. 22:31.120 --> 22:35.680 As have Microsoft and Amazon, all making announcements. 22:35.680 --> 22:43.960 And we've seen several cities now and states begin to look at whether to ban facial recognition technology and its use by law enforcement. 22:43.960 --> 22:45.180 San Francisco's done it. 22:45.180 --> 22:46.460 Boston has done it. 22:46.460 --> 22:54.440 In fact, the Massachusetts legislature, it looks prime to ban it in the state for use by law enforcement. 22:54.440 --> 23:12.580 And I think there's no doubt that one of the primary factors that are motivating these companies as well as these governments to limit the use of facial recognition technology is they haven't often gotten the issue of bias along racial lines correct. 23:12.580 --> 23:37.900 And as long as that's there, we have to be mindful about rolling this technology out so that we don't end up in a world where we now have digital biometric technologies that essentially are discriminating against people of color in the same way that so many people of color have experienced for decades or centuries in this country. 23:37.900 --> 23:54.020 We don't want a world where one segment typically has to go through a secondary inspection or additional questions or is presumed guilty just by their image. 23:54.020 --> 23:56.620 That is the world that we're trying to avoid right now. 23:56.620 --> 24:11.980 And the last thing we want to do is hard-code that into the 21st century by beginning to deploy new technologies for the government to use that could ultimately disproportionately impact and be adverse to people of color. 24:11.980 --> 24:46.240 So you are really calling for, it's not a new discussion, but broadening the discussion, not just about privacy by design and looking at the privacy impacts of government use of certain technologies, but a specific focus on how the use of those technologies could have a disparate impact on marginalized or communities of color. 24:46.240 --> 24:56.120 Because if not, we risk using technology to further facilitate racism at scale. 24:56.620 --> 24:57.780 That's exactly right. 24:57.780 --> 25:00.600 These algorithms are created by humans. 25:00.600 --> 25:06.620 These humans may have biases or the way that the algorithm is trained could be biased. 25:06.620 --> 25:08.400 Those are easy examples. 25:08.400 --> 25:19.300 But what I am saying is we shouldn't just think about the impact of a program on this amorphous concept of privacy that really focuses on the privacy of the majority. 25:19.300 --> 25:37.440 When there is a disproportionate impact on vulnerable communities or disproportionate impact on historically disenfranchised or disadvantaged communities, we ought to be looking at that program and scrutinizing it even more. 25:37.440 --> 25:39.280 And I think that's what's missing right now. 25:39.280 --> 25:43.420 What's missing right now is we often just think about privacy writ large. 25:43.420 --> 25:50.900 We don't actually think about how the privacy of the minority is being disparaged by a particular program. 25:50.900 --> 26:05.840 The last thing we want to do is have a world where the privacy and civil liberties of the majority is protected while the privacy and civil liberties of the minority is disregarded or otherwise disproportionately impacted. 26:05.840 --> 26:09.660 We don't want privacy to be a luxury good to anyone. 26:09.980 --> 26:10.840 Right. 26:11.120 --> 26:17.000 And it, you know, at times it's had a tendency to be that way, unfortunately. 26:17.520 --> 26:36.060 So I'd like to now talk with you about a letter you wrote, I believe last month, because we're still in July, to the acting secretary of DHS in your official capacity as a PCLA board member. 26:36.060 --> 26:56.700 And you wrote to express your concerns and to raise questions about a DHS program requiring all air travelers to submit to mandatory DHS-administered temperature checks or thermal imaging before boarding a commercial airline. 26:56.940 --> 27:04.720 What were some of the concerns that you expressed in your letter to the acting secretary of DHS? 27:04.720 --> 27:06.900 And have you received a response? 27:06.900 --> 27:16.040 And my understanding also is that some members of Congress have now taken up this cause and concern with you. 27:16.260 --> 27:19.360 Yeah, I have several concerns about this program. 27:19.360 --> 27:30.840 The plan, as I understand it, is for the TSA to administer temperature checks at security checkpoints in airports. 27:30.840 --> 27:45.780 My understanding is that this has been requested by various airlines, in part because they don't want to administer them and because they don't want to pay for the temperature checks that would be administered. 27:45.780 --> 28:01.100 I have strong concerns about the efficacy of temperature checks or fever checks at detecting whether someone is infected with COVID-19. 28:01.100 --> 28:06.600 As you may know, there are many reasons why someone would have a fever. 28:06.600 --> 28:16.740 COVID-19 is one reason, but there are a host of other reasons that range from an illness to a condition, you know, a heart condition, for example. 28:16.740 --> 28:27.580 Or maybe the person had just been running through the airport to get from the check-in desk to their flight because they're late. 28:27.580 --> 28:44.000 I'm also equally concerned that if someone wanted to suppress their temperature or their fever, that that's also easy to do by taking aspirin or ibuprofen, for example, or just putting a little ice on your head for a little while before you walk up to the checkpoint. 28:44.000 --> 28:54.420 Thirdly, it's not apparent to me that TSA agents are trained in asking questions or administering public health examinations. 28:54.420 --> 28:58.640 And so, you know, it's not... 28:58.640 --> 29:11.280 I have no idea how TSA would plan to train these agents, whose mission is supposed to be the security of air travel, not necessarily the public health of air travel. 29:11.280 --> 29:16.780 I'm not saying that, you know, there aren't public health experts in the government that do have the training to do this. 29:16.780 --> 29:20.860 Namely, you know, the Center for Disease Control, the CDC, would have this expertise. 29:20.860 --> 29:30.500 But the CDC has already publicly stated, or at least, you know, information has been made publicly available, that they don't want to participate in this program because it's not effective. 29:30.500 --> 29:32.820 So there are concerns about efficacy. 29:32.860 --> 29:37.500 There are concerns about, you know, the authority that TSA has to administer this program. 29:37.500 --> 29:41.840 And there are also concerns about the government's collection of this information. 29:41.840 --> 29:43.120 What are they collecting? 29:43.120 --> 29:45.880 What are they going to do with this information? 29:45.880 --> 29:48.160 What database is it going to go into? 29:48.160 --> 29:50.440 And how is this going to impact travel? 29:50.440 --> 29:54.820 Are they going to ban individuals, passengers, from traveling for 14 days? 29:54.820 --> 29:58.740 Are they going to create a no-fly list or add you to the no-fly list? 29:58.740 --> 30:08.660 What happens if you come with a doctor's note that actually says, I just got tested yesterday and I don't have COVID-19 even though I have a fever? 30:08.660 --> 30:15.460 Or, more importantly, you know, who's going to reimburse the individual for the plane ticket that they won't be able to take? 30:15.460 --> 30:18.160 Are they going to be guaranteed refunds by TSA? 30:18.160 --> 30:20.640 Are they going to be guaranteed a seat in 14 days? 30:20.640 --> 30:22.820 What if they're going for their cancer treatment? 30:22.820 --> 30:27.580 Are they going to be denied access to the right to travel to their doctor? 30:27.760 --> 30:33.020 Or are they going to be, you know, told to just go home and stay at home and wait? 30:33.020 --> 30:43.500 It just seems that there are so many questions that not only haven't been answered about what they're collecting and what they're doing with this, but also the impacts and how this is going to impact the traveling public. 30:43.500 --> 30:50.180 I also have concerns about the disproportionate impact that this program may have on people of color. 30:51.160 --> 30:59.300 CDC has put out several reports on how COVID-19 is disproportionately impacting people of color. 30:59.540 --> 31:05.640 African Americans are more likely to die from COVID-19 than are other groups. 31:05.640 --> 31:14.140 African Americans and Latinos are more likely to be hospitalized and Native Americans are more likely to be hospitalized than other groups. 31:14.140 --> 31:32.460 If we assume that COVID-19 disproportionately impacts people of color, then we should assume that a program that is designed to root out COVID-19 is going to ultimately end up disproportionately impacting people of color. 31:32.460 --> 31:53.380 And it is extremely troubling to me that the right to travel and travel by air when in many instances there isn't an adequate substitute that would be available to those folks, that they would somehow be denied the right to travel and that could impact your job, 31:53.380 --> 32:02.560 it could impact your health, it could impact your family or personal situation in ways that are, I think, potentially deeply troubling. 32:02.560 --> 32:07.360 And so I'm hopeful that DHS will rethink this program. 32:07.360 --> 32:18.520 Several members of Congress are also on both sides of the aisle, Republicans and Democrats, seem to be concerned not only about the efficacy but the impact on privacy and civil liberties of this program. 32:18.520 --> 32:28.060 And hopefully TSA and DHS will come to its senses and realize that it shouldn't be in the business of administering temperature checks in airports. 32:28.060 --> 32:54.460 And if they do want to actually increase the actual safety of air travel with respect to COVID-19, there are other measures that numerous experts have reported on that airlines, for example, could take to better secure air travel and to better ensure that it's a healthy experience for all passengers. 32:55.640 --> 33:02.880 Well, I look forward to what, if any, responses are forthcoming. 33:04.520 --> 33:14.060 So, as you mentioned before, the PCLOB had broad discretion and authority to conduct oversight and provide advice to the U.S. 33:14.060 --> 33:30.640 government with respect to the implementation of executive branch policies, procedures, regulations, and information-sharing practices relating to efforts to protect the nation from terrorism in order to ensure that privacy and civil liberties are protected. 33:30.640 --> 33:39.060 So, this authority therefore covers the activities of both law enforcement and intelligence agencies. 33:39.100 --> 33:55.740 And given the scope of the board's discretion within the context of terrorism programs, if you alone could determine the priorities for the PCLOB, what projects would you add to its current slate? 33:56.260 --> 33:58.140 That's a very good question. 33:58.660 --> 33:59.940 There are many. 33:59.940 --> 34:20.000 I think there are so many issues within our jurisdiction for us to look at that, you know, the challenge we really do face is balancing the limited resources we have with the projects that really do stand to benefit from oversight by the PCLOB. 34:20.000 --> 34:25.370 Among the topics that I would prioritize would be stingrays. 34:25.420 --> 34:50.480 Many folks may be aware of the existence of a cell site simulator technology that would allow someone to intercept telephone calls as well as text messages if they, you know, run a stingray near your location. 34:50.480 --> 35:01.740 I think it's important for us to examine the use of stingrays by the intelligence community and the efforts to protect the nation against terrorism. 35:01.740 --> 35:10.120 I'd also think that there'd be some value in the PCLOB looking at when components of the U.S. 35:10.120 --> 35:26.720 government decide to use hacking tools and beginning to think about what standards are around those, who they can be used against, what approvals need to be put in place, how they can be secured to ensure that they don't get into the hands of an adversary, 35:26.720 --> 35:31.800 which unfortunately we've seen happen more than once. 35:32.400 --> 35:38.220 Thirdly, I'd want to look at a full review of the Foreign Intelligence Surveillance Act, FISA. 35:38.220 --> 35:43.580 I think there are a lot of issues there that we could explore. 35:43.580 --> 36:03.080 Everything from the use of foreign intelligence surveillance information in criminal prosecutions to the approvals for those authorities by courts, whether intelligence courts or traditional Article III federal courts, your normal U.S. 36:03.080 --> 36:11.240 District Court, to looking at the amicus program that operates under FISA. 36:11.240 --> 36:18.160 But I think there's just a lot of work around FISA for the board to do, and that itself could be full-time. 36:18.160 --> 36:21.640 I'd also want to look at domestic terrorism issues. 36:21.640 --> 36:30.460 Typically, the board in the past has spent almost all of its energy focused, if not all of it, focused on foreign terrorism, yet we know that the number one threat to U.S. 36:30.460 --> 36:32.280 persons is actually domestic terrorism. 36:32.280 --> 36:34.740 This has been the case for centuries. 36:34.740 --> 36:40.160 This isn't a new evolution, and in fact, every year it's a greater threat. 36:40.160 --> 36:49.060 But we don't spend a lot of time really looking at the privacy and civil liberties impacts around the domestic terrorism. 36:49.060 --> 37:05.200 And then, I think probably finally, I'd want to look at the sharing of national security information with non-national security agencies, such as immigration and customs enforcement. 37:05.840 --> 37:14.620 Really beginning to think about the extent to which national security authorities are being used for non-national security purposes. 37:14.620 --> 37:29.660 And I think that's an important task for us to take because more and more government databases are being created that are intended to integrate consolidate information from a lot of sources, and once they're in there, they're very hard to get out. 37:29.660 --> 37:32.060 It's sticky data once it's in there. 37:32.060 --> 37:40.000 So I think it's important for us to get a greater understanding of a lot of these intelligence-sharing authorities and tools that are being used. 37:40.120 --> 37:49.320 Well, that is certainly a worthwhile and very expansive list of projects. 37:49.320 --> 37:57.680 I will just take moderator's privilege and say perhaps that is an argument for more resources for the Privacy and Civil Liberties Oversight Board. 37:58.760 --> 38:20.880 So, I'll piggyback that comment to the next question and say given the Privacy and Civil Liberties concerns that spring from law enforcement use of new and emerging technologies, you've talked about a number of examples, facial recognition, other biometric technologies, 38:20.880 --> 38:41.560 big data analytics, you mentioned stingrays in a counterterrorism or terrorism-focused context, but could you see an important role for the PCOB to play beyond the specific frame of privacy and civil liberties in the context of protecting our nation from terrorism? 38:41.560 --> 38:59.420 And I guess what I'm asking is, should Congress expand the PCOB's jurisdiction to oversee and address privacy and civil liberties concerns beyond that reach beyond the nation's counterterrorism efforts? 38:59.740 --> 39:08.980 Well, look, far be it for me to decide for Congress what the jurisdiction of our agency should be. 39:08.980 --> 39:16.140 You know, that's a question for Congress and , you know, they regularly consider it. 39:16.160 --> 39:30.640 In my view, privacy and civil liberties concerns have only increased over the last decade or two decades. 39:30.640 --> 39:46.820 And those concerns about government or even corporate surveillance are such that there needs to be some agency that is looking into those issues. 39:46.820 --> 39:55.560 One easy example of that is, you know, everything that's happening right now in COVID-19 and the pandemic. 39:55.560 --> 40:27.060 You know, we have a lot of debate right now about contact tracing and a lot of debate about what authorities are needed for public health agencies to collect data about each of us not only to help find a vaccine but also to be able to go back and contact individuals that someone who's infected may have been in touch with the prior 14 days. 40:27.060 --> 40:35.840 There are a lot of expansive authorities that are being used by government agencies because we are in a pandemic. 40:35.840 --> 40:38.040 Quarantine, for example. 40:38.040 --> 40:42.180 You know, I mean, imagine the impact of a quarantine on privacy and civil liberties. 40:42.180 --> 40:53.600 Yet we don't actually have an agency in the federal government that's tasked with looking at the privacy and civil liberties impacts of all the activities around the pandemic. 40:53.600 --> 40:57.500 What agency is going to look at that, for example? 40:57.500 --> 41:13.080 And we don't have agencies that are devoted towards looking at the privacy, independently looking at the privacy and civil liberties impacts of the general activities of the Federal Bureau of Investigation for example. 41:13.080 --> 41:18.320 So at least in my view, I think it's high time for the United States to have two things. 41:18.320 --> 41:24.040 One is you know, a basic federal privacy legislation. 41:24.040 --> 41:24.700 We need it. 41:24.700 --> 41:38.640 And number two is, you know, an agency or more, or two you know, choose the number of agencies that are committed to the task of protecting the privacy and civil liberties of the U.S. 41:38.640 --> 41:39.100 public. 41:39.100 --> 41:43.460 And that may be in the corporate, but it also, frankly should be in government. 41:43.460 --> 41:54.300 And making sure that there is some independent check out there on the expansive use of surveillance authorities, whether or not they involve terrorism. 41:57.000 --> 42:10.160 So switching gears a bit, as we mentioned at the beginning, in addition to your role as a PCAW board member, you're a partner at the Cooley Law Firm with very interesting privacy and cyber security practice. 42:10.160 --> 42:23.380 And of course, as a practicing lawyer, everything you do in that role is not public and in addition, due to obligations to your clients, there are limitations on what you can discuss publicly. 42:23.380 --> 42:35.220 However, there are two interesting cases involving the Computer Fraud and Abuse Act that you've been litigating, that have received some press coverage. 42:35.220 --> 42:40.580 And to my knowledge, these are the first two cases of their kind. 42:40.580 --> 42:47.040 So the first case that I'm going to refer to is the Broidy case, where on behalf of Mr. 42:47.040 --> 42:55.260 Broidy, you sued the country of Qatar and a number of individuals for their role in hacking and leaking Mr. 42:55.260 --> 42:56.620 Broidy's email. 42:56.620 --> 43:21.280 And as one news outlet reported, quote, this is a case about a hostile intelligence operation undertaken by a foreign nation against American citizens who have spoken out against that country's support for terrorism and who have entered into significant business relationships relating to defense and counterterrorism with a rival nation. 43:21.280 --> 43:45.800 The other case involves a lawsuit by WhatsApp against the NSO group, an Israeli-based spyware firm, alleging that NSO's Pegasus spyware was, among other things, used to hack phone systems of 1,400 users between April 2019 and May 2019. 43:45.800 --> 44:05.600 There are very interesting aspects of both of these cases, but let me ask you, because these cases illustrate how foreign governments are increasingly attacking individuals hacking their phone networks. 44:05.600 --> 44:08.940 What do you think we should do about this problem? 44:09.820 --> 44:17.300 There is no doubt that numerous nation states are targeting U.S. 44:17.300 --> 44:25.100 persons and corporations in hacking campaigns. 44:25.680 --> 44:39.240 Not only are they you know, sometimes they are doing this to gain access to embarrassing information about an individual and then to release it. 44:39.240 --> 44:52.820 Other times, they are using it to gain access to the intellectual property of a company which they will exploit, either by giving it to a competitor or releasing it. 44:52.820 --> 45:00.500 Other times, they are gaining it to... seeking access to engage in a disinformation campaign. 45:00.520 --> 45:22.780 All the while, no matter how much a company or individual invests in cyber security protections and safeguards, many of these nation states have almost unlimited resources and ability to continue to target that entity . 45:22.980 --> 45:30.740 Even when you have the best security, they are likely at some point to find a way in. 45:30.740 --> 45:35.100 And that way in may not be through the CEO. 45:35.120 --> 45:46.540 That way in may be through the CEO's executive assistant or the CISO's spouse may be a way in there. 45:46.540 --> 45:54.620 These are sophisticated campaigns that are being engaged in against Americans. 45:54.620 --> 46:03.280 And when these are brought to the attention of law enforcement, they're limited in what they can do. 46:03.280 --> 46:09.480 Yes, it's possible to indict a Chinese person or two or three. 46:09.480 --> 46:13.580 And someday those people may be brought to justice. 46:13.580 --> 46:25.820 But today, that's not going to stop that company that's been impacted by this from having a lot of trouble as a result of the hack. 46:25.820 --> 46:40.960 And unfortunately, litigation too has its limitations due to a law called the Foreign Sovereign Immunity Act. 46:40.960 --> 46:56.520 The acronyms are all the same, the Foreign Sovereign Immunity Act, which essentially gives any foreign government immunity from litigation in the United States with a couple of exceptions. 46:56.520 --> 47:14.100 It is now time for the United States to really rethink the Foreign Sovereign Immunity Act and to rethink the extent to which it ought to be used as a defense by foreign nation states that hack U.S. 47:14.100 --> 47:16.140 civilians and U.S. 47:16.140 --> 47:17.040 corporations. 47:17.260 --> 47:25.600 And unless the government really steps up to protect us, we are all limited in our ability to do that. 47:25.600 --> 47:33.920 There has been some legislative movement on the Hill looking at this particular issue in Washington, D.C. 47:33.920 --> 47:41.820 I'm hopeful that Congress will be able to address this issue because it's not just that the privacy of U.S. 47:41.820 --> 47:56.800 persons is being put in jeopardy, but there are hundreds of millions, if not billions of dollars that are also being put in jeopardy as a result of the ability of foreign nation states, rogue nations, as well to target U.S. 47:56.800 --> 48:00.140 persons and companies for cyber attacks. 48:03.140 --> 48:25.400 This is a complicated problem to solve and I imagine in addition to what you have mentioned, we're going to have to consider how this reflects of course on U.S. 48:25.400 --> 48:39.200 policy as well and how we engage and use our capabilities with respect to other people in other foreign nations. 48:39.200 --> 48:55.220 So I will not elaborate beyond that, but I want to very much thank you for your time and giving us some deeper insight into the work of the Privacy and Civil Liberties Oversight Board. 48:55.280 --> 49:01.020 Hope to continue this conversation with you in person, maybe in Vegas next year. 49:01.380 --> 49:03.300 Thank you so much, Stephanie. 49:03.300 --> 49:05.140 It was great to see you. 49:05.140 --> 49:10.900 A wonderful conversation and I too hope we can continue this conversation next year in Vegas. 49:10.900 --> 49:12.840 Take care.