How is misinformation impacting people online?

Beth Goldberg: So I think the conspiracies often give people that hope and that community, first and foremost. The ideology, the actual details of the belief is really secondary.

Dave Bittner: Hello, everyone, and welcome to "Caveat," the CyberWire's privacy, surveillance, law and policy podcast. I'm Dave Bittner, and joining me is my co-host, Ben Yelin, from the University of Maryland Center for Health and Homeland Security. Hello, Ben. 

Ben Yelin: Hello, Dave. 

Dave Bittner: Today, Ben shares the story of a harsh FTC order against Drizly and its CEO for data privacy abuses. And later in the show, my conversation with Beth Goldberg from Jigsaw on misinformation and its impact on people online. While this show covers legal topics and Ben is a lawyer, the views expressed do not constitute legal advice. For official legal advice on any of the topics we cover, please contact your attorney. 

Dave Bittner: All right, Ben, we got some good stories to share this week. Why don't you start things off for us here? 

Ben Yelin: So my story comes from the Washington Post technology page by Cat Zakrzewski, and it was about a new FTC order against the alcohol delivery company Drizly and its CEO, James Cory Rellas. So Drizly is an alcohol delivery company. I'm not a big drinker, so I never used it. Apparently, it was very popular, is very popular, particularly as people wanted to order booze at home during the pandemic. 

Dave Bittner: Yes. 

Ben Yelin: But apparently - yes, as I'm sure many of you can relate. Apparently, their data privacy practices were not robust, according to the FTC. The article here and the FTC estimates that the data of over 2.5 million customers were compromised because of negligent data privacy policies from this company. 

Ben Yelin: So the FTC has a new commissioner who promised to come in and - harsher penalties for these types of data privacy violations. And that's exactly what her and the rest of the FTC has done here. So in a new order that was released this week, the FTC is imposing penalties on both the company, Drizly - which was purchased by Uber while this case was going through litigation - and the CEO, James Cory Rellas, for these - anyway, imposing penalties for these data privacy violations. What's unique about this order is that it applies against the CEO even if he decides to move to a different company. And though these sanctions don't include significant monetary penalties, there are required actions that both the CEO and Drizly have to take going forward, including things like instituting multifactor authentication and other data security best practices. 

Ben Yelin: So what the FTC has done here is set a new precedent where the CEO of a company is being held liable even if he decides to move on. And I think one thing that motivated the current members of the FTC is the backlash to the order against Facebook and Cambridge Analytica, where Mark Zuckerberg himself was not held liable, wasn't forced to pay any penalties, wasn't even named in the order. So there's some level of personal accountability that was missing. And with this ruling, if this becomes a precedential ruling and it's something that the FTC continues to do when we see these data privacy violations, perhaps that's an increased incentive for these CEOs to institute best practices because they can't just skip away from the company, go somewhere else and be free from these sanctions and penalties. 

Ben Yelin: So it's really a groundbreaking decision. We've seen other decisions where individuals have been named and held accountable and are forced to do something under FTC orders. But usually, those are cases involving fraud or misleading advertising. This, at least to my knowledge, is the first time that this standard has been applied to faulty data privacy and data security practices. So it's really the FTC paving a new road here that hopefully will leave organizations and, most importantly, the leadership of those organizations to be more careful about protecting personal data. 

Dave Bittner: So help me understand here exactly - to what degree does the FTC have the authority to enforce things? Do they - you know, can they send someone to jail? You know, what - how strong are they? 

Ben Yelin: Not very strong. Until we have a federal data privacy statute that gives them greater enforcement powers, they're going to be hamstrung. I mean, really, the order here is forcing the company and the CEO to adopt data security practices. There are not significant financial penalties. There's obviously no criminal liability here. No one's slapping handcuffs on the CEO. I think the question that we might see answered as a result of this case is, is this type of punishment - or, I guess, you know, as they refer to it as - at our kid's day care, corrective action... 

Dave Bittner: (Laughter). 

Ben Yelin: ...A type of behavior intended to change the instinct of these CEOs and redirect them in a more positive direction. Is that going to be enough of an incentive for them to actually make changes? And I think the tools the FTC has certainly leaves that an open question. I don't think there's enough of a stick that they're going to be that threatened when the FTC comes out with an order like this. It would still be better for them to comply, both for the legitimacy of the company, the reputation of the CEO. And there are certain things that the FTC can do in terms of additional fines. But no one's getting handcuffs slapped on them. We're not talking about massive financial penalties here. Until we have a data privacy statute that allows the FTC to really go after these companies for shoddy data security practices, then I think we're left with this sort of patchwork where the FTC can use the powers it has, but those powers are relatively limited. 

Dave Bittner: So in terms of the CEO, the fact that the FTC is having some of these things stick to the CEO, regardless of whether or not they leave the company, does that have the potential to make the CEO kind of radioactive so that, you know, the next company could say, hey, you've got this stink on you. You know, we're going to think twice about bringing you on board. 

Ben Yelin: Yeah. And it's also - beyond just the general stink, it means that there's going to be a watchful eye on the company from federal regulators. If he takes over a separate service, then there's going to be some sort of suspicion because of the past experience with Drizly. And I think the company is going to face greater compliance costs as they try to avoid additional penalties. The one limiting factor here is kind of what we were talking about. The FTC itself, not only are their powers limited, but their resources are limited. So anonymous staff members to the FTC said to the author of this article that the agency lacks the personnel and technical expertise to effectively monitor and enforce most of these orders. You can see why they wouldn't want to say that publicly. But I think that's going to be a limiting factor here on how big of an impact this has on the company, the CEO and the industry at large. 

Ben Yelin: I think what the signal here is, is the FTC is willing to use the full extent of the powers that it currently has in a way that past FTCs have not been able to do. That's certainly noteworthy. I think if you really cared about holding these companies and CEOs accountable with actual, massive financial penalties, civil penalties or potentially some type of criminal sanction, I think we're just going to have to wait on Congress to pass a data privacy law. And that's ultimately one of the main things that a federal data privacy law would do, is it would empower the FTC with additional staff to make sure they do have technical expertise and personnel to enforce some of these orders. That would be part of a federal data privacy bill. But until that's enacted, we're just sort of in this area where the FTC is going to do the best that it can, even if it's not going to have that much of a ripple effect on the industry at large. 

Dave Bittner: And to what degree is the FTC generally independent, or do they go with the - you know, the headwinds of whatever president might be in power? 

Ben Yelin: So they are political appointees, but once they are sworn in, there's not a direct line of accountability to the president. So it's not like the head of a separate federal agency, like a cabinet secretary, where they serve at the pleasure of the president. Currently, the FTC has a Democratic majority, or at least a majority of their commissioners were appointed by President Biden. There still is one Republican member of the FTC whose term has not expired. So they do have a certain degree of independence. I think, because President Biden has been able to put his stamp on the FTC, especially with this Chairwoman Khan, who was just sworn in a couple of months ago, I think you're going to see it reflect his policy priorities, which are greater, more robust data privacy protections. 

Ben Yelin: The Republican member of the commission dissented from the part of the order here that held the CEO accountable, basically saying that this was going to have a adverse impact on businesses and their ability to operate independently and that we should not be subjecting businesses to the judgment of commissioners on the FTC. I think that's the difference between Democratic appointees to this commission and Republican appointees. And certainly if we were to have another change in party at the White House, you might see the FTC revert back to where it had been previously. So there isn't a direct line of accountability, but certainly I think the current majority on the FTC reflects the will of the current administration. 

Dave Bittner: All right. Well, it's an interesting story, for sure, and we will keep an eye on it. I suppose part of me thinks, yay, (laughter) there's accountability. Imagine that, right? 

Ben Yelin: I know. I mean, I like the idea of leadership being held accountable and it not just being something attached to the company because oftentimes... 

Dave Bittner: Right. 

Ben Yelin: ...I think leaders end up being immune from these types of orders. They move on to their next gig, and they're not the ones who are subject to these penalties. And I think... 

Dave Bittner: Yeah. 

Ben Yelin: ...So much of instituting robust security practices is buy-in from CEOs, from the C-suite. I think we're more likely to have that type of buy-in if the FTC is willing to impose accountability on them. 

Dave Bittner: Right. So my story this week also comes from The Washington Post. This is a story by Devlin Barrett, Perry Stein and Ellen Nakashima. And I'd say this is probably the big story this week when it comes to - for those who are following the law enforcement beat, there was a press conference this week from the DOJ where they brought out the big guns (laughter) - the head of the department, Mr. Merrick Garland, attorney general - who talked about 10 Chinese spies and government officials have been accused of malign schemes. Ben, first of all, one of the things that struck me about this press conference was that they were a little cagey about it. 

Ben Yelin: Yeah, there was a lot of speculation on Twitter because DOJ put out an announcement that said, major law enforcement action to be announced at 1:30 or whatever. And everybody's like, is it Trump? 

Dave Bittner: Right, and so just a lot of people were - right, exactly, exactly. But no. It was not. 

Ben Yelin: It was not. 

Dave Bittner: It was about - no, it was about China. So evidently, a couple of Chinese intelligence officers have been charged with trying to get information to a Chinese-based telecommunication company. And the DOJ is saying that Beijing is trying to lie, cheat and steal its way into a competitive advantage in technology. Ben, what did you make of this? 

Ben Yelin: So there are a couple interesting elements of this. One is that the source for this was a double agent. So the FBI employed somebody who pretended to be a friendly U.S. intelligence agent, presented himself or herself - that part remains classified - to the Chinese as somebody who was on their side, who was willing to divulge trade secrets about a company that's suspected to be Huawei, although that is not confirmed in the indictments. But it turns out that this agent was working actually for our intelligence agencies and the Department of Justice. So another case of just talking to the wrong people - you cannot trust anyone. So I think this was very good investigative work, and I think the director of the FBI and Attorney General Garland were very thankful for this double agent for doing the difficult work here. 

Ben Yelin: In terms of the content of it, I mean, I think this is part of a broader struggle to protect our intellectual property rights from Chinese aggressors. We've seen that manifest itself in a number of ways. I think the DOJ is taking a harsher tack against the Chinese to try and build up some sort of disincentive so that they'll stop engaging in this type of espionage. In terms of the expected impact, I mean, I think it's going to be muted. I don't think China will extradite these indicted individuals, who have close associations with the Chinese government, to actually be tried in the United States. Usually, these are more symbolic indictments. If we can't exercise jurisdiction over them, at least it's a shot across the bow that, if we find you and you're in this country or you're in another country with which we have a working extradition treaty, then you're going to be subject to arrest and prosecution. But I don't think these individuals, at least in the short term, are going to be held accountable. 

Dave Bittner: Yeah, there were two other cases here that they highlighted as well. One of them involved four people who were charged with being illegal agents on China's behalf, using a Chinese academic institution that the U.S. government said was basically a sham. It was a cover for these folks' activities. But then the third one, I think, is kind of fascinating. Evidently, there's been an ongoing program from China that they refer to as Operation Fox Hunt. And... 

Ben Yelin: That doesn't sound suspicious at all. 

Dave Bittner: No, not at all. And evidently, the Chinese operatives - they use threats, surveillance and intimidations to coerce individuals to return to China. And - leaves me scratching my head is, how could things possibly be better for them if they go to China, you know? 

Ben Yelin: Yeah. I mean, when you're using things like coercion and possibly threats of violence or, you know, hoarding personal information about these people over them, then yeah, I can understand why somebody might be coerced or threatened to comply. But certainly, I don't think it's anybody's dream at this moment in time to go to China over the United States, especially as they are still active in their COVID-Zero policies, so there's not much you can do in most of China's major cities at the moment. But because these agents are using coercion tactics, I think sometimes people in the United States might feel forced to comply. 

Dave Bittner: What do you make of this sort of in a big picture kind of way? When we look at the relationship between the U.S. and China, obviously, we're dependent on each other. We want to get along. But where do these things fit into that relationship? 

Ben Yelin: So I think it reflects an evolving understanding on the part of the Department of Justice. So there was this controversial China initiative, which was a little more aggressive. They were doing things like targeting Chinese professors for grant fraud prosecution focused on espionage. I think the Biden administration thought that that was a tactic that was not a best practice for our law enforcement agencies and not productive to our relationship with the PRC. I think what this action says is, for things that really matter - violating international law and interrupting fair trading practices as it relates to intellectual property - the DOJ is not afraid to take action, even if it will cause further diplomatic rift with China. And so I think that as a potential signal - again, without much of an enforcement mechanism, maybe it's not going to do much, but it still shows our aggressive posture - that we're willing to call out this behavior, issue these indictments, and prevent these violations that go against international laws and treaties. 

Dave Bittner: So it's a law enforcement action that I suppose ultimately is rather toothless to send a political message, is - would that be a fair way to frame it? 

Ben Yelin: Yeah, I mean, it's toothless in the sense that I don't think these individuals in the short term are going to face prosecution. But there are consequences for this type of indictment. I mean, Edward Snowden was indicted and could never return to the United States or any other country in the Western world without facing extradition. That certainly changes how these individuals will have to live their lives. They're going to be stuck in China or Russia or wherever. Otherwise, they will face extradition. So it's not entirely toothless. It's just that I don't think we're going to get a moment where these individuals are hauled in front of a U.S. judge and put in shackles and handcuffs and sent to prison in the near future. 

Dave Bittner: Yeah. All right. Well, we will have a link to that story in the show notes. And, of course, we would love to hear from you. If you have something you'd like us to consider for the show, you can email us. It's caveat@thecyberwire.com. 

Dave Bittner: Ben, I recently had the pleasure of speaking with Beth Goldberg. She is from a company called Jigsaw. And our conversation centers on misinformation and how that affects people online. Here's my conversation with Beth Goldberg. 

Beth Goldberg: I've been asked a few times in different ways, basically, are we in a golden age of conspiracy theories, or are we somehow more vulnerable or susceptible today than ever before? The good news is, I don't think we are. You're absolutely right that we've had conspiracy theories around as long as human beings have been talking to each other. And I don't really have good data to be able to say, yes, we have more conspiracies now than we did 50 or 100 years ago. So we can't really do this clean before and after. But what I think we can get hints about is, is there more awareness of conspiracy theories, and is there more amplification of conspiracy theories? 

Beth Goldberg: You know, if you think about conspiracies about the moon landing being a hoax in the 1960s or JFK's assassination being staged - those were incredibly popular. In fact, they remain incredibly popular. At some points, you know, upwards of 50% of Americans believe some of those conspiracies. But then they typically level off over time, right? There's this spike in awareness, and then they kind of dip out of the public conscience. And if you take surveys of people, you know, the percentage of Americans, for example, who believe that the Kennedy assassination was staged is sort of steady over time and relatively low. 

Beth Goldberg: I think what we're seeing now is, you can get a big spike in the number of people who believe a conspiracy theory. It can become really popular. You know, think about 9/11 being a hoax or some of the more recent conspiracies about elections. And then they don't disappear as easily, right? They're able to stay in the public conscience because we have social media really amplifying and sort of distorting and continuing to play on these conspiracies. And in some cases, they even stick around as social movements. You're seeing things like QAnon that sort of absorb these conspiracies into what's really a movement and keep them alive as part of the identity of that movement. So that, to me, is what's changed. It's not necessarily that we have more conspiracies. It's just that we have new ways to amplify them and sort of keep them in our conscience. 

Dave Bittner: You know, as we're recording this, Alex Jones is on trial for, you know, his own peddling of conspiracies with the Sandy Hook tragedy. I mean, is that - to what degree is that part of it as well, that there are folks who are out there using these to make money, to grow their audiences, and so in doing so, they're feeding these? 

Beth Goldberg: You're absolutely right. When we think about the peddlers of disinformation, you can think of two key motives. There obviously are many more, but the two big ones - the primary drivers - are profit - you know, people who are spreading misinformation purely for economic gain - and we've seen this throughout different conflicts. You know, we've got that now with the war in Ukraine, and we saw that previously around the 2016 election. There were whole content farms in Macedonia and other countries where people who had no stake in the U.S. election were pumping out disinformation about it purely because they could monetize that content and make money off it. So there's definitely folks who are doing this for profit rather than ideology. 

Beth Goldberg: The other big driver, though, is still geopolitical, sort of - you know, politicized motives. I can restart that sentence. The other major driver for conspiracy theories and disinformation is politics. It's folks with a geopolitical motive who are trying to amplify a certain party or a certain side of the narrative. And so that may be part of what's at play with Alex Jones beyond just him trying to make a buck. 

Dave Bittner: Can you help us understand the psychological elements here? I mean, why do these things have such a strong grip over the people who find themselves believing them? 

Beth Goldberg: Yeah. You know, I think there's a lot of myths about who believes conspiracy theories, who's susceptible to falling down that rabbit hole and why they do. And we found, by going and talking to over 100 conspiracy believers, that a lot of the myths we had were totally wrong and, in fact, kind of patronizing. But these folks defy simple categorization. They aren't all old people. They aren't all from a certain class or education level. They don't all have a certain political ideology. You know, folks who believe conspiracies come in all shapes and sizes and backgrounds. And we had some Ivy League lawyers, and we had, you know, folks who were incredibly young and urban, so all different backgrounds. 

Beth Goldberg: What we found - there were a few throughlines that connected all these folks we met with who had fallen down the rabbit hole. And the first was that they felt isolated. They were missing a strong sense of community or in-group or belonging, right? They had maybe moved to a new place or they had lost their job recently. And they weren't feeling connected socially to some sort of strong identity. And that means that they're sort of questing and hungering for a group of people and an anchor to be part of. 

Beth Goldberg: The second is that they felt disenfranchised from power. So they maybe weren't part of the information economy. They felt very far from Washington, D.C. And they weren't really aware of how the sausage was made, so to speak. And so they were very quick to jump to conclusions about how power worked because they felt very far from it. 

Beth Goldberg: And lastly, the most common throughline that we heard - really loudly - was just a mistrust of institutions. There was actually often an antipathy towards institutions, right? These are the folks who are taking my well-earned dollars for taxes, and they're forcing me to get vaccines, and they're actually doing me harm. Not only are they not serving me like they say they're supposed to, but these institutions of either government or media or health care are somehow harming me - that was a perception we heard quite a bit. 

Beth Goldberg: So that combination - that trio of isolation and disenfranchisement and mistrust - is really a toxic brew, and it led people to find these sort of alternative communities, these spaces - often online, sometimes in-person - where people no longer felt isolated and they were told, hey, you can be part of this movement where you have real political voice. We're going to make change, or we're going to identify, you know, the culprits behind your particular grievances and woes. And you can be part of fixing it. And so that's a really empowering and appealing - honestly, a really hopeful message to people. So I think the conspiracies often give people that hope and that community, first and foremost. The ideology, the actual details of the belief is really secondary. 

Dave Bittner: You know, we've become so fractured in our community right now, and I think even within families. You know, probably most of us - I know I can - sort of point to - you know, there's that saying - there's one in every family, right? And I think probably all of us probably don't have to go too far out in our family tree to find that relative - that aunt, uncle, the sister, brother, whoever it is - who's into this sort of thing. What's the best technique for trying to communicate with them and not have them, you know, put their shields up and be defensive? 

Beth Goldberg: Yeah. It's a really good point, Dave, that we actually all already have some experience with this in one way or another, whether it's in our families or workplaces or friend circles. And you're right that, that if we come at folks with our facts and with our figures, that we absolutely - they get their defenses up, and it becomes an argument. 

Beth Goldberg: What I've found is the most effective way to reach someone who's got sort of upside-down conspiratorial beliefs is to first make them feel heard. They're seeking this sort of belief system because they haven't felt heard and empowered. So make sure you actually listen to them, and don't write them off. And second, you know, start to ask them questions, and poke and prod a little bit at the edges of their beliefs. And by doing that, you can start to plant some seeds of doubt - right? - where they may not have a good answer for something. But you don't need to point out that their answer wasn't good. You just need to start to ask those hard questions that make them really consider things. 

Beth Goldberg: And lastly, you can build bridges with these folks by actually acknowledging real conspiracies. There have been conspiracies where, you know, government armed Contras in Nicaragua or - you know, there's lots of fun examples of things that the CIA has done. And I think sometimes acknowledging those duplicitous actions by the elites can win some favor and say, hey, I'm not totally against the idea that conspiracies exist, but some of them are theories that aren't proven, and some of them do have evidence behind them. So then you can help to tease out, hey, evidence here is important in discerning if something is a real conspiracy or just a conspiracy theory. 

Dave Bittner: What about at the higher level here? You know, from a policymaking position, obviously, a nation that values free speech, and it's not against the law to tell a lie. How do we go about trying to contain these things when they can do real harm? 

Beth Goldberg: It's a really good question and one that a lot of academics and policymakers have wrestled with for a long time. So there's no silver bullets. And I do think we want spaces where people can really debate these conspiracy theories. I think where we've been looking to draw the line with some of our research is when do these become harmful? When do they start to infringe on other people's safety? And so one of the lines of inquiry we had was at what point does a conspiracy theory motivate someone to violence? Can we actually pinpoint what the conditions are for that? And we had a few of the folks that we interviewed who really were willing to pick up a gun or another weapon and then go commit acts of violence. 

Beth Goldberg: And the distinguishing factor for them was that they felt some sort of existential threat. They felt that their lives, their livelihoods, their communities were truly going to be wiped off the map at any moment by whoever they perceived as behind a conspiracy theory. And that existential threat and that willingness to commit acts of sort of vigilante justice, in their minds, of violence, to me, is where we can draw a line and say, hey, this incitement to violence, this rhetoric about, you know, quote-unquote, "defending yourself with violence," that's not OK. And that really can result in real-world violence and harm against other communities. We've seen that with - there have been a number of acts of violence tied back to QAnon. So I think when it gets to that stage of sort of inciting rhetoric, that's when policy can really intervene and say this has gone too far. 

Dave Bittner: And are there efforts underway for that sort of thing? I mean, again, you know, we're divided, and we have a divided Congress. Are there movements here to try to - I don't know - at least acknowledge we have a problem? 

Beth Goldberg: I'll admit that that's beyond my area of expertise. I'm not sure what bills are in progress, if any, on this. I can say that, from the perspective of the tech platforms, there have been quite a few efforts in recent years to draw these really difficult lines that balance the need for free expression and debate and inquiry and research with removing this sort of incitement that can limit other people's free speech - right? - by making them feel unsafe and unwelcome on these platforms. So there have been quite a few policies, just in the last two or three years, on things like harassment and incitement to violence. YouTube and Twitter and Facebook and others have all done quite a bit of updating to their policies around conspiracy theories, really in light of some of these recent attacks that were motivated by conspiracy beliefs. 

Dave Bittner: Ben, what do you think? 

Ben Yelin: I'm a sucker for any talk about conspiracy, so I love that interview. 

Dave Bittner: (Laughter). 

Ben Yelin: One thing that stuck out... 

Dave Bittner: Right. 

Ben Yelin: ...To me is the reason conspiracies flourish is because of two incentive structures. One is money. And I think it was good of both of you to invoke what's happened with Alex Jones, where he's made quite a fortune. Some of that is certainly in jeopardy now after he's lost these civil cases. But lying and defaming other individuals with conspiracy theories has been lucrative to him in a monetary sense. And the other motivation is political. You can gain a political advantage by having people believe certain conspiracies, like some of the election fraud conspiracies we've seen from 2020. And with those incentives, there's kind of a magnetic pull for people who have power, who have money, to foster these types of conspiracy theories. And they don't care, necessarily, about the broader impact that that's going to have on society or the corrosive impact that has on individuals. I mean, everybody, as you guys said in this interview, has a family member whose life has been ruined because they're deep into this conspiracy hole. So I just thought it was a... 

Dave Bittner: Right. 

Ben Yelin: ...Fascinating conversation and always a subject I enjoy learning about and talking about. 

Dave Bittner: Yeah. Well, our thanks to Beth Goldberg for joining us. We certainly do appreciate her taking the time. 

Dave Bittner: That is our show. We want to thank all of you for listening. The "Caveat" podcast is proudly produced in Maryland at the startup studios of DataTribe, where they're co-building the next generation of cybersecurity teams and technologies. Our senior producer is Jennifer Eiben. Our executive editor is Peter Kilpe. I'm Dave Bittner. 

Ben Yelin: And I'm Ben Yelin. 

Dave Bittner: Thanks for listening.