Navigating laws for civilian cyber corps.

Michael Razeeq: Liability is one of the key legal issues and concerns that comes up whenever you talk about this sort of volunteer work where you have people going into an organization's network and, you know, working with data because there is always the possibility that something goes wrong, people may be working with sensitive data or sensitive systems. So, for the states that do have statutes, liability is something that is addressed.

Dave Bittner: Hello, everyone, and welcome to "Caveat," N2K CyberWire's privacy, surveillance, law and policy podcast. I am Dave Bittner and joining me is my co-host Ben Yelin from the University of Maryland Center for Health and Homeland Security. Hey, Ben.

Ben Yelin: Hello, Dave.

Dave Bittner: On today's show, Ben covers the groundbreaking antitrust court decision against Google, I look at a new bill that would elevate ransomware to a terrorist threat and, later in the show, my conversation with attorney Michael Razeeq. He's the 2024 New America #ShareTheMicInCyber Fellow. We're discussing his research in Civilian Cyber Corps. While this show covers legal topics and Ben is a lawyer, the views expressed do not constitute legal advice. For official legal advice on any of the topics we cover, please contact your attorney. [ Music ] All right, Ben, let's jump right in here. We are starting off with a biggie, right?

Ben Yelin: Yeah. I had a feeling this was going to come out when I was on vacation and it didn't so I am thrilled -

Dave Bittner: Okay.

Ben Yelin: - about that.

Dave Bittner: Excellent.

Ben Yelin: They discovered it right after it came out. But we had a major decision from a federal judge in the District of Columbia against Google. Several states attorneys general and the Justice Department sued Google accusing it of being a monopoly, so illegally cementing its dominance in large part by paying other companies like Apple and Samsung. And I'm quoting a New York Times story here, "Billions of dollars a year through these licensing agreements to have Google automatically handle search queries on their smartphones and web browsers." And, in a 277-page decision, the Federal District Court Judge Amit Mehta decided that Google is in fact a monopoly under the definition established through the Sherman Antitrust Act. I want to first talk about the broader implications before I get into the minute details of the case. There have been a lot of Justice Department actions, federal agency actions, state actions against these big tech companies seeking to challenge their status as monopolists in the market. A lot of these lawsuits have accused them of anti-competitive practices to maintain their ginormous, to put it colloquially, advantages in various markets.

Dave Bittner: Right.

Ben Yelin: So that's Apple, that's Amazon, that's Meta, the owner of Facebook, it's Instagram, it's WhatsApp. All of these companies have been subject to the antitrust - to antitrust lawsuits. And now the first one that comes out is perhaps the biggest and most significant, it's against Google. And I think this is a warning to those companies that we have a federal court system that's willing to take these antitrust cases against big tech companies seriously. This is the first major decision - antitrust decision against a tech company since the late '90s Microsoft -

Dave Bittner: Right.

Ben Yelin: - which ended up being settled in the early 2000s. And so I just don't think we can downplay its significance. It is a huge turning point in antitrust jurisprudence. So let's get into what this case said. Basically, to establish a monopoly, you have to first determine what the relevant market is, and then you have to show that the company engaged in anticompetitive practices that was beyond just having a better product, so like actively making it more difficult in a legally recognizable way for competition to emerge to your giant market power. And the Justice Department and these states alleged a bunch of different things that could count as the type of markets that Google had monopolized. In some of them, Google actually won on narrow questions, so things like images and advertising. A couple of other things that are kind of footnotes in the decision Google actually ended up prevailing on those questions. But there are two big questions on which the Justice Department, the United States, and the states prevailed. The first is on general search engines. So google has become a verb.

Dave Bittner: Right.

Ben Yelin: To search something on the internet is to google. I think if you were to ask a man on the street, "Does Google have a monopoly on search engines," without trying to analyze the obscure language of the Sherman Antitrust Act, you could pretty assuredly say that it is a monopoly.

Dave Bittner: I think if you went to the average person on the street and said, "Name another search engine," a not insignificant number of people wouldn't be able to.

Ben Yelin: Yeah, I mean, it would take me a second. I grew up in the age of we had AltaVista -

Dave Bittner: Right.

Ben Yelin: - we had Lycos

Dave Bittner: Ask Jeeves.

Ben Yelin: We had Ask Jeeves.

Dave Bittner: Yeah.

Ben Yelin: "Hey, Jeeves."

Dave Bittner: Right, right. That's true.

Ben Yelin: But that's not the way things are now. I mean, there is Bing.

Dave Bittner: Yep.

Ben Yelin: But, actually, the evidence of Bing's emergence ends up working against Google here because Bing wasn't really able to establish a proper market share despite the fact that it came from Microsoft.

Dave Bittner: Right.

Ben Yelin: So Google went from something like 80% of all search queries on the internet in 2009 to over 90% while this case was being adjudicated in the early 2020s. That is a huge market share. And there are ways in which Google has enforced this anticompetitive practice. The main way is by paying billions of dollars to these other companies, as we've mentioned, to have them be the default search engines on devices. What Google was arguing is, "Look, any other company can pay that kind of money to become the default search engine. Just because something is a default doesn't mean that people don't have other options. Somebody could replace Google with Bing. If they really wanted to go about changing the default search engine on their smartphone, they have the ability to do that." And the judge, I just think, really didn't buy that argument. Part of it is the amount of money that's paid to these companies that kind of reestablishes Google's place as the absolute lion king of the search engine -

Dave Bittner: Right.

Ben Yelin: - market. I mean, it is billions of dollars. And then Google reinforces those advantages in having a monopoly on text in search ads. So, if I searched for, I don't know, "men's pants" -

Dave Bittner: Right.

Ben Yelin: - I'm going to get a million different search ads for men's pants based on my search query. And one of the ways Google reinforces its power in the market is by, basically, having a monopoly not just on the search itself, but on those text-based ad suggestions. So, when the judge looked at whether consumers actually have a meaningful choice when Google is the default on these devices, they looked at sociological evidence, they looked at a lot of socioeconomic research, a lot of kind of game theory stuff. And he determined that customers really don't have a meaningful choice. Google has become so powerful, the power of the default is large, people are very resistant to replacing the default. And Google reinforces this monopoly by having these very profitable ads run inside search results.

Dave Bittner: Right.

Ben Yelin: So that is the main result here. This is not the end of the proceeding. The decision only held that Google is a monopoly under the definition of the Sherman Antitrust Act. The next portion of this decision, which has yet to come out, is the remedy so we don't know if this judge is going to force Google to change its practices, if there are simply going to be monetary damages. That is going to be decided at a later date. And, of course, this is subject to appeal. So we know that part of the Microsoft decision in the late '90s was appealed from a Federal District Court to an Appeals Court. And an Appeals Court was actually much harsher on Microsoft than the District Court. So, depending on which panel - which panel of judges on the DC Circuit Court of Appeals we get for this case, the case could be partially or entirely reversed if the judges on the Court of Appeals have a different understanding of the law and the facts or if they don't agree with Judge Mehta's findings that Google engages in these anticompetitive practices. So we're a long way from a firm resolution here. But I can't understate the significance of this. The fact that a big tech company is finally being held accountable for anticompetitive practices under the Sherman Act is huge. And it's going to have ripple effects throughout the industry.

Dave Bittner: So do - which comes first, the appeal or the remedies?

Ben Yelin: Remedies.

Dave Bittner: Okay.

Ben Yelin: And then, once that's decided, then I doubt there would be any interlocutory appeal where you would appeal the decision before we find out what the remedies are. I'm sure Google wants to know what the remedies are -

Dave Bittner: Right.

Ben Yelin: - before they decide to appeal. So we'll get that - the second part of this District Court judge's decision, which is on the remedies, some point over the next several months and then we'll go through the appeals process. I mean, just to get to this point, it's been four years, I believe since this lawsuit was filed against Google. We went through ages and ages of discovery.

Dave Bittner: Right.

Ben Yelin: A lot of historical research went into this, people who are experts on monopolies, on trustbusting, on the Standard Oil cases from the early 1900s. There is a lot in this 277-page decision. So part of me thinks, "Well, you'd think the Appeals Court would be differential given all of the research that has gone into this, how informed this opinion is by various stakeholders." But then the other part of me is like, "I am not entirely sure if Google should have won - should have lost this case."

Dave Bittner: Really?

Ben Yelin: On my worst days, and, Dave, I'm almost ashamed to admit this because I think this will be unpopular with our listeners -

Dave Bittner: Yeah.

Ben Yelin: - I just - I'm not sure they meet what I would determine as the definition of monopoly - of a monopoly. And I struggle with this. But, like, have they not just created an inferior product?

Dave Bittner: Hmm.

Ben Yelin: It's user friendly. I have no problem. Every time I search for something, it optimizes my results at the very top of my search query.

Dave Bittner: Right.

Ben Yelin: They have funny little doodles on all of the holidays. I don't know, I don't know. I have mixed feelings about it.

Dave Bittner: Well, I mean, a couple things that caught my eye here were the - I think the judge pointed out that Google had gone through a systematic process of raising prices on their ad business just because they could and there was no - basically, no other place for people to go to get the kind of results that Google provides. So they didn't - they raised their prices to meet the market's expectations and they could do so with impunity because it was kind of like, "Well, what are you going to do? Go somewhere else?" So I think the judge pointed out that, which I thought was interesting.

Ben Yelin: Yeah, I think there's definitely something to that. Obviously, raising prices when there isn't sufficient competition in a defined market is almost by definition monopolistic behavior. I'm just not sure that like is the barrier to entry so high for these other companies that they could just - it would be impossible for them to innovate to the point where a search engine would supersede Google, the way Google superseded the earlier generation of search engines by having an inferior product. I mean, do you remember when Google first came out in, what was it, 2000 or 2001?

Dave Bittner: I do.

Ben Yelin: And - yeah, I mean, you're old.

Dave Bittner: I am.

Ben Yelin: Even I remember this. And it was like overnight the difference between the previous generation of search engines and Google was so significant -

Dave Bittner: Right.

Ben Yelin: - that they had earned their portion of the market share.

Dave Bittner: They - back then, they were truly innovative.

Ben Yelin: They were. And so why have we gotten to the point where the anticompetitive practices are so significant that no other company could possibly innovate in a way where they could compete - they could fairly compete with Google?

Dave Bittner: Well, I think that, first of all, there's the argument to be made that Google's quality of results has just fallen off a cliff. So I think there's that. But I also wonder this whole idea of them paying billions of dollars to the Apples and Samsungs of the world to be the default search engine, the other companies can't compete with that. And so, if you don't have the deep pockets that Google does - they're ensuring their position by throwing money at the market that none of their competitors could ever have a hope of throwing that money at. I suppose you could say, "Well, wait a minute, my Microsoft, who runs Bing, they have all the money in the world."

Ben Yelin: That would be my counterargument. I know it might not be super compelling and it might not be a popular opinion, but Bing has made itself the default search engine in some circumstances. Correct? It was the default search engine on -

Dave Bittner: When Microsoft made a phone, yeah?

Ben Yelin: Yeah.

Dave Bittner: Well, it didn't pan out.

Ben Yelin: I know. But it didn't pan out 'cuz it was a crappy phone.

Dave Bittner: Right, right, right.

Ben Yelin: I don't know, I don't know.

Dave Bittner: Well -

Ben Yelin: I mean, I might get cancelled for this anyway.

Dave Bittner: No, no, I mean, look, it's worth looking into. I mean, I just think for - I find the judge's argument is very compelling here. I think there are many, many cases that the judge makes that are examples of Google using their position in an unfair way. I guess so my follow-up question is, "What do we think some of the possible remedies might be?"

Ben Yelin: There are a number of things that the judge can do as a remedy. I mean, the judge has pretty relatively unrestrained power here. They could issue an injunction against many of these anticompetitive practices. I think a judge would be reluctant to like set price points where they say, "You can't pay Apple above this particular threshold to be their default search engine."

Dave Bittner: Can they just get rid of it all together?

Ben Yelin: Yeah, I think they - I think this judge could - I think he could do that. So the remedies could be that drastic or, you know, they could be - cover some middle ground where Google has to stop certain anticompetitive practices, but other practices are okay. I don't really know what the full range of the potential remedies are. I think they're pretty vast. It could be as simple as paying fines to the federal agencies that were part of the lawsuit and to the state attorneys general if it's a part of some type of settlement. And then, you know, maybe -

Dave Bittner: That would seem - that seems unsatisfying.

Ben Yelin: It's very unsatisfying. Maybe each of us would get a few bucks -

Dave Bittner: Right, exactly.

Ben Yelin: - as part of a class action here. So I don't know. I think the most drastic action is would be - the most drastic action would be definitively putting an end or issuing an injunction against the most specific uncompetitive practices. So unconstrained price increases, which fuel Google's dramatic revenue growth, which allows them to pay boatloads of money to Samsung and Apple to be their default browser, I think the judge would have the power in the second part of this case to say that that is illegal, you can't do that.

Dave Bittner: What about splitting up the company?

Ben Yelin: Also a possibility.

Dave Bittner: Yeah. I've heard people joke about -

Ben Yelin: Break up big Google.

Dave Bittner: - making a - like they made all the little baby Bells when they broke up the Bell System back in the day. Could you make regional Google's -

Ben Yelin: Right.

Dave Bittner: - which is the idea of is hard to imagine that -

Ben Yelin: Google Maryland.

Dave Bittner: - a non-global search engine, but I don't know. I - you know, obviously, decoupling their ad business from their search business would be, I think, something that would be a priority that they'd look at. But it's - yeah, it's hard to - it's hard to imagine because we really haven't had anything else than this. This is the thing that grew organically.

Ben Yelin: We haven't had anything like this.

Dave Bittner: Yeah.

Ben Yelin: I also am curious to see how that - how this affects the emerging AI market, whether this affects how companies will try to engage in practices to gain a greater share of the AI market, understanding that there's now this watchful eye of the Justice Department and states looking to see whether they're engaging in anticompetitive practices. I mean, right now, in terms of LLMs, generative AI, there actually are a good number of options with varying levels of being good. And I'm wondering if part of that is even the consideration of this decision forcing companies to try and not gain this monopolistic power lest they be broken up or suffer some type of significant punishment as a result of a lawsuit. So that's definitely something I'm going to be looking after as this moves forward.

Dave Bittner: So what kind of timeline do you suppose we're on here?

Ben Yelin: I would guess that the second part of this decision is going to come out by the end of this calendar year. Once we know what that decision is, I think Google is almost certain to appeal this case to the Court of Appeals. I would guess that it'll take at least a year to adjudicate that case in the DC Circuit Court of Appeals. Any resolution on that, I would probably look to like 2026.

Dave Bittner: Okay.

Ben Yelin: So we'll be talking about this well into our - well into the second decade of our podcast I would guess.

Dave Bittner: So does that mean 2026 is when we could actually see action, like changes made, you think -

Ben Yelin: Yeah -

Dave Bittner: - if anything?

Ben Yelin: - at the earliest cuz then whoever loses at the Court of Appeals could also appeal to the U.S. Supreme Court, which hasn't taken on a major tech company antitrust case ever so they'd be going off of precedence from the pre-digital age, which would be really interesting, but it would be a groundbreaking case. And I wouldn't even start to anticipate how that go - how that would go.

Dave Bittner: Yeah.

Ben Yelin: So I think we're a long way away from any definitive resolution here. Google isn't going to get broken up tomorrow.

Dave Bittner: Right.

Ben Yelin: It's more the symbolism of this decision and the fact that it's unprecedented in this era.

Dave Bittner: So we - yeah, I mean, that, I think, is a really fascinating point is that this could affect how the big tech companies start positioning themselves with emerging technologies. Knowing that the federal government is willing to come after them with sharp teeth may - well, I think, would affect how they look at how they do things going forward. Maybe. I mean -

Ben Yelin: Yeah.

Dave Bittner: - you know, they're -

Ben Yelin: And the emerging market is AI.

Dave Bittner: - kind of famously - yeah, they're sort of famously, you know, the f around and find out attitude. Right?

Ben Yelin: I mean, the funny thing about this is like it's obviously worked out very well for Google. Even considering this lawsuit, they've now made it 20, almost 25 years dominating this market, becoming one of the most successful companies in the world. Its co-founders make gobs of money that we'd never even be able to conceptualize.

Dave Bittner: Right.

Ben Yelin: Even if they lose this case, it's like, "Eh, it's still kind of worth it to just kick ass and take names for 25 years." And maybe these other companies might feel the same way -

Dave Bittner: Interesting.

Ben Yelin: - like, "Yeah, fine, challenge us. Challenge us in a six-year legal proceeding. We're going to go dominate this market and make billions."

Dave Bittner: Right, right.

Ben Yelin: And then cash out and buy a private island in the Bahamas or wherever.

Dave Bittner: Yes, "Please don't throw me in the briar patch."

Ben Yelin: Yep.

Dave Bittner: All right, well, we will have a link to that story in the show notes. My story this week, kind of a quicker thing certainly than the Google story. There's an intelligence bill that's making its way through the Senate. It's a proposal right now sponsored by Mark Warner, who's a Democrat from Virginia. And they are looking to label ransomware as a terrorist threat. So they want to label ransomware groups as hostile foreign cyber actors and the countries harboring them as state sponsors of ransomware. What do you think of this, Ben?

Ben Yelin: I think it's a really interesting idea. I have this kind of gut-level reaction to calling things terrorism -

Dave Bittner: Okay.

Ben Yelin: - because I came of age in the 2000s when like everything bad was associated with the terrorists post-9/11 and we ended up developing a lot of really bad policies starting with the Iraq War on the idea of these people are terrorists, not to mention the surveillance state that became - my main academic interest was because of terrorism so I just have this like visceral reaction to "let's call something that isn't currently defined as terrorism as terrorism."

Dave Bittner: Yeah, using that as a broad brush.

Ben Yelin: I also think we have to look very closely at the potential kinetic effects of a ransomware attack because the kinetic effects could be as severe potentially as non-cyber-related terrorist attacks. If you were able to use ransomware to hurt critical infrastructure, whether that's power grids, water, any type of critical infrastructure, that could certainly have the same type of detrimental effect as traditional early 2000s al-Qaeda terrorism in terms of death and injury. So, in that sense, I actually think it might be a wise use of these counterterrorism statutes which automatically impose sanctions. The other similarity that I think is useful and why I think this is an interesting idea is you have a lot of groups that are affiliated with various countries, but they, in and of themselves, are not nation-states. And that's something you saw - that was part of our counterterrorism efforts post-9/11. There wasn't a giant behemoth USSR that was the basis of our international relations and our sanctions, that sort of thing. It was these more diffused groups that operated in a bunch of different countries or operated in one country, but weren't directly affiliated with that country's government. And, because I think there are significant similarities there, this might be an effective way to fight back against some of the worse purveyors of ransomware. So I do think it's an interesting idea. It's part of a much larger intelligence bill so we'd have to - in terms of the prospects of this moving forward, there are a million different things that could torpedo a multi-hundred-page intelligence bill. We'll have to see where it goes. Right now, this is just under consideration in the Senate at this point, I believe, but I do think it's a really interesting idea with some potential.

Dave Bittner: I have this sort of Warner Brothers cartoon sort of Wile E. Coyote image in my mind of the ransomware operators, you know, pressing the Return key on their keyboard and sending the ransomware out, and then, moments later, a targeted missile strike just like flying through the window.

Ben Yelin: Yeah.

Dave Bittner: Right? And, as cartoonish as that is, I wonder about the - kind of the diplomatic implications of this. In other words, the Russians are famously hands off when it comes to their ransomware operators, you know, giving them cover. As long as they don't go after people in their home country, they kind of look the other way. And so what is the - what kind of pressure do we have to put on diplomatically to change that to make it so that the other nations, the Russias, the North Koreas, the Irans, don't just look the other way and pretend like this isn't happening?

Ben Yelin: I mean, I think our power to do that is relatively limited, unfortunately, because, as it comes to our adversaries, we have already levied significant sanctions against them. They are already state sponsors of terrorism. It's unlikely that they're going to be deterred by this new potential - this one new potential set of sanctions. That's likely not going to be the marginal thing that gets them to comply. So I think there's a lot of symbolism in this, too. I think it's just a recognition that this is a major part of our threat landscape and it should be treated not with kid gloves, but with the same legal weapons that we use for counterterrorism, which are extremely strong. I think it is more of a message rather than the direct effect it might have on countries like Iran, Russia, and North Korea.

Dave Bittner: I wonder, if you categorize it this way and you categorize it as terrorism, does that expand the number of buckets full of money that the people fighting this can reach into.

Ben Yelin: Yes. I mean, because we have counterterrorism experts within our Department of Homeland Security. I mean, we have an entire national security apparatus that has been devoted for the last 20 years to fighting terrorism. So, once we classify this as a form of terrorism, then I think you can unlock some of those dollars that maybe you might not have been able to previously.

Dave Bittner: Okay. Interesting. All right, well, we will have a link to that story in the show notes. And, of course, we would love to hear from you. If there's something you'd like us to consider for the show, you can email us. It's caveat@n2k.com. [ Music ] Ben, I recently had the pleasure of speaking with Michael Razeeq, he is an attorney and also he is a #ShareTheMicInCyber Fellow. And he's doing research on Civilian Cyber Corps. Lots of different states have spun up these Cyber Corps and he is researching the effectiveness of them and how different states' degrees of legislation influences their effectiveness. Really interesting stuff. So here's my conversation with Michael Razeeq.

Michael Razeeq: They're, essentially, groups of volunteer cybersecurity experts that provide preventive and reactive services to certain beneficiaries. So you might think of corollaries in other domains like volunteer firefighters or the Medical Reserve Corps, the Civil Air Patrol, or the Coast Guard Auxiliary.

Dave Bittner: And what was the organizing of effort here? How did the - how did they come to be?

Michael Razeeq: So I think they've always been around in some form or fashion as long as the internet has been around. And I have taken care of my research to try not to limit the definition because there have been, at least since the early '90s, groups like FIRST and others that have banded together to share threat intelligence to collaborate in incident response. And I think this is just a natural evolution of that. But I think the state-organized Civilian Cyber Corps really came about - or the concept came about under DHS under a proposal in the early 2000s. It didn't really take off. NetGuard was the name of the organization then, but the concept kept kicking around and led to the Civilian Cyber Corps now that several states have set up.

Dave Bittner: And so where do we stand now? How many states have this sort of organization up and running?

Michael Razeeq: It's a small but growing number. Maryland, Michigan, Wisconsin, Ohio, and Texas all have Civilian Cyber Corps. Oklahoma is somewhere on the spectrum of setting one up. And a couple other states like Indiana and Virginia have floated proposals to set up their own Civilian Cyber Corps.

Dave Bittner: Well, let's talk about some of the research that you're doing. You're looking at the ways that the state's laws governing these organizations either help them along or perhaps hinder them. Where do we stand there?

Michael Razeeq: Sure. So, as I mentioned, my background is as a lawyer so, as I looked at this issue, I thought about where I could add value and help to advance the ball, and looking at the laws governing the Civilian Cyber Corps was really one area that I saw that I could focus on and do that. And four of the five states that have Civilian Cyber Corps have specific statutes that govern them. And, stepping back, the legal framework around Civilian Cyber Corps typically includes a statute, some sort of rules or a code of conduct that the volunteers follow, and contracts that are put in place between the state and the volunteers and the state and the beneficiaries of the volunteer services. And so I'm really looking at the statute itself to say, "Okay, well, what is covered today in the statutes that exist? What should be covered that isn't? And what should maybe be covered in a different way to help facilitate the services that the Civilian Cyber Corps are looking to provide?"

Dave Bittner: Can you give us a rundown of some of the things that are and are not covered?

Michael Razeeq: Sure. So one key thing is authorization, so under what statutory authority is the Civilian Cyber Corps operating and how is it set up. In some states, it's set up under - as a military or a quasi-military organization. For example, in Maryland, the Civilian Cyber Corps sits under the Maryland Military Defense Force. In Ohio, it sits under the Ohio National Guard. In other cases, like Texas or Wisconsin, it might sit under an IT or emergency management organization. And that plays into issues like funding, issues like how and at what level a decision has to be made to deploy the Civilian Cyber Corps. So, for example, you can think that if a Civilian Cyber Corps can only be deployed by the governor declaring a state of emergency, that's a really high bar and that could limit the potential uses of the Civilian Cyber Corp. Whereas I look at other states, like Wisconsin, which actually doesn't have a law, and I think my takeaway is not that the law isn't needed, but that I think care has to be taken in drafting the law so that it doesn't become a hindrance. But Wisconsin's Civilian Cyber Corps seems to be deployed far more than others for incident response in particular because they don't have the same sort of constraints as another state where, let's say, the governor could only deploy them in the event of a larger crisis.

Dave Bittner: And are these groups generally reactive to incidents or is there a proactive element to some of them as well?

Michael Razeeq: They're both. And I think, depending on the state and depending on the capabilities of the - of other agencies in the state and of the members of the Civilian Cyber Corps, the services might trend one way or the other, but the services generally fall into three large buckets. And those are education and training, so you can think going out into the public working with businesses, working with different agencies to provide training and awareness related to cybersecurity issues. Bucket two would be vulnerability testing and assessments, so actually going out and testing - conducting vulnerability assessments, maybe penetration testing to help spot issues before something goes wrong. So those are all the left of boom activities. And then, of course, the third bucket that we have talked about, which is incident response, or some sort of on-call capacity to help after something goes wrong, the right of boom activities.

Dave Bittner: Is there any sort of Good Samaritan clause built into any of this legislation being that we're dealing with volunteers?

Michael Razeeq: Liability is one of the key legal issues and concerns that comes up whenever you talk about this sort of volunteer work where you have people going into an organization's network and, you know, working with data because there is always the possibility that something goes wrong, people may be working with sensitive data or sensitive systems. So, for the states that do have statutes, liability is something that is addressed. One thing that's interesting that - is that the existing statutes don't reference this little known law, the Volunteer Protection Act of 1997, which is still on the books and I hadn't heard of before I had started to dive into some of this research and talk to other people who also have an interest and a passion for this and are researching similar issues. But I think that's an opportunity where the states could leverage this already existing federal law and tie into that in the statutes. And that's the sort of thing that my research will be looking at, what already exists that can be leveraged and then what's - what should be net new to help facilitate the process as more states start to look at this option.

Dave Bittner: And what is your sense for how the various states are measuring success of evaluating the return on their investments?

Michael Razeeq: I think there are different ways that you could measure the return on the investment, but I think this is also one area where there's opportunity for improvement. And I think having some sort of model legal provisions that states can draw on will help to standardize some of the statutes across different states and allow for better benchmarking and allow for better data collection because you could look at something like the number of deployments - the number of successful deployments, that could be one metric that's helpful; the attrition rate, the number of people that are being pulled in because that shows the - helps to show a proxy for the size of the cyber workforce within a state. So there are a lot of different metrics that could be pulled. You could - I think it's more difficult, but I think you could also look at cost of avoidance. The average cost of a cyber incident now I think the last number I saw is around four - close - nearing $4.5 million. And so, to the extent that some of that cost can be offset, I think that that's one way that effectiveness could be measured.

Dave Bittner: What's going on at the federal level here? Is there any financial support? Is there any movement to activate something like this at the nationwide level?

Michael Razeeq: There has been some chatter at the federal level although I haven't seen much in the way of action yet. So the National Defense Authorization Act for the Fiscal Year '23, it required an assessment to be conducted of the feasibility of a federal Civilian Cyber Corps. As far as I can tell, that study hasn't yet been completed. But the NDAA for Fiscal Year '24 provides authority for the Department of Defense to conduct a pilot program. And, so far, as far as I can tell, no concrete actions have been taken yet there either, but at least the foundations have been laid so, hopefully, we'll start to see some more activity there at the federal level. In the meantime, CISA has set up a high-risk communities portal that includes a map with links to different volunteer organizations, including these Civilian Cyber Corps in different states. So I think that will be a great resource at the federal level to help centralize some of the knowledge about these organizations. And I should say that, even at the federal level, the U.S. Marine Corps has developed its own cyber auxiliary to help support Marines. And they're focused on the left of boom activities, the education and training and assessments.

Dave Bittner: Oh, interesting. Yeah, I mean, I guess I am curious if there's any information sharing going on. You know, is there an equivalent of an ISAC for these Civilian Cyber Corps?

Michael Razeeq: Not a dedicated one. So, from what I've gathered, I think the people who are involved in the Civilian Cyber Corps are very passionate about them. And I think they work to share knowledge on their own independently. I think they collaborate. I know at least a couple people who are involved in a couple different states. Civilian Cyber Corps were on a panel together recently at one of the BSides conferences. So I think there is some informal collaboration, but I think there is an opportunity for increased collaboration between the states and increased knowledge sharing between the states and that will help the different state Civilian Cyber Corps to improve by learning from each other.

Dave Bittner: What's your sense here in terms of momentum? Do you feel as though this is the kind of thing that is - that's growing or are there other states looking at the successes that the states who have enacted these sorts of things, the successes they've had? Are they saying, "Hey, you know, we need to get into this ourselves?"

Michael Razeeq: Definitely. The momentum is high. And I have interviewed people in states that have Civilian Cyber Corps and in some states that don't have Civilian Cyber Corps, some that are in the process of considering them, and no one has said this is a bad idea. And, you know, I mentioned that we have other examples of this in other domains, like the Coast Guard Auxiliary, the Civil Air Patrol, volunteer firefighters, but nobody says, "Hey, you know, we don't - I'm not sure we need volunteer firefighters anymore right."

Dave Bittner: Right.

Michael Razeeq: So I think the real question is, "Why we don't already have this in the cyber domain?" [ Music ]

Dave Bittner: Ben, what do you think?

Ben Yelin: I'm a big fan of this. I think this is a really interesting idea. I know we've talked about it in Maryland about how we can leverage organizations like the National Guard, which already have expertise, and some of our national institutions here like the National Security Agency -

Dave Bittner: Yeah.

Ben Yelin: - to have a volunteer strike force to help against cyber incidents. So I think it's a really promising idea. I think we're in the early stages of this. In the most recent National Defense Authorization Act, the federal government was simply tasked with studying the feasibility of a federal Civilian Cyber Security Reserve Corps. That assessment has not been completed. So I know we are still in the early stages of this, but I think it's a very promising idea and it might be the way of the future to fight against cyber incidents.

Dave Bittner: Yeah. Well, yeah, it's a fascinating line of inquiry here and very interesting that Michael's doing this research. So, again our thanks to Michael Razeeq for joining us. We do appreciate him taking the time. [ Music ] And that's "Caveat" brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to caveat@n2k.com. We're privileged that N2K CyberWire is part of the daily routine of the most influential leaders and operators in the public and private sector from the Fortune 500 to many of the world's preeminent intelligence and law enforcement agencies. N2K makes it easy for companies to optimize your biggest investment, your people. We make you smarter about your teams while making your teams smarter. Learn how at n2k.com. This episode is produced by Liz Stokes. Our executive producer is Jennifer Eiben. The show is mixed by Tré Hester. Our executive editor is Brandon Karpf. Peter Kilpe is our publisher. I'm Dave Bittner.

Ben Yelin: And I'm Ben Yelin.

Dave Bittner: Thanks for listening.