TikTok’s last dance?

Adam Marre: We regulate many things in the United States. We regulate who can own TV stations. We regulate who can own radio networks, banks. And many of the reasons we do this is for national security concerns to a large degree. Yet we've let foreign entities own the most powerful attention-shaping tools in history, social media platforms, without any meaningful oversight.

Dave Bittner: Hello, everyone, and welcome to "Caveat", N2K CyberWire's privacy, surveillance, law, and policy podcast. I'm Dave Bittner, and joining me is my co-host Ben Yelin from the University of Maryland Center for Health and Homeland Security. Hey there, Ben.

Ben Yelin: Hello, Dave.

Dave Bittner: On today's show, Ben has an update on the fate of Apple's end-to-end encryption in the U.K., as well as the story of a lawsuit against DOGE for getting unauthorized access to personal data. I look at a call from Congress members for input on privacy legislation. And later in the show, I'm joined by Adam Marre, Arctic Wolf CISO, talking about banning TikTok and increasing regulations for social media companies. While this show covers legal topics and Ben is a lawyer, the views expressed do not constitute legal advice. For official legal advice on any of the topics we cover, please contact your attorney. [ Music ] All right, Ben, we're going to jump right into our stories here. You want to lead things off for us?

Ben Yelin: Sure. So we talked last week about the story in the United Kingdom, where the British government is looking at breaking Apple's encryption and getting a backdoor into their cloud services.

Dave Bittner: Right.

Ben Yelin: For law enforcement purposes.

Dave Bittner: Requiring Apple to include a backdoor was what they were hoping for, right?

Ben Yelin: Exactly.

Dave Bittner: Yeah.

Ben Yelin: So they used the statutory authority that they have based on this 2016 law that they passed, and they were trying to force Apple to have this backdoor available. Apple, as you can expect, was very resistant to this. They represent themselves as a very privacy-conscious company. And after we reported on this last week, Apple made a very fateful decision. They have now said that users in Britain will no longer be able to use their advanced data protection feature. So users in the UK will no longer be able to use that to encrypt their iCloud data, messages, notes, photos, iPhone backups, et cetera. They are removing this feature because of the British government's action and because the British government is using this Investigatory Powers Act of 2016 in a way that Apple sees as abusive. Apple was reluctant to set up the advanced data protection feature until a couple of years ago when I think events on the ground forced it into existence just because of so many cyber incidents where people's data had been made available.

Dave Bittner: Right.

Ben Yelin: And I think this is sort of an F-around, find-out situation for the UK government where Apple has called their bluff. And I'm wondering if there's going to be an outcry among encryption-supporting citizens of the United Kingdom privacy organizations to fight back against the UK government trying to claim this authority so that Apple will reverse this decision. Now, some of you may be asking, if you are not a listener in the UK, why should we care about this in the United States?

Dave Bittner: Right.

Ben Yelin: Besides just caring about things that happen overseas, I think it's important to note that this will have downstream effects on our own communications and it presents a significant number of risks because obviously we're sharing messages with people in the United Kingdom. Things could be stored on the iCloud there that it's now not going to be protected by the advanced data protection feature. So I just wanted to give this quick update just to note that Apple, under this threat, has not given in. Just like they didn't give in to the FBI 10 years ago with the San Bernardino incident, they were holding strong. And instead of granting that backdoor, they are simply removing the advanced data protection feature.

Dave Bittner: I find it interesting, too, that when you look at how Apple did this, is that because through the leaking of this, we know that Apple wasn't allowed to acknowledge that this request had been made, that the way Apple framed this in their press release was like, you know, circumstances have made it so that.

Ben Yelin: Right. Right.

Dave Bittner: So they did not refer to the --

Ben Yelin: Because there's a gag order on it.

Dave Bittner: Right, right. They didn't -- you know, there were no specifics about the original order. They just said that the conditions in the UK are such that we can no longer offer end-to-end encryption with these sorts of things. And we hope someday that will change.

Ben Yelin: Not referencing anything in particular.

Dave Bittner: Right.

Ben Yelin: Cough, cough.

Dave Bittner: Yeah. But for the moment, this is where we are.

Ben Yelin: Yeah, and I think it's a really important moment in the history of the encryption wars, because this was a major challenge to the idea of protection of encrypted communications against backdoors. And there was this question, if the most privacy-conscious big tech company was going to cave under pressure given the demands of a powerful foreign government.

Dave Bittner: Right.

Ben Yelin: And they did not. And I think that's an important moment.

Dave Bittner: Well, it also makes me wonder, because you think about other platforms that have end-to-end encryption, obviously there's apps like Signal.

Ben Yelin: WhatsApp, yeah.

Dave Bittner: Yeah. But I think of, you know, yeah, like the Meta platforms. I was thinking of Facebook Messenger, which is end-to-end encrypted, but suppose that instead of taking the route that Apple has taken here, suppose Meta gave in and built a backdoor that we don't know about.

Ben Yelin: It's very possible.

Dave Bittner: Right. I don't mean to be all conspiratorial, but we know the request happened, and one company said no. We don't know what the other companies said.

Ben Yelin: That's exactly right. And the fact that we only know about this story, we only know that Apple was given this demand under this 2016 statute because of a leak. So it's not like this is something that was announced by the UK government or British authorities. So, yeah, the fact that Apple has refused this request, I think, does not give any indication as to how other companies have reacted to it. And I wonder if somebody's going to leak stories along those lines about companies who didn't stand up to the UK government.

Dave Bittner: Yeah.

Ben Yelin: I guess we'll have to see about that.

Dave Bittner: Yeah. I mean, it's obviously, you know, we're talking about the UK, so it's not quite a parallel with, you know, how our constitution is here, but it is, I don't know, sobering, I guess, is the word, that things like this can happen, the requests can be made, and there is no transparency. There's no way for people to know, other than whistleblowers and leaks, that anything like this is even occurring behind the scenes.

Ben Yelin: Yeah. It's really difficult. I mean, I think we've tried to set up processes in the United States where at least after the fact, there are some transparency measures. There are requirements in various statutes to share with relevant members of Congress the activities of our intelligence community. But transparency is always a major problem when we're talking about secretive requests that come with gag orders to big tech companies.

Dave Bittner: It's a good point, though, you bring up about how there are members of Congress who are briefed on these things, and I suppose that is part of their job as representing us to be the backstop against that sort of thing. At least, I mean, I suppose that's what the design is intended to do.

Ben Yelin: It is. You know, does it have the same effect when they're not backed by public outrage because the public simply doesn't know about what's going on behind the scenes?

Dave Bittner: Right.

Ben Yelin: You know, for somebody like Ron Wyden, who is getting classified briefings on the intelligence community's surveillance powers, he cares about this stuff, and he'll write letters that obliquely reference something that hasn't been publicly released. But for other members, they're subject to gag orders as well. They're subject to any restrictions on classified information. And is it worth it for them to risk their position in Congress and to risk their level of access to classified information to go blabbing on about something? And I think in most cases, the answer to that is no, as we've seen.

Dave Bittner: Yeah. It's hard. It's something I personally struggle with just because on the one hand, you know, we're here Monday morning quarterbacking what are very serious national security issues, potentially, right? But at the same time, we would like to have a government that has a certain amount of transparency built in. And so the tension between those two things is pretty strong.

Ben Yelin: Yeah, it's kind of the never-ending tension at the, really at the heart of our entire podcast here.

Dave Bittner: Right. Right. Absolutely.

Ben Yelin: Yeah.

Dave Bittner: Yeah.

Ben Yelin: It's our raison d'etre. I'm sure I pronounced that incorrectly.

Dave Bittner: Yeah. Yeah. It's a film school term. Yeah. All right. So before we get to my story, you've got another thing you want to touch on here today.

Ben Yelin: Yeah. So a federal district court judge in our home state of Maryland blocked the Department of Government Efficiency, DOGE, from accessing personal data held by the two federal departments, the Department of Education and the Office of Personnel Management. And there was another decision from a different federal judge that happened last week as we're recording this that blocked DOGE's access to Department of Treasury information. So a bunch of plaintiffs, including federal employees and also unions and other organizations who were concerned that their potential personal information was being accessed by DOGE, filed a lawsuit against the government under the Administrative Procedure Act challenging DOGE's access to personal protected information that the government has. There's this thing called the Privacy Act of 1974, which basically says, unless there is some type of need-to-know basis, the government is limited in how it can release classified information, or not classified, but personal protected information from government employees. And this was to prevent -- obviously this is happening in the Nixon-Watergate era, this is to prevent agencies from sharing personal information about government employees with one another for the purpose of harassment or as a way to kind of use leverage against people who work for the federal government. That's what's managed by the Office of Personnel Management.

Dave Bittner: Right.

Ben Yelin: So in this decision, the judge issued a temporary restraining order on DOGE, preventing them, at least temporarily, from gaining access to these records. Her argument was that these plaintiffs have a likelihood to succeed on the merits, which makes a temporary restraining order appropriate. That A, they can establish standing, even though they're not able to assert with any certainty that their records are going to be sent to anybody who can cause them harm necessarily. There is enough alleged in the complaint to know that DOGE and several DOGE staffers have access to these communications, which would be a violation of the Privacy Act. What the government is saying is that these DOGE employees work for these agencies. So it's really a justified sharing of personal information within the department. and that could be how this case is adjudicated once we have a full case on the record where both sides get their best shot at putting together briefs. But at least for now, what the judge is saying is that's not a very plausible argument. Like, these DOGE employees don't have much of a history in these departments.

Dave Bittner: Right.

Ben Yelin: In fact, they had never been there prior to a couple of weeks ago. I don't think Big Balls has spent a lot of time roaming the halls of the Department of Education.

Dave Bittner: That's Mr. Big Balls to you.

Ben Yelin: That's true. I guess I should use his official full name. So, yeah, this is not persuasive to the judge. I think the judge here can see that the government is making a desperate argument claiming that these DOGE employees are actually agency employees when that's a legal fiction the government has created to justify them getting access to these records. So long story short, at least temporarily until this case can be further adjudicated, there is this temporary restraining order, part of a broader pattern of federal judges pushing back against DOGE and Elon Musk's effort at barging into these federal agencies and wreaking havoc.

Dave Bittner: How did they verify this? How did the judicial folks verify that the DOGE crew is keeping their hands off of the things that they're supposed to keep their hands off of?

Ben Yelin: I don't think they've been in a position to verify it yet.

Dave Bittner: Yeah.

Ben Yelin: All they've done is looked at the standard for issuing a temporary restraining order which is likelihood to succeed on the merits and irreparable harm.

Dave Bittner: Okay.

Ben Yelin: And when looking at likelihood to proceed on the merits I think they're largely relying on public reporting to say that we know that DOGE has been in these departments, we know just based on news articles about DOGE's activities that they're looking for access to personnel records. And they're using them for things like firing all the employees they can fire because they're still in their probationary period, right? So we know for sure that DOGE is getting access at least to some personal records and we know at least some of the ways in which they are making use of those records which is enough at this stage in the proceeding to properly allege that the plaintiffs might succeed on the merits. When we get into the fuller case, I think we're going to develop more of a record into exactly what information the DOGE bros are collecting, to whom they are distributing this information. Hopefully we can develop a full record on that so both the plaintiffs and the public can be aware to the extent to which this information is being shared possibly in violation of the Privacy Act of 1974. But this is just a temporary restraining order so we're not yet at that portion of the proceedings.

Dave Bittner: So as we proceed here and the DOGE team goes from agency to agency, will orders like this from judges have to then follow agency by agency, or could we imagine a point where the judge is saying, all right, just knock it off?

Ben Yelin: Knock off the whole darn thing?

Dave Bittner: Well, yeah. In other words, you can't just keep -- we tell you to not go in this agency, you can't just move on to the next one and start there until we tell you stop.

Ben Yelin: I mean the one case that was a frontal attack on DOGE and Musk failed.

Dave Bittner: Okay.

Ben Yelin: At least at the preliminary stage, because they couldn't properly allege that what Musk and DOGE were doing necessitated a temporary restraining order.

Dave Bittner: Right.

Ben Yelin: Basically, they weren't able to properly allege that there was irreparable harm.

Dave Bittner: Right, right, right.

Ben Yelin: It's possible, as the record continues to develop here, that maybe that would change and there's some federal judge willing to say DOGE in and of itself as proven through its activities over the past several months is causing irreparable harm to the extent that we need to issue a restraining order or an injunction. But we're not there yet. And until then, these are individual lawsuits filed by people working at individual federal agencies. And the venue in which these cases are heard depends on the particular circumstances of the agencies themselves, so it's kind of the luck of the draw in terms of what judge you get and how that judge is viewing DOGE's activities. So yeah, we're going to end up having this kind of piecemeal injunction soup where some agencies have not yet been enjoined from getting access to personnel information and some agencies have been enjoined. That is unfortunately the nature of our system. It could be that we're on the path to some type of broad ruling one way or another as to whether DOGE, whether it's the Office of Personnel Management or access to the Department of Treasury Payment System, what can DOGE access? Under our Constitution, what are limits on DOGE's power? Considering that DOGE is led by somebody who is not a cabinet secretary, has not been confirmed by the United States Senate and has been categorized in legal pleadings as just simply an advisor to the president. So where do they glean this constitutional authority? Maybe at some point we're going to get a broad case on the merits on that, but we just haven't gotten there yet.

Dave Bittner: Do you think this will end up for the Supreme Court?

Ben Yelin: It would if we got that final ruling from a federal district judge and it went through the appeals process to the circuit court. I think this is something that the Supreme Court would have to weigh in on. We've never really seen anything like this since DOGE at best is like a quasi-governmental organization and it's just a completely novel issue. Nobody's ever gone in with kind of a literal chainsaw, if you saw Elon Musk's speech at CPAC.

Dave Bittner: Yeah.

Ben Yelin: And they've started unilaterally firing people. I think there are constitutional questions as to the extent of their authority and whether this is something an advisor to the president is able to do. So yes, I do think this is something that could end up in front of the Supreme Court and probably sooner rather than later.

Dave Bittner: So let me ask you a question about something not completely unrelated, but in I'll say water-cooler conversations with my colleagues here on our space team, so the folks who make the "T-Minus" daily space podcast.

Ben Yelin: Highly recommended, by the way.

Dave Bittner: Yeah, it's very good. So we got Elon Musk, who is poking around places like NASA, and Elon Musk, obviously, is the head of SpaceX.

Ben Yelin: No conflict of interest there.

Dave Bittner: Well, that's where I'm going. They have billions of dollars in federal contracts for SpaceX. Who has standing to say, to call out Elon Musk's obvious, blatant conflict of interest here?

Ben Yelin: That's a great question. In the normal course of events, it would be a competing business. If he was getting access to contracts that otherwise would have been going to another potential federal contractor.

Dave Bittner: Right.

Ben Yelin: That's not really applicable in this case because there is no other SpaceX. That is, I mean, I guess --

Dave Bittner: Boeing?

Ben Yelin: You know, now that you mention it, it would probably be Boeing that would be able to establish standing. If they could properly allege that absent Musk's supposed illegal activity, they could have potentially received that government contract.

Dave Bittner: What about the leadership at NASA?

Ben Yelin: Could they say this person's coming through and firing our staff, which is in his best interest because it makes SpaceX more competitive?

Dave Bittner: Yeah, I mean, that would be a narrow argument for their standing. They'd have to allege some particularized harm to themselves. I'm not sure what the injury in fact for employees of NASA would be. If he's stealing their private information, as we've seen in this case, that is grounds for an injury in fact, and you can have a successful lawsuit and establish standing, but you're right, it's a kind of interesting and vexing question. I'm not sure if, besides potential competitors, anybody would be able to challenge Musk's potential conflicts of interest here. Are there not federal conflict of interest rules? I mean, there must be, right?

Ben Yelin: There are, but it's all, there are, but there --

Dave Bittner: I don't mean to be flippant, but you sense my frustration here? Like, we all see what's going on, and somehow the folks who are up to this sort of thing have brilliantly threaded all the needles, right?

Ben Yelin: Yeah. I mean, we do have mechanisms to avoid these types of conflicts of interest, but they're reliant on self-compliance, basically.

Dave Bittner: Ah.

Ben Yelin: Like, somebody claiming a conflict of interest and recusing themselves, if we're talking about the judicial branch, from consideration of the case, or just for a federal employee, taking themselves out of whatever policy decision-making authority they have as it relates to their own conflict of interest. But it's self-policing. The extent it's not self-policing, it's done through government accountability offices within these agencies, and many heads of those offices have been fired, which is great stuff, right?

Dave Bittner: Yeah. Those pesky societal norms.

Ben Yelin: And ultimately, if there were any type of criminal abuse, and I can imagine criminal charges being filed in some extreme circumstances, especially if there was criminal fraud taking place, that ultimately comes down to the Department of Justice, which is controlled by Pam Bondi, and the FBI, which is controlled by Kash Patel. I don't think either of them are willing to stand up to Elon Musk, just my personal opinion.

Dave Bittner: Yeah.

Ben Yelin: Because ultimately, decisions on prosecutions would have to go through those offices. And I don't think they have the intestinal fortitude to go against what's kind of their de facto boss here.

Dave Bittner: Yeah. All right. Well, what a place to find ourselves, right?

Ben Yelin: Yeah. I mean, one thing that has been effective is going to events with people's members of Congress. There is a Republican congressman in Georgia who had a meet-a-congressman event in his district, and there were a lot of fired federal employees who came and expressed their outrage at DOGE's activities. It's hit the Atlanta metro area extra hard because that's where the CDC is located.

Dave Bittner: Okay.

Ben Yelin: And this Republican congressman came back and is now speaking to the Trump administration about how to tone down the edges of DOGE's activities.

Dave Bittner: Yeah.

Ben Yelin: And all it took was one very contentious meeting with constituents.

Dave Bittner: They're looking toward the midterms.

Ben Yelin: Yeah. If you're wondering how you can have an impact, to me, that's the way you can have an impact is respectfully and nonviolently standing up to your members of Congress and asking them why they're allowing this type of thing to happen.

Dave Bittner: Yeah, I suppose. I mean, it's worth acknowledging that obviously you and I have our own opinions about this, which we have expressed, but there are plenty of people out there who feel as though this is great. Let's go into Washington. Let's go in with a wrecking ball. It needs to be burned down to the ground and rebuilt. Let's get rid of all the waste.

Ben Yelin: Totally. And again, I want to express some sympathy for those views. There is a lot of waste, fraud, and abuse in government. And I think in the abstract, all of us would support an effort to root out inefficiencies and get rid of unnecessary agencies and make it easier to hire good employees and fire bad employees. I think all of those things are perfectly reasonable. I've seen a lot of people who initially were excited about DOGE and the abstract, but then their daughter gets fired from the National Park Service.

Dave Bittner: Right.

Ben Yelin: And she was the good employee.

Dave Bittner: Right.

Ben Yelin: She wasn't hired because of DEI. You know, she was devoted to the mission, did an excellent job, etc.

Dave Bittner: Yeah. Yeah.

Ben Yelin: I think sometimes it has to get down to that personal level for people to understand the impact that this has on normal Americans.

Dave Bittner: Right. Right. All right. Well, we will have links to both of your stories in our show notes. What I wanted to touch on this week was a story from the folks over at CyberScoop. This is written by Derek B. Johnson and it is about the top House E&C Republicans, Energy and Commerce Committee. So they're looking for ideas on a data privacy law. So this is from the House Energy and Commerce Committee, the chair, Brett Guthrie, Republican from Kentucky, and the vice chair, John Joyce, Republican from Pennsylvania. They have issued a request for information seeking guidance on how to best develop legislation to protect the digital data of Americans across an ever-widening range of essential services. And I'm quoting from the CyberScoop article here. Ben, I think my initial reaction to this is good news.

Ben Yelin: Yeah.

Dave Bittner: If we're looking for federal privacy legislation, this is a good thing. Is it at all surprising that this is being led by a pair of influential Republicans?

Ben Yelin: I think it's actually, it's not surprising to me, and I think it's actually a good sign that there's still bipartisan interest in comprehensive national data privacy legislation. And I think there's a lot that people who work in the private sector could add to this conversation, and this gives them a venue to do so. They actually listed an email address that if you, and I really hope people only use this for serious purposes, but if you have an idea on what would make up a good data privacy law, by April 7th, you can send a message to that email address, which is in the CyberScoop story, and hopefully they can build a file through this request for information on good ideas. Ultimately, they're going to have to make some difficult decisions on things like preemption, does a federal data privacy law preempt strong state laws like California CCPA in protecting data privacy? That's been a major source of conflict and is one of the reasons I think we haven't seen a data privacy law is powerful members of the California congressional delegation don't want to preempt that law. And now we're seeing comprehensive data privacy laws in other states as well. So preemption remains a major issue. And then another issue they mentioned here, which I think is really interesting, is how a federal data privacy law might coexist with other privacy adjacent statutes. So HIPAA, Fair Credit Reporting Act, Gram-Leach-Bliley for the financial sector, and COPPA, the Children's Online Privacy Protection Rule. So I think this is promising. It's good that they're jump starting this process. It's good that they're reaching out to stakeholders to get input on this. It does mean that we're kind of back at square one here.

Dave Bittner: Yeah.

Ben Yelin: When members of Congress are reaching out to the public, to solicit ideas, it means we're not at the, we have this all written, you know, we just need to find our 218th vote in the House. So you can take that as a negative signal, but I overall take this as a positive signal.

Dave Bittner: Yeah, and this article points out that this isn't the first time we've gone down this path, and that they always seem to collapse under the weight, this article refers to it as factional disputes, which I think is a good way to describe it. And so it just gets bogged down because so many different people have different ideas of what they want this to look like. But I think for us, you know, week after week, we come here and we lament the molasses that is Congress. And so to see a couple of, like I say, influential committee members doing what appears to me to be a good-faith attempt to move this forward again, I think that's good.

Ben Yelin: Absolutely. Yeah.

Dave Bittner: Yeah. All right, we will have a link to that story in the show notes, and again, we would love to hear from you. Our email address is caveat@n2k.com. [ Music ] Ben, I recently had the pleasure of catching up with Adam Marre. He is the Chief Information Security Officer at Arctic Wolf, and our regular guest over on the CyberWire podcast. Today, we were talking about the, of course, the ban on TikTok, the specter of the ban on TikTok, and then just in general, increasing regulations for social media companies. Here's my conversation with Adam Marre.

Adam Marre: Right now, we've been presented with what I think is a false choice or the wrong choice, and that is with TikTok, you know, this went before the Supreme Court as a choice between free speech and national security, which there are implications and concerns for both. But the reason that we're at this point is a failure of leadership and a failure of Congress, our elected officials, to deal with the real issue, which is, right now, there is a complete lack of regulation on technology companies and social media in particular, which leaves us with few options to address real concerns like the national security implications of TikTok. And so now we're using a ban, like a sledgehammer, instead of a scalpel to deal with this problem.

Dave Bittner: Do you think either of those arguments are legit here, the free speech argument, the national security argument, or is it, as you say, that not really getting to the real issue?

Adam Marre: Well, those are real concerns, and they both have something to do with TikTok. There is a real value here we have in the United States of free speech, and in many court rulings, the Supreme Court has upheld the right of U.S. citizens to have access to information, even if it's propaganda from another country, and even if it's to hear speech from organizations that originate in a foreign nation, even an adversary. So U.S. citizens do have a right, and there are free speech concerns there. However, there are also real national security issues here that have come to bear, because you have an app, and to call it just a social media app is, I believe, to not really do it justice at what it actually is. But it is an app that is owned by a foreign nation and an adversary in many ways in this case, and so its ability to affect life in the United States, to threaten our national security is very realistic, and if you want, I can dive into that security concern. So TikTok isn't just a fun video app. It's great at that, and its algorithm is one of the best, but it is just that. It's a highly sophisticated algorithm that is a content delivery system, and it is controlled by a foreign adversary with no oversight and no transparency within the United States, and if you don't think that matters, imagine if a Chinese-owned company controlled the front page of the New York Times or what appeared on Fox News or CNN. I think many of us would have concerns with that. More than half of Americans get at least some, if not most, of their news from social media. So it's not just an app, it's really the equivalent of a broadcast network inside the United States with no U.S. editorial oversight, no accountability, and with an owner that is beholden to some degree, or maybe in a great degree, to the CCP. We regulate many things in the United States. We regulate who can own TV stations, we regulate who can own radio networks, banks, and many of the reasons we do this is for national security concerns to a large degree. Yet we've let foreign entities own the most powerful attention-shaping tools in history, social media platforms, without any meaningful oversight. So that's really what the concern is with national security and why TikTok in particular is different than the others, but it's also the same in many ways.

Dave Bittner: You know, I've seen people say that it wasn't supposed to get to this point, that the whole idea of the ban being the big hammer was really to get us to the point of someone else buying it. And it's the fact that that didn't happen that has got us to the kind of, you know, call your bluff, ban it, or don't point here. If TikTok divested from their Chinese owners, does that get us where we need to be, or do we still have the bigger problem of social media in general?

Adam Marre: Well, that's the thing. Again, I'd like to go before we were trying to use the ban as kind of this, again, sledgehammer to deal with this problem. And so we're like, hey, we're going to do a game of chicken here and say we're going to ban you or you divest. And what that even looks like is still murky to this, to this day, even with this extension on the deadline. But no, it does not address the real issue. What we really need is a comprehensive framework, data privacy laws, content transparency, algorithmic accountability, and restriction on foreign ownership for this critical digital infrastructure. The piecemeal whack-a-mole approach just isn't going to work. Individual bans aren't going to work. And if you want proof of that, look at what happened when the ban sort of temporarily went into place over the weekend, that weekend where it was, you know, the ban was going to go into place and it stopped appearing on, you know, in the app store and people's access to it was cut. What did they do? They immediately went to another app. And of course, this one was also owned by China in many cases. And so it's really not going to solve the problem to just do it for one app. Now, TikTok is amazing. It's a Leviathan. It's huge. It's so popular. It works really well. And so it would have an effect, but it would just push people to another app. So we really need a comprehensive set of tools to deal with this through regulation. And right now, we just have an absolute dereliction of duty of our elected officials, both sides of the aisle, for decades to set up anything meaningful to allow us to deal with this problem. We just don't have the tools we need. And so we use a ban and it's just not working well.

Dave Bittner: What sort of regulations do you think could be effective here?

Adam Marre: Well, one to really think about -- well, first of all, I've mentioned one, which is foreign ownership of broadcast networks. We just need to have a conceptualization of these social media apps that doesn't just treat them like an online bulletin board, which is essentially what we're doing right now, or even like a newspaper. Many of the national security arguments that were presented to the Supreme Court were based on analogies to mail order propaganda or newspapers. And I just don't think any of those analogies, they're apt in some ways, but they fail to capture how social media apps and how the internet is different, especially with these algorithms. So we should capture in a different way legally what these entities are and then control their ownership to a way that satisfies national security concerns and will give us a better way to deal with it. So that's one. Another one is, you know, Section 230. And that's really, you know, legislation passed back in the '90s that allows these online applications to be free of any kind of responsibility for the things that are posted on their sites. And it was very important to pass at the time. But we are way, we're decades beyond the need for that, especially when it comes to these social media apps. So one thing that's been suggested, I think, is a very interesting thing that would give us another tool is making companies, social media companies accountable for what their algorithms serve up people. So they may not be accountable for individual posts, but they would be accountable for what an algorithm serves them up. So that would help us have additional controls. And then in addition to that, you could have transparency on what the algorithm is doing and how it works. And if anyone is putting their thumb on the scale one way or the other of what the algorithm is serving up, these kinds of laws, or at least exploring them or working on them, would give us more tools so that it wouldn't just be banned TikTok because we think they might be serving up propaganda or making all these young people who are online feel just that much worse about America and just that much more positive about other things. We would know if they were doing that, if there was transparency laws passed and how these algorithms work. But not only would it help us with TikTok, it would help us with all the U.S.-based companies like Facebook, Instagram, X, all of these. We would have the same set of tools that could help us with that problem and would also address, you know, foreign-owned apps like this one.

Dave Bittner: You know, I think to the recent inauguration and the leaders of these social media companies were in the front row seats there, which on the one hand makes me wonder if there's possibly any appetite in the current administration to take something on like this. But on the other hand, could the TikTok situation be a way to get your foot in the door on this, to use, like you're saying, with the clear issue of foreign ownership to start that conversation?

Adam Marre: I was really hoping that that would be the case, that this ban would be leveraged, or the idea of TikTok being a problem would be leveraged to create more comprehensive solutions here. Because people rightly brought up, when people were first talking about the ban, they rightly brought up, hey, what about all the other social media companies? And don't they just sell our information on a data broker market and foreign entities can buy that information anyway? And all of that is true. It doesn't necessarily address the algorithmic propaganda situation, but it does, you know, talk about how our information can be sold and is collected by many of these organizations. So I was hoping that that conversation would turn to, hey, maybe we should do regulation holistically. Unfortunately, it was a ban focused on one particular app, and I was also hoping that in the execution of this, we would realize how sort of we lack the appropriate tools. And now the fear, the concern is that this ban will be handled poorly. It will be seen as more of like a political stunt than anything else. And it just won't address the problem. And then that will be used as proof that tech regulation is too difficult, too messy and not worth pursuing rather than providing a way for us or an example for us to do more of it. So that that is the concern about this particular ban, especially with the way it's gone so far.

Dave Bittner: Is anyone else leading the way when it comes to restrictions on the algorithms themselves? And obviously, you know, you think about GDPR in the UK, which in my mind is really focused on privacy and people being able to control their information. But I'm trying to think, are there any legislative solutions globally that directly address the algorithms and what they put in front of us?

Adam Marre: So the Europeans have some legislation that's aiming toward this, trying to help get transparency in some of these algorithms and some other countries have been exploring this as well. I really do think the United States needs to take a leadership role here like we have failed to do on regulating technology companies at large. As we failed to do on privacy, we still don't have a federal national privacy legislation of any kind that's meaningful. We need to do this. We need to get ahead, lead the way. And, you know, we provided this innovation of the world that others have, you know, looked at and then built upon like TikTok, which is great. It's amazing. But we need to lead the way in helping people to have transparency into this. When I'm talking about your question about the algorithmic transparency, this isn't even telling them what they can and can't do with the algorithms. It's literally just trying to provide transparency to people that use it so they know what it's doing. And that would be very useful. Now, that's very technical. It's not easy to do. But I do think it's worth it for us to get it to get this right. And unfortunately, right now, I don't see a great example out there in the world of something that we could follow, which is why I think we need to get ahead of it and lead the way.

Dave Bittner: Ben, interesting stuff, huh?

Ben Yelin: Yeah. I mean, the TikTok thing still fascinates me because the law is just kind of not being enforced right now.

Dave Bittner: Right.

Ben Yelin: Technically, the president was supposed to only cease enforcement if there was a deal imminent for some type of American entity to purchase TikTok from ByteDance. That doesn't seem to have happened, but not only has TikTok remained on people's devices, now it's back in the Apple and Google app stores. So just really interesting stuff. I think Congress passed this law with well-documented evidence about the Chinese government's influence in ByteDance. It was well thought out. It was a bipartisan bill. It was signed by former President Biden, and now it's just kind of hanging by a thread and not really being enforced.

Dave Bittner: Right. Yeah. All right. Well, our thanks to Adam Marre from Arctic Wolf for joining us. Always appreciate him taking the time. [ Music ] And that is "Caveat" brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to caveat@n2k.com. This episode is produced by Liz Stokes. Our executive producer is Jennifer Eiben. The show is mixed by Trey Hester. Peter Kilpe is our publisher. I'm Dave Bittner.

Ben Yelin: And I'm Ben Yelin.

Dave Bittner: Thanks for listening.