Deep in the tech of Texas.

Dave Bittner: Hello, everyone, and welcome to "Caveat," N2K CyberWire's Privacy Surveillance Law and Policy Podcast. I'm Dave Bittner, and joining me is my co-host Ben Yelin from the University of Maryland Center for Health and Homeland Security. Hey there, Ben.

Ben Yelin: Hello, Dave.

Dave Bittner: On today's show, Ben has the story of a new Texas law requiring age verification on social media sites. I dig into proposed budget cuts to CISA from the Trump administration. While this show covers legal topics and Ben is a lawyer, the views expressed do not constitute legal advice. For official legal advice on any of the topics we cover, please contact your attorney. [ Music ] All right, Ben, let's jump into things here. You want to start us off for us?

Ben Yelin: Sure. So Governor Greg Abbott of the state of Texas just signed a new law this past week, forcing Google and Apple -- the owners of your favorite app store, at least one of your favorite app stores -- to check the ages of mobile app store users and require parents' permission before a teenager or child can download an app or use it to buy something. This is the second of this type of law in the country. Previously, a similar law passed in the state of Utah. There was a First Amendment challenge to an earlier version of this measure that actually made it up to the Supreme Court, but the Supreme Court punted it back down to state courts as they work to adjudicate some of the key issues here. But there are a lot of attendant First Amendment issues, not so much about whether kids have the right to access these applications, but whether this is going to keep out adults who have a First Amendment constitutional right of freedom of speech, freedom of association, etc.

Dave Bittner: Okay.

Ben Yelin: The interesting part of this battle here is who does the age verification? So a lot of previous legislation has passed requiring not just app developers but website owners to do age verifications. We've seen that for things like Pornhub and other adult-themed websites.

Dave Bittner: Right, that makes sense.

Ben Yelin: And I think those websites, understanding their place in the ecosystem, have been fine trying to comply with that. I mean, there have been lawsuits, and certainly organizations like the Electronic Frontier Foundation has been against these types of laws just because they could chill freedom of association. And to do age verification, you have to submit documentation, and the documentation might be vulnerable for some type of data breach or cyberattack, what have you?

Dave Bittner: Right, right.

Ben Yelin: What this law seeks to do is to go to the source, the owners of the app stores, and have the age verification occur before any app is downloaded onto a device. So it's just a different approach entirely that seeks to achieve the same goal, to keep kids off of social media applications that, at least in the opinion of Texas state legislators, they shouldn't be on. There are a couple of problems with this approach. One is if you require it for every application, then a parent is going to need to sign off on a kid that downloads the Weather Channel app or ESPN. It seems a little bit indirect from that perspective. I think this is intended for things like Facebook, Instagram, TikTok, etc. --

Dave Bittner: Yeah.

Ben Yelin: -- because I think the professed opinion of the Texas State Legislature is that these social media sites are bad for kids, but it would end up affecting every application. The other problem -- this is a problem identified by Google and Apple and their lobbyists -- is that it would require them to collect a lot of personal information, and they're worried about that because that information could either get into the wrong hands, or it would have to be shared with app developers, and that's something that Apple and Google aren't comfortable with. What's really funny here, at least to me, is that there are the App Store folks, Apple and Google, and then there are the platform folks, the ones who actually control the applications, like Meta, and they're arguing about which entity should do the age verification here. So Meta was a major proponent of this law. They think that because the entryway into the app world is through these app stores, it makes sense that Google and Apple are the ones who are going to be required to do age verification. But Google and Apple have well -- actually, let's start with Apple first because Google's kind of a funny, interesting case.

Dave Bittner: Okay.

Ben Yelin: Apple comes back and says this should be done on the applications. We're concerned about people's personal information. It's something that might be a threat if somebody has to upload documentation that might end up in the hands of applications the user didn't intend. So it's bad from that perspective. Meta is kind of -- has a foot in both camps, so they are both. They -- I'm sorry, Google has a foot in both camps because Google runs both its own app store, but also owns YouTube, which is an application that's going to be subject to these regulations, so they've kind of tried to take a middle ground. But what I find funny here is like, obviously, this is going to be a burdensome regulation to comply with, no matter who has to do the age verification, whether it's the app stores or the applications. But each side is kind of backfilling their own justification for why somebody else should be the ones required to do the age verification.

Dave Bittner: Right, right.

Ben Yelin: And like do they hold these beliefs for some type of deep moral conviction, or have they done their research and realized which is a better policy approach? Maybe. But my suspicion is they hired some lobbyists and said we really don't want to do this because it's burdensome, and we just want people to very quickly purchase and download applications through our app stores, and we don't want to have to make them worry about age verification. So can't Meta just do it? And figure out a reason that doesn't sound like we're just being selfish and trying to protect our own interests. So I kind of feel like that's ultimately what's happening here. And that part of the story, I think, is funny to me. It's like the younger brother, you know, doing a PowerPoint presentation in front of the parents of why his older sister should be the one to take out the garbage, you know? Right, exactly. And it's instead of just saying like I want her to do it because I don't want to do it --

Dave Bittner: Right.

Ben Yelin: -- the argument is the older child should be required to take out the garbage because if you, you know, look at our family history --

Dave Bittner: Right?

Ben Yelin: It just feel likes -- feels like that sort of thing is happening here, and that's the type of thing that I feel like is not frequently acknowledged in news articles in a way that kind of bothers me. Like I think we should all be more honest about it. I think this is especially true in the legal world where parties are outcome-focused, but courts can't just say like I favor X party because I like them and want them to win. Like you have to come up with some legally justifiable reason, and this is for every element of the case, not just the final disposition, but like why they should have standing to sue in the first place.

Dave Bittner: Right.

Ben Yelin: And so much of lawyering is just like pretending that you care deeply about the Administrative Procedure Act and not that you care deeply that, if the government regulates you, you're going to lose a lot off of your bottom line. Like it's just -- it's funny how that happens. And to me, it would be more honest of news publications to just put that out in the open as why these companies have -- hold the positions that they hold.

Dave Bittner: Right, it's for the children.

Ben Yelin: Exactly.

Dave Bittner: Well, you know, something that strikes me about this, particularly from Apple's point of view -- and I have experience here -- is that we have, I guess, what are -- what Apple calls our family accounts, okay? And so that --

Ben Yelin: Because we're all family here at N2K CyberWire.

Dave Bittner: Well, I mean the Bittner family.

Ben Yelin: Oh, okay, oh.

Dave Bittner: Right.

Ben Yelin: I thought you were using family more colloquially.

Dave Bittner: No, no, no. So my actual family --

Ben Yelin: Okay, got you.

Dave Bittner: -- you know, my wife and our two sons, until recently, because our youngest son, not long ago, turned 18. But until he turned 18, we had a function turned on with Apple, where basically every time he wanted to load an app onto his phone, we got a notice for approval, saying, you know, Jack wants to load whatever, you know, Dungeons and Dragons dice rolling app. Do you approve? And we would either approve or deny. So my point is that functionality is built in to Apple's ecosystem already, that parents can do that. There's a way to opt into that. You have to go through and set it up. It's -- and it's not mandatory, of course. It's not -- there's no law. It's just something --

Ben Yelin: Right.

Dave Bittner: -- Apple built into their system that we took advantage of. Now, to your earlier point, sometimes it is a royal pain in the butt because you're just, you know, you're sitting -- going along minding your own business, and for whatever reason your kid decides they want to stock up on apps --

Ben Yelin: So going to have to go through and approve all of these, yeah.

Dave Bittner: -- these alerts like, okay. And you don't know what half of them are, you know? It's like -- but, you know, at the same time it keeps them -- it does help. It lets them know that you're keeping an eye on things, and potentially, I could see it getting in the way of them downloading -- using something you didn't want them to use.

Ben Yelin: It is interesting that they have that functionality, and yet they're so adamantly in opposition of having this be a regulation for the 30 million people that live in Texas. I think part of it is that Texas is a very big state, and it can be kind of a trend-setting state. And because it's so big, it has a significant market share in the United States. This is something that Apple is probably going to have to apply across states because if they're going to have this functionality that requires age verification, it's going to be hard to just limit that to Texas because they're the ones that pass the law. It's probably going to end up, like GDPR, having broader applicability. I'll also note, though, that like Apple -- so you have that functionality. This law makes it mandatory and requires some type of documentation for certain applications, at least. But the Wall Street Journal reported that Tim Cook called the governor of Texas, Greg Abbott, personally, to ask for changes in the law or for him to veto the bill. Abbott was unmoved; he signed the law. But it's just interesting that Apple views this as some type of existential threat, where the CEO of the company would call the governor and encourage him to veto this bill. So they must think that they have some significant interest in this.

Dave Bittner: Yeah.

Ben Yelin: I'm sure it's just administratively difficult to put online as functionality and to have it be universal, and I'm sure there are particulars in the law that make this more difficult than the type of parental verification you did voluntarily.

Dave Bittner: Right.

Ben Yelin: But it is interesting to me that they fought back so hard against this.

Dave Bittner: Yeah, I -- and I wonder what the difference is between, from Apple's point of view, the thing that they are already providing on a voluntary basis versus a mandatory requirement from a state. Could it be as simple as the -- who's going to store all of these IDs? You know, we don't want -- we don't want the liability of that age verification. We've talked about this before about like the difference between, you know, going to buy a six pack of beer at a liquor store where they check your ID, but they don't keep it.

Ben Yelin: Right.

Dave Bittner: Right? They don't keep it forever.

Ben Yelin: Right.

Dave Bittner: And that's a major difference with an online verification. Presumably, you're uploading something to them, and what we really need is some sort of electronic verification. And I know these things do exist, and there's certainly people who have chipped around the edges of this, of just in the same way that something like Face ID verifies that you are the person who's authorized to unlock this mobile device.

Ben Yelin: Right, right.

Dave Bittner: Merely just send a yes signal that the person who is trying to download this app, we have verified locally on the device that this person is above the age that you require them to be.

Ben Yelin: Yeah, I think that's true. I think there are also other ways you could go about this. One thing that Apple and Google have lobbied for is replacing age verification with what's called age assurance. So children's ages would be input by parents on the device, but then shared only as an inexact age range with app developers. So instead of sharing specific data on that user, you would minimize identifying details such as birthdays by just saying this is somebody between the ages of 11 and 18 --

Dave Bittner: Right.

Ben Yelin: -- if that makes sense.

Dave Bittner: Sure.

Ben Yelin: And I think that is a reasonable alternative. I just -- can I just very quickly go back to this point of Meta and Alphabet -- Google's parent company -- slash Apple and their backdoor justifications for this?

Dave Bittner: Please.

Ben Yelin: Meta's quote, and this is an Reuters article that we can put in the show notes: "Parents want a one-stop shop to verify their child's age and grant permission for them to download apps in a privacy-preserving way. The App Store is the best place for it, and more than one-third of U.S. states have introduced bills recognizing the central role app stores play," although this is just the second state that has enacted one of those bills.

Dave Bittner: Yeah.

Ben Yelin: But then the vice president of litigation at the Chamber of Progress -- a group backed by Apple and Alphabet -- said "a big path for challenges that this burdens adult speech in attempting to regulate children's speech." Their argument is this is a content-based regulation singling out digital communications. It's just like am I too much of a cynic to just be sitting back and realize this is all a bunch of BS?

Dave Bittner: Yeah. Well, for me, any company who wants to be your universal point of sign-on is being disingenuous here, right? And all three of these companies are that.

Ben Yelin: Right.

Dave Bittner: Right? Sign on with Facebook. Sign on with Google. Sign on with your Apple ID.

Ben Yelin: Right.

Dave Bittner: Like they all want to be the center of your sign-on universe. And you know, good news -- we're going to make this easier for you, and you'll be able to pay through us and log on in one place and just -- and never --

Ben Yelin: Your one-stop shop, yeah.

Dave Bittner: Right, never mind that we're going to track all of that because, you know, that's what we really want to do --

Ben Yelin: Yeah.

Dave Bittner: -- and monetize it and all that kind of stuff. So to me, if you're an organization who is leading with that, who really wants to do that, I find it hard to believe that -- you want to transfer the extra burden of age verification onto the verification that you really want to do, and you want to transfer that to one of your competitors.

Ben Yelin: Make them do it.

Dave Bittner: Yeah, make them do it so that we don't have to.

Ben Yelin: I will say, to add a little bit of fuel to Meta's fire in these circumstances, there have been allegations that, particularly Apple, has had a hands-off approach to regulating its App Store. So we've seen lots of incidents with developers publishing apps that were rated safe for kids, but then it turned out they provided sexualized content or other content inappropriate for children, including things like AI girlfriend simulators, which we've talked about, or kind of what they call appearance-rating tools. You might remember from Social Network the Hot-or-Not or rate-my -- rate-my-friends type things. So I think from that perspective, as a measure to sort of punish Apple for its past leniency, I think it makes sense to put this on the App Store, and I think there are other reasons. Since the App Store is kind of the gate into the world of applications, to put it there, I just don't think Meta is the best messenger on this.

Dave Bittner: I also think it's interesting that this bill originally was going to try to keep teens off of social media altogether, and they dropped that. The Texas lawmakers dropped that, so --

Ben Yelin: Yeah, I still think they're trying to build support for that. I think this is the halfway measure of requiring age verification. At least there will be parental notice for the use of these applications, so it does put more of a burden on the parents, people like you, to go in and say, I don't want my kid downloading this application. But we're not putting the burden, at this point, on the app makers themselves to try and keep children off of their applications. At this point, that -- I mean Meta's responsibility is to make sure that 12-year-olds don't have accounts on Facebook. But right now, they're -- they don't have the responsibility to keep teenagers off of Facebook, and the fact that Texas was unable to push this law forward I think certainly indicative of how big of a fight that's going to be. Meta makes a lot of money from its younger users, and I do think there are First Amendment interests at play when we're talking about blanket bans on social media, even for young people, because I think these types of blanket bans really could shut off avenues for free speech and expression. So that gets into some really complicated stuff. But this is more of a halfway measure where you're requiring that age verification. It does put an additional burden on the parents and the app stores. So it's just kind of a way to do your best without a blanket ban on social media use of children to keep children out of the worst of these applications.

Dave Bittner: Yeah, and this law is set to take effect next year, although, as this article points out, we can count on there being some legal challenges, so we'll see where it goes.

Ben Yelin: Yes, stay tuned for that. But yeah, it is scheduled to go into effect January 1 in the state of Texas.

Dave Bittner: Interesting. All right, I tell you what. Let's take a quick break to hear from our show sponsor. We'll be right back after this. [ Music ] All right, Ben. We are back, and I wanted to take a look this week at the White House budget proposal, which we've been getting more and more details about.

Ben Yelin: Yeah, when you want to make something really well-known, you release the full version of it on a Friday night.

Dave Bittner: Yes.

Ben Yelin: Right as people in D.C. are going home from work --

Dave Bittner: Right, right.

Ben Yelin: -- and that's what happened here.

Dave Bittner: I heard someone refer to it as the Coward's Hour.

Ben Yelin: Yes. That's when -- that's when I drop any piece of bad news about myself --

Dave Bittner: Right.

Ben Yelin: -- 5:01 PM on a Friday.

Dave Bittner: Right, right, exactly. So I want to dig in here specifically on some of the proposed budget cuts to CISA, which of course is the Cybersecurity Infrastructure and Security Administration. Did I get that right? Administration? Yeah, it's Administration. They are going to be under the chopping block for all kinds of things. They're looking to cut over 1,000 positions at CISA, cutting their budget by nearly half a billion dollars, and that'll reduce their total funding to about two-and-a-half billion dollars. So think about, you know, that's a big chunk of their total budget, and this is actually more than some of the previous budget projections that had been shared earlier. They're just -- they're looking to reduce hundreds of positions all over the organization. Looking at through this article here, 325 positions eliminated through a workforce transition program. This is the thing we've heard about offering early retirement. And then 300 positions are cut by not funding existing vacancy -- existing vacancies, so empty jobs just won't get filled. But then there's other things like cutting mission support enterprise services. This is 100 jobs there. They're going to eliminate the Office of Equity, Diversity, Inclusion, and Accessibility.

Ben Yelin: Yeah, shocker on that one.

Dave Bittner: I was going to say no surprises there.

Ben Yelin: Yeah.

Dave Bittner: And then the stakeholder engagement consolidation, another 100 positions there. That gets rid of things like international affairs. They say CISA will focus on its sector risk management agency for things like critical infrastructure. So before we dig into some more of these details, Ben, what's your take here on this?

Ben Yelin: So they say that this proposal only cuts mission-critical positions, and that might be true in some sense, but I think it's potentially misleading. I mean, when you talk about the offices of international affairs, this is about the type of diplomatic work needed between us and our allies to counter emerging threats from nation-states. So it might not meet their definition of mission-critical, but at least I would consider that to be mission-critical work, and I think we'd be losing a lot by eliminating those positions. There are also cuts: 71 positions being cut in regional operations, 63 positions are being cut by ending federal support for bombing-prevention programs, federal school safety initiatives, cyber and physical security exercises, which they're now pushing the responsibility for those to states and localities, which don't have the funding to carry those out themselves. They are zeroing out grant funds that have been given to states to improve their own cybersecurity posture. They did that through the proposed FEMA budget, so that's not even through CISA. So if you put the puzzle together, this is, I think, a huge hit to our nation's cybersecurity infrastructure. And you can't just say these positions are non-mission critical and then cut to this degree because it's not just the Office of Diversity, Equity, and Inclusion.

Dave Bittner: Right.

Ben Yelin: It certainly gets into more operational stuff than that, and I think it's going to have a big impact.

Dave Bittner: Well, and of course, Director of Homeland Security Kristi Noem centers much of this in her comments on getting rid of CISA's mission of election security. And much like how earlier in the show you were saying, I wish news reporters would just simply say what something is, right?

Ben Yelin: Yup.

Dave Bittner: I just continue to posit that all of this animosity toward CISA is just residual fallout from President Trump's refusal to accept the outcome of the 2020 election.

Ben Yelin: He's obsessed with this. I mean, it's not conjecture. Like just look at the history here. CISA came into existence under the first Trump administration. Christopher Krebs said a week after the 2020 election that this was a secure election.

Dave Bittner: Right.

Ben Yelin: He's immediately fired, gets -- becomes persona non grata in Trump's world. Trump has instructed all agencies of the federal government, including the Justice Department, post hoc, this is four years after Krebs has had an official government position to dig into Krebs and figure out if there's anything we can charge him for, basically. I mean, I'm not really exaggerating that that's what he instructed his cabinet to do.

Dave Bittner: Yeah.

Ben Yelin: So this has been an obsession of his. I wish he wouldn't take out this personal grievance on the mission-critical work that CISA has done and the improvements that have been made over the past several years, bipartisan improvements.

Dave Bittner: Right.

Ben Yelin: And I know that there are a lot of legislators on the Republican side who believe in CISA's mission, and that's where the politics of this comes in. This is just a proposal. The president's budget proposal never gets enacted word for word. Congress is always going to make changes. In many years, when we have divided government, the proposal is just immediately dead on arrival, laughed out of the room, and we generally get what are called continuing resolutions, where you might tinker things here and there, but largely you just resume last year's funding levels.

Dave Bittner: Right.

Ben Yelin: The reason that might not happen this year is Republicans have unified control. So they have 53 seats in the -- in the Senate. They have 220 seats and a majority in the House. You do need 60 votes for appropriations bills, unlike reconciliation bills, which we talked about in last week's episode.

Dave Bittner: Right, right.

Ben Yelin: I realize this is all getting complicated, but --

Dave Bittner: The glory of the bird rule.

Ben Yelin: The bird rule. Yeah, I know the phones have been ringing off the hook for you guys on that one. So yeah, they would need seven Democrats to sign on to this, and there are going to be other things in the president's proposal that Democrats are going to object to. So I would say Occam's razor here is that we're going to get another continuing resolution, and CISA's funding is going to be maintained, but it's certainly something that if stakeholders, especially state and local officials and private sector folks who appreciate this level of information sharing, in particular, if they don't get involved, this is something that might fall into place by September 30, which is the end of the fiscal year.

Dave Bittner: Yeah.

Ben Yelin: So I think it's important to raise awareness on what's happening here because I do think it would have a big impact on cybersecurity in this country.

Dave Bittner: Yeah, this article points out some cuts at some other federal agencies. They look at the Department of Energy, which is cutting $50 million from their Office of Cybersecurity, Energy Security and Emergency Response, cutting them from $200 million to $150 million. You alluded to earlier zeroing out the FEMA cybersecurity grant program, which had $100 million dollars this past year. So just getting rid of that. I mean, I again, I scratch my head at the animosity towards FEMA.

Ben Yelin: And really, this is -- it's FEMA that administers the grant, but the grants are given to state governments, and then state governments have given that out to local agencies. I know we've done a lot of work with this funding to help local offices of emergency management, local public health departments improve their cybersecurity posture. So they may dislike FEMA as an agency, which is their right. Certainly, it hasn't been perfect, but really, what this type of thing ends up hurting is state and local governments who rely on this federal funding to do some of the cybersecurity work, and there's just no way you can make up that funding.

Dave Bittner: Yeah.

Ben Yelin: It's not a significant amount of funding in the context of a federal budget, but the portion of the budget that states are missing out on is a big chunk of money in the context of a state budget, and it's hard for states to make up those lost dollars elsewhere when there are all sorts of federal cuts coming down the pike.

Dave Bittner: Yeah.

Ben Yelin: So, yeah, I think that's kind of an underrated one I'm looking out for here: the FEMA cybersecurity grant program.

Dave Bittner: Yeah, it'll be interesting to see how this all aligns with whatever kind of hurricane season we get this year, because --

Ben Yelin: Yeah, we keep hearing that like FEMA cuts are coming, even as the hurricane season arrives, and I certainly see why that's been the frame of the issue, at least in news stories. But FEMA does so much on the preparedness side that is unheralded. You're never going to get an article that says Congratulations, we just completed our latest full-scale exercise, and now we're prepared for a hurricane because we tested out our communications equipment.

Dave Bittner: Right.

Ben Yelin: I read those articles.

Dave Bittner: Well, I'm glad you do, Ben.

Ben Yelin: But it's not like that's A1 on the New York Times or The Washington Post.

Dave Bittner: Right.

Ben Yelin: Everybody always talks about the recovery money that comes after the disaster, but these FEMA cuts are going to, if they go into effect, hurt all portions of emergency preparedness and response.

Dave Bittner: Yeah.

Ben Yelin: And that's something now that's filtered down into cybersecurity. Even though certainly the threat landscape hasn't changed, we are still seeing a huge number of attacks on private institutions, on state agencies, on public school systems, on hospital systems.

Dave Bittner: Right.

Ben Yelin: So the threat isn't going to go away, even if the funding goes away, and we're just going to have fewer resources to deal with what happens.

Dave Bittner: Yeah, and I guess looking at the big picture, that's the thing that leaves me most confused is that our adversaries are doing one thing, which is doubling down on their efforts, right? They are not cutting back. There are no indications that our adversaries are cutting back on their efforts. So this idea that we're cutting back on our efforts, in my mind, is a real issue with national security, and I think people should take it seriously. And fortunately, there are people in Congress who are taking it seriously, and hopefully they'll have enough influence to maybe get some of this stuff to head in a different direction, but --

Ben Yelin: I hope so. I mean, it's one thing to write a letter saying we support CISA and its mission, which I think a lot of senators and members of the House and both parties have done. But like is that going to be somebody's dividing line between passing or not passing an appropriations bill? Like are you going to demand a certain level of funding for this one agency? That's what I'm concerned about. Like there's some huge budget deal, and buried down there are significant cuts to CISA that we just don't really end up knowing or caring too much about as this makes its way through Congress, but will end up having a big impact down the line.

Dave Bittner: Yeah.

Ben Yelin: So I do hope that this is the type of thing where once Congress goes through their annual appropriations bills, we're entering appropriation season in the House of Representatives. So we'll have a better idea soon as to how the House is looking at these presidential budget proposals. Are they going to hew closely to them? Are they going to take their -- are they going to kind of go their own way? Is it going to depend on which subcommittee is taking up the legislation? All of that remains to be seen. But this is something certainly I'll be keeping track of and I think something we'll definitely bring up on this podcast again.

Dave Bittner: Yeah, count on it. All right, well, that's what we've got to share this week, and of course, we would love to hear from you if there's something you'd like us to discuss on the show. You can email us; it's caveat@n2k.com. [ Music ] And that is "Caveat" brought to you by N2K CyberWire. This episode is produced by Liz Stokes. Our executive producer is Jennifer Eiben. The show is mixed by Tré Hester. Peter Kilpe is our publisher. I'm Dave Bittner.

Ben Yelin: And I'm Ben Yelin.

Dave Bittner: Thanks for listening.