Trump's tariff battle.
Dave Bittner: Hello, everyone, and welcome to Caveat, N2K CyberWire's privacy, surveillance, law, and policy podcast. I'm Dave Bittner, and joining me is my co-host Ben Yelin from the University of Maryland Center for Cyber, Health, and Hazard Strategies. Hey there, Ben.
Ben Yelin: Hello, Dave.
Dave Bittner: On today's show, we are once again joined by our N2K CyberWire colleague Ethan Cook with a look at the recent Supreme Court decision on tariffs, and later in the show, my conversation with Jeff Williams, founder of OWASP and Co-Founder and CTO of Contrast Security. We're talking about how NIST is rethinking its role in analyzing software vulnerabilities. While this show covers legal topics and Ben is a lawyer, the views expressed do not constitute legal advice. For official legal advice on any of the topics we cover, please contact your attorney. [ Music ] All right, gentlemen, let's jump in here. I think it's fair to say that this decision by the Supreme Court is perhaps one of the most impactful that we've seen in President Trump's second term. Fair to say?
Ethan Cook: I would say in the past almost like two terms. It's pretty big.
Ben Yelin: It's a big decision. It was long anticipated both by the legal community, which I consider myself a part of sometimes, and more importantly, the business community. They had heard oral arguments in May, and it was just kind of this tick-tock of when are we going to find out if this tariff regime was legal, and all of a sudden on a random Friday in February, we got our decision.
Dave Bittner: Yeah. All right, well, let's dig in here. I know, Ethan, that you've been kind of boning up on the history of this. Do you want to do a little bit of the background and what led us to where we are today?
Ethan Cook: Yeah. So, obviously, Trump's tariffs are no secret. They have been something that's been going on since almost day one of this administration and has been talked about well before he took office, on his campaign trail. Tariffs are also not a new concept. They are something that have been used historically for, you know, hundreds of years as a way to use economic leverage, etc. When he took office, one of the ways -- he did do multiple ways to institute tariffs. One of the ways he did it was through the International Emergency Economic Powers Act, or IEEPA. I don't know if there's an official way to say that, like "eye-EE-pah" [phonetic] or something.
Ben Yelin: You can do IEEPA [laughter].
Ethan Cook: And that was what was being discussed in this case. So basically, he used the International Emergency Powers Act to issue tariffs on various countries. Now, notably, the law itself doesn't have any mention of tariff in the actual text of the law, and no previous president has ever used this law to impose tariffs this way. So when they were, in getting sued, whether or not this was a constitutional power of his, it made its way eventually all the way up to the Supreme Court and, as mentioned, it was heard in May, and now we're at the point where we've just released the decision and it was kind of shocking. It was a 6-3 decision, so this was a overwhelming decision to say that he could not have done this. This was an illegal use of the law, and he -- I think it was partially surprising because it is a currently Republican-held Supreme Court, so there were several flips on this one that we weren't expecting.
Dave Bittner: So can we dig into what this act that he was using, the center of this, what its original intention is perceived to be, Ben?
Ben Yelin: Sure. So this was enacted in the middle 1970s. There was a predecessor act. The IEEPA actually revised. The idea is that if there is some declared national emergency, and generally the time it was thought that this would be related to foreign governments, this was Cold War era, that the president had the authority to take action to protect our national security through economic means. So the word "tariff" is actually not mentioned in the statute. One of the provisions, the one that's relevant here, is it gives a president the power to, quote, "regulate imports," and so the question for the Supreme Court was, does that "regulate imports" language justify these sort of across-the-board tariffs that go into place and then are revoked and then go into place again and then are imposed on random countries or islands that are only populated by penguins [laughter]. But the heart of the dispute is whether that language that the president, under a declared emergency, can regulate imports, does that include the type of tariffs that we've seen in this case here? And I think it was really intended, like if there was some type of foreign threat and we thought that imports from the Soviet Union on various types of gadgets would present a national security risk, the president would have the authority without having to seek approval from Congress to prohibit the import of those gadgets, if that makes sense. That was the basic justification for this law.
Dave Bittner: Yeah. So let's talk about the emergency component here. Maybe you can fill us in, Ethan, because I think when President Trump did this, some eyebrows were raised, the conditions by which he declared a national emergency.
Ethan Cook: Yeah. So, you know, since taking office, he has been very adamant that the U.S. is at a trade, you know, crisis, I guess the best way -- or emergency, to use the better term, and that we have been being, you know, screwed over left and right by other countries who are, you know, taking advantage of the U.S. economy. The U.S. economy is suffering because of it, etc., yada, yada, yada. That's the rhetoric, and that has been a justification to kind of launch this aggressive across-the-board trade war with allies, foreign adversaries, etc., as a way to use tariffs as a leveraging power tool of sorts, hitting it as a, say, of we're going to hit both of these countries with, let's say, a universal, both, you know, 10% tariff on whatever the product is, and whoever comes to the table first will lower those tariffs to get an incentive for your domestic manufacturing, etc. And so realistically, I think the idea behind them was it was a way to, quote-unquote, "get more domestic infrastructure and growth within the U.S.," but also to leverage trade deals and force other countries to compete for the U.S.'s favor in these trade deals.
Dave Bittner: Also, he also summoned the notion of drugs coming into our country, right? That was part of it as well.
Ethan Cook: Yeah, that was a huge one with China. Yeah, so fentanyl has been a huge portion of this as well. Obviously, it is a major drug crisis within the U.S. and it has been something that has been really hard for the administration, both the previous and this current one, to deal with. Part of that is because fentanyl, the chemicals that are used to make fentanyl are used in a lot of other drugs, so it's not something that you can just, oh, ban X chemical, because that then turns off, you know, several other very legitimate uses of medication. So that has been a sticking point of, okay, you need to do better to control where these chemicals are going to, where these components are going to so we can control the import of fentanyl, and I think that has been also a "convenient emergency," quote-unquote, to spur this economic war of sorts.
Dave Bittner: Let's walk through what happened with this, how it played out up until the moment when it hit the Supreme Court. So, Ben, fill us in. Who initially took issue with this and brought legal challenges against this tariff regime?
Ben Yelin: So it was a bunch of small businesses who collectively decided to sue the federal government, saying that they had exceeded their authority. They got a favorable ruling from a federal district court. It got a little procedurally complicated because there's a special federal court that deals with trade-related matters, and then there's the normal federal courts of appeals, and there was actually a dispute about which court had jurisdiction over this. The specialized federal trade court was more sympathetic to the Trump administration's case, but given that there were -- there was this disagreement at the appellate level, the case ended up making it to the Supreme Court. They granted certiorari sometime last year, at the end of their 2024-2025 term and then heard the case at the beginning of this term, and again, there was a lot of anticipation for this decision and it certainly -- the decision itself certainly lived up to that hype.
Dave Bittner: What were the arguments made before the Supreme Court?
Ben Yelin: So the argument from the plaintiffs was that the IEEPA did not justify -- the language in the IEEPA did not justify these types of across-the-board tariffs. What the plaintiffs were saying is that this would misconstrue the statute and that this would be an overbroad interpretation of the statute, and they relied heavily on the so-called "Major Questions Doctrine," and this is something that the Supreme Court has articulated in a few cases over the previous years. Basically, the idea is you shouldn't interpret an act of Congress to give sweeping powers to federal agencies that have enormous economic and political impacts unless Congress has done so explicitly. And this is a doctrine that's been propagated by the conservative members of the court. It was used to knock down President Biden's student loan policy, which used a post-9/11 statute which says in a national emergency the president has the power to forgive student loans, and they said in that case that it would be an over-interpretation of that statute to grant kind of across-the-board student loan relief. That was intended for troops who were overseas during military engagements, you know, after some type of September 11th-type event.
Dave Bittner: Right.
Ben Yelin: So the plaintiffs leaned heavily on that argument. They also made the argument, and really the Supreme Court decision didn't do much to address this, that there's a slippery slope around declarations of emergencies. If a trade imbalance is an emergency, then everything is an emergency.
Dave Bittner: Right.
Ben Yelin: I mean, most of our history, there have been various trade imbalances. I think the Supreme Court is reluctant to wade into the question of what counts as an emergency. I think they --
Ethan Cook: Understandably so.
Ben Yelin: Right, they consider that as something that's best left to co-equal branches of government. From the administration's perspective, they said that this was not a Major Questions case, that this was a normal interpretation of the statute, that under the common dictionary definition of "regulate" and "tariffs," you could certainly justify this type of tariff regime, or regulate imports, rather, that you could justify this type of tariff regime. They also said that both parties can concede in this case that this statute would give the authority to a president to halt all imports from a particular country. So if the president can do that, why can they not slap even a $1 tariff on other countries, and the majority opinion kind of took issue with that argument, which I know we'll get to, but that was kind of the structure of each side's argument.
Dave Bittner: Well, for clarity here, Ethan, maybe you can explain to us how in non-emergency situations tariffs have generally worked.
Ethan Cook: Yeah. So the tariffs have been something that have always been a -- the president can impose tariffs. Let's, like, take a step back. That is something that he -- that they can legally do. However, the way Trump was doing it in this way was obviously the Supreme Court has disagreed with. Now, tariffs can also be imposed by Congress. That's not something that is like a unique power, from my understanding, but for example, it's actually one of the ways he is now pivoting to do it. There's a section called "Section 122," which allows the president to put in a tariff, but there are very limited ways that they can do this. There's typically audits that need to be done, you know, assessments that need to be done. There has to be -- it has to be time-limited, etc. There's minimal requirements. Through this previous -- kind of the reason why it was so broad-sweepingly impactful was because those standard processes were able to be bypassed, so now we didn't have to go through these extra steps. We can just kind of do these things where we wake up one day and we decide, all right, there's a 10% tariff on this country. Oh, wait, now there's a 15% tariff here, which is why we were almost getting this daily news of tariffs coming through. Now, tariffs are going to have to go through this little bit more long, elongated process, which, from what I understand, the business world is not even necessarily a fan of, at least from an international level, because now we don't really know. It didn't really clear up a lot of the questions we're having. It more so just pushed them to a new statute, and it didn't actually solve the question of, are these tariffs illegal or not? It's now, what is the next way we're going to be doing these tariffs? So with the Section 122, which is what we're currently doing, Trump went out and did a press conference right after this announcement came out and said, "I'm issuing a blanket 10%," later revised it to 15% tariff under this section. Worth noting that this section can only be done for 150 days, so it's very limited comparatively to the previous efforts that were being done and, you know, did make some exceptions for, let's say, products like steel or products that can't be produced in the U.S. You know, bananas, for example, that was a big one the first time we did it, and then we realized, oh, well, we can't grow bananas, so maybe we shouldn't tariff a banana.
Dave Bittner: People love their bananas.
Ethan Cook: Exactly, one of the most popular fruits in America. And now we're using that as the blanket method, and legally he can do that. That is, you know, something that he's allowed to do, and I think that is a stopgap for the momentary to keep imposing these tariffs while they figure out what other statutes they can do in the meantime.
Ben Yelin: To take just a quick step back, and all what you said is absolutely correct and critical, the Constitution says that it's the role of Congress to lay and collect taxes, including duties on foreign imports, which is tariffs. Congress has delegated some of that authority in these statutes that you mentioned to --
Ethan Cook: Right. Congress giving power to the executive? [laughter].
Ben Yelin: Knock me over with a feather, right? They've delegated a lot of this authority through these various statutes to the executive branch, and I think they intended to give the executive branch some level of flexibility because they don't want to have to come back and design unique tariffs every time there's some type of foreign threat, but as you said, they did want to introduce these procedural safeguards to make sure the tariffs weren't being imposed arbitrarily or for an undetermined unlimited amount of time. Yeah.
Dave Bittner: So I guess is it fair to say that what we would describe as standing tariffs, for example, I know there's a 100% tariff on Chinese auto manufacturers, right? And that's basically to keep Chinese electric cars out of our market. We just don't want them here because of lots of reasons, competitive and otherwise, but that sort of thing comes through Congress, right? Something that is long-lasting, that is put in place and is basically permanent until declared otherwise, that all happens through acts of Congress. Is that fair to say?
Ethan Cook: Yeah, I think so. Ben, would you agree?
Ben Yelin: Yeah, it is, and sometimes they use the authorities that they've already granted to the administration, but all of those are specific. And so, Ethan, you mentioned one of the statutes. There are others that would justify these types of tariffs based on very clearly identified national security risks so that they're not overbroad, and Congress can, of course, as they have done many times, impose their own tariffs if they're considered policy decision on how tariffs should be imposed over which countries, what the rates should be. They do that all the time. What we have not seen prior to this administration is the use of this IEEPA statute above and beyond what Congress has done and above and beyond what the administration has done under these other authorities. We just haven't seen this kind of blanket provision that would allow you to tariff everything at all times at any level for an indeterminate amount of time. That's kind of what's new in this era.
Dave Bittner: So, Ben, I know you are an avid follower of the Supreme Court, and so having watched the arguments in this case as we -- first of all, there was a lot of anticipation here because they took a long time to release their ruling.
Ben Yelin: Yeah, they did. I think the legal experts that I were reading, that I was reading basically were saying the indication is that there are going to be a lot of opinions here. There's going to be a majority opinion, there are going to be concurring opinions, there's going to be separate dissents. That's exactly what happened. I think every justice, or I should say most of the justices had their own viewpoint on this that they wanted to elucidate, sometimes in great detail. So this was a 6-3 decision, but I really look at it more as like a three, three, and three decision.
Dave Bittner: Hmm.
Ben Yelin: You have the three liberals who believe that these tariffs under IEEPA are unconstitutional based on just normal statutory interpretation, that this goes above and beyond the meaning of the words "regulate imports" that are in that IEEPA statute. Then you have the three majority makers who are conservative justices. Those are Chief Justice Roberts, Justice Gorsuch, and Justice Barrett, who are saying these are unconstitutional because of the Major Questions Doctrine, that if Congress meant to delegate these powers that have such large political and economic impacts to the administration, they would have done so explicitly. They've done so explicitly in other statutes, and to preserve separation of powers, we are not going to read in these vast sweeping powers to a relatively narrow statute that applies during emergencies.
Dave Bittner: Hmm.
Ben Yelin: So you had six justices saying that these types of tariffs are illegal, but the six justices are divided on why they're illegal, why these are unconstitutional.
Dave Bittner: Mm-hm.
Ben Yelin: And then you had the minority in this case, the dissenting opinion from Justices Thomas, Alito, and Kavanaugh, saying that these are constitutional even under the Major Questions Doctrine. So you have that kind of three, three, and three divide. I think the most important opinion, we can get into this, is Justice Gorsuch's concurring opinion. He's kind of concurring in his own judgment, but he's using it as an opportunity to opine on the Major Questions Doctrine, what it is, and why everybody else but him is wrong on it [laughter].
Dave Bittner: Imagine that.
Ben Yelin: And I think his opinion to me is kind of what ends up controlling here. If you are to extrapolate what kind of the narrowest grounds are for why this is an unconstitutional use of the IEEPA, I think he's the one who did the best job of kind of laying it out.
Dave Bittner: All right. Well, let's dig in. What did he say?
Ben Yelin: So he has problems with everybody [laughter]. He believes --
Dave Bittner: He doesn't get along well with others.
Ben Yelin: He believes very strongly in the Major Questions Doctrine. He's used it himself in previous cases. He believes in it.
Dave Bittner: Yeah.
Ben Yelin: He says that the liberals are wrong to say that this is not a Major Questions case. What the liberals were saying was you don't have to use this doctrine. You can just use normal rules of statutory interpretation to figure out that regulating imports doesn't mean taxing bananas that come into this country, that they don't have to resort to this other judicial philosophy, and what he says is the liberals are being inconsistent, that they want to get to a certain result in this case. So unlike in other previous cases, like the Biden student loan case where they were willing to argue, you know, the administration should be extremely deferential to whatever Congress may have intended in writing these relatively vague words, here they're going in the other direction. They're applying the Major Questions Doctrine without admitting that they're applying the Major Questions Doctrine, and the liberals took umbrage to that in the opinion from Justice Kagan. You can now understand why these opinions are hundreds of pages, because like they have to address every argument that the other person made, right?
Dave Bittner: Yeah.
Ben Yelin: So that was his problem with the three liberal justices. He had a problem with Justice Barrett. Justice Barrett has said that the Major Questions Doctrine itself should be construed narrowly. It's kind of a special exception. It's not to be applied in every single case, it's very context-specific, and Gorsuch says to her, like, you're being overly constrictive. This is a very live judicial doctrine. We've affirmed it in many cases. It certainly applies here. His problem with the dissenting justices is they are all believers in the Major Questions Doctrine. They were fully willing to throw out Biden's student loans, but here, he thinks they're bending over backwards to defend something that he sees as clearly unconstitutional, that if you're willing to say, "Well, Congress didn't intend for Joe Biden to excuse everybody's student loans," in that case, how could you say here that 'regulate imports' means across-the-board tariffs that can be turned on and turned off at will from a president who is rather impulsive?" My words not his. So that was his problem with the dissent. And then there's Justice Thomas, who wrote his own separate dissent, which was basically like Congress can delegate any power it wants to the president, and that power is virtually unlimited unless it concerns core constitutional rights like civil liberties, and Gorsuch said, like, that's freaking insane [laughter]. So if you do the math there, that's seven of the other eight justices that he criticized. It was only Chief Justice Roberts who he held his fire from, but I think that was his way of kind of threading the needle, to say, like, this is a Major Questions Doctrine case. Unlike the liberals, I believe in the Major Questions Doctrine and it applies here, and unlike the dissenting justices, I'm being consistent about it. It applies whether it's a Democratic president or a Republican president, and unlike Justice Barrett, I don't think this is some kind of special exception. I think this is something that's not context-specific, that it can be applied rather universally, and unlike Justice Thomas, I am not a judicial lunatic who thinks that [laughter] Congress can delegate all of its authority for all time to be administrative.
Ethan Cook: You're telling me that they just -- why even have them? Like, you know, under that logic, right?
Ben Yelin: Right, and that's a question I'm sure rhetorically Justice Thomas has asked himself [laughter], but that's kind of, I think, Justice Gorsuch's opinion, while it's kind of a Frank Costanza "I have problems with all of you people" Festivus celebration [laughter], I think it's the best distillation of what this opinion actually says. And sorry, that was a long-winded explanation, but that's my read of it.
Dave Bittner: So is it fair to say he's kind of the most intellectually consistent in what he's laid out here?
Ben Yelin: In his mind [laughter], and you know what? Frankly, in my mind, too.
Dave Bittner: Okay.
Ben Yelin: If your primary concern is intellectual consistency, I think the intellectually consistent position is that the Major Questions Doctrine, if you believe in it at all, clearly applies in this case as it does in the Biden student loan case, that if you believe that Congress would not delegate such powers to the executive branch, such major powers economically and politically without explicit authorization, if you believe in that doctrine, it's very clearly applicable in both of these cases. I believe that is the most intellectually consistent position. In defense of the liberals, there is nothing explicitly in the Constitution that justifies the Major Questions Doctrine.
Dave Bittner: Hmm.
Ben Yelin: Like, the Major Questions Doctrine is an interpretation of the principle of separation of powers, but there's nothing in the Constitution that says, like, if Congress passes a law the administration seeks to justify and it implies significant economic or political issues, then there has to be some type of explicit authorization. Like, that itself is not in the Constitution. So from a textualist perspective, I think it's very fair to argue that the Major Questions Doctrine is made up and doesn't exist, but if you're going to believe in it, as Gorsuch does, then the consistent position is that it should apply in this case as it did in the Biden student loan case.
Dave Bittner: Wow. So, Ethan, what happens next? I mean, you mentioned that President Trump has said he has other avenues with which to pursue his tariffs. Is he in for another round of being on a direct path to the Supreme Court?
Ethan Cook: Almost certainly. No, no, no, I don't -- I think there -- obviously, there's always going to be legal challenges, but some of the statutes, you know, are -- he does have legal power to impose these tariffs. I'm sure there would be people who argue they're overly broad, or etc. Whether they make it to the Supreme Court or not, who knows? I don't know if the Supreme Court will want to touch this again for some time. You know, obviously, they've drawn a lot of flak from the conservative side, with several of their justices, quote-unquote, "flipping," but I don't -- I think, to Ben's point, there is a lot more gray there than people would like to give credit for. So as I mentioned, he has imposed new tariffs already. I think there are two kind of outstanding questions, which is first, what do we do with the, you know, hundreds, over 100, I think it was 175 billion, something along those lines, of tariffs we've already collected through these imposed tariffs that are now unconstitutional. Do we refund them? Do we kind of just hold them and be like, "Ah, we'll take it"? Because there is a matter of that was a new line of funding for the government, that if we refund, we're now suddenly out 175 billion, which is not like, you know, make or break, but it's not a small amount of money either.
Dave Bittner: Right, it's not what you find in your couch cushions.
Ethan Cook: Exactly. And then there's, you know, I think -- I forget which justice it was, maybe it was Kavanaugh who said, "It's going to be a mess to give all this money back," or it was something in the -- and I was -- my thought on that was that, by that logic, we should never do any anything, because if it's a mess to do it, then what's the point, right? That was like, okay, you didn't really understand that perspective because that's -- we can apply that to any law. So that is one outstanding question, which I, to be honest, knowing the government, I think everyone just kind of going to wink-wink/nudge-nudge and just let it go kind of thing, and no one's really going to deal with it because we're going to move on from this and just take the 175 billion and pocket that into whatever.
Ben Yelin: It is weird, though. Like, there isn't an equitable solution. Whereas, like in most other cases, if some type -- if some other type of tax was unfair, like let's just say in a hypothetical world the government instituted some taxes that violated the equal protection clause, like Jews were taxed more than Christians or something, and it was very obviously unconstitutional --
Dave Bittner: Right.
Ben Yelin: Like, they -- there would be some type of remedy there where you would refund the unconstitutional taxes. I think just because of how complicated the policy is of collecting tariffs, I don't see how that happens here.
Ethan Cook: I don't think anyone's going to get anything back. I think it's just going to be a "Oh, well, let's move on from it and just pretend like it didn't happen" kind of thing.
Ben Yelin: Right, and I understand it because you can't just give the companies the money because they passed the costs on to the consumers.
Ethan Cook: Consumers, exactly.
Ben Yelin: But they don't always pass on 100% of the cost to the consumers, so you can't just pay the consumers either.
Ethan Cook: And every company's going to do it their own way. So are you going to go one by one, let's say, you know, farm company and figure out what percentage did they pass off and who bought from them and, you know, what -- it's going to take forever. There's no way it's going to happen.
Ben Yelin: Right, and I think the majority kind of leaves that unaddressed. They say that Kavanaugh, like, just because this is going to be difficult doesn't mean that should constrain our decision here, but they also don't say anything about how these tariff refunds are going to work. So it is really an unanswered question. I completely agree with you, Ethan, that Occam's Razor, nothing happens. None of us are getting our, like, "Oh, I was paying 20 cents extra per banana and I bought 100 bananas, so I'm getting X amount of money back." I don't think that's going to happen.
Ethan Cook: Yeah. I think, you know, the second major kind of conversation is what does that impact existing trade deals? I think a really good example is we had recently just inked a new trade deal with India. They were going to get taxed, tariffed at 18% per the deal, but that was through the previous power, and now we're doing new trade deals at 15%. So do we take the 15? Does India get 18 like we agreed upon? How does this all work? And then, again, it's only for five months. So I think that is a -- and you can go country by country and this is where the mess is going to start really piling up, which is right now we've just blanketed 15%, obviously giving exemptions to agricultural products and certain steel products and pharmaceuticals, etc., but we have trade deals with all of these countries and each one has their own unique trade tariff rate, and now we have to kind of go through and do -- I think that's a question the administration's going to have to work out, but there were some, you know, I think I read a point from the U.K. where they are not -- this didn't -- yes, it was the -- I'm pulling it up right now, William Bain, the head of trade policy at the British Chamber of Commerce, released a statement saying, "This didn't clear up any of the murky waters for our businesses." Like, this doesn't help us, because now we run into the question of, cool, we can establish those trade tariffs were illegal, but you've imposed new ones that are legal but also are time-limited, and now we don't really know, and they're also at universal 15%, so is that going to impact the ones that were higher? Do the lower trade tariffs, let's say we had them at 10%, now get raised to 15%? And there's been no real clarification provided from this on any end.
Ben Yelin: Now, what could happen and what was proposed by Republican Senator Bernie Moreno is Congress could just codify the Trump administration's tariffs that were issued under this IEEPA authority. They could absolutely do that tomorrow and they would be 100% constitutional. Last I checked, Congress doesn't like raising taxes, especially in an election year.
Dave Bittner: Right, right [laughter].
Ben Yelin: And being held accountable for it, so that's not going to happen either. So yeah, that also is one of the reasons we're in this this gray area.
Dave Bittner: Well, it's interesting to me that this administration being so tuned in to the stock market, and the stock market does not respond favorably to uncertainty, and so perhaps predictably, when this ruling came out, the stock market took a dive.
Ben Yelin: Yeah, but I think from the Trump administration's perspective, like it took a huge dive on Liberation Day back in April. That was like the scary day where we instituted all these tariffs. Stocks took a huge dive and then he pulled back on some of them. In the meantime, like the stock market has mostly gone up and it's gone up significantly, and I think from their perspective it's like, "We want this policy to be instituted." The market even under what they perceived to be a regime of significant tariffs, still went up a lot over the past six or seven months for whatever reason. Maybe it was the tariffs themselves weren't as bad for the stock market as people anticipated or they were bad but other things were helping prop up the stock market, but for whatever reason, like they got the Dow to 50,000, and so in their mind, it's like, "Well, maybe we don't have to be as concerned about the stock market reaction."
Dave Bittner: Right. No, that's fair.
Ethan Cook: And I think for the tariff and on the stock market, you know, I think with how the administration has been throughout its start of tariffs has been, you know, one day this tariff's here, one day it's there, let's pull back here, I think the stock market has kind of almost grown numb to it to a degree, like it dips and it goes up and down in response, but I don't think it overreacts or underreacts to anything anymore, as it did for Liberation Day, because it kind of just expects this. I think the writing was on the wall for some time that a ruling, whether in favor or against, was going to come out against these tariffs at some point. Everyone knew it was happening, so there was a "All right, we'll respond to it when it gets here," but realistically we know that the administration is very pro-business across the board and that's not going to change regardless of the ruling.
Ben Yelin: I also think there's an element of every time the stock market really starts to crash, Trump pulls back. Like, I think it might seem kind of cringe to talk about TACO, "Trump always chickens out," and like, yeah, that's cringe, forgot about that [laughter]. That's like resistance propaganda and people roll their eyes at it, but the true element to it from the perspective of market participants is like, I don't want to be the one person who sells all of my stocks in a panic while everybody else realizes that Trump is not going to let the stock market go down. Like, he'll just reverse the decision because he cares too much about his popularity, and if everybody thinks that, then the stock market won't go down. The danger is like, okay, everybody thinks that, the stock market doesn't go down, so then he doesn't chicken out because the stock market didn't go down.
Dave Bittner: Right, right.
Ben Yelin: So that's kind of a catch-22 there, but it's worked out for him and for market participants for the past year.
Dave Bittner: All right, gentlemen. Interesting conversation for sure, and thank you, Ethan, for joining us once again. Always appreciate your insights and expertise on these things. We're going to take a quick break. We will be right back after this message from our show's sponsors. [ Music ] And we are back. Gentlemen, I had the recent pleasure of speaking with Jeff Williams, who was the founder of OWASP and was also the Co-Founder and Chief Technology Officer at an organization called "Contrast Security," and our discussion centers on how NIST is rethinking its role in analyzing software vulnerabilities. Here's my conversation with Jeff Williams. [ Music ]
Jeff Williams: Yeah, so, you know, in the early 2000s, researchers were finding lots of vulnerabilities in products and we need a way to exchange those, like the people that are using those products need to know about them so they can update their software and so on, and NIST established the CVE program, the common vulnerability enumeration program, which would capture those vulnerabilities, assign them a number, and generate certain metadata about those vulnerabilities, like a score, for instance. You want to know which ones are a 10 and which ones are a 4.2, and they made a database that lots and lots of people came to rely on. You know, in the early days, there weren't that many vulnerabilities, but last year I think there were something like 45,000 vulnerabilities that ran through that program, which is a healthy number, and it's predicted to almost double this year.
Dave Bittner: So what's the issue, then, that NIST is taking a look at this? Is it merely just a matter that it's growing so fast it's hard to keep track of?
Jeff Williams: Well, that's part of it, but the big problem happened last year when their funding got cut, and that caused a lot of problems. They got way behind in vulnerabilities that they have to process through, so there's this giant backlog, and that holds up, you know, people patching their software and being protected against that stuff, so it's actually a kind of a dangerous situation, and when you zoom out, you realize most of the cybersecurity industry is built on top of this tiny little pedestal [laughter], is this program run by a few folks at MITRE.
Dave Bittner: Now, simultaneous to this, the EU is launching their own version of this. Is that an accurate way to describe it, the GCVE?
Jeff Williams: Yeah, it's got some differences, but, yeah, they saw the struggles that we're experiencing here in the U.S. running this program and they said, "Well, we don't want to be dependent on just that source for our vulnerabilities," so they created their own authority.
Dave Bittner: Now, is this intended to be something that runs alongside of our own program or could it potentially replace it?
Jeff Williams: It's intended to run alongside it, and that's some of the challenge here, is that instead of having, you know, one major vulnerability authority, now we're going to have a bunch, and that creates friction for people that want to use those services. Now, you know, imagine you're a company that just wants to make sure you do your updates. Where do you go for that information? Do you go to the old CVE program? Do you go to the new GNA-driven program, the GCVE program in Europe? I said "GNA" because they have -- their system involves multiple numbering authorities, which is kind of another complication. It's a federated kind of approach, which, you know, has advantages and disadvantages, but if you have to check a whole bunch of different places, there might be duplicates and it creates friction.
Dave Bittner: You'd think we would have learned our lesson just from trying to name threat actors, right? Like, you know, whether it's Fancy Bear or, you know, Octopus Panda or, you know, nobody can agree on that, that we wouldn't head down this path again.
Jeff Williams: I'm glad that the CVE program came up with a very simple, unsexy naming approach. CVEs are just named like, you know, CVE-2025-0001, and the next one's named 0002 and just some of the vulnerabilities get, you know, colloquial names, but most of them don't.
Dave Bittner: How do you suspect this is going to play out?
Jeff Williams: I think it's anybody's guess. I think it's really unfortunate that the U.S. kind of fumbled the ball here. I think we had the potential to be the authority for CVEs for the entire world and, you know, really do something good for cybersecurity, but we've, you know, we've kind of bungled it now. We've broken a lot of trust, and so I think, you know, now other countries are going to start to build their own databases and just it's going to make a mess of things for a while.
Dave Bittner: What's your advice to the folks who rely on this to -- I mean, how do they approach this looking at the level of uncertainty that may be ahead of us?
Jeff Williams: I think we just got to get used to a world where there's multiple vulnerability authorities, and you're going to have a lot of duplicates. Hopefully, they have the same numbers, but, you know, it's entirely conceivable that two researchers find a similar vulnerability, report it to their own vulnerability entity, they get different CVE numbers and they just live as duplicates within this world, which is then going to cause confusion. Like, did I patch it? Did I not patch it? Hey, oh, no, I already did this. How do I track it? This is, I mean, it's impossible to underestimate the importance of this service in the cybersecurity world. If you don't know where the vulnerabilities are, you can't have a patching program, you can't keep your software up to date, and so this is going to be a pain. You know, in the back of my head, I'm like, you know, we really need one -- another service that unifies all these, but then I realize you're just creating one more thing.
Dave Bittner: Yeah, I was -- that was going to be my next question is, like it seems like we'll need a de-conflicting service, but now you've got three, right?
Jeff Williams: Exactly [laughter]. There are some things I think they could do that would improve things. You know, I think putting more work into analyzing these vulnerabilities and de-conflicting things, making a great API that people can use at massive scale. This thing -- these things get bombarded with requests. So, you know, until very recently the CVE program didn't have good APIs and they were constantly going up and down and stuff. So, you know, there are things we could do to make this system better and make the world a safer place, but right now it looks like there's, I'd say, disorganization going on.
Dave Bittner: Has there been any call for this task to be transferred to someone other than NIST?
Jeff Williams: Well, CISA got involved when MITRE lost funding. CISA came to the rescue, and so that they funded the program for a while and, you know, I think just in the current political environment in the U.S., I think it's difficult to imagine that this program's going to get significantly expanded.
Dave Bittner: Yeah. It's hard to be, I guess, overly optimistic about it. It feels like, you know, folks have to kind of hang on and see what's coming next, see how this shakes out.
Jeff Williams: Yeah, it just seems so foolish to me. Like, this, you know, having a great infrastructure for managing these risks is, you know, for the amount of money we're talking about, it's, you know, in the low tens of millions of dollars to fund this program. It's a rounding error in the defense budget and it's really critical. Cybersecurity, you know, that may be the next battlefield and keeping it secure is pretty critical to our defense and the safety of the world. So I just -- I don't understand the priorities here.
Dave Bittner: Yeah, it really is -- it's a common good.
Jeff Williams: Yeah, and I think, you know, I don't know if our current government is really that interested in common goods. [ Music ]
Dave Bittner: Ben, what do you think?
Ben Yelin: I thought it was a really interesting interview, and I think certainly the time is ripe for NIST to undertake this strategic review, especially just given the changes in the cybersecurity threat landscape. So I thought it was very interesting.
Dave Bittner: Yeah. All right, well, again, our thanks to Jeff Williams from Contrast Security. We do appreciate him taking the time. [ Music ] And that is Caveat brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to caveat@n2k.com. This episode is produced by Liz Stokes. Our executive producer is Jennifer Eiben. The show is mixed by Tre Hester. Peter Kilpe is our publisher. I'm Dave Bittner.
Ben Yelin: And I'm Ben Yelin.
Ethan Cook: And I'm Ethan Cook.
Dave Bittner: Thanks for listening. [ Music ]
