Confirmation bias meets the Ukraine war and Elon Musk

Episode 403 of the Cyberlaw Podcast

Whatever else the pundits are saying about the use of cyberattacks in the Ukraine war, Dave Aitel notes, they all believe it confirms their past predictions about cyberwar. And in fact, not much has been surprising about the cyber weapons the parties have deployed, Scott Shapiro agrees. The Ukrainians have been doxxing Russia's soldiers in Bucha and its spies around the world. The Russians have been attacking Ukraine's grid. What's surprising is that the grid attacks have not seriously degraded civilian life, plus how hard the Russians have had to work to have any effect at all. Cyberwar isn't a bust, exactly, but it is looking a little overhyped. In fact, Scott suggests, it's more like a confession of weakness than of strength: "My military attack isn't up to the job, so I'll throw in some fancy cyberweapons to impress The Boss."

Would it have more impact in the U.S.? We can't know until the Russians (or someone else) gives it a try. We should certainly have a plan for responding, and Dmitri Alperovitch and Sam Charap have offered theirs: Shut down Russia's internet for a few hours just to show we can. It's better than no plan, but we're not ready to say it's the right plan, given its limited impact and high cost in terms of exploits exposed.

Much more surprising, and therefore more interesting, is the way Ukrainian mobile phone networks have become an essential part of Ukrainian defense. As discussed in a good blog post, Ukraine has made it easy for civilians to keep using their phones without paying, no matter where they travel in the country and no matter which network they find there. At the same time, Russian soldiers are finding that the network is a dangerous honeypot. Dave and I think there are lessons there for emergency administration of phone networks in other countries.

Gus Hurwitz draws the short straw and sums up the second installment of the Elon Musk v. Twitter story. We agree that Twitter's poison pill probably kills Musk's chances of a successful takeover. So what else is there to talk about? In keeping with the confirmation bias story, I take a short victory lap for having predicted that Musk would try to become the Rupert Murdoch of the social oligarchs. And Gus helps us enjoy the festschrift of hypocrisy from the Usual Sources declaring that the preservation of democracy depends on internet censorship, administered by their friends.

Scott takes us deep on pipeline security, citing a colleague's article for Lawfare on the topic. He thinks responsibility for pipeline security should be moved from Transportation Security Administration (TSA) to the Federal Energy Regulatory Commission (FERC), because, well, TSA. The Biden administration is similarly inclined, but I'm not enthusiastic; TSA may not have shown much regulatory gumption until recently, but neither has FERC, and TSA can borrow all the cyber expertise it needs from its sister agency, CISA. An option that's also open to FERC, Scott points out.

You can't talk pipeline cyber security without talking industrial control security, so Scott and Gus unpack a recently discovered ICS malware package that is a kind of Metasploit for attacking operational tech systems. It's got a boatload of features, but Gus is skeptical that it's the best tool for causing major havoc in electric grids or pipelines. Also, remarkably, it seems to have been disclosed before the nation state that developed it could actually use it against an adversary. Now that's defending forward!

As a palate cleanser, we ask Gus to take us through the latest in EU cloud protectionism. It sounds like a measure that will hurt U.S. intelligence but do nothing for Europe's effort to build its own cloud industry. I recount the background story, from subpoena litigation to the CLOUD Act to this latest counter-CLOUD attack. The whole thing feels to me like Microsoft playing both sides against the middle.

Finally, Dave takes us on a tour of the many proposals being launched around the world to regulate the use of Artificial Intelligence (AI) systems. I note that Congressional Dems have their knives out for the face recognition vendor, id.me. And I return briefly to the problem of biased content moderation. I look at research showing that Republican Twitter accounts were four times more likely to be suspended than Democrats after the 2020 election, which seems at first glance like a smoking gun for moderator bias. But I find myself at least tentatively persuaded by further research showing that the Republican accounts were four times as likely to tweet links to sites that a balanced cross section of voters considers unreliable. Where is confirmation bias when you need it?

Download the 403rd Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [e-mail]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Comments

[Sebastian Cremmington]

One of the most effective cyberattacks has been Russia disseminating a dossier online that says Zelensky was captured on video hiring prostitutes to pee on him…what would happen if that video were to get out!?! Another very effective cyberattack has been Russian internet trolls drawing penises on photos of Zelensky’s face. Also Russia apparently spent $10k on Facebook ads saying Ukraine is ruled by Nazis. I can see how the Russians were able to throw the 2016 election to Trump with this level of tech sophistication.

[Rev. Arthur L. Kirkland]

Right-wingers who aren’t welcome at mainstream sites turn out to be delusional misifits and lying bigots? More right-wingers than left-wingers rely on ignorance-saturated sources?

This is news?

[Sims]

You probably should have had a corporate lawyer on to discuss the Musk/Twitter fight and TWIT’s poison pill. I would gladly have volunteered. The poison pill does not kill Musk’s takeover attempt, as no poison pill is absolute. Ignore all the ridiculous analysis of getting around it or buying through it-that has never even been attempted. But the simple answer is that the Delaware chancery court has made abundantly clear that a board’s fiduciary duties do extend to removing a pill if it is in the shareholder’s best interests. All a pill does is buy time to analyze the offer, and assess alternatives.

[Brett Bellmore]

“But I find myself at least tentatively persuaded by further research showing that the Republican accounts were four times as likely to tweet links to sites that a balanced cross section of voters considers unreliable. Where is confirmation bias when you need it?”

Assuming, of course, that they didn’t consider those sites unreliable because of the platform censorship, of course. Hard to say, since your link doesn’t work.

[Brett Bellmore]

Finding it elsewhere,

It’s interesting that “offensive language, hate speech, and toxic language” had basically no correlation at all to being banned on Twitter. When these actually match the criteria for protected moderation in section 230.

Political affiliation and sharing information attacked by ‘fact checkers’, OTOH, was almost identically highly predictive.

They try to rule out bias by fact checkers, by comparing the fact checkers to a “balanced group” rating of sites being shared. But there were some troubling signs about that ‘balanced group’, such as the fact that it’s agreement with fact checkers dropped drastically when they excluded from scoring people who weren’t actually familiar with a site being rated. Which suggests to me they were just echoing the fact checkers’ opinions of sites they knew nothing about.