 Hi, welcome. My name is Stan Sachs. I'm a cyber fellow at New America and a senior fellow at the Yale Law School Paltai China Center I'm thrilled today to be joined by David Gossett, who's a partner with the Technology Privacy and Security Group at Davis Wright Tremaine He's also been a litigator in the WeChat case and Jen Daskell, who is professor and faculty director at the Tech Law and Security Program at American University Washington College of Law and is also this year a fellow with us at New America where she's working on a very exciting project But Jen, I may put you on the spot and have you talk a little bit about that today as well Unfortunately James Mulvennan could not join us. He has a very sick golden retriever So we are all going to do our best to channel the national security perspective from James here in the conversation So before we get started just very briefly to recap where we've been And I think it's been a dizzying few weeks and months looking at the August executive order ban in which the president Declared a national emergency to ban TikTok and WeChat. We also have an ongoing SIFIUS review, which is the Committee on Foreign Investment in the United States Investigation into the national security risks of the foreign acquisition piece of this deal of the bite dance acquisition of TikTok and Simultaneously we have trickling through the system Lawsuits which David Gossett has been on the front lines of it can talk with us about And I think what's at stake here is we're talking about privacy. We're talking about cyber security Free speech in the future of the global internet not to mention US-China relations and tech competition among two great powers So let's get started and I want to turn it over to David first David get us up to speed on where we are with the lawsuits Both WeChat and TikTok and I will say although we are talking about TikTok and WeChat as a package today These also are very distinct sets of issues And we'll do our best as well to be specific about what's at play in each of these distinct sort of landscapes as well But David, let's kick us off and get us up to speed on how to think about what the lawsuits mean. What comes next? Slide into it. Thank you so much for inviting me to join you today As Sam said on August 6th, the president issued these two executive orders one banning In not entirely well-defined terms TikTok one banning and not entirely well-defined terms, but more or less identical to the other one WeChat One one slight correction. I'll make to what Sam said is these didn't declare a national emergency. These both were issued Pursuant to the national emergency the president declared back in May 2019 on Icts by chain the the information and communications technology and services supply chain he declared that national emergency 14 months before and most of the discussion had after that Declaration been about Huawei and other companies. It was internet backbone technology and we can get into that but in any event Fast-forward to August 2020 and he says I'm banning TikTok and WeChat We'll get into various reasons. He might or might not have in those Two executive orders he said these take effect in 45 days of September 20th And before September 20th, the secretary of Commerce Wilbur Ross will issue some form of identification Clarifying what is actually being banned by Executive orders. It also says that they can enforce the bans without Warning, so it's a little ambiguous from exactly what In any event this happened back in August and You look the companies and users of these apps got quite worried And in fact there are at this point four separate lawsuits that I'm going to briefly note. I I represent the plaintiffs in the only lawsuit about WeChat, which is the US WeChat users alliance Versus Trump and Ross. This is a lawsuit brought by an association of American or US based users of WeChat mostly Chinese American Businesses and individuals who use and rely on WeChat as soon because it was good. They thought it was The executive order was invalid and would Block their use of the device block their speech communication with the relevance and others And there are three separate lawsuits about TikTok In basically the order in which they were filed a TikTok employee named Patrick Ryan who I believe said told me via chat that he's going to be here today. So hi Patrick if you're in fact I sued in the Northern District of California and Because he was concerned that transactions involving we took talk would involve include paying the employees of tiktok and He and the other employees were might very well as of September 20th not be able to be maintained then a group and so and Patrick sought a Junction barring the the enforcement of the Tiktok executive order and the judge denied it largely because there's the PE the government represented that they were going to Tiktok creators have sued in Pennsylvania. That's the Marlin case They really rely on it both for expressive purposes and many people actually essentially use it as a form of making a living and have sued to say And then Most recently tiktok itself by dance, I think it's technically the plan which is the tiktok corporate owner has sued in The District of Columbia District Court and it is also trying to get the the Injunction the serve the executors block the temper All of these are still on ongoing We in the we check case on the Sunday So hours before the executive order was great to take effect got a preliminary junction are in the implementation of that and that litigation is progressing at Lightspeed both lightspeed and very slowly so late last night the government filed a Motion asking for that injunction to be stayed so essentially for the Executive order to be able to take effect the ban on which had to be able to take effect Instantly and we are starting this back at all this morning have been working on proposing that then the Tiktok executive order was delayed the There is a at the moment. There is a ban But there will be a ban as of Sunday at midnight or new downloads of tiktok and the actual Use of tiktok won't be banned until November. This is tied into the potential sale tiktok Judge in the tiktok creators lawsuit is hearing on briefing right now mother to join even the ban on downloads the Plaintiffs in that case have a brief do it by the clock today and the judge has promised to rule or the injunction would take effect Similarly in the newest lawsuit the tiktok lawsuit Judge Nichols here in DC has ordered the government by 230 today either to oppose the injunction or to Extend the ban on new downloads of tiktok so that he can they can take more time to Discuss whether that's a quick summary of a procedural posture. Basically right now nothing is banned Tiktok could be banned downloads of tiktok could be banned as of Sunday Everything else depends on judges at least Got it. I mean one of the hottest topics of conversation I think has been around no or do existing users and for WeChat and and tiktok What happens with existing users if you already have it on your phone? Is this just going to do is this is going to impact software updates? And then there's been the whole extraterritorial question of does the term Transaction extend beyond the border of the US which it seems like at least with the most latest development It sounds like it does not. Is that correct? There are a couple questions in there. So let's put aside new downloads of the app or updates to the app because those clearly are banned and they're there as you say what is actually banned by the Under the Secretary of Commerce's Identifications as they think you're calling them is essentially corporate transactions with 10 cent and bite dance with the owners of WeChat So Internet service providers aren't allowed to do business with these companies content distribution networks aren't allowed to do business with these service with these companies Various other technical aspects of contracting to keep the app running smoothly are banned And as you say there is a real dispute a real sort of unknown as to whether the What that will mean is that? Those fans were to take effect the app would work less less well things would be slowed down Some content might not go through smoothly things like that or if it would actually just be a it's shut down You you can't actually access WeChat as soon as this takes effect because they can't have and frankly We still don't know The the government has in a couple of recent filings including this one last night said It would be the latter. It would just make things work less well and eventually drive these services out of business the judge in our lawsuit over the weekend when we had a hearing on Friday Saturday Discounted those sorts of assertions which they made then too Because secretary Ross was quoted on Fox business news is saying We tap will be completely shut down as of Monday and so they essentially took that as an admission by the government that would be shut down I think the answer and I am not the Technical engineer who really can answer the question fully but my sense from talking to people is the answer is somewhere in between the two these services are pretty critical to a lot of the functionality of these apps and so Things would work really badly and some things might just stop But I don't think it's the case that the the app would You would open up the app and it just wouldn't know that if you already had it under Got it. So this is really the lay of the land I think the legal perspective of what is at stake right now I want to turn to Jen and Jen and I have had extensive conversations about what appears to be a sort of muddying of Privacy data security and national security Not to mention the whole layer of a US-China tech conflict. So Jen, can you help us Sort through how do we think about these very distinct but increasingly blurred issues at stake and what are the risks? I'm great. Thanks. Thanks Sam and thanks Thanks David as well for this great conversation Before I get there, I just want to add in one additional layer of complication to add on to the Litigation issue which is this question of the potential sale and all the back and forth that's gone on with that So that's another layer of complexity that With respect to tic-tac again as as Sam as you rightly pointed out at the beginning there Although we're talking about both lawsuits They raise a whole set of separate equities legal issues and also policy issues as well But with respect to tic-tac there was For one thing there's been a number of shifting Deadlines as to when any sort of ban would go into a fact which has been caught up with this idea that some of this could be dealt with Via a sale. This was first kind of came to the attention of of the American people when President Trump announced that he would approve a sale of a very American company to to purchase tic-tac and For a while it was presumed that would be Microsoft that has Apparently fallen through and President Trump has has stated that he will approve a sale involving a combination of oracle and wal-mart although we don't know all the details about What that will look like it looks like it's actually I should say I should I should Be clear. It's not actually an outright sale, but it would be a transaction pursuant to which oracle and wal-mart would take Part ownership and a minority ownership according to at least what's been reported of tic-tac approximately 20 percent And so a significant amount of the company would still be owned by Chinese interests so And another piece of this is that oracle and wal-mart officials have also said that they would pay Five billion dollars to the United States or to support some sort of us Based program that also kind of falls from President Trump's claim that he was going to demand a tax for this sale Which is a pretty unprecedented Situation, but that's another piece of this. That's that's a mooting piece of the puzzle And that transaction that sale that shift of ownership will also then go back into the sypias process Which also Will read we'll have to review whether or not this transaction satisfies the national security concerns That were raised by the sypias process as well. So we've got the litigation We've got the potential sale and they all kind of merged together as part of the background Now to turn to your question, which was about the national security data privacy data security issues I think one of the things that we're seeing here is Obviously This these these bands were announced on the 6th of august pursuant to aiba And aiba requires a finding that there's been An unusual and extraordinary threat to the national security foreign policy or economy of the united states And here with respect to both the tiktok and the wechat bands The national security threat that the president announced were both Surveillance concerns and also censorship concerns And here I think it's very important to kind of unpack what exactly those concerns are So here when we're talking about tiktok and wechat we're talking about communication tools That kind of sit at the kind of highest level of the internet stack It's a very different situation Then when we were dealing with for example, woway, which was in the news a lot over the last few years and In connection with the ban on woway. And then you're talking about A company that has access to the infrastructure to the network and in that situation there are At least it might be very significant surveillance concerns About being able to access information that flows basically anywhere across the network When you get to tiktok and wechat It's a different set of concerns. It's about collecting surveillance of personal communications and here And then I'll stop so we can hopefully come back to this. I think there is a it's important to kind of parse out the different security concerns There's one set of concerns about getting access to communications about government business Of government officials of people talking about official business There's a separate set of concerns, which I would argue are more removed from the core national security interests of getting access to communications of Chinese americans talking to their parents or their grandparents in china or teenagers talking to one another On a tiktok app and I think it's very important as we Think through these issues that we disentangle What specific national security concerns we are talking about and when and then with what circumstances those Are concerns about access to core national security secrets when they're access about concerns about access to our critical infrastructure and when they are Merging more with kind of general data privacy concerns And if that's where we're going with our understanding of national security What are the kind of really big broad implications and does national security then effectively swallow everything? Yeah, can I add I I agree entirely with what Jen just said and in fact It's interesting because The evidence that the government put forth in the wechat case today and they threw some new evidence in last night And I'm not yet able to really to even describe that but we'll get it one time Focus on but before that a lot of the evidence they used was about things like huawei and infrastructure And then when they they had a little A couple of reports they cited about the security risks of wechat And the suggestions of those people were things like ban the use on government funds It wasn't an individual's use of it It was be much more targeted because of the natural the what are the actual security risks and the one other thing I'll say on this to reinforce what what Jen had said was So we have I think it's having different actual So we had a bunch of plaintiffs putting in declarations and in some of those declarations They talked about the fact that they understood that that their communications Especially their communications back to china not intra u.s communication Might be Surveys in some way and they didn't like that fact and they but they used the app knowing that because of its value to them its value as a means of communication With family in china and so it was a it was a conscious choice to allow themselves to have some level of Surveillance by the system But frankly is no different than all of our choice to use facebook, which is similarly heavily surveilled by the company and something to all sorts of Surveillance requests by the u.s and state governments So i'm going to put on my james mulvend and hat and also my former working with the national security community hat To really dig deeper into you know, what's at stake here? And I think the comparison between wechat and facebook doesn't entirely hold up If we think about wechat is known to be You know a sort of constant real-time monitoring by chinese authorities And if there are data requests made on wechat There are no real meaningful avenues for contestation in a rule-by-law country Um, I think from the tiktok perspective, you know, there was a an op-ed in the washington post earlier this week laying out Two distinct national security risks, which I happen to disagree with But I think we're very a very clear articulation because I think sometimes I have what happens with tiktok is we say why Is a video of someone lip-singing with their cat of national security value is this this is a this is a privacy person This is a privacy issue And if someone wants to monetize that if this is has a because we know that tiktok has a very powerful algorithm and can get users hooked on the app To spend more time on the app. So more data is funneled in and then with that powerful algorithm The company can then seed content which can manipulate behavior And what this washington post article identified were two risks one is that algorithm You know the better it gets the more data that's fueled into that algorithm and it gets more refined What's to say that in china's military civil fusion system that algorithm is not going to get better at targeting a missile It's the idea of more users. Let's fire a missile number two is the idea of You know, if we know that if you think of one of the murky issues around tiktok And this is separate I think from the data security issue But one of the more murky issues around tiktok has been You know, what is the way in which that algorithm boosts certain content? Over others and we know that there have been cases for example around, you know There was a user who was curling her eyelashes while talking about shinjiang And then her account was sort of mysteriously deactivated apparently according to a technical glitch Um, I think now in this environment It would be very hard for tiktok to remove content about shinjiang, right? But we do know that there's some murkiness around What kind of content is coming out and the degree of influence that the chinese government may or may Have with that algorithm My view of what's wrong with those two national security arguments and then would love to hear your your perspective is The algorithm is powerful as a tool of boosting content and seeding content Which is a totally distinct set of issues for let's target a missile for an autonomous, you know weapon system It's quite far-fetched and I think there's an exaggeration around the extent to which the military civil fusion Is so pervasive and effective within the chinese bureaucracy james may have May have some you know may just challenge me on that perspective, but that's my view And on the second one around, you know, are we that fragile as a system? That we are the u.s. Government is going to crumble because of chinese communist propaganda You know, I think given I think your average tiktok user if they were fed chinese communist propaganda would probably just delete the app I mean the whole point is to feed people things that they actually Want to see to get them hooked And we know that while russia has been very sophisticated in the ways that it has seeded misinformation into the system Everything that we know about the way china conducts these overseas information Operations is much more one heavy-handed and two about chinese domestic issues Can you influence the way that dissidents are talking about things like hong kong and the south china sea? And those sorts of issues we go Exactly Anyway, that was a long sort of dip into the national security side, but you any responses either jen or david on those points You know, and I think I think there's there are really important aspects of this conversation So I think when we talk about the national security issues, they're really three There was one the the claim the ai claim which applies to tiktok not we chat and I share your skepticism And again, I'm not I am not A a technology. I'm not a tech expert. I'm not a technologist But having spoken to many people who work in ai. I think there's I I've been told that my skepticism about this idea that just because you get access to data and just because you have Developed an ai tool in one context necessarily translates to a different context is that your your skepticism is apt that it's very It's very real and so I share your your skepticism about the ai point The second one is the surveillance issue and then again to go back and I think we have to distinguish who's being surveyed And for what purposes and when you know the argument there at the national security argument there is that Even if we're not talking about government officials even accessing data about ordinary individuals There's the capacity to influence in ways that May in some cases provide some sort of Of of concern threat, etc And again that that may be true But here we also have really big equities on the other side And so I think we need to think through both what is the seriousness of any national security claim and and think about that in connection with Especially with we chat and also with tiktok the free speech implications on the other side And then finally there's the censorship issue And I think it's you know, if you're going to take the national security perspective It's more than just the censorship of the kind of human rights censorship issue Which is a real concern, but it's harder to say that that's necessarily a national security concern I think the bigger threat is one that would be associated with concerns about election influence And sam you're right that china has been a lot less sophisticated historically than russia with regard to election influence But I think that that is that is the claimed concern and again The question is what do you do about it? And is is that is the risk that there's some sort of influence Justify the entire ban of an entire app and particularly again once you balance the other equities at stake Um, I think there's some serious concerns about that approach I want to get back Two points on that before you go ahead and the first time because on the last point I think I mean obviously sort of Foreign influence in our political discourse and other forms of discourse is a big deal but in some ways it shows the lie to these bands because As both of you have suggested the real problem has been Apparently has been sort of russian mostly influence and disinformation campaigns And most of that's been on facebook and twitter. It's not on we chat or tick tock and so That if this concern about foreign influence and foreign Um disinformation campaigns were really what was going on here and now I'm speaking in my litigation had about Challenging what's really going on here and whether this is all really about A bunch of kids organizing on tick tock to pretend to appear at a trump rally um, but if this was really about The national the disinformation campaigns in the us Then why are we focused just on we chat and tick tock? Why aren't we we we thinking also very seriously about the regulation of facebook twitter other things and now you get into all the constitutional and other questions about But it seems like a a solution to the wrong problem The other thing I will flag because you um sam you had made this point about so people don't know about the surveillance but And obviously the government would say My answer is Of point, but the u.s. government does exactly the same thing. I mean the u.s. government routinely brings subpoenas to cloud providers and other internet service providers for material about individuals with under Theories and under statutes which doesn't require any notice to this people. So yes china is The u.s. government would say but we're concerned about the foreign interference in our case But we do the same thing. So it's a little hard to push them I think there's just no way possibly to compare law enforcement access to data in china with law enforcement access to data in the US system I mean gen can you help us? What is how should we think about these? What is the process by which that how does that work in the us? Is david's point fair that that is that an accurate comparison? So I don't I mean, I don't think that the that the and I think that there's clearly the access to data concerns in china are Significantly greater than the access to data concerns in the united states and in the united states the the the bigger concern is is a lack of significant meaningful any meaning really meaningful consumer privacy protections and that's You know if we're going to go down the road of talking about the real problems here the underlying problems here about malicious foreign interference and also Data security data privacy I mean, I think that there's a whole set of issues that the us needs to tackle that have nothing to do with chinese-based companies or chinese-based apps that really would go a long way to Providing the kinds of protections that are needed, but um, you know, I think it's also quite clear that's um that the us law enforcement is subject to a very robust number of constraints and rules with respect to access to data in ways that just Do not exist in china and anything comparable or even close The cheap point I would admit Although and I will say, you know coming from me. I've done a ton of work looking at the evolution of china's data protection system Funny the argument is coming from me right because we know that china has actually Moved rapidly and putting in place at least in writing Laws and regulations standards that do actually attempt to put some guardrails in writing I would argue that those guardrails are more meant as a check from a consumer privacy standpoint as far as what companies are able to do with data At the same time you have massive Surveillance authorities given to the government to do what it wants, right? And then there's a question about, you know, is there transparency? Is there meaningful avenues for oversight of the contestation even as we're seeing the rollout of those laws and rules in china? But I want to pivot more to this point about the lack of of federal privacy law in the us because Oftentimes one of the arguments that comes up is this idea of reciprocity The idea that will china banned google and facebook and tiktok and they have the great firewall So now it makes sense that the u.s. Government should finally wake up to the reality that an open free internet is an illusion And just give china a taste of its own medicine here There are a couple of problems with that argument One of which is I think the way to actually truly technically be reciprocal Would actually be to pass federal privacy law or have at least a set of clear country agnostic criteria That tiktok and we chat and others would be subject to and then if they're unable to comply with those Then they're banned for them from the market. So that's actually what it would look like if it was true reciprocity The other of course is you know china has a lot of things that I think probably we are not a good idea to mimic And to jen's point about well, what are the equities at stake if we go down this path? What is the purpose of reciprocity? What are we trying to achieve? And what are the equities at stake if we do do this? And we talked about sort of the precedent that this could potentially set and the oracle tiktok deal I think sets a precedent for industrial policy and the ability of the u.s. Government to interfere requiring A you know a a domestic company to take a stake in exchange for market access Which in my mind just legitimizes china's model because that's what's required for us firms operating china So anyway, that's a lot to throw out there. Um, I'll you know david you look like you wanted to hop in and say something I mean I just I mean I agree with everything you just said But I mean it feels very much like throwing the baby out with the bath water. We have a situation where china has a whole bunch of policies the firewall among them that are fundamentally inconsistent with what we And American civil servants and technologists think is that It should be the nature of the internet and our response to that shouldn't be to Similarly To just destroy what the internet has been and what has led it to to being such a great success in such a huge um instrument of change in sort of the world over the last two three decades Jen can I put you on the spot for a moment to talk about the project that you're going to be doing at new america this year because I Think it really feeds into this issue of how do we address some of the real challenges right now in what a us internet governance model Should look like in ways that actually are much bigger than this us china spat Um, sure before I do that. I just want to go back to the conversation because I got um, I received as we were talking I received a comment which is a fair one from An audience member about the ways in which we are kind of under Underselling the scope of potential china influence in the in the information space and that You know pointing out that rush has been better than china Doesn't doesn't predict the future and china is getting increasingly more sophisticated and increasingly effective in the information space And it is and and and the concern is that china that the chinese government is using its Technology tools and its communication systems to spread its message and to use To engage in information conflict in a in a more sophisticated Potentially dangerous way. Um, so I just wanted to acknowledge that point and and um, I That being said the question still remains What do we do about that and and do we think that a complete ban on the apps is the right response to that and There I have a ring a number of very significant questions and concerns but going back to your initial question about What my project is it's uh, it's exactly that it's looking at the ways in which um, you know, we have Um, you know, it was it was just a little over a decade or coming in all in all 11 years that um, Then secretary of state hillary clinton gave her kind of famous free and open internet agenda speech in the new museum here in Washington dc where where I am currently And kind of promised this very utopian world of what in which the internet would connect us all and we would be free and open and and and the best voices would be lifted up and Contrasted that with the authoritarian model, which and which there was an assumption that the authoritarian model Was was obviously wrong normatively But also would lead to slow and poor economic growth and was On the demise while the free and open internet agenda was on the rise And what we've seen in the last decade is just this enormous amount of harms that are being perpetuated online from all kinds of sources Some of this in the in the information complex space, but a whole range of areas beyond that And in the course of responding to that We in the united states across the world. We are increasingly adopting tools techniques Practices that were once kind of condemned and associated with the authoritarian regimes And I think my project is both mapping that out and also thinking through What are the stopping points and this goes back to a comment that I think both of you may but david just said quite forcefully, which is we don't We we should not be looking to china as the model to be mimicking and so the arguments that I've heard over and over again in the wake of the tic-tac and the we chat bands is We're not stopping free speech. It was china who did it It was china who kicked out all those companies And so if china just let in facebook if china just let in our communication tools Then chinese americans would be able to communicate with their family and friends in china It's china's fault not ours But we are starting the reality is that we are starting at this baseline where For reasons that are not at all ideal those companies have not been allowed to operate in china And at least they've not been allowed to operate in a way that's consistent with with with core values and freedoms and And so this is the world we live in and by saying they've done it So we we're going to do it too. We are starting from the status quo in 2020 and that really does Cut off communications for a significant part of the population in the name Of trying to mimic a country who's engaging in a range of practices that I think we ought to be quite concerned about Can I Real quick going Original executive order on ICT supply chain executive order that this is based on if you look the language of this It identifies gives the cost department vast authority to ban any transaction The quote-unquote digital economy What does that actually mean and I think that is why what jen is talking about why this this is Pool that once you know unleashed. I think has far more Potentially destructed notifications that maybe even the doors of that anticipated would go ahead David you want to jump in? Okay, sure. Um, yeah, what So I guess this is also response to what you just said, but um, though it was more responsive to to I think The two words that have not been mentioned once yet in our conversation in the 40 minutes We've been talking its first amendment. And so I mean, I think it's important. So if you think take of the supply chain Executive order the the national merchants in the supply chain that does apply. So it's so vastly broadly it covers everything and when it was issued I think many of us thought it was really about supply chain. It was about Huawei and other sorts of the internet infrastructure that could that uh, could very well be a Backdoor for some James Bond desks You then jump from there to We chat the tick tock which are communicative media on which people Themselves are talking and they're using it to um for everything from Stupid videos. So having deep discussions of politics and other things and That's where As I've always understood it in our constitutional system though You draw lines between Huawei and I don't know enough about the technical aspects of Huawei to know whether Huawei should be banned or not. I'm not using them as a as the In the sense that they're bad. I'm just using them in the sense of They are the kind of equipment that if there were real security risks I would understand how we would want to bend it from tick tock in we chat Which just seems so fundamentally different and seem to to raise such higher Constitutional values in the United States that are why we have Secretary Clinton talking about the the vast open internet and such because we are a country that believes in um communicative speech and believes in the freedom of the press the freedom of of individuals to communicate as I see fit so if we want to go back to this question of How do we address these legitimate concerns in a smart way in a way that's consistent with the The openness of the u.s. An open u.s. Internet open and open and free internet that the u.s. Government has long lobbied for How do we do that and one of the questions and I want to just remind our audience members Please submit questions via the q&a feature and we'll use the remainder of the discussion actually to take your questions So we have a question From terra herston and she she asks about this need for vendor agnostic criteria What would be those criteria and that many of the developments we're talking about really do appear to have To be based on country of origin and the legal regimes in a vendor's country of origin So what would be some ideas? I'll go to you gen for how what would the criteria be to assess both from a privacy's I mean from a privacy standpoint from a cyber security standpoint and potentially these shouldn't be wrapped up in one and the chinese Cyber security law privacy and cyber security are both part of the same law But how would you put in place these kinds of criteria? What should that what's a vision for how that would look All right, so so great question and I don't just to be clear I don't think that the data privacy data security I mean, I think that there is a real need for strong data privacy data security protections I don't think that in and of itself solves the the separate problem of Foreign ownership and potential foreign access by a country or an entity that we're concerned about So I just wanted to make clear that I think it's a piece of the problem But it's not an entire solution and the other thing I want to say before I answer your question Which is a great question is um, you know, we we keep on talking about the I my the whole premise of this project that I'm that I'm kind of embarking on is to be quite skeptical of even the language Free and open like I don't think we can have I'm free and open to the extent at least free means Unfettered unfettered is not free and we've learned that the hard way over the last 10 years So the question is how do we construct an internet agenda that matches our values? That recognizes that we can't have an unfettered communication network because that leads to so much harm without also at the same Time kind of mimicking this these authoritarian approaches that have been put in place And then a range of countries and entities are now adopting as well So just want to put out there with respect to the rhetoric in terms of what a good data privacy or data security The system would look like I mean we could spend You know multiple multiple webinars just talking about that but at a minimum I think some of the things that we ought to be concerned about are limitations on retention of data protections against sharing of data for purposes beyond which for which it was collected um Question limitations and who has access to the data which is related to the dissemination strong protections in terms of when government can access data strong protections in terms of Again the the sharing of data strong security protocols in terms of how data is is stored And range and then there's a range of other technical tools themselves that companies and entities can put in place including encrypting data including encrypting data end-to-end that also Significantly obviously bolster data protection and data security I I think that this is such an important idea of how do we have security in an interconnected environment as well And I I love I think as a former CIA official subordinate has talked about the idea of having security in Recognizing that we're going to connect to an untrustworthy network And what are the ways we can create security within that David? Did you want to chime in? on that or or broader No, I'm gonna let you and and jen have that part of the discussion because I'm not Not nearly as expert as either if you want it. Okay. Um, and Reminder again to the audience. Please submit q&a and we'll try to get to your questions in the remaining part of the hour Jen can I while I'm waiting for other audience questions to come in Can I press you a little bit further on your point about that privacy law is just one part of the picture And that there are things that actually Would be country specific or would address? I think the geopolitical reality that we're that we're talking about here Can you speak a bit more further about what your your thoughts are on that? Yeah, so I I don't know that I was um I don't know that there's other country specific issues But my point was simply that if you know a data privacy data security laws would help So limitations on how long data is retained limitations on who can access it limitations that would apply to the u.s. government And and u.s. Officials The the issue is and this gets into the the question about extraterritoriality and in what circumstances these rules apply Exeterritorially and whether and to what extent it's appropriate to put in bans on transfers of data So the rules would apply Clearly if there were a strong data protection regime in the united states That would set limits on retention sharing data storage within the united states It doesn't necessarily depending on how the rules are set up It doesn't necessarily protect against foreign governments also themselves accessing data particularly if data is moved either Overtly or or surreptitiously across borders Um, and you know one thing that I've been thinking about is we look at you know, where is the role at what point do we Focus specifically on issues related to china and at what point do we focus on this is a u.s. Internet governance question And where do those intersect? One of the challenges that I've had and I don't know the answer to this So it's okay if you don't either but in talking about having country agnostic criteria Wouldn't that just by default Mean a ban on sharing data with china Because would it ever be possible for china for chinese companies to meet those criteria? Even if we know for example that under the cyber security law regime in china, there are provisions around consent Um things that are taken from gdpr Which look rhetorically similar to gdpr But if we also know that there is a lack of meaningful Contestation and oversight related to how that's implemented in china Would it ever be possible for a chinese company to meet that higher thresholds say hypothetically? We had in place those kinds of criteria in a country agnostic way Um, how do you think about that? I mean this thing gets back to this gets then gets us into the I mean I think this starts to take us into the shrems gdpr territory, which is the question as to whether and in what circumstances government should be putting in place limitations on the transfer of data out of their Countries to other countries based on some set of data security data privacy principles And the u.s. Has not in any sort of broad brushed way. I mean we're starting to do that again in this very kind of ad hoc Let's let's address tick tock. Let's address we chat. Let's address wow way way But we have not done that in any sort of broad brush way in the way that the that the EU has with respect to their gdpr I you know, I am also skeptical that that's a good that the gdpr approach is a good approach I mean I think that you as a result the gdpr in my opinion has has overreached in their restrictions on data transfers And if countries around the world started adopting that approach We are in a world where any company that wants to operate internationally basically has to build a server in every single part of the world and store data locally and it becomes incredibly hard to do a whole range of like ordinary business functions like move around hr data For example, it's just a very simple example. So, um, you know, this this set of issues is is incredibly complicated and the question as to whether and in what circumstances it's appropriate to place limitations on the movement of data either outside The borders kind of writ large or to specific countries. I think requires a lot more thoughts and and discussion Yeah, and and on this, I mean just to bring it a little closer back to sort of we chat I think it's also, um It's worth thinking through carefully what data you're talking about so for for In these cases where the interest is is has been described as national security Um, you have to think about what that is actually a national security risk rather than a risk of personal personal privacy personal data intervention and so, um, this is why the australian, um, Institute on which the government has relied repeatedly to defend these um these particular bands has suggested much more targeted bars on government use and sort of government employees to ensure that any data that leaks through We chat or is prevailed through we chat and tech talk is Noted as Doesn't have as high national security implications as and obviously this doesn't get to the broader civil society questions of should we insist that companies Protect all data and Are ourselves up as an example of the perfect internet even if it means coming off the rest of the world So speaking of speaking of the rest of the world here, we have a question from when to you How much do you think other countries, especially our allies will follow the u.s Lead in banning talk and we chat or taking certain measures to ensure data security based on national security concerns If the west does form an alliance taking a stance on big chinese tech companies What impact is that for the internet? Are we trending toward a bifurcated world? So, um, I think yes, we're trending towards a bifurcated world I think, you know, even where where in the huawei ban the u.s Was not particularly has not been successful in getting all of its friends and allies to To kind of follow suit with that and there the national security case is A lot stronger. I mean very strong with the huawei ban So so so I you know whether or not the u.s at this particular moment would be successful in getting everyone to kind of follow suit Um, I have serious questions about but I actually think one of the bigger questions that this kind of approach takes and this is one of the Real concerns with saying well china did it so we should do it too. Is that it it does normalize this idea that you Kick out an app or you kick out some sort of communication tool based on Who what foreign ownership and you know, there's lots of places around the world where the united states is not particularly popular And it's not helpful for us companies to be in a world in which the precedent is that foreign governments who for whatever reason are Disgruntled dissatisfied unhappy with the united states concerned about us surveillance powers kick out our us companies owned apps Because we've normalized that as a means of addressing these really important data privacy data security surveillance side of questions Yeah, I think that's precisely right. I mean I mean the example from a few years ago that I've I always paid attention to is I mean turkey blocked wikipedia And on it because there was too much The government turkey didn't like that to my mind was a foreign policy Issue that needed to be addressed through the traditional foreign policy and we had all sorts of tools to Um affect pressure on countries that do things that that are not that we think are Against our national interest or against the world Order but the answer wouldn't be to Um, say, okay, you're gonna block wikipedia. We're gonna block. We're not gonna let any american company sort do any business with Turkey that's just that it's not the appropriate response and so so to here. I think This is essentially what jim jim just had. I mean using As a response a means that just continues to Create through hybridized bastardized internet around the world with without the it's traditional Openness just makes the problem worse We have one more question before the hour from Carmen Cero My colleague at Yale law schools paul thai china center. What kind of enforcement mechanisms? Do you envision for a privacy or data protection law if we did have such a law? How would we know that facebook is following it or 10 cent? And I want to just piggy on piggy back on that question Which is if if part of the tiktok oracle deal is to look open to have open up the algorithm Is looking at the algorithm one time a sort of frozen instance of algorithmic review Does that actually get at some of the issues that we're talking about here? related to content and information influence So I would say to your last question. I would say no, that's not going to be that's not going to solve the problem in terms of enforcement You know, there's there's a lot of different proposals that that are floating around in terms of the national data protection data privacy statute and I mean the big the big kind of question in terms of who are the enforcers are Does the fdc continue to play a role strengthen role? Or or does the us go down a route which is much more complicated of kind of mimicking what's been done in the eu and creating separate data protection agencies and new data protection authority, which Obviously has the huge hurdles of starting something new and getting something new off the ground But in terms of what's being discussed right now, those are the kind of two main options that appear to be unfeasible Yeah, and on that I have two two small points one. I mean, I think if people haven't read it, I would Send them to there was a proposal in back in august by Tom Wheeler and paul verveer and gene kimmelman about creating a new sort of oversight agency that was put out by the harvard chorenstein center that I think I'm not sure I think it's right But I think it was a fascinating proposal and the other thing I will say is Um Back in 2011. I helped start the consumer financial protection bureau. I was the first to kind of defense litigation there defensively qualification and Starting a new agency isn't that part. It takes work. It takes effort. It takes a level of commitment by the government to transfer functions there and such but it was also one of the Most one things I've ever done is try to start a new agency for scratch And uh, I I don't think we should think that that's off the table just because Oh my god, we're doing something new it we we did it this decade and um, yes, there's been also some questions about structure of the CFPB, but It also has done a lot of good and those those questions about its structure have prevented it from in fact Really improving things after the 2009 2019 We're at our our time and apologies. We couldn't get to all of our questions, but please continue to reach out Hopefully we can continue the conversation. I think what's become clear here is that What is at stake is much bigger than a us china spat But really the future of how the internet will be governed. So jen and david. Thank you so much for joining us