Stanford CIS Blog

This is the best text explainer I have found: https://cyberlaw.stanford.edu/blog/2025/05/no-two-tier-internet-coalit…

DT tries to make everyone that peers pay them. Facebook used to pay the ransom, then decided to stop. Now its going to move to a transit connection. The problem is DT keeps its transit routes congested or artificially limits how much traffic a transit provider can deliver. So now when FB moves to transit, will DT widen those connections or will it keep them narrow to try to make Facebook's applications get terrible enough performance that Facebook will pay DT. It's a showdown. DT wants to get paid twice for the same service, once by its subscribers and once by every app and website on the planet. https://cyberlaw.stanford.edu/blog/2024/09/a-deutsche-telekom-shakedow…

If you haven't seen it already, this is a good read about EARN it and the issues around CSAM scanning in general wrt the 4th amendment. http://cyberlaw.stanford.edu/blog/2020/03/earn-it-act-unconstitutional…

The debate about this bill has been going on for a while now. Riana Pfefferkorn of CIS did a lot better job objectively addressing the issues (sans the overt political cheap shots) in her article. It lays out why it may be unconstitutional on several grounds. I'd recommend reading it if you want more detail on the bill: THE EARN IT ACT: HOW TO BAN END-TO-END ENCRYPTION WITHOUT ACTUALLY BANNING IT: http://cyberlaw.stanford.edu/blog/2020/01/earn-it-act-how-ban-end-end-…

The eminently qualified Jennifer Granick calls it "a great first step" https://cyberlaw.stanford.edu/blog/2013/01/thoughts-zoe-lofgrens-cfaa-… See also her writings over the last few days https://cyberlaw.stanford.edu/about/people/jennifer-granick

I presume you are talking about WK 10235/2022 ADD 10[0], as I found many blogs and journals[1] talking about Lithuania's position there and how it is anti-E2EE, pro-Chat Control. Some things should be clarified: Firstly, it is a working document that someone obtained through a FOI request. So it is important to understand that this was not meant for the public, and therefore the opinion Lithuanian representatives provided there was not scrutinized as such prior to release. This is not a comprehensive position of Lithuania's government or any of its branches. Secondly, the document follows positions expressed in and around a police (LEWP) meeting. It is difficult to imagine that law enforcement would support E2EE or stand against Chat Control in principle, because it makes their daily work more difficult. This context should be kept in mind and is also pointed out by the Stanford Center for Internet and Society article I linked. Thirdly, the opinion of a limited group of Lithuania's law enforcement workers does not impact Lithuania's constitution, nor culture. I also believe that it is not an opinion shared by many Lithuanians who have some distrust of authority following years of state surveillance, persecution, and the trauma this entailed. So it is important to understand that the culture, the constitution, and the opinion of law enforcement workers contributed to this working document are three distinct things. Finally, this "let's sacrifice anything and everything to…

Now you're being dishonest. The 6-month sentence was a plea deal he declined. It was a 35-50 year sentence if he fought and lost all charges. It remained to be seen if he were actually guilty. > Carmen Ortiz, the federal prosecutor who hounded Aaron Swartz in the months before his Friday suicide, has released a statement arguing that "this office’s conduct was appropriate in bringing and handling this case." She says that she recognized that Swartz's crimes were not serious, and as a result she sought "an appropriate sentence that matched the alleged conduct – a sentence that we would recommend to the judge of six months in a low security setting." > That's funny because the press release her office released in 2011 says that Swartz "faces up to 35 years in prison, to be followed by three years of supervised release, restitution, forfeiture and a fine of up to $1 million." And she apparently didn't think even that was enough, because last year her office piled on even more charges, for a theoretical maximum of more than 50 years in jail. https://www.forbes.com/sites/timothylee/2013/01/17/aaron-swartz-and-th… > Some have blithely said Aaron should just have taken a deal. This is callous. There was great practical risk to Aaron from pleading to any felony. Felons have trouble getting jobs, aren't allowed to vote (though that right may be restored) and cannot own firearms (though Aaron wasn't the type for that, anyway). More…

Here is some more criticism of the EARN IT Act supporting that https://www.schneier.com/blog/archives/2020/03/the_earn-it_act.html Lindsay Graham has repeatedly sought to weaken encryption and mandate backdoors and key escrow. Also in June this year following the EARN IT Act he introduced the Lawful Access To Encrypted Data Act (LAED) which would mandate backdoors: https://cyberlaw.stanford.edu/blog/2020/06/there%E2%80%99s-now-even-wo… LEAD is extreme and has little support. It is widely believed that the LAED was not intended to be passed but is meant to help pass the EARN IT Act by making the EARN IT Act seem like a more moderate and reasonable piece of legislation. The EARN IT Act is really a ploy by Lindsay Graham and others to bypass Congress on this issue which they cannot otherwise get passed, and allow a small group of people who are not even security experts to develop regulation and mandates (which will probably be against encryption) under the guise of fighting child porn.

I'm always puzzled by these articles looking at the Great Firewall of China as if it is an alien thing. Much of it was designed in the US, by American engineers, working for companies like Cisco ( http://www.wired.com/2008/05/leaked-cisco-do ). So just ask them. People have even sued companies like Cisco about this ( http://blog.thomsonreuters.com/index.php/suit-over-ciscos-role-in-chin… ), but the US government dismissed those cases ( http://cyberlaw.stanford.edu/blog/2015/03/china%E2%80%99s-golden-shiel… ). I read bizarre pieces from New York Times columnists ( http://www.nytimes.com/2009/06/18/opinion/18kristof.html ) which say "If President Obama wants to support democratic movements on a shoestring, he should support an “Internet freedom initiative” pending in Congress. This would include $50 million in the appropriations bill for these censorship-evasion technologies. The 21st-century equivalent of the Berlin wall is a cyberbarrier, and we can help puncture it." Huh? US corporations built it. The US courts have OK'd it. Why should US taxpayers pay to circumvent the technology that S&P 500 companies like Cisco are building?

The statement contains no new news, it was already reported that there was an ultimatum from the prosecution for him to either plead guilty to all 13 counts, or go to trial where he faced a sentence of up to 50 years in prison. Attorney Jennifer Granick, the Director of Civil Liberties at the Stanford Center for Internet and Society, pointed out that plea offers are not binding on the court and are presented as optional suggestions for the judge to consider during sentencing. Normally the judge goes with the "neutral" sentencing guidelines, regardless of any deals. http://cyberlaw.stanford.edu/blog/2013/01/towards-learning-losing-aaro… In this case, neutral guidelines are capped at 5 years per count, for a potential sentence of 65 years in prison, with the guilty plea deal. As Granick states: > [T]he court is not constrained to sentence as the government suggests. Rather, the probation department drafts an advisory sentencing report recommending a sentence based on the guidelines. The judge tends to rely heavily on that "neutral" report in sentencing. If Aaron pleaded to a misdemeanor, his potential sentence would be capped at one year, regardless of his guidelines calculation. However, if he plead guilty to a felony, he could have been sentenced to as many as 5 years, despite the government's agreement not to argue for more. Each additional conviction would increase the cap by 5 years, though the guidelines calculation would remain the same. No…

Waymo has a control center, but it's customer service, not remote driving. They can look at the sensor data, give hints to the car ("back out, turn around, try another route") and talk to the customer, but can't take direct control and drive remotely. Baidu's system in China really does have remote drivers.[1] Tesla also appears to have remote drivers, in addition to someone in each car with an emergency stop button.[2] [1] https://cyberlaw.stanford.edu/blog/2025/05/comparing-robotaxis-baidus-… [2] https://insideevs.com/news/760863/tesla-hiring-humans-to-control-robot…

The keyword is "meaningful". The DMCA's counter-notice process is intimidating to use [1]. The DMCA as a whole is written in a way that effectively forces platforms to remove content targeted by unsubstantiated DMCA infringement notices [2]. (Tangentially, courts have read the DMCA's repeat infringer provision to apply to more parties than the text requires [2].) YouTube's Content ID process, unfair as it is, is net fairer than the DMCA [3]. [1] https://cyberlaw.stanford.edu/blog/2017/01/dmca-counter-notice-does-it… [2] https://www.rstreet.org/research/jawboning-in-plain-sight-the-unconsti… [3] https://www.youtube.com/watch?v=1Jwo5qc78QU - YouTube's copyright system isn't broken. The world's is.

https://cyberlaw.stanford.edu/blog/2007/03/second-lifes-response-its-p… Our legal dept (person) did this in 2007 and it made me so happy.

Signal reported on their access in 2021 as well: https://signal.org/blog/cellebrite-vulnerabilities/ https://cyberlaw.stanford.edu/blog/2021/05/i-have-lot-say-about-signal…

Some more details on the photograph experiment from https://cyberlaw.stanford.edu/blog/2007/09/how-lucky-people-think-diff… ---- [Experimenter]: They'd go through, and after about three pages, there'd be a massive half-page advert saying, STOP COUNTING. THERE ARE 43 PHOTOGRAPHS IN THIS NEWSPAPER. It was next to a photo, so we knew they were looking at that area. A few pages later, there was another massive advert -- I mean, we're talking big -- that said, STOP COUNTING. TELL THE EXPERIMENTER YOU'VE SEEN THIS AND WIN 150 POUNDS [about $235]. For the most part, the unlucky would just flip past these things. Lucky people would flip through and laugh and say, "There are 43 photos. That's what it says. Do you want me to bother counting?" We'd say, "Yeah, carry on." They'd flip some more and say, "Do I get my 150 pounds?" Most of the unlucky people didn't notice.

A/K/A "generative computing", which has been under attack for a long time. I believe Jonathan Zittrain's written specifically on the topic, though the closest match I'm currently finding is about the generative Internet: <https://papers.ssrn.com/sol3/papers.cfm?abstract_id=847124> Also "The Future of the Internet and How to Stop It" (2008): <https://futureoftheinternet.org/> Response: <https://cyberlaw.stanford.edu/blog/2010/09/do-we-need-new-generativity… Cory Doctorow on the war against general purpose computing: <https://boingboing.net/2012/01/10/lockdown.html> (2012)

See https://cyberlaw.stanford.edu/blog/2023/06/eu-member-states-still-cann… There are fighting internally already, because this proposal is illegal and unconstitutional, and some proposals are just unimplementable.

Wouldn’t this law be unconstitutional according to the EU constitution? Its own top legal departments seem to say so https://cyberlaw.stanford.edu/blog/2023/06/eu-member-states-still-cann…

I have never heard of them https://cyberlaw.stanford.edu/about/people/megan-gray That Megan Gray?

https://cyberlaw.stanford.edu/blog/2017/01/using-transparency-fight-ta… https://www.dmca.com/FAQ/How-can-I-eliminate-fake-DMCA-Takedown-Notice…

T-Mobile was one of the earliest violators of net-neutrality: https://cyberlaw.stanford.edu/publications/t-mobile-likely-violating-n…

> Are they going to outlaw electronics knowledge? No, but they might ban "bespoke" devices.[0] Maybe you're smart and brave enough to build and maintain your own illegal device, but good luck trying to persuade other people to do the same so that you can communicate with them securely online. Also, the government might force ISPs to block access to devices that don't pass remote attestation checks. [0] https://cyberlaw.stanford.edu/blog/2023/02/my-comment-uk-government-it…

The US is not without flaws, we have SESTA and FOSTA, which restrict website content, passed with minimal outcry, and the potentially upcoming EARN IT[0] and LAED[1] acts, which will threaten end-to-end encryption and more. The only senator vaguely aware of these problems seems to be Ron Wyden. No reason to assume we are able to simply relax. 0. https://en.wikipedia.org/wiki/EARN_IT_Act_of_2020 (despite the year in the name, it's still an ongoing potential bill) 1. https://cyberlaw.stanford.edu/blog/2020/06/there%E2%80%99s-now-even-wo…

See the “Federal CSAM Law” section here: https://cyberlaw.stanford.edu/blog/2020/01/earn-it-act-how-ban-end-end… > Section 2258A of the law imposes duties on online service providers, such as Facebook and Tumblr and Dropbox and Gmail. The law mandates that providers must report CSAM when they discover it on their services, and then preserve what they’ve reported (because it’s evidence of a crime).

The SAE levels measure the level of autonomy. Level 2 / driver assist is a form of autonomy. Also level 1 is driver assistance. Level 2 would be “partial automation”, see http://cyberlaw.stanford.edu/blog/2013/12/sae-levels-driving-automatio…

Depends how friendly the administration is to encryption. A lot has happened since March 2017. https://www.politico.com/story/2019/06/27/trump-officials-weigh-encryp… https://www.eff.org/deeplinks/2020/10/urgent-earn-it-act-introduced-ho… http://cyberlaw.stanford.edu/blog/2020/06/there%E2%80%99s-now-even-wor… The US and cryptography have never really gotten along. https://en.wikipedia.org/wiki/Crypto_Wars

https://cyberlaw.stanford.edu/blog/2020/01/earn-it-act-how-ban-end-end… Scroll to summary, specifically "Section 230 immunity for CSAM can be earned via 1 of 2 “safe harbors”."

It's just bad, real bad, only made worse by the LAED bill they've recently introduced. Rianna Pfefferkorn wrote a in-depth analysis about EARN IT which is really good to read: https://cyberlaw.stanford.edu/blog/2020/01/earn-it-act-how-ban-end-end… I also wrote a smaller high level article about it if you're interested in a briefer read: https://medium.com/@console.blog/action-tell-your-representative-to-op…

> that one would reasonably think would be shot down immediately, but isn't. EARN IT looks like a compromise compared to this: https://cyberlaw.stanford.edu/blog/2020/06/there%E2%80%99s-now-even-wo… which is I assume why it was pushed only a few days ago.

Longer discussion at https://cyberlaw.stanford.edu/blog/2020/06/there%E2%80%99s-now-even-wo…