Welcome to the TechStream newsletter! If this email was forwarded to you, sign-up here. We love to hear from readers. Get in touch: techstream@brookings.edu.

Addressing spyware's threat to democratic politics

What would it take to eliminate the kind of sophisticated spyware that forced Apple this week to issue an emergency fix to its operating systems? The question has renewed urgency after another disclosure about spyware developed by NSO Group, the Israeli security firm that sells surveillance software to clients around the world. NSO was discovered to be using a so-called “zero-click exploit” that allowed the company to target vulnerable devices at-will and to turn them into powerful surveillance devices.

The proliferation of NSO’s hacking tools—which are some of the world’s most sophisticated thanks to the deep bench of hacking talent the company can rely on via its links to Israel’s most elite cyber units—represents a threat to democratic values. As highly intrusive spyware becomes increasingly available to those able to afford it, the space for opposition politics only shrinks. For autocrats, the tools offer a window into the work of their enemies; for dissidents, activists, and journalists, the continued operation of groups like NSO stoke paranoia and make their work all the more difficult. Citizen Lab, the research group that discovered this latest vulnerability, calls the tools sold by NSO “despotism-as-a-service.”

Despite the repeated exposure of how the company’s tools have been turned against targets that have no legitimate law enforcement purpose, the company appears to continue to supply its tools to the highest bidder. Its software has turned up on devices belonging to a wide variety of civil-society targets, including Emirati activists, a dissident close to the murdered journalist Jamal Khashoggi, and lawyers investigating the disappearance of students in Mexico, among others. NSO has neither confirmed nor denied its use of this most recent vulnerability, issuing only a cryptic statement: “NSO Group will continue to provide intelligence and law enforcement agencies around the world with life-saving technologies to fight terror and crime.”

While digital technologies have transformed our lives, there has been growing recognition, at least in capitals of democratic states, that these technologies are not always entirely compatible with democratic values. President Joe Biden seemed to acknowledge this during the campaign when he pledged to align “the technologies of the future” with “laws and ethics” and to ensure that they “promote greater shared prosperity and democracy.” He now has a chance to do so. In December, Washington plans to convene a Summit for Democracy, which might provide the forum to build consensus on how to ensure that digital communication technologies are not easily subverted by authoritarian states and their enablers in the spyware industry.

Reining in the worst of the spyware industry’s abuses begins with NSO, and there Washington has an opportunity to use its muscle. The Israeli government licenses the products sold by NSO and has the power to end or radically reform the company’s work. Though it is constrained by the peculiarities of its relationship with Israel, Washington has the power to lean on its ally and compel change. Until that happens, NSO group will continue to play cat and mouse with security engineers at Apple and other major technology companies, selling access to these firms’ devices to the highest bidder. The potential victims include anyone with a phone.

Broader reform of the spyware landscape will be far more difficult. If NSO were to leave the market, other unscrupulous security firms will likely step in to supply NSO’s former clients. The profit opportunity is simply too great, and NSO is far from the only player in this space. Just this week three former American intelligence officers admitted to their role in carrying out cyberattacks on behalf of the United Arab Emirates. That calls for some type of global compact to regulate the use of digital surveillance tools. Crafting such an agreement will undoubtedly be difficult. Past attempts to leverage arms-control frameworks to build similar agreements have been highly controversial and mostly unsuccessful.

But the constant discovery of highly invasive spyware that make it easy for authoritarians to surveil and suppress their opponents make action on this issue absolutely critical. If digital technologies are going to maintain their promise for strengthening, rather than undermining, democratic values and processes, their security must be ensured.

– Elias Groll (@EliasGroll)

Recently on TechStream

Data-driven policing's threat to constitutional rights

Across the country, the tools that power modern police surveillance contribute to cycles of violence and harassment. Predictive policing systems digitally redline certain neighborhoods as “hotspots” for crime, with some systems generating lists of people they think are likely to become perpetrators. These designations subject impacted communities to increased police presence and surveillance that follows people from their homes to schools to work. The typical targets are Black and brown youth, who may also be secretly added to gang databases. Unquestioned reliance on data can hypercharge discriminatory harms from over-policing and the school-to-prison pipeline. Our elected leaders must uncover and dismantle these practices and recognize them for what they are: an attack on our constitutional rights to due process and equal protection under the law, Ángel Díaz writes.

Read more

Loitering munitions show autonomous future of war

Loitering missiles operate from a simple premise: What if a missile could become more accurate by slowing down? For decades, loitering missiles have been on the forefront of autonomous lethality. Historically, loitering munitions were used to target things like radars but are increasingly being used to attack humans. And as they make this transition in targeting capability, loitering munitions represent a bridge between today’s precision-guided weapons that rely on greater levels of human control and our future of autonomous weapons with increasingly little human intervention, Kelsey Atherton writes.

Read more

What we’re following

Facebook files. A series of Wall Street Journal articles published this week based on internal Facebook documents describe how the company has created separate content moderation rules for VIP users, the negative effect of the company’s Instagram platform on teen mental health, and how the company’s tweaks to its algorithms have resulted in more divisive content on Facebook. Taken together, the articles contradict the company’s public statements regarding rules governing content and their enforcement, its claims about its products’ impact on user health, and the stated goals of algorithm tweaks. Based on documents authored by company researchers leaked to the Wall Street Journal, the series provides perhaps the most damning indictment to date of Facebook’s approach to a series of critical public policy issues.

Misinfo research. A Facebook data set provided to social science researchers in order to study misinformation on the platform was majorly flawed. The data only included interactions from about half of the platform’s American users, throwing into doubt the validity of both published and ongoing research based on the data, such as studies on the spread of false information on Facebook.

Encrypted back-ups. Facebook said it plans to expand the amount of content on WhatsApp that is encrypted. In updates expected to ship later this month, the messaging application plans to start encrypting chats backed up in cloud storage systems run by Apple and Google. Expanding encryption to backed-up chats represents a major expansion of the amount of user data encrypted by WhatsApp, a move that is likely to intensify conflict with government agencies who argue that encrypted chat systems represent a threat to law enforcement operations.

Deepfakes. The MIT Technology Review has identified a deepfake service that swaps photos of an individual’s face onto the body of a pornographic actor. While the feared use-cases of deepfakes—AI technology that creates highly realistic synthetic video—have typically revolved around disinformation and propaganda, some of the most nefarious applications identified in the wild focus on the harassment of women.

Data transfers. U.S. and European negotiators are making progress in drafting a new data transfer agreement, the Wall Street Journal reports. Data transfers between the United States and the EU have been blocked by a series of European court rulings arguing that U.S. law fails to provide sufficient privacy protections to European users, rulings that have thrown a wrench in the operations of U.S. technology firms.

Pump and dump. A fake press release claiming that Walmart would be allowing customers to pay using the cryptocurrency Litecoin caused a major spike in its price before the news was debunked. The ploy may have been part of a pump and dump scheme and is fueling for calls for additional regulation of the cryptocurrency space.

FEC. The Federal Election Commission ruled in favor of a decision by Twitter in the run-up to the 2020 election to block users from posting links to an article about a laptop belonging to the son of President Joe Biden. The decision may provide precedent for social media companies to carry out similarly aggressive content moderation action around American elections.

FTC. President Joe Biden nominated Georgetown Professor Alvaro Bedoya, a prominent voice within progressive tech policy circles, to serve as a commissioner on the Federal Trade Commission. If confirmed by the Senate, Bedoya will bring a wealth of experience regarding technology privacy issues and provide additional heft to the commission’s efforts to provide greater regulatory scrutiny of major technology firms.

Android. South Korean regulators ordered Google to pay an approximately $175 million fine for preventing the manufacturers of smartphones from using modified versions of the Android operating system. The ruling orders Google to stop using so-called “anti-fragmentation agreements,” which prevents companies like Samsung from altering the Android operating system.

Alipay. Chinese regulators are intensifying their crackdown on entrepreneur Jack Ma’s business empire and want to break up Alipay, the digital payments app with more than 1 billion users, the Financial Times reports. After ordering Ma’s Ant Group to restructure two other credit services, Huabei and Jiebei, Chinese regulators are formulating a plan to force Ma to split off Alipay’s loans business into a separate app. The development marks the latest twist in the Chinese government’s remarkable effort to rein in the power of the country’s powerful technology firms.

Chinese antitrust. China’s Ministry of Industry ordered internet firms Tencent and Alibaba to stop blocking links to one another’s services. The order aims to end the “walled gardens” of China’s internet and to spur competition among the country’s technology companies.

Reports we’re reading

Enrollment algorithms. A new Brookings Institution report examines enrollment algorithms at higher-education institutions and whether they are contributing to algorithmic discrimination.

Trust and safety techniques. The scholar Riana Pfefferkorn surveys major technology firms to examine content-dependent and content-oblivious trust and safety techniques.

A final point

“The power of AI to serve people is undeniable, but so is AI’s ability to feed human rights violations at an enormous scale with virtually no visibility. Action is needed now to put human rights guardrails on the use of AI, for the good of all of us.”

— Michelle Bachelet, the UN’s human rights chief, in rolling out a new report on AI.

Apple, Facebook, and Google provide financial support to the Brookings Institution, a nonprofit organization devoted to rigorous, independent, in-depth public policy research.