cybersecurity

It’s A Bird! It’s A Plane! It’s A…Spy Balloon? Are We Prepared For The Advancements In Aerial Surveillance Technology?

By Omnia Shedid

In January 2023, the U.S. Congress received a classified report detailing a country’s efforts to conduct aerial surveillance with “unknown cutting edge technology.”[1]  The technology included quadcopter drones, spy balloons, and other “aerial phenomena” designed to fly at high altitudes and gather sensitive information.[2] On February 2, 2023, U.S. government officials shared that a Chinese spy balloon was flying over the United States.[3] Flights were grounded, the meme-iverse went ablaze, and “balloongate” was trending on Twitter. Made of metal plates and containing gas and other chemicals, the Chinese spy balloon was spotted flying over Montana all the way to the Carolinas.[4] Although military officials said that the spy balloon was not capable of gathering more intelligence than was already being gathered by Chinese satellites, the balloon was shot down by U.S. fighter jets over the Atlantic Ocean.[5] The incident has fractured an already fragile diplomatic relationship between the United States and China, prompting Secretary of State Antony Blinken to cancel his visit to Beijing.[6] The visit would have been the first visit of a top U.S. diplomat since 2018.[7] In addition to the diplomatic ramifications caused by this incident, it has started many other conversations relating to the U.S.’s ability to anticipate and respond to other aerial surveillance threats. Are we prepared for the advancements in aerial surveillance technology?  

While a spy balloon undoubtedly poses a serious threat, the most significant aerial surveillance threat comes from unmanned aerial vehicles (UAVs). UAVs, also known as drones, have evolved into being faster, smarter, and much cheaper to make, positioning them to be the safest option for continued aerial surveillance. According to the U.S. Department of Homeland Security Cybersecurity and Infrastructure Security Agency Interagency Security Committee, the threat risks from UAVs can come from recreational users, intentional operators, or terrorist and paramilitary users.[8] Their wide availability to the average citizen as well as government entities makes their threat notable, as they are much more accessible to people or entities who intentionally want to gather information or cause harm. These aircrafts can also be used for electronic, cyber, and physical attacks. While the exact number of foreign aerial surveillance objects is unclear, more than three-dozen countries have armed drones capable of surveilling and attacking.[9] Some countries, including Russia, Turkey, and China, have increasingly begun to develop drones domestically, which makes it harder for other countries to anticipate one another’s advancements in drone technology.[10] More reliant and stealthy than a spy balloon turned weather machine, drones have adapted to transport chemical and explosive contraband, perform cyberattacks, and surveil much larger areas than ever before.[11] Their range, flight method, and ability to limit its detection are all areas of advancements that could make aerial surveillance much more accessible to foreign governments.[12]

In addition to threats associated with foreign aerial surveillance of the U.S. and its citizens, there has been tension among U.S. federal, state, local, and tribal governments on how to regulate aerial surveillance within the U.S. by government and non-government operators. The Federal Aviation Administration (FAA) predicted that more than 4.3 million unmanned aircraft systems were sold annually as of 2020.[13] The FAA also predicts that there will be 1.4 million drones being operated for recreational use and more than 800,000 commercial drones operated by businesses by 2024.[14] While the FAA attempts to integrate drones into national airspace, it will have to ensure that they are not used to infringe on the privacy of U.S. citizens and that the U.S. government has the capacity and equipment to detect and track threatening activity.[15] For example, in the aftermath of George Floyd’s murder and the protests against police brutality, law enforcement entities increased police reliance on artificial intelligence, facial recognition, and aerial surveillance.[16] In New York alone, a Freedom of Information Act request to the FAA revealed that there are 530 active drone registrations from 85 government entities.[17] This sparked conversations about regulations, or the lack thereof, surrounding aerial surveillance by U.S. and non-U.S. government entities. Among those debates, the FAA has continued to integrate procedures and protocols that curb surveillance drones, both within the U.S. and by foreign entities.

However, the legal and policy considerations around aerial surveillance, from jurisdiction questions to organizational capacity to fight security risks of such surveillance, are complex. In response, the FAA developed the UAV Integration Pilot Program (IPP) to help state, local, and tribal governments work with private-sector entities, such as drone operators and manufacturers, to develop safety guidelines and integration methods.[18] Because there is minimal legislative clarity and competing jurisdiction issues surrounding UAVs and private organizations, the National Telecommunications and Information Administration has developed a best practices document that could support private and commercial users.[19] Additionally, the Department of Homeland Security develops awareness and mitigation resources to be used by security personnel and federal government employees involved in non-military activities.[20] Policy researchers also recommend that Congress develop and pass legislation that limits the aggregate amount of time government drones may surveil as well as increase procedural protections surrounding data retention by drones, and transparency and accountability, among other measures.[21]

Whether it is operated by a foreign actor or a recreational user, it is clear that aerial surveillance technology will continue to advance, and so will its threat. In response, U.S. laws and policies should be modified to prepare for those threats.

[1] Julian E. Barnes and Edward Wong, Classified U.S. Report Highlights Foreign Power Aerial Spying With Advanced Tech, The New York Times (Feb. 4, 2023), https://www.nytimes.com/2023/02/04/us/politics/balloon-congress-surveillance-report.html.

[2] Id.

[3] Idrees Ali and Phil Stewart, Chinese spy balloon flies over the United States: Pentagon, Reuters (Feb. 1, 2023), https://www.reuters.com/world/suspected-chinese-spy-balloon-flying-over-united-states-us-officials-2023-02-02/.

[4] Juliette Kayyem, Why the U.S. Isn’t Shooting Down the Chinese Spy Balloon, The Atlantic (Feb. 3, 2023), https://www.theatlantic.com/ideas/archive/2023/02/why-the-us-isnt-shooting-down-the-chinese-spy-balloon/672945/.

[5] Zachary Cohen, Kevin Liptak, Oren Liebermann and Phil Mattingly, US fighter jets shoot down Chinese spy balloon off East Coast, CNN (Feb. 4, 2023), https://www.cnn.com/2023/02/04/politics/china-spy-balloon-us-latest/index.html.

[6] Barnes and Wong, supra note 1.

[7] Id.

[8] PROTECTING AGAINST THE THREAT OF UNMANNED AIRCRAFT SYSTEMS (UAS), US Dep’t of Homeland Sec. Cybersec. And Infrastructure Sec. Agency Interagency Sec. Comm. (Nov. 2020), https://www.cisa.gov/sites/default/files/publications/Protecting%20Against%20the%20Threat%20of%20Unmanned%20Aircraft%20Systems%20November%202020_508c.pdf.

[9] Who Has What: Countries with Armed Drones, New America, https://www.newamerica.org/international-security/reports/world-drones/who-has-what-countries-developing-armed-drones.

[10] Id.

[11] PROTECTING AGAINST THE THREAT OF UNMANNED AIRCRAFT SYSTEMS (UAS), supra note 8.

[12] PROTECTING AGAINST THE THREAT OF UNMANNED AIRCRAFT SYSTEMS (UAS), supra note 8.

[13] FAA predicts small drone purchases to reach 4.3 million by 2020, Aerospace Tech. (Mar. 28, 2023), https://www.aerospace-technology.com/news/newsfaa-predicts-small-drone-purchase-to-reach-43-million-by-2020-4848780/.

[14] Drone Operations, US Gov’t Accountability Off., https://www.gao.gov/drone-operations (last visited Feb. 5, 2023).

[15] Richard M. Thompson II, Drones in Domestic Surveillance Operations: Fourth Amendment Implications and Legislative Responses, Cong. Rep. Serv. (Apr. 3, 2013), https://sgp.fas.org/crs/natsec/R42701.pdf.  

[16] Steven Feldstein and David Wong, New Technologies, New Problems – Troubling Surveillance Trends in America, Just Sec. (Aug. 6, 2020), https://www.justsecurity.org/71837/new-technologies-new-problems-troubling-surveillance-trends-in-america/.

[17] PRYING EYES: GOVERNMENT DRONE DATA ACROSS NEW YORK STATE, NYACLU, https://www.nyclu.org/en/campaigns/prying-eyes-government-drone-data-across-new-york-state (last visited Feb. 5, 2023)

[18] PROTECTING AGAINST THE THREAT OF UNMANNED AIRCRAFT SYSTEMS (UAS), supra note 8.

[19] Voluntary Best Practices for UAS Privacy, Transparency, and Accountability, Nat’l Telecomm. And Info. Admin., https://www.ntia.doc.gov/files/ntia/publications/voluntary_best_practices_for_uas_privacy_transparency_and_accountability_0.pdf. (last visited Feb. 5, 2023).

[20] PROTECTING AGAINST THE THREAT OF UNMANNED AIRCRAFT SYSTEMS (UAS), supra note 8.

[21] Gregory McNeal, Drones and aerial surveillance: Considerations for legislatures, Brookings (Nov. 2014), https://www.brookings.edu/research/drones-and-aerial-surveillance-considerations-for-legislatures/.

Businesses Appeal to Chinese Government over Cybersecurity

By: Dan Hart

An alliance of forty-six business groups appealed to the Chinese government to reconsider proposed legislation that would enforce strict cyber-security rules. These business groups, hailing from the United States, Europe, and Asia, believe the new regulations will negatively impact foreign trade with China and serve to further isolate the country.[1] These complaints are the latest against a perceived trend of economic isolationism, or favoritism towards domestic business over foreign investors.[2]

The rules would allow any business to transfer data, required for business purposes, past China’s borders only after passing a security evaluation. The rules would impose a legal requirement on internet providers to cooperate with enforcement agencies’ counter-terrorism and criminal investigations by providing data deemed relevant.[3]  They would also require network operators to accept government supervision and to “comply with social morals.”[4]

The proposed cyber security regulations affect international business to varying degrees, but would have the greatest impact on domestic Chinese businesses and Chinese citizens. Chinese citizens would be required to store all their personal information as well as their business information on Chinese servers.[5]

These new security rules would grant the Chinese government even greater control over their citizens’ private lives and information, limiting both what they can see from the rest of the world and how they can interact with that world.

 

[1] http://www.businessinsider.com/ap-business-groups-appeal-to-china-over-cybersecurity-law-2016-8

[2] http://www.businessinsider.com/ap-business-groups-appeal-to-china-over-cybersecurity-law-2016-8

[3] http://fortune.com/2016/08/17/china-cybersecurity-law-foreign-business/

[4] http://www.reuters.com/article/us-china-cyber-lawmaking-idUSKCN0ZD1E4

[5] http://www.reuters.com/article/us-china-cyber-lawmaking-idUSKCN0ZD1E4

Microsoft’s Battle: Privacy Up in the Clouds

By: Cecilia Santostefano

It’s no surprise that we live in a world largely permeated by technology. It influences how we live – from the developing industries to the outlets we use to communicate with each other. However, rapid increases in the use of technology, particularly the internet, raise privacy concerns. After all, the right to privacy is greatly valued by Americans.

While whistleblower Edward Snowden fixated his concerns on computer hackers, so-called Big Brother is the more relevant privacy concern today.[1] Back in 2013, the Department of Justice served Microsoft with a court order to hand over e-mail communications that the company stored outside of the United States.[2] This is similar to Apple’s face-off with the DOJ from early 2016.[3] Microsoft’s response was two-fold. First, customers trust the cloud. If customers don’t believe their communications are secure from government viewing, then that risks the use and, ultimately, the success of the cloud.[4] Second, the government requires what is known as a ‘secrecy order’ when conducting its electronic investigations. A secrecy order compels Microsoft to keep information regarding ongoing investigations secret from its customers for a certain period of time; typically one to three months.[5] This delayed notification concerned Microsoft, who feared this provided the government with a means to continue searching customer information without a specific reason.[6] The latter claim is the basis for Microsoft’s lawsuit against the DOJ.[7]

In early September, sizeable entities including Google, Amazon, and Snapchat joined Microsoft’s DOJ-resistant efforts.[8] Other civil liberty groups like The Washington Post also stand united with Microsoft.[9] The allies believe their customers “do not give up their rights [to privacy] when they move their private information from physical storage to the cloud.”[10] While Microsoft executives have agreed secrecy orders are necessary under certain conditions where government investigations cannot be compromised, the corporation retains an emphasis on the importance of privacy.[11]

 

[1] See Jennifer Schlesinger, Is Big Brother really watching you?, CNBC, (June 3, 2014, 9:08 AM), http://www.cnbc.com/2014/06/03/is-big-brother-really-watching-you.html.

[2] David Goldman, Microsoft is fighting the DOJ too, CNN, (Feb. 23, 2016, 6:52 PM), http://money.cnn.com/2016/02/23/technology/microsoft-ireland-case/.

[3] Mikey Campbell, DOJ confirms successful iPhone data extraction, withdraws encryption case against Apple, Apple Insider, (Mar. 28, 2016, 2:47 PM), http://appleinsider.com/articles/16/03/28/doj-to-withdraw-san-bernardino-iphone-court-action-suggests-discovery-of-successful-bypass.

[4] See Nick Wingfield, Microsoft’s Challenge to Government Secrecy Wins Dozens of Supporters, NY Times, (Sept. 2, 2016), http://www.nytimes.com/2016/09/03/technology/microsofts-challenge-to-government-secrecy-wins-dozens-of-supporters.html?ref=technology&_r=0.

[5] Wingfield, supra note 4.

[6] Id.

[7] Sarah McBride, Microsoft sues U.S. government over data requests, Reuters, (Apr. 15, 2016, 8:48 AM), http://www.reuters.com/article/us-microsoft-privacy-idUSKCN0XB22U.

[8] Wingfield, supra note 4.

[9] Id.

[10] Jose Pagliery, Microsoft sues government for secret searches, CNN, (Apr. 14, 2016, 4:08 PM), http://money.cnn.com/2016/04/14/technology/microsoft-secret-search-lawsuit/.

[11] See Wingfield, supra note 4.