Good morning. Welcome to today's conference. Hashtag Cyberspace IRL. Rule of law approaches to virtual threats. And welcome to the United States Institute of Peace. I'm David Yong. I'm USIP's Vice President for Applied Conflict Transformation. Our Center for Applied Conflict Transformation tests innovative approaches to peace building. As many of you may know, USIP was founded by Congress in 1984 as a nonpartisan national institute dedicated to the proposition that a world without violent conflict is possible, practical, and essential to US and global security. USIP pursues this vision by working on the ground with local partners, local peace builders. We provide governments and civil society organizations with the tools, knowledge, and training to manage conflict so it doesn't become violent and to resolve it when it does. For many decades I've had the honor to work at the intersection of peace, human rights, democratic governance, and the rule of law. So I'm particularly pleased this morning to welcome all of you to discuss the role of the rule of law in the face of virtual threats globally. We are particularly pleased to be co-hosting this important event today with the American Bar Association's Rule of Law Initiative. I'd like to thank my USIP colleague, Philippe Laroumartin, and his colleague, Chelsea Dreyer, for working with our ABA colleagues on this important event. I'd also like to thank Alberto Mora and Judge Margaret McEwen for their great leadership of the ABA Rolly Project. For over a quarter century, ABA's Rule of Law Initiative has promoted the rule of law and democratic governance around the world. Rule of law approaches to virtual threats. Of course, this is a timely event and an important topic. Anyone working on managing conflict today cannot do so effectively without truly understanding the ways in which technology can either support or hinder peacebuilding. It's clear that technology presents new opportunities for peacebuilding. Many peacebuilders have indeed successfully used social media to coordinate demonstrations against oppressive governments. Other peacebuilders have developed software applications to expose corruption and hold governments more accountable. And blockchain technology offers new opportunities to instill greater transparency in the delivery of essential public services or humanitarian assistance to populations in crisis. Yet, at the same time, technological platforms are also being used to promote violent extremism, to spread misinformation, and to undermine electoral processes, often significantly destabilizing fragile or conflict-affected societies. In addition, several powerful countries are integrating particularly invasive technologies such as facial recognition to manage security risks at home and are exporting and promoting these new models of intrusive governance. These models are increasingly at odds with human rights standards. And many illegal trafficking networks, often deeply embedded in local conflicts, have been strengthened also by technology. Therefore, peacebuilding organizations like ours, like the United States Institute of Peace, have a significant interest in understanding the various ways and technology impacts violent conflict. That's why we're particularly excited to be working with the ABA Rowley today. We're happy to be partnering on this important effort with them. The law, domestic and international law alike, is an essential tool to help preserve the opportunities offered by technology. And the law is also an essential tool to protect societies from these risks. Today you'll hear from many experts from governments, from the private sector, from civil society, who are expert on these virtual threats. They'll discuss with you issues like protecting data security, preserving online freedom, countering hate speech on social media, deploying technology to combat human trafficking, and most generally to set more effective legal norms for cyberspace. So with all these experts in-house, including all of you in the audience, I invite you to make new networks in our struggle against these virtual threats. Through these connections, we'll advance our combined efforts. And I offer to you the strong partnership between the United States Institute of Peace and the American Bar Association's Rule of Law Initiative. It's a good example of partnership in this common endeavor. So now I'd like to welcome to the podium Mr. Alberto Mora. He is ABA Rowley's executive director. He's one of our community's great champions for human rights and the rule of law. Welcome, Alberto. Thank you for your leadership. Good morning, all, and thank you, David, for the introduction. And thank you for partnering with the American Bar Association Rule of Law Initiative in sponsoring today's conference. I'm particularly pleased to be here in the Frank Carlucci Auditorium, by the way, since when I graduated from college 45 years ago, Frank was my first boss at the U.S. Embassy in Portugal and remains actually very much one of my mentors over the decades. And not to get on a somber note, but to touch on a somber note, those of us in the American Bar Association family learned of the death of Sandy Dallenbert, who was also a mentor to many of us, an example and a great leader and a giant in American law and in the American Bar Association. So it's a somber note, but Sandy would be delighted that we're holding this conference today on this particular topic and continuing the work that he led over so many years. I'm delighted to open this conference on behalf of the American Bar Association and my role as Executive Director for Global Programs and Director of the Rule of Law Initiative. Since its inception in 1878, the American Bar Association has been partnering with governments and non-governmental organizations, not only to support the development of the American legal community, but also to advance human dignity through the promotion of the rule of law. This conference is the latest manifestation of the ABA's history of convening some of the finest thinkers to tackle some of the most complex and vexing problems we face in the United States and around the world. And the problems we are discussing in this conference are indeed in that category. Every day, we're reminded of the pervasive threats in cyberspace and how bad actors online have an impact IRL. As the young people in our office say, which of course, as I just learned a couple of days ago, stands for in real life, or so they say. So I'd like to welcome everybody to this year's American Bar Association's Rule of Law annual conference on contemporary rule of law issues entitled hashtag cyberspaceRL rule of law approaches to virtual threats. This is our third annual issues conference, a time each year which we take a step back from the day-to-day implementation of rule of law development program in more than 50 countries to reflect on that work, to learn on what we're learning, and to convene experts from whom we can learn and together strengthen the rule of law and governance communities. We're delighted that you're here to help us in this work, and let me say a few words of acknowledgement to the many people who have helped make this conference possible. First, to set the stage for this work, we commissioned a paper on the topic in ABA Roli's paper series, and I want to commend co-authors Mary Greer of the ABA Roli Research Evaluation and Learning Division, and Tara Moborowski of ABA Roli. They've done a masterful job of condensing a survey of series of difficult, interrelated issues. And second, I'd like to recognize Dr. Linda Beshai, ABA's Director of Research, who has led this effort from the beginning and will be working to see that we're learning from this conference and that learning is captured and incorporated in our future work. With the help of Raptors Notes and under Linda's direction, we will compress the learning from today into a conference report and recommendations will be posted to our website along with a video of each of today's panels. Linda, if you would please stand up with members of our Artreach and Conference Working Group and stand. These are the folks who have made this conference possible. I'd also like to recognize the ABA Roli Board of Directors, led by our Chair, Judge Margaret McEwen, and its Program Committee led by Judge Jamie Baker. Their insights, advice, and comments were invaluable in helping this initiative and we're honored that so many of them could be with us today. We also have the privilege of having with us the President of the American Bar Association, Bob Carlson, and I think Judy Paris Martinez, the President-Elect, is also in the audience who will be coming shortly. Their presence is evidence of the importance that the ABA places on this topic and our work to contribute to the rule of law approach to this debate. Let me also say a big thanks to the dozens of ABA Roli volunteers, staff interns who also participated in making this conference possible. Finally, let me thank the ABA cosponsors and their members, ABA Standing Committee on the Law and National Security, and the A Criminal Justice section. And with that, let me invite the Chair of the Roli Board, Ninth Circuit Judge Margaret McEwen, to the podium to say a few words and introduce our keynote speaker. Thank you also very much. Good morning and thank you, Alberto. On behalf of the ABA Rule of Law Board of Directors, I also thank all of you for coming to join in this conversation today. One of the strengths of the ABA over the years has been convening different stakeholders, and that's what we've done today. We have here, if you look around and meet your neighbors, everyone from international organizations and law enforcement. We have lawyers and non-lawyers, private sector, donors, implementers, academics, and practitioners. So our goal today is to take a look at these complex issues, but to do it through a rule of law lens. So here's the question that we will pose today and that our speakers will in various ways be addressing. That is, what do rule of law frameworks and interventions offer us in terms of grappling with some of these cyber complexities? You all know that in general, virtual threats are often dealt with in the framework of security. What we want to look at today is ways in which rule of law approaches are really at the center of dealing with these issues, whether it's in terms of strengthened frameworks for either defining crimes or harnessing global cooperation, or in terms of an architecture of how rule of law intersects with these cyber issues, looking at ways to have protection of both civil and political rights, freedom on the internet. So we think the rule of law community has a very different and very positive perspective to offer on this. Obviously today these issues of cyber are front and center, but I'd like to put them in context in terms of a temporal scope. In the early 1990s, with the fall of the Soviet Union, the ABA rule of law initiative was born, first in Eastern Europe, and then we spread to all of the continents. So that's the early 1990s. Recall that the internet was not in common currency until probably the mid 1990s. And the first time our U.S. Supreme Court dealt with the internet was not until 1997 in the case of ACLU v Reno related to the online protection of children on the internet. That was 1977, and of course since then the floodgates have just opened and we've gone from there. So I think we have a lot to learn from each other today, and I thank you in advance for this important conversation. Very fortunate for us, we're extremely pleased to welcome a prominent voice in this arena to be our keynote and kickoff speaker. That's Sujit Raman. He is currently the Associate Deputy Attorney General in the U.S. Department of Justice. Here he is advising not only the Attorney General, but many others in their oversight of our country's cyber-related criminal and national security issues. He's also before that was a line prosecutor, so he's seen it from the bottom all the way to the top in terms of his job. And he also represents the Department on Cyber Matters both before the National Security Council at the White House and other agencies in the U.S. government. So he has a very unique perspective to offer us, and I now thank you for coming and ask Sujit to please join us and welcome him. Thank you. Good morning. Truly is a privilege for me to be here this morning, and I am honored to follow to the podium three prominent defenders of the rule of law, both at home and abroad. Thank you, Judge McEwen, for those kind words of introduction. Thank you, Mr. Mora and Dr. Young, for your comments as well, and for dedicating your lives to upholding and promoting the ideal of the rule of law. Our theme today is the rule of law in cyberspace. No topic could be more timely, and no domain poses a greater threat to America's public safety and national security. As the Director of National Intelligence observed earlier this year, our adversaries and strategic competitors will increasingly use cyber capabilities, including cyber espionage, attack, and influence to seek political, economic, and military advantage over the United States and its allies and partners. The threat isn't limited to state actors. FBI Director Chris Wray informed Congress last fall that we also face sophisticated cyber threats from hackers for hire, organized crime syndicates, and terrorists. Not only do these threat actors constantly seek to access and steal our nation's classified information, trade secrets, and technology, they also seek to strike our critical infrastructure and to harm our economy. Reading quotes like this, you might think cyberspace is the 21st century equivalent of the 19th century Wild West. It's true that actors in ungoverned physical spaces aim to spread instability around the globe, including through cyber means. But much of the world's cyber instability today is caused by actors who live in tightly governed spaces, authoritarian nations like China, Russia, Iran, and North Korea. These nations actively work to destabilize the U.S.-led international order, thereby promoting and advancing their own geopolitical interests. I'd like to use my time with you this morning to discuss three interrelated ideas. The first is that we have moved into a new era of great power competition. In its early years, the Internet's openness seemed to represent an unvarnished good that would promote free thinking and human rights around the world, defeat authoritarianism, and drive the growth of new markets. Today, that vision unfortunately has darkened. Our adversaries have used the Internet to exercise control over their own populations, and they've leveraged cyberspaces open and unregulated character to threaten our economic and national security, narrow our nation's strategic advantage, and attempt to undermine our values. The second idea relates to the importance of law in the new age of great power competition. International law, that is, the law governing the relationships between sovereign states, applies in cyberspace and could serve as a stabilizing force in this new era. But international law in this context is still in its infancy, and many of the details remain to be worked out. The reality is that states often tend to follow their own rules, especially in the gray zone between peace and war, where so much of today's great power competition is taking place. For that reason, I will emphasize U.S. domestic law and the important role that the U.S. Department of Justice in particular plays in defending the rule of law in cyberspace and in promoting global cyber norms. Finally, I'll briefly address a characteristic aspect of the new era in great power competition. That is, foreign adversaries' weaponization of information in their attempts to sow discord in our society, undermine our democratic values, and disrupt the rule of law within our own borders. I'll explain how our domestic legal traditions empower us in this brave new era. And I'll leave you with this thought. Under the Constitution, we are not powerless to confront and to counter other nations' covert, deceptive misuse of cyberspace in their efforts to turn our free speech ideals against us. Now, cyberspace was once seen as a medium for accelerating the spread of liberal values. As Ira Magaziner, President Clinton's internet czar, observed in 1999, the internet is a force for the promotion of democracy because dictatorship depends upon the control of the flow of information. The internet makes this control much more difficult in the short run, he wrote, and impossible in the long run. In addition, Magaziner stated, the internet will promote better understanding among nations and will be a tremendous force for improving education. Many thoughtful people shared those views, which in one form or another animated the internet governance policies of the Clinton, Bush, and Obama administrations. Sure, technology firms experienced tremendous growth in those years, and the networked, interconnected world did draw closer together, creating obvious benefits. But since then, we've learned that many of the policy choices made in the internet's infancy sowed the seeds of that early vision's destruction. To understand why, it's useful to consider the internet's structure. The way our defense strategists sometimes conceive of it, cyberspace is composed of three interdependent layers, physical, logical, and persona. Hardware and tangible infrastructure comprise the physical layer. The human beings who develop a digital representation of themselves, such as an email address or a social media profile, to participate in interconnected activity comprise the persona layer. Digital is the logical layer. In essence, the internet's nervous system. Colloquially, we think of this layer as code. This is where data exists. It's also what links network nodes together as packets of information travel around the world. To promote rapid growth and universal connectivity, those who shaped the internet prioritized the logical layer's openness, speed, and mutability. They did not prioritize its security. Many internet protocols simply assumed that every other computer on the network could be trusted. Thus, for all of its benefits, this open structure also came with a cost. It wasn't long before our adversaries began using this aspect of the internet's openness against us. At the same time, the internet has never been truly borderless in the sense of being completely undifferentiated. As Jack Goldsmith observes, the very notion of an internet implies fragmentation. As data packets move from one connected network to another, they can be filtered and routed based on various attributes, including the source of the data and its destination. Authoritarian nations have used filtering to control the content of the data that enters and exits their borders and to monitor and censor what moves around within them. China's Great Firewall is probably the most notorious example. Russia's reported plans to unplug from the global internet fall into the same category, as do that nation's repeated calls in international fora for greater information security. The growth of the internet actually fortified illiberal regimes hold over their citizens and empowered those governments in new and alarming ways. Taken together, these trends have fundamentally pre-oriented international relations. Over the past few years, our competitors have used cyberspace to consolidate authority at home while accessing our information and intruding into our affairs in ways they could never do in a purely physical world. All the while, they have carefully sought to operate below the threshold of the use of force, so as not to trigger an armed U.S. response. Nevertheless, their tactics have increasingly become assertive. As General Paul Nakasone, the commander of U.S. Cyber Command, observes, 10 years ago, cyber threats were primarily about other nations engaging in espionage by coming into our networks and stealing information. That activity was serious enough. The situation turned for the worse, starting in 2013, when our adversaries began disrupting a series of networks within the United States, often targeting and victimizing private parties. From the denial of service attacks that Iran launched against our financial sector to the destructive attack against an American casino, from North Korea's targeted attack on Sony Pictures to its reckless propagation worldwide of the WannaPri ransomware, from Russia's spread of the destructive not-petia malware to the information operations it has launched against its adversaries around the world, and from China's mass theft of U.S. government personnel data to that nation's sustained campaign of intellectual property theft. Our adversaries, in General Nakasone's words, have mounted continuous, nonviolent cyber operations that produce cumulative, strategic impacts by eroding U.S. military, economic, and political power without reaching a threshold that triggers an armed response. This, in a nutshell, is what we mean when we say that great power competition has revived and that its locus has shifted to cyberspace. Both the latest national security strategy and the national cyber strategy identify a number of priority actions to ensure that America remains safe in this new era. Law enforcement plays an important role in our shared, all-of-government effort. At the U.S. Department of Justice, our primary missions include forcing federal criminal law and protecting national security, combating cyber crime and cyber-enabled threats to our nation rate among our highest priorities. For many years, we've targeted and successfully disrupted transnational criminal syndicates engaged in cyber crime, as well as the digital infrastructure those actors employ. More recently, we began publicly charging foreign state actors whose malicious cyber activity broke U.S. law. It's fair to ask why we devote significant resources to prosecuting state actors whom we may never bring to the United States to face justice. And it's equally fair to ask why we shifted from an approach that relied mainly on intelligence collection and diplomacy to one that includes a law enforcement response. As I will explain, the contributions of state-sponsored malicious cyber activity serve an important purpose. Even if we can't guarantee that we'll be able to produce in court every individual involved. Since the indictment of Chinese PLA officers in 2014, the Department of Justice has remained focused on state-sponsored criminal activity that targets U.S. companies. We are also now focused on activity that targets the U.S. criminal process. In the past two years, the Department brought more national security cyber cases against criminals acting on behalf of our major adversaries than in the previous five years. There are several reasons for the increasing prosecutions. The main one is that we are following the threat, just as we did in responding to the threat of terrorism. As I have explained, nation states are engaged in activity and companies in the United States violates U.S. law and departs from international norms of responsible state behavior. Norms that benefit all nations. Our criminal cases reflect our adversaries' efforts to harm our companies and our nation. Second, the increasing number of national security cyber cases reinforces the lesson that our adversaries' conduct lies outside the norms of responsible behavior. The actions we highlight in indictments are not legitimate statecraft. They are crimes without justification in international relations. I'll say more about that in a moment. Third, our cases reflect our increasingly sophisticated ability to attribute this criminal conduct to the individuals and states involved. This ability is closely related to my second point because it shows the commitment of our law enforcement and intelligence agencies to work closely together while protecting intelligence sources and methods. These partnerships, which were forged in the counter-terrorism context, serve to solidify the consensus that a law enforcement response to malign nation-state cyber activity makes sense. In bringing these cases, these basic principles. First, the department has a duty to enforce our laws and protect our people. We cannot refuse to act when foreign state actors violate our criminal laws, transgress, establish norms, and victimize our citizens. That is especially true when such crimes often represent severe violations of the victim's privacy rights and can have lasting, damaging consequences. The department has an obligation to work toward a future where our citizens can live and conduct their business with confidence in the integrity of their information and institutions. Second, attribution is the key to deterrence. Without attribution, there will be no consequences and thus no deterrence. Attribution through the criminal justice system escalates the stakes that a police or a public statement alone would not. We have on occasion obtained custody of foreign criminal defendants. Our indictments limit their travel and the prospect of criminal indictment can help deter some cyber actors from engaging in such conduct in the first place. This can make it more difficult for states to recruit the manpower and resources for cyber attacks and raise the cost of engaging in a malicious cyber activity. Third, attribution through the criminal justice system is a powerful way to expose state conduct that violates norms of responsible behavior. It complicates our adversaries' attempts to feign ignorance of illegal acts they thought could be taken in secret or to hide behind public denials. Our cases are governed by well-known policies relating to the conduct of all federal prosecutors. An indictment is brought by a grand jury under established procedures. Chargers are brought only when the facts and law justify it. The allegations in our indictments are thorough and detailed and we can prove them in a courtroom using admissible evidence at proof beyond a reasonable doubt. For all these reasons, criminal indictments are among the most powerful statements we can make as a government. Fourth, unsealed indictments promote transparency. There will always be cases in which our ability to expose malicious cyber activity is limited by our obligation to protect intelligence sources and methods for sensitive ongoing investigations. But where we are able to do so, we strive to expose such schemes to the American people and to the international community. Attribution through detailed indictments educates the public about our adversaries efforts and methods to spread disinformation, steal commercial technology and target computer networks. Fifth, although our goal is to hold accountable in court those we charge with trade theft or cyber crimes, our investigations can provide critical support for the use of civil, diplomatic, economic and military tools. Some thoughtful critics have criticized the department's so-called name and shame strategy on the theory that our indictments have failed to staunch the activity. But you can't separate our indictments from the broader array of tools our government now uses to counter malign cyber activity. These include freezing assets or prohibiting transactions or adding companies to the Department of Commerce entity list. As the National Security Advisor has confirmed, it also includes undertaking offensive cyber operations aimed at defending our national interests. Our tools also include other authorities that can block criminals' assets, restrict their access to the banking system and prohibit them from freely engaging in trade. We developed this approach to address terrorism and terrorist financing. We are applying it to the cyber context as well. Finally, by using public law to emphasize the need to protect private U.S. companies and victims against nation-state actors, we help develop the framework for public-private cooperation that is critical to cyber security. The department tries to show through our actions how we can help companies respond to nation-state threats they cannot face alone in a way that respects their status as victims. The department has developed strong relationships with the private sector based on our aggressive pursuit of criminal nation-state conduct ranging from cyber theft to information operations using third-party social media platforms. Now, no one suggests seriously that we can prosecute our way out of this problem but to dismiss the role that federal law enforcement plays in the government's shared fight against cyber-enabled threats is to unfairly discount and diminish our nation's powerful commitment to the rule of law both within our borders and without. Before I conclude, I'd like to briefly address one final topic. That is the question of how we can respond to one of the latest and most potentially destabilizing manifestations of great power competition in cyberspace. Namely, our adversaries use of covert information operations to influence and subvert our nation's democratic institutions, including specifically our elections. The Department of Justice has been instrumental in revealing that foreign actors create and operate false U.S. personas on internet sites designed to attract U.S. citizens to spread divisive messages. They also fabricate news stories in an effort to discredit American individuals or organizations. In the process, they reach unprecedented numbers of Americans covertly without ever setting foot on U.S. soil. These deceitful actions are especially pernicious because they seek to weaponize our traditions of free speech, open inquiry and individual conscience against us as part of a broader project to undermine the very concept of self-government. Foreign attempts to pollute our public discourse are nothing new. These efforts have taken many forms across the decades from covert funding of newspapers and covert financing of front groups to creating and spreading fake internal government communications. Our traditional response has been one to require transparency. The Foreign Agents Registration Act for FARA, for example, requires persons who engage in certain conduct as agents of foreign principles to register with the Justice Department, to file periodic reports thereafter and to include a conspicuous statement disclosing that relationship on any materials disseminated by the agent on behalf of the foreign principal. FARA's purpose is to ensure that the American public and our lawmakers know the source of information that is provided at the behest of a foreign principal where that information may be intended to influence U.S. public opinion, policy and laws. The statute enhances the public's and the government's ability to evaluate such information. Our recent indictments exposing Russian malign influence activity fall within the same heritage. Uncovering and disclosing such malign activity after it has happened is not a panacea, however, especially where public disclosure of a foreign influence operation could amplify it or could create undue public harm or confusion or could compromise intelligence sources and methods. That raises obvious questions. In defending our elections, are we limited to enforcing federal disclosure laws and other federal criminal laws that address foreign interference in our elections? And are we limited to uncovering and disclosing such conduct only after it occurs? Or can we take affirmative action to prevent covert cyber-enabled foreign influence campaigns that are designed to attack and undermine our elections through the weaponization of speech? I think the answer to that last question is yes. If non-US persons outside the United States are covertly interfering in our elections, whether through malicious cyber-activity or covert operations using social media, the government can act to prevent that conduct consistent with the First Amendment. The fact is, it has been settled law for over a century that non-US persons located outside the United States have no rights under the First Amendment. Foreign governments similarly lack First Amendment protection. The more difficult question is whether hypothetical US government efforts outside of our borders to block or target such activity would impact the First Amendment rights of US persons who are potential consumers of the covert foreign dissemination. Or for that matter, the free speech rights of US persons whose own online speech may be amplified by covert foreign activity, as where covert foreign controlled accounts disseminate the content using bots. In a line of cases stretching back several decades, the Supreme Court has indicated that the First Amendment encompasses a right to receive information. That is, a right of a would-be recipient of information that is independent of any right possessed by the speaker. Hypothetical activity by the US government to prevent foreign dissemination of information to the American public could, therefore, implicate the First Amendment rights of US citizens and residents to receive information. In my view, however, such hypothetical activity would likely not violate the First Amendment where it targets messaging covertly disseminated by a foreign government and or its agents seeking to interfere with the US election and where our government's actions are based exclusively on the foreign source of the information. That is because the Supreme Court precedent suggesting that Americans might have a right to receive foreign political propaganda and circumscribing the government's ability to limit the stock of information from which members of the public may draw decisions presuppose that the recipient can weigh the information he receives in light of the source of that information so as to evaluate the import of the propaganda. The calculus is very different where the foreign actors have deceitfully misattributed information in a manner designed to mislead rather than to inform. The First Amendment does not provide a right to receive covert foreign propaganda. Otherwise, disclosure statutes like FERA would be unconstitutional. Hypothetical US government activity would likely be consistent with the First Amendment even where it involved action to prevent foreign governments and their agents from covertly amplifying the online speech of Americans. The speech of Americans is of course fully protected by the First Amendment. The government thus could not remove or repeat the online communications of a US person. But such a person has no constitutional right to amplification by a foreign government which itself, of course, is without constitutional rights. The Department of Justice has previously expressed the view that a US person has no First Amendment right to speak on behalf of a foreign nation. On the theory that the US person speech in that context isn't his speech at all that of his foreign master's unprotected voice. In much the same way, a US person's ability to speak is not impaired by the denial of amplification from a foreign nation that lacks First Amendment rights. At least where the amplification conceals the role of the foreign nation. I should emphasize that my thinking here is tentative and the context is hypothetical. Moreover, my thinking assumes two important factors. Namely first, hypothetical US government activity would target covert acts by a foreign government and or its agents. And second, our activity would focus on protecting the integrity of the US electoral system. Though the analysis for covert foreign speech relating to political issues generally may well follow a similar track. Under these circumstances US government activity to regulate harm from foreign misinformation would be on the most solid ground. So let me close by emphasizing that how we respond to the challenges posed by this new era of great power competition in cyberspace will have far reaching consequences. As our adversaries use fraud, theft and deception to project their power and undermine internationally supported norms, I'm reminded of the words of US Supreme Court Justice Robert Jackson. Writing in the wake of the Second World War when the global community faced a different set of emerging challenges Justice Jackson noted that quote, we are put under a heavy responsibility to see that our behavior during this unsettled period will direct the world's thought toward a firmer enforcement of the laws. I can think of no more poetic a description of our duty today. We too face an uncertain future and we too must act in accordance with law ensuring that everything we do in these unsettled times directs the world's thoughts toward a firmer enforcement of the laws. Thank you to every single one of you for everything you do to aid in that noble effort. Thank you very much. Thank you Mr. Rahman that was a terrific, terrific beginning. He has so nicely framed how the internet challenges our traditional notions of jurisdiction international relations security intellectual property privacy, speech and the elections. You know it was once said that cyberspace is not a place and the word cyberspace actually comes to us from science fiction but I think as Mr. Rahman has so ably demonstrated that it is no longer science fiction but it is a reality or as Alberto said in real life. So we now move to the second phase of our program sessions. One on the legal frameworks both international and regional in terms of cyber crime and internet regulation and a second referenced by Mr. Rahman on election security. So these rooms are listed in your program but they're both across the atrium from where you had your coffee this morning and you have a chance to choose between either of these and we'll have more sessions as we go through the day and again you can choose or you can wander in and between the breakout sessions whatever your attention span may be. So again please join me in thanking Mr. Rahman for kicking off the conference. We have a lot of ABA and USIP staff here to help you and direct you enjoy the day. Any of these gatherings. Good morning everybody ABA and to USIP for organizing this panel and for having me participate as moderator. We have a very distinguished group here this morning to discuss international legal frameworks and capacity building related to cyber crime. Before I begin I wanted to introduce myself and give a very brief context and then we'll turn to our panelists. I work in the State Department's Bureau of International Narcotics and Law Affairs where I'm the acting director of the Office of Global Crime Issues. For those of you who haven't heard of INL we help our foreign partners tackle the most pressing international crime issues, illegal drugs law enforcement that impact the United States and its interests. We have capacity building programs in about 90 countries around the world and our partners to implement those programs include US criminal justice agencies like the US Department of Justice international organization contractors non-governmental organizations the American Bar Association among them and with our help the idea is that countries are better able to confront to address crime and to work with us to address crime before it impacts our citizens. Our classic mission international narcotics and law enforcement our classic mission has been counter narcotics and that still is a critical area of work for us especially in light of the opioid crisis.  While strong national laws and capacity are important to combat this threat of course cyber crime is the quintessential transnational crime and we need international cooperation to effectively combat it. International legal cooperation such as mutual legal assistance is necessary to pursue cases when the impact and the evidence may lie across borders and while every country's law doesn't have to look exactly the same as every other country's some commonality some interoperability helps with cooperation by the same token bringing countries if not to the same level of capacity but trying to bring countries to a similar level of capacity fosters cooperation and makes it more feasible. Now the tools that are out there some of which we'll discuss today range from bilateral agreements like mutual legal assistance treaties informal networks to foster law enforcement to law enforcement cooperation the G7 24-7 network of high tech crime points of contact is one example multilateral instruments we'll talk about the Budapest Convention even the UN Convention on transnational organized crime or UN talk. For the U.S. our cyber crime policy in our programs because we do a lot of capacity building we support a lot of technical assistance globally in this issue as with other issues is to promote accession to the Budapest Convention. At the technical level it outlines and we'll hear more from Rudy and others as he explains the essential elements of a strong domestic counter-cyber crime regime and at the policy level it reflects the values of liberal democracies in terms of promoting free speech a multi-stakeholder approach to to cyberspace and respect for human rights. In contrast and this will be part of our discussion this morning some countries have began advancing alternative or contrasting approaches that stress a more top-down authoritarian approach that may threaten free speech human rights and insert greater state control I would say into cyberspace and the response on specific issues like cyber crime. So we'll talk about what is out there what opportunities are presented by the existing international legal framework what the challenges are and alternative views we'll also talk about partnerships including capacity building partnerships and the important role that they play. Now I'm not going to try and what I hope to do is we'll have relatively brief presentations from each of our panelists and then we'll open it up for comments and questions from the whole room and when I say comments I envision this as participatory and that the only expertise certainly doesn't on this issue certainly doesn't lie here at the front of the room. I will ask that when we have questions or comments just that you introduce yourself say give your name and your affiliation. I'm not going to do lengthy introductions to the panelists because each is sufficiently distinguished that we would use up the next half hour if I went into the full depth of their bios. Take your time, please. Sure. Rudy is not shy. In the order that we'll go though Rudy or Hollis is both a consultant for the Council of Europe and the chairperson of the group of experts on cyber crime for the organization of American States. He was a DOJ senior trial attorney at the computer crime and intellectual property section where he prosecuted many, many, many major cases. He was a legal attaché at the U.S. Embassy in Argentina and an AUSA in San Francisco. Ken Kern all the way to my right is the chief information officer and the special assistant for international relations at the New York County District attorney's office. He was the deputy chief for cyber crime and identity theft there where again he prosecuted a wide variety of high level and high impact cases in identity theft, financial and cyber frauds. He was a prosecutor with the ICTY, the International Criminal Tribunal for Yugoslavia and participated in the Milosevic trial which brings us to Mary Greer who also worked with the ICTY. Mary Greer is the senior technical advisor in criminal law at ABA Roli. Her work with the rule of law initiative then CLE dates back to 1998 when she was a liaison in Bosnia. She designs and implements programs in global criminal justice issues like cyber crime but also sexual and gender-based violence and financial organized crime. So we have a wealth of perspectives. I am now going to silence myself turn to Rudy and then we'll go to Ken and then to Mary. Thank you. I was recently in New York City passed away and I had the responsibility of going through her things to basically close out her state. Do I need the microphone? Yes. And in going through her things it was like going through a museum. One of the things that I found was this. A transistor radio which were developed in 1955 it revolutionized electronic communications like nothing ever before. It sold over a billion. It facilitated people being able to go out and listen to music and the news and it contained four transistors. Today's communications are through devices like this which contain over four billion transistors. Now the problem is that many countries are operating with laws that they enacted and have not changed since 1955. And as you can imagine these laws in these countries are not equipped to deal with the digital world and the realities of the digital world. As an example on May 5th in the year 2000 the I Love You virus was released. It infected over 55 million computers resulting in over $10 billion in losses. The Pentagon had to shut down its servers. The person was identified as Odell Del Guzman who is from the Philippines. Although he was identified he was never prosecuted. He was never imprisoned because at that time the Philippines did not recognize the realities of the digital world. Yes they had laws that dealt with destruction of property but they only dealt with tangible properties, not with property of ones and zeros. And so it wasn't recognized as a crime and extraditions for Mr. De Guzman's arrest and extraditions were obviously denied. At the same time a number of countries in Europe including the United States and Canada foresaw these new challenges that we were all starting to see and they negotiated the terms of an international treaty which is the Budapest Convention. They recognized that cyber crime is an international problem that no country can deal with it by itself. It requires cooperation among various countries. So after a decade a decade of negotiations the Budapest Convention was open for signature on November 23rd 2001 and the treaty was open for signatures. The treaty is basically broken down into three components. Part one deals with four basic definitions. What is a computer system? What is computer data? Who is a service provider? And what is traffic data? Articles 2-13 deal with substantive laws and it basically says no matter what your legal system is we have to agree that certain things are going to be criminalized. For example illegal access to a computer illegal interception computer related forgery computer related fraud child pornography intellectual property corporate liability and the third component has to do with procedural laws and these are basically it says again hey no matter what your legal system is you have to have certain things in place in order to deal with the realities of the digital world. We're operating under the common law system under the Napoleonic system and in some countries it's the judges for example who do investigations and it says no matter what your legal system is we need to do things like have some way to expeditiously preserve data because we recognize that data can disappear by touching a button and we don't have the time to get judges sometimes to sign orders and we need to be able to act quickly so it encourages countries to be able to have a mechanism to preserve data without the need of a court order it also calls for certain safeguards it says yes we have to act quickly but we also have to take into consideration privacy there has to be a balance between privacy of our citizens and the needs of security when you walked into this building you gave some of your privacy when you went through that metal detector when you go to an airport they search your luggage you're giving up a lot of privacy but again balanced against the needs and the realities of security it must be done but the buddha best convention specifically article 15 says countries one over the other you have to have a reasonable balance so as a result the buddha best convention is now has been signed by over 66 countries it is it deals with criminal behavior but also it has been used as a mechanism to save lives how is that through the signatories kidnapped victims have been identified a few years ago I don't know if any of you have heard of something called the blue whale the blue whale is a phenomena where disenfranchised adolescents find each other they encourage each other to mutilate themselves and sometimes even commit suicide I think there have been over 200 kids who have committed suicide until Argentina found that someone in their country was trying to get a group together to do exactly this and they contacted the department of justice because they are also a signatory to the buddha best convention and they asked us to intervene on behalf of them with facebook hoping to identify who these kids were because of the buddha best convention and the various treaties we were able to identify the source and save six lives all of them found in Argentina the treaty is dealing with the new cyber issues as well for example in the year 2016 it published its conclusions and recommendations involving trans-border access to electronic evidence in the cloud and this was the basic issue in the supreme court case last year which was the case of the buddha best versus microsoft and that case as you may know it involved the question is an order issued by a u.s. court enforceable when the u.s. provider has transferred those records outside of the united states that was an issue that a cloud committee has never resolved by the court because last year the united states enacted its cloud act which basically allows these court orders to be respected both when issued by a u.s. court and in some cases by courts outside of the united states but the point is that many of the findings and conclusions made by buddha best have been incorporated into this new act as you can see I'm high tech today so capacity building is also an important component of the buddha best convention we try to do training on a regional basis and we work with other international organizations in this hemisphere we've worked with the organization of american states with the department of justice and with the state department we've trained over 2,000 legislators judges prosecutors investigators and it has been training that has been given a careful thought instead of just organizing training that come if you want we have been very careful in deciding where to hold this training we try to select countries that have shown a true interest and a commitment to this issue not just always going to Buenos Aires but it's going to be a fabulous for steak and wine but countries like Ecuador or Paraguay if I'm not recommending anyone go to Paraguay it's one of the most boring countries but they have shown a commitment to cybercrime and they were worthy of hosting one of these regional trainings the participants are carefully selected we try to identify people who really need this training judges for example come in contact with electronic evidence but don't feel comfortable determining the admissibility of electronic records we try not to select the same attendees I've gone to train in a number of these various conferences and it always seems that it's the same people attending to hear presentations by the same people so it's like a family gathering and that's something that we've been very aware of and we've tried to avoid the trainers are very carefully selected we want trainers who understand the cultural subtleties that are involved who go down to a foreign country and don't start talking about the red socks versus the white socks because people scratch their heads and say socks what does that have to do with anything we want trainers who speak the language a lot is lost through translation especially when we talk about technical issues technical issues we include forensic experts for example in finishing I want to recognize both the department of state particularly INL who without their grants none of this would have been possible none of this they are the most significant contributor to the Budapest and Council of Europe I want to also recognize the Department of Justice who have provided particularly the computer crime and intellectual property section who have provided the needed leadership to not only negotiate the terms of the Budapest Convention but they've also been a source of very qualified instructors and combined with these we've had the type of success and hopefully we'll continue to receive those funds because funds are being tighter and tighter to receive we recognize that but I also want to be on record to thank INL thank you thank you Rudy I think you raise interesting points that we'll explore further about considerations that inform effective capacity building in general in this area in particular and the tie between capacity building initiatives like accession to the Budapest Convention but the organizers did ask me to make clear that Rudy's views on Paraguay are not necessarily shared by the ABA, USIP or the US State Department diplomacy has never been my strong point never having been there I'm sure it's a very interesting country we'll turn over to Ken now good morning everyone on behalf of District Attorney Cyrus R. Vance Jr the New York County District Attorney I just want to thank ABA and USIP for the opportunity to speak with you today and good morning to everyone a little bit about our office we are at its heart a local prosecutor's office oh it's not okay thank you so on behalf of District Attorney Cyrus R. Vance thank you so much for the opportunity to speak with you this morning we are at our heart a local prosecutor's office we handle approximately 60,000 to 100,000 cases a year based on volume of criminal activity and what that really places is that we become an emergency room of society what happens on the streets of Manhattan come into our doors we have to study it analyze it for our work in investigating exonerating and prosecuting at the same time because of our physical location in Manhattan we are also an international office our jurisdiction because of Wall Street and because of some technological jurisdiction issues gives rise to an opportunity for us to view the lens both as a local office and so we as in trying to address the scourge of cyber crime we see it affecting not only our local institutions and our residents but our international partners and international citizens so we've had to think differently and act differently because of that we've invested in personnel we've invested in making sure that we have process all the things that were coming in the door the same thing that if you were focused on DNA in a medical case you need to have the tools and equipment to focus and drive these cases and to educate your staff to be able to have conversations with judges about why these cases matter the other thing we've had to do is really change the way that we place personnel so we have succumbents as a local prosecutor's office in the city of London Paris, Singapore and in Israel because of the threats that we those are central cities for us in trying to combat cyber crime and financial crime the district attorney's general operating principle has always been it is better to prevent a crime than try to address it from a defense of posture so we've had tremendous discussion about in a few minutes about how to go ahead and try to prevent more of the cyber crime that we're seeing and not to just admire the problem or be frustrated by the problem of cyber crime which is where I think many of our citizens are throughout the world you see a hack a story comes up about 150 million people there's a wow factor and you move on in addition to making sure that we don't just admire the problem that we try to prevent it we've had to become more sophisticated international office we share some of the same principles that Rudy articulated about having staff that can speak across borders and to work with colleagues throughout the world because that is the only way you can do cyber crime and focus on it nowadays so when we talk a little bit about the threats of cyber crime what I want to just show to you are three initiatives, two very positive and one that's been troubling for us as an office you can imagine that as law enforcement officials there is a desire to not to bring people to justice who are committing these irrespective of constraints of borders so we abide by of course all the international norms and follow the policies associated with those and work with great federal partners many of whom are in the room today we have also as a local actor been constrained by some of the time sensitive issues related to prosecuting these cases and agility across networks and borders and many of us at the state and local prosecutor side which handles approximately 95% of the cases in the United States alone did not have the ability to react in real time so you're constantly playing defense and you're constantly slow footed in order to change that the hope that the district said is let me try to invest in initiatives that focus on both prevention and an international framework so I'm going to focus on two of them and I have a deck and I'm set to go if you are sir thank you it's not moving ahead cyber criminal but I'm not going to waste time but as you're getting it I'll talk a little bit about it the district attorney called the global cyber alliance created this initiative a non-profit because in terms of playing whack-a-mole with criminal cases we can't prosecute our way through this problem the only logical solution is to try to have continue our enforcement work but also develop skills at prevention so the district attorney with the city of London police commissioner in September of 2015 created an initiative called the global cyber alliance it's an international organization that is it's really predicated on how do we move real-time data across sectors and countries and we came into this in trying to aid the district attorney as to whether this was a worthwhile investment saying doesn't this exist already and of course there are tremendous initiatives that exist throughout the world but for our vantage point we were not necessarily privy to some of these and when we spoke to our New York partners in the cyber professionals in New York they were certainly not aware of some of the opportunities to share across borders and sectors so the global cyber alliance was created a separate non-profit from our office four years later we're very proud that there are 250 partners across 18 sectors in 28 countries the sectors represent the gamut of ones you would think of from critical infrastructure to entities that wouldn't necessarily appear as top of your mind educational organizations are schools within New York who are constantly being hit by cyber attacks with all the intellectual property that's at our academic institutions the board of directors is from around the world and from all different sectors when we first met at the Federal Reserve Bank the district attorney asked this question what is the first project we should get involved with and around the room the heads of Bloomberg City our partners in France London all without a doubt said phishing to which the district attorney said how boring a phishing this is what we should and he didn't take long to be convinced of course that as many of you know phishing is at the root of most of the problems that exist for cyber and so what the global cyber alliance did is create a series of tools free of charge that one can go to the website globalcyberalliance.org and download tools that can assist in terms of prevention of attacks on email which is DMARC Quad 9 another free tool which deals with threats against the internet and we recently released a tool for small businesses when we looked at what was happening in New York we felt that there was an economic opportunity large institutions could invest in cyber security but the heartbeat of New York is small and medium businesses and they're getting priced out of the opportunity to protect themselves and as everybody knows the large corporations have its chain is based in the small business community so the global cyber alliance is an initiative that we believe in capacity building to take all the expertise that we have with around the world and unify it and produce things that are helpful for our citizens around the world I'll spend two more minutes another global but rooted in New York is the threat to our critical infrastructure so about a year ago the district attorney said in case of a cyber attack he, New York City ready and prepared and the answer was not enough and so the district attorney along with partners with the global cyber alliance the police commissioner of NYPD and New York City cyber command created the New York City cyber critical services infrastructure with one primary mission how do we protect New York City and all the threats around the world when we know we're not doing enough to share that information in real time when an attack against con Edison our electrical provider or against wall street isn't being moved to the other sectors within New York so over time we have now brought together about 37 different organizations again focused on New York but an attempt to address an international problem the threats that we see are both local, national and international but JetBlue wasn't communicating which ASPSC or IBM or Booz Allen and certainly what we have noticed is that the biggest threat is to our hospitals and our healthcare facilities as you all know the United Kingdom went through the crisis of having its doctors and nurses unable to access medical records last May and if you think that if a judge or anybody ever thinks cyber crime is a zeros and ones as Rudy put and we both share the philosophy of course it's not it affects real lives and that's an example of a real life problem so sectors represented in New York small businesses media organizations financial State of Michigan was way ahead of us five years ago started this figuring out how do you prepare at the local level for attacks given that you've got to respond in real time and that if you are going to have a citizenry that is in panic stage unless you have the tools in place when you need to smash the emergency glass at a company to get to your operating plan in case of a cyber attack what's the plan for this city itself New York City 8.6 million visitors 1.8 in Manhattan alone 1.8 million people residing in Manhattan you are trying to stem chaos and make sure that what's behind the glass is a ready made plan for what to do and who are you talking to as part of that have started to do trainings in cyber security to protect our infrastructure and sadly we did have to go to Boston because New York doesn't have some of the things that would allow us to train together meaning state of the art facilities but Boston does an IBM so hopefully New York will catch up finally I'm not going to go into this to too much detail because of time but I do want to say that the initiatives are so promising bringing together institutions people to share and collaborate and give tools but as prosecutors one of our biggest challenges that we face as we try to balance privacy concerns with our judicial orders is the issue of encryption so I'll save that and turn it back to you thank you Ken one of the aspects that struck me from your presentation was for collaboration and the capacity for rapid response not just at the state department and this is just me but I tend to think about it as between and among countries but we have to think federal level with state and local government entities with the private sector among sectors so thank you for fleshing that out and reminding us of that the capacity building has come up in each of the interventions at this point and I think Mary will now elaborate a bit and share some of the experience and perspectives of ABA Rowley in that area thank you Rob and thank you to my panelists and greetings to everyone I wanted to make sure that I bring us back into a conversation that we started during the opening remarks where we're trying to identify what rule of law strategies can be most effective in virtual spaces and I have lots of colleagues in the room from DOJ Optad and ABA Rowley and other implementers and donor agencies so I'm excited to have further conversation after I talk a little bit more about the how and the why in terms of technical assistance and what rule of law strategies we've already designed and developed and what we can do better but you know I wanted to start with the why and I'm not sure we always do that as effectively but the why is as my colleagues have mentioned it's really about peace and security at all levels it's about the peace and security of countries financial physical security of individuals businesses communities hospitals schools and you know the how I have some general observations and then I want to talk about some specific examples I kind of have three buckets of observations some of which have already been brought up by Rob and Ken and Rudy but you know first of all and I lifted from Ken's PowerPoint the motto for the global cyber alliance our philosophy is simple do something and then measure it I think the most effective technical assistance in the rule of law realm are programs that are designed after thorough assessments and assessments that identify gaps in laws resources frameworks and that those assessments are ongoing you know there's logical gaps between the time when we at Roley might submit a proposal in one of these areas and when there's a decision on the funding and when the implementation actually starts so the assessing has to happen all along the way and the measuring you know during the course of the implementation of a program but most critically identifying what you're trying to change and did you actually accomplish that are people safer and more secure are defense lawyers incorporating into their practice are prosecutors incorporating into their day-to-day strategies around enforcement because of what information we shared and the expertise that we helped create so do something and measure it and then the second general bucket of observation is I just kind of call it breath and depth you know to me breath is logical as rule of law implementers especially as part of the American Bar Association is we're working with justice actors and in some countries we're working with a variety of justice actors and including the defense bar but as my colleagues have already mentioned you can't just deal with this through the ministries of justice and the justice actors we also want to work with the judicial training academies with the supreme judicial councils and other entities that are critical at the juncture of implementing rule of law programs and strategies inspectorates the lawmakers and the regulators and then the economic groups and consortias and as my colleagues already mentioned we have to work regionally the breadth has to be wide and strong and in terms of the depth we have to work as Rob mentioned at the local, the national and global level and we want to work with individuals and business owners and global corporations and civil society actors in order to address this the third general observation I have is we have to be strategic thinkers I'm a recovering prosecutor but at times you did not have the evidence you knew something had happened you knew who did it you didn't have the evidence so what else can you do you might file a different Rudy outline for us the variety of types of criminalized behavior has been modeled for us through the Budapest convention you know it may not be the highest level of felony that you can file or you may have to go after someone's permit or you may have to go after their bar license or something you have to try to do something to not if you're not able to do the the enforcement measure that you think is most appropriate and most deserving you may have to do something else I appreciated our keynote mentioning the diplomatic channels you know we've all worked in countries where we've worked with our colleagues from the embassy whether at INL the PolyEcon officer someone who can help us put a little diplomatic or political pressure we can make the progress and the changes that we desire the other the sanctions the asset forfeiture seizures I also my colleague Katherine is here from DOJ OPTAD you know a lot of us have worked together to try to create specialized units multi-disciplinary multi-agency task force and those those are the most appropriate ways to deal with highly specialized areas like we're finding this virtual spaces and cyber issues to be but you can't forget the conservation officer in Tanzania who's probably going to be the one who's going to identify who's trafficking I'm not going to mention flamingos but maybe rhinos or something or the street cop into Blesi you can't forget to train at all levels and at all levels of expertise that everyone needs to have the basic tools that Ken and his colleagues have been identifying and furthering and lastly you know our keynote mentioned the tightly governed spaces you have to find common ground with the actors and the countries and the governments that don't appear to be budging and as a matter of fact appear to be just tightening the news there has to be common grounds and strategies that you can find in terms of furthering the how I have three specific areas of technical assistance that I'd like to highlight from some of our work and I really am excited that we have other implementers in the room to talk about other areas but Rudy spent time helping us become more familiar with the Budapest Convention but basically tying technical assistance this is not new but it's really critical in this area to international practices and conventions and standards a couple examples of that you know a lot of us are familiar with the United States 2030 agenda for sustainable development the development goals and one is intended to harness information and communications to advance gender equality and women's empowerment by accessing the internet accessing information and increasing public participation my colleague Liz is here we had a program in Malaysia where we convened a workshop with most journalists and human rights defenders on the feminist principles of the internet sharing information about digital security and privacy rights online I've been tipped off that the world the second example I give is many of us have helped further mock trial competitions and the largest is the jessup moot court competition I've been tipped off that this year's fact pattern is going to include killer robots in the fact pattern AI okay alright and then my second area of specific types of technical assistance back to the regional work working with regional bodies on a regional basis and a couple examples of that we have programming in southern Africa where we're working with the african prosecutors association and the south africa development community and we're working on trafficking issues in that region of africa thanks to people like rob and other people at INL we have boy I think since like 1999 we've had a regional anti-corruption program starting in the Baltics Central Asia now headquartered in Thailand but through that program our regional anti-corruption advisor coordinated with the US and Vietnamese governments conference around trafficking in wildlife and illegal logging where we partnered with the Asia-Pacific economic cooperative APEC where we brought together over a hundred participants sharing information about how to most effectively combat wildlife trafficking and illegal logging and then the third program we're just kicking off I got to be in Ethiopia last month we're working with the african union where we're developing strategies to enhance the capacity of the staff of the secretariat of the african union to deal with the global breadth of the challenges in their member states my last bucket is I want to talk again about breadth and depth and I don't know if my colleague Ashley Martin is here but we had a two-year program through the good graces of the department of human rights and labor at the state department where we dealt with internet freedom issues and we furthered those efforts that have been described by my co-panelists where we we tried to work we tried to bring in the public sector to deal with public the private sector to deal with public agencies and working with civil society actors much through which we were able to sub-grant the funds that DRL gave us we worked in 18 countries 11 of which were in Europe and 7 of which were in Asia to build the capacity of lawyers and civil society actors in the areas of freedom of expression association and the flow of information a couple things that we accomplished during that two years through our partners there's an internet freedom network comprised of 10 local partners through that freedom network there were 11 country specific state of affairs reports where there was analysis about the gaps were legislatively in terms of resources and those kind of things and then products were developed including in Armenia a multimedia toolkit informing civil society actors, government representatives and internet users writ large about existing and emerging digital threats we created a lawyers network within the that regional body where the lawyers got better at assisting victims of events that occurred in the cyber realm as well as representing actors who were being prosecuted through some of the overreaches of governments in their efforts to try to restrict the space and lastly some of the countries we worked in were very sensitive countries and in one of the areas we brought together representatives from the regulatory agencies private businesses and civil society where we started a dialogue and a multi agency working group to improve the legal and policy framework around information restrictions so in conclusion why are we doing this we're doing it because it involves the safety and security of our partners in our countries the countries in which we work and on a global stage so invite all of you all to share some of your strategies and stories so thank you well thank you Mary thoughtful comments as always and I know I happen to know that you're not only a recovering prosecutor but a recovering defense lawyer as well and maybe at the end Ken would use a couple minutes of your time when he realizes he has to go back home and say that he admitted that Boston has something that New York City does not have so I have to apologize to the audience these interventions have left no nothing interesting to comment on no questions in your mind we've completely settled the issues we can take some extra time at coffee now I'll kidding aside we're going to open the floor now I don't know what the system is for sharing mics but yep we've got a floating mic so again if you just say your name and your affiliation and we invite comments I would suggest that they be relatively safe if it's a comment or questions for the panel if questions will take three at a time so we're opening it up I'm Peter Borgher I'm on the rolly board delighted to see you Mary tell us a little bit about how these various efforts that you've been talking about or what we can learn from the Budapest convention impact private actors for example to take one that's been in the news Facebook is faced with a huge volume of traffic some of which it would like to filter how does it do that appropriately and to what extent are there rule of law either models or maybe actual statutes that would inform how private actors with a big opportunity to impact ought to function thank you Katie Wong with NTD TV my question is about China because as you have said that China is not signed on this Budapest convention but it's also actually involved in this state sponsored cyber attack and also it controls the online freedom of speech and so on so it also promote this concept of cyber sovereignty so how can you deal with China on different aspects thank you for your comments the internet has evolved much over the years I work with the folks that brought you the internet originally and we've been developing new methods where the internet is no longer end to end in the moving forward that was sort of a first cut at how to do it and this gentleman talked about the Budapest and you have the computer data and how do you preserve that well I've had some conversations recently where the digital entity itself the data how do you incorporate it in a computer program because basically you're talking about zeros and ones as you mentioned and if you actually are protecting the information itself and resolving to that information itself you have a fighting chance about how to preserve and manage and at least try to hold back the tide and have the legal access to perform stated operations on those sequence of bits you actually also have a way to manage the global infrastructure and we set up a foundation in Geneva called the Dana Foundation and it's based on an old DARPA project going back 25 years we're actually it's come forward now and we're using the newer security obviously but it's based on the notion of not just end to end where you resolve to the ports machine but you're actually managing the information units itself and I'd be pleased to provide you some information about that now the Buddha's best convention 2001 is there a possibility of evolving the concepts because you're not just transferring records of preserving data data is gotten to be one of those words that what is it information so the information has to be represented in some form to manage over long periods of time the access to those units of information and that's what we spent an enormous amount of time with years on and we're most pleased to share that information with you thank you okay so our three initial questions one and I'll paraphrase is how these efforts have impacted the private sector and I'll add and how's the private sector contributed to the evolution and impact of the implementation of these efforts working in the context of countries that have very different views about the appropriate nature of the internet and role towards cyber crime and issues of the need for our legal approaches and perhaps our conventions to evolve in light of evolving technological approaches and recognition of new needs and issues of preservation of data so I'll turn it over to the panelists whoever wants to jump in first I can jump in just with some remarks on from our vantage point in terms of private sector the initiatives that we laid out and the way that we have to approach short term and long term cyber security issues goes through the heart of the private sector while the government sector of course has excellent professionals and a certain amount of bandwidth in truth the private sector has the opportunity to with 2 billion users at one company have global change in a heartbeat so for us I think the approach has been that we are constantly collaborating with the private sector constantly listening to the private sector and making sure that we are never never missing an opportunity to leverage their good will both at the state, local level and global level we're all in the same same boat trying to address these cyber security issues and so for our collaboration with Facebook we deal with it we deal with them constantly and there are several initiatives that we can talk offline about just wanted to chime in on the private sector issues one of the other rule of law strategies we have identified that important in any rule of law programming but especially in this space are public information and public education campaigns and that's especially acutely needed with the private sector and I'll address the China question how do you deal with countries that are not signatories countries that are not signatories generally fall into three categories you have less developed countries that really don't depend much on e-commerce I don't want to use Paraguay as an example but I'll talk about Paraguay and they usually do not wake up until somebody very important in their country has been the victim of an attack for example in the Dominican Republic that who is a signature they got mobilized when the president a few years ago their president was the victim of a cyber attack all of a sudden what is this and they mobilize now that one of the leaders in all of Latin America the second category would be those regimes are more restrictive the China the Russia for example who are very concerned about maintaining their sovereignty they don't want the Buddha best convention coming in and allowing judges in France to issue orders for China to be obligated to turn over records that's a huge issue and there you have two diametrically opposed legal systems that may never come into an agreement that's just the reality and the third category would be what I would call countries that have a type of complex countries and again I don't want to be specific but since we're talking about Brazil Brazil Brazil is a country that is promoting the negotiation of a totally new treaty and they always come up with a different excuse why they don't want to sign the Buddha best at one point it's because they were opposed to one of the articles having to do with intellectual property enforcement then they came up with another excuse and within those countries there are divisions it's like countries saying hey we're not a third world country we should have been involved in the negotiation of this treaty but since we weren't let's start a new one where we can get in at the ground level but the problem is as I mentioned earlier the Budapest convention took over a decade to negotiate what do we do in the next 15 years while we negotiate another treaty do we just totally abandon Budapest and was join Budapest Brazil and then negotiate any new terms that you feel are important or that may have been ignored but to suggest that we're going to totally abandon the Budapest convention and then negotiate the terms of a new treaty that's not realistic I'll note that among the Budapest conventions 63 or so states parties I may have the number off are both Council of Europe members non-Council of Europe members that are developed countries and a number of G77 are developing countries and then it's estimated that another 60 countries that are not parties to the Budapest convention have modeled their laws on its provisions let's open it back up for more questions and comments and again please just note your name and if you have an institutional affiliation please ask the mics around good morning my name is Jeanette Manning and I'm an attorney with the National Association of Attorneys General here in DC and I head up our international center and my question actually is probably more geared towards you can with respect to you had a slide regarding encryption can you talk a little bit more about advances you're seeing particularly as it relates for law enforcement are they starting to make more headway with private entities now starting to hopefully cooperate as it relates to investigation so can you elaborate on that good morning my name is Orlando Munoz I work with ABA Rolly in Colombia South America and my question is to Rodolfo could you please provide more details about the Argentinian case of the I mean how Argentinian authorities acted against the way of the game good morning thank you again for giving us this panel my question is for Mary because you mentioned the feminist principles concept of internet security I was just wondering what are you seeing as the major challenges or gaps in the ability for law enforcement to bring cases specifically around cyber mob attacks those that limit women's participation in the internet when those sorts of online mob gathering in an organization lead to physical violence or threats of violence thank you so we have encryption Argentina I was terrified for a moment that you were from Paraguay and law enforcement responses to cyber mobs and online aggression against women alright I'll start with Argentina one of these cases the Argentinian authorities got through social media specifically through Facebook this message and they recognized what it was they try to reach Facebook to get subscriber information under the emergency exception there's an exception under our law that says when you have a life-threatening situation where the potential is imminent that someone's going to lose their life service providers may in their discretion provide records that are necessary Facebook refused to turn them over and this goes to one of the questions that were asked earlier the role of private the private sector so they contacted the Department of Justice that is Argentina did to help to see what we could do we recognize that this was an emergency so at the time I was working for the computer crime section I called Facebook and they said this is not an emergency my response was you know what this is your decision but if somebody ends up dying and they ask the Department of Justice why we didn't act and the impact that may have on the value of your shares whether they go up or down that's your decision we got the records within two hours and with those records we were able to find the geolocator information the geolongitude information and I was able to actually see the house from which that Facebook message had been sent which I provided to the authorities they identified the individual he was a 16 year old very disturbed individual they found out the other people he was communicating with through his computer and as I said they were able to save about six lives thank you for the question on the feminist the law enforcement issues around cyber attacks on the internet threats of violence I don't have any I turn to my colleagues here and in the audience for any specific examples from a rule law but I'm a strategy or issues but I'm imagining the investigative challenges are real and it's what we've already identified the access to electronic evidence in real time let me start with political will by either governments or investigative agencies the challenges with obtaining electronic evidence threats of violence are definitely harder from an enforcement standpoint than actual assaults or actual stalking, actual hate crimes and then the attribution issue which my colleagues that are better the use of electronic evidence can maybe maybe elaborate on so thank you very much for your question it actually will allow me to tie back to your earlier question with the audience permission I'll do a two minute primer on encryption my comments throughout are never criticizing any particular entity it is an observation for you in terms of what the impact has been for us in the state and local community on the very practical path that we have which is to investigate, exonerate and to prosecute so this issue for us the going dark issue has been around for decades but it hit the state and local community most in a few years ago in 2014 because from a data at rest perspective your phones, these are the devices that we typically in the past have been able to in every instance go to a judge get a warrant, take that warrant take that phone that's associated with a private sector ship it off to a California entity and based on the judge's authorization get into that phone as we're focused on human trafficking, sex crimes whatever the case a judge has read our application and made a decision but in 2014 Apple made a decision to change its operating system that's their private sector choice that was dramatic to say the least now why does it matter is because Apple and Google control because of their market share about 99.3% of the operating systems around the world for our office as I talked about in my initial comments we run a state-of-the-art lab very proud of it no matter how many terrific professionals we have or the tools we use we can't get into most of these devices more than a thousand devices that we lawfully obtained since 2014 were inaccessible when they were seized more and more of these devices because of the operating systems just come in and they are inaccessible to us after we get a warrant again remember we have the legal authority but not the physical ability to secure it where are these cases coming from these are 9% of them are homicides attempted homicides real life issues 10% of them are sex abuse cases including child sex abuse human trafficking around 7% and then the unique thing is from a cyber crime perspective these cases about 30% of them are related to cyber crimes so we can't get into the phone trying to tackle the evidence to just examine it we could exonerate but we can't get into the cyber crime so we are asked to investigate but we can't get into the evidence let me just talk a little bit about what the practical implications are videos on these devices affect our investigations of sex crimes human trafficking when we look at these these videos were strong corroboration of the victims of 13 year old girls narrative the defendant entering her bedroom and assaulting her talk about the most dramatic cases when I talk about exoneration and the need to get into these devices I'm not playing lightly I'm saying we've looked at this and in 17 instances because we were able to get into the devices a man or a woman who was accused either had their charges completely erased or they were reduced so to your core question are things getting better or worse? worse much worse can't get into the devices unless we spend a lot of money to outside consultants to do it and we when we're dealing with not data at rest but data in motion when we're trying to do our wiretaps we're frozen out so this is not a tech problem no one's pointing the finger at the tech community this is not a law enforcement problem this is a societal issue so we're all in this trying to grapple with how do we balance public safety, threats to critical infrastructure, threats to all the things that I talked about on the earlier initiatives and privacy and we are stuck we're in a really tough place where the victims of our cases we cannot get to the evidence and so what I will say is we have put together every year a white paper on the subject you can just visit our website ManhattanDA.org to access those we approach it as neutrally as we possibly can but with a clear underscored emphasis that from a public safety position this is untenable so to serve back to your question about the private sector in every sector except for the tech sector we have a robust at times there can be friction but in the tech community it has been really difficult now that has gotten slightly better slightly better over time but not much so I wish I had better news and sorry if we take up so much time so we started a little bit late but I don't want to take us too much later or go into the next session so I'm going to take one minute and just mention some of the themes that jump out from the presentations and from the discussion of the questions and then we'll recognize our panelists so from my perspective some of the themes that stand out are the need for adequate legal frameworks as crime has evolved the idea that having common elements among countries helps with international cooperation and the importance of capacity building and thoughtfulness and drawing upon lessons learned in capacity building the importance of not just thinking as I unfortunately often do of federal entities or country to country cooperation but sub-federal entities or sub-national entities and cooperation that is vertical and horizontal and the innovative approaches that states and localities have in confronting these issues the fact that we have to treat it as a multi-stakeholder issue involving the private sector and thank you for raising the point of the constraints and the challenges for small and medium enterprises that we don't always think about we often think about the behemoths in the field in all of those directions that we mentioned and a planning and preparation the point that a criminal justice response in a sense is a response when it's too late and we're in a defensive posture and then, and this could be another hour or two hours of discussion the balance of privacy and security and the challenge of encryption so I'm sure that you are with me as a panelist to be articulate thoughtful comprehensive responsive if you'll join me to both thank them and thank ABA and USIP and I'm sure they would be happy if you button hold them for more side discussions why don't we get started now my name is Latha Knott and I am the Executive Director of the First Amendment Center which is located right here in DC at the museum and is an organization dedicated to exploring issues related to free expression which is why I'm very honored to host this panel today which is the tipping point when is cyber incitement responsible for violence and our goal today is to have an informal discussion about the dividing line between free speech and hate speech and what factors can lead hate speech to result in actual real-world violence I think that I won't get much argument when I say that there are a number of paradoxes that surround the conversations that we have online they are hosted and moderated by private platforms but they have a huge impact on public discourse they connect people all over the world but you can see that they often lead to a polarizing effect in so many societies and while social media can be an invaluable tool for spreading news and information after a crisis it can often be the cause of crises when you see it being used to spread misinformation and incitements to violence as a free speech advocate I'm generally in favor of more speech rather than less speech and I'm wary of censorship but I would deny that social media can have an amplifying effect on violence in its users that it is susceptible to manipulation and that it can have a real-world cost a human cost when unfettered communication does lead to violence and it's always been very difficult to balance free expression with security and safety and luckily for us we have two experts today who can help us parse some of the things that we do when doing so and our first expert is Richard Wilson who is the Gladstein Distinguished Chair of Human Rights and Professor of Law and Anthropology at the University of Connecticut and we also have Stephanie Klein-Albrandt who is finance and economics the finance and economics expert on the UN panel of experts established pursuant to UN Resolution 1874 and the plan for today is that both Richard and Stephanie are going to present their initial commentary on the research that they've done in this area they'll talk about the case studies of Myanmar and Guatemala Richard will walk us through the framework that he has developed to assess when hate speech is likely to turn into violence and Stephanie will talk about where we can go from here with what we know about online speech and violence what are our next steps what course should we plot after that I'm just going to ask a couple of questions to get the discussion started but I'd like to turn it over to the audience for your questions following that but first Richard speech against human rights defenders in Guatemala with the ABA and behind me is a team in this report my colleague Molly Land who unfortunately is ill and couldn't be here today but she has been more than an equal partner and also the research and much of the writing for the report has been done by students at the University of Connecticut School of Law two of them are here I can't help but embarrass them because that's what teachers do ask them to stand up Mona Abbas and Jonathan Donovan who just graduated if any of you are in positions of authority hire her that's my recommendation and also the support of the ABA Center for Human Rights team who have just been amazing in ushering this along Brittany Benowitz, Jenna Anderson and Juan Ramirez have been just amazing to work with so we are talking about hate speech online and it is a tidal wave of a problem but it is a huge problem if you see just to point out some of the some of the numbers here 4.75 billion pieces of content shared daily on Facebook just all these hours of video uploaded on YouTube Twitter 500 million tweets a day and 80% of users outside the United States so it is important to recognize that the social media companies and their platforms are not just U.S. phenomenon in fact they are not just predominantly U.S. phenomenon this is a global phenomenon and that has all kinds of impacts for the regulation and law that applies here are some more numbers for the first quarter of 2018 I will just point out a few interesting facts here 583 million fake accounts I believe that number has gone down but that is an awful lot and 2.5 million pieces of content featuring hate speech which is our topic for today Facebook has community standards in their terms of service they have three tiers of content moderation the most serious tier is tier one there are a number of protected categories like race, ethnicity sexual orientation gender, disability and these are protected groups and calls for violence disease or death dehumanizing languages in tier one mocking hate crimes endorsing them tier two would include making claims about the deficiencies or mental physical deficiencies of these groups holding them in contempt calls for segregation and this also includes ethnic slurs or other forms of language that includes slurs so there is a kind of hierarchy here that the social media companies have indicated to us of what they consider to be the most serious forms of hate speech and what forms of hate speech they consider to be less serious so we can argue about this how did these categories come to a rise are they the best ones to have you know this is certainly a topic that we can discuss there has been criticism that these hate speech guidelines are over broad but also under inclusive over broad in that napalm girl a photograph which arguably ended the vietnam war a photograph from 1972 in vietnam was taken down on facebook in 2016 it was later allowed but it was taken down under the hate speech guidelines and then other kinds of posts which perhaps deal with immigration are allowed to stay up so there is an argument here that the hate speech guidelines are not getting more coded forms of insult more coded forms of speech but they are actually excluding forms of speech that we ought to allow as part of our democratic and public discourse so we focused on hate speech in just one country in our report which is Guatemala why Guatemala well it seemed to be one of the more egregious cases but also a case that we wanted to dig into more deeply but there was simply a problem here of a number of problems I'll just put them up here which are present also in other countries Serbia, Colombia, Cambodia come to mind this is not just a Guatemala issue but one of the problems was that prominent state or state aligned actors were targeting human rights defenders there seems to be a problem here in social media companies approach to hate speech which is to treat everyone the same everyone is just an individual out there making their posts but what happens when there is a coordinated state or state aligned program of targeting a particular sector of society in Guatemala the language was labeling human rights defenders as communists or terrorists and also explicitly to encouraging violence from the security forces this harmful speech was by and large not being removed by social media companies and there is a high level of violence against human rights defenders in Guatemala in 2017 20 human rights defenders were killed in Guatemala is there a correlation then is there a question between the targeted harassment intimidation and incitement by state and state aligned actors and the actual violence on the street against human rights defenders it seemed like there was a correlation in the violence in Guatemala and 18 when president Morales called human rights defenders criminals and 8 were killed in the subsequent months so we dug into this problem we researched it for 9 months now and here are some of our findings first of all there seems to be a serious problem in Guatemala and also in other places of indirect speech which doesn't explicitly violate the hate speech guidelines or terms of service of social media companies but nonetheless can have deleterious effects it's coded it's veiled it's evading content moderation now since we're all users of language we know how complex and nuanced language is we know how language within particular community groups can be used in ways to secure the message from other outsiders to transmit a message that only a certain group will hear in the United States we call it dog whistle politics but it's happening everywhere and always has in political discourse but this seems to be a particular problem for social media companies how do you pick up on indirect speech where the audience knows exactly what's being said but it's not being said in a way that it is grabbed by the filter of the hate speech regulation of a social media company the messages were then amplified in Guatemala by net centers and fake accounts we found extensive evidence of this and there have been a number of reports including one yesterday by the UN mission in Guatemala on net centers and you can download that at ccig which is the UN mission against impunity in Guatemala and it just produced a report on that topic it's not clear from our research this doesn't mean it's not happening but it's not clear from our research that there's a direct correlation that would satisfy a court of law that a specific speech act cause a specific criminal act that's what criminal law looks for it looks for that causal nexus and evidence beyond a reasonable doubt it's unlikely that we're going to get that kind of evidence if we look at what's happening on social media online if that's our standard we're going to be frustrated but we had reported indirect effects from human rights defenders in Guatemala intimidation, silencing harassment, stigmatizing being fired from their jobs and not able to get other jobs long term consequences which created conditions in which violence towards defenders is tolerated one human rights defender when we said what's the kind of impact of this delegitimizing and harassing of human rights defenders and their response was to say well you know if something bad happens to us then maybe other Guatemalans who don't know about the situation say ah tiene que ver algo they must have done something there must be some reason there and that's the kind of important effect of political discourse especially of the indirect kind which is about creating a tolerance for violence creating an elevated willingness on the part of the listener to engage in moral justifications of violence that's not directly causal to the violence it comes in a sense after the fact but still can have consequences and something else that we find is that human rights defenders are not a protected category in any of the social media platform filters so here are recommendations we think there ought to be not a single algorithm for hate speech that's what the situation is now that's the status quo social media companies want to create a list of words that they can then regulate and filter across the world evenly we would argue that that model it does respond to the question of scale but it doesn't respond to the question of the contextual needs of a country that's going through armed conflict a constitutional crisis possibly genocide and there we would argue that what we need are a kind of bespoke policy where a social media company designates a country, a critical country where there is no rule of law where there's massive levels of social conflict perhaps a constitutional crisis as there is in Guatemala right now and that these are designated critical countries and in these critical countries you get a team put together which engages in context specific content moderation what does that mean it means that the speech is evaluated by native speakers who can see the indirect language the coded language that's being used the speaker from Facebook earlier talked about adding 30,000 individuals who are engaged in cyber security and content moderation that's great but what we find is that individuals are sitting in the Philippines or in Dublin or in the Ukraine and they're moderating content all over the world and sometimes they're using Google Translate so even if you're a Spanish speaker from Spain you may not pick up on the slang of Mexico City or the slang of San Salvador or what's being said in a rural community in Guatemala we all know how variable English is for a New Zealand speaker earlier we all know that there are these interesting little complexities and nuances to language which only a native speaker is going to pick up and we recommend that in those in these kinds of situations where there is a crisis in a country that those native speakers be brought in that the speech is evaluated alongside social and political contextual factors so you can't just look at the speech and this is consistent with 100 years of First Amendment law in the United States since 1919 and all of our Wendell Holmes in Schenck the US Supreme Court has been saying you don't just look at the speech you look at the context of the speech and so all we're emphasizing here is that social media companies need to contextualize the language that they're regulating and filtering what are the social and political factors in a country perhaps look at those in order to understand what the consequences of words can be and in situations which are of extreme crisis it's certainly the case that there are determining factors which are risk factors which elevate the likelihood that violence is going to occur elections are one a common one there's much more inter-ethnic violence inter-political violence around elections the authority of the speaker is another there are a number of factors which are risk factors which are indicative and predictive of the likelihood thirdly look at the status of the speaker are they state or are they state aligned we request and recommend that content moderation be sensitive to coded or veiled speech and that there be de-platforming of accounts that violate the terms of service this is what they're meant to do anyway and this might be done in a more consistent fashion as a result of our investigations and report one Twitter account the foundation contra el terrorismo which is one of the worst accounts in Guatemala has been suspended and closed but which we may consider a victory but then there's the question of what appeals process is there we'd like to see social media companies being very explicit about the reasons for de-platforming the reasons for removing content could they explain that could they give us clear criteria when an individual and provides some kind of appeals process for them thanks very much thank you so much I'm revising my speech a little bit to take account of some of the points that we had in common so I'm going to speak today both about platform governments and just a little bit of time on government repression and use of the internet by authoritarian governments to suppress rights the main rights at stake are right to privacy and freedom of expression and association and there are others as well but those are the main ones that I'll address with the privacy rights the main impediment is really just connected to the inherent online business model which relies on extraction of information to better target ads and freedom of expression the boundaries are defined in a kind of a gray zone between legal frameworks and company norms I just want to start with a quote E.O. Wilson said the main problem with humanity is that we have paleolithic emotions medieval institutions and god-like technology and this has led to really an extractive attention economy with reverse engineering of human instincts that's sort of where we are today and what this requires and I'll get into some recommendations in a bit we really need action by the companies by governments and civil society to better protect speech in the digital age and not merely incremental changes at the margin of sort of social media's management of public space we also need changes to the rules governing online speech and public participation in making interpreting and enforcing those so just quickly with regard to right to privacy so these the relevant issues include expanding surveillance regimes tracking and profiling of users online behavior data transfer without required safeguards if you're all familiar users can increasingly now make tweaks to how they share the information there's really still no means of limiting the data collection that is the premise for the services that are used so targeted advertising what's really scary here is that we're really even way beyond Cambridge Analytica at this point because you don't even need any technical tactics to access a huge amount of information about users right now it's possible to assess the top five personality traits of an individual based entirely on their click patterns and their mouse movements and it's likely that that information will be given to an insurance company before you yourself like they can find signs of Parkinson's years before you have any actual real symptoms so it's likely to be given to a sole-to-insurance company to a government before you as an individual will be given that information moving on to freedom of expression so the platforms like to speak as though they are enablers of freedom of expression and association and you've heard how that's done connecting all these people giving rights giving free speech to a whole host of people but they effectively have both boundaries for expression based on mostly company created norms or community type standards and legal standards but we don't really know the actual mix of all of that and then they regulate content through different forms of content moderation so there's algorithms there's user flagged content there's requests from governments and other state actors and agencies for removal of content now the algorithms have been successful to a large extent with things like child pornography, terrorism violence including suicide but not to repeat too much what Richard has said but it's really much less successful for hate speech for the obvious reasons of the use of allegory the use of nuance the use of coded language for example before it took the outside world the expression Rohingyas are Bengalis was not something that Facebook was looking at it's literally kind of dehumanization of the Rohingya to essentially say that they are not Burmese and that's just not picked up and if it's picked up even if it's a day or two later the damage has been done because these viral posts already calling for violence have been disseminated there's another case of I think it's South Sudan or Sudan where the persecuted group is referred to by the acronym, three letter acronym referring to the telephone company because quote they're everywhere which is in and of itself hate speech but how long does it take for a platform to figure that out and then you have to actually understand the process of creating an algorithm first you have to have human beings agree to what hate speech is which is totally in and of itself a difficult enterprise because defining what hate speeches can be left up to all sorts of different types of interpretations then you need to create rules about what hate speech should be allowed so Richard pointed out the tier one tier two and tier three then you need to build the rules into algorithms and then you make the algorithms observe the rule and then you need humans to constantly review the algorithms to make sure that they're actually picking up the content that needs to be flagged so it's a long process and it locks in definitions from the very beginning and requires constant review and yet as you might all know I mean the types of information that's fed in to AI is sometimes very questionable discriminatory faulty and there's kind of an assumption that AI is this magical process that cleanses it and makes it super technologically advanced so what comes out must be somehow correct and we've seen this there's been studies in the use of AI by police stations around and it shows that it just furthers discrimination so with regard to hate speech in August 2018 so the platforms have decided at least one certain platform that algorithms are really the primary way of dealing with the situation hate speech in Myanmar according to Facebook the amount that they were able to remove went up to 52% from 13% and the goal is just you know let's get up to 90% but it's almost a physical impossibility because if something starts as a derogatory term in a suburb of Lagos tomorrow how long is it going to take Facebook to pick up on that and how many posts will there have already been and there already have been deaths and what sort of tragic is that police in many of these countries just follow the platforms because they know that the violence will follow what's on the platforms and do they have the capability to actually have you know their whole police force monitoring the platforms and doing policing so what we need are changes to the rules governing online speech in the public's participation in making and enforcing those we need actions by companies, governments to protect speech we need new models of content moderation and public oversight and government regulation all of which would protect the rule of law with a long term vision of public investment to sustain the infrastructure of freedom of expression I'll just get into a few ways so decentralized decision making companies are addressing problems of scale by hiring or promising to hire more moderators with language skills 30,000, 40,000 right but there's really extremely, extremely so that's on the sort of on the language side these people can maybe read if they have it for a given country because generally they only hire start hiring en masse after there's been a scandal in a country but assuming that you can they can access and read it there's limited participation for platform users to help create or enforce standards in the context of the cultures in which they operate every community is different they have global human rights standards and they're implemented differently according to national contexts so there needs to be better interaction within coverage from the field you need more people on the ground that know what's going on putting them all at the level where people are actually impacted by their decisions and have some role in governing them it's like a governance question so in addition to sort of content moderators and oversight board one can imagine actually having employees who have knowledge in the country concerned and not just helicoptering in from California or from wherever this idea of kind of California overlords making decisions like the decision to pull the four ceasefire groups off the web in Myanmar who was making that decision on basis of what did they actually find out what this means why those groups and not the other groups why these ones are particularly targeted by government implications for elections how much contextual knowledge was there in that decision apart from an antiseptic treatment of probably a package that was given by the government of how these groups are engaging in violence with none of the context around it this would also help platforms to figure out how much leverage they have in a given market because the requests for taking stuff down from governments needs to be evaluated in context of how much leverage the platforms have if it's widely adopted by people you can be reasonably assured that if you refuse certain requests that you're not going to be shut down for example but you need to have the local contextual knowledge to do that to make any of those decisions human rights standards should ideally be the explicit standard for content moderation guidelines now this is kind of a no-brainer right the community standards incorporate some aspects of human rights law but wouldn't it be stronger if you went to a government saying we are making a decision to pull this content off or to take this action in line with international human rights law to which you are obligated and we are as well by virtue of principles on business and human rights GNI etc then these are our guidelines that the whole community agrees with and this is why it should just be made explicit and I understand that that's a heavy reach although friends of mine that work in these companies in the policy realm there's a lot of people that are very much on board to do this at the top level there's no agreement that there should be an explicit simply even if you can't make human rights standards the basis maybe just a reference in the community standards or in the standards themselves that this is based on customary international law as articulated in the following human rights instruments so it seems like a no-brainer then there's a problem of transparency lack of transparency right we don't actually have the data on all the harm that's being created notwithstanding some great platforms that tell us every day the research that Richard and others are doing or global voices it's not like there's an oil spill right and and you have to you get to see the actual data now you have companies publishing reports right you're getting more and more information on what they're asked to take down decisions made etc but they still it still requires more more steps and I would argue that those are to disclose policy choices and applicable content standards right to open up the processes and proposals to public comment and when new rules about content are adopted explain how those changes were made decisional transparency so the reason behind content actions basis of a decision and how a user can appeal again this me and Marcia's fire groups decision what was the basis why these four groups why these other four groups that do the same thing were not targeted what was the basis of that decision provide some clarity into algorithmic decision making so the inputs into the AI like I said input if you input bad you're getting output bad actually if you input bad you're getting output worse right because it's just amplifying the bad data that you're that you're entering and then ideally companies would establish case law right which would open up as much as their decision making as possible to public scrutiny and you'll all have heard of the oversight board that Facebook is setting up kind of like a Supreme Court for Facebook and it's a positive step it's a very positive step ideally that would be a platform like an all platform wide body that would be truly independent because it will be paid for by Facebook anyway even if it goes through a third party it's clear that those people are still it's not truly independent but it's a good step I think I had a lot more but I think I should maybe stop in terms of time yeah or maybe I'll just very quickly very quickly talk about government regulation so the government regulation that's needed is regulation to monitor company behavior protect the space for individual expression reinforce this need for transparency by the companies and themselves and investing in the infrastructure necessary for freedom of expression in their countries and you know there's there's four leaning steps that should be part of any regulation of social media which would require company disclosures companies can edge towards better transparency in part because of their fear of government regulation right but even if they start to do so governments have good reason to demand that the companies disclose their rules and decisions which should give their public the tools to decide whether to engage on the platform and Germany's net DG has begun to do this companies have been producing specific reporting about net DG's implementation this is a kind of regulatory move that could encourage greater public understanding of platform operation and we might get in the discussion the extent to which Europe is really ahead on a lot of this and that we should be learning lessons from what they're doing the other thing that's important is that when requests are made to remove content from the platform it would be important that the platforms require that that comes from the platform. If not ideally a court of law and not just some random police station or individual or agency that doesn't like a certain thing there should be a process whereby our institutions are involved where there's a judicial review of the decision before that's removed and ideally again that that be transparent that process right which governments are asking platforms to remove which kind of content and finally something I'm very passionate about is when the content is removed where is it being saved for future war crimes trials and I know from my work in the UN that this question was posed to Facebook early on in the Myanmar saga and the initial the initial reply was well we never thought of that I think that now they're thinking about it but just imagine what kind of a job it is to be able to maintain and categorize that information it's valuable information about things that are happening that are subject to international jurisdiction for example so that's just another issue that we have to get our heads around and with that I'll stop Thank you both so much for that a lot of troubling knowledge I think for everybody here but that was very interesting and I just wanted to ask you guys a couple of questions before I turn it over to the audience first interestingly it sounds like both of you are talking about the value that there might be to online speech if Facebook were to have more of a legal process if it were to say have an appeals process for people who would be platformed and have its own body of case law do you think that's where they are headed? I don't know the answer to that possibly it seems like there's a hodgepodge of hate speech guidelines my understanding is is that there are 200 pages of rules and documents that content moderators are using to consult when they review a post that it's not consolidated that it's not consistent if you look at the tiers, tiers 1, 2 and 3 that those would not be the forms of speech that I would put into tiers 1, 2 and 3 that if you look at the social science of hate speech and incitement and there's a lot of new neuroscience on this I would look at Susan Fisk and LaSonna Harris's work for instance Susan Fisk is at Princeton and doing amazing work on this stuff you know we might come up with a different a different set of categories I think that the companies are looking to governments to provide some of these answers and finding it very difficult to come up with it themselves and where governments have come up with those answers and we can talk about this the German Nets DG law for instance the response of the social media companies has usually been whaling and gnashing of teeth but then compliance and then a sense that actually there hasn't been a major violation of democratic rights to deliberation and due process and discussion it's no one understands this completely it's the Wild West and I would like to add to that the place where we're seeing more legalese is in this oversight board discussions where in theory you could have case law built up and you could then by the case law if it were transparent extrapolate back exactly how the platforms are reasoning Article 19 is called for social media councils and again this would be something that would be across social media that would have a model that would work for all that would be obviously something more consistent with a legal approach than having each company have their own properly funded their own like funded by themselves institution that in theory is providing oversight and I think we're also talking about when we think about Facebook having a legal system it going a little bit going further than say the first amendment I mean do you think that there is just an inherent difference in online speech versus speech in real life definitely all this stuff violates the first amendment all these hate speech guidelines because the first amendment indicates you can't have content discrimination and so this is clearly picking out some forms of content you know there the social media companies are essentially clubs and they can do what they want with regard to their terms of service you accept them or you don't at the same time they're not just clubs they are the internet in places like India and Burma and other places and they're much closer to public utilities so I think there's this real tension between their private nature and their public function and that's not something that's easily resolved yeah I'll just point out a different issue which is the difference between protecting speech that's not online speech that is online so your drunk uncle in the back of the room making ridiculous racist comments is one thing and putting that online when you know it's inciting hundreds of thousands of people to commit violence against those people so you just have this amplification aspect where crazy ideas are given a megaphone in a way that creates off platform situations of violence and other abuses of human rights I mean there are other ways of responding as well we've talked a lot about deplatforming and removal of posts but there's all kinds of interesting nudges and here you might get into behavioral economics which is short of censorship but if someone uses an ethnic slur in their twitter post a little a little box could pop up saying this violates our terms of service are you aware of that there's also a group which I believe is based in Europe, Sweden and Germany and they intervene in debates and call people out when they're using highly incendiary language and saying really is this helpful and it's interesting how much that kind of shaming and norm enforcing can be effective but the group argues that when they do that 80% of the posts are actually taken down by the users that posted them they're shamed so it's dialogue, shaming dialogue rather than censorship I see what you mean we've got about 10 minutes left so I would like to turn it over to the audience to see if there are any questions and I've been told that we have at least a couple of microphones running around is that true all right can we get one over there I had a question in regards to maybe some futility in trying to take down hate speech and I think you kind of spoke to that earlier both of you in terms of the shaming idea and that aspect in the sense