Author: Jeff Cassman

Last week, the Biden-Harris Administration announced new, voluntary commitments that seven leading A.I. companies—Amazon, Anthropic, Google, Inflection, Meta, Microsoft, and OpenAI—are taking to manage the risks of new A.I. development and use. These commitments come just two months after the White House announced new efforts to advance the development and use of responsible A.I. and six months after the National Institute for of Standards and Technology released its voluntary A.I. Risk Management Framework.

The voluntary commitments include (1) pre-deployment A.I. security testing, (2) A.I. risk management information sharing, (3) investments in A.I. cybersecurity safeguards, (4) exploration of A.I. vulnerability bug bounties, (5) research into watermarking systems and similar technical systems to help consumers identify A.I.-generated content, (6) public reporting of A.I. system capabilities and limitations, (7) research into the societal risks of A.I., including A.I. bias and privacy violations, and (8) greater deployment of advanced A.I. systems. The White House announcement did not detail any methods for holding leading A.I. companies accountable for these commitments.

In response to the White House’s announcement, EPIC released the following statement:

“While EPIC appreciates the Biden Administration’s use of its authorities to place safeguards on the use of artificial intelligence, we both agree that voluntary commitments are not enough when it comes to Big Tech. Congress and federal regulators must put meaningful, enforceable guardrails in place to ensure the use of AI is fair, transparent, and protects individuals’ privacy and civil rights.”

– Caitriona Fitzgerald, Deputy Director, Electronic Privacy Information Center (EPIC)

EPIC issued the following statement on the launch of Worldcoin:

Worldcoin is a potential privacy nightmare that offers a biometrics-dependent vision of digital identity and cryptocurrency, and would place Sam Altman’s Tools for Humanity company at the center of digital governance. Worldcoin’s approach creates serious privacy risks by bribing the poorest and most vulnerable people to turn over unchangeable biometrics like iris scans and facial recognition images in exchange for a small payout. Mass collections of biometrics like Worldcoin threaten people’s privacy on a grand scale, both if the company misuses the information it collects, and if that data is stolen. Ultimately, Worldcoin wants to become the default digital ID and a global currency without democratic buy-in at the start, that alone is a compelling reason not to turn over your biometrics, personal information, and geolocation data to a private company. We urge regulatory agencies around the world to closely scrutinize Worldcoin. 
– Jake Wiener, Counsel, Electronic Privacy Information Center (EPIC)

In comments to the Federal Trade Commission, EPIC commended the FTC for taking enforcement action against direct-to-consumer genetic testing company Vitagene for unfair and deceptive trade practices involving genetic and health information. Vitagene misrepresented the company’s data security and privacy practices and put sensitive consumer information at risk by storing Health Reports in publicly accessible Amazon S3 Datastore buckets for nearly two years.

EPIC urged the FTC to approve the proposed consent order and praised the definition of “Covered Incident” in the order because it includes situations in which consumer health information is “reasonably believed to have been” accessed or exposed publicly without authorization. EPIC encouraged the Commission to build on this concept of a cybersecurity incident in future Section 5 enforcement and through the Health Breach Notification Act, as it “reflects the understanding that cybersecurity enforcement should prevent data from being stored insecurely in the first place, not just retroactively address security breaches.”

EPIC regularly files comments in response to proposed FTC consent orders and complaints regarding business practices that violate privacy rights. Additionally, EPIC has long advocated for health privacy safeguards. Recently, EPIC published an analysis of how a data minimization-focused commercial surveillance rule would shape the FTC’s health data privacy authority.

Starting in July, the Federal Reserve will be rolling out a new payment service dubbed “FedNow.” Among many on the dissident side of politics, there is a growing worry that this new service may be a trojan horse for a central bank digital currency (CBDC).

The concern is a valid one. A CBDC, depending on how it is implemented, could eliminate the privacy allowed by a cash system, allow the freezing of accounts with greater ease, and open the door to social credit scores for individuals. One asks, is the fear of FedNow truly justified? Or is it a risk for another reason?

To analyze whether FedNow is a trojan horse for a CBDC, one must first understand what a CBDC would be in function. A CBDC, as defined by the Federal Reserve itself, would be “money that is a liability of the central bank.” In essence, a CBDC would be a digital dollar with accounts held at the Federal Reserve itself, similar to what the Federal Reserve offers to banks today. Jerome Powell, the Federal Reserve chairman, has dubbed this a “wholesale” CBDC and stated on numerous occasions that such a currency could only be made so by an act of Congress. Legally, individuals cannot have accounts at the Federal Reserve. Changes to this must be made by Congress, to which Powell has not offered an opinion.

Powell is not the only policy maker at the Federal Reserve to express concern or show dismissal toward possible benefits of a CBDC. Federal Reserve governor Michelle Bowman did as much during a speech to Georgetown University in April 2023. Bowman discussed the listed benefits of a CBDC, including possible speeding up of the financial system and the inclusion of more Americans in the banking system. She, however, dismissed all of these. She touted the benefits of FedNow in speeding up interbank transactions but expressed the fears many hold as to the politicization of a possible CBDC. Powell has also dismissed a CBDC on similar lines, stating to the House Financial Services Committee, “We’ll have real-time payments in this country very, very soon” (this being a reference to CBDC’s being proposed as a solution to transaction speeds).

On the possible smoothing of the payment system, Bowman touted FedNow as a solution that would make a CBDC unnecessary. On the subject of including more Americans in the banking system, she noted the skepticism that many hold toward banks. She posited that a CBDC would solve that issue in no way, shape, or form. Among key players on the Federal Reserve Board there is clear opposition to CBDCs.

But to address the elephant: FedNow. Is FedNow a central bank digital currency trojan horse? Short answer: no. Long answer: FedNow is a new settlement system for member banks of the Federal Reserve System. Historically accounts have been settled physically by vehicles moving money between banks at the end of business days. Today it is primarily done by the system known as…

EPIC and a coalition of human rights, civil liberties, and civil rights organizations have come out in opposition to S.1631, The Safeguarding the Homeland from the Threats Posed by Unmanned Aircraft Systems Act. The bill would expand the governments counter-drone authority. In a letter to the Senate Homeland an Security and Government Affairs and Judiciary Committees the coalition argued “the bill provides overbroad authority for takedowns, inadequately protects First Amendment and press activities, does not include due process protections for improper counter-drone activities, and lacks basic transparency rules to facilitate responsible use.” The coalition urged Congress to only pass counter-drone authority legislation that has proper safeguards in place to protect privacy, human rights, civil rights, and civil liberties. EPIC has previously opposed granting the government overbroad counter-drone authorities.