Good Morning:
Kleio the dog wants a belly rub.
First off, a report on the #GreekChorusFoundation’s latest decisions.
On August 27, I put to the group a series of questions related whether the foundation should take on a third project, in addition to the two it currently has going: Operation Taya and Operation Battery.
For details, see the Aug. 27 dog shirt:
The decisions, specifically concerned whether the foundation should take on support of the family of Slava Kurbanov, a Ukrainian soldier and friend of Jimmy Rushton whose death in a Russian missile strike Jimmy and I discussed here:
The Greek Chorus voted overwhelmingly to take on short-term financial support for Kurbanov’s family until government benefits kick in. I will be amending the foundation’s web page this weekend to enable such donations.
Thanks to everyone who participated in this this voting and the discussions that surrounded it.
Last Thursday on #DogShirtTV, the estimable Carol T. had some questions about the concept of a “natural born citizen” and the estimable Mike Feinberg had a fiery skull:
Last Friday on #DogShirtTV, the estimable Mike Feinberg had some thoughts on the literary character of ghost stories, while the estimable Anastasiia Lapatina updated us on life under Russian bombardment:
Monday on #DogShirtTV, the estimable Jonathan Rauch and I discussed pests: mosquitos, DEI overreach, and Donald Trump:
Tuesday on #DogShirtTV, the estimable Alicia Wanless came on the show to give us an update on the Canadian political situation, now that Carney has broken off trade negotiations with the US:
Wednesday on #DogShirtTV, the estimable Quinta Jurecic came on the show to tell us about her recent article on Trump’s latest efforts to end birthright citizenship:
Thursday on #DogShirtTV, the estimable Holly Berkley Fletcher was mad. Mad, mad, mad. I could only get out of the way and let her rant. (EJ Wittes checked the transcript: Holly is talking for a solid 80% of this show.)
And yesterday on #DogShirtDaily, Holly and I brainstormed on how to stop the triumphal arch and other building crimes in Washington DC:
Recently On Lawfare
Compiled by the estimable Sarah Willrich
The Church Bells Still Ring
Seamus Hughes and Peter Beck remember the Annunciation Catholic Church shooting that occurred one year ago. They argue that the attack reflects a broader “true crime community” subculture in which teens are pushed toward violence by online networks that reward it with notoriety and warn that there is often not enough support to guide them away from that path.
And law enforcement agencies from the federal level all the way down to local school resource officers can’t assume these young people are simply troubled outliers and that their acts of violence are the unfortunate, unavoidable cost of troubled minds. These are impressionable, vulnerable, and often isolated teens and adolescents who have been radicalized by peers, who have fooled each other and themselves into feeling a sense of belonging in a violent, cruel community. Many entered their adolescence trapped inside and online as a global pandemic raged outside their windows. Opportunities for typical social interactions were limited, to say the least. For far too many, the worst versions of ourselves that we as a society produced—collectively in our stoic indifference—offered some of the few opportunities to feel connected.
The Boat Strikes Aren’t Part of a War. They’re Murder.
Sarah Elaine Harrison argues that debating whether the U.S.’s strikes against boats in the Caribbean are war crimes is a distraction from the simpler, graver truth: they are extrajudicial killings—that is, murder under U.S. law—and evidence of the Trump administration’s slide toward authoritarianism. Harrison encourages Congress to push back by highlighting how the illegal killings are bad drug policy.
Think of it this way: At any time, U.S. security forces—whether police or the military—cannot shoot people in the streets merely because they are illegally trafficking drugs or affiliated with groups that traffic drugs and pose no imminent threat to life or serious bodily injury. The authorities have to arrest, charge, and try them. The only difference in these boat strikes is that the people being targeted are some miles off the coast. Because the military is summarily executing people who pose no imminent threat, that constitutes the unlawful taking of life, more commonly known as murder.
Invisible Source Skew
Kate Klonick and Renée DiResta highlight how decisions made by artificial intelligence (AI) companies about what information their models consult impact the information they provide to users. Klonick and DiResta identify three key pathways through which this occurs: a decrease in reliance on some sources, relied-upon sources themselves no longer being updated, and the acquisition of new, exclusive datasets.
What a model learned from, therefore, is not necessarily the same as what it looks up. Paywalls, crawler restrictions, commercial arrangements, and product choices shape AI-generated responses. Both training and retrieval are shaped by consequential forces largely invisible to the public, which increasingly relies on the answers.
We call this phenomenon invisible source skew: the gradual shaping of an information environment by routine product decisions made at AI companies about which sources are retrieved, which are maintained, and even which datasets are acquired. Any one of those decisions may make technical sense, be commercially rational, or even be entirely unremarkable. But together, they create a public epistemic infrastructure whose inputs can change dramatically without users—or often anyone outside the companies—being able to see, understand, or contest those changes.
U.K. Supreme Court Opens Door for Spyware Victims to Sue Foreign States
Siena Anstis, Natalia Krapiva, and Kate Pundyk analyzes the U.K. Supreme Court’s decision that Bahrain does not have sovereign immunity in a case brought by Bahraini dissidents alleging they were targeted by spyware, even though the perpetrators were not in the U.K. The authors explain that the case adds important legal protections for victims of digital transnational repression but raises important questions about how the new precedent interacts with treaty obligations.
While the Supreme Court’s immunity decision is a big step forward for transnational spyware litigation, there will be other challenges. In particular, future claimants will have to establish that their claim falls within the scope of Section 5 of the SIA, which is confined to “death or personal injury” and “damage to or loss of tangible property.” A claimant must plead one of those qualifying heads to fit within Section 5 of the SIA and defeat immunity. As Lord George Leggatt observed in his dissenting opinion in Shehabi, claims framed solely around economic loss or the exposure of private information—with no pleaded personal injury or property damage—will fall outside the exception. However, once a claimant overcomes this obstacle, consequential loss flowing from that injury is potentially recoverable.
China’s AI-Enabled APT Operations Are Getting Interesting
In the latest edition of the Seriously Risky Business cybersecurity newsletter, Tom Uren discusses a new report about Chinese AI malware capabilities, the Treasury Department’s naming of specific Iranian hackers in its Operation Economic Outcast press release, whether AI should be considered critical infrastructure, and more.
Bitdefender suspects that the same high-level specification document was independently implemented twice with AI assistance. Bitdefender concedes that this structural similarity is not conclusive evidence but notes that it is the “kind of thing an AI-assisted workflow makes easy.”
This is the first example we’ve seen where the evidence tells a compelling story of a competent cyberespionage actor incorporating AI into its work practices. SilkParasite is taking the same, disciplined approach to malware development and doing more of it. It’s creating more malware families to build redundancy, make attribution and discovery harder, and reduce the risk of compromise from any single exposure.
The “GEC Files” Don’t Show a Censorship Operation
Renée DiResta examines the State Department’s claim that its former Global Engagement Center (GEC) colluded with a Stanford research consortium to suppress online speech supportive of then-candidate Trump during the 2020 election. DiResta finds that the latest document release doesn’t support that claim, was already public, and drastically overstates the scale at which the consortium flagged content as problematic.
The documents Jordan released offer hard evidence that EIP independently assessed all tips and frequently declined to escalate them. Several tickets were marked as out-of-scope—not relevant to the project. Others received a form response: “Thank you very much for your submission. We will be monitoring this situation for further updates.“ If this was a censorship cutout, it was strikingly undisciplined about executing the Deep State’s plan.
Dig a bit further and the numbers get more damning—for Rogers.
The First Amendment Problems With Meta’s $17 Billion Deal
Jeff Kosseff argues that Meta’s settlement with 47 states is a form of jawboning: restricting First Amendment rights indirectly by pressuring a third party to do what the government could not do directly. Kosseff identifies three ways the settlement could limit those rights: preventing children from seeing certain content, mandating what features Meta can offer and to whom, and limiting anonymity for adult users through age verification requirements.
Meta had warned that the litigation could lead to liability of up to $1.4 trillion. Even if Meta has “voluntarily” entered into the settlement, it is difficult to argue that the threat of losing an existential lawsuit did not factor into its decision. And even though Meta is free to enter into this agreement, it should not be able to waive the First Amendment interests of millions of speakers and users. The settlement is particularly concerning for the broader internet because Meta would pay more if TikTok and YouTube adopt similar restrictions.
Understanding Al-Shabaab’s Recruitment Pipeline
In the latest edition of Lawfare’s Foreign Policy Essay series, Ismail Abukar explains that Al-Shabaab’s recruitment relies primarily on family ties, not ideology—creating a self-replicating pipeline where younger initiates are recruited by family members already in the group. Abukar argues that, rather than counter-messaging, interventions should focus on providing alternative social structures and meaningful political inclusion for those vulnerable to recruitment.
The children of that initial generation are joining for a different reason: family membership. His father was Al-Shabaab and there was no other world to grow up in. While the motivation to join Al-Shabaab has changed across generations, Al-Shabaab’s pipeline of recruits did not. The communities are the same, but the mechanism has shifted—reinforced by subclan identity and familial legacy of membership that is now being passed to a new generation. This distinction matters because it changes what intervention is required. Economic development would address the first generation’s pathway, but it does not address a boy who joins because his father was already a member.
The Supreme Court’s Ballroom Non-Decision
Molly Roberts breaks down the Supreme Court’s decision allowing the construction of the White House ballroom to proceed, holding that the plaintiff likely did not have standing to sue. Roberts analyzes previous cases on aesthetic standing and explains why the Court’s decision failed to clarify who has the right to sue based on aesthetic, cultural, or even environmental harms going forward.
Instead, the justices simply declared that the National Trust’s objections to the ballroom fall in the insufficient category of (reaching back to Valley Forge) “psychological consequence presumably produced by observation of conduct with which one disagrees”—rather than the sufficient category of aesthetic harm. Why? Well, according to the Court, “mere offense, disagreement, or distaste does not qualify as a concrete and particularized injury under Article III.” How is this different from the environmental cases? Those involved “more than mere offense,” the majority says, rendering them concrete and particularized. What more? Duh—injuries stemming from causes other than “offense, disagreement, or distaste.”
This remarkable bit of circular reasoning reduces to every parent’s favorite logical fallacy: Because I said so.
Governance by Shakedown
Mark Pollack characterizes the Trump administration’s pattern of threatening organizations and individuals to achieve favorable deals as “governance by shakedown.” Despite the process’s frequent illegality and occasional failure to achieve the administration’s preferred direct effects, Pollack argues it has still succeeded in extracting monetary gains and creating a broader environment of intimidation that encourages self-moderation.
This temporal asymmetry explains why legally weak, even blatantly unconstitutional, measures can be effective instruments of coercion: The target must decide whether to accommodate now or gamble on relief later. Temporary restraining orders in the law firm and university cases mattered precisely because they shortened that gap; the months-long delay before the Supreme Court’s tariff ruling mattered because it did not. Governance by shakedown exploits not only executive discretion, but time: The administration can impose pain quickly, while constitutional guardrails work slowly.
White House Unveils Program to Authorize Private-Sector Cyber Surveillance and Disruption Operations
Aaron R. Cooper and Philip Chertoff explain the legal complications, including surveillance protections for U.S. persons and the difficulty of accurately targeting foreign criminal organizations, that companies must consider if they choose to conduct authorized cyber operations under the White House’s new plan. While the plan’s implementation is still being determined, Cooper and Chertoff advise companies to start assessing what risks participating in the plan could expose them to.
A critical element is how the memorandum defines potential targets. Under the memorandum, a CE-TCO is defined as “any foreign group that conducts cyber-enabled crime against the United States Government, a United States person, or United States interests, and that is not an institutional part of a foreign government or wholly operated under a foreign government’s direction.” To this definition, the memorandum adds an important presumption: A foreign group is assumed not to be state-connected unless clear intelligence establishes such a connection. The addition of this presumption is likely in recognition of a practice in which foreign adversaries have used non-state actors as proxies to execute cyberattacks against the U.S., where the link is difficult to prove. This specific callout may suggest a priority in disrupting such nation-state proxies.
Persistent Engagement and the Illusion of Cyber Equilibrium
Jason Healey and Jack Snyder critique the U.S. Cyber Command’s posture of “persistent engagement” in cyberspace, arguing that it fails to produce a stable equilibrium between great powers. Healey and Snyder argue the U.S.’s increasing focus on dominance in cyber warfare is likely to create an escalating spiral of the security dilemma.
Different combinations of power, interest, and means of struggle led to differing outcomes in these contests. As exemplified by the differing patterns of escalation control in Kargil and World War I, not all of these conflicts remained stable for long periods, nor did they all resolve peacefully. Most were based largely on unilateral calculations about the dangers of escalation, lacking explicit agreement over the thresholds and rules of the competition. Some—such as Britain’s coercion of France over Fashoda—wound up with a (limited) winner and a (limited) loser, whereas in the most extreme case—the brinksmanship crises between the great powers between 1905 and 1914—the adversaries no longer cared about limits and escalated to world war.
This perspective should encourage great humility among cyber theorists and strategists of self-limiting rivalry.
Search Warrants for Election Materials Get Their Day in Court
Justin Levitt discusses a case before the California Supreme Court considering the legality of warrants authorizing a county sheriff—who, at the time, was running for governor—to seize and count ballots. Levitt argues the case presents the court with an opportunity to clearly define ensuring election integrity as a civil, not criminal, responsibility.
But those systems belong to the zone of civil process. And while those systems and criminal justice systems can coexist peacefully, they should not be conflated. California jurisdictions have procedures for observers to watch most aspects of the election process. They have procedures to allow challenges to voter eligibility based on reliable information. They have procedures for jurisdictions to test voting machines under the public eye, to maintain strict chains of custody, and to audit results to ensure their accuracy. They have procedures to contest election results in court, to weigh allegations of error or misconduct against real evidence in a judicial crucible subject to adversarial scrutiny.
AIs as Modern Genies
Barath Raghavan and Bruce Schneier compare artificial intelligence (AI) agents to genies and other magical events that give humans what they want, but not always in the way they intended. Raghavan and Schneier warn that as AI makes that process even faster, it becomes more important to think cautiously about how, when, why, and to what effect the technology is being used.
We have recently proposed measuring this gap directly under a metric called the “genie coefficient”: how far an AI agent’s actions drift from what a person really meant. In other words, how genie-like is an AI system? The gap is a fundamental feature of human language and human society. Human intentions have never been fully specifiable, and the world around us is complex enough that attempts to boil it down into data, systems, and language have always had the limitations that AI is now bumping up against. But in individual circumstances, people have relied on human judgment and wisdom to decide what is reasonable. It’s what jury trials depend upon.
The ‘Covered List’: A Fraud Claimed ‘National Security’
Nicholas Weaver explains how the Federal Communications Commission’s covered list, an effective ban on purchasing certain equipment from foreign providers, evolved from a limited national security tool under President Biden to an overly broad ban on critical goods. Weaver argues that the executive is given broad deference in creating the list, enabling the Trump administration to use it to block access to cheap parts and favor administration allies, ultimately harming national security.
For example, if the U.S. military wants recruits already familiar with first-person view drones, it needs a civilian population that can buy the latest (Chinese-made) drones at Costco—that is how you get service members who understand the technology before they enlist. And for the vast majority of drone flights, the data exposure is trivial: The CCP is welcome to watch me inspect my roof for fallen leaves with my DJI mini; in this case, BCC-the-CCP is an acceptable (and for me indeed explicitly articulated) feature I tolerate in return for a quality drone that costs far less.
Open-Weight Diplomacy: How China’s AI Models Are Rerunning the Digital Silk Road
Chinmayi Sharma compares how China’s artificial intelligence (AI) companies are providing their open-weight models abroad to the country’s previous buildout of telecommunications networks. While China may be repeating its playbook, Sharma argues that Washington should not. She explains that attempts to restrict the spread of AI models, as the U.S. did with Huawei products, would not only be ineffective but risk preventing the U.S. from providing a competitive counteroffer to countries eager to adopt AI technologies.
Twenty years later, China’s open-weight AI models are sparking debates that echo the concerns the telecom buildout raised: How does the majority world access an indispensable technology without surrendering sovereignty, or in other words, without trading access today for dependency tomorrow?
China’s playbook appears virtually identical to its telecom strategy. Its AI buildout involves many of the same companies, the same countries, and the same vocabulary as its broadband strategy. And open weights play the role subsidized equipment once did: They are the keystone to an indispensable new technology that one country can provide to another virtually for free to get a foot in the door, but they are also useless without the intricate, interconnected stack of other components that, conveniently, are far more expensive.
Podcasts
On Scaling Laws, Kenji Yoshino, a member of Meta’s Oversight Board, joins Kevin Frazier and Kate Klonick to discuss Yoshino’s recent piece on whether a similar model could be applied to artificial intelligence (AI) oversight.
On Rational Security, Scott Anderson sits down with me, Julia Curlee, and Alex Zerden to talk through the week’s big national security news stories, including a Russian drone guided by AI attacking a target in Ukraine, the U.S.’s new sanctions against Iran and its trading partners, the collapse of U.S.-Canada trade talks, and more.
On Friday’s Lawfare Daily, Natan Sachs joins Daniel Byman to discuss who is likely to win the Oct. 27 Israeli elections, what the consequences might be for wars in Gaza and Iran, how the winner could impact Israeli domestic politics, the role of small parties, and how Trump might sway the vote.
On Scaling Laws, Brandon Mitchell speaks with Kevin Frazier about the growing role of AI in workforce development, how Mitchell’s company provides career guidance in a hiring environment that increasingly relies on automated screening tools, and how AI will disrupt the labor market more broadly.
On Tuesday’s Lawfare Daily, Daniel Byman speaks with Tricia Bacon and Antonia Juelich about how different terrorist groups are using artificial intelligence (AI) and how governments are employing AI to fight them.
On Scaling Laws, Bri Treece and Rob Slone join Kevin Frazier to discuss a neglected layer of AI governance: the organizations that deploy AI in real-world products, services, and operations. They consider why PACT AI was formed, what AI assurance can learn from other industries, why evaluating AI cannot be a one-time exercise, and the major barriers facing the broader AI assurance ecosystem.
On Thursday’s Lawfare Daily, Peter Salib joins Kevin Frazier to break down the postmortems on OpenAI’s failure to contain AI agents undergoing testing, which resulted in a hack of Hugging Face.
On Rational Security, Scott Anderson sits down with Molly Roberts, Eric Columbus, and Renée DiResta to talk through the week’s big domestic news stories, including President Trump’s efforts to reshape mail-in voting, Meta’s landmark settlement in a child-safety lawsuit against the company, and the Supreme Court’s decision allowing the White House ballroom construction to continue.
Videos
On Lawfare Live, I sit down with Molly Roberts, Anna Bower, and Eric Columbus to discuss the latest developments in litigation surrounding the Trump administration, including updates in the litigation over President Trump’s executive order targeting mail-in voting, the Justice Department’s filing suggesting that the Kennedy Center may be torn down, the prosecution of Rep. LaMonica McIver, and more.
In a special livestream, I sit down with Roberts and Roger Parloff to discuss the Supreme Court’s decision to grant a stay of the district court’s preliminary injunction, allowing the Trump administration to continue to build the White House ballroom while litigation is ongoing.
Documents
Sarah Willrich shares Trump’s executive order declaring a national emergency related to national security risks to the U.S. electrical grid, which authorizes the secretary of energy to prohibit transactions deemed to threaten U.S. national security.
Announcements
Lawfare is hiring a Program Assistant for our AI Research Program and seeking applications for the 2026-2027 Student Contributor Program. Learn more and apply at the links above.
Today’s #BeastOfTheDay is the fox, seen here in the National Portrait Gallery in London in 2004:
An artist named Francis Alÿs collated the CCTV footage of today’s Beast into an art piece called The Nightwatch, thereby allowing us all to watch many minutes of footage of today’s Beast wandering around an art gallery. In honor of today’s Beast, go check it out!
Today’s #BeastOfTheDay is not the baby goat, but the baby goat is still very much a Beast worth being aware of today, if you live in North Carolina. On August 28, the North Carolina Department of Health and Human Services confirmed that three baby goats exhibited in petting zoos around the state over the last month have rabies. Since rabies can transmit through saliva, that means anyone who petted the infected goats may have come into contact with the virus and might need prophylaxis. So, here is the NCDHHS press release with a list of events the goats were at. If you petted goats in NC in the last month, check whether you were at one of the events with these goats. If you know anyone in NC who might have been to a petting zoo recently, pass this along to them. Rabies is 100% fatal once symptoms develop. Don’t fuck around.
This has been a #BeastOfTheDay Public Service Announcement.
