@article{hoofnagleqsensing2022,

title = {Quantum Sensors—Unlike Quantum Computers—Are Already Here},

author = {Chris Jay Hoofnagle and Simson L Garfinkel},

url = {https://www.defenseone.com/ideas/2022/06/quantum-sensorsunlike-quantum-computersare-already-here/368634/},

year  = {2022},

date = {2022-06-27},

urldate = {2022-06-27},

journal = {DefenseOne},

abstract = {Much ink has been spilled about quantum computers, particularly in overblown claims that quantum cryptanalysis will someday shred today’s encryption techniques. But their simpler cousins—quantum sensors—are here now and improving at a rate that demands urgent attention.},

keywords = {National Security, Quantum},

pubstate = {published},

tppubtype = {article}

}

@article{hoofnaglecryptanalysis2022,

title = {Quantum Cryptanalysis: Hype and Reality},

author = {Chris Jay Hoofnagle and Simson L Garfinkel},

url = {https://www.lawfareblog.com/quantum-cryptanalysis-hype-and-reality},

year  = {2022},

date = {2022-02-16},

urldate = {2022-02-16},

journal = {Lawfare: Hard National Security Choices},

abstract = {Is society is on the verge of losing all of its secrets to quantum cryptanalysis—possibly to a single geopolitical actor, like China? We confidently assess that this is improbable. Quantum cryptanalysis may indeed be a threat in the distant future, but we believe that the cryptanalytic usefulness of quantum computers will be limited, if they are possible at all. Here we highlight technical, practical, and economic and strategic reasons why cryptanalysis is a boogeyman. Cryptanalysis has occupied too much of the spotlight on quantum computing. That spotlight casts shadows on different, more realistic risks and benefits.},

keywords = {National Security, Privacy, Quantum},

pubstate = {published},

tppubtype = {article}

}

@article{hoofnaglequantumbust2022,

title = {What if quantum computing is a bust?},

author = {Chris Jay Hoofnagle and Simson L Garfinkel},

url = {https://slate.com/technology/2022/01/quantum-computing-winter-scenario.html},

year  = {2022},

date = {2022-01-26},

urldate = {2022-01-26},

journal = {Slate Future Tense},

abstract = {Are we facing a future where governments dominate quantum technologies, and use them to collect and make sense of information about us? Or might the future bring some other landscape, where quantum technologies protect the communications of the average person and quantum sensing helps us diagnose and treat illness?},

keywords = {National Security, Quantum},

pubstate = {published},

tppubtype = {article}

}

@article{10.1145/3551664,

title = {ACM TechBrief: Quantum Computing and Simulation},

author = {Simson L. Garfinkel and Chris J. Hoofnagle},

url = {https://dl.acm.org/doi/book/10.1145/3551664},

year  = {2022},

date = {2022-01-01},

urldate = {2022-01-01},

journal = {ACM TechBriefs},

publisher = {Association for Computing Machinery},

address = {New York, NY, USA},

abstract = {Quantum computers have garnered enormous interest and media attention because of their predicted ability to one day crack encryption algorithms that are widely used today. While such machines would have profound impacts within both the public and private sectors, they are not predicted to become a reality for at least a decade or, by some estimates, as many as forty years—if ever. By contrast, powerful quantum simulators are nearly a reality. Their practical applications could be just two years away.},

keywords = {National Security, Quantum},

pubstate = {published},

tppubtype = {article}

}

@article{vanburen2021,

title = {Fighting Insider Abuse After Van Buren},

author = {Bryan Cunningham and John Grant and Chris Jay Hoofnagle},

url = {https://www.lawfareblog.com/fighting-insider-abuse-after-van-buren},

year  = {2021},

date = {2021-01-01},

urldate = {2021-01-01},

journal = {Lawfare: Hard National Security Choices},

abstract = {We explain how tools we are familiar with from our various experiences supporting organizations trying to responsibly manage large-scale datasets could be employed to address legitimate threats—both from insiders (employees of an organization holding sensitive information) and outsiders (external hackers or others trying to steal intellectual property or otherwise improperly access information). Such tools are available now in multiple technology platforms, enabling owners of even the most sensitive datasets to manage users’ access to sensitive data; to quickly detect and block improper access; to deter unwanted uses of protected data; and, finally, to compel—or at least “nudge”—users to access systems responsibly. These tools enable institutions—from military and law enforcement agencies to local governments and private-sector companies—to protect sensitive data from misuse.},

keywords = {Cybersecurity, Deterrence Theory, National Security},

pubstate = {published},

tppubtype = {article}

}

@article{apple2021,

title = {The Apple Privacy Debate: Scanning Photos Is in Service of `Human Freedoms'},

author = {Chris Jay Hoofnagle},

url = {https://futureofsex.net/sex-tech/the-apple-privacy-debate-scanning-photos-is-in-service-of-human-freedoms/},

year  = {2021},

date = {2021-01-01},

urldate = {2021-01-01},

journal = {Future of Sex},

abstract = {Earlier this month, Apple announced that it will begin reporting users with excessive amount of Child Sex Abuse Materials (CSAM) to the National Center for Missing and Exploited Children (NCMEC). Apple software will scan the hashes of all photos stored in iCloud for matches to NCMEC's database. 

This move has stirred up controversy, as pro-privacy advocates claim that this could mark the end of Apple's dedication to user privacy. 

As part of the Future of Sex Expert Series, Chris Hoofnagle, Professor of Law in Residence at the University of California, Berkeley, explains why Apple's decision is nuanced, and possibly necessary.},

keywords = {Cybersecurity},

pubstate = {published},

tppubtype = {article}

}

@article{turow_hoofnagle_2019,

title = {Mark Zuckerberg's Delusion of Consumer Consent},

author = {Joseph Turow and Chris Jay Hoofnagle},

url = {https://www.nytimes.com/2019/01/29/opinion/zuckerberg-facebook-ads.html},

year  = {2019},

date = {2019-06-05},

urldate = {2019-06-05},

journal = {The New York Times},

publisher = {The New York Times},

abstract = {He said Facebook users want tailored ads. According to our research, that’s not true.},

keywords = {Privacy},

pubstate = {published},

tppubtype = {article}

}

@article{hoofnagle2019european,

title = {The European Union general data protection regulation: what it is and what it means},

author = {Chris Jay Hoofnagle and Bart Sloot and Frederik Zuiderveen Borgesius},

url = {https://doi.org/10.1080/13600834.2019.1573501 

https://www.tandfonline.com/doi/full/10.1080/13600834.2019.1573501},

year  = {2019},

date = {2019-01-01},

urldate = {2019-01-01},

journal = {Information & Communications Technology Law},

volume = {28},

number = {1},

pages = {65–98},

publisher = {Routledge},

abstract = {This paper introduces the strategic approach to regulating personal data and the normative foundations of the European Union’s General Data Protection Regulation (‘GDPR’). We explain the genesis of the GDPR, which is best understood as an extension and refinement of existing requirements imposed by the 1995 Data Protection Directive; describe the GDPR’s approach and provisions; and make predictions about the GDPR’s implications. We also highlight where the GDPR takes a different approach than U.S. privacy law. The GDPR is the most consequential regulatory development in information policy in a generation. The GDPR brings personal data into a detailed regulatory regime, that will influence personal data usage worldwide. Understood properly, the GDPR encourages firms to develop information governance frameworks, to in-house data use, and to keep humans in the loop in decision making. Companies with direct relationships with consumers have strategic advantages under the GDPR, compared to third party advertising firms on the internet. To reach these objectives, the GDPR uses big sticks, structural elements that make proving violations easier, but only a few carrots. The GDPR will complicate and restrain some information-intensive business models. But the GDPR will also enable approaches previously impossible under less-protective approaches.},

keywords = {GDPR, Privacy},

pubstate = {published},

tppubtype = {article}

}

@article{hoofnagle2019tethered,

title = {The Tethered Economy},

author = {Chris Jay Hoofnagle and Aniket Kesari and Aaron Perzanowski},

url = {https://www.gwlr.org/the-tethered-economy/ 

https://www.gwlr.org/wp-content/uploads/2019/10/87-Geo.-Wash.-L.-Rev.-783.pdf},

year  = {2019},

date = {2019-01-01},

journal = {Geo. Wash. L. Rev.},

volume = {87},

number = {4},

pages = {783},

abstract = {Imagine a future in which every purchase decision is as complex as choosing a mobile phone. What will ongoing service cost? Is it compatible with other devices you use? Can you move data and applications across devices? Can you switch providers? These are just some of the questions one must consider when a product is “tethered” or persistently linked to the seller. The Internet of Things, but more broadly, consumer products with embedded software, are already tethered. 

While tethered products bring the benefits of connection, they also carry its pathologies. As sellers blend hardware and software—as well as product and service—tethers yoke the consumer to a continuous post-transaction relationship with the seller. The consequences of that dynamic will be felt both at the level of individual consumer harms and on the scale of broader, economy-wide effects. These consumer and market-level harms, while distinct, reinforce and amplify one another in troubling ways. 

Seller contracts have long sought to shape consumers’ legal rights. But in a tethered environment, these rights may become nonexistent as legal processes are replaced with automated technological enforcement. In such an environment, the consumer-seller relationship becomes extractive, more akin to consumers captive in an amusement park than to a competitive marketplace in which many sellers strive to offer the best product for the lowest price. 

At the highest level, consumer protection law is concerned with promoting functioning free markets and insulating consumers from harms stemming from information asymmetries. We conclude by exploring legal options to reduce the pathologies of the tethered economy.},

keywords = {Antitrust Law, Competition Law, Consumer Protection},

pubstate = {published},

tppubtype = {article}

}

@article{hoofnagle2018facebook,

title = {Facebook in the Spotlight: Dataism vs. Personal Autonomy},

author = {Chris Jay Hoofnagle},

url = {https://www.jurist.org/commentary/2018/04/chris-hoofnagle-facebook-dataism/},

year  = {2018},

date = {2018-01-01},

journal = {JURIST - Academic Commentary},

abstract = {In this essay I explain the challenges the FTC faces in enforcing its 2012 consent agreement against Facebook and suggest ways it could nonetheless prevail. In the long run, everyone wins if our civil society institutions can police Facebook, including the company itself. While Facebook’s privacy problems have long been dismissed as harmless, advertising-related controversies, all now understand Facebook’s power over our broader information environment. After Brexit, the 2016 U.S. election, and violence in Myanmar, if consumer law fails, we risk turning to more heavy-handed regulatory tools, including cyber sovereignty approaches, with attendant consequences for civil society and internet freedom.},

keywords = {Privacy},

pubstate = {published},

tppubtype = {article}

}

@article{hoofnagle2018designing,

title = {Designing for Consent},

author = {Chris Jay Hoofnagle},

url = {https://escholarship.org/content/qt09h8k6ms/qt09h8k6ms_noSplash_79430ceb59aaf5daa0509a8ea07fe9d0.pdf},

year  = {2018},

date = {2018-01-01},

journal = {Journal of European Consumer and Market Law},

volume = {7},

number = {4},

pages = {162–171},

publisher = {Kluwer Law International},

abstract = {While the General Data Protection Regulation leans away from consent as a mechanism to justify the collection and use of personal data, consent remains a prime mechanism for protecting privacy and limiting marketing in the United States (U. S.). This article summarizes the difficulties businesses face in gaining high-quality consent and sets out the different consent standards in U. S. statutory law. In an exploratory effort, it then shows how companies have designed consent experiences for particularly privacy-invasive devices – home voice assistants and “smart” televisions – through testing and documentation of their function. The article then explains the quality of consent that U. S. law demands in different contexts, and elucidates the limits of consent as a privacy tool in light of the kinds of information-intensive devices that consumers are adopting.},

keywords = {GDPR, Privacy},

pubstate = {published},

tppubtype = {article}

}

@article{boerman2018sponsored,

title = {Sponsored Blog Content: What Do the Regulations Say: And What Do Bloggers Say},

author = {Sophie C Boerman and Natali Helberger and Guda Noort and Chris Jay Hoofnagle},

url = {https://www.jipitec.eu/archive/issues/jipitec-9-2-2018/4730/JIPITEC_9_2_2018_146_Boerman_et_al},

year  = {2018},

date = {2018-01-01},

journal = {J. Intell. Prop. Info. Tech. & Elec. Com. L.},

volume = {9},

pages = {146},

abstract = {Influencer marketing – the use of opinion leaders such as bloggers with many followers and readers to disseminate product messages – is gaining advertisers’ interest. This paper presents the law and self-regulative provisions concerning blog advertising in both Europe and the US and documents the actual practice of disclosing blog advertising: whether and if so how, bloggers disclose influences from advertisers, and how these disclosures align with the regulations in place. The Federal Trade Commission Act and related guides in the US, and self-regulative provisions in Europe urge advertisers and endorsers, such as bloggers, to disclose any commercial relationship. These disclosures should be clear and conspicuous because advertising to consumers should be recognizable as such. Although advertisers increasingly encourage bloggers to promote products, it is unclear whether bloggers comply with disclosure requirements. 

To test compliance with disclosure requirements, we performed a content analysis of 200 blog posts drawn from the top-20-ranked sites in the Netherlands and the United States. We found that 65% of the posts mention brands and products. Yet, only 15% of the blog posts provided some commercial sponsorship disclosure. To determine whether posts mentioning brands were organic, unsponsored endorsements, we made repeated attempts to contact authors. Of those that responded, most claimed that their writing was not sponsored, but a small number received remuneration and did not disclose it. Furthermore, among the disclosing bloggers, we found regular problems in their sponsorship disclosures: many only state ‘sponsored’ or ‘affiliated link’; only 1/3 stated the name of the actual sponsor; most require the users to “scroll down,”; and most are in the same font as ordinary text. Our findings raise several regulatory issues; namely, the need for more concrete guidance on disclosure format, and it highlights the difficulty of monitoring compliance with the existing provisions. In so doing, our findings also provide important input for the European Commission’s Regulatory Fitness and Performance exercise, which tackles, among others the Unfair Commercial Practice Directive.},

keywords = {Consumer Protection},

pubstate = {published},

tppubtype = {article}

}

@article{hoofnagle2018facebook2,

title = {Facebook and Google are the new data brokers},

author = {Chris Jay Hoofnagle},

url = {https://www.dli.tech.cornell.edu/post/facebook-and-google-are-the-new-data-brokers#},

year  = {2018},

date = {2018-01-01},

journal = {Cornell Digital Life Initiative Critical Reflections},

publisher = {Cornell Digital Life Initiative},

abstract = {Google and Facebook’s claims about data selling are as false as they are adamant. To understand why, one needs to change focus from the platform-advertiser relationship, and concentrate on developer-platform incentives. To grow their platforms, Google and Facebook reward developers—in effect, pay them—with personal information. But even experts in the field miss the point because information practices are opaque and misleading, and because most people experience platforms as consumers rather than developers.},

keywords = {Privacy},

pubstate = {published},

tppubtype = {article}

}

@article{perzanowski2016we,

title = {What We Buy When We 'Buy Now'},

author = {Aaron Perzanowski and Chris Jay Hoofnagle},

url = {https://scholarship.law.upenn.edu/cgi/viewcontent.cgi?article=9564&context=penn_law_review},

year  = {2017},

date = {2017-01-01},

journal = {University of Pennsylvania Law Review},

volume = {165},

pages = {315},

abstract = {This Article presents the results of the first study of the impact of marketing language like the Buy Now button on the beliefs and behavior of digital media consumers. Our data demonstrate that a sizable percentage of consumers is misled with respect to the rights they acquire when they “buy” digital media goods. They mistakenly believe they can keep those goods permanently, lend them to friends and family, give them as gifts, leave them in their wills, resell them, and use them on their devices of choice.},

keywords = {Consumer Protection},

pubstate = {published},

tppubtype = {article}

}