#wjlta

Technology, Law, and the Future: How Loper Bright v. Raimondo Could Impact Artificial Intelligence Governance

/ Washington Journal of Law, Technology & Arts / Leave a comment

By: Joseph Valcazar

The world was a very different place in 1984. Prince debuted his critically acclaimed Purple Rain album; The Terminator, Gremlins, and the Indiana Jones sequel dominated the box office; the future’s most popular video game, Tetris, was released; and, of course, the Supreme Court released its landmark Chevron v. Natural Resource Defense Council (Chevron) opinion. This case established the Chevron deference, a legal doctrine instrumental to the evolution of administrative law for over forty years. This doctrine was cited in more than 18,000 federal opinions. 

That was until 2024 when the current Supreme Court issued its opinion in Loper Bright Enterprises v. Raimondo (Loper Bright), effectively overruling Chevron. In an instant, the federal administrative state was turned on its head, leading to many questions about what the future holds for key administrative issues. And currently, there are few greater hot-button topics than artificial intelligence (AI).

What was Chevron Deference?

Chevron deference refers to a legal doctrine where courts afforded federal agencies, like the Food and Drug Administration or the Environmental Protection Agency (EPA), deference when interpreting ambiguous federal statutes. As long as these interpretations were deemed reasonable, courts would defer to the agency’s reasonable interpretation of the law, even when the courts may have preferred an alternative interpretation. 

For example, the dispute in the original Chevron case revolved around whether the term “source” in the Clean Air Act applied to individual equipment that emitted air pollution—such as smokestacks or boilers—or only to industrial plants on a whole as a source of pollution. The EPA interpreted “source” to cover the latter, allowing industrial plants to modify individual pieces of equipment without a permit so long as the total emissions of the plant did not increase. In a unanimous decision, the Supreme Court held the EPA’s interpretation to be reasonable, deferring to the agency and future agency interpretations and thus creating Chevron deference. 

This doctrine guided administrative action for forty years, influencing how Congress drafted its legislation. As Justice Kagan pointed out in her Loper Bright dissent, Congress would intentionally leave vague or ambiguous terms for agencies to resolve. Such as directing the Federal Aviation Administration to restore the “natural quiet” of the Grand Canyon National Park. 

Then Loper Bright happened. In one broad swoop, the Supreme Court overruled this long-standing precedent, or as Justice Gorsuch squarely put it, “[t]oday, the Court places a tombstone on Chevron no one can miss.” As a result, administrative law has entered a state of limbo. With deference removed, it is now up to the court’s independent judgment to decide when an agency has acted within its proper authority. There is no longer a barrier restricting courts from interjecting their own potentially conflicting interpretations of administrative statutes. Critics of Loper Bright express concerns that judges, who lack subject matter expertise on many complex matters, will create inconsistent rulings across jurisdictions. They worry this may lead to more confusion and uncertainty surrounding agencies’ authority. 

If true, these concerns have significant implications for an agency’s ability to react to novel technologies such as AI.

What’s the 101 on AI? 

To describe AI in simple terms, it is a form of technology that can perform advanced tasks and reach conclusions as a human would. This technology has experienced rapid growth in recent years. AI will seemingly touch every area of our lives. Whether it’s within your own home refining your Google search results, in healthcare as a tool to diagnose illness, or in business to automate key processes, AI is being widely adopted to reshape every aspect of our lives. This is not to say every use of A.I. is popular, or without its share of controversy. Examples, such as the use of AI in insurance denial claims, are just one of many reasons why some believe the ability to regulate AI is essential. Without proper governance of AI, privacy risks, system biases, and transparency concerns will exist, and what could be a net good could just as quickly become a net negative that abuses the public’s information. 

How Can Agencies Respond to Loper Bright?

With the complexity of AI, questions arise on how federal agencies should approach regulating such a novel technology. The answer is unclear in the wake of Loper Bright. Agencies may still interpret broad or ambiguous statutes; Loper Bright did not eliminate this power. However, actions related to AI and other hot-button issues will likely receive higher scrutiny from potential plaintiffs, leading to more litigation. Agencies may consider this fact when planning to issue new regulations. This could cause them to act more cautiously or strategically and thus respond less effectively to rapidly emerging issues.

Agencies may lean on issuing more guidance documents and statements that explain new regulations or clarify existing policy. However, these are not legally binding and non-enforceable. One advantage of this fact is that not every guidance document is currently subject to judicial review. Therefore, these guidance documents could be strategically utilized to advocate for specific policy positions without facing the scrutiny that a typical regulation would face. 

One pitfall of this strategy is that guidance documents are relatively limited in scope. In Appalachian Power Co. v. Environmental Protection Agency (EPA) (2000), the D.C. Circuit Court held that the EPA had improperly issued a guidance document because the guidance had the effect of a binding ruling on private and state actors. This case highlights how courts often do not enjoy attempts to evade judicial review. If agencies rely more on issuing guidance documents going forward, a likely outcome is courts choosing to exercise greater scrutiny over these documents to reduce any apparent workaround of Loper Bright. 

Conclusion

It’s unclear right now how agency actions will evolve in a post-Chevron world. The only thing that appears certain is that litigation will follow. The power paradigm between the judicial and executive branches has rapidly and significantly shifted. At a time when the private sector has just announced a $500 billion investment in AI, there are no signs that this emerging technology has any plans of slowing down. The next few years of governance will be critical in determining Loper Bright’s long-term effect on AI regulation. 

While this blog has focused primarily on the administrative state and its ability (or now lack thereof) to regulate this novel technology, agencies are not the only mechanism of governance that exists. As always, the legislature can draft and pass legislation regulating AI and its implementation. However, given Congress’s recent and current inefficiency, meaningful legislation around AI seems slim.

How Trademark Lawsuits Are Tackling Fake Merchandise

/ Washington Journal of Law, Technology & Arts / Leave a comment
Photo by Zachary DeBottis on Pexels.com

By: Teagan Raffenbeul

Counterfeit products have existed for thousands of centuries, with counterfeit currency dating back to 3300-2000 BC. Over time, counterfeiting has grown significantly, with its economic cost estimated to exceed trillions of dollars. As e-commerce has grown, so too has the availability of counterfeit products, including fake merchandise claiming to be endorsed by musical artists. Online marketplaces like Amazon and Etsy have enabled individuals to create and sell products using images of or related to famous individuals. 

In 2023, a fan of country singer Luke Combs created and sold tumblers adorned with Comb’s face on Amazon. The fan, Nicol Harness, sold eighteen of her Combs-themed tumblers, earning only $380. Nonetheless, she was included in a mass lawsuit filed against more than 200 online entities selling unauthorized Combs merchandise. Harness was ordered to pay $250,000 in damages, and her Amazon account was frozen – all before she had notice of the anti-counterfeiting lawsuit. Regardless of whether Harness knew she was infringing on Combs’ intellectual property rights, the products were still counterfeit and could be subject to lawsuits for violating an artist’s intellectual property rights. 

Anti-Counterfeiting Enforcement

Two federal statutes primarily govern anti-counterfeiting enforcement in the United States. The Lanham Act provides civil remedies, while the Trademark Counterfeiting Act of 1984 imposes criminal penalties for violations of the anti-counterfeiting provisions in the Lanham Act. Due to various impracticalities of criminal enforcement, such as timing constraints, trademark owners typically turn to civil trademark infringement lawsuits for relief. 

Counterfeit merchandise is deemed “counterfeit” because it infringes on a valid, registered trademark owned by an artist or another party. A trademark is a symbol that indicates the source of a product to purchasers. Trademarks may present themselves in the form of names, logos, colors, or symbols. For musical artists, their trademarks signal to fans that they endorse the product and officially license it. When an artist’s trademark appears on products they did not create or endorse, it can mislead and confuse fans and consumers into believing the artist is the actual source of the product, even when they are not. Even if a product contains a disclaimer stating the merchandise is merely inspired by the artist, it does not automatically protect the merchandise from receiving a cease-and-desist letter or facing a counterfeit lawsuit. Artists will often strategically choose which cases to litigate, balancing the negative publicity from suing fan-made merchandise against the necessity of taking action against enough infringing products to protect their trademark rights. Factors such as the similarity of names and products, as well as how well-known the infringed trademark is, are usually considered, with direct copies of artists’ own merchandise often purposely targeted.

Anti-counterfeiting lawsuits have a higher standard than the “likelihood of confusion” standard used in traditional trademark infringement cases. The Lanham Act defines a counterfeit mark as “a spurious mark which is identical to or substantially indistinguishable from a registered mark.” This requires a higher degree of similarity, with marks needing to be “identical” to be successful in a counterfeit lawsuit. 

Additionally, when filing a civil counterfeiting case, most plaintiffs will request an ex parte temporary restraining order (TRO). These TROs may be granted without prior notice to the alleged counterfeiter and they immediately remove the counterfeit items from the market. The TROs also prevent the alleged counterfeiters from disposing of or destroying evidence of the counterfeit items.

“SAD Schemes”

Due to the increase of e-commerce in the last decade, an influx of counterfeit merchandise has become easily accessible online. In response, several U.S. law firms, particularly in Chicago, have begun initiating mass anti-counterfeiting trademark lawsuits, targeting hundreds of merchandise sellers simultaneously. The uniformity found between anti-counterfeiting enforcement suits has led to these types of lawsuits being labeled by some people as “SAD Schemes.”

These mass lawsuits have been coined “SAD Schemes” or “Schedule A Defendants” schemes because plaintiffs typically file the complaint separately from a sealed Schedule A attachment. The plaintiff usually identifies a group of online vendors whose listed products infringe on their intellectual property rights and includes them on a Schedule A attachment. The complaint refers to these vendors as “defendants listed on a Schedule A,” and the judge then seals the Schedule A, keeping the defendants’ identities anonymous. The complaint itself generally includes a few factual allegations that are not particularized to any one defendant. Following this, plaintiffs frequently request an ex parte TRO to freeze the defendants’ assets and activity in the marketplace. 

These lawsuits are often filed by large brands such as Nike and Ray-Ban, however recently they have increasingly been applied to fight counterfeit merchandise. In 2022, the rock band Nirvana sued approximately 200 different sites for selling counterfeit products. The following year, pop artist Harry Styles filed a massive Schedule A trademark suit to combat the increasing quantity of counterfeit merchandise populating online stores. 

Downsides of “SAD Schemes” 

SAD Schemes are often filed under the presumption that the “counterfeiters” are difficult to locate and trace due to the nature of e-commerce. As a result, judges frequently permit email service. This provides plaintiffs a significant advantage, as many defendants are often not aware they have been legally served. Many defendants never see the email, as was the case in the Combs lawsuit, where the email was sent to the fan’s junk mail. Some defendants have said they have mistaken it for spam mail or an extortion attempt, and therefore disregard the email. Due to issues such as these, judges generally do not permit email service in ordinary cases. However, in SAD Schemes, when cases are filed under the presumption the alleged counterfeiters are anonymous online merchants who are difficult to track down, judges allow it. As a result, defendants’ funds are often frozen, and many default judgments have been rendered without any opposition from the defendants.

Lawyers utilizing SAD Schemes typically follow a standardized template with minimal factual allegations allowing them to easily “clone-and-revise” the complaint for future lawsuits. This streamlined approach, combined with the ability to target hundreds of defendants at once, saves plaintiffs significant time and money while also enabling lawyers to quickly process multiple cases. SAD Schemes can unfold in just a few days, resulting in a somewhat lucrative business for intellectual property firms. By leveraging Schedule A forms that keep defendants’ identities hidden and relying on the fact that most alleged counterfeiters are either unaware of the lawsuit or unwilling to fight back due to the expensive and time-consuming nature of the lawsuits, these lawyers and law firms have begun to turn it into a volume business. Over the past decade, this field has seen the number of Schedule A anti-counterfeiting trademark lawsuits rise from 105 to 938, with over 600,000 defendants having been sued.

SAD Schemes are a relatively new type of lawsuit. There is limited precedent, and district courts have taken various approaches in interpreting the statutory language and applying relevant terminology such as “counterfeit” and “counterfeiting.” This has resulted in some inconsistencies and confusion among existing case law. In the future, we can likely expect to see a continued rise in counterfeit merchandise and a rise in lawsuits by these artists to protect their intellectual property rights, hopefully providing more clarity and information on how anti-counterfeiting enforcement is executed.

Bad Beat: Iowa Gambling Probe Allegedly Violated Student Athletes’ Constitutional Rights with Warrantless Geofence

/ Washington Journal of Law, Technology & Arts / Leave a comment

By: Sam William Kuper

“I hope all of these athletes at Iowa (UI) and Iowa State (ISU) take the State of Iowa to the cleaners.” UI men’s wrestling coach Tom Brands did not mince words describing the recent fallout from actions taken by the Iowa Division of Criminal Investigation (DCI) against student athletes. Last year, over a dozen student athletes and students at UI and ISU were criminally charged and some were suspended by the NCAA under suspicion of illegal sports gambling. However, a recent motion by defendant Isaiah Lee, a former ISU football player, alleges that the  charges were a result of an unconstitutional “warrantless search.”

Initial Investigation

Back in May of 2023, the DCI initiated an investigation of UI and ISU student athletes suspected of sports gambling in violation of state and NCAA rules. 25 current or former UI and ISU athletes and student managers were charged because of the investigation. Many for “tampering with records”—an aggravated misdemeanor that carries a maximum sentence of up to two years in prison—for allegedly falsifying personal electronic sports wagering records by utilizing the accounts of others to place sports bets. 16 pleaded guilty, with most pleading guilty to the lesser charge of underage gambling. Some of those charged were subsequently suspended by the NCAA, with different punishments depending on whether their wagers were on their own games or that of other sports or schools. For example, Isaiah Lee faced permanent ineligibility for placing a bet against his own team in a game where ISU beat Texas 30-7.

Alleged “Warrantless Search”

Isaiah Lee’s January 22nd Motion to Compel outlines his version of the facts. First, it is important to understand that gambling companies such as FanDuel and DraftKings must verify the location of their mobile users to make sure they are in a jurisdiction where sports gambling is legal. They do so via the company GeoComply, who act as the “custodians of data and processing” on behalf of their customers.

In December of 2022, Special DCI Agent Brian Sanger was given access to GeoComply’s data visualization and data analytics tool, Kibana. He used the software tool to place a “Geofence”—a virtual fence on a desired geographic area that reveals data of users within that area—around an athletic facility at UI where access is restricted to athletes, coaches, and support personnel. After he found gambling apps were opened inside the geofence, he requested subpoenas to obtain identifying account and bet information—leading to criminal charges for the student athletes.

According to the motion, Sanger did not remember why he initiated the search, but that he was “concerned about things such as people infiltrating Iowa’s sports team to gain insider information or match fixing.” However, he apparently did so without “warrant[s], tips, complaints, or evidence that illegal gambling was occurring.” The purpose of the discovery motion is to compel the State to disclose the circumstances and communications surrounding how and why Sanger and the DCI came to be in use of Kibana, and the types of searches he performed with it. For context, GeoComply’s website states they only comply with data requests from law enforcement if it is “legally binding and valid.”

What is a Fourth Amendment regulated search?

The Fourth Amendment of the U.S. Constitution protects people from unreasonable searches and seizures by government actors (like Sanger). The modern “reasonable expectation of privacy” or “REP” test as to whether Fourth Amendment protections apply was stated in Justice Harlan’s concurrence in Katz v. United States (1967): (1) the person must have exhibited an actual (subjective) expectation of privacy; and (2) that expectation must be one that society is prepared to recognize as “reasonable.” If these requirements are met, then the Fourth Amendment applies and the government needs a warrant based on probable cause to search.

However, under the “third-party exposure doctrine,” a person has no legitimate expectation of privacy in what they knowingly expose to the public or third parties. For example, the Supreme Court has held that there is no REP in garbage left on the curb of your home for pickup. But this standard has been heavily controversial in the digital age, as modern consumers often “reveal a great deal of information about themselves to third parties”—such as Google, Facebook, and their cell phone providers. In the landmark case Carpenter v. United States (2018) a 5-4 court declined to extend this doctrine to tracking cell-site location information for longer than seven days—suggesting that users have a reasonable expectation of privacy in their location history despite its disclosure to parties like Google. In addition, the court held in Kyllo v. United States (2001) that “[w]here . . . the Government uses a device that is not in general public use, to explore details of the home that would previously have been unknowable without physical intrusion, the surveillance is a ‘search’ and is presumptively unreasonable without a warrant.” There, the government unconstitutionally used a thermal imaging device to scan the defendant’s home for heaters used in growing marijuana without a warrant. 

Did the student athletes have a REP?

The question of whether student athletes like Isaiah Lee are protected by the Fourth Amendment is complicated. While the first prong of the REP test is uncontroversially met, the second prong, along with the third-party exposure doctrine, raises many questions.

For example, what kind of location data was used? GeoComply’s website says they collect GPS, GSM, Wi-Fi, and IP Address data from the user’s device to verify location accuracy. Many universities, like UW, have a policy of turning over evidence of illegal activities on their network as soon as possible after detection. Thus, one would likely not have a REP of illegal activities while on UW’s network (however, UI does appear to have a greater level of privacy protection). But if, by chance, GeoComply only used GPS data, and the students were using solely their cellular network to access the gambling applications, there would likely be a stronger argument in favor of a REP.

With the alleged facts we have as of now, this case resembles Kyllo. The government used “a device that is not in general public use” (geofence software Kibana) “to explore details of the home that would previously have been unknowable without physical intrusion” (whether mobile phones in dorms and athletics facilities accessed gambling apps) without a warrant supported by probable cause. The debate is whether a public school’s dorms and athletics facilities should carry the same level of protection as a home.

What would be the remedy?

If the court finds Sanger’s use of the geofence software to be unconstitutional, the remedy would be the “exclusionary rule.” This would prevent the government from using the evidence gathered, along with any evidence gathered because of the original evidence (such as the identifying account information gathered because of the original geofence) in criminal prosecution. Thus, all the currently pending UI and ISU cases would likely be dismissed. But could the students then bring a civil action against Sanger under 42 U.S.C. 1983 for compensatory damages (such as lost wages from being suspended by the NCAA)? That is an entirely different question.

Sand Trap: The Future of the PGA Tour’s Nonprofit Status

/ Washington Journal of Law, Technology & Arts / Leave a comment

By: Sam William Kuper

“Saudi Arabia’s sovereign wealth fund” is not a collection of words typically linked to tax-exempt nonprofits. However, that is exactly who stands to benefit from the century-old 501(c)6 Internal Revenue Code when the PGA Tour and LIV Golf complete their tentative agreement to merge in 2024. But is this merger and the PGA Tour’s planned continued use of its tax exemption as necessarily bad—or even evil—as many politicians are saying they will be?

Money Talks

Led by Chairman Crown Prince Mohammed Bin Salman (de facto leader of Saudi Arabia) and Governor Yassir Al-Rumayyan (former chairman of Saudi Arabia’s national oil company, Aramco), Saudi Arabia’s Public Investment Fund (“PIF”) has over $700 billion USD in assets and is seen as a cornerstone for the development of Saudi Arabia’s Vision 2030 project. Starting in 2014, PIF began investing and reaching beyond Saudi Arabia’s borders to extend its influence and investment opportunities. From stakes in Silicon Valley sweethearts Uber and WeWork(oof) to video game icons Electronic Arts and Activision Blizzard, PIF has become an investment hegemon. Its next goal? Dominating international sports.

Coined “sportswashing,” PIF has used its immense wealth to insert itself into the world’s most popular sports in an attempt to bolster its reputation and hide from Saudi Arabia’s awful human rights record. They bought a middling Premier League soccer team and infused it with cash. They backed Formula One races in Saudi Arabia, headlined by post-race concerts from Travis Scott, Charlie Puth, and Calvin Harris. PIF’s crown jewel, however, was its introduction of LIV Golf in October of 2021.

(Don’t) Pay for Play

For the better part of a century, the PGA Tour has been the preeminent golf league in the world. In 2021, it hosted 113 tournaments in 36 U.S. states and 10 countries, with about 200 golfers competing for $765 million in prize money. It generated over $1.59 billion in revenue and paid executives over $30 million—with Commissioner Jay Monahan raking in $13 million. The catch? They have been a 501 (c)6 tax-exempt nonprofit since 1977.

Initially enacted within the 1913 Tariff Act, 501(c)6 organizations (in comparison to 501(c)3) are organizations that share a common business interest. Their purpose is to promote that interest for the benefit of their members, and “not to engage in a regular business of a kind ordinarily carried on for profit.” In return, they must publicly file a 990 form disclosing their finances—including their sources of funding, charitable donations, and payments to executives.

The PGA Tour was not alone in claiming this exception amongst its peers. In 1966, the Tariff Act was amended to include “football leagues” when the National Football League (NFL) merged with a competitor. Major League Baseball (MLB) and the National Hockey League (NHL) also claimed nonprofit status in the decades following. But while the MLB, NHL, and NFL have all discarded their non-profit status in recent years, the PGA Tour has remained steadfast—mostly because their players are individual contractors and not member teams who make their own profits from ticket sales, merchandise, etc.

By co-sponsoring tournaments with 501(c)3 charities (such as the FedeEx St. Jude Classic), the PGA Tour provides a platform for raising money. However, a 2013 ESPN report flamed the PGA Tour for donating just 16% of its revenue from tournaments on average to charities—the industry standard is 65%—and in one case, caused a charity to lose money.

Pitching the Wedge

Documents prepared for PIF by Mckinsey & Company—known to hold authoritarian governments as clients—advised that LIV needed to lure the top 12 players in the world from the PGA Tour to be profitable. They managed four. Nicknamed “Project Wedge,” LIV’s launch was met with expected criticism. Signing stars like Phil Michelson, Dustin Johnson, and Bryson DeChambeau to massive contracts, the PGA immediately banned them from future Tour events. Commissioner Monahan publicly admonished these players, saying that he “would ask any player that has left, or any player that would consider leaving, ‘have you ever had to apologize for being a member of the PGA Tour?’” In its first season, LIV spent $784 million on 8 events. Their revenue was “virtually zero.”

But despite LIV’s flop, they persisted—and the golf world was thrown into further chaos. The 11 banned golfers sued the PGA Tour for antitrust violations and the PGA counterclaimed for tortious interference. The Justice Department launched its own antitrust investigation into professional golf. But in May of 2023, over breakfast near Palazzo Ducale in Venice, Monahan and Al-Rumayyan came to terms with what, in hindsight, was likely inevitable.

Big Beautiful Deal

The announced agreement, described by former President Trump as “big, beautiful, and glamourous,” would combine the European Tour, LIV Golf, and the PGA Tour into one, new for-profit entity that would control the PGA’s commercial rights. The PGA Tour would retain its nonprofit status and control over how tournaments are played. LIV would reserve the exclusive right to invest in the company. Al-Ramyan would be the Chairman. All lawsuits would be dropped. Almost immediately, two Senate committees launched investigations into the merger so they could assess the “risks associated with a foreign government’s investment in American cultural institutions, and the implications of this planned agreement on professional golf in the United States going forward.”

“Golf is a sport in which players call penalties on themselves, whether an infraction is visible to others or not” – PGA Tour mission statement

“Any hypocrisy I have to own.” Jay Monahan, in walking back his initial comments about players leaving for LIV, reiterated that he felt like the merger was best for golf. But it is without a doubt problematic. From Saudi Arabia’s connection to 9/11 to the 2018 killing of Washington Post journalist Jamaal Kashoggi, there is no good way to frame Saudi involvement in American sport.

But here are the facts. The PGA Tour has raised $3.6 billion for charitable donations since 1938, and $1.6 billion since 2014. In 2021, it generated $173 million, or about 12% of total revenue—just 8 million away from cracking the top 100 of the most charitable organizations in the U.S. The NFL Foundation, in contrast, gave away $70 million in 2022, or about .5% of the NFL’s total revenue. Patagonia, who was widely praised for shifting ownership to a nonprofit and dedicating 100% of its profits to environmental causes, still gives away only about 6.6% of its revenue.

We still do not know much about the details of the merger or the future of the PGA Tour as a nonprofit. But if the PGA Tour either decides or is forced to give up its nonprofit status, it will no longer be required to publicly disclose its finances. With Al-Rumayyan serving as the chairman for the new joint entity, and PIF’s reputation for a lack of transparency, this would likely not be an optimal outcome.

Saudi Arabian investment in American culture is not coming—it is already here. But its benefits here of providing consistent wages for all professional golfers, making the game more available across the globe, and ultimately raising more money for charities, may be worth it. We should push for clarity, disclosure, and charitable giving when we can, in whatever form that may take.

Plugging-in Your EV? More Like Plugging-in Your Data.

/ Washington Journal of Law, Technology & Arts / Leave a comment
NREL,-owned electric vehicles (EVs) below solar by U.S. Department of Energy is licensed under CC-CC0 1.0

By: Caroline Dolan

As global warming and ecological degradation progress, sustainable technology and infrastructure is being implemented to remediate and prevent aggravation. However, electric vehicles (EVs), which are an effective way to curb carbon emissions and boost green efforts, pose a unique set of privacy risks every time we plug-in.

The data transaction: Plugging-in

EVs are dependent on EV chargers and for the majority who do not have the capacity to charge at home, public chargers are a necessity. Public EV chargers are essentially an Internet of Things (IoT) device that facilitate the transaction of data for kilowatts. Information involving pricing, session date, time, duration, and power patterns is collected and sent to the operator’s network. Furthermore, most chargers are affiliated with a mobile-app or use a radio-frequency identification card (RFID) implicating your phone as another data source sharing payment information, names, emails, IP addresses, and internet history. In order for an app to make the consumer experience more convenient and recommend the nearest charger, location identification is necessary. However, Certified Information Privacy Professionals have reported how this data can be used to pinpoint your location and predict your typical driving route. 

Sharing and collecting this information can make life a lot more convenient and does not seem to pose any imminent risks of harm. However, every public charger is connected to a grid and whether it is a closed or open network, there is always a risk of ransomware attacks, ID fraud, and grid damage. The Cybersecurity and Infrastructure Security Agency defines ransomware as “a form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption.” As described by privacy professionals, closed networks relate to a certain set of manufacturers who have discretion and unrestricted authority to use the data and create profiles; open networks tether multiple manufacturers which decreases each manufacturer’s control but gives more stakeholders access increasing your data’s vulnerability. In other words, while there is not an imminent risk of harm, there is a perpetual risk.

An EV economy

As the Wall Street Journal reported, “Modern vehicles are effectively connected computers on wheels. They’re able to collect a wealth of information via built in apps, sensors, and cameras, which can monitor people both inside and near the vehicle.”

Whether the data originates from the user’s personal device connected to the EV or solely through the charging equipment, the data is ripe for hackers, car manufacturers, insurance companies, and emergency service providers. While such data can help urban planners determine the optimal areas for development and economic profit, it can also inform insurance companies on how to set rates based on driving risk and behavior. More importantly, the Wall Street Journal has recognized that if data brokers obtain and sell the data, even with personal information redacted, movements and habits are individualistic and may provide insight into one’s identity.

Well-intentioned green policy may be getting ahead of itself

President Biden’s goal of boosting U.S. EV production is being achieved through his Made-in-America EV charging network initiative which is supported by the Department of Transportation’s National Electric Vehicle Infrastructure (NEVI) program. NEVI is distributing $5 billion into various EV programs to create a coast-to-coast network of EV chargers and electrify the highway system. However, these good intentions may be putting the cart before the horse since privacy risks of EVs have yet to be adequately and uniformly regulated.

Notably, the Federal Highway Administration (FHWA) has imposed a set of requirements on NEVI fund recipients stated in its “final rule.” The final rule consists of network connectivity requirements that ensure secure payment processing and minimize the amount of personal information that companies may retain. While these efforts seek to safeguard data and promote transparency, the final rule essentially requires merely “appropriate” data protection and gives states the discretion to determine the means. 

California is one state that is addressing the privacy concerns raised by the EV boom. California’s newly approved Electric Vehicle Infrastructure Deployment Plan cites the state’s Senate Bill 327 which requires a manufacturer of a “connected device” to equip the device with reasonable security features based on the nature and function of the device. From a legal perspective, the reference to SB-327 indicates that EV chargers may constitute a “connected device” and therefore warrant reasonable and appropriate security features and protection. 

However, state regulations are not an adequate shield from the broad destruction of a cyberattack. Therefore, some EV charger companies like ChargePoint have adopted internal regulations and earned certifications from the International Organization for Standardization (ISO) based on its comprehensive  information security and cyber-risk management. ChargePoint is a predominant U.S. company that supplies EV charging stations across North America as well as Europe and is therefore subject to Europe’s General Data Protection Regulation (GDPR). The GDPR controls the collection, use, and storage of personal data as well as the conduct of non-EU companies that possess the data of EU residents and citizens. While it seems unlikely that the U.S. will implement a federal law akin to the GDPR, California and ChargePoint may prompt other states and companies to implement regulations that supplement FHWA’s final rule.

Will supporting EVs come at the cost of our privacy?

While it is difficult to encourage people to undertake the risks posed by EVs, even for the sake of curbing carbon emissions; the Earth is a finite resource and without it our privacy is moot. Therefore, people should not be discouraged from purchasing an EV or plugging-into a public charger. Rather, the government and individuals should be compelled to hold corporations accountable for how data is stored and used so that we may plug-in without fear. As the effects of global warming become more apparent, embracing corporate accountability and privacy protection is critical in order to keep up with the EV boom and conserve the Earth.