I’m really enjoying it because, for a long time, I’ve been trying to understand why affordability is such a challenge in California. I have my own priors, and as a center-right person, I wonder if they are leading me astray. Seeing what progressives like Thompson and Klein have documented is a real eye-opener.

Below are some interesting insights I pulled from the book regarding California’s housing costs. These are just excerpts, without any analysis on my part, but they do track with a recent CalMatters deep dive on the topic.

Subscribe now

The authors attribute the high cost of housing in California, generally, and in Los Angeles specifically, to a “supply problem” driven by anti-growth regulations, restrictive zoning, environmental litigation, and a bureaucratic culture that prioritizes process over outcomes.

1. California Generally:

There Is A Severe Supply Side Shortage Caused By Policy Choices:
The authors argue that housing prices are high simply because there are not enough homes to meet demand, a condition they describe as “chosen scarcity.”

“First and foremost, far less housing has been built in California’s coastal areas than people demand.” (Citing the California Legislative Analyst’s Office).

“In the 1950s and 1960s, California routinely built more than 200,000 homes each year. Since 2007, California has never once permitted more than 150,000 new homes.”

“Zoning regulations in liberal states and cities that restrict housing supply have increased costs far more than the recent influx of immigrants.”

The Shift from Growth to Anti-Growth (The “Petaluma” Model):
The authors trace a historical shift where California moved from welcoming development (the “Lakewood” model) to restricting it through growth caps and boundaries (the “Petaluma” model).

“Today, California is more Petaluma than Lakewood... the city became famous for stopping growth rather than for welcoming it.”

“Anti-growth politics could, and often did, tip into a kind of misanthropy aimed at newcomers.”

Weaponization of Environmental Laws (CEQA):
The authors argue that well-intentioned environmental laws, specifically the California Environmental Quality Act (CEQA), have been repurposed to stop housing construction.

“CEQA became a potent weapon against the construction of new homes. ‘Between 1972 and 1975, twenty-nine thousand proposed homes in the Bay Area... were subject to environmental litigation.’”

“A lobbyist for the Sierra Club put it, CEQA now covered ‘anybody engaged commercially in putting two sticks of wood together.’”

Excessive Regulations and “Everything-Bagel Liberalism”:
The authors describe a regulatory environment where too many requirements are piled onto projects, making them prohibitively expensive.

“The standards in California are higher than anywhere else in the country. And you’re not just required to build to the standard, you also need to hire a consultant to confirm you’ve built to the standard. That adds costs.”

2. Los Angeles Specifically

Anemic Permitting Rates:
The authors highlight Los Angeles’s failure to permit enough housing relative to its population compared to other cities.

“Los Angeles’s and San Francisco’s metro areas permitted only 2.5 units per 1,000 residents.” (Page 33, contrasting with Austin’s 18 units).

“’In Los Angeles, fewer homes were built in the seventies than in the sixties, fewer in the eighties than in the seventies, and fewer in the nineties than in the eighties, even as the city’s overall population grew.’” (Page 37)

Bureaucracy and Funding Complexity (Prop HHH):
Using the Prop HHH bond measure as a case study, the authors attribute high costs to a “beast” of regulations and complex funding structures that delay projects.

“A 2022 audit found the units cost, on average, around $600,000, almost twice the cost of the median sale price for a home in Houston.”

Ron Galperin, former LA City Controller, states: “’If you look at the inflated cost that comes along with all of the regulations and rules and restrictions... basically all of this money is going to feed the beast of covering the cost of the regulations.’”

“We had thirty-eight unique funding sources coming in when I was there... and each of those had annual or biannual audits.”(quoting Heidi Marston)

Local Opposition (NIMBYism):
Specific examples in Los Angeles, such as the Venice Dell Community project, illustrate how local homeowners use lawsuits and parking complaints to stall affordable housing.

“The development is being fought and even sued by a collection of local homeowners who complain that ‘Venice desperately needs this parcel to address our chronic parking shortage’...”

Surviving local opposition often means agreeing to a range of demands that send costs ballooning... developers hire pricey architects, redo plans repeatedly... hire extra lawyers and auditors.”

These are brief excerpts that I organized for quick reference and easy sharing. They do not reflect the full depth of the book. I am finding the book valuable and recommend it to anyone interested in government reform.


* above means that’s an affiliate link; buy their book and make me rich, a few pennies at a time. 😂

Back in 2024, the Federal Trade Commission finalized its so-called “click-to-cancel” rule—an expansive regulatory effort that would have forced businesses to create cancellation processes for subscriptions that were as easy as signing up. The FTC claimed this rule was necessary to combat negative option marketing schemes, a term used for recurring subscriptions that consumers allegedly forget to cancel. However, as I argued at the time, and as industry groups rightly pointed out, this rule wasn't just burdensome. It was procedurally flawed and legally indefensible.

Now, the Eighth Circuit Court of Appeals agrees. In a sweeping decision issued on July 8, 2025, the court vacated the FTC’s rule in its entirety, citing the agency’s failure to follow statutory rulemaking procedures mandated by Section 22 of the FTC Act. (Bloomberg Law coverage)

FTC Skipped their Required Processes

When a federal agency promulgates a rule expected to have an annual economic impact of over $100 million, the law requires it to publish a preliminary regulatory analysis for public comment. This step ensures that interested stakeholders—especially small and mid-sized businesses—have a meaningful opportunity to weigh in on the economic implications and propose alternatives.

Instead, the FTC claimed (without real evidence) that its rule wouldn’t cross the $100 million threshold. But after informal hearings before an administrative law judge in early 2024, even the FTC’s own ALJ found that the rule’s costs would almost certainly exceed that amount. Still, the agency plowed ahead, skipping the preliminary analysis and proceeding directly to the final one.

That shortcut violated the law.

Why Procedure Matters

The Eighth Circuit made clear that procedural safeguards aren’t technicalities—they are essential to good governance. In the court’s words, failing to comply with statutory requirements "could open the door to future manipulation of the rulemaking process" by allowing agencies to lowball economic estimates and avoid early public scrutiny.

And this wasn’t harmless error. The court found that industry groups were deprived of the opportunity to meaningfully engage with the FTC’s assumptions, cost-benefit calculations, and possible alternatives. That’s not a bureaucratic foot fault—it’s a due process failure.

Subscribe now

Industry-Wide Overreach

Beyond the procedural missteps, the FTC’s rule would have imposed sweeping mandates on every sector of the economy. As the U.S. Chamber of Commerce and dozens of trade associations pointed out, the rule tried to apply a one-size-fits-all framework to more than 200 million consumer and business contracts. It offered vague requirements like “equal dignity” cancellation mechanisms and attempted to generalize from a small subset of complaints to the entire American economy.

That’s not targeted consumer protection—it’s regulatory overreach.

What’s Next?

The court didn’t need to reach the merits because the FTC’s process was so flawed. However, the strong language in the opinion suggests skepticism about the agency’s attempt to bypass its rulemaking authority. The FTC could try again, but it will now need to start from scratch, with full transparency and proper economic analysis.

This case is a reminder that good intentions don’t excuse bad process. And it underscores why independent judicial review remains a critical check on regulatory power.

Share

The European Union’s Artificial Intelligence Act is poised to impose a significant compliance burden on companies while offering little in the way of clear benefits. As Bloomberg’s Isabel Gottlieb reports, the first provisions of the Act take effect on February 2, including a ban on certain high-risk AI uses and a sweeping requirement that companies train employees on AI literacy. While the law’s intentions might be noble, its ambiguities and burdensome requirements will likely create more confusion than clarity.

Just look at the “four point” summary of the Act provided by the European Future of Life Institute; that summary itself is eleven sub-bullets of legal and bureaucratic word salad — not through any fault of the Institute summarizing the Act, but instead because the words in the Act all require additional interpretation. Great for lawyers and consultants, not so great for innovation:

Regulation Without Guidance

One of the key concerns companies face is the lack of detailed guidance on how to comply. The European Commission aims to publish clarifying guidelines on prohibited uses, but key threshold questions remain as undefined concepts. As an example, the Act’s ban on AI that exploits vulnerabilities, uses subliminal techniques, or engages in social scoring may sound reasonable, but without clear definitions, companies are left guessing what compliance actually entails.

In fact, that screenshot above showing the “four point summary” is only the beginning, a high level summary of the act weighs in at 2,000+ words. The act itself is 90,000 words, with an additional 50,000 words in an interpretive memo — no small company is reading that, they’re paying lawyers and consultants to develop systems of compliance.

The lack of clarity in the AI Act, along with its massive scope, mirrors previous technology regulations that introduced broad restrictions without providing workable frameworks. The GDPR, for instance, created immense compliance headaches while failing to meaningfully curb data privacy violations from major tech firms. The AI Act appears poised to repeat this cycle, imposing heavy obligations while leaving businesses in regulatory limbo.

A Broad Net Catching Everyone

The Act does not just target AI developers—it applies to any company using AI within the EU. Many U.S. companies will be affected, even if they are not primarily AI companies. This extraterritorial reach, akin to the GDPR’s global impact, forces businesses worldwide to grapple with compliance, regardless of whether they have operations in Europe. Companies must now assess whether their AI applications—such as chatbots or internal HR tools—fall under vaguely defined prohibitions on biometric categorization or emotion recognition (Not sure what “emotion recognition” means? Don’t worry, here are 2,000 words from a law firm helping you figure it out. Although the firm notes that they too aren’t sure what it means, but reach out and they will help you work through it 💰 💶 💸).

The Act’s literacy requirement adds another layer of compliance, applying to all AI providers and deployers without clear implementation guidance. Businesses must ensure a “sufficient level of AI literacy” among employees, yet the law provides little clarity on what this entails. (But don’t worry, law firms are on it, although they, too, note that they aren’t sure what it means). Once again, companies are expected to comply without clear direction, adding to the growing uncertainty surrounding AI governance.

With its broad scope, the AI Act has raised concerns about regulatory overreach, as critics warn that Europe’s AI rules could influence American policymaking and stifle innovation. While some argue that harmonizing global AI standards fosters trust and accountability, others fear that compliance costs will disproportionately burden smaller U.S. firms, potentially forcing them out of the European market or slowing AI advancements. Companies must now navigate this complex regulatory landscape, balancing EU mandates with the need to innovate.

All of this seems to suggest that European bureaucrats are committed to regulating the continent into irrelevance, and dragging non-European companies down with them.

It’s almost axiomatic that the Act will harm non-European companies the most, mainly because Europe doesn’t have many AI companies to begin with:

And doesn’t invest much in AI either:

With stats like that, European regulations are, by the numbers, destined to impact non-European companies (by accident or by design).

On this point, AI innovator Ole Lehmann comically notes:

Experts Sound the Alarm

Several experts and commentators share my skepticism about the EU AI Act’s effectiveness and its potential to stifle innovation. AI governance specialist Evi Fuelle warns that companies may be underestimating the detailed documentation required to demonstrate compliance. Meanwhile, Dessislava Savova of Clifford Chance, quoted at Bloomberg, notes that most companies now face an “AI stress test” with little preparation.

Industry voices have long cautioned against overregulation in AI, as excessive regulation risks cementing the dominance of large firms that can afford compliance costs while throttling startups and innovation. The EU AI Act exemplifies this concern: it will disproportionately burden smaller companies that lack the resources to navigate its complexities. One need only look at how Microsoft has quickly leaned into complying with the Act (as they did with GDPR) and how the largest companies are defining the standards for the industry.

A Familiar Pattern of Regulatory Overreach

The EU’s approach to AI regulation follows a predictable pattern of tech policy overreach. Instead of fostering responsible AI development through clear and pragmatic guidelines, lawmakers have prioritized broad prohibitions and punitive measures. The 7% revenue fine for violations mirrors the aggressive penalties under GDPR but ignores the reality that compliance costs alone may be debilitating for many companies.

While the EU frames these measures as protecting consumers and ensuring ethical AI use, history suggests that such regulations often fail to achieve their intended goals. The GDPR did not prevent major data privacy scandals, and there is little reason to believe the AI Act will meaningfully curb problematic AI applications. Instead, it is likely to generate a compliance industry of legal consultants and auditors while leaving businesses struggling to interpret vague mandates.

hits the nail on the head with this comment, describing how smaller European companies are struggling with compliance while larger companies take it in stride:

Final Thoughts

The EU AI Act is a case study in how well-intended (I’m not sure they’re well intended, but I’ll give them the benefit of the doubt) regulations can become a bureaucratic nightmare. Without clear guidelines, businesses are forced to operate in uncertainty, risking fines and legal challenges. Worse, the law’s broad scope ensures that even companies with minimal AI engagement will face burdensome compliance requirements.

Rather than imposing sweeping, ambiguous mandates, regulators should work with industry leaders to develop targeted, practical solutions. AI governance should not be about regulatory theater—it should be about fostering innovation while mitigating real risks. The EU AI Act, as it stands, is unlikely to achieve that balance and companies are about to feel the cost of compliance.

In 2022, I wrote at Forbes about how the Federal Trade Commission (FTC), under Lina Khan’s leadership, fundamentally misunderstood the mechanics of innovation and competition. The agency’s misguided attempt to block Meta’s acquisition of Within Unlimited, a virtual reality (VR) fitness company, was a case in point. The FTC’s challenge was rooted in a flawed premise: that allowing Meta to acquire Within would reduce competition in the VR fitness market.

The reality, as I pointed out then, is precisely the opposite. The ability to exit via acquisition is what fuels startup investment in the first place. If the government arbitrarily blocks such acquisitions, the downstream effect is fewer startups, less innovation, and, ultimately, less competition.

Now, as we enter a second Trump administration, we must assess the damage done by the Khan-led FTC and determine how to correct it.

Subscribe now

The False Premise That Acquisitions Stifle Competition

In blocking the Meta-Within deal, the FTC trotted out the usual talking points: acquisitions lead to monopolies, stifle innovation, and harm consumers. This claim was not only wrong, but it also betrayed a fundamental misunderstanding of how venture-backed startups work.

Startups are built to exit. Investors take risks with the expectation that their capital will be returned through an IPO or, more commonly, an acquisition. Blocking acquisitions eliminates the primary incentive for investors to fund innovative companies in the first place.

This is not speculation. As I noted in Forbes, data from Silicon Valley Bank revealed that 58% of startup founders expected their companies to be acquired, while only 17% expected to go public. Yet, the FTC’s stance under Khan made clear that it would actively interfere in this natural process, effectively slamming the brakes on startup investment.

Lina Khan’s FTC Has Reduced, Not Increased Competition

By making it more difficult for startups to exit through acquisition, Khan’s FTC reduced the incentives for entrepreneurs to enter the market. The FTC claimed blocking Meta’s purchase of Within would preserve competition, but in reality, it likely had the opposite effect.

If large players like Meta, Apple, and Google know they will face roadblocks acquiring startups, they are more likely to build in-house solutions instead. This means fewer opportunities for startups to compete, less funding for entrepreneurs, and, ultimately, less innovation.

Khan’s FTC ignored this reality and instead pursued a European-style regulatory approach that views all acquisitions with suspicion. The end result? A chilling effect on investment and entrepreneurship.

How The Meta-Within Case Was a Canary in the Coal Mine

This case was not an isolated incident. It signaled a broader ideological shift at the FTC—one in which bureaucrats with no real-world experience in business, investing, or startups took it upon themselves to reshape the tech sector according to their own misguided theories.

The problem is that these policies do not just hurt the tech giants—they harm the very startups and entrepreneurs that regulators claim to protect.

The Meta-Within case should have been a wake-up call. Instead, the FTC continued doubling down on its flawed logic, pursuing aggressive (and often legally dubious) antitrust enforcement that disincentivized market participation.

The Second Trump Administration’s Opportunity to Reverse Course

With a new administration on the horizon, the question becomes: How do we undo the damage caused by Khan’s FTC?

1. Reform Antitrust Policy – The next FTC leadership must recognize that acquisitions are a feature, not a bug, of a competitive market. The ability to be acquired incentivizes investment, which in turn leads to more innovation and market participation.

2. Restore a Pro-Growth Regulatory Environment – Khan’s approach has been one of overreach, operating under the assumption that regulators, rather than markets, should decide the trajectory of competition. A second Trump administration has the opportunity to put control back in the hands of businesses and investors.

3. Encourage Startup Formation Through Clear Exit Pathways – If we want to see more startups, we must ensure that their exit pathways remain open. That means stopping the FTC from arbitrarily blocking acquisitions that pose no real threat to competition.

4. Shift FTC Focus to Consumer Harm, Not Ideological Battles – Antitrust policy should focus on actual harm to consumers, not theoretical market structures imagined by academics and bureaucrats. If an acquisition leads to better products, more investment, and increased innovation, it should be encouraged, not obstructed.

A Pro-Innovation, Pro-Startup Future

Had the FTC under Lina Khan prevailed in its case against Meta, it would have set a dangerous precedent—one where regulators, not the market, decide which startups succeed and which fail. Fortunately, courts saw through this flawed logic and allowed the acquisition to proceed.

But the damage had already been done. The chilling effect on startup investment, the uncertainty injected into the M&A landscape, and the regulatory hostility toward acquisitions have all had lasting consequences.

A second Trump administration has the opportunity to reverse this course and reestablish a regulatory environment that supports innovation, competition, and entrepreneurship. The past few years have shown us what happens when central planners interfere in markets they do not understand. It’s time to correct those mistakes and put the FTC back on a path that fosters, rather than stifles, innovation.

The AI race just got a lot more interesting.

A Chinese startup, DeepSeek, has developed an AI model that rivals OpenAI’s ChatGPT and Google’s Gemini—but at a fraction of the cost. Unlike U.S. models that rely on expensive, high-performance Nvidia chips, DeepSeek had to innovate around U.S. export restrictions. The result? A more efficient AI model that costs just $5.6 million to train, compared to the hundreds of millions or even billions spent by leading U.S. AI firms.

That’s where my conversation with Inside the Issues host Amrit Singh began.

Subscribe now

Necessity Breeds Innovation

U.S. export controls were meant to limit China’s access to advanced AI chips, but DeepSeek turned the challenge into an opportunity. They developed a model that operates with far less computing power—something that could disrupt the AI industry in unexpected ways.

And they didn’t stop there. Unlike OpenAI and Google, which tightly control access to their models, DeepSeek made its model open-source. That means developers can run it on local computers without relying on large-scale AI data centers. This could be a huge boost for AI innovation—but it also raises serious concerns.

Security & National Security Risks

DeepSeek's popularity is undeniable—it’s now the most downloaded app on Apple’s platform—but it also raises data security questions. If users rely on DeepSeek’s servers, their data is being processed in China. That’s a major risk. As I explained in the interview, there is a distinction between running the open-source model on your own infrastructure versus using DeepSeek apps and infrastructure. The broader implications of widespread Chinese AI adoption should not be ignored.

The U.S. government has already expressed national security concerns over Chinese-owned tech platforms like TikTok. With DeepSeek, similar issues arise:

• Data tracking risks – Could the Chinese government access and analyze user data from DeepSeek?

• Algorithmic manipulation – Will AI-generated content be influenced to favor Chinese narratives?

• Geopolitical leverage – Could this technology shift the balance of power in AI development?

The TikTok Precedent: When AI and Policy Collide

The discussion naturally turned to TikTok, which the Biden administration targeted with new regulations upheld by the Supreme Court. Historically, the U.S. has protected First Amendment rights, even when it meant allowing Americans access to foreign propaganda. But in TikTok’s case, the Supreme Court sided with national security concerns over free speech arguments.

As I pointed out, this decision sets a major precedent. The ruling affirms that the government can regulate foreign-owned tech platforms if national security is at stake. Could similar scrutiny soon apply to DeepSeek?

What Happens Next?

With TikTok, President Trump extended the deadline for compliance, but a shutdown still looms. DeepSeek may face similar regulatory hurdles, particularly if concerns grow over data security and foreign influence.

One option that’s been floated for TikTok is a forced divestment—essentially, the U.S. taking a 50% ownership stake. That’s a bizarre proposal, given the administration’s stance on privatization. Would the U.S. government really want to own and regulate a social media app?

My prediction? We’ll likely see a shutdown or significant restrictions rather than a regulatory compromise. China isn’t about to give up control of its social media darling, and the U.S. won’t risk its national security over an app.

This week, I joined Your Morning with Kelvin Washington on Spectrum News to break down the recent surge in mysterious drone sightings that have captivated the public and fueled a wave of speculation.

Subscribe now

What's Behind the Hype?

Drones are nothing new, but many people rarely look up at night to see what’s actually flying overhead. As I explained, a mix of misidentification, heightened media coverage, and public curiosity has turned routine drone activity into a viral phenomenon. Some of what’s being spotted are likely just aircraft, satellites, or even legal drone operations.

However, the lack of clear explanations from government agencies has only added to public anxiety. Homeland Security, the FAA, the FBI, and the Department of Defense all have roles in overseeing drone activity, yet there’s no centralized authority capable of quickly addressing concerns. This fragmented approach to drone oversight leaves room for speculation, much like what happened with the Chinese spy balloon incident in 2023, when the government’s delayed response damaged public trust.

Military Ops or Something Else?

Could these drones be part of a secret military test? While that’s a possibility, I pointed out that truly covert operations don’t usually continue once exposed. That said, if the government were conducting an experiment to gauge public reaction to widespread drone sightings, it might explain the lack of immediate answers.

One key issue I highlighted is that most people—including law enforcement—aren’t skilled at judging altitude, speed, or size from a distance. This makes accurate identification difficult, further fueling confusion.

Ruling Out the Wildest Theories

Social media is ablaze with theories about foreign adversaries or even extraterrestrial visitors. But as I pointed out, any drones flashing red and green FAA-compliant lights are almost certainly not Chinese, Russian, or alien. If an adversary wanted to fly undetected, they wouldn’t follow U.S. aviation rules.

The only truly concerning reports are the rare cases of drones flying without lights or exhibiting unusual movement patterns. Those warrant further investigation, but for now, the vast majority of sightings likely have mundane explanations.

Until then, if you see something strange in the sky, it’s probably not time to panic—though it may be time to pour a glass of wine and join a drone-watching party.

On December 17, I joined CNN Newsroom with Max Foster to discuss the surge in drone sightings across the U.S. and the public confusion surrounding them. The lack of definitive information has fueled conspiracy theories, raising concerns about both national security and government transparency.

Subscribe now

What’s Really Happening?

The reports fall into three main categories:

1. Misidentifications – Many so-called drone sightings are actually conventional aircraft. People look up, see something far away, moving slowly, and assume it’s a drone. In a recent example on X (formerly Twitter) a person mistook a United Airlines flight for a drone.

2. Legal Drones in Restricted Areas – Some drones are confirmed as such, but flying a drone isn’t inherently illegal—only flying in restricted spaces is.

3. Unidentified Aerial Activity – The small but most intriguing category involves objects that can’t easily be classified as drones or manned aircraft. These incidents, particularly near sensitive sites, have sparked public anxiety.

Sorting Facts from Fiction

The numbers paint a clearer picture:

• The U.S. has over a million registered drones, with many more operating unregistered.

• A White House call with the FBI led to a tip line, which received 5,000 reports. Only about 100 were deemed worth investigating.

• Many sightings coincide with standard flight paths near major airports like JFK and Newark, meaning they are likely just aircraft seen from unusual angles.

Adding to the chaos, some civilians have started launching their own drones to track unidentified ones—only complicating the situation further.

A Crisis of Trust

Beyond drones, this issue highlights a broader problem: the public’s declining trust in government information. Many people recall the lack of timely updates and conflicting reports surrounding the Chinese spy balloon, fueling skepticism about what authorities disclose. Elected officials and citizens alike feel they aren’t getting the full story, whether or not the information they receive is technically accurate.

Foreign Threats and Testing U.S. Defenses

Could foreign actors be involved? If an adversary wanted to conduct aerial surveillance, lighting up drones with flashing lights and strobe effects would be a terrible strategy. However, one plausible theory is that some of these visible flights could be probing missions—tests designed to measure U.S. response times and countermeasures before deploying less conspicuous drones for actual espionage.

What’s Next?

As these sightings continue, the government needs to do more than just reassure the public—it must provide clear, credible explanations. Otherwise, misinformation will fill the void, exacerbating public distrust and making real security threats harder to identify.

What do you think? Are these sightings overblown, or is there more to the story? Let me know in the comments.

Revisiting My 2006 Op-Ed on Data Security Failures

Back in 2006, I wrote an op-ed for The Washington Times titled Onus to Protect Identity, where I warned that identity theft was becoming an increasingly lucrative crime due to weak security measures by institutions that held sensitive personal information. At the time, high-profile data breaches—from government agencies to private corporations—revealed just how recklessly personal data was being handled.

Yet, despite the rising threat, my argument was that lawmakers and regulators were focusing too much on punishing identity thieves rather than holding data handlers accountable. I proposed a shift in legal and regulatory frameworks that would place liability on institutions that failed to properly safeguard personal information.

Key Points from My 2006 Op-Ed

1. Identity Theft Was a Crime of Opportunity

   • While the average bank robber stole about $2,500 per heist, identity thieves could extract $20,000 to $30,000 per victim.

   • Institutions holding personal data—banks, universities, government agencies, and businesses—were in the best position to prevent identity theft but had little incentive to do so.

2. Institutions Were Grossly Negligent in Handling Personal Data

   • I cited multiple egregious cases of mishandling personal information:

     • Berkeley’s exposure of 98,000 Social Security numbers from a stolen laptop.

     • A national tax firm in Ohio discarding customer tax returns in a dumpster.

     • Blockbuster Video leaving boxes of customer data—complete with Social Security numbers and birthdates—on a sidewalk.

   • The lack of consequences for these failures allowed such practices to persist, contributing to a growing epidemic of identity theft.

3. The Legislative Approach Was Misguided

   • Lawmakers were overemphasizing penalties for identity thieves rather than creating clear security mandates for those entrusted with personal data.

   • Simply increasing criminal penalties did little to prevent identity theft because the real vulnerability lay in institutions failing to secure data properly.

4. A Two-Pronged Solution: Regulations and Private Litigation

   • I argued for clear and enforceable data protection standards, including:

     • Immediate notification requirements when a data breach occurred (as California had pioneered).

     • Mandatory data encryption for sensitive information.

     • Stricter limits on the use and dissemination of Social Security numbers.

   • Beyond regulation, I advocated for the creation of a private cause of action, allowing victims of identity theft to sue institutions that failed to safeguard their data.

     • This would function similarly to consumer protection laws, empowering individuals as “private attorneys general” to enforce compliance through litigation.

   • To balance concerns about frivolous lawsuits, I proposed a safe harbor for companies that met a defined set of security standards—ensuring that only truly negligent entities would be held liable.

What’s Changed Since 2006?

Nearly two decades later, identity theft remains a pervasive problem, and the legal landscape has evolved in some ways—but not always in the direction I recommended.

✅ Adopted Measures:

• Mandatory breach notification laws: Nearly all U.S. states now require companies to notify affected individuals when personal data is compromised.

• Limits on Social Security number use: Government agencies and financial institutions have increasingly moved away from using Social Security numbers as primary identifiers.

• More stringent disposal requirements: Laws now require companies to securely destroy physical and electronic records containing sensitive information.

❌ Still Missing or Incomplete:

• No broad federal data protection law: Unlike Europe’s GDPR (which I think is misguided, but flagging it here nonetheless), the U.S. still lacks a comprehensive federal privacy and data security law, relying instead on a growing patchwork of state laws.

• No clear liability for negligent data handlers: The idea of allowing victims to sue for improper data security practices has not been widely adopted, meaning companies can still get away with weak protections as long as they comply with basic breach notification laws.

• Identity theft has evolved into synthetic fraud: Criminals are now creating entirely new identities using AI-driven techniques, making fraud detection even harder.

• Tech companies have become new data guardians: In 2006, the biggest risks came from financial institutions and government agencies; today, social media platforms, cloud storage services, and AI-driven databases hold unprecedented amounts of personal data—often with inconsistent security measures.

Where Do We Go From Here?

While some of my 2006 recommendations have become reality, others remain unaddressed, and the threat landscape has evolved far beyond simple identity theft. The next phase of legal reform should focus on:

• A unified federal standard for data security, preventing a patchwork of inconsistent state laws.

• Real consequences for negligent data handlers, including a form of fiduciary responsibility for sensitive data.

• Expanded protections against AI-driven fraud, including synthetic identity theft and deepfake-enhanced impersonation.

Would love to hear your thoughts—should companies be held to a higher standard of care when handling personal data? Let me know in the comments.

California’s latest legislative session saw Governor Gavin Newsom signing multiple bills aimed at regulating artificial intelligence. These laws tackle deepfakes, campaign transparency, and protections for performers against AI-generated likenesses. But are lawmakers getting ahead of themselves?

I recently joined Inside the Issues to discuss California’s approach to AI regulation, including the controversial SB 1047, which would force AI companies to prove their models won’t cause “catastrophic harm.”

Subscribe now

Regulating the Unknown

Right now, AI regulation feels a bit like doomsday prepping—legislators are imagining worst-case scenarios and crafting laws before there’s concrete evidence of harm. The problem? This approach assumes risks that may never materialize, potentially stifling innovation in the process.

Take SB 1047, spearheaded by State Senator Scott Wiener. It flips the burden onto AI companies, requiring them to certify their models won’t cause harm—even though the bill itself doesn’t define what “harm” means. It’s a classic case of regulate first, figure it out later.

A Burden on Innovation?

Wiener argues that this bill merely enforces what big AI firms (like OpenAI, Google, and Anthropic) claim they’re already doing. But as I pointed out in the interview, there’s a big difference between voluntary commitments and government-mandated obligations. Once the law steps in, compliance costs skyrocket—meaning companies must pour resources into insurance, legal teams, and bureaucratic oversight instead of innovation.

This isn’t just about tech giants. The idea that only major corporations are affected is misleading. AI startups today are raising hundreds of millions of dollars, meaning many will be swept up in the regulation’s net. That’s why big names like Marc Andreessen oppose SB 1047, while others like Elon Musk support it. Strange bedfellows, indeed.

A Patchwork Nightmare

Another major issue? Regulatory fragmentation. If California sets strict AI rules while other states take different approaches, tech companies will face a compliance nightmare. Hawaii, for example, is pushing even more extreme laws that require companies to prove AI is beneficial before they can launch a product.

We’ve already seen how this plays out with privacy laws, where states have created a chaotic patchwork of regulations. Without federal intervention, AI could head down the same road, stifling progress rather than fostering responsible development.

What’s Next?

Newsom hasn’t yet signed SB 1047, and he may prefer to wait and see how the debate unfolds. Politically, that’s the safest move. Substantively, it’s also the right one—rushing into regulation before we fully understand AI’s trajectory could do more harm than good.

As California barrels ahead on AI legislation, the big question remains: Do we regulate based on hypothetical fears, or do we allow innovation to evolve and address real problems as they arise?

Let me know your thoughts in the comments.

Joby Aviation is making a bold move to reshape urban transportation with the installation of the first electric air taxi charging infrastructure in the greater New York City area. In a partnership with Helo Holdings, Inc., Joby is setting up chargers at Kearny Heliport—one of the busiest vertical-lift facilities on the East Coast and just minutes from Manhattan.

Subscribe now

The move is part of a larger push to bring eVTOL (electric vertical take-off and landing) aircraft into the mainstream, offering an efficient, quiet, and sustainable alternative to traditional urban transport. But Joby’s ambitions extend beyond just commercial air taxis—the company is also growing its military and defense operations.

Regulatory challenges remain, as the FAA works to establish the rules of the road (or sky) for this new mode of transportation. Yet, with Joby leading the way in aircraft certification, the company is positioning itself as the Tesla of the skies—ensuring that when urban air mobility truly takes off, it will be Joby’s network setting the standard.

Read my full analysis on Forbes: Joby Aviation Inks Deal To Install Air Taxi Charging Infrastructure In NYC Region

A man was spotted holding what appeared to be a gun in Chula Vista. Officers could have rushed in, weapons drawn. But instead, a drone arrived first—and quickly revealed the “gun” was nothing more than a cigarette lighter.

It is the kind of scenario where drones can be a game-changer for public safety.

That’s where my conversation with Inside the Issues host Alex Cohen began.

Subscribe now

The Evolution of Police Drone Use

For years, FAA rules limited how law enforcement could use drones. Initially, officers treated them like remote-controlled aircraft—something they pulled out of the trunk to peek over a fence. But recent changes allow drones to operate miles away from officers, completely transforming their role.

Now, police can send drones ahead of them to 911 calls, allowing them to assess situations before arriving on the scene. It’s a shift that provides real safety benefits—reducing the likelihood of tragic misidentifications and use-of-force incidents.

The Chula Vista Model

Chula Vista became one of the first U.S. cities to get FAA approval for drone-based surveillance, setting the standard for other departments. I first met their team in 2015, when they were already thinking ahead. They built strict policies to ensure transparency, avoiding the kind of backlash that derailed similar programs elsewhere.

Other cities—like Santa Monica—followed suit, using drones for tasks like managing post-event traffic flows. These measured, accountable implementations helped ease public concerns about the “big brother” implications of persistent surveillance.

A Tool for Safety, Not Surveillance

Drones aren’t just for crime response—they’re a force multiplier for search-and-rescue operations. Instead of sending officers on foot to search for a missing person, drones can cover vast areas in minutes, making a real difference in emergencies.

And when officers do respond to high-risk calls, drones create a crucial buffer. In my Forbes piece over a decade ago, I argued that pulling officers back from immediate danger buys time for better decision-making. In the real world, that can mean the difference between life and death.

Think of cases like Tamir Rice—where a split-second misidentification had fatal consequences. If a drone can confirm that what looks like a weapon is actually a toy or a lighter, we prevent unnecessary tragedies.

The Privacy Problem

Of course, not every use of drones is so clear-cut. The concern comes when they’re deployed for wide-area surveillance.

We’ve already seen the risks. In Baltimore, police flew manned aircraft 24/7, tracking every person’s movements across the city. Drones could easily do the same. When law enforcement can rewind footage to see everywhere someone has been, we’ve crossed a major privacy threshold.

Who Gets to See the Footage?

Another open question: Should drone footage be subject to public records laws?

On one hand, government transparency is critical. But should anyone be able to request and obtain drone footage? If police are flying over someone’s backyard, does that footage become public record?

Right now, courts are sorting it out. But the real answer should come from lawmakers—not judges. States like California need to create clear policies about how drone footage is stored, accessed, and used.

The Bottom Line

Drones are here to stay in law enforcement. When used responsibly, they improve safety and reduce unnecessary police encounters. But without clear guardrails, they could turn into a tool for mass surveillance.

The challenge, as we discuss in the segment, is making sure we get the balance right.

Back in August of 2005, I wrote an Op-Ed in The New York Times about the vulnerability of our electrical grid. Sadly, much of what I wrote is still true today.

In the aftermath of the 2003 blackout, securing the grid was supposed to be a priority. But as I pointed out at the time, critical weaknesses remained—specifically, the lightly protected switching stations that control power distribution across the country. These facilities house sophisticated relays and computers that keep the grid stable, yet they are often protected by nothing more than a barbed-wire fence and a thin aluminum building. A few well-placed attacks could take down large portions of the country’s power supply for weeks.

The solution? Harden security at key substations, prioritize the most critical sites, and mandate stronger protections through regulation. The cost would be high, but the consequences of inaction would be far worse. Nearly two decades later, the vulnerabilities I highlighted remain, and the risk of both physical and cyberattacks on the grid has only grown.

Read the original piece here: The Terrorist and the Grid (The New York Times).