clening

Karma: 62

clening 15 Jul 2026 12:50 UTC
2 points
0
in reply to: Katalina Hernandez’s comment on: AI Safety Policy Needs to train Legal Practitioners
I still don’t think the GDPR envisioned the DPO as a ‘gatekeeper’, so much as advisor. I mean, look at Article 39:

The data protection officer shall have at least the following tasks:
1. 1. to inform and advise the controller or the processor and the employees who carry out processing of their obligations pursuant to this Regulation …;
  2. to monitor compliance with this Regulation, … including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits;
  3. to provide advice where requested as regards the data protection impact assessment and monitor its performance pursuant to Article 35;
  4. to cooperate with the supervisory authority;
  5. to act as the contact point for the supervisory authority on issues relating to processing, including the prior consultation referred to in Article 36, and to consult, where appropriate, with regard to any other matter.
That isn’t a position that blocks decisions, which is what a gatekeeper is. A gatekeeper blocks bad decisions from happening. Sometimes, a GC has that authority, but more commonly, it’s people in the C-Suite who have the veto button. A DPO gives guidance and advice, but we have absolutely no control beyond persuasion (same as any engineer or low-level product counsel).

clening 15 Jul 2026 12:38 UTC
5 points
0
in reply to: aphyer’s comment on: AI Safety Policy Needs to train Legal Practitioners
Compared to the alternatives, the GDPR is a good piece of legislation. It defines the ‘who’, ‘what’, and ‘why’ far more comprehensively than say, the Data Protection Directive that came before it, or 90% of the other data protection laws around the world. It offers some actual rights and importantly, imposes actual obligations. If you don’t believe me, go read a few privacy notices or 10-K filings and count up the times that the GDPR is mentioned relative to almost any other law, bar the CCPA.
Is it perfect? No. Does it make things far more complicated than they need to be? Absolutely. Is it frequently Goodharted to hell by the worst offenders? Yep! But, that makes it a flawed piece of legislation, not inherently bad or worthless. The failure modes of the GDPR come down to problems with the ‘how’:
1) still-unresolved ambiguities in interpretation (‘risk-based approach’ sounds lovely to a legislator, but having little guidance on the details make consistency hard. Everything in Chapter V, which covers cross-border transfers is a dogs’ breakfast of inconsistency);
2) poor, usually inconsistent guidance from regulatory bodies, or worse, ‘guidance’ that has no mandate, coherence, or enforcement teeth;
3) complete enforcement failures—the One Stop Shop is a failed experiment, and it should be abandoned. Let each member state sue for non-compliance, as the states already do in the US;
4) disproportionate impact: the law treats all-comers identically, whether you’re a small eCommerce company or Meta. The problem is compliance costs and knowledge and time needed to comply. In my ideal world, regulators would be more realistic about defining ‘risk’ for organizations. For example: if you’re selling medical devices that include lots of features that will phone home and share sensitive personal data broadly, yes, you should absolutely need to have your house in order. Ditto for other traditionally regulated industries.
But it’s less realistic to expect the same standard be met (documentation, policies, data transfer obligations, quick turn-arounds for DSRs, DPIAs, etc) by a tiny, low-risk provider. And enforcement should be aligned accordingly, instead of just going after the low-hanging fruit.
Sue the absolute **** out of Meta, X, Google, Microsoft, Palantir, OpenAI, Clearview—the folks that are in the news for being the worst offenders. Force them to disgorge data, or cease trading in Europe, or actually recouping the fines. Stop faffing about with wrist-slaps and hedgy BS. Concurrently, build out the tools and standards that will make compliance easy for everyone—think HTTPs, or the gradual improvement to payment card processing that has come through PCI-DSS standarization.
Attack the structure, don’t hang on the procedure. But that’s hard, and most regulators don’t have the political support or resources to do that. So, they go for the easy, stupid compliance-theatre stuff, and it makes the law look worthless.

clening 15 Jul 2026 12:07 UTC
3 points
2
in reply to: Katalina Hernandez’s comment on: AI Safety Policy Needs to train Legal Practitioners
Yes, but I like you, so it wouldn’t be a diss-take. I only reserve the spicy stuff for my sworn enemies.

clening 15 Jul 2026 12:05 UTC
4 points
2
on: AI Safety Policy Needs to train Legal Practitioners
We mandated the existence of the gatekeeper.
I don’t think ‘gatekeeper’ is the right word. A DPO sits inside the business, but is merely advisory or persuasive, not controlling, any more than any other compliance function. Yeah, the DPO can say that X is a terrible idea, and the business might choose to listen, but frequently they don’t.

The DPO has no power to force behavior. Otherwise, Meta wouldn’t be doing standard Meta things. I’ve met the DPO team @ Meta. They’re lovely, smart, engaging people. With no meaningful power. That’s not a gatekeeper, it’s a compliance functionary with a statutory mandate for independence and competency.

clening 15 Jul 2026 9:50 UTC
4 points
1
on: AI Safety Policy Needs to train Legal Practitioners
Laws don’t implement themselves: people within corporations design frameworks and strategies so that implementation of these laws is operationally possible.
Also, regulators and courts enforce the laws. That’s where the real ‘implementation’ comes in. A law without teeth for state-sanctioned coercion is toothless and won’t get implemented at all. Just look at the Platform to Business Regulation (EU 2019/1150). Few companies know it exists; fewer still bother to do what’s required under the law. https://www.maverick-law.com/en/blogs/platform-to-business-regulation-more-rights-for-business-users-of-online-platforms.html

NIS-2 seems to be going in the same direction. My point is, the AI knowledge/alignment problem is much bigger because implementation is squishy and complex.

clening 15 Jul 2026 9:24 UTC
3 points
2
on: AI Safety Policy Needs to train Legal Practitioners
- A mature student would answer from experience, and the teacher would say: “No. This is not right.”
- The mature student would go: “But this is exactly how I dealt with my case yesterday.”
- The teacher would eventually settle it with something along the lines of “At the end of the day, this is what you need to pass your exam.”
I recall that anyone with experience (mature or even those of us who had any legal experience), received that answer. It was deeply frustrating. In the US, this is a major problem—and law schools don’t even adequately teach to the test (state bar examinations) because there are 50+ different bars, with slightly different essays and legal interpretations. For that, you took a separate, 3-month course … *flashbacks*

How Brussels can avoid becoming a digital vassal to US Big Tech

clening15 Jul 2026 9:15 UTC

16 points

0 comments5 min readLW link

clening 3 Jun 2026 20:57 UTC
1 point
0
on: Post-AGI Economics As If Nothing Ever Happens
When interacting with cognitive systems way more capable than us, we may find ourselves in a situation somewhat similar to kids: our preferences may be easily influenced, and not particularly self-interested. The ideologies we adopt may be driven by non-human systems. Our world models may be weak, resulting in massive information assymetries.
Cynically speaking, I’m not sure it will take AGI for this; we already see it today with garden-variety social media, mis- and disinformation, deepfakes, etc. Presumably, some branch of economics is considering this, so the questions are a) is there enough focus, and b) how much worse will this be with AGI.

clening 3 Jun 2026 20:48 UTC
1 point
0
on: Post-AGI Economics As If Nothing Ever Happens
Econ reasoning is trying to do something like projecting the extremely high dimensional reality into something like 10 real numbers and a few differential equations. All the hard cognitive work is in the projection. Solving a bunch of differential equations impresses the general audience, and historically may have worked as some sort of proof of intelligence, but is relatively trivial.
I feel like this could equally be extended to other branches (in my orbit, privacy engineering, and technical AI safety come to mind)

clening 20 Apr 2026 9:15 UTC
3 points
2
in reply to: ChristianKl’s comment on: clening’s Shortform
With respect, I’m not sure you fully read the post. I called out the existing contract specifically, though I did not mention the dollar amount.
On February 26, after weeks of negotiation, talks broke down between the Pentagon and Anthropic after Anthropic’s CEO, Dario Amodei refused to accede to DOD demands for unfettered “lawful”1 uses of its AI tools by the military. Anthropic was generally fine with Claude being used by the military generally (as it had been since July 2025), and by other strategic military contractors, such as Palantir, Amazon, Oracle, and Lockheed Martin, for everything from supply chain logistics and cyber operations, to foreign surveillance & intelligence gathering.
I also mentioned the fact that Anthropic was unique in that it ran in the classified environment. I quoted Anthropic’s language explicitly.
Given that, I don’t think we’re actually in disagreement here, unless you’re objecting to my tone or something not related to the substance of my piece, in which case, there’s nothing more I have to say.

clening 20 Apr 2026 6:29 UTC
1 point
0
in reply to: ChristianKl’s comment on: clening’s Shortform
FWIW, I covered more of Anthropic’s boundaries (which, if I’m reading you correctly, weren’t actually all that substantial) in this post. I didn’t rehash that here.
But it’s possible he has other boundaries, e.g., hostile nation-state acts, cyberweapons, but those were not explicitly demanded by the DOD/administration. I don’t know. I wasn’t in the room.

clening 19 Apr 2026 12:44 UTC
10 points
6
on: clening’s Shortform
Mythos, Leverage, and Tech Extensity
In late February, the Trump administration and the Department of Defense took the unprecedented step of declaring Anthropic a supply-chain risk, and cutting the company off from government contracts. I predicted in March that despite the administration’s efforts, Anthropic would not only prevail, but would come out ahead:
Bluntly, Trump needs Anthropic (and by extension, the hyperscalers, VC firms, and sovereign wealth funds [who support Anthropic]) far more than they need him. Even if the courts do side with the administration, Trump still has to contend with all the essential companies who have funded his largesse, and the fact that so many of these donors have a vested interest in Anthropic succeeding. That’s extensity.

No matter how powerful Trump thinks he is, no dictator can afford to piss off the coalition that actually keeps him in power. So, in the end, I don’t think Trump’s theatrics will hurt Anthropic much, because there are far too many big, important essential players who need Anthropic, and who have the leverage and ability to get Trump and Hegseth to blink first.
I mention all this, because on Friday, Dario Amodei met with senior White House officials, in an effort to reach a detente. I thought that was interesting, but what I was missing was the specific leverage point: Claude Mythos. Matija Vidmar explained things nicely.
Suddenly, a few things clicked.
1. Based on their Project Glasswing announcement on April 7, Anthropic has almost certainly been working on its Mythos frontier AI model for months now, and have been testing it before the spat with the administration reached its high-drama phase.
2. Anthropic believes their model is powerful enough that it needs further evaluation prior to release.^[1] Rather than keep that research in-house, they decided to selectively release the model to a handful of security companies (all of whom took stock hits on the April 7 announcement), the Linux Foundation, and tech firms.
3. Those tech firms, which include AWS, Google, Broadcom, Microsoft, and Nvidia—all have a vested interest in Anthropic’s success. JPMorganChase’s inclusion also isn’t coincidental. Goldman Sachs and Citigroup are also purportedly testing Mythos.
4. While these companies might stay quiet publicly (to avoid a predictable administration meltdown), it’s near certain that every last one of these companies was fiercely advocating on behalf of Anthropic internally. It’s no coincidence that JD Vance and Scott Bessent met with Anthropic, Google, xAI, and Microsoft a day or so prior to the Mythos drop. A separate meeting between Scott Bessent, Jay Powell and the Wall Street banks occurred a few days later.
5. I believe Amodei pushed back on the administration’s demands precisely because he knew Mythos presented a risk, and that the administration’s theatrics could only go so far. As I wrote, “Amodei can afford to take a principled stance against the administration not necessarily because the company is braver or more patriotic than other AI companies, but because Amodei knows that Anthropic has extensive reach and leverage.”
6. It would be politically suicidal for the administration not to back down at this point. Tanking Anthropic because Amodei didn’t kiss the ring sufficiently risks alienating Trump’s coalition (which he can’t afford to lose). Icing out Anthropic from government contracts also creates a genuine national security risk. If CISA or the DOD, or NSA can’t use Mythos to harden their systems, those systems are exposed to threat actors and nation states who are happy to use Anthropic models.
7. There’s literally no upside for the administration to play a game they can’t win, and I think Anthropic knows this. I suspect that even if Trump doesn’t get it, JD Vance, Scott Bessent, Susie Wiles do.
My current forecast on the supply chain risk question
On March 22, I used FeedForward (my internal research & forecasting engine) to run a forecast on whether Anthropic will still be designated a supply chain risk by the US Government on May 31, 2026.^[2] Here’s the current assessment, with increasing/decreasing likelihood measures.
Current Assessment
Confidence: 5% (updated 2026-04-17)
Key Factors
Increasing likelihood:
- Mythos creating normalization pressure—Treasury Secretary Bessent’s characterization of Mythos as strategically important, combined with White House plans for agency access and Treasury CIO seeking Mythos access, suggests the government may need to modify or lift the designation to utilize the technology for national security purposes
- Pentagon’s practical needs—Wall Street CEOs summoned by Bessent and Powell to discuss Mythos cybersecurity applications, with major banks (JPMorgan, Goldman Sachs, Citigroup) reportedly testing it, indicates government is prioritizing defensive cybersecurity capabilities over the ban
- Expedited litigation timeline—May 19 oral arguments in the DC Circuit supply-chain risk case, create possibility of ruling before May 31, though extremely tight
- Political optics of inconsistency—Government simultaneously praising Anthropic’s strategic value while maintaining supply chain risk label creates unsustainable tension
Decreasing likelihood:
- Appeals Court definitively ruled against emergency relief—DC Circuit panel refused to block the supply-chain risk designation, with explicit reasoning citing “judicial management of how, and through whom, the Department of War secures vital AI technology during an active military conflict”
- Court split confirms prolonged litigation—San Francisco judge found DOD likely acted in bad faith and ordered removal, but DC Circuit’s opposite ruling means resolution requires higher court intervention, extending timeline
- Trump-appointed judges’ reasoning—The DC panel (including Gregory Katsas, former Trump deputy counsel, and Neomi Rao from OMB) emphasized national security deference and military conflict context, suggesting even favorable procedural arguments won’t overcome security claims
- No evidence of settlement negotiations—Despite the normalization signals, no articles indicate active DOD-Anthropic settlement discussions.
In short, what we’re witnessing is extensity in action. It’s not just a question of what AI model some agency uses for its internal chatbot. It’s about what happens when a single company becomes so integral that it can push back against the traditional levers and forces (regulatory, political, economic, or otherwise) that govern behavior.
1. ^
  Though some, like Devansh have called out the media for blindly parroting Anthropic’s press release and not, the primary sources, CVEs, exploit code, etc. He dug into those details and suggested that many of the capabilities might just be hype.
2. ^
  I ran a separate forecast on whether they would still be kept out of government contracts, notwithstanding the supply chain risk designation. I have much higher odds (43% chance vs. the community’s 75% chance) of that being the case, but even those odds are decreasing.

clening 17 Apr 2026 12:08 UTC
4 points
2
in reply to: StanislavKrym’s comment on: How Big Tech Becomes Ungovernable
@StanislavKrym Great questions! Honestly, I have mixed views on this, but my central position is that age verification and bans are unlikely to be effective in the way they’re being presented. However, I do think it will be extremely effective at eroding privacy and anonymity online (and a leading source of future data breaches). But I don’t think it will fundamentally protect kids.
To be candid, I don’t think protecting kids was the driving motivation for many of the proponents. Governments, and especially the facial recognition and age-verification providers, who lobbied heavily for these laws, want data, and it’s much easier to garner support if efforts are wearing the cape of protecting kids/fighting terrorism vs. admitting that they’re keen to build a database of everyone’s biometric info.

As to your second question, I think you’re right to a certain extent, and that’s what makes tech extensity different from classical horizontal monopolies. Tech extensity doesn’t require a single entity to set or control the market. The network effects, as they are, come from the fact that to function in society at all, you’ll eventually be forced to use one of the hyperscalers, because their products will be everywhere. I explore what this might look like in another post on my blog (https://insights.priva.cat/p/the-ladder-to-nowhere-how-openai). Kulveit, Douglas, Ammann, et al., discuss a related idea in their Gradual Disempowerment article.^[1]

Data portability is useful, but I don’t think it will solve the underlying problem. To analogize, you have ‘data portability’ with respect to the internet, in the sense that you can migrate your data offline to a filing cabinet. But migrating your data doesn’t make life easier, because so much of the systems in our lives depend on the internet.

To your last point: I’m not sure I follow exactly? If a button could be pressed, and the tech powers were constrained (or better still, roadblocks were put up to protect agency, autonomy, choice, etc.) that would act as a bulwark against companies enshittifing by adding friction. It’s similar to how data silos in government prevent or at least slow down unconstrained data abuses.

For example, I think the experts are correct to predict that there will be a tax shortfall in the US, after DOGE dismantled data silos and disregarded privacy protections that previously kept the IRS from sharing data with ICE.

Am I missing a larger point?
1. ^
  I wasn’t aware of this when I wrote this piece in February. @Katalina Hernandez shared it with me yesterday, but there are overlaps with my larger point. I have … some thoughts on why their approach misses the mark, however.