Civil Liberties Groups Speak Out Against CISPA in Lead Up to Hearings

https://www.eff.org/deeplinks/2013/03/34-civil-liberties-groups-speak-out-against-cispa-lead-hearings

by rbur0425 • 13 years ago

203 111 13 years ago

eff.org

halviti• 13 years ago

Obligatory Maddox from SOPA 1

http://thebestpageintheuniverse.net/c.cgi?u=pass_sopa

chc2• 13 years ago

This "CISPA is the next SOPA" meme is about as fact-based as "Electronic Arts is literally Hitler." I'm not telling you it's good or bad, but it's not remotely SOPA. It isn't even addressing the same general topic as SOPA.

diminoten6• 13 years ago

SOPA isn't really related to CISPA all that much, I don't know why people think they're similar.

tptacek24• 13 years ago

Because the EFF actively campaigned (dishonestly) against CISPA as a sort of second coming of the objectives of SOPA.

mtgx• 13 years ago

The White House petition against it passed 100,000 signatures, too:

https://www.techdirt.com/articles/20130311/16221022286/white...

nlh• 13 years ago

One of the biggest (and most frustrating) problems with the legislative process is that the people who really want this to go through KNOW that we - "the masses" - eventually start to suffer from "protest exhaustion". They can propose a bill - we can rally our troops and get on TV and black out Wikipedia and do 100 interviews and maybe - just maybe - we can kill it.

The first time. And maybe the second time. And maybe even the third time. But after a while we're going to start to get numb to the calls-to-arms. And eventually our sometimes-well-intentioned-but-pulled-in-30-directions representatives are going to stop getting those concerned phone calls and emails from constituents, and they're going to fall prey to the typical "think of the children" argument that often gets put forward on any security bill, and something ugly is going to get passed.

I hate resigning myself to this, but it's the disappointing reality.

What to do?

ori_b2• 13 years ago

Go on the offensive. Instead of just fighting to kill legislation like CISPA, lobby for legislation that will guarantee the freedom of the internet. That will unequivocally protect people's liberties on (and off) the internet.

sp332• 13 years ago

Getting such a law passed does nothing to prevent a future law from saying the opposite.

dubfan2• 13 years ago

The special interests behind legislation like CISPA have professional lobbyists and millions of dollars to pay them. If you're a private citizen and want a law passed at the federal level, you need to have a cute and young white child who died due to something your law legislates against. Otherwise you don't stand a chance of being heard.

unix-dude2• 13 years ago

I really don't think these kinds of bills will end until there is an amendment passed expressly guarenteeing rights relating to internet (or, perhaps more broadly, network) freedom.

In fact, I doubt even that will stop these kinds of laws from being introduced. However, it will give a firm and easy foothold to dismissing them. Similarly, it will become that much easier to retroactively have them removed if they violate an amendment.

The exact text of this kind of amendment would be difficult to craft, frankly, I'm not a lawyer, I have no idea where or how to start crafting this. However, I do fully believe this is the ultimate winning endgame for this kind of legislation.

We need a "legal hacker" a la Richard Stallman to craft something like this.

aptwebapps• 13 years ago

You need a heck of a lot more than a legal hacker to get a Constitutional Amendment passed.

daten• 13 years ago

I worry that most of the opposition to this bill is based on FUD that EFF is spreading. Having experience actually working in the security industry and knowing the limitations that this bill is trying to address, the ability of the government and private sector to work together to keep malicious groups out of their networks, I recognize the necessity and intentions of this bill.

This isn't about spying on Americans. This isn't SOPA with a new name. This isn't about stopping piracy or spying on your facebook profile. This bill is about letting government agencies share intelligence on network threats with private companies so those companies can protect their customers information. None of the agencies or companies involved want to share any private information about their citizens or customers. There are lots of lawyers involved in the process to ensure that doesn't happen.

I wonder if some of that exhaustion is also what leads people to not read the bill or understand the context and just assume it's another anti-piracy bill.

gojomo2• 13 years ago

What are the current barriers to agencies sharing intelligence with private companies? Can you give an anonymized/abstract example, where the FBI/etc might have actionable info about a 'cyber threat', and under current law can't pick up the phone or send an email warning private companies?

Torgo4• 13 years ago

I understand what you're saying, but when legislation is proposed I look at what it very easily could enable, not just what it's written to be for. When I look at what's being proposed I see that the government is using its sovereign power to trade away my right to civil suit against a company in event of a data loss, in exchange to that company for it handing over private information (that very well can include customer information) without a warrant. In big broad, abstract ways this is to my benefit if it improves "cyber security" but it also removes some specific rights I have.

"None of the agencies or companies involved want to share any private information about their citizens or customers." The telcos have monetized their lawful intercept programs and receive bad publicity protection from the government by being legally entitled to keep it a secret. They now have a profit motive and the risk of bad publicity is low. And the civil liability immunity agreement (as I understand it) in CISPA will effectively act as a giant gift that only a sovereign power can grant, we'll offer you protection from being sued if you just hand over business data without a warrant.

If you want to talk about confusing, I watch C-SPAN constantly (it's an illness) and whenever anybody in the legislative or executive branch talks about "cyber security" they always talk about IP protection and "preventing a cyber pearl harbor" in the same breath. So if you want to blame somebody for the confusion start with the people proposing this legislation.

declan8• 13 years ago

You give EFF too much credit. The ACLU, the American Library Association, the Center for Democracy and Technology, the Competitive Enterprise Institute and the Liberty Coalition (both libertarian/conservative groups -- the latter includes Bob Barr and Grover Norquist's Americans for Tax Reform), Reporters Without Borders, etc. sent a letter yesterday to Congress opposing CISPA.

I'm not sure why you think the very smart lawyers and legislative counsel at the ACLU, the ALA, etc. are incapable of reaching their own conclusions about the relative merits of legislation.

I hope you're right that CISPA isn't about spying on Americans. The problem is that, as written, it allows precisely that, with the cooperation of the same companies that have opened their networks to the FedGov in the past. If the wildcard language trumping all state and federal privacy laws were deleted, I think a lot of the (informed) opposition would vanish.

BTW, there were "lots of lawyers involved in the process" of creating SOPA. Look how that turned out. I'd be far more comforted if there we had fewer lawyers and more technologists involved. :)

More: http://news.cnet.com/8301-31921_3-57422693-281/ and http://news.cnet.com/8301-13578_3-57574196-38/

snowwrestler3• 13 years ago

It's not the reality; lines can and are held. For example, drilling in ANWR has been proposed for decades and it still isn't happening, because the organizations who fight are smart about when they fire up their troops.

In addition, environmental type people are not reflexively opposed to/afraid of the federal government, so they are willing to educate themselves about the process and the issue. They learn to distinguish between issues, and when a threat is real vs. perceived.

In comparison the Internet enthusiast community seems to largely persist in the fantasy that the government should not (or cannot) have a role in the regulation of the Internet. Thus when issues do come up, they are ignorant and reactive. And they are eager for issues to go away so that they can go back to "normal" i.e. ignoring the government.

pasbesoin• 13 years ago

This is part of why I've decided to no longer politically support (vote for, nor contribute to) "the best of a bad lot".

Perhaps I'll be "throwing my vote away". Nonetheless, next time around, I'll be choosing from amongst the other choices.

For the Federal elections, it's early enough in the cycle that if people start doing this en masse, it might have some real influence.

AnthonyMouse5• 13 years ago

I keep telling people this, because it can't be emphasized enough: The reason your choice in the general election is between a giant douche and a turd sandwich is that those are the people who win the primaries. If you want to change that, vote in the primaries.

tptacek24• 13 years ago

You are especially likely to become numb to calls to arms when they are in fact cries of "wolf".

SOPA was a genuinely invasive bill and a clear power grab by the content industry. It created a new special second-class "tainted" designation for content sites that refused to play ball with rightsholders and gave rightsholders new means to prosecute their rights outside of civil courts. It was understandable and --- even though I'm a supporter of copyright in general --- commendable that organized opposition to SOPA killed that bill outright.

CISPA is nothing like SOPA.

To begin with, CISPA has none of the same objectives of SOPA. It isn't about the content industry at all. In fact, when early opposition to CISPA by organizations like EFF started catching on, its sponsors scrubbed the bill of language that could have been read (in a stretch) as protecting rightsholders. CISPA is about online security attacks, not about piracy.

Next, CISPA isn't invasive. SOPA threatened to create a kangaroo court system of copyright-noncompliant sites that the content industry could starve by banning commercial transactions with them. CISPA is an opt-i bill; the USG cannot compel any organization to cooperate with any USG agency, but instead creates a facility that companies can use if they need to share attack information but don't want to spend $100,000 in ECPA-interpreting legal review each time they do it.

In fact, CISPA in practice probably has more to do with information moving FROM the USG TO private companies. The USG spends hundreds of millions of dollars a year monitoring its networks (which together constitute the largest IT organization in the world). It is true that the largest IT org in the world happens to be a shitty IT shop, but it has nevertheless built up about a decade of experience tracking malware and botnets and DOS attack information; when Blaster broke out, the experience of the Naval Marine Corp Intranet getting overrun by it was some of the first shared among ISPs. All sorts of random rules prevent USG IT shops from running any kind of central clearinghouse of attack information, and still more rules prevent any of that information from being published.

I don't particularly like CISPA. It obviously sounds like I do, but that's because the uninformed paranoia about CISPA is so virulent that any measured take on the bill sounds like cheerleading. I don't care whether CISPA passes or doesn't pass. But it drives me a little bananas to see how easily the ostensibly curious and well-informed people on HN are bamboozled by identity politics on issues like this.

It's a tiny bill, as bills go. Just go read it.

lawnchair_larry5• 13 years ago

If you truly don't understand why many are opposed to it, you should read the EFF FAQ page.

It doesn't matter what the objectives are, or whether or not the intention is to protect rights holders. It matters what the law actually allows as written. That's what we take issue with.

And yes, I have read the entire thing.

declan8• 13 years ago

It is true that some of the criticism of CISPA is off the mark. So was some of the criticism of SOPA. It does not necessarily follow that _all_ of the criticism of CISPA is uninformed, and in fact much of it is perfectly accurate. Rebutting uninformed criticism may be an entertaining hobby, but it leaves the informed criticism unrebutted.

I have yet to hear a good argument for why we need CISPA to override all federal and state privacy laws, including laws restricting what companies can turn over to the government in the absence of legal process. In programmerese, CISPA is a wildcard approach -- an "rm -rf *" -- when you haven't done an "ls" to see what's in the directory first. Perhaps one or two need to be overriden for good reason, but why not specify them instead of using a wildcard?

Here are some details: http://news.cnet.com/8301-31921_3-57422693-281/ What sparked significant privacy worries is the section of CISPA that says "notwithstanding any other provision of law," companies may share information "with any other entity, including the federal government." It doesn't, however, require them to do so. By including the word "notwithstanding," House Intelligence Committee Chairman Mike Rogers (R-Mich.) and ranking member Dutch Ruppersberger (D-Md.) intended to make CISPA trump all existing federal and state civil and criminal laws. (It's so broad that the non-partisan Congressional Research Service once warned (PDF) that using the term in legislation may "have unforeseen consequences for both existing and future laws.") "Notwithstanding" would trump wiretap laws, Web companies' privacy policies, gun laws, educational record laws, census data, medical records, and other statutes that protect information, warns the ACLU's Richardson: "For cybersecurity purposes, all of those entities can turn over that information to the federal government."

TallGuyShort4• 13 years ago

As a wise man pointed out on HN the last time around, we haven't won when this law fails to pass. We've only won a law explicitly stating the opposite passes.

tptacek24• 13 years ago

So what you're saying is, the best possible thing to happen would be a law specifically preventing any American company from relaying threat information --- packet captures of exploits, netflow traffic profiles of botnets, &c --- to the US government, and, further, preventing any agency in the USG from providing traffic capture information, packet filter information, or botnet identification information to private companies.

TallGuyShort4• 13 years ago

No. In my mind, the best possible thing to happen would be a law specifically preventing any American government agency from requiring any company to hand over such information without due process. Sadly, you would think this was already clear enough from the constitution, but there are already enough loop holes that it happens anyway. Another good thing would be for American internet companies to voluntarily adopt and adhere to privacy policies along the same lines.

tocomment• 13 years ago

Should we use a the internet bat signal[1] on this issue? What do you guys think? Is it already under discussion?

[1] http://internetdefenseleague.org/

Cieplak• 13 years ago

Supporters include companies like AT&T, Facebook, IBM, Intel, Oracle Corporation, Symantec, Verizon, and Microsoft.

http://en.wikipedia.org/wiki/Cyber_Intelligence_Sharing_and_...

I'm envisioning a web dashboard that lets federal agents do fuzzy queries on individuals, to see all the sites visited, emails sent, web searches, browsing habits, etc, from all the IP addresses used by the given individual in the past several years. The system would aggregate information gathered from ISPs and web companies. The government can already get anything they want from an ISP or web company, but they have to do it on a case by case basis and it is probably annoying to correlate information across sources. In the future, I imagine that a federal agent can go to his big brother dashboard, type in a name, and have immediate access to all sorts of information gathered from credit card companies, search providers, ISPs, telecoms.

gojomo2• 13 years ago

Don't forget an "add person to cyber threat watchlist" button!

It should automatically advise internet services that a person/account may be trouble, thus granting those private companies the blanket "exemption from liability... for decisions made based on cyber threat information identified, obtained, or shared under this [law]." (That's one of the most concerning vague and elastic provisions in the current proposed bill text.)

There should also be a 'redress number' subsystem, for when people on the watchlist start noticing their accounts being restricted or disabled, and want to make the case they're not the bad guy the agent who pressed the button thought they were.

pdonis• 13 years ago

Are you actually advocating for these, or just trying to point out how extreme the government's powers could be if CISPA were passed?

SoftwareMaven• 13 years ago

I would bet, at least for the NSA and probably the FBI, this already exists. It just isn't quite as real-time as they would like it to be. Instead of the instant fuzzy-search, it's a couple of quick letters, but the oversight seems to be about the same.

rayiner8• 13 years ago

That would be scary, if CISPA had anything to do with any of that.

diminoten6• 13 years ago

I find it a great way to tell if a person is worth engaging on this issue based on whether or not they think CISPA involves the government proactively asking for information.

ericjeepn• 13 years ago

Just tell the gun lobby that if any of the Gun Shops keep an online database of their customers that's subject to the law. No need to worry about a national gun registry, the GOV gets it for free. Get the NRA involved and ALL OF CONGRESS will run screaming about how this goes against the 2nd Amendment.

crisnoble• 13 years ago

This actually would work. I think the general public either (a) doesn't know about this law at all or (b) doesn't think it will interfere with their daily activities. Getting other big organizations who value privacy would help solve both problems. I think that anyone who begins to understand the law will be opposed to it.

diminoten6• 13 years ago

The Gun Shop would have to volunteer that information to the government according to CISPA, so that wouldn't work.

wmf• 13 years ago

Political maneuvering has nothing to do with what CISPA actually says (as many others in this thread have pointed out).

snowwrestler3• 13 years ago

I supposed I would ask what privacy-protecting language would make the approach envisioned in CISPA (cyber threat data sharing) acceptable to privacy-oriented organizations like the ones listed. If the answer is "none," I would question their good faith in the process--or at least the public face they put on it.

diminoten6• 13 years ago

I am never more reminded of how smart people can succumb to groupthink than I am when I read HN posts about CISPA. There are a lot of misconceptions about the law, including what kind of data gets shared (only relevant threat data, this isn't your bank account info, and the RIAA can't sue you if shared data reveals you to be torrenting movies - can elaborate more on this if there's interest), who does the sharing (orgs share to the government voluntarily), who has access to the sharing (government and people the government decide to share the data with), etc.

I saw an infographic a little while back that I thought made a pretty good representation of what the bill actually proposes, I wonder if anyone has a link available to it.

Wingman4l7• 13 years ago

It's not necessarily the letter of the law that people are worried about, it's the overreach that would result once it's on the books.

diminoten6• 13 years ago

Having read the criticism the EFF's been pointing at CISPA, I fail to see how they're interpreting the bill to mean that such overreaching is even possible. I want to see what sort of changes the EFF would make to the current bill which would satisfy the privacy concerns they're claiming exist.

I think everyone agrees that companies should be able to describe to the cops what the guy who robbed them looked like, and those companies should be able to tell their customers they've been robbed without getting sued by their shareholders because the ensuing PR fallout tanks the stocks.

tptacek24• 13 years ago

The USG is actively prevented by current regulations from setting up a clearinghouse that would collect netflow signatures, botnet identification, and traffic captures of exploit code and then sharing that information with companies like Google and Facebook.

Private companies can and do share (heavily scrubbed) electronic signature information, but must go through contortions to do so, and incur huge legal costs to do it. As a result, only the largest companies participate in these efforts.

Because the USG is more or less enjoined from participating in clearinghouses with private companies, information sharing networks are handshake affairs that are often unknown to anyone outside tier-3 network engineering. Other private IT security product companies run de facto clearinghouses, but only for their customers.

As a result, when your startup gets DDoS'd and you call your ISP for help, they generally can't do shit to help you. It may annoy you to know that if your connectivity provider is large, there is a group in there that could offramp your traffic to internal "scrubbing centers" to peel off DDOS traffic. But because high-end DDoS protection at ISPs is done sub rosa, startups have a very hard time finding these people.

There is an actual problem with online security attacks right now, and hysteria over any USG intervention with the Internet at all is helping perpetuate it. And all it appears to take to fuel that hysteria is statements like "think of the overreach that will happen once a law hits the books".

Civil Liberties Groups Speak Out Against CISPA in Lead Up to Hearings

Related Stories