It's official: CISPA is back

http://www.cispaisback.org/

by zizee • 13 years ago

222 48 13 years ago

cispaisback.org

zizee6• 13 years ago

Received this message from the Internet Defence League a short while ago:

FWD----------------

Dear Internet Defense League member,

Last year, right on the heels of our historic victory against SOPA, a piece of really nasty legislation almost passed that would have radically undermined online privacy.

It was called CISPA. And it raced through the US House of Representatives, passing before any of us had a chance to react. We stalled the bill in the Senate, but now CISPA is back, and we don't want to make the same mistake twice. Before there is any movement on the bill, we want to send a strong message to Congress that CISPA shouldn't pass.

That's why we're partnering with the Electronic Frontier Foundation to launch an Internet Defense League action starting tomorrow, Tuesday March 19th.

Can you participate? If so, get the code for your site here: http://members.internetdefenseleague.org

And help get more people signed up by sharing this page with your social network.

Wait, what is CISPA? And why does it matter so much?

CISPA (the Cyber Intelligence Sharing and Protection Act) would give companies complete freedom to share your personal data with the US government. It doesn't require them to do so, but if the government asked it would be hard to say no, and they'd have no reason to-- CISPA would free them from any promises made to customers in public statements or privacy policies.

Your emails, your Facebook account, your bank statements, the websites you visit, your real-time location (courtesy of your cellphone company)-- all of it could soon belong to a slew of government agencies and even local police, who could use it against you without a warrant.

Get the code: http://members.internetdefenseleague.org

The IDL action will display only tomorrow. The banner looks like this: http://i.imgur.com/mVG9kVX.png The modal looks like this: http://i.imgur.com/tCOtoEC.png

And they both link to this action page hosted by the EFF: https://action.eff.org/o/9042/p/dia/action/public/?action_KE...

Please spread the word.

Thanks! Sincerely, Holmes Wilson - Internet Defense League

P.S. If you'd like to learn more about CISPA, the EFF has a great FAQ page here: https://www.eff.org/cybersecurity-bill-faq

GHFigs3• 13 years ago

If you'd like to learn more about CISPA, the EFF has a great FAQ page

Why wouldn't you read the bill yourself?

saraid2162• 13 years ago

You have my magnanimous permission to do both. Go ahead.

zizee6• 13 years ago

I believe this link will give you the text of the bill:

http://www.govtrack.us/congress/bills/113/hr624/text

iamjustin• 13 years ago

Have you seen the text of the bill? Maybe there are some people that would rather read a summary of what the bill would actually do, rather than have to decipher it themselves.

tptacek8• 13 years ago

According to this site, CISPA would "end" online privacy; it urges you to send letters to Congress saying "this bill would have given federal agencies unlimited access to virtually any of my personal data and online communication-- without a warrant."

But of course, CISPA does nothing of the sort. It is:

* An opt-in measure that can't be forced on a private company by the government

* Restricted to "cyber threat information", a term carefully (relative to any other online legislation) defined to apply only to attacks on the confidentiality/integrity/availability of systems and applications

* Specifically restricted from applying to Aaron Swartz-style ToS violations, or, for that matter, to intellectual property misappropriation

* Written to exclude "individuals" from "protected entities" to avoid any reading that would permit ISPs to use it to hand over records for individual targeted customers

And, while it exempts private companies from suits for good-faith attack data sharing (that is the point of the measure), it deliberately makes the government liable for any damages from misuse of shared information.

As Declan McCullagh pointed out in another thread here recently, private companies operate under a bewildering stack of regulations that make it legally dicey to share even innocuous data during attacks. In addition to ECPA and SCA, the two omnibus federal electronic privacy laws, there are a number of domain-specific laws ranging from HIPAA for medical privacy to DPPA for drivers records. Companies who handle protected data currently either don't share attack data, or incur legal risks when they do, or incur legal expenses when they have their sharing practices reviewed.

CISPA is a straightforward (and short) bill that attempts to remedy that problem. I don't support it (I don't think it will do much to help), but it's not evil, and organizations that try to fundraise off the idea that it is are playing games with your attention.

zizee6• 13 years ago

organizations that try to fundraise off the idea that it is are playing games with your attention

Are you saying that the Internet Defence League (http://internetdefenseleague.org/) is deliberately misrepresenting this issue? (not trolling, honest question)

tptacek8• 13 years ago

I think there are multiple points in the "CISPAISBACK.ORG" site that are misleading, and from what I understand of the bill (having read multiple drafts and also survived approximately 900 different HN debates on it), the infographic at the bottom of the page that purports to explain the bill language is in some ways directly false:

* The bill does not cover "intellectual property"

* The bill does not pertain to Photoshop and Nickelback albums

* The bill does not give you no legal recourse if your information is abused; you can sue the government, under liability established explicitly in CISPA

* The bill has nothing whatsoever to do with the objectives of SOPA

diminoten2• 13 years ago

I do, actually, think that are organizations like the IDL and the EFF are misrepresenting this for attention, as it will ostensibly boost their donations.

To be fair, I also think this is the nature of the beast, and almost all advocacy groups do exactly this. I just think these groups, in this specific case, are doing it rather... severely, due to the tendency of the Internet community to react so viscerally towards any legislation that's in any way related to the Internet. When the government uses the word 'cyber' in their legislation proposals, Internet people tend to get nervous.

They're playing on a lot of very legitimate fears that Washington doesn't understand the Internet and seeks to cause harm to its openness. Fears which I hold, to be clear, but not fears which are warranted in this particular case.

They'd gain back a lot of my respect if they prominently focused on the bill's text rather than summaries without citations, and offered explicit amendments which would satisfy their issues. Of course the problem with this is that a great deal of what they're saying isn't citable (it's hard to cite factually dubious statements), and their complaints about the bill are nebulous and nonspecific, so I understand why their rhetoric is not focused on the bill's content (examples of this "the content of the bill doesn't matter, it's the precedent" argument can even be found in this very thread).

gojomo4• 13 years ago

That it's technically 'opt in' doesn't matter much if it biases the incentives for bulk sharing. Agencies can say: "Share anything potentially cyber-crime-related with us, companies, and you'll get blanket immunity, for not just the sharing but all 'decisions' made from the info we give you." Zero risk from sharing, and possibly wind up on law enforcement's 'shit list' for withholding? That makes wide sharing the only thinkable option for risk-minimizing companies.

The terms "cyber threat" and "cybersecurity crime" are very expansively defined in the bill text previously referenced (http://www.govtrack.us/congress/bills/112/hr3523/text). It looks to me like every federal crime where a computer is involved is covered, including unauthorized acquisition of copyrighted material. The lawyers at the EFF and elsewhere also seem to think CISPA will be usable in intellectual property investigations and prosecutions. What's your reference that it's not?

The Swartz prosecution wasn't about mere ToS-violations and it's disingenuous of you to suggest that. ToS violations aren't even mentioned in the original Swartz indictment (http://web.mit.edu/bitbucket/Swartz,%20Aaron%20Indictment.pd...). Swartz's actions, and Auernheimer's, were prosecuted under the CFAA, and the CFAA is specifically named in the CISPA bill text as one of the definitional sources for applicable 'cybersecurity crimes'.

You're giving an awful lot of weight to what prosecutors and law-enforcement say this bill will do. But they tend to downplay new powers when they're being discussed, and then expansively interpret them after passage (and until yanked back by the courts). That's why the EFF and ACLU -- expert organizations who actually fight court cases under this sort of vague language -- should be trusted on matters of practical effects once passed.

And given how bills can expand through amendments to include law enforcement wishlist items at any time, the suggestion that this bill needs no well-funded opposition makes it more likely it will grow into something even worse, via amendment or expansive interpretation. The warnings from privacy advocates that you're criticizing, on the other hand, help make sure CISPA will fail or be better-limited through the amendment process.

tptacek8• 13 years ago

(B) EXCLUSION - Such term does not include information pertaining to efforts to gain unauthorized access to a system or network of a government or private entity that solely involve violations of consumer terms of service or consumer licensing agreements and do not otherwise constitute unauthorized access.

Why does 2013 CISPA have this proviso and the original draft bill not? Because the intention of CISPA is not to harass people for downloading Photoshop, but rather to give enterprises tools for dealing with botnets. But it's hard to learn that from sites like the one we're commenting on, which go out of their way to lie and say that CISPA is an anti-piracy bill.

AnthonyMouse2• 13 years ago

Careful now.

>An opt-in measure that can't be forced on a private company by the government

Allowing companies to "opt-in" to sharing data currently prohibited from being shared by privacy laws could still be something we shouldn't like. Especially if it doesn't restrict what they can do with it after they've shared it.

>Restricted to "cyber threat information", a term carefully (relative to any other online legislation) defined to apply only to attacks on the confidentiality/integrity/availability of systems and applications

This the actual definition from the bill FWIW:

  ‘(A) IN GENERAL- The term ‘cyber threat information’ means information directly pertaining to--

    ‘(i) a vulnerability of a system or network of a government or private entity;

    ‘(ii) a threat to the integrity, confidentiality, or availability of a system or network of a government or private entity or any information stored on, processed on, or transiting such a system or network;

    ‘(iii) efforts to deny access to or degrade, disrupt, or destroy a system or network of a government or private entity; or

    ‘(iv) efforts to gain unauthorized access to a system or network of a government or private entity, including to gain such unauthorized access for the purpose of exfiltrating information stored on, processed on, or transiting a system or network of a government or private entity.

Full text here: http://www.govtrack.us/congress/bills/113/hr624/text

>* Specifically restricted from applying to Aaron Swartz-style ToS violations, or, for that matter, to intellectual property misappropriation

This is the remainder of the definition:

  ‘(B) EXCLUSION- Such term does not include information pertaining to efforts to gain unauthorized access to a system or network of a government or private entity that solely involve violations of consumer terms of service or consumer licensing agreements and do not otherwise constitute unauthorized access.

I don't see anything about intellectual property. I think what you're referring to is that intellectual property in the early drafts was explicitly included and was removed. But I don't see anywhere it's explicitly excluded and EFF seems to think the replacement wording could still be read to cover it in various cases. [1]

[1] https://www.eff.org/cybersecurity-bill-faq

>* Written to exclude "individuals" from "protected entities" to avoid any reading that would permit ISPs to use it to hand over records for individual targeted customers

If that was the intention then they did a pretty crappy job, because if you're a "protected entity" then sharing requires your "express consent" and qualifies you for the immunity provision if you share information or make "decisions" based on it, and I don't see anything prohibiting the sharing of information on individuals who aren't protected entities.

There is a list of categories of information in (c)(4) that can't be used, but it's ridiculously inadequate and in any event only applies to the federal government.

>As Declan McCullagh pointed out in another thread here recently, private companies operate under a bewildering stack of regulations that make it legally dicey to share even innocuous data during attacks.

I think this is probably true, and perhaps warrants some kind of a response. But this bill as written looks to me like a minefield of unintended consequences.

tptacek8• 13 years ago

First, let's be clear about the debate. I am not saying that it's unreasonable to oppose CISPA. My beef is with organizations who are dishonest about what the bill contains.

So, for instance, when it comes to "intellectual property" enforcement, an issue brought up directly by the site we're commenting on, IPR protection was removed from the 2012 CISPA bill before it was voted on. The term "intellectual property" occurs in the (incorrect) callout of the bill text on this site.

Next, as regards the definition of "cyber threat information", I'll only say again: this is a narrower, more specific definition of online security threats than in any other piece of online security legislation I've ever read. The intent of that language seems straightforward to me. And the explicit exemption of consumer terms of service and licensing is unprecedented, which makes it all the more jarring to see the bill compared to SOPA.

Regarding the "protected entities" and "individuals", should this issue come before a court, the court won't have to look far to see the intent of the language, since the House Select Committee on Intelligence published a FAQ that states directly that the intent of that language is to prevent ISPs from sharing information about one of its individual customers.

If you want to lay out a comprehensive case against CISPA, or even a few selected valid ones, I'd welcome the input. I'm afraid we don't have much good critique of the bill to work from. I know I sound like a CISPA booster, but I'm not; I'm a "not getting played by interest groups" booster.

sowhatquestion• 13 years ago

I'm sorry, but do you honestly believe that the specific provisions of this bill matter? Do you honestly believe that whatever it says won't be stretched to justify the most invasive and overbearing applications? The corporations under discussion here--whatever leeway they may have to opt-in or opt-out--are the same enlightened creatures who have (for example) interpreted the DMCA in all of our best interests.

This is not about CISPA. This is about drilling the message into Congress that we don't need any new regulation of the Internet--or any expansion of the post-9/11 surveillance regime, period--no matter how well-intentioned.

tptacek8• 13 years ago

If the terms of this bill don't matter, then neither do the ones in ECPA and SCA, and we can all stop pretending like any of these bills matter and just let the content industry pass SOPA while they're at it.

declan2• 13 years ago

tptacek: Thanks for the call-out in this thread! To continue our (I think) polite disagreement from before, I think your description is accurate in specifics but doesn't address the broader privacy and surveillance landscape. Remember the debate five years ago over retroactive immunity for the telecommunications companies that opened their networks to the NSA in violation of the law?

By overriding every federal and state law on the books -- the wildcard approach -- CISPA encourages this kind of broad data hoovering for cybersecurity purposes. Defenders of CISPA claim "cybersecurity" purposes is narrowly defined; reasonable people may disagree. And I have yet to hear a good reason why a wildcard approach is necessary, when even CRS raises questions about unintended consequences.

Also the recent EO accomplishes a lot in terms of info-sharing, and it's worth reading: http://www.whitehouse.gov/the-press-office/2013/02/12/execut...

That said, I agree that some advocacy groups may overstate the privacy concerns about CISPA. I think the charitable interpretation is that they're overly eager or misinformed, not that they're trying to profit off of misinformation. People do this sort of advocacy work out of their hearts, not because they're trying to get rich.* I extend the same charitable explanation to CISPA's drafters.

* That's why people become entrepreneurs and try to get into YC! :)

edit: FAQ link: http://news.cnet.com/8301-31921_3-57422693-281/how-cispa-wou...

snowwrestler3• 13 years ago

If not the wildcard approach, then what is the acceptable alternative? This is my biggest problem with the opposition to CISPA--they jumped straight to "kill the bill". The cynical take on that is that "do or die" campaigns are easier, more fun, and more lucrative to nonprofits than nuanced policy proposals.

tptacek8• 13 years ago

It is interesting that you think it's a better idea to revisit and reweigh the privacy decisions of every privacy bill that could interfere with attack data sharing, so that we can relitigate the sensitivity of driver's records or patient health information, rather than simply crafting a measure that says "leave intact every privacy regulation on the books, don't crack open laws that settled policy disputes about privacy years or decades ago, and instead just do the commonsense thing and let IT people at companies share Netflow and botnet information."

ancarda• 13 years ago

How am I not surprised Facebook and Microsoft are on that list. Two companies I trust SO much with my privacy.

hkmurakami• 13 years ago

Here's what dismays me about this. We killed it once. It's back again. Let's say it's bad and we want to kill it, and we succeed again.

What's to say it won't come back again? How long do we have to keep doing this dance? Even if it is worth killing every time, will our attention spans be long enough to keep fighting it every single time for the decades that may still come?

zizee6• 13 years ago

"The price of liberty is eternal vigilance." -unknown.

harshreality• 13 years ago

That's a slightly modified form of the "eternal vigilance" quote by http://en.wikipedia.org/wiki/John_Philpot_Curran

TruthElixirX2• 13 years ago

Yay. You understand why this whole process is futile. This bill isn't the problem. This bill is a symptom of the problem. The problem is not going away. The problem is the U.S. federal government.

It is an out of control machine of death seeking to criminalize as much behavior as possible.

The U.S. has the highest incarceration rate. They have the most weapons.

This kind of thing will not end until the government collapses in on itself or people have an entire paradigm shift in the way that they think of their relation to their fellow person.

Aloha• 13 years ago

The people have nothing to do with it anymore.

The vested moneyed interests are in control, and will be until the people wake up from their stupor and pay attention.

brown9-2• 13 years ago

I actually think that it's a pretty good characteristic of the US government that unpopular proposed laws have to be re-proposed rather than rammed through without any debate or legislative process by some sort of dictatorship.

saraid2162• 13 years ago

A complete answer to this question is really nothing less than a comprehensive study of the entire field of political science. The reality is that you have two choices: you either defer your right of governance to someone else and just stop caring, or you will never be free of this.

No victory is eternal. There is no such thing as victory.

In a sense, this is actually why it keeps coming up. The reality of governance is such an immense expanse of tedium that a great many people buckle under it and try to imagine themselves as heroes or rebels or old wise men. They go looking for enemies where there are none and make them up to fight, making meaning where none was needed before.

In any case, the answer to your question is, "Until you're dead, and someone else will have to keep it up after that."

dchichkov• 13 years ago

Yep. Sure. It will come back in a decade or so. And then in another decade. And I actually find that encouraging. That's democracy in action.

But meanwhile, now, - let's do something positive and try to avert that bill that facilitates violations of essential liberties!

snowwrestler3• 13 years ago

You have to keep doing the dance forever. This is what it means to live in a republic.

diminoten2• 13 years ago

How did we "kill" CISPA? It passed with a vote count of 248-168 in the house.

ehm_may• 13 years ago

I actually wrote a blog post on CISPA a while back. http://michaelmay.me/2013/02/17/wtf-is-cispa

I'm not worried about it. However, I may not be entirely correct in my analysis. Would be interested in feedback.

bitgangsta• 13 years ago

We worked with Change.org & Twilio to build this petition tool on CISPA, it's the second-largest with over 43k signatures. http://cispapetition.org

squozzer• 13 years ago

<fact> I went ahead and signed the petition. </fact>

<opinion> The comments I've read so far seem pretty thoughtful both pro and con.

And for the most part, the US government acts in good faith.

BUT, on occasion we find ourselves looking pretty foolish when we believe uncritically what a government says (Iraq war) or horrified at what seems to be gratuitous heavy-handedness on the government's part (Swartz.)

And despite what former Secretary Clinton would like you to believe, there is no reset button on government legitimacy. Like an individual's reputation, it takes years to restore what was eroded in hours.

And while cyber attacks seem to represent a threat best countered by an organization that commands resources on a national scale, can we really trust them to do the right thing?

Hell, they put a PFC in a position to disseminate State Department messages. Anyone who's done a stint in the Army knows not to put a PFC in charge of anything except maybe a trigger, and even then under the guidance of an NCO. </opinion>

<speculation> I forward the hypothesis that the government has more interest in tracking (untaxed) financial transactions than thwarting cyber attacks.

The government's ability to fund itself has come to rely heavily on the Fed buying US debt, which some might call "printing money".

The longer that continues, the less credible the US dollar becomes in world finance.

The only thing keeping the dollar afloat is the rather poor state of the euro and yen, and the world's reluctance to trust China or Russia.

So the US is going fishing for sources of loot.

If the hypothesis is true, CISPA might be a godsend to Joe Six-Pack, or at least better than what's happening in Cyprus.

But in the end I think we'll get CISPA and Cyprus. </speculation>

It's official: CISPA is back

Related Stories