Reddit co-founder calls out Google, Twitter, Facebook over CISPA

http://www.networkworld.com/news/2013/041013-reddit-268596.html

by denzil_correa • 13 years ago

344 85 13 years ago

tptacek23• 13 years ago

I would like to hear from Ohanian about what changes he would like to see to improve the scope and privacy controls in CISPA.

arbitrage• 13 years ago

How about not passing the beshitted thing in the first place?

knowaveragejoe• 13 years ago

If there are better scope and privacy controls, then what is the issue? The bill has a valid purpose, people are complaining because of the fear of abuse because the language is vague in parts.

deelowe3• 13 years ago

Agreed. There are valid reasons for the bill(mostly around giving agencies the ability to do their jobs in the digital age without unnecessary restrictions). Also, there's that whole issue of having the ability to do something about cyberterrorism(which is happening today by the way). The implementation may not be sound, but something does need to be done.

The CIA and FBI need to be able to research and distribute malware. The government needs to have a way to do something in cyber warefare scenarios. This is why the bill has so many supporters.

My guess is that big businesses are supporting this(Google) due to them having been bit by state sponsored attacks in the past(http://world.time.com/2012/06/06/google-warns-gmail-users-of...).

cygwin982• 13 years ago

Do you see the contradiction here? Google pulled out of China a few years ago because Chinese government was supposedly doing shits like this. Google followed its unofficial "Do not Evil" motto. That's cool. Then this time it is OK for the US to do the same?

AnthonyMouse6• 13 years ago

>something does need to be done.

Can you elaborate on why that is?

"Something must be done" is the refrain of private defense contractors seeking new revenue streams following the tapering off of our most recent foreign excursions. "Cyber war" is total B.S. It's just taking the same industrial espionage issues that have existed forever and adding "on a computer" to it in order to increase the hype level.

There are a ton of things the government could actually do to help with information security. Some of them are even in the bill -- I don't think anyone has a problem with government providing threat information to the private sector. Or how about more funding for security research. Incentives to implement protocols like DNSSEC.

But there is no excuse for exempting corporations from all privacy laws using extremely vague language. The problem with this bill is very much the implementation rather than the intent, but "good intentions" are no justification for bad legislation.

betterunix• 13 years ago

"giving agencies the ability to do their jobs in the digital age without unnecessary restrictions"

Personally, I would happy to see less power given to law enforcement agencies. Maybe a quid pro quo: we let them access communications more easily if they stop using soldiers to do police work.

"that whole issue of having the ability to do something about cyberterrorism"

Something like this?

https://en.wikipedia.org/wiki/Operation_Sundevil

Do you really think we need another E911 document prosecution in this country?

"The CIA and FBI need to be able to research and distribute malware"

They already do that. What does CISPA add?

ryanSrich4• 13 years ago

Any control over the content on the web is inherently bad, regardless of what the media tells you.

ensignavenger3• 13 years ago

I just read the definition of Cybersecurity Threat in the bill. I think the EFF's recommendation to specifically exclude the content of communication would be a major improvement.

I think the complaint that there is no real recourse if a company chooses to share information that does not fit the definition- as the bill grants immunity for such actions and there is no way for an individual to know the information was shared (in order to sue the Fed within the 2 year time frame required) is valid. So one improvement would be to remove the immunity clause. (Or something similar to Rep. Justin Amash's proposed amendment)

When Quest refused to participate in the Fed's illegal spying program, they punished them by moving a large contract from the company. I read nothing in skimming the bill that would prevent the Feds from pulling a similar stunt, promising immunity under CISPA as the carrot, while threatening them with a stick (money) like they did to Quest.

Another possible improvement would be to expand the mission of US-CERT, to make them the point of contact for all information sharing, require them to validate it is cybersecurity related, and then they become the clearing house and the single accountable agency within the US Government for all CISPA related data. (There may be another agency more suitable than USCERT, but I use them as an example.)

There have been several amendments proposed to improve the privacy protections in CISPA, but they have been blocked- and thus we are left to ask why? If it is all good intentions, why block the proposed protections that help ensure that good intentions don't go awry?

tptacek23• 13 years ago

Thank you for this comment. I actually disagree with a lot of it, but you clearly know what the bill is talking about.

You have three concerns:

1. That even though the bill tries to specify what kinds of information can be shared under CISPA, the penalties for "over-sharing" with the USG are very fuzzy (you are immunized not just for sharing to the letter of the bill, but also for "good faith" sharing).

2. That the bill does not prevent the USG from retaliating for failing to cooperate with efforts outside the scope of the bill.

3. That the bill could build up US-CERT instead of diffusing authority (and potential conflicts of interest) through DOJ, DOD, and DNI.

I agree with the 1st, but not the 2nd or the 3rd concern. In particular: your 2nd concern militates for another bill, not an amendment to CISPA.

lawnchair_larry6• 13 years ago

It's funny that you mention Qwest (Now CenturyLink), and the illegal spying program, because they (along with AT&T) are brokering access to the NSA's latest spying toy, which CISPA is intended to expand.

http://www.dc3.mil/dcise/DIB%20Enhanced%20Cybersecurity%20Se...

This DIB Enhanced Cybersecurity Service is being handled by the defense contractors who donate to Mike Rogers:

http://www.opensecrets.org/politicians/contrib.php?cycle=201...

4. AT&T

8. General Dynamics

9. Raytheon

9. SAIC Inc

9. Lockheed Martin

9. Northrop Grumman

19. BAE Systems

Their letters of support for CISPA, referencing the DIB program, are on the Senate website:

http://intelligence.house.gov/sites/intelligence.house.gov/f...

I write to you on behalf of the National Defense Industrial Association (NDIA) to express our support for The Cyber Intelligence Sharing and Protection Act of 2011 (HR 3523). ... As you are aware, NDIA is a non-profit organization, and is America's leading Defense Industry association, ... Our members represent the entire spectrum of the Defense Industrial Base (DIB). ... To illustrate, some NDIA members have participated in the Department of Defense's DIB Pilot program...

http://intelligence.house.gov/sites/intelligence.house.gov/f...

ASIS

... The bill also gives businesses certainty that cybersecurity information shared with the government would be provided safe harbor and would not lead to frivolous lawsuits, among other protections.

http://intelligence.house.gov/sites/intelligence.house.gov/f...

"I am please to write to you to express CSC's wholehearted endorsement of the "Cyber Intelligence Sharing and Protection Act of 2011" which you released today and which requires the Director of National Intelligence to establish a program allowing certified organizations to use classified cyber signatures to help protect their IT enterprises...

As you know, CSC was the first IT enterprise company invited to join the defense industrial base pilot program (DIB)...

This program was quietly started around 2011:

http://www.washingtonpost.com/national/major-internet-servic...

NSA allies with Internet carriers to thwart cyber attacks against defense firms

The National Security Agency is working with Internet service providers to deploy a new generation of tools to scan e-mail and other digital traffic with the goal of thwarting cyberattacks against defense firms by foreign adversaries... The Internet carriers are AT&T, Verizon and CenturyLink. Together they are seeking to filter the traffic of 15 defense contractors, including Lockheed, CSC, SAIC and Northrop Grumman.

There is at least $6B waiting to go to the defense contractors to help the NSA. (They're already working with the NSA on the big Utah datacenter):

ttp://www.bizjournals.com/washington/blog/fedbiz_daily/2013/01/northrop-saic-mantech-among-those-to.html?page=all

Northrop, SAIC, ManTech among those to bid for DHS' $6B cyber program

Northrop Grumman Corp., ManTech International Corp. and SAIC all confirmed to me their plans to bid as a prime contractor for DHS' Continuous Monitoring as a Service program, which will be worth up to $6 billion over five years

pms2• 13 years ago

Actually... Why do they want to pass this bill in the first place?

I mean... The things they want to do are comparable with monitoring all phone calls. Listening to all phone calls and trying to catch dangerous words in the conversations. Why nobody tried to do this with phone calls, but now they try to do this with on-line messaging and social networks?

kaoD• 13 years ago

Because text analysis is very easy compared to audio analysis.

Check YouTube's transcriptions. They suck.

pms2• 13 years ago

Well. That's obvious.

The question is if we need it, and if it won't be abused?

I think we were doing pretty fine without monitoring phone calls, so why do we want to monitor on-line services? Because it's simpler is not a good answer.

tptacek23• 13 years ago

What CISPA purports to do is not comparable with monitoring all phone calls. Where, in the text of the bill or any of its amendments, do you find support for the concern that the law would be used that way?

ryanSrich4• 13 years ago

They don't have to say those exact words pre se. All they have to do is keep the wording vague enough so that those actions can be justified.

darrylb42• 13 years ago

Could be this?

http://www.techdirt.com/articles/20130417/16253022748/oh-loo...

lawnchair_larry6• 13 years ago

Yep, and that's just the tip of the iceberg.

TallboyOne• 13 years ago

I would have a beer with that guy.

maciekp• 13 years ago

freaky moves in the last part

GigabyteCoin• 13 years ago

Hopefully Namecoin will see some more development out of this: http://reddit.com/r/namecoin

davidmr• 13 years ago

> The video is clearly meant to be less than totally serious - it seems unlikely that Ohanian, himself a prominent figure in the tech world, would need to resort to trying to talk his way to Page through Google's public phone number...

I realize that the author probably meant that Ohanian would have connections who might have connections who would have Larry Page's phone number, but the wording of that briefly made me think that the author thought there was some secret phone book you get when you cash out your popular startup for a certain amount.

wavesounds• 13 years ago

Here's the petition: http://www.saveyourprivacypolicy.org/

cinquemb• 13 years ago

well the market just went uptick for the encryption products/services :P

kunai• 13 years ago

If only Aaron Swartz was still alive.

420365247• 13 years ago

Why does this only have 73,000 views on YouTube?....

Reddit co-founder calls out Google, Twitter, Facebook over CISPA

Related Stories