4 ms·

"CISA would give companies like Facebook legal immunity for violating privacy laws as long as they share information with the government." Whether or not Faceb

"CISA would give companies like Facebook legal immunity for violating privacy laws as long as they share information with the government." Whether or not Facebook is secretly lobbying for CISA, the article describes the way the incentives look.

tptacek 11y ago
That summary is also grossly inaccurate, easy crossing the bar for "dishonest".
- revelation 11y ago
  Because surely the government will interpret "cyber threat indicator" in the most restricted, privacy-saving way imaginable? The first thing this bill allows for is to have Facebook rat out whatever communication they deem "malicious" to the federal government and be shielded from the fallout.
  - tptacek 11y ago
    That's not true. The bill does not allow Facebook to "deem" any communication "malicious". It can share only indicators, a term that has a definition in the bill more detailed than that of any other computer security term anywhere else in US law. Meanwhile, the clear implication of the article we're commenting on, and the idea FFTF is trying to spread, is that CISA allows Facebook to violate user privacy, and to build its business doing so, by leveraging CISA. That's a nonsensical argument, and a terribly dishonest one. CISA is a bad law, much more so than CISPA, which preceded it. The reason we have CISA instead of CISPA? FFTF.
    - arkem 11y ago
      After reading the text of the bill I'm full of indifference towards it. Can you expand on why you think it's a bad law? I'd like to know because I'm probably missing an angle.
      - tptacek 11y ago
        Where you are with CISA, I was with CISPA. But CISA extends CISPA so that data collected from providers can be used to further a whole set of unrelated criminal investigations, which blurs the line, from trying to solve a computer security problem to building new investigative tools. I'm not opposed in principle to new investigative tools, but I don't think debate about them should be avoided by sticking them into cybersecurity bills. Still: virtually everything organizations like FFTF say about CISA seems to be false, and all you have to do to see how is to read the actual text of the bill.
        arkem 11y ago
        Thanks for the explanation. The terrorism and law enforcement angles on the use of IoCs were my least favorite parts for me as well.
- tzs 11y ago
  I had to ask the two main people from FFTF that post here and on Reddit twice here on HN and around six times on Reddit, but one of them finally answered my question [1] as to exactly what part of CISA would give companies immunity as long as they also share with the government. They are basing that on this article [2]. [1] https://www.reddit.com/r/technology/comments/3q1kgl/facebook_may_be_the_secret_force_behind/cwbxbyp https://www.reddit.com/r/technology/comments/3q1kgl/facebook... [2] https://www.emptywheel.net/2015/10/14/time-to-get-very-concerned-about-cisa-gutting-governmental-leverage-on-corporations-over-cyber/ https://www.emptywheel.net/2015/10/14/time-to-get-very-conce...
pdkl95 11y ago
> legal immunity for violating ... laws [when working] with the government Aka, a Letter Of Marque[1]. Facebook wants to be a modern privateer. Selling plundered data and reputation is less violent than the cargo that was traditionally the target of privateering, but it's still government-backed piracy. [1] https://en.wikipedia.org/wiki/Letter_of_marque https://en.wikipedia.org/wiki/Letter_of_marque edit: Wow. +5 to -1. That's more than the usual number of people using down-votes as a substitute for rebuttal.
- arkem 11y ago
  It's really not. CISA is a vehicle for the distribution of Indications of Compromise and other standard infosec threat intelligence between Government entities as well as the public and large corporations. The liability protections are completely reasonable if private companies were going to participate at all. The privacy protections built in are also much more thorough than I was expecting in a bill of this nature. Really the only thing that really worries me about is that the things that the Government is allowed to do with shared information includes "identifying the use of an information system by a foreign adversary or terrorist". Which seems a little too broad for my tastes. In fact, I was on the CISA hate train but after reading it I feel that it's an entirely inoffensive law and my outrage has fizzled into indifference. I'm not going to lose sleep if this passed nor if it isn't but likening it to a Letter of Marque is not warranted. Here's the text for anyone interested: https://www.congress.gov/bill/114th-congress/senate-bill/754 https://www.congress.gov/bill/114th-congress/senate-bill/754
- Dylan16807 11y ago
  People are less likely to reply when you're being silly. Facebook didn't plunder this data, and a letter of marque sounds like a bounty hunting license, not a law adding immunities for certain classes of action.

tptacek 11y ago

That summary is also grossly inaccurate, easy crossing the bar for "dishonest".

revelation 11y ago
Because surely the government will interpret "cyber threat indicator" in the most restricted, privacy-saving way imaginable? The first thing this bill allows for is to have Facebook rat out whatever communication they deem "malicious" to the federal government and be shielded from the fallout.
- tptacek 11y ago
  That's not true. The bill does not allow Facebook to "deem" any communication "malicious". It can share only indicators, a term that has a definition in the bill more detailed than that of any other computer security term anywhere else in US law. Meanwhile, the clear implication of the article we're commenting on, and the idea FFTF is trying to spread, is that CISA allows Facebook to violate user privacy, and to build its business doing so, by leveraging CISA. That's a nonsensical argument, and a terribly dishonest one. CISA is a bad law, much more so than CISPA, which preceded it. The reason we have CISA instead of CISPA? FFTF.
  - arkem 11y ago
    After reading the text of the bill I'm full of indifference towards it. Can you expand on why you think it's a bad law? I'd like to know because I'm probably missing an angle.
    - tptacek 11y ago
      Where you are with CISA, I was with CISPA. But CISA extends CISPA so that data collected from providers can be used to further a whole set of unrelated criminal investigations, which blurs the line, from trying to solve a computer security problem to building new investigative tools. I'm not opposed in principle to new investigative tools, but I don't think debate about them should be avoided by sticking them into cybersecurity bills. Still: virtually everything organizations like FFTF say about CISA seems to be false, and all you have to do to see how is to read the actual text of the bill.
      - arkem 11y ago
        Thanks for the explanation. The terrorism and law enforcement angles on the use of IoCs were my least favorite parts for me as well.
tzs 11y ago
I had to ask the two main people from FFTF that post here and on Reddit twice here on HN and around six times on Reddit, but one of them finally answered my question [1] as to exactly what part of CISA would give companies immunity as long as they also share with the government. They are basing that on this article [2]. [1] https://www.reddit.com/r/technology/comments/3q1kgl/facebook_may_be_the_secret_force_behind/cwbxbyp https://www.reddit.com/r/technology/comments/3q1kgl/facebook... [2] https://www.emptywheel.net/2015/10/14/time-to-get-very-concerned-about-cisa-gutting-governmental-leverage-on-corporations-over-cyber/ https://www.emptywheel.net/2015/10/14/time-to-get-very-conce...

pdkl95 11y ago

> legal immunity for violating ... laws [when working] with the government Aka, a Letter Of Marque[1]. Facebook wants to be a modern privateer. Selling plundered data and reputation is less violent than the cargo that was traditionally the target of privateering, but it's still government-backed piracy. [1] https://en.wikipedia.org/wiki/Letter_of_marque https://en.wikipedia.org/wiki/Letter_of_marque edit: Wow. +5 to -1. That's more than the usual number of people using down-votes as a substitute for rebuttal.

arkem 11y ago
It's really not. CISA is a vehicle for the distribution of Indications of Compromise and other standard infosec threat intelligence between Government entities as well as the public and large corporations. The liability protections are completely reasonable if private companies were going to participate at all. The privacy protections built in are also much more thorough than I was expecting in a bill of this nature. Really the only thing that really worries me about is that the things that the Government is allowed to do with shared information includes "identifying the use of an information system by a foreign adversary or terrorist". Which seems a little too broad for my tastes. In fact, I was on the CISA hate train but after reading it I feel that it's an entirely inoffensive law and my outrage has fizzled into indifference. I'm not going to lose sleep if this passed nor if it isn't but likening it to a Letter of Marque is not warranted. Here's the text for anyone interested: https://www.congress.gov/bill/114th-congress/senate-bill/754 https://www.congress.gov/bill/114th-congress/senate-bill/754
Dylan16807 11y ago
People are less likely to reply when you're being silly. Facebook didn't plunder this data, and a letter of marque sounds like a bounty hunting license, not a law adding immunities for certain classes of action.