3 ms·

Because surely the government will interpret "cyber threat indicator" in the most restricted, privacy-saving way imaginable? The first thing this bill allows f

Because surely the government will interpret "cyber threat indicator" in the most restricted, privacy-saving way imaginable? The first thing this bill allows for is to have Facebook rat out whatever communication they deem "malicious" to the federal government and be shielded from the fallout.

tptacek 11y ago
That's not true. The bill does not allow Facebook to "deem" any communication "malicious". It can share only indicators, a term that has a definition in the bill more detailed than that of any other computer security term anywhere else in US law. Meanwhile, the clear implication of the article we're commenting on, and the idea FFTF is trying to spread, is that CISA allows Facebook to violate user privacy, and to build its business doing so, by leveraging CISA. That's a nonsensical argument, and a terribly dishonest one. CISA is a bad law, much more so than CISPA, which preceded it. The reason we have CISA instead of CISPA? FFTF.
- arkem 11y ago
  After reading the text of the bill I'm full of indifference towards it. Can you expand on why you think it's a bad law? I'd like to know because I'm probably missing an angle.
  - tptacek 11y ago
    Where you are with CISA, I was with CISPA. But CISA extends CISPA so that data collected from providers can be used to further a whole set of unrelated criminal investigations, which blurs the line, from trying to solve a computer security problem to building new investigative tools. I'm not opposed in principle to new investigative tools, but I don't think debate about them should be avoided by sticking them into cybersecurity bills. Still: virtually everything organizations like FFTF say about CISA seems to be false, and all you have to do to see how is to read the actual text of the bill.
    - arkem 11y ago
      Thanks for the explanation. The terrorism and law enforcement angles on the use of IoCs were my least favorite parts for me as well.

tptacek 11y ago

That's not true. The bill does not allow Facebook to "deem" any communication "malicious". It can share only indicators, a term that has a definition in the bill more detailed than that of any other computer security term anywhere else in US law. Meanwhile, the clear implication of the article we're commenting on, and the idea FFTF is trying to spread, is that CISA allows Facebook to violate user privacy, and to build its business doing so, by leveraging CISA. That's a nonsensical argument, and a terribly dishonest one. CISA is a bad law, much more so than CISPA, which preceded it. The reason we have CISA instead of CISPA? FFTF.

arkem 11y ago
After reading the text of the bill I'm full of indifference towards it. Can you expand on why you think it's a bad law? I'd like to know because I'm probably missing an angle.
- tptacek 11y ago
  Where you are with CISA, I was with CISPA. But CISA extends CISPA so that data collected from providers can be used to further a whole set of unrelated criminal investigations, which blurs the line, from trying to solve a computer security problem to building new investigative tools. I'm not opposed in principle to new investigative tools, but I don't think debate about them should be avoided by sticking them into cybersecurity bills. Still: virtually everything organizations like FFTF say about CISA seems to be false, and all you have to do to see how is to read the actual text of the bill.
  - arkem 11y ago
    Thanks for the explanation. The terrorism and law enforcement angles on the use of IoCs were my least favorite parts for me as well.