12 ms·

Despite privacy concerns, CISA bill poised for passage

321 points by lizmrush 11y ago

mtgx 11y ago
Once again we can thank Dianne Feinstein for this. How did she get re-elected again? Was it gerrymandering or did her NSA buddies, which she keeps propping up, hack the poorly secured voting machines?
- tshtf 11y ago
  Feinstein is a senator. How could gerrymandering have anything to do with her election?
  - tptacek 11y ago
    (the answer, of course, is that it can't)
    - cma 11y ago
      Passive gerrymandering. California's state lines were intentionally not redrawn before the last election, so as to not absorb Republican voters from Nevada, which would have diluted the democratic majority in California and made things tough for Feinstein. The OP is hinting through his username that somehow the Mt. Gox bitcoin exchange was involved.
      - spicyj 11y ago
        Unlikely, given that mtgx's account here is 3.5 years old.
      - tptacek 11y ago
        I am finding it very difficult to believe that any modern border dispute between California and Nevada could have flipped California. Feinstein won 49.5 to 12.7; a landslide victory. Gerrymandering had nothing to do with CISA.
        rhino369 11y ago
        I think cma was being facetious.
        tptacek 11y ago
        I think you're right. Sorry! One of those days.
  - snowwrestler 11y ago
    Have you seen the shape of California? I mean, it's implausible at best. :-) But seriously, it's kind of fun to imagine what life would be like if U.S. states were shaped like House districts. Maryland is probably the closest, geometrically.
    - schoen 11y ago
      There's a cool exhibit in the Oakland Museum of California about proposals for the shape of the eastern border of California! Interestingly, some of the motivations for the proposals did involve something like gerrymandering, in terms of arguments about how many Mormons who had emigrated to the west would end up being included in California's territory. Another interesting thing about the California-Nevada border that ended up getting adopted is where the northwest line turns north (where the bend is): it's inside of Lake Tahoe. That makes it a lot easier to remember!
    - WildUtah 11y ago
      Have you seen the shape of California? Did you know that Reno has been gerrymandered so far it's now west of Los Angeles? That has to be some kind of conspiracy. Otherwise it would just be impossible.
      - snowwrestler 11y ago
        California was stretched so far that it covers the full distance from the lowest elevation in the lower 48 to the highest summit in the lower 48. It was also shaped so that it encompassed the driest point in the U.S.--Death Valley--and one of the wettest: 100 feet underwater below the Golden Gate Bridge. Also, if the state of California were its own country, it would be referred to as the nation of California. True story.
    - deleted 11y ago
      [deleted]
- jtmcmc 11y ago
  Feinnstein is a very long running senator with a hugely entrenched power base. Because of that it's hard to remove her from office. She also despite being very authoritarian is fairly progressive in other respects so she is able to appeal to her base of older democrats in that respect. I really really dislike her, but it totally makes sense that she is basically invulnerable within her senate seat.
  - swang 11y ago
    This is the reason why I don't fill in a ballot for her whenever her seat comes up. I know it's not going to do much, and I am not really sure I want a Republican in that seat (if that were even possible) since I doubt it would be any better than her positions. All I see with her about this is the hypocrisy of it all. She is totally fine with the NSA intervening in our lives, but threw a huge fit when the CIA was found to be spying on members of Congress. Yes, spying on the people is OK, but spying on Congress by the CIA is a "violation of separation of powers" and shouldn't be tolerated?
    - protomyth 11y ago
      That's why primary challenges are important. I doubt she'll be gone before she wants to be, but I was skeptical they could get Cantor also.
- bsder 11y ago
  Neither. The Republicans run idiotic candidates like Carly who Feinstein and Boxer eat for breakfast.
- wfo 11y ago
  For the vast majority of Americans, surveillance and internet security are pretty close to the bottom of their list of concerns. This is a forum is an echo chamber full of a tiny concentrated group of technical people many of whom are very extreme single issue voters about this sort of thing which is a gross micharacterization of Californians or Americans as a whole. People elect Feinstein because they think she is doing a good job. They might even agree with you that she's wrong on your pet issue but that issue just isn't as important to them as it is to you.
Laaw 11y ago
Setting aside any hatred for the government and mistrust, how does Company A share information with Company B (or the FBI) about how a hacker got into their networks? Is the concern that Google is going to hand over your browser history under the guise of CISA?
- tptacek 11y ago
  The law doesn't define how information is to be shared; it merely makes it lawful for the sharing to happen, so long as it meets the conditions in the statute. This is pretty typical for bills in US Federal Law: Congress enacts a relatively broad statute that establishes principles relied upon in a later "rulemaking" process; the statute will delegate to specific agencies the privilege of making those rules.
  - Laaw 11y ago
    If this law isn't enacted, then it will continue to be illegal for Company A to share breach details with the government, or with each other. Is this necessary to slow down the rate and severity of breaches? If so, what should this law look like?
    - tptacek 11y ago
      I don't think the harm outweighs the limited good in this situation. I'm negative on CISA. I was neutral on CISPA, which didn't have the law enforcement investigative enhancements CISA has. But I still don't think it's a big deal either way. Like, don't donate money to prevent it from passing if this is the only donation you can make this year.
- unethical_ban 11y ago
  Mailing lists and phone calls are a big part of it.
tptacek 11y ago
The actual text of CISA: https://www.govtrack.us/congress/bills/114/s754/text https://www.govtrack.us/congress/bills/114/s754/text There are no amendments to CISA that I can find (CISPA collected quite a few amendments, some of which were very relevant to HN, before the bill eventually died). I read CISA so you don't have to! (You still should). Here's a summary: There are three particularly important defined concepts: <<Sec. 2 (5) (A) "Threats">>, which means "unauthorized activity" that might plausibly compromise confidentiality, integrity, or availability, but that isn't either protected speech or a mere ToS violation. <<Sec 2 (6) "Indicators">>, the most important concept in the bill, which is, roughly: logs of recon activity, exploit techniques, vulnerability data, account hijack techniques (I think this bill actually tries to capture the notion of an XSS), bot C&Cs, damage reports on attacks, and anything else related to security and not already prohibited by law. <<Sec 2 (7) "Defensive measures">>, roughly, things that stop or monitor attacks. "Defensive measures" is a confusing concept in the bill. For awhile, it was thought that CISA would authorize something akin to hack-back privilege for private entities; it does not. Meanwhile, defensive measures are probably already lawfully shareable. Anyways, the bill allows you to share both indicators and defenses. The bill allows the USG to share indicators and defensive measures with private entities, and vice versa. So then: Section 3 of the bill authorizes the USG to share stuff with private entities. This isn't the part of the bill that concerns people (we all probably want more sharing from USG to private entities; for instance, that's what we're saying every time we demand NSA fork over its zero-days). Section 4 authorizes private entities to share with the USG. Here's what it allows: (a) You can monitor your own systems, or those of people who give you written authorization, for any security purpose, notwithstanding any previous limitation on monitoring. Even if ECPA or student records law says you shouldn't monitor, if you're doing it to deal with security threats, you're now allowed to. (b) You can run your own defensive measures, or defensive measures on people who give you written authorization. Ok then. (c) You can share indicators and defenses with the USG, and receive them from the USG so long as you comply with their sharing restrictions. (d) You have to keep the data secure, you can't share it willy-nilly, and before you share anything, you have to (1) review it for PII and (2) anonymize any PII you find. Sec 4 (d) (4) has problematic language that allows, say, Facebook to provide written authorization to the USG to prosecute based on shared indicators; in theory, they can do this even if the prosecution they're going to launch isn't related to a computer crime, but just happens to be illuminated by the indicator Facebook shared. (But remember: Facebook can't share under CISA unless they have a bona fide cybersecurity purpose for doing so). Section 5 has a bunch of rulemaking authority in it, but buried in it is Sec 5 (d) (5) (a), which gives all the purposes FedGov is allowed to use indicators for: * any security purpose * attributing threats * determining whether threats are foreign * preventing immediate disaster/harm (iv) * stopping child sex trafficking (v) * stopping major felonies, espionage, trade secret theft (vi) (iv), (v), and (vi) are major problems; these aren't cybersecurity purposes at all, but rather a sort of "these crimes are so bad that we're allowed to repurpose indicators to deal with them", which, maybe fair enough (except for trade secret theft), but still, not OK that new investigative capabilities are buried in the middle of a cybersecurity bill. And that's it.
belak 11y ago
There's an AMA on reddit right now with the EFF, Access, Fight for the Future, FFTF, and Demand Progress about this. https://www.reddit.com/r/IAmA/comments/3qban2/oh_look_its_that_cisa_surveillance_bill_again/ https://www.reddit.com/r/IAmA/comments/3qban2/oh_look_its_th... Looks like it just started a few minutes ago, so no idea if it'll be useful, or not.
- tptacek 11y ago
  I'm never super happy with EFF's advocacy (I think they do good and important legal and technical work but I'm almost always unhappy with how they represent policy to the public). I've been uniformly discouraged by FFTF's advocacy, which I find goes way past "misleading" into "straight up dishonest", such as their recent piece that strongly suggested Facebook supported CISA (a fact not in evidence, for whatever that's worth) because doing so would immunize them from privacy suits for user data so long as they dumped all that user data to the USG. No reading of CISA gets you to that. Example from today's AMA is FFTF's claim that CISA "exempts itself from FOIA", making it impossible to challenge in court: they're referring to Sec 4 (d) (4) (b), which exempts from FOIA individual shared indicators, which of course must be the case, because indicators are things like compromised account names and passwords. That's all the law exempts from disclosure.
  - dsp1234 11y ago
    they're referring to Sec 4 (d) (4) (b) Also 5 (d) (3) (a) and (b) which exempts "Cyber threat indicators and defensive measures provided to the Federal Government under this Act".
    - tptacek 11y ago
      Right. Same deal, right? They're simply saying that raw indicators are exempt from FOIA, and, of course, they'd have to be.
      - dsp1234 11y ago
        So I guess the serious (and it is serious) question is this. If I can't FOIA for security indicators, or defensive measures, then how could I ever know that they included illegal or illegitimate information about me?
godgod 11y ago
More proof that we have a facist government in place. This bill gives the corporations legal immunity and allows the government full access to your private data...WITHOUT A WARRANT. Enjoy the cloud. Freedom is dead.
orionblastar 11y ago
I can't believe the number of times this bill has been voted down, only to come back up for a vote again under a different bill or different name. It is like they keep submitting bills until it gets passed. This not only is a waste of time, it seems to be how the lobbyists get their bills passed. Eventually one will get passed and then our privacy will no longer exist. If you want our data, get a judge to order a search warrant. Otherwise it is Unconstitutional.
- dmfdmf 11y ago
  >If you want our data, get a judge to order a search warrant. Otherwise it is Unconstitutional. This is my position and nothing will move me from it because it is the principled position. Moreover, the advocates of mass surveillance fail to realize that even if their motives are as pure as the driven snow nevertheless a mass surveillance system will attract sociopaths and psychopaths who survive by preying on other human beings instead of creating value and trade. This is exactly why we have a Constitution to limit the powers of government.
  - orionblastar 11y ago
    I fear a Police State where it is basically an 1984 type of society. Instead of TV sets watching us, it is our smart phones. The only thing protecting us from the Thought Police is the fact that our smart phones are encrypted so that we can have privacy. Take away that encryption and let the Police or anyone else have access to anyone's smart phone and there is no privacy and you can be arrested for stuff you didn't do but might because some machine learning algorithm says you might commit a crime. Sort of like the Minority Report TV show were they stopped using precogs and went to a Hawkeye program that uses ML to tell if someone is going to do a crime and has access to everything in the public to tell.
littletimmy 11y ago
Dianne Feinstein again? Wasn't she Really angry some time ago when it was revealed the NSA spied on Congress? Does privacy apply only to Congress and not to ordinary citizens? Ms. Feinstein peaked before the computer was invented. It is time this 82-year-old was retired and we get in charge someone who understands technology. How does this woman keep getting elected?
- deleted 11y ago
  [deleted]
- tptacek 11y ago
  But this industry isn't ageist at all, no...
- wavefunction 11y ago
  She supports the motion-picture industry and has incumbent support in a safe district for her political party. As a senator with real seniority she's quite embedded in the system. I believe she was more concerned about a) the NSA facing public scrutiny b) that the CIA hacked her computer resources in an attempt to determine what line of inquiry into torture the sub-committee on CIA torture investigation was headed towards. So yes, warrantless-surveillance is for "the little people" as far as she and the other members of Congress are concerned, mostly.
jcrawfordor 11y ago
One of the things that concerns me about this debacle is that ongoing CISA controversy will eliminate the possibility of legislative support for information sharing for good. I appreciate that there are privacy concerns in CISA, however, it is very important to the security field that sharing of intelligence indicators become more plainly safe from a legal perspective. 'Indicators' usually consist of information about external actors and organizations that are relevant to intrusion detection, for example, the most common types of indicators are domains used for C&C and hashes of malicious files. It is difficult to construe a privacy violation from these types of indicators. There are concerns about certain providers who may have indicators relevant to their users - for example, some providers might share the names of otherwise legitimate user accounts which have been compromised as these are often used to send spam that ought to be blocked. However, in general, cyber intel indicators do not involve sensitive information about users. Right now a great deal of organizations are not participating in public or private threat information sharing because of concerns over liability and compliance, and this significantly impedes defense by letting threat actors get away with infrastructure and tool reuse that ideally should reveal them. These acts originated as an attempt to correct that. It looks alarmingly like many advocacy organizations want to keep it this way for good. I don't want to be painted as anti-privacy and I would say that I'm not, but the principal goal of this legislation is not to send your data to the NSA, it's to help me do my job. I hope that the internet community will have the foresight to try to resolve the specific problems with current legislation, and not to entirely prevent information sharing.
- snowwrestler 11y ago
  CISA will almost certainly pass tomorrow. It already achieved cloture, typically the hardest part of getting a bill out of the Senate. It needed 60 votes and got 83. It just needs 50 for final passage, and I have a hard time seeing how 34 Senators would change their minds within a week.
- meowface 11y ago
  There is already a pretty large threat intelligence information sharing effort in place through the ISAC system established by DHS: http://www.isaccouncil.org http://www.isaccouncil.org These have seen widespread adoption by medium and large sized companies, and are doing good work. Or at least the one I participate in is; I can't speak for the other ISACs. They have policies that facilitate information sharing without privacy or liability issues. There are definitely still a very large portion of organizations that are not a member of any ISAC or similar information sharing group, though. I don't know how much CISA may help with that.
sroussey 11y ago
So just hack this one government system and get everyone's vulnerabilities. Thanks for making it easy. Maybe someone will work as a contractor and post them all somewhere.
mkhpalm 11y ago
They write these articles as if the people of the United States have any say in the matter...
- Shivetya 11y ago
  it all starts with people not voting for who they are told to vote for. I am quite sure that the majority here will vote for the candidate at the top of the party that the donor class/establishment has decided wins. Just like the Republican party establishment who fights against the Tea Party (for which the media and establishment convinced many voters of both sides to mock them) the Democratic party may be having its own similar moment with Sanders. Yet it doesn't matter if you still vote for whom you are given regardless of your personal choice. Politics in the US cannot change until people simply say no. That means at least voting for someone not from the big two or voting against your own party to show them the lesson they need. After all, how can your vote be wasted doing so when so many are convinced their vote already doesn't matter?
- sd8f9iu 11y ago
  It worked with SOPA, didn't it? Seems like the people have a bit of say.
deleted 11y ago
[deleted]
grflynn 11y ago
₋ Four Letter Acronyms do not a policy make ₋ The net is a-central and not dependent on a single facist org to run it ₋ Pirate utopias will crop up to subvert any such control mechanisms. ⸗ 4 letter acronyms by virtue of being over⁻arching make the net stronger by way of streisand effect
- anon4 11y ago
  It's somewhat ironic to think how "pirate" once meant someone who takes everything you have and gives nothing back, but today a pirate is a very generous individual who contributes their time and money, not to mention risking personal safety, in order to give you free access to contemporary culture.

321 points by lizmrush 11y ago

mtgx 11y ago

Once again we can thank Dianne Feinstein for this. How did she get re-elected again? Was it gerrymandering or did her NSA buddies, which she keeps propping up, hack the poorly secured voting machines?

tshtf 11y ago
Feinstein is a senator. How could gerrymandering have anything to do with her election?
- tptacek 11y ago
  (the answer, of course, is that it can't)
  - cma 11y ago
    Passive gerrymandering. California's state lines were intentionally not redrawn before the last election, so as to not absorb Republican voters from Nevada, which would have diluted the democratic majority in California and made things tough for Feinstein. The OP is hinting through his username that somehow the Mt. Gox bitcoin exchange was involved.
    - spicyj 11y ago
      Unlikely, given that mtgx's account here is 3.5 years old.
    - tptacek 11y ago
      I am finding it very difficult to believe that any modern border dispute between California and Nevada could have flipped California. Feinstein won 49.5 to 12.7; a landslide victory. Gerrymandering had nothing to do with CISA.
      - rhino369 11y ago
        I think cma was being facetious.
        tptacek 11y ago
        I think you're right. Sorry! One of those days.
- snowwrestler 11y ago
  Have you seen the shape of California? I mean, it's implausible at best. :-) But seriously, it's kind of fun to imagine what life would be like if U.S. states were shaped like House districts. Maryland is probably the closest, geometrically.
  - schoen 11y ago
    There's a cool exhibit in the Oakland Museum of California about proposals for the shape of the eastern border of California! Interestingly, some of the motivations for the proposals did involve something like gerrymandering, in terms of arguments about how many Mormons who had emigrated to the west would end up being included in California's territory. Another interesting thing about the California-Nevada border that ended up getting adopted is where the northwest line turns north (where the bend is): it's inside of Lake Tahoe. That makes it a lot easier to remember!
  - WildUtah 11y ago
    Have you seen the shape of California? Did you know that Reno has been gerrymandered so far it's now west of Los Angeles? That has to be some kind of conspiracy. Otherwise it would just be impossible.
    - snowwrestler 11y ago
      California was stretched so far that it covers the full distance from the lowest elevation in the lower 48 to the highest summit in the lower 48. It was also shaped so that it encompassed the driest point in the U.S.--Death Valley--and one of the wettest: 100 feet underwater below the Golden Gate Bridge. Also, if the state of California were its own country, it would be referred to as the nation of California. True story.
  - deleted 11y ago
    [deleted]
jtmcmc 11y ago
Feinnstein is a very long running senator with a hugely entrenched power base. Because of that it's hard to remove her from office. She also despite being very authoritarian is fairly progressive in other respects so she is able to appeal to her base of older democrats in that respect. I really really dislike her, but it totally makes sense that she is basically invulnerable within her senate seat.
- swang 11y ago
  This is the reason why I don't fill in a ballot for her whenever her seat comes up. I know it's not going to do much, and I am not really sure I want a Republican in that seat (if that were even possible) since I doubt it would be any better than her positions. All I see with her about this is the hypocrisy of it all. She is totally fine with the NSA intervening in our lives, but threw a huge fit when the CIA was found to be spying on members of Congress. Yes, spying on the people is OK, but spying on Congress by the CIA is a "violation of separation of powers" and shouldn't be tolerated?
  - protomyth 11y ago
    That's why primary challenges are important. I doubt she'll be gone before she wants to be, but I was skeptical they could get Cantor also.
bsder 11y ago
Neither. The Republicans run idiotic candidates like Carly who Feinstein and Boxer eat for breakfast.
wfo 11y ago
For the vast majority of Americans, surveillance and internet security are pretty close to the bottom of their list of concerns. This is a forum is an echo chamber full of a tiny concentrated group of technical people many of whom are very extreme single issue voters about this sort of thing which is a gross micharacterization of Californians or Americans as a whole. People elect Feinstein because they think she is doing a good job. They might even agree with you that she's wrong on your pet issue but that issue just isn't as important to them as it is to you.

Laaw 11y ago

Setting aside any hatred for the government and mistrust, how does Company A share information with Company B (or the FBI) about how a hacker got into their networks? Is the concern that Google is going to hand over your browser history under the guise of CISA?

tptacek 11y ago
The law doesn't define how information is to be shared; it merely makes it lawful for the sharing to happen, so long as it meets the conditions in the statute. This is pretty typical for bills in US Federal Law: Congress enacts a relatively broad statute that establishes principles relied upon in a later "rulemaking" process; the statute will delegate to specific agencies the privilege of making those rules.
- Laaw 11y ago
  If this law isn't enacted, then it will continue to be illegal for Company A to share breach details with the government, or with each other. Is this necessary to slow down the rate and severity of breaches? If so, what should this law look like?
  - tptacek 11y ago
    I don't think the harm outweighs the limited good in this situation. I'm negative on CISA. I was neutral on CISPA, which didn't have the law enforcement investigative enhancements CISA has. But I still don't think it's a big deal either way. Like, don't donate money to prevent it from passing if this is the only donation you can make this year.
unethical_ban 11y ago
Mailing lists and phone calls are a big part of it.

tptacek 11y ago

The actual text of CISA: https://www.govtrack.us/congress/bills/114/s754/text https://www.govtrack.us/congress/bills/114/s754/text There are no amendments to CISA that I can find (CISPA collected quite a few amendments, some of which were very relevant to HN, before the bill eventually died). I read CISA so you don't have to! (You still should). Here's a summary: There are three particularly important defined concepts: <<Sec. 2 (5) (A) "Threats">>, which means "unauthorized activity" that might plausibly compromise confidentiality, integrity, or availability, but that isn't either protected speech or a mere ToS violation. <<Sec 2 (6) "Indicators">>, the most important concept in the bill, which is, roughly: logs of recon activity, exploit techniques, vulnerability data, account hijack techniques (I think this bill actually tries to capture the notion of an XSS), bot C&Cs, damage reports on attacks, and anything else related to security and not already prohibited by law. <<Sec 2 (7) "Defensive measures">>, roughly, things that stop or monitor attacks. "Defensive measures" is a confusing concept in the bill. For awhile, it was thought that CISA would authorize something akin to hack-back privilege for private entities; it does not. Meanwhile, defensive measures are probably already lawfully shareable. Anyways, the bill allows you to share both indicators and defenses. The bill allows the USG to share indicators and defensive measures with private entities, and vice versa. So then: Section 3 of the bill authorizes the USG to share stuff with private entities. This isn't the part of the bill that concerns people (we all probably want more sharing from USG to private entities; for instance, that's what we're saying every time we demand NSA fork over its zero-days). Section 4 authorizes private entities to share with the USG. Here's what it allows: (a) You can monitor your own systems, or those of people who give you written authorization, for any security purpose, notwithstanding any previous limitation on monitoring. Even if ECPA or student records law says you shouldn't monitor, if you're doing it to deal with security threats, you're now allowed to. (b) You can run your own defensive measures, or defensive measures on people who give you written authorization. Ok then. (c) You can share indicators and defenses with the USG, and receive them from the USG so long as you comply with their sharing restrictions. (d) You have to keep the data secure, you can't share it willy-nilly, and before you share anything, you have to (1) review it for PII and (2) anonymize any PII you find. Sec 4 (d) (4) has problematic language that allows, say, Facebook to provide written authorization to the USG to prosecute based on shared indicators; in theory, they can do this even if the prosecution they're going to launch isn't related to a computer crime, but just happens to be illuminated by the indicator Facebook shared. (But remember: Facebook can't share under CISA unless they have a bona fide cybersecurity purpose for doing so). Section 5 has a bunch of rulemaking authority in it, but buried in it is Sec 5 (d) (5) (a), which gives all the purposes FedGov is allowed to use indicators for: * any security purpose * attributing threats * determining whether threats are foreign * preventing immediate disaster/harm (iv) * stopping child sex trafficking (v) * stopping major felonies, espionage, trade secret theft (vi) (iv), (v), and (vi) are major problems; these aren't cybersecurity purposes at all, but rather a sort of "these crimes are so bad that we're allowed to repurpose indicators to deal with them", which, maybe fair enough (except for trade secret theft), but still, not OK that new investigative capabilities are buried in the middle of a cybersecurity bill. And that's it.

belak 11y ago

There's an AMA on reddit right now with the EFF, Access, Fight for the Future, FFTF, and Demand Progress about this. https://www.reddit.com/r/IAmA/comments/3qban2/oh_look_its_that_cisa_surveillance_bill_again/ https://www.reddit.com/r/IAmA/comments/3qban2/oh_look_its_th... Looks like it just started a few minutes ago, so no idea if it'll be useful, or not.

tptacek 11y ago
I'm never super happy with EFF's advocacy (I think they do good and important legal and technical work but I'm almost always unhappy with how they represent policy to the public). I've been uniformly discouraged by FFTF's advocacy, which I find goes way past "misleading" into "straight up dishonest", such as their recent piece that strongly suggested Facebook supported CISA (a fact not in evidence, for whatever that's worth) because doing so would immunize them from privacy suits for user data so long as they dumped all that user data to the USG. No reading of CISA gets you to that. Example from today's AMA is FFTF's claim that CISA "exempts itself from FOIA", making it impossible to challenge in court: they're referring to Sec 4 (d) (4) (b), which exempts from FOIA individual shared indicators, which of course must be the case, because indicators are things like compromised account names and passwords. That's all the law exempts from disclosure.
- dsp1234 11y ago
  they're referring to Sec 4 (d) (4) (b) Also 5 (d) (3) (a) and (b) which exempts "Cyber threat indicators and defensive measures provided to the Federal Government under this Act".
  - tptacek 11y ago
    Right. Same deal, right? They're simply saying that raw indicators are exempt from FOIA, and, of course, they'd have to be.
    - dsp1234 11y ago
      So I guess the serious (and it is serious) question is this. If I can't FOIA for security indicators, or defensive measures, then how could I ever know that they included illegal or illegitimate information about me?

godgod 11y ago

More proof that we have a facist government in place. This bill gives the corporations legal immunity and allows the government full access to your private data...WITHOUT A WARRANT. Enjoy the cloud. Freedom is dead.

orionblastar 11y ago

I can't believe the number of times this bill has been voted down, only to come back up for a vote again under a different bill or different name. It is like they keep submitting bills until it gets passed. This not only is a waste of time, it seems to be how the lobbyists get their bills passed. Eventually one will get passed and then our privacy will no longer exist. If you want our data, get a judge to order a search warrant. Otherwise it is Unconstitutional.

dmfdmf 11y ago
>If you want our data, get a judge to order a search warrant. Otherwise it is Unconstitutional. This is my position and nothing will move me from it because it is the principled position. Moreover, the advocates of mass surveillance fail to realize that even if their motives are as pure as the driven snow nevertheless a mass surveillance system will attract sociopaths and psychopaths who survive by preying on other human beings instead of creating value and trade. This is exactly why we have a Constitution to limit the powers of government.
- orionblastar 11y ago
  I fear a Police State where it is basically an 1984 type of society. Instead of TV sets watching us, it is our smart phones. The only thing protecting us from the Thought Police is the fact that our smart phones are encrypted so that we can have privacy. Take away that encryption and let the Police or anyone else have access to anyone's smart phone and there is no privacy and you can be arrested for stuff you didn't do but might because some machine learning algorithm says you might commit a crime. Sort of like the Minority Report TV show were they stopped using precogs and went to a Hawkeye program that uses ML to tell if someone is going to do a crime and has access to everything in the public to tell.

littletimmy 11y ago

Dianne Feinstein again? Wasn't she Really angry some time ago when it was revealed the NSA spied on Congress? Does privacy apply only to Congress and not to ordinary citizens? Ms. Feinstein peaked before the computer was invented. It is time this 82-year-old was retired and we get in charge someone who understands technology. How does this woman keep getting elected?

deleted 11y ago
[deleted]
tptacek 11y ago
But this industry isn't ageist at all, no...
wavefunction 11y ago
She supports the motion-picture industry and has incumbent support in a safe district for her political party. As a senator with real seniority she's quite embedded in the system. I believe she was more concerned about a) the NSA facing public scrutiny b) that the CIA hacked her computer resources in an attempt to determine what line of inquiry into torture the sub-committee on CIA torture investigation was headed towards. So yes, warrantless-surveillance is for "the little people" as far as she and the other members of Congress are concerned, mostly.

jcrawfordor 11y ago

One of the things that concerns me about this debacle is that ongoing CISA controversy will eliminate the possibility of legislative support for information sharing for good. I appreciate that there are privacy concerns in CISA, however, it is very important to the security field that sharing of intelligence indicators become more plainly safe from a legal perspective. 'Indicators' usually consist of information about external actors and organizations that are relevant to intrusion detection, for example, the most common types of indicators are domains used for C&C and hashes of malicious files. It is difficult to construe a privacy violation from these types of indicators. There are concerns about certain providers who may have indicators relevant to their users - for example, some providers might share the names of otherwise legitimate user accounts which have been compromised as these are often used to send spam that ought to be blocked. However, in general, cyber intel indicators do not involve sensitive information about users. Right now a great deal of organizations are not participating in public or private threat information sharing because of concerns over liability and compliance, and this significantly impedes defense by letting threat actors get away with infrastructure and tool reuse that ideally should reveal them. These acts originated as an attempt to correct that. It looks alarmingly like many advocacy organizations want to keep it this way for good. I don't want to be painted as anti-privacy and I would say that I'm not, but the principal goal of this legislation is not to send your data to the NSA, it's to help me do my job. I hope that the internet community will have the foresight to try to resolve the specific problems with current legislation, and not to entirely prevent information sharing.

snowwrestler 11y ago
CISA will almost certainly pass tomorrow. It already achieved cloture, typically the hardest part of getting a bill out of the Senate. It needed 60 votes and got 83. It just needs 50 for final passage, and I have a hard time seeing how 34 Senators would change their minds within a week.
meowface 11y ago
There is already a pretty large threat intelligence information sharing effort in place through the ISAC system established by DHS: http://www.isaccouncil.org http://www.isaccouncil.org These have seen widespread adoption by medium and large sized companies, and are doing good work. Or at least the one I participate in is; I can't speak for the other ISACs. They have policies that facilitate information sharing without privacy or liability issues. There are definitely still a very large portion of organizations that are not a member of any ISAC or similar information sharing group, though. I don't know how much CISA may help with that.

sroussey 11y ago

So just hack this one government system and get everyone's vulnerabilities. Thanks for making it easy. Maybe someone will work as a contractor and post them all somewhere.

mkhpalm 11y ago

They write these articles as if the people of the United States have any say in the matter...

Shivetya 11y ago
it all starts with people not voting for who they are told to vote for. I am quite sure that the majority here will vote for the candidate at the top of the party that the donor class/establishment has decided wins. Just like the Republican party establishment who fights against the Tea Party (for which the media and establishment convinced many voters of both sides to mock them) the Democratic party may be having its own similar moment with Sanders. Yet it doesn't matter if you still vote for whom you are given regardless of your personal choice. Politics in the US cannot change until people simply say no. That means at least voting for someone not from the big two or voting against your own party to show them the lesson they need. After all, how can your vote be wasted doing so when so many are convinced their vote already doesn't matter?
sd8f9iu 11y ago
It worked with SOPA, didn't it? Seems like the people have a bit of say.

deleted 11y ago

[deleted]

grflynn 11y ago

₋ Four Letter Acronyms do not a policy make ₋ The net is a-central and not dependent on a single facist org to run it ₋ Pirate utopias will crop up to subvert any such control mechanisms. ⸗ 4 letter acronyms by virtue of being over⁻arching make the net stronger by way of streisand effect

anon4 11y ago
It's somewhat ironic to think how "pirate" once meant someone who takes everything you have and gives nothing back, but today a pirate is a very generous individual who contributes their time and money, not to mention risking personal safety, in order to give you free access to contemporary culture.