4 ms·

It is uncontroversial to state that corporations and special interest groups frequently lobby in public for a position and in private against a position. Freque

by zmanian 11y ago

It is uncontroversial to state that corporations and special interest groups frequently lobby in public for a position and in private against a position. Frequently you know this only through un-attributable information passed to you. Advocacy organizations are not journalists. They don't need to cite their sourcing before making claims they believe are true. The purpose of calling out Facebook is an attempt force them to align their public and private positions if they differ. As usual, Marcy does excellent analysis about what information NSA will be able to collect, analyze and disseminate under CISA.[1] [1] https://www.emptywheel.net/2015/10/26/two-intended-consequences-cisa-supporters-will-be-responsible-for/ https://www.emptywheel.net/2015/10/26/two-intended-consequen...

tptacek 11y ago
This is a blog post that makes two very broad claims: 1. That Chrysler can exploit CISA to avoid liability for vulnerabilities in their cars simply by sharing the flaws with the USG as an "indicator". 2. That the USG can use CISA to collude with private companies to avoid warrant requirements and spy on their customers. Both of these points are, I think, false. I've linked upthread to the text of the bill and provided a summary. In particular, I don't think the "Chrysler reading" of the bill finds any support at all in the text; Chrysler is immunized from suits stemming from their own sharing, and even in the sharing, they are explicitly on the hook for negligence and misconduct. If it's helpful, here's the entire limitation of liability in CISA. Notice: companies are exempt from liability for monitoring, sharing, and receipt of indicators. They aren't exempt from liability for having vulnerabilities in the first place! 6.Protection from liability (a) Monitoring of information systems No cause of action shall lie or be maintained in any court against any private entity, and such action shall be promptly dismissed, for the monitoring of information systems and information under section 4(a) that is conducted in accordance with this Act. (b) Sharing or receipt of cyber threat indicators No cause of action shall lie or be maintained in any court against any entity, and such action shall be promptly dismissed, for the sharing or receipt of cyber threat indicators or defensive measures under section 4(c) if— (1) such sharing or receipt is conducted in accordance with this Act; and (2) in a case in which a cyber threat indicator or defensive measure is shared with the Federal Government, the cyber threat indicator or defensive measure is shared in a manner that is consistent with section 5(c)(1)(B) and the sharing or receipt, as the case may be, occurs after the earlier of— (A) the date on which the interim policies and procedures are submitted to Congress under section 5(a)(1); or (B) the date that is 60 days after the date of the enactment of this Act. (c) Construction Nothing in this section shall be construed— (1)to require dismissal of a cause of action against an entity that has engaged in gross negligence or willful misconduct in the course of conducting activities authorized by this Act; or (2)to undermine or limit the availability of otherwise applicable common law or statutory defenses.
- declan 11y ago
  I'm not sure why you were downvoted for a reasonable post citing original sources (I upvoted you to try to correct that). I expect I will disagree with you about the desirability of CISA, just as we disagreed years ago about CISPA, but enjoy your posts on the topic nevertheless. They make thoughtful and reasonable points. Even if you end up on the wrong side. :)
  - tptacek 11y ago
    Just to be clear: CISA is bad. I oppose it.
    - ChrisAntaki 11y ago
      How many comments have you made expressing your opposition, versus painting groups fighting CISA in a negative light?
      - tptacek 11y ago
        I'm not "painting" anyone. People say things that are misleading, wrong, or outright dishonest. I point them out. I don't feel any need to justify that to you.
        ChrisAntaki 11y ago
        Well, wouldn't it be more productive to write your own blog post(s) on why CISA should be opposed?
        tptacek 11y ago
        It would be about as productive as you writing a blog post about how much you disagree with my comments.
        ChrisAntaki 11y ago
dpeck 11y ago
| Advocacy organizations are not journalists. They don't need to cite their sourcing before making claims they believe are true. Tell me where you find these journalists today.
- ChrisAntaki 11y ago
  You can find some on The Intercept (https://theintercept.com/ https://theintercept.com/).
TeMPOraL 11y ago
> Advocacy organizations are not journalists. They don't need to cite their sourcing before making claims they believe are true. The purpose of calling out Facebook is an attempt force them to align their public and private positions if they differ. So in other words, as long as they are "advocacy organizations" and say that they believe in some view, they get a free pass to lie, spread bullshit and FUD? I thought we should have a higher standard. Personally, I am for severely punishing liars as a top priority, no matter what side they're on. Then we may get a constructive discussion.

by zmanian 11y ago

tptacek 11y ago

This is a blog post that makes two very broad claims: 1. That Chrysler can exploit CISA to avoid liability for vulnerabilities in their cars simply by sharing the flaws with the USG as an "indicator". 2. That the USG can use CISA to collude with private companies to avoid warrant requirements and spy on their customers. Both of these points are, I think, false. I've linked upthread to the text of the bill and provided a summary. In particular, I don't think the "Chrysler reading" of the bill finds any support at all in the text; Chrysler is immunized from suits stemming from their own sharing, and even in the sharing, they are explicitly on the hook for negligence and misconduct. If it's helpful, here's the entire limitation of liability in CISA. Notice: companies are exempt from liability for monitoring, sharing, and receipt of indicators. They aren't exempt from liability for having vulnerabilities in the first place! 6.Protection from liability (a) Monitoring of information systems No cause of action shall lie or be maintained in any court against any private entity, and such action shall be promptly dismissed, for the monitoring of information systems and information under section 4(a) that is conducted in accordance with this Act. (b) Sharing or receipt of cyber threat indicators No cause of action shall lie or be maintained in any court against any entity, and such action shall be promptly dismissed, for the sharing or receipt of cyber threat indicators or defensive measures under section 4(c) if— (1) such sharing or receipt is conducted in accordance with this Act; and (2) in a case in which a cyber threat indicator or defensive measure is shared with the Federal Government, the cyber threat indicator or defensive measure is shared in a manner that is consistent with section 5(c)(1)(B) and the sharing or receipt, as the case may be, occurs after the earlier of— (A) the date on which the interim policies and procedures are submitted to Congress under section 5(a)(1); or (B) the date that is 60 days after the date of the enactment of this Act. (c) Construction Nothing in this section shall be construed— (1)to require dismissal of a cause of action against an entity that has engaged in gross negligence or willful misconduct in the course of conducting activities authorized by this Act; or (2)to undermine or limit the availability of otherwise applicable common law or statutory defenses.

declan 11y ago
I'm not sure why you were downvoted for a reasonable post citing original sources (I upvoted you to try to correct that). I expect I will disagree with you about the desirability of CISA, just as we disagreed years ago about CISPA, but enjoy your posts on the topic nevertheless. They make thoughtful and reasonable points. Even if you end up on the wrong side. :)
- tptacek 11y ago
  Just to be clear: CISA is bad. I oppose it.
  - ChrisAntaki 11y ago
    How many comments have you made expressing your opposition, versus painting groups fighting CISA in a negative light?
    - tptacek 11y ago
      I'm not "painting" anyone. People say things that are misleading, wrong, or outright dishonest. I point them out. I don't feel any need to justify that to you.
      - ChrisAntaki 11y ago
        Well, wouldn't it be more productive to write your own blog post(s) on why CISA should be opposed?
        tptacek 11y ago
        It would be about as productive as you writing a blog post about how much you disagree with my comments.
        ChrisAntaki 11y ago

dpeck 11y ago

| Advocacy organizations are not journalists. They don't need to cite their sourcing before making claims they believe are true. Tell me where you find these journalists today.

ChrisAntaki 11y ago
You can find some on The Intercept (https://theintercept.com/ https://theintercept.com/).

TeMPOraL 11y ago

> Advocacy organizations are not journalists. They don't need to cite their sourcing before making claims they believe are true. The purpose of calling out Facebook is an attempt force them to align their public and private positions if they differ. So in other words, as long as they are "advocacy organizations" and say that they believe in some view, they get a free pass to lie, spread bullshit and FUD? I thought we should have a higher standard. Personally, I am for severely punishing liars as a top priority, no matter what side they're on. Then we may get a constructive discussion.