3 ms·

I could be missing a further limitation, but doesn't Section 4(a) de facto amount to a repeal of all other laws that limit monitoring? Yes, the exception is lim

I could be missing a further limitation, but doesn't Section 4(a) de facto amount to a repeal of all other laws that limit monitoring? Yes, the exception is limited to monitoring for a "security purpose", but a pretty broad range of things can be justified as a "security purpose". I'm also skeptical that courts will seriously second-guess companies' representations on that point.

tptacek 11y ago
Yep, I called that section out for that reason. I'm not particularly worried about it (I think this part of CISA mostly just clarifies something that was already pretty much settled). Companies aren't allowed to just make up "security purpose", though; under CISA, they have to be monitoring for threats as construed in CISA, which means, for instance, they can't find exemption for liability for monitoring for mere ToS violations.
- gknoy 11y ago
  Couldn't one collect logs of all things, under the auspices of collecting logs that (may) contain "recon activity" and "exploits"? It seems on a surface reading that one could collect all those under the umbrella of collecting Indicators, and then also use it also for things like selling-to-advertisers or other business-related things. Of course, our terms of use on most sites already say they can collect + monetize such things, so maybe this is moot.
  - tptacek 11y ago
    I'm not sure I see the part of CISA that allows you to sell your logs to advertisers. I do see lots of places in the bill that allow sharing to other private entities or to the USG for cybersecurity purposes.
    - ChrisAntaki 11y ago
      Sounds like a loophole.
      - tptacek 11y ago
        What specific part of the bill reads like a loophole that would allow Facebook to sell its security logs to advertisers?
        ChrisAntaki 11y ago
        I was just responding to what you'd said above: > I do see lots of places in the bill that allow sharing to other private entities or to the USG for cybersecurity purposes.
        tptacek 11y ago
        "For cybersecurity purposes". It's a short bill. Read it again! These terms are defined, reasonably well.

tptacek 11y ago

Yep, I called that section out for that reason. I'm not particularly worried about it (I think this part of CISA mostly just clarifies something that was already pretty much settled). Companies aren't allowed to just make up "security purpose", though; under CISA, they have to be monitoring for threats as construed in CISA, which means, for instance, they can't find exemption for liability for monitoring for mere ToS violations.

gknoy 11y ago
Couldn't one collect logs of all things, under the auspices of collecting logs that (may) contain "recon activity" and "exploits"? It seems on a surface reading that one could collect all those under the umbrella of collecting Indicators, and then also use it also for things like selling-to-advertisers or other business-related things. Of course, our terms of use on most sites already say they can collect + monetize such things, so maybe this is moot.
- tptacek 11y ago
  I'm not sure I see the part of CISA that allows you to sell your logs to advertisers. I do see lots of places in the bill that allow sharing to other private entities or to the USG for cybersecurity purposes.
  - ChrisAntaki 11y ago
    Sounds like a loophole.
    - tptacek 11y ago
      What specific part of the bill reads like a loophole that would allow Facebook to sell its security logs to advertisers?
      - ChrisAntaki 11y ago
        I was just responding to what you'd said above: > I do see lots of places in the bill that allow sharing to other private entities or to the USG for cybersecurity purposes.
        tptacek 11y ago
        "For cybersecurity purposes". It's a short bill. Read it again! These terms are defined, reasonably well.