3 ms·

One of the things that concerns me about this debacle is that ongoing CISA controversy will eliminate the possibility of legislative support for information sha

One of the things that concerns me about this debacle is that ongoing CISA controversy will eliminate the possibility of legislative support for information sharing for good. I appreciate that there are privacy concerns in CISA, however, it is very important to the security field that sharing of intelligence indicators become more plainly safe from a legal perspective. 'Indicators' usually consist of information about external actors and organizations that are relevant to intrusion detection, for example, the most common types of indicators are domains used for C&C and hashes of malicious files. It is difficult to construe a privacy violation from these types of indicators. There are concerns about certain providers who may have indicators relevant to their users - for example, some providers might share the names of otherwise legitimate user accounts which have been compromised as these are often used to send spam that ought to be blocked. However, in general, cyber intel indicators do not involve sensitive information about users. Right now a great deal of organizations are not participating in public or private threat information sharing because of concerns over liability and compliance, and this significantly impedes defense by letting threat actors get away with infrastructure and tool reuse that ideally should reveal them. These acts originated as an attempt to correct that. It looks alarmingly like many advocacy organizations want to keep it this way for good. I don't want to be painted as anti-privacy and I would say that I'm not, but the principal goal of this legislation is not to send your data to the NSA, it's to help me do my job. I hope that the internet community will have the foresight to try to resolve the specific problems with current legislation, and not to entirely prevent information sharing.

snowwrestler 11y ago
CISA will almost certainly pass tomorrow. It already achieved cloture, typically the hardest part of getting a bill out of the Senate. It needed 60 votes and got 83. It just needs 50 for final passage, and I have a hard time seeing how 34 Senators would change their minds within a week.
meowface 11y ago
There is already a pretty large threat intelligence information sharing effort in place through the ISAC system established by DHS: http://www.isaccouncil.org http://www.isaccouncil.org These have seen widespread adoption by medium and large sized companies, and are doing good work. Or at least the one I participate in is; I can't speak for the other ISACs. They have policies that facilitate information sharing without privacy or liability issues. There are definitely still a very large portion of organizations that are not a member of any ISAC or similar information sharing group, though. I don't know how much CISA may help with that.
- jcrawfordor 11y ago
  You may find it meaningful that, in my interactions with several people involved in operating ISACs, I have heard nothing but support for CISA. One high-up individual in a well-known ISAC expressed a great deal of frustration and said that opposition to CISA came only from people who had no idea what it was indicators were. I don't think that it's quite that simple, but there's certainly an element of that. Much of the benefit of CISA is specifically in the area of information sharing with the gov't, which has various initiatives like NCCIC that are falling flat in a lot of ways. Of course the ISACs would like to be involved in this. CISA is also seen as a way to get a lot more organizations to contribute to ISACs, as well.
lawnchair_larry 11y ago
"I don't want to be painted as anti-privacy and I would say that I'm not, but the principal goal of this legislation is not to send your data to the NSA" This is what folks with this argument are missing - it doesn't matter one bit what the goal of legislation is, especially when it involves immunity for very vague things. Just because you will use it for that, does not prevent someone else from abusing it now or in the future. The point of legislation should be to protect the people. Just like the author of the Patriot Act never intended for it to be abused the way it was. And these things are extraordinarily difficult to curtail after the fact. "Sensenbrenner supported the Amash Amendment, a plan to defund the NSA's telephone surveillance program. "Never, he said, did he intend to allow the wholesale vacuuming up of domestic phone records, nor did his legislation envision that data dragnets would go beyond specific targets of terrorism investigations." The Amendment fell seven votes short of the number it needed to pass." Also, I don't really buy that businesses are limited by their inability to share threat information, because they have been doing this for years.

snowwrestler 11y ago

CISA will almost certainly pass tomorrow. It already achieved cloture, typically the hardest part of getting a bill out of the Senate. It needed 60 votes and got 83. It just needs 50 for final passage, and I have a hard time seeing how 34 Senators would change their minds within a week.

meowface 11y ago

There is already a pretty large threat intelligence information sharing effort in place through the ISAC system established by DHS: http://www.isaccouncil.org http://www.isaccouncil.org These have seen widespread adoption by medium and large sized companies, and are doing good work. Or at least the one I participate in is; I can't speak for the other ISACs. They have policies that facilitate information sharing without privacy or liability issues. There are definitely still a very large portion of organizations that are not a member of any ISAC or similar information sharing group, though. I don't know how much CISA may help with that.

jcrawfordor 11y ago
You may find it meaningful that, in my interactions with several people involved in operating ISACs, I have heard nothing but support for CISA. One high-up individual in a well-known ISAC expressed a great deal of frustration and said that opposition to CISA came only from people who had no idea what it was indicators were. I don't think that it's quite that simple, but there's certainly an element of that. Much of the benefit of CISA is specifically in the area of information sharing with the gov't, which has various initiatives like NCCIC that are falling flat in a lot of ways. Of course the ISACs would like to be involved in this. CISA is also seen as a way to get a lot more organizations to contribute to ISACs, as well.

lawnchair_larry 11y ago

"I don't want to be painted as anti-privacy and I would say that I'm not, but the principal goal of this legislation is not to send your data to the NSA" This is what folks with this argument are missing - it doesn't matter one bit what the goal of legislation is, especially when it involves immunity for very vague things. Just because you will use it for that, does not prevent someone else from abusing it now or in the future. The point of legislation should be to protect the people. Just like the author of the Patriot Act never intended for it to be abused the way it was. And these things are extraordinarily difficult to curtail after the fact. "Sensenbrenner supported the Amash Amendment, a plan to defund the NSA's telephone surveillance program. "Never, he said, did he intend to allow the wholesale vacuuming up of domestic phone records, nor did his legislation envision that data dragnets would go beyond specific targets of terrorism investigations." The Amendment fell seven votes short of the number it needed to pass." Also, I don't really buy that businesses are limited by their inability to share threat information, because they have been doing this for years.