10 ms·
Congress has added CISA to the federal budget bill
- MrQuincle 11y agoWelcome to the rest of the world. We're being eavesdropped legally by your congress for ages. :-)
- j_s 11y agoAny specifics on which congress-people are responsible for this?
- flubert 11y agoIn the larger sense, aren't all the representatives responsible? Certainly the ones who voted for it. I know it is controversial, but they should be reading the bills before passing legislation. And the ones who didn't vote? What are we paying you for, if you aren't even showing up for your job? And even those who may have voted no seen to bear some responsibility, why didn't you raise an alarm? You should still be reading bills that have a high likely hodd of passing, even if your intention is to vote no.
- ChuckMcM 11y agoOf course, but some representative made the motion to include the text of the CISA bill part of the Omnibus bill, that should be on the record somewhere.
- chishaku 11y agoAnyone have more clarity on this? I think since this is just a single bill, figuring out who included which part of the final text is a non-trivial task. However, since senior leadership of both parties are mostly responsible for getting this bill through, I think they ultimately are responsible for allowing the CISA portion to be included.
- Shivetya 11y agolikely go find the committee it came from, however this bill is being crafted with the President's blessing. don't think the Democrats in Congress agree to anything that he doesn't. There may be times where you can "see that one didn't" but its the same on both aisles, when the bet is sure they can afford to allow members who need a boost back home to "act" defiant. otherwise, the establishment gets what the establishment wants. Keep voting those incumbents back in and it will always be so. Hence one reason why the Republican Presidential side of the race is so interesting, those who aren't the system or are seen as bucking it are front and center. Sadly Bernie was quickly pushed to the side as there was never going to be a choice there
- ccvannorman 11y agoNews flash, privacy is going to (keep) getting worse before it grts better. This is why the instant someone invents a totally secure and private way for me to exist online, I'm going to dump a truckload of money down their coffers.
- ljk 11y ago> This is why the instant someone invents a totally secure and private way for me to exist online isn't that impossible due to all the backdoors in software, hardware, and even in the encryption?
- mtgx 11y ago> News flash, privacy is going to (keep) getting worse before it grts better. If by that you're saying we should just "wait it out" until it gets worse, then I'm not sure I agree. Unless you're expecting the US to go through a totalitarian regime and then through a revolution in the future, then I doubt it's going to "get better" if people don't try to fight these changes hard at all steps. As the surveillance people get more power it's only going to become easier for them to pass new changes like these. It's also going to get easier for them to ban good encryption in popular services, as well as open source projects that are "aiding the terrorists" (or whatever their excuse will be). It really doesn't matter how "silly" you think such excuses will be, if by then the judges can be compelled to agree with them. In fact, by then, you'd be lucky if the majority of the brainwashed population by the controlled mass media will even agree with you that such excuses are "silly", as they would most likely believe them. Just look at plenty of other countries around the world for such examples. I mean half of the US population probably still believes Snowden cooperated with Russia or is a Russian spy, thanks to the denigration campaign against him. Heck, 20% of HN probably believes that.
- profeta 11y agoand the people that did that will go largely unpunished in any way and continue to receive the same votes as always.
- CM30 11y agoProbably a silly question, but is there a reason all these 'additions' are being snuck into bills and what not? Why does the system allow members of congress to add unrelated extras to bills in the first place? Wouldn't a simple fix for things like this be 'only allow a new law proposal to be about a single topic and nothing else'?
- uremog 11y agoIt's common because politics often works like that and nothing disallows it. "I'll vote for your [x] if you vote for my [y]". I definitely dislike it but just saying, sometimes that's why.
- lukeschlather 11y agoWhat you're suggesting is essentially banning formal expressions of compromise. Compromise is essential for legislation to get made.
- EvanAnderson 11y agoCompromise is essential for legislation to happen, but I also don't think riders really are a form of compromise. It's an underhanded tactic.
- lukeschlather 11y agoHow do you suggest a formally agreed-upon compromise without merging two separate topics into one bill?
- jessriedel 11y agoIt was my vague understanding that there is some very low bar for attaching riders, so that members can kill a bill they don't like by attaching a poison pill. If so, the answer would be "make the amendment process require more votes" or something like that. I'd very much like an clear explanation of how the amendment process works.
- imglorp 11y ago"So this is how liberty dies...with thunderous applause."
- dang 11y agoThere have been close to a dozen posts about this. We merged the threads that had comments. If another article is significantly more substantive, let us know and we can change the URL.
- ck2 11y agoI don't know the origin of the word "scumbags" but it seems to fit perfectly here. Can you imagine sitting across from someone you are negotiating with and you are about to sign and they slip a sheet of paper inbetween the document, making you agree to it? Of course not. But what you'd never do to a fellow american in person, congress is more than okay with doing to you without you being there or realizing what is going on. Lowest of the low.
- delecti 11y agoIn addition to it's modern usage, which I agree appropriately describes these congresspeople, the word "scumbag" refers to condoms.
- deleted 11y ago[deleted]
- AnimalMuppet 11y agoMore specifically, to used ones.
- disposition2 11y agoLooks like it is actually worse than CISA... https://www.techdirt.com/articles/20151215/06470133083/congress-drops-all-pretense-quietly-turns-cisa-into-full-surveillance-bill.shtml https://www.techdirt.com/articles/20151215/06470133083/congr...
- tptacek 11y agoSomeone asked me about this last night. Is there sourcing for this beyond "Techdirt says so"? Because on matters of law, Techdirt is extraordinarily untrustworthy. I'd love to see the amendments or revisions that are purported to be doing this to the bill. (I don't support CISA, but if you asked me which I'd rather get rid of, CISA or Techdirt, I'd have to think about it.) update: No. See: https://news.ycombinator.com/edit?id=10747359 https://news.ycombinator.com/edit?id=10747359
- yuhong 11y agohttps://www.techdirt.com/articles/20151216/05514933094/as-predicted-congress-turned-cisa-into-clear-surveillance-bill-put-it-into-must-pass-govt-funding-bill.shtml https://www.techdirt.com/articles/20151216/05514933094/as-pr... has an embedded document and a link.
- tptacek 11y agoThanks. Here's a sane version of that link, I think: http://docs.house.gov/billsthisweek/20151214/CPRT-114-HPRT-RU00-SAHR2029-AMNT1final.pdf http://docs.house.gov/billsthisweek/20151214/CPRT-114-HPRT-R...
- newman314 11y agoSo can someone please help explain to me how this is permissible? Taking this to extremes, why would politicians not sneak every crazy wild idea that they have onto this bill if it's a must-pass bill?
- mod 11y agoThey do that all the time. That's why I'm a professional developer these days, instead of a professional poker player.
- dragonwriter 11y ago> Taking this to extremes, why would politicians not sneak every crazy wild idea that they have onto this bill if it's a must-pass bill? They try; there are various constraints: (1) Individual members can't just stick a rider onto a bill, riders are amendments, and are voted on. (2) Riders are, in effect, a strong-arm negotiation tactic between one house of Congress and the other, or between Congress and the executive -- a gamble that the other side sees the other provisions of the bill as "must pass" enough to accept the added conditions. But those gambles can be wrong, resulting in neither the main bill or the added provision getting passed. So, the biggest incentive to add non-germane riders is to a bill you are less concerned with passing than those you are trying to get to accept the rider as a precondition for the rest of the bill, where them rejecting the rider is more unattractive to them that it is to you. If you really think its a "must pass" bill (rather than just wanting others to think that so that they'll accept the rider), you won't want to risk causing it to fail somewhere in the process because the rider you attached was unacceptable.
- retbull 11y agoUnless you want the political fodder to say the other party is also willing to shut the government down. If you don't care about shutting everything down you can put horrible things in a must pass bill.
- dragonwriter 11y agoIf you don't care about shutting everything down, there is no such thing as a "must-pass" bill; at least, the fact that not passing a bill would lead to a shutdown doesn't make it must-pass if you don't care about shutting everything down. But I think you are agreeing with what I said, that its more attractive to attach riders to something you think your counterparty sees as "must pass", but you do not.
- DanielBMarkham 11y agoAs I understand it, by slipping it in on an Omnibus budget bill, leaders get to add in bullshit that nobody in their right mind could defend on the floor and then expect an up-down, yes-no vote on the entire budget, including the add-in, by the membership. In addition, because it's a budget bill, regular conference committee rules don't apply. The idea was that having conference committees dicker over each line item would be a great way to prevent both houses from agreeing. So the "fix" they made for money bills can be used for cyber-surveillance bills too. I may have missed the details. Apologies if that's the case. If this was added to the Omnibus, the reason why was obscurity. My misunderstanding of the details is a prime example of voters not being able to track who's responsible. That's the point.
- Zikes 11y agoSo now they're legally allowed to do what they've already been doing without oversight anyways, which they were legally never allowed to do in the first place and still aren't legally allowed to do due to Constitutional restraints. I don't like to sound defeatist, but honestly what does this change?
- tmaly 11y agoit would be great if we could have all these bill changes in a git repo with commits from the representatives that added them. open source gov.
- fapjacks 11y agoBut then they could be held accountable for their shitty actions, and if there's one thing they don't want, it's that!
- ionforce 11y agoThere should be an automatic ban against anyone who attempts to shirk responsibility.
- deleted 11y ago[deleted]
- jlev 11y agoIt's almost as if we need a "Congressional Versioning System" rimshot. At least we're finally getting open bill status data as XML, without having to rely on GovTrack scraping the Federal Register.
- JoshTriplett 11y ago> It's almost as if we need a "Congressional Versioning System" rimshot. Or a Government Information Tracker.
- BHSPitMonkey 11y agoThis is the best means of subversion against those who would commit acts of corruption in office.
- beatpanda 11y agoThis exists, it's at opencongress.org
- micwawa 11y agoSo if I delete my YikYak account today will I still be employable in the future?
- an0nym1ty 11y agoI don't understand the connection here. Could you elaborate for me?
- micwawa 11y agoThe article says "The bill would make it easier for private sector companies to share user information with ... other companies". Taking this at face value, any potential employer could conceivably access everything I've ever said on YikYak, just, to you know, compare with their own notes and make sure I'm not a criminal. This wasn't really supposed to be that serious of a comment, as haven't said anything too horrible.
- tptacek 11y agoSince it's linked upthread: Techdirt is one of the least trustworthy sources on the Internet for information about Internet law. (Here's a summary of CISA I wrote a few months ago on HN: https://news.ycombinator.com/item?id=10454172 https://news.ycombinator.com/item?id=10454172 ) Today (and yesterday), Techdirt claims the following changes to CISA: 1. Removes the prohibition on information being shared with the NSA, allowing it to be shared directly with NSA (and DOD), rather than first having to go through DHS. 2. Directly removes the restrictions on using this information for "surveillance" activities. 3. Removes limitations that government can only use this information for cybersecurity purposes and allows it to be used to go after any other criminal activity as well. 4. Removes the requirement to "scrub" personal information unrelated to a cybersecurity threat before sharing that information. 'yuhong helpfully posted a link to the revised bill attached to the budget bill.[1] I compared it clause for clause to the version that passed the house. That is 10 minutes of my life I will never get back. Unsurprisingly, only one of Techdirt's claims is true (but worded misleadingly). The other three are simply false. Here's the breakdown: <strike>1. The "CERTIFICATION OF CAPABILITY AND PROCESS" part of Section 107 now allows the President, after CISA has been started by DHS, and after publicly notifying Congress, to delegate to any federal agency, including NSA, the authority to run the process described by the rest of the bill. The previous version required DHS to run the entire process. Techdirt isn't wrong about that change. Techdirt is wrong to be confused about why NSA would be a designated coordinator for threat indicators under CISA (NSA houses virtually all of the USG's threat intelligence capability; no other department has comparable expertise coordinating vulnerability information).</strike> I was wrong about this; the new bill specifically disallows DoD or NSA from running the CISA portal. 2. The bill doesn't change the authorized usage of cyber threat indicators at all (nor does it change any of the definitions of threat indicators, vulnerabilities, and so on). The few places I found changes at all actually improved the bill (for instance: Section 105 5(A) no longer allows threat indicators to be shared to investigate "foreign adversaries"). 3. CISA has always allowed the USG to use cyber threat information in law enforcement pertaining to a specific list of crimes --- that is one of the ways CISA is significantly worse than CISPA. But Techdirt suggests that CISA can be used by the DEA to investigate drug crimes. You cannot have read the bill and believe that to be an illustrative example, because drug crimes aren't among the listed crimes: fraud/identity theft, espionage, and protection of trade secrets. It should not surprise you that the list of applicable crimes has not changed in the budget bill version. 4. The new CISA act retains all the "specific person" and "technical capability configured to remove any information" language regarding personally identifiable information in "cyber threat indicators". The "scrub", by the way, has always applied to private entities (Techdirt may have tripped over themselves to write this bullet point, because the new bill clarifies "entity", "federal entity", and "non-federal entity", and so the scrubbing language now reads "non-Federal entity" --- but the original bill defined "entity" as "private entity"!) [1]: http://docs.house.gov/billsthisweek/20151214/CPRT-114-HPRT-RU00-SAHR2029-AMNT1final.pdf http://docs.house.gov/billsthisweek/20151214/CPRT-114-HPRT-R...
- MrZongle2 11y agoDon't you get it, America? Your masters want this. Why can't you have the good grace to let yourselves be observed and controlled without raising such a ruckus? /s
- kossTKR 11y agoWhy is this not getting massive attention here on Hackernews? Right now a post about a dude hacking together a selv driving car has garnered 5X the amount of votes on this post (not that the other post isn't interesting). Remember that: Apple, Reddit, Twitter, the Business Software Alliance, the Computer and Communications Industry Association, and other tech firms have all publicly opposed the bill. And a coalition of 55 civil liberties groups and security experts all signed onto an open letter opposing the bill in April. Even the Department of Homeland Security itself has warned in a July letter that the bill could flood the agency with information of “dubious value” at the same time as it “sweep[s] away privacy protections.” http://www.wired.com/2015/10/cisa-cybersecurity-information-sharing-act-passes-senate-vote-with-privacy-flaws/ http://www.wired.com/2015/10/cisa-cybersecurity-information-... Isn't this massive news? I mean the bill in itself is horrible policy making, but the way it's being snuck in is scandalous in its own right. Have i misunderstood something?
- sounds 11y agoMy thoughts are that if you're not planning for an Orwellian Nanny-State who will demand access to all your private keys, you're probably not going to be able to scale up to the UK and China. HN readers will be designing business models with that in mind. Not saying this is "old news," just that the actual bill that aligns the US with China in terms of human rights violations will not affect startups as much as it will affect large incumbent businesses: Apple, Reddit, Google, Amazon, etc. Those incumbents will continue to make money right up until they are disrupted by startups who can route around the internet damage caused by the US spying infrastructure. [1] So here's a toast to the first HN company that succeeds. [1] https://en.wikiquote.org/wiki/John_Gilmore https://en.wikiquote.org/wiki/John_Gilmore, from the perspective that spying has chilling effects and is part of a total censorship program.
- tptacek 11y agoBecause virtually the same bill passed the Senate with 75% support, and the House passed the (significantly worse) PCNA back in April at approximately the same margin. This bill was going to become law; the only question was whether the conference committee between the House and Senate would change it --- if it had, it would have changed it for the worse, since the House bill is worse than the Senate bill, which is the one that's going to pass. There's just not much of a story here.
- ccvannorman 11y ago985-222-CISA If you live in the United States, this phone number connects you with your congresspeople and senators in order to make your voice heard. Citizens stopped CISA before, we can do it again. Don't lie down.
- ccvannorman 11y agoEdit: I've seen a few people calling BS on this because of TechDirt. I found it from the EFF, who gave me this number to call. I feel strongly about surveillance legislation because I don't want myself or my friends to go to prison because [insert corp here] decided I did something illegal with their electronic content, and I don't want my geolocation, etc. perpetually in the hands of anyone with a security clearance.
- tptacek 11y agoSec 102.(5)(B): The term cybersecurity threat does not include any action that solely involves a violation of a consumer term of service or a consumer licensing agreement
- forgotpwtomain 11y agoBut according to recently tried cases, something as mundane as incrementing a URL can be construed as a violation of CFAA.
- tptacek 11y agoSo? Your criminal liability for incrementing the URL is totally situational. If you're reading a catalog and you tick the URL to see what the next product is, you aren't going to be liable. If you see a URL used for XHR in the frontend for your bank and you increment it to see other people's bank accounts, you will be. We don't have a law against "hacking" in the US; we have a law against "unauthorized access", particularly when that access has consequences. According to one recently tried case, by the way, and one where the sentence was ultimately vacated. And finally: CISA has almost nothing to do with criminal law (it defines no new offenses does not change CFAA or its sentencing). If you want to have a discussion about how totally broken CFAA's sentencing is, I'm right there with you.
- dude3 11y agoThis is interesting too TEMPORARY H-1B VISA FEE INCREASE.—Not- withstanding section 281 of the Immigration and Nation-ality Act (8 U.S.C. 1351) or any other provision of law, during the period beginning on the date of the enactment of this section and ending on September 30, 2025, the combined filing fee and fraud prevention and detection fee required to be submitted with an application for admission as a nonimmigrant under section 101(a)(15)(H)(i)(b) of the Immigration and Nationality Act (8 U.S.C. 1101(a)(15)(H)(i)(b)), including an application for an extension of such status, shall be increased by $4,000 for applicants that employ 50 or more employees in the United States if more than 50 percent of the applicant’s employees are nonimmigrants described in section 101(a)(15)(L) of such Act.
- ones_and_zeros 11y agoI'd be really interested to know what businesses in the United States have more than half of its employees here on H-1B visas.
- falsestprophet 11y agoCompanies like Infosys, Tata Consultancy Services, and Wipro who provide our country with tens of thousands of the world's greatest minds to maintain enterprise applications for about $70,000 a year.
- deleted 11y ago[deleted]
- beatpanda 11y agoP.S., the reason you don't see as much wrangling or dramatic threats to shut down the government over this budget bill is because a bunch of stuff like this was loaded into it. Because Congress is under enormous pressure by law enforcement and intelligence agencies to undermine computer security in the name of "safety", but they can't be seen doing it because it's extremely unpopular. What will be interesting is if all the riders on this budget bill are so unpopular that the voting public demands a government shutdown. Personally, I think everyone here is better off spending time writing software to make surveillance less practical. Even if the U.S. government is nominally constrained by laws (they aren't in practice), there are plenty of other actors in the world that aren't governed by any constraints and will monitor all electronic communications up to their technical capacity to do so. If you care about privacy and information security you need to be working on tools to make it impossible for surveillance to occur, not petitioning a Congress that is dead-set on screwing you.
- collin123 11y ago:( ugh not again
- pnathan 11y agoRolling in a little late here, I am actually wondering what substantive rationale exists here. There are super competent people in the government, and they do percolate information out to Congress. So I don't think it's fully appropriate to call the Congress-critters chumps (although it's a national pastime), and I do also wonder what the effective means of altering policy are(No, I don't think the EFF is being effective).