5 ms·

I believe that CISA is mostly about changes within the government itself about sharing data between agencies. It seems to interface with the non-government worl

by egwynn 11y ago

I believe that CISA is mostly about changes within the government itself about sharing data between agencies. It seems to interface with the non-government world insofar as it lets companies share their data with government agencies without getting sued. I do NOT believe it contains any further provisions requiring private companies to share their data without a warrant. Can someone tell me if I’m reading it correctly? Not saying I like it, but if it’s not specifically requiring cooperation, then I guess there’s still some hope left.

jessriedel 11y ago
> I do NOT believe it contains any further provisions requiring private companies to share their data without a warrant. Sure, but that means the companies now face minimal incentive to protect user data but doubtless will experience pressure from the government to give it up even without a warrant.
- tptacek 11y ago
  This bill only allows companies to share data that fit the definition of "cybersecurity threat indicator", and that definition requires companies to not knowingly share personally identifying information. It is not a particularly effective vector for slurping messages out of Facebook.
  - jessriedel 11y ago
    Does that roughly mean that FB must (to be shielded from lawsuits) anonymize the data before passing it to the government? This isn't particularly comforting, since it could still be used to prosecute individuals if identity can be inferred from other context. The EFF's criticism is basically that the bill is overly broad and can be used nefariously, even if it's not an all purpose FB message vacuum: > The bill's broad immunity clauses, vague definitions, and aggressive spying powers combine to make the bill a surveillance bill in disguise. Further, the bill does not address problems from the recent highly publicized computer data breaches that were caused by unencrypted files, poor computer architecture, un-updated servers, and employees (or contractors) clicking malware links. https://www.eff.org/deeplinks/2015/10/eff-strongly-oppose-cisa-cyber-surveillance-bill-and-cfaa-amendment https://www.eff.org/deeplinks/2015/10/eff-strongly-oppose-ci... That seems consistent with my aforementioned worry.
    - tptacek 11y ago
      They have to do one of two things: 1. They can establish and run a process that ensures that data doesn't have personally identifying information in it. For instance, they can have a process by which they sign off on the types of things they're willing to share, and share only the stuff that never has PII in it. 2. They can instead run software that tries to spot PII and zaps it before sharing it. I don't know how people can take EFF seriously when they say things like "aggressive spying powers". Whatever "spying powers" are in this bill are subtle; I don't think they're there at all. EFF does this a lot: they know their readers aren't going to read the bill, and further that their readers want to believe that the bill is horrifying, and they play that to the hilt.
      - jessriedel 11y ago
        Thanks very much for info. Much appreciated. Agreed that the EFF risks its reputation when it freely uses hyperbolic language. But I think some of this is due to (mostly philosophical) difference about how much we should worry about granting vague powers to the government which are mostly not abused. People similarly differ in how fiercely they fight free speech restrictions, etc.
        tptacek 11y ago
        I think the underlying worry here is very legitimate. But my interest is in making sure we know the truth as precisely as we can, and I believe nobody is well-served by the propagation of falsehoods, even when the falsehoods support a valid narrative.
      - soared 11y ago
        3. They aren't required to share any data, and can keep it to themselves.
vezzy-fnord 11y ago
The bill itself reads mostly mundane, which I think is part of the intention. The main issues are the liberal definitions of "cybersecurity purpose," "cybersecurity threat" and "cyber threat indicator," along with the really half-assed integrity requirements ("Make sure you scrub out personally identifiable information, but only if you're aware of it, so no big deal.") and a repeated insistence on the data being "shared as quickly as operationally practicable". As such, it strikes me as a try-hard and forced attempt to implement private-to-governmental-entity data sharing with little assurance, and cloaked as a seemingly routine bill. It thus makes perfect tactical sense to bundle it with an omnibus, since it blends in well.
- tptacek 11y ago
  Could you be more specific about the "liberal definitions" of "cybersecurity purpose, threat, and indicator"? I've read all the computer security legislation that's been proposed in the last 8 years or so, and CISA had the least egregious definitions I'd read. They even inherited the CISPA amendment that established that terms of service violations weren't cybersecurity threats.
  - vezzy-fnord 11y ago
    That it does, along with consumer licensing agreements (presumably EULAs). "Cybersecurity purpose" is itself mostly a pointer contingent to the meaning of "cybersecurity threat": Except as provided in subparagraph (B), the term cybersecurity threat means an action, not protected by the First Amendment to the Constitution of the United States, on or through an information system that may result in an unauthorized effort to adversely impact the security, availability, confidentiality, or integrity of an information system or information that is stored on, processed by, or transiting an information system. (6) Cyber threat indicator is rather loose with F, G and H. B drops the term "security control". A seems to be legitimately trying to address automated scanning, but might seem to let through legitimate scraping since it doesn't further qualify. If this is, as you say, one of the least egregious definitions, then I'm not sure whether this is a cause for concern or hope.
bertil 11y ago
Let’s assume a government asks Facebook about private information. In the US, it can do so via with secret courts, so the people being surveilled cannot know about and oppose it. In that case, Facebook is the only one who could do something about it: they can do so by arguing that revealing that information would put them in legal trouble. How that works, I have no idea: the court is secret, so is the idiosyncrasies of its appeal process. The possibility that Facebook could be attacked makes the lawyers unhappy: their job includes minimising risks, and this is a big one given the PR around it. The ability to oppose abusive requests makes the (very many) privacy-concerned employees happy: they really don’t like spending their career helping ideas they strongly oppose. That’s why you can have contradictory statements. The real issue here is the existence of secret courts, and administrative processes that exclude judges and the basic legal protection (guaranteed by the Fourth amendment in the US). Facebook can’t really oppose that without exposing itself to spin around being pro-terrorists (which is mind-boggling when you think about how loudly the same people talk about “Freedom”). Allowing an appeal and maintaining needed discretion in certain matters is a delicate problem, but hardly a new one in law. It sounds to me (not a legal expert) that what would be preferable is to have a Public defender for privacy, fluent in legal and technical matter, who be made privy to secret decision, and not allowed to contact the people being targeted before they know about the surveillance. The ACLU sounds like they could recommend good candidates. A judge should be able to do that, and Congress at a higher level — but whomever was in charge lately has dropped the ball quite dramatically, being both lied to and far too lenient in what they knew.
dhimes 11y ago
It also says that non-related personal information will be removed from the shared data, and (surprise!) that if someone's personal data were accidentally (I presume) shared then the feds must notify that person of the breach. That's actually a positive in this bill.
- dhimes 11y ago
  https://www.govtrack.us/congress/bills/114/hr2029/text/eah#link=N_I_103_b_1_E_~T1&nearest=H84F2F9F026E94AF6B7487061FC414A40 https://www.govtrack.us/congress/bills/114/hr2029/text/eah#l...
tptacek 11y ago
You are reading it correctly. CISA explicitly establishes by statute that private entities are never required to share data, but that the government is required to share with private entities.
- dhimes 11y ago
  It also seems to be addressing, by "cybersecurity threats," the act of trying to hack into information systems. The law seems to be paving the legal way for facebook to work with google and ycombinator if there was a network attack by <insert cyber bad-guys> in order to set up defensive measures against the attack and perhaps share information as to who and where it is coming from. Personal information must be removed from such shared information, and if not the insulted party must be notified. Specific details of how to do this must be decided in the next 90 (or was it 180)days and compliance oversight reports are required regularly. I'm a little embarrassed, but I must have missed the part where this makes things worse. I'm being honest here: If I should be upset about this I need to know why, please.
  - tptacek 11y ago
    There are reasons not to like CISA. I'm pretty irritated by it: I think organizations like Fight For The Future organized a campaign against CISPA based on a whole lot of FUD, and for their efforts got us a law that actually justifies (a very little bit) of that FUD. Unlike CISPA, CISA allows shared information to be used for law enforcement purposes. Ideally, threat information shared with the government should be used solely to improve defenses and prevent breaches; instead, anyone who shares data now needs to be cognizant of the other uses to which it will be put.
    - dhimes 11y ago
      Law enforcement outside of cyber security? OK, I did miss that. Thanks.
      - tptacek 11y ago

by egwynn 11y ago

jessriedel 11y ago

> I do NOT believe it contains any further provisions requiring private companies to share their data without a warrant. Sure, but that means the companies now face minimal incentive to protect user data but doubtless will experience pressure from the government to give it up even without a warrant.

tptacek 11y ago
This bill only allows companies to share data that fit the definition of "cybersecurity threat indicator", and that definition requires companies to not knowingly share personally identifying information. It is not a particularly effective vector for slurping messages out of Facebook.
- jessriedel 11y ago
  Does that roughly mean that FB must (to be shielded from lawsuits) anonymize the data before passing it to the government? This isn't particularly comforting, since it could still be used to prosecute individuals if identity can be inferred from other context. The EFF's criticism is basically that the bill is overly broad and can be used nefariously, even if it's not an all purpose FB message vacuum: > The bill's broad immunity clauses, vague definitions, and aggressive spying powers combine to make the bill a surveillance bill in disguise. Further, the bill does not address problems from the recent highly publicized computer data breaches that were caused by unencrypted files, poor computer architecture, un-updated servers, and employees (or contractors) clicking malware links. https://www.eff.org/deeplinks/2015/10/eff-strongly-oppose-cisa-cyber-surveillance-bill-and-cfaa-amendment https://www.eff.org/deeplinks/2015/10/eff-strongly-oppose-ci... That seems consistent with my aforementioned worry.
  - tptacek 11y ago
    They have to do one of two things: 1. They can establish and run a process that ensures that data doesn't have personally identifying information in it. For instance, they can have a process by which they sign off on the types of things they're willing to share, and share only the stuff that never has PII in it. 2. They can instead run software that tries to spot PII and zaps it before sharing it. I don't know how people can take EFF seriously when they say things like "aggressive spying powers". Whatever "spying powers" are in this bill are subtle; I don't think they're there at all. EFF does this a lot: they know their readers aren't going to read the bill, and further that their readers want to believe that the bill is horrifying, and they play that to the hilt.
    - jessriedel 11y ago
      Thanks very much for info. Much appreciated. Agreed that the EFF risks its reputation when it freely uses hyperbolic language. But I think some of this is due to (mostly philosophical) difference about how much we should worry about granting vague powers to the government which are mostly not abused. People similarly differ in how fiercely they fight free speech restrictions, etc.
      - tptacek 11y ago
        I think the underlying worry here is very legitimate. But my interest is in making sure we know the truth as precisely as we can, and I believe nobody is well-served by the propagation of falsehoods, even when the falsehoods support a valid narrative.
    - soared 11y ago
      3. They aren't required to share any data, and can keep it to themselves.

vezzy-fnord 11y ago

The bill itself reads mostly mundane, which I think is part of the intention. The main issues are the liberal definitions of "cybersecurity purpose," "cybersecurity threat" and "cyber threat indicator," along with the really half-assed integrity requirements ("Make sure you scrub out personally identifiable information, but only if you're aware of it, so no big deal.") and a repeated insistence on the data being "shared as quickly as operationally practicable". As such, it strikes me as a try-hard and forced attempt to implement private-to-governmental-entity data sharing with little assurance, and cloaked as a seemingly routine bill. It thus makes perfect tactical sense to bundle it with an omnibus, since it blends in well.

tptacek 11y ago
Could you be more specific about the "liberal definitions" of "cybersecurity purpose, threat, and indicator"? I've read all the computer security legislation that's been proposed in the last 8 years or so, and CISA had the least egregious definitions I'd read. They even inherited the CISPA amendment that established that terms of service violations weren't cybersecurity threats.
- vezzy-fnord 11y ago
  That it does, along with consumer licensing agreements (presumably EULAs). "Cybersecurity purpose" is itself mostly a pointer contingent to the meaning of "cybersecurity threat": Except as provided in subparagraph (B), the term cybersecurity threat means an action, not protected by the First Amendment to the Constitution of the United States, on or through an information system that may result in an unauthorized effort to adversely impact the security, availability, confidentiality, or integrity of an information system or information that is stored on, processed by, or transiting an information system. (6) Cyber threat indicator is rather loose with F, G and H. B drops the term "security control". A seems to be legitimately trying to address automated scanning, but might seem to let through legitimate scraping since it doesn't further qualify. If this is, as you say, one of the least egregious definitions, then I'm not sure whether this is a cause for concern or hope.

bertil 11y ago

Let’s assume a government asks Facebook about private information. In the US, it can do so via with secret courts, so the people being surveilled cannot know about and oppose it. In that case, Facebook is the only one who could do something about it: they can do so by arguing that revealing that information would put them in legal trouble. How that works, I have no idea: the court is secret, so is the idiosyncrasies of its appeal process. The possibility that Facebook could be attacked makes the lawyers unhappy: their job includes minimising risks, and this is a big one given the PR around it. The ability to oppose abusive requests makes the (very many) privacy-concerned employees happy: they really don’t like spending their career helping ideas they strongly oppose. That’s why you can have contradictory statements. The real issue here is the existence of secret courts, and administrative processes that exclude judges and the basic legal protection (guaranteed by the Fourth amendment in the US). Facebook can’t really oppose that without exposing itself to spin around being pro-terrorists (which is mind-boggling when you think about how loudly the same people talk about “Freedom”). Allowing an appeal and maintaining needed discretion in certain matters is a delicate problem, but hardly a new one in law. It sounds to me (not a legal expert) that what would be preferable is to have a Public defender for privacy, fluent in legal and technical matter, who be made privy to secret decision, and not allowed to contact the people being targeted before they know about the surveillance. The ACLU sounds like they could recommend good candidates. A judge should be able to do that, and Congress at a higher level — but whomever was in charge lately has dropped the ball quite dramatically, being both lied to and far too lenient in what they knew.

dhimes 11y ago

It also says that non-related personal information will be removed from the shared data, and (surprise!) that if someone's personal data were accidentally (I presume) shared then the feds must notify that person of the breach. That's actually a positive in this bill.

dhimes 11y ago
https://www.govtrack.us/congress/bills/114/hr2029/text/eah#link=N_I_103_b_1_E_~T1&nearest=H84F2F9F026E94AF6B7487061FC414A40 https://www.govtrack.us/congress/bills/114/hr2029/text/eah#l...

tptacek 11y ago

You are reading it correctly. CISA explicitly establishes by statute that private entities are never required to share data, but that the government is required to share with private entities.

dhimes 11y ago
It also seems to be addressing, by "cybersecurity threats," the act of trying to hack into information systems. The law seems to be paving the legal way for facebook to work with google and ycombinator if there was a network attack by <insert cyber bad-guys> in order to set up defensive measures against the attack and perhaps share information as to who and where it is coming from. Personal information must be removed from such shared information, and if not the insulted party must be notified. Specific details of how to do this must be decided in the next 90 (or was it 180)days and compliance oversight reports are required regularly. I'm a little embarrassed, but I must have missed the part where this makes things worse. I'm being honest here: If I should be upset about this I need to know why, please.
- tptacek 11y ago
  There are reasons not to like CISA. I'm pretty irritated by it: I think organizations like Fight For The Future organized a campaign against CISPA based on a whole lot of FUD, and for their efforts got us a law that actually justifies (a very little bit) of that FUD. Unlike CISPA, CISA allows shared information to be used for law enforcement purposes. Ideally, threat information shared with the government should be used solely to improve defenses and prevent breaches; instead, anyone who shares data now needs to be cognizant of the other uses to which it will be put.
  - dhimes 11y ago
    Law enforcement outside of cyber security? OK, I did miss that. Thanks.
    - tptacek 11y ago