19 ms·

The bill itself reads mostly mundane, which I think is part of the intention. The main issues are the liberal definitions of "cybersecurity purpose," "cybersecu

The bill itself reads mostly mundane, which I think is part of the intention. The main issues are the liberal definitions of "cybersecurity purpose," "cybersecurity threat" and "cyber threat indicator," along with the really half-assed integrity requirements ("Make sure you scrub out personally identifiable information, but only if you're aware of it, so no big deal.") and a repeated insistence on the data being "shared as quickly as operationally practicable". As such, it strikes me as a try-hard and forced attempt to implement private-to-governmental-entity data sharing with little assurance, and cloaked as a seemingly routine bill. It thus makes perfect tactical sense to bundle it with an omnibus, since it blends in well.

tptacek 11y ago
Could you be more specific about the "liberal definitions" of "cybersecurity purpose, threat, and indicator"? I've read all the computer security legislation that's been proposed in the last 8 years or so, and CISA had the least egregious definitions I'd read. They even inherited the CISPA amendment that established that terms of service violations weren't cybersecurity threats.
- vezzy-fnord 11y ago
  That it does, along with consumer licensing agreements (presumably EULAs). "Cybersecurity purpose" is itself mostly a pointer contingent to the meaning of "cybersecurity threat": Except as provided in subparagraph (B), the term cybersecurity threat means an action, not protected by the First Amendment to the Constitution of the United States, on or through an information system that may result in an unauthorized effort to adversely impact the security, availability, confidentiality, or integrity of an information system or information that is stored on, processed by, or transiting an information system. (6) Cyber threat indicator is rather loose with F, G and H. B drops the term "security control". A seems to be legitimately trying to address automated scanning, but might seem to let through legitimate scraping since it doesn't further qualify. If this is, as you say, one of the least egregious definitions, then I'm not sure whether this is a cause for concern or hope.

tptacek 11y ago

Could you be more specific about the "liberal definitions" of "cybersecurity purpose, threat, and indicator"? I've read all the computer security legislation that's been proposed in the last 8 years or so, and CISA had the least egregious definitions I'd read. They even inherited the CISPA amendment that established that terms of service violations weren't cybersecurity threats.

vezzy-fnord 11y ago
That it does, along with consumer licensing agreements (presumably EULAs). "Cybersecurity purpose" is itself mostly a pointer contingent to the meaning of "cybersecurity threat": Except as provided in subparagraph (B), the term cybersecurity threat means an action, not protected by the First Amendment to the Constitution of the United States, on or through an information system that may result in an unauthorized effort to adversely impact the security, availability, confidentiality, or integrity of an information system or information that is stored on, processed by, or transiting an information system. (6) Cyber threat indicator is rather loose with F, G and H. B drops the term "security control". A seems to be legitimately trying to address automated scanning, but might seem to let through legitimate scraping since it doesn't further qualify. If this is, as you say, one of the least egregious definitions, then I'm not sure whether this is a cause for concern or hope.