3 ms·

It also seems to be addressing, by "cybersecurity threats," the act of trying to hack into information systems. The law seems to be paving the legal way for fa

by dhimes 11y ago

It also seems to be addressing, by "cybersecurity threats," the act of trying to hack into information systems. The law seems to be paving the legal way for facebook to work with google and ycombinator if there was a network attack by <insert cyber bad-guys> in order to set up defensive measures against the attack and perhaps share information as to who and where it is coming from. Personal information must be removed from such shared information, and if not the insulted party must be notified. Specific details of how to do this must be decided in the next 90 (or was it 180)days and compliance oversight reports are required regularly. I'm a little embarrassed, but I must have missed the part where this makes things worse. I'm being honest here: If I should be upset about this I need to know why, please.

tptacek 11y ago
There are reasons not to like CISA. I'm pretty irritated by it: I think organizations like Fight For The Future organized a campaign against CISPA based on a whole lot of FUD, and for their efforts got us a law that actually justifies (a very little bit) of that FUD. Unlike CISPA, CISA allows shared information to be used for law enforcement purposes. Ideally, threat information shared with the government should be used solely to improve defenses and prevent breaches; instead, anyone who shares data now needs to be cognizant of the other uses to which it will be put.
- dhimes 11y ago
  Law enforcement outside of cyber security? OK, I did miss that. Thanks.
  - tptacek 11y ago
    Law enforcement can use indicators to RESPOND TO, PREVENT or MITIGATE "an imminent threat of death, serious bodily harm, or serious economic harm" (e.g. almost anything), but can only use it to assist in the PROSECUTION of identity theft, trade secret theft, or espionage. (PCNA had broader language that enabled prosecutions of a variety of crimes with indicator data). Again, CISPA, the bill FFTF takes credit for killing, had none of this language.

by dhimes 11y ago

tptacek 11y ago

There are reasons not to like CISA. I'm pretty irritated by it: I think organizations like Fight For The Future organized a campaign against CISPA based on a whole lot of FUD, and for their efforts got us a law that actually justifies (a very little bit) of that FUD. Unlike CISPA, CISA allows shared information to be used for law enforcement purposes. Ideally, threat information shared with the government should be used solely to improve defenses and prevent breaches; instead, anyone who shares data now needs to be cognizant of the other uses to which it will be put.

dhimes 11y ago
Law enforcement outside of cyber security? OK, I did miss that. Thanks.
- tptacek 11y ago
  Law enforcement can use indicators to RESPOND TO, PREVENT or MITIGATE "an imminent threat of death, serious bodily harm, or serious economic harm" (e.g. almost anything), but can only use it to assist in the PROSECUTION of identity theft, trade secret theft, or espionage. (PCNA had broader language that enabled prosecutions of a variety of crimes with indicator data). Again, CISPA, the bill FFTF takes credit for killing, had none of this language.