2 ms·

> Exactly what "liability" were you thinking of here? (3) EXEMPTION FROM LIABILITY- No civil or criminal cause of action shall lie or be maintained in Federal

by Natsu 15y ago

> Exactly what "liability" were you thinking of here? (3) EXEMPTION FROM LIABILITY- No civil or criminal cause of action shall lie or be maintained in Federal or State court against a protected entity, self-protected entity, cybersecurity provider, or an officer, employee, or agent of a protected entity, self-protected entity, or cybersecurity provider, acting in good faith-- (A) for using cybersecurity systems or sharing information in accordance with this section; or ‘(B) for not acting on information obtained or shared in accordance with this section. =========== Part (B) is pretty troubling. Suppose they find out, due to information shared in accordance with that section, that they're compromised. In spite of this, they fail to protect your money or data. Are they covered by that?

tptacek 15y ago
They're not liable simply by dint of receiving the information, meaning that there's no legal disincentive for them to accept information about compromises, such that an elaborate, expensive, and time consuming legal facade would be required for them to receive it. It's not a blanket shield of liability against breaches. It confers immunity from liability only for transmitting and receiving information. In the spectacularly unlikely event that Google received information that they were compromised through this channel and then did not act on it (!), they would still be liable for information that comes to them about the compromise through other channels.
- Natsu 15y ago
  Suppose that was the only information they had about their own servers being compromised. That would seem to land in a bit of a grey area, no? You're probably right and the courts could find some way around this shield if someone was too obviously negligent, though. Anyhow, that aside, my primary opposition comes from the fact that this is a poorly-drafted, unnecessary bill, not from how well I can imagine ways to abuse it. I mean, I don't think it's the end of civil liberties online or whatever its being billed as in the articles I haven't even read, but it's worth opposing simply for being such a crude blunt instrument.

by Natsu 15y ago

tptacek 15y ago

They're not liable simply by dint of receiving the information, meaning that there's no legal disincentive for them to accept information about compromises, such that an elaborate, expensive, and time consuming legal facade would be required for them to receive it. It's not a blanket shield of liability against breaches. It confers immunity from liability only for transmitting and receiving information. In the spectacularly unlikely event that Google received information that they were compromised through this channel and then did not act on it (!), they would still be liable for information that comes to them about the compromise through other channels.

Natsu 15y ago
Suppose that was the only information they had about their own servers being compromised. That would seem to land in a bit of a grey area, no? You're probably right and the courts could find some way around this shield if someone was too obviously negligent, though. Anyhow, that aside, my primary opposition comes from the fact that this is a poorly-drafted, unnecessary bill, not from how well I can imagine ways to abuse it. I mean, I don't think it's the end of civil liberties online or whatever its being billed as in the articles I haven't even read, but it's worth opposing simply for being such a crude blunt instrument.