4 ms·

I have to say, an argument that a particular proposed law does nothing - literally has no effect - seems inherently dishonest on its face. Your argument then i

I have to say, an argument that a particular proposed law does nothing - literally has no effect - seems inherently dishonest on its face. Your argument then is that the proponents are, um, doing it for their health? Because they're bored and have nothing else to do? I've only ever seen such arguments made about governmental actions by the most dishonest and most self-interested parties. I would say there's a 100% overlap in the sets of people who say "pay no attention to bill 17, it does nothing" and people who stand to benefit substantially from bill 17. ECPA is actually fairly strict. It would be both illegal and tortious for Google to, for example, share the entire contents of your Gmail archives with the MPAA, currently. But after CISPA passes, it would be neither illegal nor a tort. As for the government, it overturns and eliminates warrant/certification requirements for a wide swath of purposes. Under ECPA, a communications provider could give data to the government only if it reasonably believed it was immediately necessary to prevent death or serious injury. Under CISPA, any internet entity can give any data to the government OR ANY OTHER ENTITY for almost any sort of reason - "ensuring the integrity" of any internet service cuts a giant, giant swath. And specifically enumerated in CISPA, but entirely absent from ECPA, are that anything relating to antipiracy efforts is also covered. You seem to have a very confused idea about ECPA-1986 if you think it has much in common with CISPA-2012. To the extent that they overlap, CISPA is intended to overrule protections that ECPA provided.

tptacek 15y ago
As someone who has actually had dialog with an attorney after having his mail stolen by a provider incident to a (bogus) security investigation, I believe you're wrong. Service providers have broad authority to capture, read, and even disclose information carried on their networks incident to their (sweeping) duties to operate their services and protect their property. Also: your understanding of warrant requirements under ECPA is skewed; service providers also have broad authority to disclose information to people acting under color of law in the course of criminal investigations. Again: under the restrictive 1986 ECPA (which is not the current law of the land). Also, you're mistaken about the argument I'm making. I don't think CISPA replaces ECPA.
- jellicle 15y ago
  Okay, so we've discovered the problem. You had a situation, where an attorney told you that you had no remedy at law for some privacy breach, and you've turned that into "any new law that eliminates privacy protections doesn't do anything because I already don't have any privacy". I don't think that was a good life lesson to have learned. ECPA says service providers can access data "as may be necessarily incident to the rendition of the service or to the protection of the rights or property of the provider of that service;". This is an narrow exception intended to make it legal for a sysadmin, doing legitimate work, to tail a mail queue or something like that. CISPA grabs that exception with both hands and does a goatse.cx on it. I think there's a big big difference between allowing providers access to data necessary for providing the service, and eliminating ALL civil and criminal liability for giving your data to, well, just about anyone, for just about any reason. Again, CISPA is intended to legalize the wholesale sharing of your online activities FROM Google/Facebook/Verizon/etc. TO the MPAA/RIAA/Media Defender/government/etc., based on any tangible connection to the integrity of any online service (spamming? too many comments on HN? That's a-sharin'!) or any sort of copyright/trademark/trade secret infringement claim. That simply isn't legal today.
  - tptacek 15y ago
    None of this follows from my previous comment. You seem intent on making this argument about me, and not about the law we're discussing.
- Natsu 15y ago
  > I don't think CISPA replaces ECPA. CISPA has a bunch of clauses saying that it trumps any law to the contrary ("Notwithstanding any other provision of law"), so the ECPA only applies when CISPA doesn't. CISPA even has a redundant clause talking about federal preemption that appears to be there just to emphasize the fact that it was intended to overrule everything else. Perhaps you would prefer to hear the ACLU's opposition piece: https://www.aclu.org/technology-and-liberty/aclu-opposition-hr-3523-cyber-intelligence-sharing-and-protection-act-2011 https://www.aclu.org/technology-and-liberty/aclu-opposition-... They repeat a fair number of the EFF's complaints, including how the law is too broad. I don't think the sky is falling here, but I do think that putting a giant loophole in every single privacy law, however inadequate the current ones may be, is a mistake. If they really want to do something, they ought to update the ECPA. It's rather dated.
KaeseEs 15y ago
There are numerous laws on the books that do absolutely nothing. For instance, it has been illegal since 1986 to manufacture a handgun containing less than four ounces of metal. No such practical design existed at the time, nor was any being developed, nor was there any plan from any manufacturer about ever making one.
- Malcx 15y ago
  I'd imagine this was to combat making guns readily available that would bypass metal detectors. Just because there weren't any planed at the time, forsight may have been enough to avoid that situation? /speculation
- jellicle 15y ago
  Actually, they were reacting to a patented design and the announced intention to manufacture such weapons: http://www.thefirearmblog.com/blog/2011/10/05/what-happened-the-the-mythical-undetectable-plastic-gun/ http://www.thefirearmblog.com/blog/2011/10/05/what-happened-...

tptacek 15y ago

As someone who has actually had dialog with an attorney after having his mail stolen by a provider incident to a (bogus) security investigation, I believe you're wrong. Service providers have broad authority to capture, read, and even disclose information carried on their networks incident to their (sweeping) duties to operate their services and protect their property. Also: your understanding of warrant requirements under ECPA is skewed; service providers also have broad authority to disclose information to people acting under color of law in the course of criminal investigations. Again: under the restrictive 1986 ECPA (which is not the current law of the land). Also, you're mistaken about the argument I'm making. I don't think CISPA replaces ECPA.

jellicle 15y ago
Okay, so we've discovered the problem. You had a situation, where an attorney told you that you had no remedy at law for some privacy breach, and you've turned that into "any new law that eliminates privacy protections doesn't do anything because I already don't have any privacy". I don't think that was a good life lesson to have learned. ECPA says service providers can access data "as may be necessarily incident to the rendition of the service or to the protection of the rights or property of the provider of that service;". This is an narrow exception intended to make it legal for a sysadmin, doing legitimate work, to tail a mail queue or something like that. CISPA grabs that exception with both hands and does a goatse.cx on it. I think there's a big big difference between allowing providers access to data necessary for providing the service, and eliminating ALL civil and criminal liability for giving your data to, well, just about anyone, for just about any reason. Again, CISPA is intended to legalize the wholesale sharing of your online activities FROM Google/Facebook/Verizon/etc. TO the MPAA/RIAA/Media Defender/government/etc., based on any tangible connection to the integrity of any online service (spamming? too many comments on HN? That's a-sharin'!) or any sort of copyright/trademark/trade secret infringement claim. That simply isn't legal today.
- tptacek 15y ago
  None of this follows from my previous comment. You seem intent on making this argument about me, and not about the law we're discussing.
Natsu 15y ago
> I don't think CISPA replaces ECPA. CISPA has a bunch of clauses saying that it trumps any law to the contrary ("Notwithstanding any other provision of law"), so the ECPA only applies when CISPA doesn't. CISPA even has a redundant clause talking about federal preemption that appears to be there just to emphasize the fact that it was intended to overrule everything else. Perhaps you would prefer to hear the ACLU's opposition piece: https://www.aclu.org/technology-and-liberty/aclu-opposition-hr-3523-cyber-intelligence-sharing-and-protection-act-2011 https://www.aclu.org/technology-and-liberty/aclu-opposition-... They repeat a fair number of the EFF's complaints, including how the law is too broad. I don't think the sky is falling here, but I do think that putting a giant loophole in every single privacy law, however inadequate the current ones may be, is a mistake. If they really want to do something, they ought to update the ECPA. It's rather dated.

KaeseEs 15y ago

There are numerous laws on the books that do absolutely nothing. For instance, it has been illegal since 1986 to manufacture a handgun containing less than four ounces of metal. No such practical design existed at the time, nor was any being developed, nor was there any plan from any manufacturer about ever making one.

Malcx 15y ago
I'd imagine this was to combat making guns readily available that would bypass metal detectors. Just because there weren't any planed at the time, forsight may have been enough to avoid that situation? /speculation
jellicle 15y ago
Actually, they were reacting to a patented design and the announced intention to manufacture such weapons: http://www.thefirearmblog.com/blog/2011/10/05/what-happened-the-the-mythical-undetectable-plastic-gun/ http://www.thefirearmblog.com/blog/2011/10/05/what-happened-...