6 ms·

The Disturbing Privacy Dangers in CISPA and How To Stop It

57 points by sathishmanohar 15y ago

iamgilesbowkett 15y ago
the House votes on the bill on April 23, which is a week away. any opposition which happens needs to happen fast. (I think that's probably deliberate.)
- tzs 15y ago
  A week from now, the bill will be about a week shy of being five months old. This doesn't sound lie a rushed vote to thwart opposition.
dguido 15y ago
I'm not sure I have a problem with companies under attack sharing IDS logs. This whole EFF post seems like a stretch. I think "threat information" is pretty clearly not my mom's personal e-mail, unless my mom is some kind of Tibetan supporter and China has been dropping her 0days daily, in which case it might be nice to have the government send my e-mail provider a heads up or for my e-mail provider to warn other people who might be affected. Can we save the grandstanding for actual privacy issues?
- sehugg 15y ago
  A law that grants immunity for sharing vaguely defined information for a vaguely defined purpose, and then authorizes the government to use that information for vaguely justifiable purposes is not an actual privacy issue?
  - tptacek 15y ago
    No, it's not, because the law of the land already allows service providers to voluntarily share information about the usage of their service (ie, email if they operate an email service) to the government without restriction, so long as that sharing is incident to an effort to protect their own service. In other words: service providers can share any information that is ostensibly about abuse of their own services; what they can't do is feed information about e.g. drug trafficking conducted over their service to help build a case against drug trafficking. CISPA also relies on voluntary sharing and is also framed around efforts to protect services. That doesn't make it a good bill. I don't think it is, and I "oppose" it (for whatever that's worth). But I oppose it because it's an ineffective measure, not because it's a threat to the Internet.
- ScottBurson 15y ago
  The problem is the gap between the ostensible purpose of the bill -- which most people seem to agree is a good thing -- and what the language of the bill actually allows. You may think that "threat information" is not your mom's personal email, but what if her ISP or the government disagrees? How is such a dispute to be resolved? The EFF is arguing that under the bill as it stands today, you have no recourse. It is always important to ask how the language of a law might be abused. As history shows, it probably will be if it can. My take at the moment is that the bill is probably salvageable if: (a) the definitions of what information can be shared without judicial oversight are tightened substantially; (b) a judicial oversight process is introduced for information that is potentially more sensitive; (c) businesses that exceed what is allowable under those provisions expose themselves to liability; and (d) clear and strict restrictions are placed on what the government is allowed to do with the information, along the lines that it may use it only to facilitate cybersecurity investigations.
  - tptacek 15y ago
    Exactly what recourse do you think you had in (say) 1998 to the sharing of your personal email by a service provider with (say) the FBI? 1998 predates the PATRIOT act and anything it did to defang the ECPA; your privacy rights were presumably at their zenith. So: specific questions: (a) what could you have done if Hotmail decided that your mail was relevant to an investigation about an attack on their service? (b) what protections did you have that once the investigation wrapped up, your emails would not end up in a database at DoJ? (c) under what specific law would you have been able to sue Hotmail for sharing your mail illegitimately? It should be obvious that my belief is that you had no recourse then, that you could not have sued, and that DoJ could easily have banked your mail or, to raise revenue for the state, sold it to direct marketing companies. But IANAL and it's wholly possible that despite the (limited) direct experience I've had with the ECPA and email privacy, I'm totally wrong.
    - ScottBurson 15y ago
      I concede your point about ECPA, as noted upthread; what do you think of my suggestions for further modifications to CISPA?
tptacek 15y ago
I've been pretty consistently disappointed with how EFF has been portraying this bill (which I don't support), to the point where it's causing me to re-evaluate the EFF as a whole. The ACLU has had a much more measured response. Instead of trying to mobilize opposition to the bill by depicting it as "SOPA 2" (which it clearly isn't), they provided a list of suggestions for narrowing and refining the language in CISPA. The new draft reflects many of their concerns. At its heart, CISPA is mostly a publicity measure meant to provide its sponsors with a veneer of having "done something" about the growing threat to industry by determined nation-state attackers (which is a real, if perhaps overhyped, threat to our national security). The kernel of intervention in CISPA --- the only thing CISPA actually "does" --- is an "official" provision for sharing information between service providers. Some things you should know before you make up your mind about how dangerous that sharing is: * It is already broadly allowed by the pre-PATRIOT 1986 Electronic Communications Privacy Act, which requires only that information be shared in conjunction with an actual effort to maintain services by the provider of the service itself, establishes no limits on the amount of information share or who it's shared with, explicitly carves out the ability for providers to share information with officials acting under color of law during criminal investigations (without a warrant!), and makes no mention whatsoever of anonymizing or stripping PII (ironically unlike CISPA). * It reflects already- in- place common industry practice: providers are already sharing often-detailed information about attacks. * The "monitoring" of your emails is already so commonplace and widely accepted that it forms the basis for products like Google Mail; the capture and sharing of your email during criminal investigations is, sadly, already allowed without a warrant in many US venues! It is one thing to suggest that the state of affairs for electronic privacy is sad indeed, and to militate in favor of better laws. Count me in. It's another thing entirely to attempt to twist every meaningless, do-nothing piece of legislation to come out of Washington as an attempt to rewire the Internet in favor of the MPAA, which is exactly what the EFF appears to be doing here. I felt like the concern over SOPA was slightly overblown but at least fundamentally valid. Here I see virtually no validity to the concerns, and any epsilon of valid concern that is present is so outweighed by hysteria that the net effect on civic discourse is negative, not positive. Support organizations that aren't trying to play off your emotions.
- chimeracoder 15y ago

the House votes on the bill on April 23, which is a week away. any opposition which happens needs to happen fast. (I think that's probably deliberate.)

tzs 15y ago
A week from now, the bill will be about a week shy of being five months old. This doesn't sound lie a rushed vote to thwart opposition.

dguido 15y ago

I'm not sure I have a problem with companies under attack sharing IDS logs. This whole EFF post seems like a stretch. I think "threat information" is pretty clearly not my mom's personal e-mail, unless my mom is some kind of Tibetan supporter and China has been dropping her 0days daily, in which case it might be nice to have the government send my e-mail provider a heads up or for my e-mail provider to warn other people who might be affected. Can we save the grandstanding for actual privacy issues?

sehugg 15y ago
A law that grants immunity for sharing vaguely defined information for a vaguely defined purpose, and then authorizes the government to use that information for vaguely justifiable purposes is not an actual privacy issue?
- tptacek 15y ago
  No, it's not, because the law of the land already allows service providers to voluntarily share information about the usage of their service (ie, email if they operate an email service) to the government without restriction, so long as that sharing is incident to an effort to protect their own service. In other words: service providers can share any information that is ostensibly about abuse of their own services; what they can't do is feed information about e.g. drug trafficking conducted over their service to help build a case against drug trafficking. CISPA also relies on voluntary sharing and is also framed around efforts to protect services. That doesn't make it a good bill. I don't think it is, and I "oppose" it (for whatever that's worth). But I oppose it because it's an ineffective measure, not because it's a threat to the Internet.
ScottBurson 15y ago
The problem is the gap between the ostensible purpose of the bill -- which most people seem to agree is a good thing -- and what the language of the bill actually allows. You may think that "threat information" is not your mom's personal email, but what if her ISP or the government disagrees? How is such a dispute to be resolved? The EFF is arguing that under the bill as it stands today, you have no recourse. It is always important to ask how the language of a law might be abused. As history shows, it probably will be if it can. My take at the moment is that the bill is probably salvageable if: (a) the definitions of what information can be shared without judicial oversight are tightened substantially; (b) a judicial oversight process is introduced for information that is potentially more sensitive; (c) businesses that exceed what is allowable under those provisions expose themselves to liability; and (d) clear and strict restrictions are placed on what the government is allowed to do with the information, along the lines that it may use it only to facilitate cybersecurity investigations.
- tptacek 15y ago
  Exactly what recourse do you think you had in (say) 1998 to the sharing of your personal email by a service provider with (say) the FBI? 1998 predates the PATRIOT act and anything it did to defang the ECPA; your privacy rights were presumably at their zenith. So: specific questions: (a) what could you have done if Hotmail decided that your mail was relevant to an investigation about an attack on their service? (b) what protections did you have that once the investigation wrapped up, your emails would not end up in a database at DoJ? (c) under what specific law would you have been able to sue Hotmail for sharing your mail illegitimately? It should be obvious that my belief is that you had no recourse then, that you could not have sued, and that DoJ could easily have banked your mail or, to raise revenue for the state, sold it to direct marketing companies. But IANAL and it's wholly possible that despite the (limited) direct experience I've had with the ECPA and email privacy, I'm totally wrong.
  - ScottBurson 15y ago
    I concede your point about ECPA, as noted upthread; what do you think of my suggestions for further modifications to CISPA?

tptacek 15y ago

I've been pretty consistently disappointed with how EFF has been portraying this bill (which I don't support), to the point where it's causing me to re-evaluate the EFF as a whole. The ACLU has had a much more measured response. Instead of trying to mobilize opposition to the bill by depicting it as "SOPA 2" (which it clearly isn't), they provided a list of suggestions for narrowing and refining the language in CISPA. The new draft reflects many of their concerns. At its heart, CISPA is mostly a publicity measure meant to provide its sponsors with a veneer of having "done something" about the growing threat to industry by determined nation-state attackers (which is a real, if perhaps overhyped, threat to our national security). The kernel of intervention in CISPA --- the only thing CISPA actually "does" --- is an "official" provision for sharing information between service providers. Some things you should know before you make up your mind about how dangerous that sharing is: * It is already broadly allowed by the pre-PATRIOT 1986 Electronic Communications Privacy Act, which requires only that information be shared in conjunction with an actual effort to maintain services by the provider of the service itself, establishes no limits on the amount of information share or who it's shared with, explicitly carves out the ability for providers to share information with officials acting under color of law during criminal investigations (without a warrant!), and makes no mention whatsoever of anonymizing or stripping PII (ironically unlike CISPA). * It reflects already- in- place common industry practice: providers are already sharing often-detailed information about attacks. * The "monitoring" of your emails is already so commonplace and widely accepted that it forms the basis for products like Google Mail; the capture and sharing of your email during criminal investigations is, sadly, already allowed without a warrant in many US venues! It is one thing to suggest that the state of affairs for electronic privacy is sad indeed, and to militate in favor of better laws. Count me in. It's another thing entirely to attempt to twist every meaningless, do-nothing piece of legislation to come out of Washington as an attempt to rewire the Internet in favor of the MPAA, which is exactly what the EFF appears to be doing here. I felt like the concern over SOPA was slightly overblown but at least fundamentally valid. Here I see virtually no validity to the concerns, and any epsilon of valid concern that is present is so outweighed by hysteria that the net effect on civic discourse is negative, not positive. Support organizations that aren't trying to play off your emotions.

chimeracoder 15y ago