2 ms·

I'm not sure I have a problem with companies under attack sharing IDS logs. This whole EFF post seems like a stretch. I think "threat information" is pretty cle

by dguido 15y ago

I'm not sure I have a problem with companies under attack sharing IDS logs. This whole EFF post seems like a stretch. I think "threat information" is pretty clearly not my mom's personal e-mail, unless my mom is some kind of Tibetan supporter and China has been dropping her 0days daily, in which case it might be nice to have the government send my e-mail provider a heads up or for my e-mail provider to warn other people who might be affected. Can we save the grandstanding for actual privacy issues?

sehugg 15y ago
A law that grants immunity for sharing vaguely defined information for a vaguely defined purpose, and then authorizes the government to use that information for vaguely justifiable purposes is not an actual privacy issue?
- tptacek 15y ago
  No, it's not, because the law of the land already allows service providers to voluntarily share information about the usage of their service (ie, email if they operate an email service) to the government without restriction, so long as that sharing is incident to an effort to protect their own service. In other words: service providers can share any information that is ostensibly about abuse of their own services; what they can't do is feed information about e.g. drug trafficking conducted over their service to help build a case against drug trafficking. CISPA also relies on voluntary sharing and is also framed around efforts to protect services. That doesn't make it a good bill. I don't think it is, and I "oppose" it (for whatever that's worth). But I oppose it because it's an ineffective measure, not because it's a threat to the Internet.
ScottBurson 15y ago
The problem is the gap between the ostensible purpose of the bill -- which most people seem to agree is a good thing -- and what the language of the bill actually allows. You may think that "threat information" is not your mom's personal email, but what if her ISP or the government disagrees? How is such a dispute to be resolved? The EFF is arguing that under the bill as it stands today, you have no recourse. It is always important to ask how the language of a law might be abused. As history shows, it probably will be if it can. My take at the moment is that the bill is probably salvageable if: (a) the definitions of what information can be shared without judicial oversight are tightened substantially; (b) a judicial oversight process is introduced for information that is potentially more sensitive; (c) businesses that exceed what is allowable under those provisions expose themselves to liability; and (d) clear and strict restrictions are placed on what the government is allowed to do with the information, along the lines that it may use it only to facilitate cybersecurity investigations.
- tptacek 15y ago
  Exactly what recourse do you think you had in (say) 1998 to the sharing of your personal email by a service provider with (say) the FBI? 1998 predates the PATRIOT act and anything it did to defang the ECPA; your privacy rights were presumably at their zenith. So: specific questions: (a) what could you have done if Hotmail decided that your mail was relevant to an investigation about an attack on their service? (b) what protections did you have that once the investigation wrapped up, your emails would not end up in a database at DoJ? (c) under what specific law would you have been able to sue Hotmail for sharing your mail illegitimately? It should be obvious that my belief is that you had no recourse then, that you could not have sued, and that DoJ could easily have banked your mail or, to raise revenue for the state, sold it to direct marketing companies. But IANAL and it's wholly possible that despite the (limited) direct experience I've had with the ECPA and email privacy, I'm totally wrong.
  - ScottBurson 15y ago
    I concede your point about ECPA, as noted upthread; what do you think of my suggestions for further modifications to CISPA?
    - tptacek 15y ago
      I think it would be better for industry not to pass a bill at all than to pass one that introduced judicial oversight and explicit liability for information sharing that is already occurring. I think it doesn't make much sense to introduce sweeping, meaningful privacy controls in the context of a bill that aims to help organizations coordinate defenses against nation-state attackers. The net effect would simply be to hamstring defenders. This bill is an attempt to increase sharing. (I don't think we need CISPA at all and don't support it). I think it makes a lot of sense to introduce sweeping new privacy controls in general. The ECPA predates the public Internet and could use a thorough update.

by dguido 15y ago

sehugg 15y ago

A law that grants immunity for sharing vaguely defined information for a vaguely defined purpose, and then authorizes the government to use that information for vaguely justifiable purposes is not an actual privacy issue?

tptacek 15y ago
No, it's not, because the law of the land already allows service providers to voluntarily share information about the usage of their service (ie, email if they operate an email service) to the government without restriction, so long as that sharing is incident to an effort to protect their own service. In other words: service providers can share any information that is ostensibly about abuse of their own services; what they can't do is feed information about e.g. drug trafficking conducted over their service to help build a case against drug trafficking. CISPA also relies on voluntary sharing and is also framed around efforts to protect services. That doesn't make it a good bill. I don't think it is, and I "oppose" it (for whatever that's worth). But I oppose it because it's an ineffective measure, not because it's a threat to the Internet.

ScottBurson 15y ago

The problem is the gap between the ostensible purpose of the bill -- which most people seem to agree is a good thing -- and what the language of the bill actually allows. You may think that "threat information" is not your mom's personal email, but what if her ISP or the government disagrees? How is such a dispute to be resolved? The EFF is arguing that under the bill as it stands today, you have no recourse. It is always important to ask how the language of a law might be abused. As history shows, it probably will be if it can. My take at the moment is that the bill is probably salvageable if: (a) the definitions of what information can be shared without judicial oversight are tightened substantially; (b) a judicial oversight process is introduced for information that is potentially more sensitive; (c) businesses that exceed what is allowable under those provisions expose themselves to liability; and (d) clear and strict restrictions are placed on what the government is allowed to do with the information, along the lines that it may use it only to facilitate cybersecurity investigations.

tptacek 15y ago
Exactly what recourse do you think you had in (say) 1998 to the sharing of your personal email by a service provider with (say) the FBI? 1998 predates the PATRIOT act and anything it did to defang the ECPA; your privacy rights were presumably at their zenith. So: specific questions: (a) what could you have done if Hotmail decided that your mail was relevant to an investigation about an attack on their service? (b) what protections did you have that once the investigation wrapped up, your emails would not end up in a database at DoJ? (c) under what specific law would you have been able to sue Hotmail for sharing your mail illegitimately? It should be obvious that my belief is that you had no recourse then, that you could not have sued, and that DoJ could easily have banked your mail or, to raise revenue for the state, sold it to direct marketing companies. But IANAL and it's wholly possible that despite the (limited) direct experience I've had with the ECPA and email privacy, I'm totally wrong.
- ScottBurson 15y ago
  I concede your point about ECPA, as noted upthread; what do you think of my suggestions for further modifications to CISPA?
  - tptacek 15y ago
    I think it would be better for industry not to pass a bill at all than to pass one that introduced judicial oversight and explicit liability for information sharing that is already occurring. I think it doesn't make much sense to introduce sweeping, meaningful privacy controls in the context of a bill that aims to help organizations coordinate defenses against nation-state attackers. The net effect would simply be to hamstring defenders. This bill is an attempt to increase sharing. (I don't think we need CISPA at all and don't support it). I think it makes a lot of sense to introduce sweeping new privacy controls in general. The ECPA predates the public Internet and could use a thorough update.