3 ms·

The problem is the gap between the ostensible purpose of the bill -- which most people seem to agree is a good thing -- and what the language of the bill actual

The problem is the gap between the ostensible purpose of the bill -- which most people seem to agree is a good thing -- and what the language of the bill actually allows. You may think that "threat information" is not your mom's personal email, but what if her ISP or the government disagrees? How is such a dispute to be resolved? The EFF is arguing that under the bill as it stands today, you have no recourse. It is always important to ask how the language of a law might be abused. As history shows, it probably will be if it can. My take at the moment is that the bill is probably salvageable if: (a) the definitions of what information can be shared without judicial oversight are tightened substantially; (b) a judicial oversight process is introduced for information that is potentially more sensitive; (c) businesses that exceed what is allowable under those provisions expose themselves to liability; and (d) clear and strict restrictions are placed on what the government is allowed to do with the information, along the lines that it may use it only to facilitate cybersecurity investigations.

tptacek 15y ago
Exactly what recourse do you think you had in (say) 1998 to the sharing of your personal email by a service provider with (say) the FBI? 1998 predates the PATRIOT act and anything it did to defang the ECPA; your privacy rights were presumably at their zenith. So: specific questions: (a) what could you have done if Hotmail decided that your mail was relevant to an investigation about an attack on their service? (b) what protections did you have that once the investigation wrapped up, your emails would not end up in a database at DoJ? (c) under what specific law would you have been able to sue Hotmail for sharing your mail illegitimately? It should be obvious that my belief is that you had no recourse then, that you could not have sued, and that DoJ could easily have banked your mail or, to raise revenue for the state, sold it to direct marketing companies. But IANAL and it's wholly possible that despite the (limited) direct experience I've had with the ECPA and email privacy, I'm totally wrong.
- ScottBurson 15y ago
  I concede your point about ECPA, as noted upthread; what do you think of my suggestions for further modifications to CISPA?
  - tptacek 15y ago
    I think it would be better for industry not to pass a bill at all than to pass one that introduced judicial oversight and explicit liability for information sharing that is already occurring. I think it doesn't make much sense to introduce sweeping, meaningful privacy controls in the context of a bill that aims to help organizations coordinate defenses against nation-state attackers. The net effect would simply be to hamstring defenders. This bill is an attempt to increase sharing. (I don't think we need CISPA at all and don't support it). I think it makes a lot of sense to introduce sweeping new privacy controls in general. The ECPA predates the public Internet and could use a thorough update.

tptacek 15y ago

Exactly what recourse do you think you had in (say) 1998 to the sharing of your personal email by a service provider with (say) the FBI? 1998 predates the PATRIOT act and anything it did to defang the ECPA; your privacy rights were presumably at their zenith. So: specific questions: (a) what could you have done if Hotmail decided that your mail was relevant to an investigation about an attack on their service? (b) what protections did you have that once the investigation wrapped up, your emails would not end up in a database at DoJ? (c) under what specific law would you have been able to sue Hotmail for sharing your mail illegitimately? It should be obvious that my belief is that you had no recourse then, that you could not have sued, and that DoJ could easily have banked your mail or, to raise revenue for the state, sold it to direct marketing companies. But IANAL and it's wholly possible that despite the (limited) direct experience I've had with the ECPA and email privacy, I'm totally wrong.

ScottBurson 15y ago
I concede your point about ECPA, as noted upthread; what do you think of my suggestions for further modifications to CISPA?
- tptacek 15y ago
  I think it would be better for industry not to pass a bill at all than to pass one that introduced judicial oversight and explicit liability for information sharing that is already occurring. I think it doesn't make much sense to introduce sweeping, meaningful privacy controls in the context of a bill that aims to help organizations coordinate defenses against nation-state attackers. The net effect would simply be to hamstring defenders. This bill is an attempt to increase sharing. (I don't think we need CISPA at all and don't support it). I think it makes a lot of sense to introduce sweeping new privacy controls in general. The ECPA predates the public Internet and could use a thorough update.