5 ms·

How would you know if its a "substantial and positive step" if you are not familiar with everything in the bill?

by dfc 15y ago

azernik 15y ago
Because the changes mentioned in the memo cite the specific parts of the bill to which they would apply. For example: In addition, H.R. 3523 would inappropriately shield companies from any suits where a company's actions are based on cyber threat information identified, obtained, or shared under this bill, regardless of whether that action otherwise violated Federal criminal law or results in damage or loss of life. This broad liability protection not only removes a strong incentive to improving cybersecurity, it also potentially undermines our Nation's economic, national security, and public safety interests. I don't need to know everything about the bill to know that liability protection that broad is a Bad Thing, and that attempts to strip it out are both substantial and positive.
- tptacek 15y ago
  Under what law would an email provider be exposed to liability should they opt to share information about email accounts, or even the contents of email messages, in the course of responding to a network security incident? Hint: the Federal law that attempts to establish that email stored at a provider is even "private" to begin with carves out a broad exception for exactly this kind of sharing, with no limitations on how that information is stored or relayed.
  - azernik 15y ago
    But a lot of companies that aren't e-mail providers (for example, health care providers) are currently exposed to a lot of liability if they share your information without your consent.
    - tptacek 15y ago
      This is a really good point. I see the conflict between HIPAA and CISPA as an artifact of it being a bad, poorly- thought- out bill, though, not a conspiracy to gain access to (e.g.) medical data. It's also worth noting that HIPAA is a notoriously toothless regulation; if you talk to practice managers that focus on health care, you'll hear stories about companies simply setting aside funds to pay the (comparatively minor) fines they're unlikely to be assessed.

How would you know if its a "substantial and positive step" if you are not familiar with everything in the bill?

by dfc 15y ago

How would you know if its a "substantial and positive step" if you are not familiar with everything in the bill?

Because the changes mentioned in the memo cite the specific parts of the bill to which they would apply. For example: In addition, H.R. 3523 would inappropriately shield companies from any suits where a company's actions are based on cyber threat information identified, obtained, or shared under this bill, regardless of whether that action otherwise violated Federal criminal law or results in damage or loss of life. This broad liability protection not only removes a strong incentive to improving cybersecurity, it also potentially undermines our Nation's economic, national security, and public safety interests. I don't need to know everything about the bill to know that liability protection that broad is a Bad Thing, and that attempts to strip it out are both substantial and positive.

tptacek 15y ago
Under what law would an email provider be exposed to liability should they opt to share information about email accounts, or even the contents of email messages, in the course of responding to a network security incident? Hint: the Federal law that attempts to establish that email stored at a provider is even "private" to begin with carves out a broad exception for exactly this kind of sharing, with no limitations on how that information is stored or relayed.
- azernik 15y ago
  But a lot of companies that aren't e-mail providers (for example, health care providers) are currently exposed to a lot of liability if they share your information without your consent.
  - tptacek 15y ago
    This is a really good point. I see the conflict between HIPAA and CISPA as an artifact of it being a bad, poorly- thought- out bill, though, not a conspiracy to gain access to (e.g.) medical data. It's also worth noting that HIPAA is a notoriously toothless regulation; if you talk to practice managers that focus on health care, you'll hear stories about companies simply setting aside funds to pay the (comparatively minor) fines they're unlikely to be assessed.