3 ms·

How about the ECPA? Does this: > as may be necessarily incident to the rendition of the service or to the protection of the rights or property of the provider

How about the ECPA? Does this: > as may be necessarily incident to the rendition of the service or to the protection of the rights or property of the provider of that service allow a telecom to randomly hand private information over to the government? Because it sounds to me like it's not "necessarily incident" unless it's, you know, necessarily incident. Thankfully our court system has the authority to decide that as well. In the case of CISPA, there are absolutely NO restrictions, and it's been broadened to apply to even more situations than just the provider's security. You are mischaracterizing the current nature of the privacy laws, unless you have something else to add?

tptacek 14y ago
Yes, it does. What is it that you think "incident to rendition of service" means? (Not that I think this is dispositive, but I had an actual run-in with an ISP over this clause. They suspected me of hacking their service, because they read my home directory [yes, this is shell server Internet access; I'm old] and found SMTP code in it --- so they recorded copies of all my email messages. A friend worked there and ratted them out. I met with a (good) lawyer. The response: too bad, so sad. GO ECPA!)
- ewillbefull 14y ago
  I assume that it means there is some compelling, /defensive/ purpose of disclosing the information. CISPA is completely indiscriminate and does not carry that same guarantee. Also your example appears to address what the ISP is allowed to record, not what they are allowed to share, which is a different issue all-together.
  - tptacek 14y ago
    See: US v. Harvey US v. Goldstein US v. Auler US v. DeLeeuw Also, reread CISPA, particularly the amendments clarifying what was meant by "cyber threat" and what activities were exempt from disclosure under CISPA.
    - ewillbefull 14y ago
      Thank you. It appears the EFF disagrees that cyber security threats were meaningfully narrowed in the amendments -- though this does not specifically pertain to any of my previous arguments. > Unfortunately, this amendment doesn’t address the serious problems with the vague definitions. Even after amendments, “Cybersecurity system" defines the system that “cybersecurity providers” or self-protected entities use to monitor and defend against cyber threats. This is a “system” intended to safeguard “a system or network.” The definition could mean anything—a Local Area Network, a Wide Area Network, a microchip, a website, online service, or a DVD. It might easily be stretched to be a catch-all term with no meaning. For example, it is unclear whether DRM on a DVD constitutes a “cybersecurity system.” And such a “cybersecurity system” is defined to protect a system or network from “efforts to degrade, disrupt or destroy”—language that is similarly too broad. Degrading a network could be construed to mean using a privacy-enhancing technology like Tor, or a p2p protocol, or simply downloading too many files. Your thoughts?
      - tptacek 14y ago
        The exclusion which appears directly beneath the language they're commenting on exempts "attacks" that merely violate licenses. The language they're commenting on also reads clearly: "efforts to degrade, disrupt, or destroy a system or network of a government or private entity". "Efforts" implies intent. BitTorrent doesn't intend to degrade, disrupt, or destroy systems (though if it violates license agreements it does establish a nexus for monitoring under the ECPA!). Beyond that, look: obviously we can all play the Glass Bead Game to connect any piece of language in any bill back to any action we want to protect. This is why patents are so impossibly annoying to read. But at some point, Occam's Razor has to apply. The language in the amendment we're discussing simply isn't tailored to BitTorrent.

tptacek 14y ago

Yes, it does. What is it that you think "incident to rendition of service" means? (Not that I think this is dispositive, but I had an actual run-in with an ISP over this clause. They suspected me of hacking their service, because they read my home directory [yes, this is shell server Internet access; I'm old] and found SMTP code in it --- so they recorded copies of all my email messages. A friend worked there and ratted them out. I met with a (good) lawyer. The response: too bad, so sad. GO ECPA!)

ewillbefull 14y ago
I assume that it means there is some compelling, /defensive/ purpose of disclosing the information. CISPA is completely indiscriminate and does not carry that same guarantee. Also your example appears to address what the ISP is allowed to record, not what they are allowed to share, which is a different issue all-together.
- tptacek 14y ago
  See: US v. Harvey US v. Goldstein US v. Auler US v. DeLeeuw Also, reread CISPA, particularly the amendments clarifying what was meant by "cyber threat" and what activities were exempt from disclosure under CISPA.
  - ewillbefull 14y ago
    Thank you. It appears the EFF disagrees that cyber security threats were meaningfully narrowed in the amendments -- though this does not specifically pertain to any of my previous arguments. > Unfortunately, this amendment doesn’t address the serious problems with the vague definitions. Even after amendments, “Cybersecurity system" defines the system that “cybersecurity providers” or self-protected entities use to monitor and defend against cyber threats. This is a “system” intended to safeguard “a system or network.” The definition could mean anything—a Local Area Network, a Wide Area Network, a microchip, a website, online service, or a DVD. It might easily be stretched to be a catch-all term with no meaning. For example, it is unclear whether DRM on a DVD constitutes a “cybersecurity system.” And such a “cybersecurity system” is defined to protect a system or network from “efforts to degrade, disrupt or destroy”—language that is similarly too broad. Degrading a network could be construed to mean using a privacy-enhancing technology like Tor, or a p2p protocol, or simply downloading too many files. Your thoughts?
    - tptacek 14y ago
      The exclusion which appears directly beneath the language they're commenting on exempts "attacks" that merely violate licenses. The language they're commenting on also reads clearly: "efforts to degrade, disrupt, or destroy a system or network of a government or private entity". "Efforts" implies intent. BitTorrent doesn't intend to degrade, disrupt, or destroy systems (though if it violates license agreements it does establish a nexus for monitoring under the ECPA!). Beyond that, look: obviously we can all play the Glass Bead Game to connect any piece of language in any bill back to any action we want to protect. This is why patents are so impossibly annoying to read. But at some point, Occam's Razor has to apply. The language in the amendment we're discussing simply isn't tailored to BitTorrent.