4 ms·

I'll take the bait (not implying that you are trying to troll). The difference now is CISPA gets the government involved. Up until now, yes, FB has had a relax

I'll take the bait (not implying that you are trying to troll). The difference now is CISPA gets the government involved. Up until now, yes, FB has had a relaxed attitude toward user data when it comes to the law. However, I and many others, believe the government and via proxy the MPAA and RIAAs of the world will now have access to this data and it will be misused and abused all in the name of CISPA and with authority.

tptacek 14y ago
A couple of responses to that which might change your reasoning (let me know!): * CISPA is opt-in, so if Facebook doesn't want to share information with the government, CISPA isn't going to change its obligations. * If Facebook wants to share information with the MPAA and RIAA, its Terms of Service already enable it to do so, explicitly. * CISPA itself has gone through multiple successive drafts to eliminate the perception that it was merely a tool of license enforcement; the version the House finally passed (a) defines "cyber threat" specifically in regards to the "Confidentiality, Integrity, Availability" triad familiar to netsec practitioners (it is the first piece of federal legislation to do so, I believe) and (b) specifically exempts "consumer licensing" from the events that engage CISPA information sharing. * SOPA was intended to provide countermeasures to "criminal" copyright infringement and actually did provide some government control over network traffic. CISPA provides no countermeasures of any sort; it only governs information sharing. What are your thoughts on that? Do you think I'm misreading the law on any of those four points? Or, having been made aware of them, is your reasoning on CISPA at all influenced?
- djb_hackernews 14y ago
  Thanks for taking the time to provide some excellent responses. I don't mean to insult your patience, but I don't think I could say it any better than chernevik did http://news.ycombinator.com/item?id=3939974 http://news.ycombinator.com/item?id=3939974. He really got down to my issues with this bill. * There doesn't seem to be a need for it. Was there a situation where justice was not served but would have been/ could be after CISPA? * I just don't trust it, no matter how harmless it currently is. There is a term for this type of legislative process, not quite slippery slope, but it escapes me at the moment.
  - redthrowaway 14y ago
    > There is a term for this type of legislative process In sales and negotiation circles, it's known as the foot-in-the-door technique: http://en.wikipedia.org/wiki/Foot-in-the-door_technique http://en.wikipedia.org/wiki/Foot-in-the-door_technique
  - tptacek 14y ago
    I agree with both of these issues. Not only do I not see a need for CISPA, but further, I don't think CISPA does anything; the sharing authority CISPA grants private companies, I believe those companies already had under ECPA. I've been informed since I started reading and discussing CISPA that a primary purpose of this bill is actually the opposite of what people are worried about: that instead of getting private companies to share with the government, CISPA exists largely to provide a legal framework for the government to share information with private companies, so that when government systems are hit with new (say) Microsoft Office malware and "spear phishing" attacks, they can notify stakeholders in private industry. So that's one reason for CISPA. Another might just be to encourage private companies to share more information about network attacks; the supporters of this bill are not wrong that private companies are loathe to do that now for a variety of reasons. But again, ultimately, I agree with you. I don't support CISPA.
    - Natsu 14y ago
      > I've been informed since I started reading and discussing CISPA that a primary purpose of this bill is actually the opposite of what people are worried about: that instead of getting private companies to share with the government, CISPA exists largely to provide a legal framework for the government to share information with private companies, so that when government systems are hit with new (say) Microsoft Office malware and "spear phishing" attacks, they can notify stakeholders in private industry. I honestly wouldn't have a problem with that (who would?), but I have to wonder exactly what sort of legal problems they were having in doing this and why they couldn't create private agreements allowing that?
      - tptacek 14y ago

tptacek 14y ago

A couple of responses to that which might change your reasoning (let me know!): * CISPA is opt-in, so if Facebook doesn't want to share information with the government, CISPA isn't going to change its obligations. * If Facebook wants to share information with the MPAA and RIAA, its Terms of Service already enable it to do so, explicitly. * CISPA itself has gone through multiple successive drafts to eliminate the perception that it was merely a tool of license enforcement; the version the House finally passed (a) defines "cyber threat" specifically in regards to the "Confidentiality, Integrity, Availability" triad familiar to netsec practitioners (it is the first piece of federal legislation to do so, I believe) and (b) specifically exempts "consumer licensing" from the events that engage CISPA information sharing. * SOPA was intended to provide countermeasures to "criminal" copyright infringement and actually did provide some government control over network traffic. CISPA provides no countermeasures of any sort; it only governs information sharing. What are your thoughts on that? Do you think I'm misreading the law on any of those four points? Or, having been made aware of them, is your reasoning on CISPA at all influenced?

djb_hackernews 14y ago
Thanks for taking the time to provide some excellent responses. I don't mean to insult your patience, but I don't think I could say it any better than chernevik did http://news.ycombinator.com/item?id=3939974 http://news.ycombinator.com/item?id=3939974. He really got down to my issues with this bill. * There doesn't seem to be a need for it. Was there a situation where justice was not served but would have been/ could be after CISPA? * I just don't trust it, no matter how harmless it currently is. There is a term for this type of legislative process, not quite slippery slope, but it escapes me at the moment.
- redthrowaway 14y ago
  > There is a term for this type of legislative process In sales and negotiation circles, it's known as the foot-in-the-door technique: http://en.wikipedia.org/wiki/Foot-in-the-door_technique http://en.wikipedia.org/wiki/Foot-in-the-door_technique
- tptacek 14y ago
  I agree with both of these issues. Not only do I not see a need for CISPA, but further, I don't think CISPA does anything; the sharing authority CISPA grants private companies, I believe those companies already had under ECPA. I've been informed since I started reading and discussing CISPA that a primary purpose of this bill is actually the opposite of what people are worried about: that instead of getting private companies to share with the government, CISPA exists largely to provide a legal framework for the government to share information with private companies, so that when government systems are hit with new (say) Microsoft Office malware and "spear phishing" attacks, they can notify stakeholders in private industry. So that's one reason for CISPA. Another might just be to encourage private companies to share more information about network attacks; the supporters of this bill are not wrong that private companies are loathe to do that now for a variety of reasons. But again, ultimately, I agree with you. I don't support CISPA.
  - Natsu 14y ago
    > I've been informed since I started reading and discussing CISPA that a primary purpose of this bill is actually the opposite of what people are worried about: that instead of getting private companies to share with the government, CISPA exists largely to provide a legal framework for the government to share information with private companies, so that when government systems are hit with new (say) Microsoft Office malware and "spear phishing" attacks, they can notify stakeholders in private industry. I honestly wouldn't have a problem with that (who would?), but I have to wonder exactly what sort of legal problems they were having in doing this and why they couldn't create private agreements allowing that?
    - tptacek 14y ago