4 ms·

Thanks for taking the time to provide some excellent responses. I don't mean to insult your patience, but I don't think I could say it any better than chernevik

Thanks for taking the time to provide some excellent responses. I don't mean to insult your patience, but I don't think I could say it any better than chernevik did http://news.ycombinator.com/item?id=3939974 http://news.ycombinator.com/item?id=3939974. He really got down to my issues with this bill. * There doesn't seem to be a need for it. Was there a situation where justice was not served but would have been/ could be after CISPA? * I just don't trust it, no matter how harmless it currently is. There is a term for this type of legislative process, not quite slippery slope, but it escapes me at the moment.

redthrowaway 14y ago
> There is a term for this type of legislative process In sales and negotiation circles, it's known as the foot-in-the-door technique: http://en.wikipedia.org/wiki/Foot-in-the-door_technique http://en.wikipedia.org/wiki/Foot-in-the-door_technique
tptacek 14y ago
I agree with both of these issues. Not only do I not see a need for CISPA, but further, I don't think CISPA does anything; the sharing authority CISPA grants private companies, I believe those companies already had under ECPA. I've been informed since I started reading and discussing CISPA that a primary purpose of this bill is actually the opposite of what people are worried about: that instead of getting private companies to share with the government, CISPA exists largely to provide a legal framework for the government to share information with private companies, so that when government systems are hit with new (say) Microsoft Office malware and "spear phishing" attacks, they can notify stakeholders in private industry. So that's one reason for CISPA. Another might just be to encourage private companies to share more information about network attacks; the supporters of this bill are not wrong that private companies are loathe to do that now for a variety of reasons. But again, ultimately, I agree with you. I don't support CISPA.
- Natsu 14y ago
  > I've been informed since I started reading and discussing CISPA that a primary purpose of this bill is actually the opposite of what people are worried about: that instead of getting private companies to share with the government, CISPA exists largely to provide a legal framework for the government to share information with private companies, so that when government systems are hit with new (say) Microsoft Office malware and "spear phishing" attacks, they can notify stakeholders in private industry. I honestly wouldn't have a problem with that (who would?), but I have to wonder exactly what sort of legal problems they were having in doing this and why they couldn't create private agreements allowing that?
  - tptacek 14y ago
    It's possible (I don't know) that there's no way to get sensitive information about computer network attacks out of DHS, DOJ, CIA and NSA without some kind of legislative provision, especially if the government wants to be choosy about who gets it; all this stuff covers "selective disclosure", which, like it or not, is the only kind of disclosure there is going to be for a lot of these attacks.

redthrowaway 14y ago

> There is a term for this type of legislative process In sales and negotiation circles, it's known as the foot-in-the-door technique: http://en.wikipedia.org/wiki/Foot-in-the-door_technique http://en.wikipedia.org/wiki/Foot-in-the-door_technique

tptacek 14y ago

I agree with both of these issues. Not only do I not see a need for CISPA, but further, I don't think CISPA does anything; the sharing authority CISPA grants private companies, I believe those companies already had under ECPA. I've been informed since I started reading and discussing CISPA that a primary purpose of this bill is actually the opposite of what people are worried about: that instead of getting private companies to share with the government, CISPA exists largely to provide a legal framework for the government to share information with private companies, so that when government systems are hit with new (say) Microsoft Office malware and "spear phishing" attacks, they can notify stakeholders in private industry. So that's one reason for CISPA. Another might just be to encourage private companies to share more information about network attacks; the supporters of this bill are not wrong that private companies are loathe to do that now for a variety of reasons. But again, ultimately, I agree with you. I don't support CISPA.

Natsu 14y ago
> I've been informed since I started reading and discussing CISPA that a primary purpose of this bill is actually the opposite of what people are worried about: that instead of getting private companies to share with the government, CISPA exists largely to provide a legal framework for the government to share information with private companies, so that when government systems are hit with new (say) Microsoft Office malware and "spear phishing" attacks, they can notify stakeholders in private industry. I honestly wouldn't have a problem with that (who would?), but I have to wonder exactly what sort of legal problems they were having in doing this and why they couldn't create private agreements allowing that?
- tptacek 14y ago
  It's possible (I don't know) that there's no way to get sensitive information about computer network attacks out of DHS, DOJ, CIA and NSA without some kind of legislative provision, especially if the government wants to be choosy about who gets it; all this stuff covers "selective disclosure", which, like it or not, is the only kind of disclosure there is going to be for a lot of these attacks.