3 ms·
This bill is nothing like SOPA and whoever is campaigning on this basis is doing a massive disservice to themselves because people can tell the difference. CIS
by drucken 14y ago
This bill is nothing like SOPA and whoever is campaigning on this basis is doing a massive disservice to themselves because people can tell the difference.
CISPA is just a continuation of clear "wiretapping" landgrabs by the US Federal Government, in this case using the basis of "cybersecurity". The US government have been trying to do this for decades and they will almost certainly succeed, no matter the resistance.
What is new is that it seeks to indemnify specific third parties who wiretap or even hack on their behalf.
As for the current version of the bill (H.R.3523.RFS), apart from the obviously broad language, there is only one section, on the use of information, that I would be greatly concerned with if I were a US resident, Section 2.C.1 (specifically part A):
LIMITATION- The Federal Government may use cyber threat information shared with the Federal Government in accordance with subsection (b)--
`(A) for cybersecurity purposes;
`(B) for the investigation and prosecution of cybersecurity crimes;
`(C) for the protection of individuals from the danger of death or serious bodily harm and the investigation and prosecution of crimes involving such danger of death or serious bodily harm;
`(D) for the protection of minors from child pornography, any risk of sexual exploitation, and serious threats to the physical safety of such minor, including kidnapping and trafficking and the investigation and prosecution of crimes involving child pornography, any risk of sexual exploitation, and serious threats to the physical safety of minors, including kidnapping and trafficking, and any crime referred to in 2258A(a)(2) of title 18, United States Code; or
`(E) to protect the national security of the United States.
What does "(A)" mean and why is it present when both "(B)" and "(E)" are already present? Without further highly specific legal binding, "for cybersecurity purposes" is far too broad an entry for the use at which the information may be put!
- tptacek 14y agoExactly how would CISPA indemnify a company that hacked on its behalf? Obviously I'm asking because I think there is no way that it does.
- drucken 14y agoSection 2.B.1: SELF-PROTECTED ENTITIES- Notwithstanding any other provision of law, a self-protected entity may, for cybersecurity purposes-- (i) use cybersecurity systems to identify and obtain cyber threat information to protect the rights and property of such self-protected entity; and `(ii) share such cyber threat information with any other entity, including the Federal Government. Section 2.B.4: EXEMPTION FROM LIABILITY- No civil or criminal cause of action shall lie or be maintained in Federal or State court against a protected entity, self-protected entity, cybersecurity provider, or an officer, employee, or agent of a protected entity, self-protected entity, or cybersecurity provider, acting in good faith-- `(A) for using cybersecurity systems to identify or obtain cyber threat information or for sharing such information in accordance with this section; or `(B) for decisions made based on cyber threat information identified, obtained, or shared under this section. 1. The key phrase "Notwithstanding any other provision of law" allows those parts of the bill to ignore all other laws. 2. "EXEMPTION FROM LIABILITY" subsection could not be any more clear. 3. "use cybersecurity systems to identify and obtain cyber threat information" is such broad language as to mean almost anything, especially in context of software. But we're getting side-tracked, imo. At this point, I would not even try to prevent the US government getting whatever information it wanted, however it wanted - third party or not. The key is what they are allowed to do with it after they have it...
- tptacek 14y ago"Cybersecurity systems" are intrusion detection systems. It's a ludicrous misreading of the law to suggest that you can call a zero-day exploit a "cybersecurity system" that you've deployed "preemptively" against a threat. To see why, reframe: anybody running an exploit against any system could make that claim. It clearly does not mean that. The term is defined later in the bill.