7 ms·

It's official: CISPA is back

222 points by zizee 14y ago

zizee 14y ago
Received this message from the Internet Defence League a short while ago: FWD---------------- Dear Internet Defense League member, Last year, right on the heels of our historic victory against SOPA, a piece of really nasty legislation almost passed that would have radically undermined online privacy. It was called CISPA. And it raced through the US House of Representatives, passing before any of us had a chance to react. We stalled the bill in the Senate, but now CISPA is back, and we don't want to make the same mistake twice. Before there is any movement on the bill, we want to send a strong message to Congress that CISPA shouldn't pass. That's why we're partnering with the Electronic Frontier Foundation to launch an Internet Defense League action starting tomorrow, Tuesday March 19th. Can you participate? If so, get the code for your site here: http://members.internetdefenseleague.org http://members.internetdefenseleague.org And help get more people signed up by sharing this page with your social network. Wait, what is CISPA? And why does it matter so much? CISPA (the Cyber Intelligence Sharing and Protection Act) would give companies complete freedom to share your personal data with the US government. It doesn't require them to do so, but if the government asked it would be hard to say no, and they'd have no reason to-- CISPA would free them from any promises made to customers in public statements or privacy policies. Your emails, your Facebook account, your bank statements, the websites you visit, your real-time location (courtesy of your cellphone company)-- all of it could soon belong to a slew of government agencies and even local police, who could use it against you without a warrant. Get the code: http://members.internetdefenseleague.org http://members.internetdefenseleague.org The IDL action will display only tomorrow. The banner looks like this: http://i.imgur.com/mVG9kVX.png http://i.imgur.com/mVG9kVX.png The modal looks like this: http://i.imgur.com/tCOtoEC.png http://i.imgur.com/tCOtoEC.png And they both link to this action page hosted by the EFF: https://action.eff.org/o/9042/p/dia/action/public/?action_KEY=9048 https://action.eff.org/o/9042/p/dia/action/public/?action_KE... Please spread the word. Thanks! Sincerely, Holmes Wilson - Internet Defense League P.S. If you'd like to learn more about CISPA, the EFF has a great FAQ page here: https://www.eff.org/cybersecurity-bill-faq https://www.eff.org/cybersecurity-bill-faq
- GHFigs 14y ago
  If you'd like to learn more about CISPA, the EFF has a great FAQ page Why wouldn't you read the bill yourself?
  - saraid216 14y ago
    You have my magnanimous permission to do both. Go ahead.
    - GHFigs 14y ago
      1.) I have never needed or sought your permission. 2.) If an "Internet Defense League" member wished--with your permission, of course--to read the text of the bill he's been asked to oppose and promote opposition to, this email offers no assistance. In polite terms, I think this is an oversight.
  - zizee 14y ago
    I believe this link will give you the text of the bill: http://www.govtrack.us/congress/bills/113/hr624/text http://www.govtrack.us/congress/bills/113/hr624/text
    - GHFigs 14y ago
      Curiously, no such link appears in the "Internet Defense League" email, the submitted link, the EFF's FAQ, or the EFF's action page.
  - iamjustin 14y ago
    Have you seen the text of the bill? Maybe there are some people that would rather read a summary of what the bill would actually do, rather than have to decipher it themselves.
tptacek 14y ago
According to this site, CISPA would "end" online privacy; it urges you to send letters to Congress saying "this bill would have given federal agencies unlimited access to virtually any of my personal data and online communication-- without a warrant." But of course, CISPA does nothing of the sort. It is: * An opt-in measure that can't be forced on a private company by the government * Restricted to "cyber threat information", a term carefully (relative to any other online legislation) defined to apply only to attacks on the confidentiality/integrity/availability of systems and applications * Specifically restricted from applying to Aaron Swartz-style ToS violations, or, for that matter, to intellectual property misappropriation * Written to exclude "individuals" from "protected entities" to avoid any reading that would permit ISPs to use it to hand over records for individual targeted customers And, while it exempts private companies from suits for good-faith attack data sharing (that is the point of the measure), it deliberately makes the government liable for any damages from misuse of shared information. As Declan McCullagh pointed out in another thread here recently, private companies operate under a bewildering stack of regulations that make it legally dicey to share even innocuous data during attacks. In addition to ECPA and SCA, the two omnibus federal electronic privacy laws, there are a number of domain-specific laws ranging from HIPAA for medical privacy to DPPA for drivers records. Companies who handle protected data currently either don't share attack data, or incur legal risks when they do, or incur legal expenses when they have their sharing practices reviewed. CISPA is a straightforward (and short) bill that attempts to remedy that problem. I don't support it (I don't think it will do much to help), but it's not evil, and organizations that try to fundraise off the idea that it is are playing games with your attention.
- zizee 14y ago
  organizations that try to fundraise off the idea that it is are playing games with your attention Are you saying that the Internet Defence League (http://internetdefenseleague.org/ http://internetdefenseleague.org/) is deliberately misrepresenting this issue? (not trolling, honest question)
  - tptacek 14y ago
    I think there are multiple points in the "CISPAISBACK.ORG" site that are misleading, and from what I understand of the bill (having read multiple drafts and also survived approximately 900 different HN debates on it), the infographic at the bottom of the page that purports to explain the bill language is in some ways directly false: * The bill does not cover "intellectual property" * The bill does not pertain to Photoshop and Nickelback albums * The bill does not give you no legal recourse if your information is abused; you can sue the government, under liability established explicitly in CISPA * The bill has nothing whatsoever to do with the objectives of SOPA
ancarda 14y ago
How am I not surprised Facebook and Microsoft are on that list. Two companies I trust SO much with my privacy.
deleted 14y ago
[deleted]
hkmurakami 14y ago
Here's what dismays me about this. We killed it once. It's back again. Let's say it's bad and we want to kill it, and we succeed again. What's to say it won't come back again? How long do we have to keep doing this dance? Even if it is worth killing every time, will our attention spans be long enough to keep fighting it every single time for the decades that may still come?
- zizee 14y ago
  "The price of liberty is eternal vigilance." -unknown.
  - harshreality 14y ago
    That's a slightly modified form of the "eternal vigilance" quote by http://en.wikipedia.org/wiki/John_Philpot_Curran http://en.wikipedia.org/wiki/John_Philpot_Curran
    - zizee 14y ago
      a slightly modified form More like a TL;DR version of it :-) The full quote from John Philpot Curran is: It is the common fate of the indolent to see their rights become a prey to the active. The condition upon which God hath given liberty to man is eternal vigilance; which condition if he break, servitude is at once the consequence of his crime and the punishment of his guilt. The new (shortened) "version" is somewhat more pithy, and far more easy to distribute. So maybe someone other that Curran deserves some of the credit. I wrote "unknown" as the quote is often mis/attributed to Thomas Jefferson, but the evidence is not strong here.
- TruthElixirX 14y ago
  Yay. You understand why this whole process is futile. This bill isn't the problem. This bill is a symptom of the problem. The problem is not going away. The problem is the U.S. federal government. It is an out of control machine of death seeking to criminalize as much behavior as possible. The U.S. has the highest incarceration rate. They have the most weapons. This kind of thing will not end until the government collapses in on itself or people have an entire paradigm shift in the way that they think of their relation to their fellow person.
ehm_may 14y ago
I actually wrote a blog post on CISPA a while back. http://michaelmay.me/2013/02/17/wtf-is-cispa http://michaelmay.me/2013/02/17/wtf-is-cispa I'm not worried about it. However, I may not be entirely correct in my analysis. Would be interested in feedback.
bitgangsta 14y ago
We worked with Change.org & Twilio to build this petition tool on CISPA, it's the second-largest with over 43k signatures. http://cispapetition.org http://cispapetition.org
squozzer 14y ago
<fact> I went ahead and signed the petition. </fact> <opinion> The comments I've read so far seem pretty thoughtful both pro and con. And for the most part, the US government acts in good faith. BUT, on occasion we find ourselves looking pretty foolish when we believe uncritically what a government says (Iraq war) or horrified at what seems to be gratuitous heavy-handedness on the government's part (Swartz.) And despite what former Secretary Clinton would like you to believe, there is no reset button on government legitimacy. Like an individual's reputation, it takes years to restore what was eroded in hours. And while cyber attacks seem to represent a threat best countered by an organization that commands resources on a national scale, can we really trust them to do the right thing? Hell, they put a PFC in a position to disseminate State Department messages. Anyone who's done a stint in the Army knows not to put a PFC in charge of anything except maybe a trigger, and even then under the guidance of an NCO. </opinion> <speculation> I forward the hypothesis that the government has more interest in tracking (untaxed) financial transactions than thwarting cyber attacks. The government's ability to fund itself has come to rely heavily on the Fed buying US debt, which some might call "printing money". The longer that continues, the less credible the US dollar becomes in world finance. The only thing keeping the dollar afloat is the rather poor state of the euro and yen, and the world's reluctance to trust China or Russia. So the US is going fishing for sources of loot. If the hypothesis is true, CISPA might be a godsend to Joe Six-Pack, or at least better than what's happening in Cyprus. But in the end I think we'll get CISPA and Cyprus. </speculation>

222 points by zizee 14y ago

zizee 14y ago

Received this message from the Internet Defence League a short while ago: FWD---------------- Dear Internet Defense League member, Last year, right on the heels of our historic victory against SOPA, a piece of really nasty legislation almost passed that would have radically undermined online privacy. It was called CISPA. And it raced through the US House of Representatives, passing before any of us had a chance to react. We stalled the bill in the Senate, but now CISPA is back, and we don't want to make the same mistake twice. Before there is any movement on the bill, we want to send a strong message to Congress that CISPA shouldn't pass. That's why we're partnering with the Electronic Frontier Foundation to launch an Internet Defense League action starting tomorrow, Tuesday March 19th. Can you participate? If so, get the code for your site here: http://members.internetdefenseleague.org http://members.internetdefenseleague.org And help get more people signed up by sharing this page with your social network. Wait, what is CISPA? And why does it matter so much? CISPA (the Cyber Intelligence Sharing and Protection Act) would give companies complete freedom to share your personal data with the US government. It doesn't require them to do so, but if the government asked it would be hard to say no, and they'd have no reason to-- CISPA would free them from any promises made to customers in public statements or privacy policies. Your emails, your Facebook account, your bank statements, the websites you visit, your real-time location (courtesy of your cellphone company)-- all of it could soon belong to a slew of government agencies and even local police, who could use it against you without a warrant. Get the code: http://members.internetdefenseleague.org http://members.internetdefenseleague.org The IDL action will display only tomorrow. The banner looks like this: http://i.imgur.com/mVG9kVX.png http://i.imgur.com/mVG9kVX.png The modal looks like this: http://i.imgur.com/tCOtoEC.png http://i.imgur.com/tCOtoEC.png And they both link to this action page hosted by the EFF: https://action.eff.org/o/9042/p/dia/action/public/?action_KEY=9048 https://action.eff.org/o/9042/p/dia/action/public/?action_KE... Please spread the word. Thanks! Sincerely, Holmes Wilson - Internet Defense League P.S. If you'd like to learn more about CISPA, the EFF has a great FAQ page here: https://www.eff.org/cybersecurity-bill-faq https://www.eff.org/cybersecurity-bill-faq

GHFigs 14y ago
If you'd like to learn more about CISPA, the EFF has a great FAQ page Why wouldn't you read the bill yourself?
- saraid216 14y ago
  You have my magnanimous permission to do both. Go ahead.
  - GHFigs 14y ago
    1.) I have never needed or sought your permission. 2.) If an "Internet Defense League" member wished--with your permission, of course--to read the text of the bill he's been asked to oppose and promote opposition to, this email offers no assistance. In polite terms, I think this is an oversight.
- zizee 14y ago
  I believe this link will give you the text of the bill: http://www.govtrack.us/congress/bills/113/hr624/text http://www.govtrack.us/congress/bills/113/hr624/text
  - GHFigs 14y ago
    Curiously, no such link appears in the "Internet Defense League" email, the submitted link, the EFF's FAQ, or the EFF's action page.
- iamjustin 14y ago
  Have you seen the text of the bill? Maybe there are some people that would rather read a summary of what the bill would actually do, rather than have to decipher it themselves.

tptacek 14y ago

According to this site, CISPA would "end" online privacy; it urges you to send letters to Congress saying "this bill would have given federal agencies unlimited access to virtually any of my personal data and online communication-- without a warrant." But of course, CISPA does nothing of the sort. It is: * An opt-in measure that can't be forced on a private company by the government * Restricted to "cyber threat information", a term carefully (relative to any other online legislation) defined to apply only to attacks on the confidentiality/integrity/availability of systems and applications * Specifically restricted from applying to Aaron Swartz-style ToS violations, or, for that matter, to intellectual property misappropriation * Written to exclude "individuals" from "protected entities" to avoid any reading that would permit ISPs to use it to hand over records for individual targeted customers And, while it exempts private companies from suits for good-faith attack data sharing (that is the point of the measure), it deliberately makes the government liable for any damages from misuse of shared information. As Declan McCullagh pointed out in another thread here recently, private companies operate under a bewildering stack of regulations that make it legally dicey to share even innocuous data during attacks. In addition to ECPA and SCA, the two omnibus federal electronic privacy laws, there are a number of domain-specific laws ranging from HIPAA for medical privacy to DPPA for drivers records. Companies who handle protected data currently either don't share attack data, or incur legal risks when they do, or incur legal expenses when they have their sharing practices reviewed. CISPA is a straightforward (and short) bill that attempts to remedy that problem. I don't support it (I don't think it will do much to help), but it's not evil, and organizations that try to fundraise off the idea that it is are playing games with your attention.

zizee 14y ago
organizations that try to fundraise off the idea that it is are playing games with your attention Are you saying that the Internet Defence League (http://internetdefenseleague.org/ http://internetdefenseleague.org/) is deliberately misrepresenting this issue? (not trolling, honest question)
- tptacek 14y ago
  I think there are multiple points in the "CISPAISBACK.ORG" site that are misleading, and from what I understand of the bill (having read multiple drafts and also survived approximately 900 different HN debates on it), the infographic at the bottom of the page that purports to explain the bill language is in some ways directly false: * The bill does not cover "intellectual property" * The bill does not pertain to Photoshop and Nickelback albums * The bill does not give you no legal recourse if your information is abused; you can sue the government, under liability established explicitly in CISPA * The bill has nothing whatsoever to do with the objectives of SOPA

ancarda 14y ago

How am I not surprised Facebook and Microsoft are on that list. Two companies I trust SO much with my privacy.

deleted 14y ago

[deleted]

hkmurakami 14y ago

Here's what dismays me about this. We killed it once. It's back again. Let's say it's bad and we want to kill it, and we succeed again. What's to say it won't come back again? How long do we have to keep doing this dance? Even if it is worth killing every time, will our attention spans be long enough to keep fighting it every single time for the decades that may still come?

zizee 14y ago
"The price of liberty is eternal vigilance." -unknown.
- harshreality 14y ago
  That's a slightly modified form of the "eternal vigilance" quote by http://en.wikipedia.org/wiki/John_Philpot_Curran http://en.wikipedia.org/wiki/John_Philpot_Curran
  - zizee 14y ago
    a slightly modified form More like a TL;DR version of it :-) The full quote from John Philpot Curran is: It is the common fate of the indolent to see their rights become a prey to the active. The condition upon which God hath given liberty to man is eternal vigilance; which condition if he break, servitude is at once the consequence of his crime and the punishment of his guilt. The new (shortened) "version" is somewhat more pithy, and far more easy to distribute. So maybe someone other that Curran deserves some of the credit. I wrote "unknown" as the quote is often mis/attributed to Thomas Jefferson, but the evidence is not strong here.
TruthElixirX 14y ago
Yay. You understand why this whole process is futile. This bill isn't the problem. This bill is a symptom of the problem. The problem is not going away. The problem is the U.S. federal government. It is an out of control machine of death seeking to criminalize as much behavior as possible. The U.S. has the highest incarceration rate. They have the most weapons. This kind of thing will not end until the government collapses in on itself or people have an entire paradigm shift in the way that they think of their relation to their fellow person.

ehm_may 14y ago

I actually wrote a blog post on CISPA a while back. http://michaelmay.me/2013/02/17/wtf-is-cispa http://michaelmay.me/2013/02/17/wtf-is-cispa I'm not worried about it. However, I may not be entirely correct in my analysis. Would be interested in feedback.

bitgangsta 14y ago

We worked with Change.org & Twilio to build this petition tool on CISPA, it's the second-largest with over 43k signatures. http://cispapetition.org http://cispapetition.org

squozzer 14y ago

<fact> I went ahead and signed the petition. </fact> <opinion> The comments I've read so far seem pretty thoughtful both pro and con. And for the most part, the US government acts in good faith. BUT, on occasion we find ourselves looking pretty foolish when we believe uncritically what a government says (Iraq war) or horrified at what seems to be gratuitous heavy-handedness on the government's part (Swartz.) And despite what former Secretary Clinton would like you to believe, there is no reset button on government legitimacy. Like an individual's reputation, it takes years to restore what was eroded in hours. And while cyber attacks seem to represent a threat best countered by an organization that commands resources on a national scale, can we really trust them to do the right thing? Hell, they put a PFC in a position to disseminate State Department messages. Anyone who's done a stint in the Army knows not to put a PFC in charge of anything except maybe a trigger, and even then under the guidance of an NCO. </opinion> <speculation> I forward the hypothesis that the government has more interest in tracking (untaxed) financial transactions than thwarting cyber attacks. The government's ability to fund itself has come to rely heavily on the Fed buying US debt, which some might call "printing money". The longer that continues, the less credible the US dollar becomes in world finance. The only thing keeping the dollar afloat is the rather poor state of the euro and yen, and the world's reluctance to trust China or Russia. So the US is going fishing for sources of loot. If the hypothesis is true, CISPA might be a godsend to Joe Six-Pack, or at least better than what's happening in Cyprus. But in the end I think we'll get CISPA and Cyprus. </speculation>