5 ms·

tptacek: Thanks for the call-out in this thread! To continue our (I think) polite disagreement from before, I think your description is accurate in specifics bu

by declan 14y ago

tptacek: Thanks for the call-out in this thread! To continue our (I think) polite disagreement from before, I think your description is accurate in specifics but doesn't address the broader privacy and surveillance landscape. Remember the debate five years ago over retroactive immunity for the telecommunications companies that opened their networks to the NSA in violation of the law? By overriding every federal and state law on the books -- the wildcard approach -- CISPA encourages this kind of broad data hoovering for cybersecurity purposes. Defenders of CISPA claim "cybersecurity" purposes is narrowly defined; reasonable people may disagree. And I have yet to hear a good reason why a wildcard approach is necessary, when even CRS raises questions about unintended consequences. Also the recent EO accomplishes a lot in terms of info-sharing, and it's worth reading: http://www.whitehouse.gov/the-press-office/2013/02/12/executive-order-improving-critical-infrastructure-cybersecurity http://www.whitehouse.gov/the-press-office/2013/02/12/execut... That said, I agree that some advocacy groups may overstate the privacy concerns about CISPA. I think the charitable interpretation is that they're overly eager or misinformed, not that they're trying to profit off of misinformation. People do this sort of advocacy work out of their hearts, not because they're trying to get rich.* I extend the same charitable explanation to CISPA's drafters. * That's why people become entrepreneurs and try to get into YC! :) edit: FAQ link: http://news.cnet.com/8301-31921_3-57422693-281/how-cispa-would-affect-you-faq/ http://news.cnet.com/8301-31921_3-57422693-281/how-cispa-wou...

snowwrestler 14y ago
If not the wildcard approach, then what is the acceptable alternative? This is my biggest problem with the opposition to CISPA--they jumped straight to "kill the bill". The cynical take on that is that "do or die" campaigns are easier, more fun, and more lucrative to nonprofits than nuanced policy proposals.
- declan 14y ago
  There's nothing wrong with saying: "If this bill is bad, let's kill it." The proponents are free to fix it and try again. To answer your question more directly, if privacy law $i or $j or $k interferes with information sharing, then let's identify those privacy laws and have a discussion about how to amend them to allow information sharing in the case of an ACTUAL cyberattack. As anyone who's made a mistake with /bin/rm knows, wildcards can be dangerous and have unintended consequences. I haven't seen this argument answered directly, and I'd like to read a thoughtful response. More: http://news.cnet.com/8301-31921_3-57422693-281/how-cispa-would-affect-you-faq/ http://news.cnet.com/8301-31921_3-57422693-281/how-cispa-wou...
  - snowwrestler 14y ago
    It just seems to me that if "kill the bill" is the sole entirety of the message, then there is no way to move forward on the issue. Your 2nd paragraph makes a lot of sense, but as far as I know has not been offered or endorsed by any of the opposition groups. If I'm wrong please let me know.
tptacek 14y ago
It is interesting that you think it's a better idea to revisit and reweigh the privacy decisions of every privacy bill that could interfere with attack data sharing, so that we can relitigate the sensitivity of driver's records or patient health information, rather than simply crafting a measure that says "leave intact every privacy regulation on the books, don't crack open laws that settled policy disputes about privacy years or decades ago, and instead just do the commonsense thing and let IT people at companies share Netflow and botnet information."

by declan 14y ago

snowwrestler 14y ago

If not the wildcard approach, then what is the acceptable alternative? This is my biggest problem with the opposition to CISPA--they jumped straight to "kill the bill". The cynical take on that is that "do or die" campaigns are easier, more fun, and more lucrative to nonprofits than nuanced policy proposals.

declan 14y ago
There's nothing wrong with saying: "If this bill is bad, let's kill it." The proponents are free to fix it and try again. To answer your question more directly, if privacy law $i or $j or $k interferes with information sharing, then let's identify those privacy laws and have a discussion about how to amend them to allow information sharing in the case of an ACTUAL cyberattack. As anyone who's made a mistake with /bin/rm knows, wildcards can be dangerous and have unintended consequences. I haven't seen this argument answered directly, and I'd like to read a thoughtful response. More: http://news.cnet.com/8301-31921_3-57422693-281/how-cispa-would-affect-you-faq/ http://news.cnet.com/8301-31921_3-57422693-281/how-cispa-wou...
- snowwrestler 14y ago
  It just seems to me that if "kill the bill" is the sole entirety of the message, then there is no way to move forward on the issue. Your 2nd paragraph makes a lot of sense, but as far as I know has not been offered or endorsed by any of the opposition groups. If I'm wrong please let me know.

tptacek 14y ago

It is interesting that you think it's a better idea to revisit and reweigh the privacy decisions of every privacy bill that could interfere with attack data sharing, so that we can relitigate the sensitivity of driver's records or patient health information, rather than simply crafting a measure that says "leave intact every privacy regulation on the books, don't crack open laws that settled policy disputes about privacy years or decades ago, and instead just do the commonsense thing and let IT people at companies share Netflow and botnet information."