6 ms·

What you say is misleading. You say "allow them to share," when you should say "immunity from prosecution related to damages resulting from them sharing." Basi

What you say is misleading. You say "allow them to share," when you should say "immunity from prosecution related to damages resulting from them sharing." Basically, it's open season on surveillance because now companies aren't liable if requests are followed in "good faith," which essentially means "we did whatever the government wanted."

tptacek 14y ago
I'm not sure how anything you said contradicts anything I said. Service providers are, by the way, not immunized from civil suits if they share information not incident to an actual attack.
- icebraining 14y ago
  And how are the affected people to know that such information has been shared, if you can't even make a FOIA request?
  - tptacek 14y ago
    Any bill that ever allows private companies to share information with the USG is going to include a FOIA exemption, because the alternative is that no private company's management team would ever allow information to be shared under any circumstance, as it could allow the public access to trade secrets, contractually confidential information, and market intelligence.
    - icebraining 14y ago
      Ok, but you haven't answered my question.
      - tptacek 14y ago
        I think my answer is they probably won't know. The purpose of the bill is to allow sharing of operational data about network security attacks. The bill isn't intended to allow private companies to share your Facebook profile or email. I guess you could argue that malware often uses mail to spread, and that a social media provider might dragnet a whole bunch of email spools to collect malware samples and then forklift it to LEOs for investigation. That would be bad. The bill takes some small steps to keep that from happening, but probably not enough.
- homosaur 14y ago
  Anything can be roped into "actual attack." Remember the actual language of the bill, since you read it: "theft of intellectual property." What the hell does that mean? Of course there is no oversight aside from the people who are making requests, so the idea that a company would actually be penalized for releasing info "unreleated to cyberthreats" is laughable at best.
  - tptacek 14y ago
    Like I said upthread, CISPA goes further in trying to actually define what a "cyberattack" is than any other bill I've read. How would you modify the definitions in the bill?
    - homosaur 14y ago
      You and I have discussed DHS related things before, and I think we simply have differing views on this entire thing. I simply don't want any more power going to the most demonstrably incompetent branch of government in the history of the US (including, of course, everything historically that came out of the 1947 act that this is a rider to). I do agree with you that the definitions of cybercrime and attacks in CISPA would be a start for the framework for coherent legislation. I just don't think that DHS should continue to be added onto piecemeal until they control 100% of all law enforcement activities as well, since let's face it, that's the eventual goal.
  - lawnchair_larry 14y ago
    To add, it doesn't even say "actual attack", it basically says anything related to security and "acting in good faith."
    - tptacek 14y ago
      I agree that "good faith" is crappy language.
- lawnchair_larry 14y ago
  And here is the main problem with the bill. "Not incident to an actual attack" is not reflective of the language used. It's so vauge that you could drive a truck through it. Or, a $2+ billion Utah datacenter, for instance.
  - tptacek 14y ago
    The statutory "good faith" language is a problem, in that "good faith" isn't well defined anywhere. But what are the additional changes you'd make to the liability exemption to tighten it up?
    - lawnchair_larry 14y ago
      The wildcards (such as "good faith", but there are others) are non-starters. You don't even need to reason about the finer points of the bill with that in there. But ideally? I don't want anybody to share any information of mine to any third party, without my consent, at any time. I'm having trouble thinking of why that would be necessary. I'm willing to entertain reasonable arguments as to why it might be necessary, and may make some compromises (without wildcard language) in light of a compelling argument, but nobody sponsoring CISPA has even made an attempt to do that.
      - tptacek 14y ago
        Sure. Here are two examples. 1. You're a web app company that routinely comes under DDOS attacks. A private security company would like you to subscribe and push Netflow traces to them during attacks, so they can derive minimal ACLs and relay them to ISPs so the attack could be filtered upstream. That Netflow data could in theory contain some of your traffic, and further could be statistically de-anonymized to reveal your personal usage of that service. Currently, you need authorization from your counsel every time you share that Netflow data; post-CISPA, you could get a one-time authorization and automatically push Netflow to the anti-DDOS provider. 2. You're working with several social networking companies to track down a browser malware attack that transmit itself through online messages. You'd like to collect a large volume of samples programmatically to share with other providers and LEOs, but you're extremely concerned that in doing so you might reveal details about private messages, perhaps even by sharing which users have messaging relationships with other users. Pre-CISPA, your counsel might refuse that sharing outright; post-CISPA, you'd have statutory protections for sharing that operational data in the course of responding to malware.

tptacek 14y ago

I'm not sure how anything you said contradicts anything I said. Service providers are, by the way, not immunized from civil suits if they share information not incident to an actual attack.

icebraining 14y ago
And how are the affected people to know that such information has been shared, if you can't even make a FOIA request?
- tptacek 14y ago
  Any bill that ever allows private companies to share information with the USG is going to include a FOIA exemption, because the alternative is that no private company's management team would ever allow information to be shared under any circumstance, as it could allow the public access to trade secrets, contractually confidential information, and market intelligence.
  - icebraining 14y ago
    Ok, but you haven't answered my question.
    - tptacek 14y ago
      I think my answer is they probably won't know. The purpose of the bill is to allow sharing of operational data about network security attacks. The bill isn't intended to allow private companies to share your Facebook profile or email. I guess you could argue that malware often uses mail to spread, and that a social media provider might dragnet a whole bunch of email spools to collect malware samples and then forklift it to LEOs for investigation. That would be bad. The bill takes some small steps to keep that from happening, but probably not enough.
homosaur 14y ago
Anything can be roped into "actual attack." Remember the actual language of the bill, since you read it: "theft of intellectual property." What the hell does that mean? Of course there is no oversight aside from the people who are making requests, so the idea that a company would actually be penalized for releasing info "unreleated to cyberthreats" is laughable at best.
- tptacek 14y ago
  Like I said upthread, CISPA goes further in trying to actually define what a "cyberattack" is than any other bill I've read. How would you modify the definitions in the bill?
  - homosaur 14y ago
    You and I have discussed DHS related things before, and I think we simply have differing views on this entire thing. I simply don't want any more power going to the most demonstrably incompetent branch of government in the history of the US (including, of course, everything historically that came out of the 1947 act that this is a rider to). I do agree with you that the definitions of cybercrime and attacks in CISPA would be a start for the framework for coherent legislation. I just don't think that DHS should continue to be added onto piecemeal until they control 100% of all law enforcement activities as well, since let's face it, that's the eventual goal.
- lawnchair_larry 14y ago
  To add, it doesn't even say "actual attack", it basically says anything related to security and "acting in good faith."
  - tptacek 14y ago
    I agree that "good faith" is crappy language.
lawnchair_larry 14y ago
And here is the main problem with the bill. "Not incident to an actual attack" is not reflective of the language used. It's so vauge that you could drive a truck through it. Or, a $2+ billion Utah datacenter, for instance.
- tptacek 14y ago
  The statutory "good faith" language is a problem, in that "good faith" isn't well defined anywhere. But what are the additional changes you'd make to the liability exemption to tighten it up?
  - lawnchair_larry 14y ago
    The wildcards (such as "good faith", but there are others) are non-starters. You don't even need to reason about the finer points of the bill with that in there. But ideally? I don't want anybody to share any information of mine to any third party, without my consent, at any time. I'm having trouble thinking of why that would be necessary. I'm willing to entertain reasonable arguments as to why it might be necessary, and may make some compromises (without wildcard language) in light of a compelling argument, but nobody sponsoring CISPA has even made an attempt to do that.
    - tptacek 14y ago
      Sure. Here are two examples. 1. You're a web app company that routinely comes under DDOS attacks. A private security company would like you to subscribe and push Netflow traces to them during attacks, so they can derive minimal ACLs and relay them to ISPs so the attack could be filtered upstream. That Netflow data could in theory contain some of your traffic, and further could be statistically de-anonymized to reveal your personal usage of that service. Currently, you need authorization from your counsel every time you share that Netflow data; post-CISPA, you could get a one-time authorization and automatically push Netflow to the anti-DDOS provider. 2. You're working with several social networking companies to track down a browser malware attack that transmit itself through online messages. You'd like to collect a large volume of samples programmatically to share with other providers and LEOs, but you're extremely concerned that in doing so you might reveal details about private messages, perhaps even by sharing which users have messaging relationships with other users. Pre-CISPA, your counsel might refuse that sharing outright; post-CISPA, you'd have statutory protections for sharing that operational data in the course of responding to malware.