4 ms·

Could somebody give an argument (or link to an argument) for why CISPA shouldn't be passed?

by pfraze 14y ago

spiek 14y ago
Here's the EFF's FAQ on it: https://www.eff.org/cybersecurity-bill-faq https://www.eff.org/cybersecurity-bill-faq
- u2328 14y ago
  This is one of the most concerning issues to me from that FAQ: Q: Can a company hack a perceived threat under CISPA ("hack back")? A: CISPA provides companies with immunity "for decisions made based on cyber threat information" as long as they are acting in good faith. But CISPA doesn’t define “decisions made.” Aggressive companies could interpret this immunity to cover "defensive"—and what some would consider offensive—countermeasures like DDOSing suspected intruders, third parties, or even innocent users. Private defense contractors have already advocated for this power. These actions should not be allowed by such expansive wording. It leaves the bill ripe for abuse. So, corporations can effectively DDoS other servers now, without legal repercussion, as long as it was in 'good faith'. How does one evaluate 'good faith' in a court room? If I'm a small company with a website, and some major corporation attacks me and knocks my site offline because the attacker who attacked them spoofed the IP address with my website's address, are they off the hook because their attack was in 'good faith'? To me, I get the feeling that CISPA is about more than violating privacy (although it does that in spades), but also legitimatizing the militarization of the Internet.
  - tptacek 14y ago
    I don't know what to think about the "hack-back" controversy. On the one hand, the idea that there could ever be federal authorization for "hacking back" at any target is preposterous. The result would be chaos. Attackers would almost certainly invest effort in tricking the service providers dumb enough to do it into striking innocent networks, or, better yet, into striking out at other providers who themselves would launch "hack-back" efforts --- you know, this is starting to sound awesome --- and in reality no company with a lawyer on staff, retainer, or in the phone book would ever allow their team to do such a thing, CISPA or no CISPA. On the other hand, if just one company is dumb enough to misread the law as providing authorization and tort immunity from running attack code on their imagined attackers, that's probably a very good reason to amend the bill.
ihsw 14y ago
The collusion between governments and corporations becomes tied even more inexorably at their brains as well as their coffers.
sehugg 14y ago
One thing that does not seem to be often discussed is that CISPA data can be used to investigate and prosecute crimes. Specifically, crimes involving harm to minors or serious bodily harm. No one likes to see adults or minors injured, but this inclusion is at odds with proponents' claim that it CISPA is only "for cybersecurity purposes". Even the House Committee on Intelligence's own FAQ seems to contradict the bill's text in its first entry: http://intelligence.house.gov/sites/intelligence.house.gov/files/images/041613cispamythfact.pdf http://intelligence.house.gov/sites/intelligence.house.gov/f... "Serious bodily harm" isn't a term which just covers terrorist acts; it covers things like automobile accidents. One wonders if data collected under CISPA could be used to find and prosecute drunk drivers in a National Park -- hey, it prevents serious bodily harm and it's on Federal property, right? Other claims that the bill's language is too broad and needs more work: http://www.legislationandpolicy.com/747/cispa-and-the-need-to-increase-cyber-security-without-infringing-on-personal-privacy/ http://www.legislationandpolicy.com/747/cispa-and-the-need-t... http://www.whitehouse.gov/sites/default/files/omb/legislative/sap/113/saphr624r_20130416.pdf http://www.whitehouse.gov/sites/default/files/omb/legislativ...
- lawnchair_larry 14y ago
  Talking about protecting minors is usually a good thing to thrown into a dirty bill that can't stand on it's own, as a weak appeal to emotion. Sadly, it works.

Could somebody give an argument (or link to an argument) for why CISPA shouldn't be passed?

by pfraze 14y ago

Could somebody give an argument (or link to an argument) for why CISPA shouldn't be passed?

spiek 14y ago

Here's the EFF's FAQ on it: https://www.eff.org/cybersecurity-bill-faq https://www.eff.org/cybersecurity-bill-faq

u2328 14y ago
This is one of the most concerning issues to me from that FAQ: Q: Can a company hack a perceived threat under CISPA ("hack back")? A: CISPA provides companies with immunity "for decisions made based on cyber threat information" as long as they are acting in good faith. But CISPA doesn’t define “decisions made.” Aggressive companies could interpret this immunity to cover "defensive"—and what some would consider offensive—countermeasures like DDOSing suspected intruders, third parties, or even innocent users. Private defense contractors have already advocated for this power. These actions should not be allowed by such expansive wording. It leaves the bill ripe for abuse. So, corporations can effectively DDoS other servers now, without legal repercussion, as long as it was in 'good faith'. How does one evaluate 'good faith' in a court room? If I'm a small company with a website, and some major corporation attacks me and knocks my site offline because the attacker who attacked them spoofed the IP address with my website's address, are they off the hook because their attack was in 'good faith'? To me, I get the feeling that CISPA is about more than violating privacy (although it does that in spades), but also legitimatizing the militarization of the Internet.
- tptacek 14y ago
  I don't know what to think about the "hack-back" controversy. On the one hand, the idea that there could ever be federal authorization for "hacking back" at any target is preposterous. The result would be chaos. Attackers would almost certainly invest effort in tricking the service providers dumb enough to do it into striking innocent networks, or, better yet, into striking out at other providers who themselves would launch "hack-back" efforts --- you know, this is starting to sound awesome --- and in reality no company with a lawyer on staff, retainer, or in the phone book would ever allow their team to do such a thing, CISPA or no CISPA. On the other hand, if just one company is dumb enough to misread the law as providing authorization and tort immunity from running attack code on their imagined attackers, that's probably a very good reason to amend the bill.

ihsw 14y ago

The collusion between governments and corporations becomes tied even more inexorably at their brains as well as their coffers.

sehugg 14y ago

One thing that does not seem to be often discussed is that CISPA data can be used to investigate and prosecute crimes. Specifically, crimes involving harm to minors or serious bodily harm. No one likes to see adults or minors injured, but this inclusion is at odds with proponents' claim that it CISPA is only "for cybersecurity purposes". Even the House Committee on Intelligence's own FAQ seems to contradict the bill's text in its first entry: http://intelligence.house.gov/sites/intelligence.house.gov/files/images/041613cispamythfact.pdf http://intelligence.house.gov/sites/intelligence.house.gov/f... "Serious bodily harm" isn't a term which just covers terrorist acts; it covers things like automobile accidents. One wonders if data collected under CISPA could be used to find and prosecute drunk drivers in a National Park -- hey, it prevents serious bodily harm and it's on Federal property, right? Other claims that the bill's language is too broad and needs more work: http://www.legislationandpolicy.com/747/cispa-and-the-need-to-increase-cyber-security-without-infringing-on-personal-privacy/ http://www.legislationandpolicy.com/747/cispa-and-the-need-t... http://www.whitehouse.gov/sites/default/files/omb/legislative/sap/113/saphr624r_20130416.pdf http://www.whitehouse.gov/sites/default/files/omb/legislativ...

lawnchair_larry 14y ago
Talking about protecting minors is usually a good thing to thrown into a dirty bill that can't stand on it's own, as a weak appeal to emotion. Sadly, it works.