4 ms·

Here's the EFF's FAQ on it: https://www.eff.org/cybersecurity-bill-faq https://www.eff.org/cybersecurity-bill-faq

by spiek 13y ago

u2328 13y ago
This is one of the most concerning issues to me from that FAQ: Q: Can a company hack a perceived threat under CISPA ("hack back")? A: CISPA provides companies with immunity "for decisions made based on cyber threat information" as long as they are acting in good faith. But CISPA doesn’t define “decisions made.” Aggressive companies could interpret this immunity to cover "defensive"—and what some would consider offensive—countermeasures like DDOSing suspected intruders, third parties, or even innocent users. Private defense contractors have already advocated for this power. These actions should not be allowed by such expansive wording. It leaves the bill ripe for abuse. So, corporations can effectively DDoS other servers now, without legal repercussion, as long as it was in 'good faith'. How does one evaluate 'good faith' in a court room? If I'm a small company with a website, and some major corporation attacks me and knocks my site offline because the attacker who attacked them spoofed the IP address with my website's address, are they off the hook because their attack was in 'good faith'? To me, I get the feeling that CISPA is about more than violating privacy (although it does that in spades), but also legitimatizing the militarization of the Internet.
- tptacek 13y ago
  I don't know what to think about the "hack-back" controversy. On the one hand, the idea that there could ever be federal authorization for "hacking back" at any target is preposterous. The result would be chaos. Attackers would almost certainly invest effort in tricking the service providers dumb enough to do it into striking innocent networks, or, better yet, into striking out at other providers who themselves would launch "hack-back" efforts --- you know, this is starting to sound awesome --- and in reality no company with a lawyer on staff, retainer, or in the phone book would ever allow their team to do such a thing, CISPA or no CISPA. On the other hand, if just one company is dumb enough to misread the law as providing authorization and tort immunity from running attack code on their imagined attackers, that's probably a very good reason to amend the bill.

Here's the EFF's FAQ on it: https://www.eff.org/cybersecurity-bill-faq https://www.eff.org/cybersecurity-bill-faq

by spiek 13y ago

Here's the EFF's FAQ on it: https://www.eff.org/cybersecurity-bill-faq https://www.eff.org/cybersecurity-bill-faq

u2328 13y ago

This is one of the most concerning issues to me from that FAQ: Q: Can a company hack a perceived threat under CISPA ("hack back")? A: CISPA provides companies with immunity "for decisions made based on cyber threat information" as long as they are acting in good faith. But CISPA doesn’t define “decisions made.” Aggressive companies could interpret this immunity to cover "defensive"—and what some would consider offensive—countermeasures like DDOSing suspected intruders, third parties, or even innocent users. Private defense contractors have already advocated for this power. These actions should not be allowed by such expansive wording. It leaves the bill ripe for abuse. So, corporations can effectively DDoS other servers now, without legal repercussion, as long as it was in 'good faith'. How does one evaluate 'good faith' in a court room? If I'm a small company with a website, and some major corporation attacks me and knocks my site offline because the attacker who attacked them spoofed the IP address with my website's address, are they off the hook because their attack was in 'good faith'? To me, I get the feeling that CISPA is about more than violating privacy (although it does that in spades), but also legitimatizing the militarization of the Internet.

tptacek 13y ago
I don't know what to think about the "hack-back" controversy. On the one hand, the idea that there could ever be federal authorization for "hacking back" at any target is preposterous. The result would be chaos. Attackers would almost certainly invest effort in tricking the service providers dumb enough to do it into striking innocent networks, or, better yet, into striking out at other providers who themselves would launch "hack-back" efforts --- you know, this is starting to sound awesome --- and in reality no company with a lawyer on staff, retainer, or in the phone book would ever allow their team to do such a thing, CISPA or no CISPA. On the other hand, if just one company is dumb enough to misread the law as providing authorization and tort immunity from running attack code on their imagined attackers, that's probably a very good reason to amend the bill.