9 ms·
Reddit co-founder calls out Google, Twitter, Facebook over CISPA
- tptacek 14y agoI would like to hear from Ohanian about what changes he would like to see to improve the scope and privacy controls in CISPA.
- arbitrage 14y agoHow about not passing the beshitted thing in the first place?
- knowaveragejoe 14y agoIf there are better scope and privacy controls, then what is the issue? The bill has a valid purpose, people are complaining because of the fear of abuse because the language is vague in parts.
- dreamdu5t 14y agoWhat valid purpose? The Internet does not need more regulation. The FBI/CIA do not need easier access to everyone's communication. Please demonstrate what the threat is requiring FBI and CIA to read my emails and access my entire browsing history. Let me guess... "Terrorism."
- icebraining 14y agoI'm not sure I'd call it "more regulation" - the purpose of this law is to disable in certain cases the regulations that prevent data sharing. In a way, it's less regulation.
- dreamdu5t 14y agoI haven't read and understood the whole bill honestly, but the first paragraph: "The Director of National Intelligence shall establish procedures to allow elements of the intelligence community to share cyber threat intelligence with PRIVATE-SECTOR ENTITIES AND UTILITIES and to encourage the sharing of such intelligence."
- tptacek 14y agoThis would allow the USG, which operates the largest IT department in the world and the largest computer security team in the world, to share malware samples and vulnerability data with private companies, instead of the current state of affairs, where we can safely presume the USG often must sit back and watch as people get owned up by attacks they've been aware of for months.
- clicks 14y agoThat sounds extremely difficult to buy. Does there really not exist any legal avenue in which USG could hand over the pertinent data to the authorities? Why is it that Google (as it has claimed) can hand over thousands of e-mail accounts' contents to various 3-letter agencies but USG cannot hand over samples of malware.
- tptacek 14y agoGoogle hands over email addresses based on court orders and (less frequently) warrants. It is not reasonable to run a security response group that needs to get a court order every time an incident occurs.
- smokeyj 14y agoWhy are court orders unreasonable?
- tptacek 14y agoBecause the tempo of incidents in a real security response practice is very high, orders of magnitude more than the temp of criminal investigations. This is one of those places where I'd suggest you want to be careful what you wish for. Here's why: If we can generally agree that there is a kind of operational network security data that should reasonably be shareable --- say, Netflow records corresponding to a DDoS in progress --- and that data is routinely generated, then requiring a court order to share it routinizes the court order process. When you make a routine out of what was intended to be an exception, it stops being an exception. A court order is a demand from the state that someone do things. We probably want court orders to be on the "right" side of the base rate fallacy.
- lukeschlather 14y agoThe Internet absolutely does need more regulation. I disagree in principle that regulation is bad, but I also think that simply saying "quit regulating" is myopic. Regulations exist, and refusing to touch them because we're afraid of "more regulation" just leaves them dysfunctional. For example, right now due to the lack of clear regulations concerning digital storage, a lot of law enforcement agencies believe that they can legally access people's personal email without a warrant. This should be corrected with a clear law that says you need a warrant, since the 4th amendment's talk of being secure in "papers" is too vague. There's good regulation and bad regulation. "Less regulation" is a good sound byte, not a good strategy.
- ryanSrich 14y ago> For example, right now due to the lack of clear regulations concerning digital storage, a lot of law enforcement agencies believe that they can legally access people's personal email without a warrant. CISPA has no intention of stopping this. Quite the opposite really. The vague wording and hush hush push to get this passed gives rise to the idea that CISPA is a tool to force more of this kind of behavior not stop it. >The Internet absolutely does need more regulation Really? That's a scary thought.
- lukeschlather 14y agoIf you just want less regulation, CISPA is your bill. It dramatically reduces the amount of regulations governing how law enforcement can get private data people store on computers via the Internet ("the cloud.")
- onemorepassword 14y agoThere are already regulations in place to protect people against unwarranted searches. There's nothing in those laws that even suggests "this doesn't apply to personal email". This is just scaremongering combined with a deliberate abuse of power on order to trick a compliant public into even more repressive laws. This is not about less or more regulation, this is about burying new regulation removing people's rights hidden unnecessary fake regulation. Useful new regulation regarding the internet is very, very rare. 99% of it is a cover for something else. And of course the biggest giveaway is that internet should have lead to less regulation, because all kinds of physical restrictions no longer apply or are impossible to enforce. But we don't see proposals for that, now do we?
- runjake 14y agoBecause the scope will be misused, and the data will be given away. It's not like the US government doesn't have an extensive history of privacy & rights abuses. Tasers were passed as an alternative to shooting a suspect, now they're used routinely for detainment. The various terrorism laws are now being used clearly outside the scope of terrorism (hackers, drugs, etc). The DMCA is being all kinds of abused outside its scope. This is what we're rightly-concerned about.
- AnthonyMouse 14y ago>If there are better scope and privacy controls, then what is the issue? The issue is that there aren't. You can't argue that we should pass this bill because you believe some different bill would be less problematic. Get the Senate to insert an amendment with whatever language you're talking about and show a page on eff.org explaining how the amendment addresses all of their concerns, then you can make that argument.
- tptacek 14y agoWhat are the scope restrictions and privacy controls you feel the bill is missing? (If you think I'm about to hit you over the head, know that I think the bill is also missing controls.)
- AnthonyMouse 14y agoTo give a couple of examples: The exemption from liability should be default deny rather than default allow. Don't exempt everyone from everything, make a list of the things you feel are problematic, explicitly enumerate them in the bill and don't provide an exemption from anything else. At least that way we know what we're getting ourselves into -- I don't think the intention is to allow corporations to be exempt from liability for dumping toxic waste in the rivers or releasing information previously required to be kept private to foreign governments that directly leads to the deaths of dissidents, but if they can justify a good faith cybersecurity purpose in doing so, that's what the existing language seems to allow. The other issue is that the exemption encompasses not only information sharing, but any "good faith" action taken based on the information. I understand what they're going for there. If some law prohibits sharing information, it probably prohibits use too, which would get in the way of what they're trying to do. The problem is, again, that they're not talking about specific laws. So if they respond to the information by hiring Blackwater to raid what they believe to be the attacker's home, no liability? That's not OK.
- tptacek 14y agoThis is an extremely smart and thoughtful comment. I can't find much in it to disagree with --- you could argue that the US Code shouldn't nail down specific kinds of network security attacks, because in 10 years there will be 10 new kinds we didn't think of, but there's nothing wrong with baby steps either.
- lawnchair_larry 14y agoThe "purpose" is to fill an NSA datacenter in Utah through voluntary, liability-free sharing, and to make defense contractors rich. Nobody wants to let the NSA siphon their data because they got sued last time. This bill is a liability shield, so even companies not really interested in sharing all that much are dumb to turn it down. Edited to add: The NSA, in cooperation with the DHS, has been running the pilot program related to this for several years. AT&T, the largest non-defense contractor throwing money at this, is helping them. There are billions in government contracts and quasi-regulatory-capture (note the language about certified cyber security providers) waiting to change hands over this. Then everybody can share with the NSA, customers lose all rights, and don't even know its happening. This is a legalized version of the warrantless wiretapping scandal.
- tptacek 14y agoThe Democratic (note before you yell: I am one of those) alternative to CISPA is the one designed to make defense contractors rich. It created a stratum of professional service firms more or less deputized by the USG to conduct mandated audits on private-sector systems determined by some process within the USG to constitute "critical infrastructure"; it was, in other words, a giveaway to Raytheon and SAIC.
- lawnchair_larry 14y agoFalse dichotomy. Dems are just as bad obviously. The original CISPA was "bipartisan".
- tptacek 14y agoActually, it's the opposite. The original CISPA was the free-market deregulating alternative to Rockefeller. It's taken on more bipartisan support over the last year (but that's now receding, I think due to the climate in DC). You're right that it's not a dichotomy; I'll try not to portray it as one (as much --- the failure of CISPA does set the Democrats up for another bite at the apple on their proposed regs, which are OMG worse).
- deleted 14y ago[deleted]
- deelowe 14y agoAgreed. There are valid reasons for the bill(mostly around giving agencies the ability to do their jobs in the digital age without unnecessary restrictions). Also, there's that whole issue of having the ability to do something about cyberterrorism(which is happening today by the way). The implementation may not be sound, but something does need to be done. The CIA and FBI need to be able to research and distribute malware. The government needs to have a way to do something in cyber warefare scenarios. This is why the bill has so many supporters. My guess is that big businesses are supporting this(Google) due to them having been bit by state sponsored attacks in the past(http://world.time.com/2012/06/06/google-warns-gmail-users-of-state-sponsored-attacks/ http://world.time.com/2012/06/06/google-warns-gmail-users-of...).
- cygwin98 14y agoDo you see the contradiction here? Google pulled out of China a few years ago because Chinese government was supposedly doing shits like this. Google followed its unofficial "Do not Evil" motto. That's cool. Then this time it is OK for the US to do the same?
- deelowe 14y agoI think you misunderstood me. I wasn't saying the govt. should be allowed to conduct cyberwarfare. However, they should be allowed to conduct investigations into cyberwarfare and protect it's citizens against it. That's one of the major intents here. The FBI and CIA can not work together on investigations when it involves doing something like working with private entities to share maleware or explore attack vectors. To be clear, they can't even do whitehat things today that private citizens are allowed due to regulatory restrictions. I'm not saying this justifies cispa. It doesn't. But, it does help frame the discussion in a productive way.
- cygwin98 14y agoNo problem. Maybe just me (perhaps quite some people here as well) had a high expectation over Google. I thought Google pulled off that stunt from a human right stand, rather than from simply being patriotic to the USA. GOOG has much more resources than Elon Musk to do lots of stuffs meaningful for the greater good of human being.
- ryanSrich 14y agoAny control over the content on the web is inherently bad, regardless of what the media tells you.
- ensignavenger 14y agoI just read the definition of Cybersecurity Threat in the bill. I think the EFF's recommendation to specifically exclude the content of communication would be a major improvement. I think the complaint that there is no real recourse if a company chooses to share information that does not fit the definition- as the bill grants immunity for such actions and there is no way for an individual to know the information was shared (in order to sue the Fed within the 2 year time frame required) is valid. So one improvement would be to remove the immunity clause. (Or something similar to Rep. Justin Amash's proposed amendment) When Quest refused to participate in the Fed's illegal spying program, they punished them by moving a large contract from the company. I read nothing in skimming the bill that would prevent the Feds from pulling a similar stunt, promising immunity under CISPA as the carrot, while threatening them with a stick (money) like they did to Quest. Another possible improvement would be to expand the mission of US-CERT, to make them the point of contact for all information sharing, require them to validate it is cybersecurity related, and then they become the clearing house and the single accountable agency within the US Government for all CISPA related data. (There may be another agency more suitable than USCERT, but I use them as an example.) There have been several amendments proposed to improve the privacy protections in CISPA, but they have been blocked- and thus we are left to ask why? If it is all good intentions, why block the proposed protections that help ensure that good intentions don't go awry?
- tptacek 14y agoThank you for this comment. I actually disagree with a lot of it, but you clearly know what the bill is talking about. You have three concerns: 1. That even though the bill tries to specify what kinds of information can be shared under CISPA, the penalties for "over-sharing" with the USG are very fuzzy (you are immunized not just for sharing to the letter of the bill, but also for "good faith" sharing). 2. That the bill does not prevent the USG from retaliating for failing to cooperate with efforts outside the scope of the bill. 3. That the bill could build up US-CERT instead of diffusing authority (and potential conflicts of interest) through DOJ, DOD, and DNI. I agree with the 1st, but not the 2nd or the 3rd concern. In particular: your 2nd concern militates for another bill, not an amendment to CISPA.
- pms 14y agoActually... Why do they want to pass this bill in the first place? I mean... The things they want to do are comparable with monitoring all phone calls. Listening to all phone calls and trying to catch dangerous words in the conversations. Why nobody tried to do this with phone calls, but now they try to do this with on-line messaging and social networks?
- kaoD 14y agoBecause text analysis is very easy compared to audio analysis. Check YouTube's transcriptions. They suck.
- pms 14y agoWell. That's obvious. The question is if we need it, and if it won't be abused? I think we were doing pretty fine without monitoring phone calls, so why do we want to monitor on-line services? Because it's simpler is not a good answer.
- tptacek 14y agoWhat CISPA purports to do is not comparable with monitoring all phone calls. Where, in the text of the bill or any of its amendments, do you find support for the concern that the law would be used that way?
- TallboyOne 14y agoI would have a beer with that guy.
- maciekp 14y agofreaky moves in the last part
- GigabyteCoin 14y agoHopefully Namecoin will see some more development out of this: http://reddit.com/r/namecoin http://reddit.com/r/namecoin
- davidmr 14y ago> The video is clearly meant to be less than totally serious - it seems unlikely that Ohanian, himself a prominent figure in the tech world, would need to resort to trying to talk his way to Page through Google's public phone number... I realize that the author probably meant that Ohanian would have connections who might have connections who would have Larry Page's phone number, but the wording of that briefly made me think that the author thought there was some secret phone book you get when you cash out your popular startup for a certain amount.
- wavesounds 14y agoHere's the petition: http://www.saveyourprivacypolicy.org/ http://www.saveyourprivacypolicy.org/
- cinquemb 14y agowell the market just went uptick for the encryption products/services :P
- kunai 14y agoIf only Aaron Swartz was still alive.
- 420365247 14y agoWhy does this only have 73,000 views on YouTube?....