9 ms·

How about not passing the beshitted thing in the first place?

knowaveragejoe 14y ago
If there are better scope and privacy controls, then what is the issue? The bill has a valid purpose, people are complaining because of the fear of abuse because the language is vague in parts.
- dreamdu5t 14y ago
  What valid purpose? The Internet does not need more regulation. The FBI/CIA do not need easier access to everyone's communication. Please demonstrate what the threat is requiring FBI and CIA to read my emails and access my entire browsing history. Let me guess... "Terrorism."
  - icebraining 14y ago
    I'm not sure I'd call it "more regulation" - the purpose of this law is to disable in certain cases the regulations that prevent data sharing. In a way, it's less regulation.
    - dreamdu5t 14y ago
      I haven't read and understood the whole bill honestly, but the first paragraph: "The Director of National Intelligence shall establish procedures to allow elements of the intelligence community to share cyber threat intelligence with PRIVATE-SECTOR ENTITIES AND UTILITIES and to encourage the sharing of such intelligence."
      - tptacek 14y ago
        This would allow the USG, which operates the largest IT department in the world and the largest computer security team in the world, to share malware samples and vulnerability data with private companies, instead of the current state of affairs, where we can safely presume the USG often must sit back and watch as people get owned up by attacks they've been aware of for months.
        clicks 14y ago
        That sounds extremely difficult to buy. Does there really not exist any legal avenue in which USG could hand over the pertinent data to the authorities? Why is it that Google (as it has claimed) can hand over thousands of e-mail accounts' contents to various 3-letter agencies but USG cannot hand over samples of malware.
        tptacek 14y ago
        Google hands over email addresses based on court orders and (less frequently) warrants. It is not reasonable to run a security response group that needs to get a court order every time an incident occurs.
        smokeyj 14y ago
        Why are court orders unreasonable?
        tptacek 14y ago
        Because the tempo of incidents in a real security response practice is very high, orders of magnitude more than the temp of criminal investigations. This is one of those places where I'd suggest you want to be careful what you wish for. Here's why: If we can generally agree that there is a kind of operational network security data that should reasonably be shareable --- say, Netflow records corresponding to a DDoS in progress --- and that data is routinely generated, then requiring a court order to share it routinizes the court order process. When you make a routine out of what was intended to be an exception, it stops being an exception. A court order is a demand from the state that someone do things. We probably want court orders to be on the "right" side of the base rate fallacy.
        clicks 14y ago
        Google hands over email addresses based on court orders and (less frequently) warrants. So, the authorities have the resources to request user data by the numbers 14,000 and above from just Google alone for Gmail accounts [1]... and you're telling me we need more cyber security bills to make it even easier for them. Don't you think they already have it easy enough? I'm still skeptical about your claim that presently there exist no means for USG to legally hand over malware samples to the authorities in existing legal frameworks. Can you provide some citation that talks about this? [1] http://www.google.com/transparencyreport/userdatarequests/ http://www.google.com/transparencyreport/userdatarequests/ -- it should be noted that Google complies with the requests a majority of times. Also, it is reasonable to assume that it is mostly American gov't agencies who make up for most of the requests.
  - lukeschlather 14y ago
    The Internet absolutely does need more regulation. I disagree in principle that regulation is bad, but I also think that simply saying "quit regulating" is myopic. Regulations exist, and refusing to touch them because we're afraid of "more regulation" just leaves them dysfunctional. For example, right now due to the lack of clear regulations concerning digital storage, a lot of law enforcement agencies believe that they can legally access people's personal email without a warrant. This should be corrected with a clear law that says you need a warrant, since the 4th amendment's talk of being secure in "papers" is too vague. There's good regulation and bad regulation. "Less regulation" is a good sound byte, not a good strategy.
    - ryanSrich 14y ago
      > For example, right now due to the lack of clear regulations concerning digital storage, a lot of law enforcement agencies believe that they can legally access people's personal email without a warrant. CISPA has no intention of stopping this. Quite the opposite really. The vague wording and hush hush push to get this passed gives rise to the idea that CISPA is a tool to force more of this kind of behavior not stop it. >The Internet absolutely does need more regulation Really? That's a scary thought.
      - lukeschlather 14y ago
        If you just want less regulation, CISPA is your bill. It dramatically reduces the amount of regulations governing how law enforcement can get private data people store on computers via the Internet ("the cloud.")
    - onemorepassword 14y ago
      There are already regulations in place to protect people against unwarranted searches. There's nothing in those laws that even suggests "this doesn't apply to personal email". This is just scaremongering combined with a deliberate abuse of power on order to trick a compliant public into even more repressive laws. This is not about less or more regulation, this is about burying new regulation removing people's rights hidden unnecessary fake regulation. Useful new regulation regarding the internet is very, very rare. 99% of it is a cover for something else. And of course the biggest giveaway is that internet should have lead to less regulation, because all kinds of physical restrictions no longer apply or are impossible to enforce. But we don't see proposals for that, now do we?
- runjake 14y ago
  Because the scope will be misused, and the data will be given away. It's not like the US government doesn't have an extensive history of privacy & rights abuses. Tasers were passed as an alternative to shooting a suspect, now they're used routinely for detainment. The various terrorism laws are now being used clearly outside the scope of terrorism (hackers, drugs, etc). The DMCA is being all kinds of abused outside its scope. This is what we're rightly-concerned about.
- AnthonyMouse 14y ago
  >If there are better scope and privacy controls, then what is the issue? The issue is that there aren't. You can't argue that we should pass this bill because you believe some different bill would be less problematic. Get the Senate to insert an amendment with whatever language you're talking about and show a page on eff.org explaining how the amendment addresses all of their concerns, then you can make that argument.
  - tptacek 14y ago
    What are the scope restrictions and privacy controls you feel the bill is missing? (If you think I'm about to hit you over the head, know that I think the bill is also missing controls.)
    - AnthonyMouse 14y ago
      To give a couple of examples: The exemption from liability should be default deny rather than default allow. Don't exempt everyone from everything, make a list of the things you feel are problematic, explicitly enumerate them in the bill and don't provide an exemption from anything else. At least that way we know what we're getting ourselves into -- I don't think the intention is to allow corporations to be exempt from liability for dumping toxic waste in the rivers or releasing information previously required to be kept private to foreign governments that directly leads to the deaths of dissidents, but if they can justify a good faith cybersecurity purpose in doing so, that's what the existing language seems to allow. The other issue is that the exemption encompasses not only information sharing, but any "good faith" action taken based on the information. I understand what they're going for there. If some law prohibits sharing information, it probably prohibits use too, which would get in the way of what they're trying to do. The problem is, again, that they're not talking about specific laws. So if they respond to the information by hiring Blackwater to raid what they believe to be the attacker's home, no liability? That's not OK.
      - tptacek 14y ago
        This is an extremely smart and thoughtful comment. I can't find much in it to disagree with --- you could argue that the US Code shouldn't nail down specific kinds of network security attacks, because in 10 years there will be 10 new kinds we didn't think of, but there's nothing wrong with baby steps either.
- lawnchair_larry 14y ago
  The "purpose" is to fill an NSA datacenter in Utah through voluntary, liability-free sharing, and to make defense contractors rich. Nobody wants to let the NSA siphon their data because they got sued last time. This bill is a liability shield, so even companies not really interested in sharing all that much are dumb to turn it down. Edited to add: The NSA, in cooperation with the DHS, has been running the pilot program related to this for several years. AT&T, the largest non-defense contractor throwing money at this, is helping them. There are billions in government contracts and quasi-regulatory-capture (note the language about certified cyber security providers) waiting to change hands over this. Then everybody can share with the NSA, customers lose all rights, and don't even know its happening. This is a legalized version of the warrantless wiretapping scandal.
  - tptacek 14y ago
    The Democratic (note before you yell: I am one of those) alternative to CISPA is the one designed to make defense contractors rich. It created a stratum of professional service firms more or less deputized by the USG to conduct mandated audits on private-sector systems determined by some process within the USG to constitute "critical infrastructure"; it was, in other words, a giveaway to Raytheon and SAIC.
    - lawnchair_larry 14y ago
      False dichotomy. Dems are just as bad obviously. The original CISPA was "bipartisan".
      - tptacek 14y ago
        Actually, it's the opposite. The original CISPA was the free-market deregulating alternative to Rockefeller. It's taken on more bipartisan support over the last year (but that's now receding, I think due to the climate in DC). You're right that it's not a dichotomy; I'll try not to portray it as one (as much --- the failure of CISPA does set the Democrats up for another bite at the apple on their proposed regs, which are OMG worse).

If there are better scope and privacy controls, then what is the issue? The bill has a valid purpose, people are complaining because of the fear of abuse because the language is vague in parts.

dreamdu5t 14y ago
What valid purpose? The Internet does not need more regulation. The FBI/CIA do not need easier access to everyone's communication. Please demonstrate what the threat is requiring FBI and CIA to read my emails and access my entire browsing history. Let me guess... "Terrorism."
- icebraining 14y ago
  I'm not sure I'd call it "more regulation" - the purpose of this law is to disable in certain cases the regulations that prevent data sharing. In a way, it's less regulation.
  - dreamdu5t 14y ago
    I haven't read and understood the whole bill honestly, but the first paragraph: "The Director of National Intelligence shall establish procedures to allow elements of the intelligence community to share cyber threat intelligence with PRIVATE-SECTOR ENTITIES AND UTILITIES and to encourage the sharing of such intelligence."
    - tptacek 14y ago
      This would allow the USG, which operates the largest IT department in the world and the largest computer security team in the world, to share malware samples and vulnerability data with private companies, instead of the current state of affairs, where we can safely presume the USG often must sit back and watch as people get owned up by attacks they've been aware of for months.
      - clicks 14y ago
        That sounds extremely difficult to buy. Does there really not exist any legal avenue in which USG could hand over the pertinent data to the authorities? Why is it that Google (as it has claimed) can hand over thousands of e-mail accounts' contents to various 3-letter agencies but USG cannot hand over samples of malware.
        tptacek 14y ago
        Google hands over email addresses based on court orders and (less frequently) warrants. It is not reasonable to run a security response group that needs to get a court order every time an incident occurs.
        smokeyj 14y ago
        Why are court orders unreasonable?
        tptacek 14y ago
        Because the tempo of incidents in a real security response practice is very high, orders of magnitude more than the temp of criminal investigations. This is one of those places where I'd suggest you want to be careful what you wish for. Here's why: If we can generally agree that there is a kind of operational network security data that should reasonably be shareable --- say, Netflow records corresponding to a DDoS in progress --- and that data is routinely generated, then requiring a court order to share it routinizes the court order process. When you make a routine out of what was intended to be an exception, it stops being an exception. A court order is a demand from the state that someone do things. We probably want court orders to be on the "right" side of the base rate fallacy.
        clicks 14y ago
        Google hands over email addresses based on court orders and (less frequently) warrants. So, the authorities have the resources to request user data by the numbers 14,000 and above from just Google alone for Gmail accounts [1]... and you're telling me we need more cyber security bills to make it even easier for them. Don't you think they already have it easy enough? I'm still skeptical about your claim that presently there exist no means for USG to legally hand over malware samples to the authorities in existing legal frameworks. Can you provide some citation that talks about this? [1] http://www.google.com/transparencyreport/userdatarequests/ http://www.google.com/transparencyreport/userdatarequests/ -- it should be noted that Google complies with the requests a majority of times. Also, it is reasonable to assume that it is mostly American gov't agencies who make up for most of the requests.
- lukeschlather 14y ago
  The Internet absolutely does need more regulation. I disagree in principle that regulation is bad, but I also think that simply saying "quit regulating" is myopic. Regulations exist, and refusing to touch them because we're afraid of "more regulation" just leaves them dysfunctional. For example, right now due to the lack of clear regulations concerning digital storage, a lot of law enforcement agencies believe that they can legally access people's personal email without a warrant. This should be corrected with a clear law that says you need a warrant, since the 4th amendment's talk of being secure in "papers" is too vague. There's good regulation and bad regulation. "Less regulation" is a good sound byte, not a good strategy.
  - ryanSrich 14y ago
    > For example, right now due to the lack of clear regulations concerning digital storage, a lot of law enforcement agencies believe that they can legally access people's personal email without a warrant. CISPA has no intention of stopping this. Quite the opposite really. The vague wording and hush hush push to get this passed gives rise to the idea that CISPA is a tool to force more of this kind of behavior not stop it. >The Internet absolutely does need more regulation Really? That's a scary thought.
    - lukeschlather 14y ago
      If you just want less regulation, CISPA is your bill. It dramatically reduces the amount of regulations governing how law enforcement can get private data people store on computers via the Internet ("the cloud.")
  - onemorepassword 14y ago
    There are already regulations in place to protect people against unwarranted searches. There's nothing in those laws that even suggests "this doesn't apply to personal email". This is just scaremongering combined with a deliberate abuse of power on order to trick a compliant public into even more repressive laws. This is not about less or more regulation, this is about burying new regulation removing people's rights hidden unnecessary fake regulation. Useful new regulation regarding the internet is very, very rare. 99% of it is a cover for something else. And of course the biggest giveaway is that internet should have lead to less regulation, because all kinds of physical restrictions no longer apply or are impossible to enforce. But we don't see proposals for that, now do we?
runjake 14y ago
Because the scope will be misused, and the data will be given away. It's not like the US government doesn't have an extensive history of privacy & rights abuses. Tasers were passed as an alternative to shooting a suspect, now they're used routinely for detainment. The various terrorism laws are now being used clearly outside the scope of terrorism (hackers, drugs, etc). The DMCA is being all kinds of abused outside its scope. This is what we're rightly-concerned about.
AnthonyMouse 14y ago
>If there are better scope and privacy controls, then what is the issue? The issue is that there aren't. You can't argue that we should pass this bill because you believe some different bill would be less problematic. Get the Senate to insert an amendment with whatever language you're talking about and show a page on eff.org explaining how the amendment addresses all of their concerns, then you can make that argument.
- tptacek 14y ago
  What are the scope restrictions and privacy controls you feel the bill is missing? (If you think I'm about to hit you over the head, know that I think the bill is also missing controls.)
  - AnthonyMouse 14y ago
    To give a couple of examples: The exemption from liability should be default deny rather than default allow. Don't exempt everyone from everything, make a list of the things you feel are problematic, explicitly enumerate them in the bill and don't provide an exemption from anything else. At least that way we know what we're getting ourselves into -- I don't think the intention is to allow corporations to be exempt from liability for dumping toxic waste in the rivers or releasing information previously required to be kept private to foreign governments that directly leads to the deaths of dissidents, but if they can justify a good faith cybersecurity purpose in doing so, that's what the existing language seems to allow. The other issue is that the exemption encompasses not only information sharing, but any "good faith" action taken based on the information. I understand what they're going for there. If some law prohibits sharing information, it probably prohibits use too, which would get in the way of what they're trying to do. The problem is, again, that they're not talking about specific laws. So if they respond to the information by hiring Blackwater to raid what they believe to be the attacker's home, no liability? That's not OK.
    - tptacek 14y ago
      This is an extremely smart and thoughtful comment. I can't find much in it to disagree with --- you could argue that the US Code shouldn't nail down specific kinds of network security attacks, because in 10 years there will be 10 new kinds we didn't think of, but there's nothing wrong with baby steps either.
lawnchair_larry 14y ago
The "purpose" is to fill an NSA datacenter in Utah through voluntary, liability-free sharing, and to make defense contractors rich. Nobody wants to let the NSA siphon their data because they got sued last time. This bill is a liability shield, so even companies not really interested in sharing all that much are dumb to turn it down. Edited to add: The NSA, in cooperation with the DHS, has been running the pilot program related to this for several years. AT&T, the largest non-defense contractor throwing money at this, is helping them. There are billions in government contracts and quasi-regulatory-capture (note the language about certified cyber security providers) waiting to change hands over this. Then everybody can share with the NSA, customers lose all rights, and don't even know its happening. This is a legalized version of the warrantless wiretapping scandal.
- tptacek 14y ago
  The Democratic (note before you yell: I am one of those) alternative to CISPA is the one designed to make defense contractors rich. It created a stratum of professional service firms more or less deputized by the USG to conduct mandated audits on private-sector systems determined by some process within the USG to constitute "critical infrastructure"; it was, in other words, a giveaway to Raytheon and SAIC.
  - lawnchair_larry 14y ago
    False dichotomy. Dems are just as bad obviously. The original CISPA was "bipartisan".
    - tptacek 14y ago
      Actually, it's the opposite. The original CISPA was the free-market deregulating alternative to Rockefeller. It's taken on more bipartisan support over the last year (but that's now receding, I think due to the climate in DC). You're right that it's not a dichotomy; I'll try not to portray it as one (as much --- the failure of CISPA does set the Democrats up for another bite at the apple on their proposed regs, which are OMG worse).