6 ms·

What valid purpose? The Internet does not need more regulation. The FBI/CIA do not need easier access to everyone's communication. Please demonstrate what the t

What valid purpose? The Internet does not need more regulation. The FBI/CIA do not need easier access to everyone's communication. Please demonstrate what the threat is requiring FBI and CIA to read my emails and access my entire browsing history. Let me guess... "Terrorism."

icebraining 14y ago
I'm not sure I'd call it "more regulation" - the purpose of this law is to disable in certain cases the regulations that prevent data sharing. In a way, it's less regulation.
- dreamdu5t 14y ago
  I haven't read and understood the whole bill honestly, but the first paragraph: "The Director of National Intelligence shall establish procedures to allow elements of the intelligence community to share cyber threat intelligence with PRIVATE-SECTOR ENTITIES AND UTILITIES and to encourage the sharing of such intelligence."
  - tptacek 14y ago
    This would allow the USG, which operates the largest IT department in the world and the largest computer security team in the world, to share malware samples and vulnerability data with private companies, instead of the current state of affairs, where we can safely presume the USG often must sit back and watch as people get owned up by attacks they've been aware of for months.
    - clicks 14y ago
      That sounds extremely difficult to buy. Does there really not exist any legal avenue in which USG could hand over the pertinent data to the authorities? Why is it that Google (as it has claimed) can hand over thousands of e-mail accounts' contents to various 3-letter agencies but USG cannot hand over samples of malware.
      - tptacek 14y ago
        Google hands over email addresses based on court orders and (less frequently) warrants. It is not reasonable to run a security response group that needs to get a court order every time an incident occurs.
        smokeyj 14y ago
        Why are court orders unreasonable?
        tptacek 14y ago
        Because the tempo of incidents in a real security response practice is very high, orders of magnitude more than the temp of criminal investigations. This is one of those places where I'd suggest you want to be careful what you wish for. Here's why: If we can generally agree that there is a kind of operational network security data that should reasonably be shareable --- say, Netflow records corresponding to a DDoS in progress --- and that data is routinely generated, then requiring a court order to share it routinizes the court order process. When you make a routine out of what was intended to be an exception, it stops being an exception. A court order is a demand from the state that someone do things. We probably want court orders to be on the "right" side of the base rate fallacy.
        clicks 14y ago
        Google hands over email addresses based on court orders and (less frequently) warrants. So, the authorities have the resources to request user data by the numbers 14,000 and above from just Google alone for Gmail accounts [1]... and you're telling me we need more cyber security bills to make it even easier for them. Don't you think they already have it easy enough? I'm still skeptical about your claim that presently there exist no means for USG to legally hand over malware samples to the authorities in existing legal frameworks. Can you provide some citation that talks about this? [1] http://www.google.com/transparencyreport/userdatarequests/ http://www.google.com/transparencyreport/userdatarequests/ -- it should be noted that Google complies with the requests a majority of times. Also, it is reasonable to assume that it is mostly American gov't agencies who make up for most of the requests.
    - dreamdu5t 14y ago
      What law stops the USG from sharing malware samples and vulnerabilities? What part of CISPA changes that? I don't see anything about this when I skim through the bill.
      - tptacek 14y ago
        Sec 1104 (a) (1)
    - ensignavenger 14y ago
      Perhaps a more strict definition of Cyber Threat Intelligence would help. If the definition was narrowed to exclude private data, that would go a long way. But doesn't the US-CERT already do this? What information would the US-CERT like to share that they cannot currently share?
      - tptacek 14y ago
        I think people thing US-CERT is more important than it actually is because of its history, which included a long stretch where it was the only incident response team anyone had heard of. But in reality, US-CERT does very, very little: it is a clearinghouse for heavily redacted vulnerability information that has usually been in the mainstream for a long time. Did you read the definition of cyber threat information in the bill? It's here: http://intelligence.house.gov/hr-624-bill-and-amendments http://intelligence.house.gov/hr-624-bill-and-amendments If so, I'd be interested in your ideas for improving the definition. Thank you for the thoughtful comment.
lukeschlather 14y ago
The Internet absolutely does need more regulation. I disagree in principle that regulation is bad, but I also think that simply saying "quit regulating" is myopic. Regulations exist, and refusing to touch them because we're afraid of "more regulation" just leaves them dysfunctional. For example, right now due to the lack of clear regulations concerning digital storage, a lot of law enforcement agencies believe that they can legally access people's personal email without a warrant. This should be corrected with a clear law that says you need a warrant, since the 4th amendment's talk of being secure in "papers" is too vague. There's good regulation and bad regulation. "Less regulation" is a good sound byte, not a good strategy.
- ryanSrich 14y ago
  > For example, right now due to the lack of clear regulations concerning digital storage, a lot of law enforcement agencies believe that they can legally access people's personal email without a warrant. CISPA has no intention of stopping this. Quite the opposite really. The vague wording and hush hush push to get this passed gives rise to the idea that CISPA is a tool to force more of this kind of behavior not stop it. >The Internet absolutely does need more regulation Really? That's a scary thought.
  - lukeschlather 14y ago
    If you just want less regulation, CISPA is your bill. It dramatically reduces the amount of regulations governing how law enforcement can get private data people store on computers via the Internet ("the cloud.")
- onemorepassword 14y ago
  There are already regulations in place to protect people against unwarranted searches. There's nothing in those laws that even suggests "this doesn't apply to personal email". This is just scaremongering combined with a deliberate abuse of power on order to trick a compliant public into even more repressive laws. This is not about less or more regulation, this is about burying new regulation removing people's rights hidden unnecessary fake regulation. Useful new regulation regarding the internet is very, very rare. 99% of it is a cover for something else. And of course the biggest giveaway is that internet should have lead to less regulation, because all kinds of physical restrictions no longer apply or are impossible to enforce. But we don't see proposals for that, now do we?

icebraining 14y ago

I'm not sure I'd call it "more regulation" - the purpose of this law is to disable in certain cases the regulations that prevent data sharing. In a way, it's less regulation.

dreamdu5t 14y ago
I haven't read and understood the whole bill honestly, but the first paragraph: "The Director of National Intelligence shall establish procedures to allow elements of the intelligence community to share cyber threat intelligence with PRIVATE-SECTOR ENTITIES AND UTILITIES and to encourage the sharing of such intelligence."
- tptacek 14y ago
  This would allow the USG, which operates the largest IT department in the world and the largest computer security team in the world, to share malware samples and vulnerability data with private companies, instead of the current state of affairs, where we can safely presume the USG often must sit back and watch as people get owned up by attacks they've been aware of for months.
  - clicks 14y ago
    That sounds extremely difficult to buy. Does there really not exist any legal avenue in which USG could hand over the pertinent data to the authorities? Why is it that Google (as it has claimed) can hand over thousands of e-mail accounts' contents to various 3-letter agencies but USG cannot hand over samples of malware.
    - tptacek 14y ago
      Google hands over email addresses based on court orders and (less frequently) warrants. It is not reasonable to run a security response group that needs to get a court order every time an incident occurs.
      - smokeyj 14y ago
        Why are court orders unreasonable?
        tptacek 14y ago
        Because the tempo of incidents in a real security response practice is very high, orders of magnitude more than the temp of criminal investigations. This is one of those places where I'd suggest you want to be careful what you wish for. Here's why: If we can generally agree that there is a kind of operational network security data that should reasonably be shareable --- say, Netflow records corresponding to a DDoS in progress --- and that data is routinely generated, then requiring a court order to share it routinizes the court order process. When you make a routine out of what was intended to be an exception, it stops being an exception. A court order is a demand from the state that someone do things. We probably want court orders to be on the "right" side of the base rate fallacy.
      - clicks 14y ago
        Google hands over email addresses based on court orders and (less frequently) warrants. So, the authorities have the resources to request user data by the numbers 14,000 and above from just Google alone for Gmail accounts [1]... and you're telling me we need more cyber security bills to make it even easier for them. Don't you think they already have it easy enough? I'm still skeptical about your claim that presently there exist no means for USG to legally hand over malware samples to the authorities in existing legal frameworks. Can you provide some citation that talks about this? [1] http://www.google.com/transparencyreport/userdatarequests/ http://www.google.com/transparencyreport/userdatarequests/ -- it should be noted that Google complies with the requests a majority of times. Also, it is reasonable to assume that it is mostly American gov't agencies who make up for most of the requests.
  - dreamdu5t 14y ago
    What law stops the USG from sharing malware samples and vulnerabilities? What part of CISPA changes that? I don't see anything about this when I skim through the bill.
    - tptacek 14y ago
      Sec 1104 (a) (1)
  - ensignavenger 14y ago
    Perhaps a more strict definition of Cyber Threat Intelligence would help. If the definition was narrowed to exclude private data, that would go a long way. But doesn't the US-CERT already do this? What information would the US-CERT like to share that they cannot currently share?
    - tptacek 14y ago
      I think people thing US-CERT is more important than it actually is because of its history, which included a long stretch where it was the only incident response team anyone had heard of. But in reality, US-CERT does very, very little: it is a clearinghouse for heavily redacted vulnerability information that has usually been in the mainstream for a long time. Did you read the definition of cyber threat information in the bill? It's here: http://intelligence.house.gov/hr-624-bill-and-amendments http://intelligence.house.gov/hr-624-bill-and-amendments If so, I'd be interested in your ideas for improving the definition. Thank you for the thoughtful comment.

lukeschlather 14y ago

The Internet absolutely does need more regulation. I disagree in principle that regulation is bad, but I also think that simply saying "quit regulating" is myopic. Regulations exist, and refusing to touch them because we're afraid of "more regulation" just leaves them dysfunctional. For example, right now due to the lack of clear regulations concerning digital storage, a lot of law enforcement agencies believe that they can legally access people's personal email without a warrant. This should be corrected with a clear law that says you need a warrant, since the 4th amendment's talk of being secure in "papers" is too vague. There's good regulation and bad regulation. "Less regulation" is a good sound byte, not a good strategy.

ryanSrich 14y ago
> For example, right now due to the lack of clear regulations concerning digital storage, a lot of law enforcement agencies believe that they can legally access people's personal email without a warrant. CISPA has no intention of stopping this. Quite the opposite really. The vague wording and hush hush push to get this passed gives rise to the idea that CISPA is a tool to force more of this kind of behavior not stop it. >The Internet absolutely does need more regulation Really? That's a scary thought.
- lukeschlather 14y ago
  If you just want less regulation, CISPA is your bill. It dramatically reduces the amount of regulations governing how law enforcement can get private data people store on computers via the Internet ("the cloud.")
onemorepassword 14y ago
There are already regulations in place to protect people against unwarranted searches. There's nothing in those laws that even suggests "this doesn't apply to personal email". This is just scaremongering combined with a deliberate abuse of power on order to trick a compliant public into even more repressive laws. This is not about less or more regulation, this is about burying new regulation removing people's rights hidden unnecessary fake regulation. Useful new regulation regarding the internet is very, very rare. 99% of it is a cover for something else. And of course the biggest giveaway is that internet should have lead to less regulation, because all kinds of physical restrictions no longer apply or are impossible to enforce. But we don't see proposals for that, now do we?