4 ms·

I just read the definition of Cybersecurity Threat in the bill. I think the EFF's recommendation to specifically exclude the content of communication would be a

I just read the definition of Cybersecurity Threat in the bill. I think the EFF's recommendation to specifically exclude the content of communication would be a major improvement. I think the complaint that there is no real recourse if a company chooses to share information that does not fit the definition- as the bill grants immunity for such actions and there is no way for an individual to know the information was shared (in order to sue the Fed within the 2 year time frame required) is valid. So one improvement would be to remove the immunity clause. (Or something similar to Rep. Justin Amash's proposed amendment) When Quest refused to participate in the Fed's illegal spying program, they punished them by moving a large contract from the company. I read nothing in skimming the bill that would prevent the Feds from pulling a similar stunt, promising immunity under CISPA as the carrot, while threatening them with a stick (money) like they did to Quest. Another possible improvement would be to expand the mission of US-CERT, to make them the point of contact for all information sharing, require them to validate it is cybersecurity related, and then they become the clearing house and the single accountable agency within the US Government for all CISPA related data. (There may be another agency more suitable than USCERT, but I use them as an example.) There have been several amendments proposed to improve the privacy protections in CISPA, but they have been blocked- and thus we are left to ask why? If it is all good intentions, why block the proposed protections that help ensure that good intentions don't go awry?

tptacek 14y ago
Thank you for this comment. I actually disagree with a lot of it, but you clearly know what the bill is talking about. You have three concerns: 1. That even though the bill tries to specify what kinds of information can be shared under CISPA, the penalties for "over-sharing" with the USG are very fuzzy (you are immunized not just for sharing to the letter of the bill, but also for "good faith" sharing). 2. That the bill does not prevent the USG from retaliating for failing to cooperate with efforts outside the scope of the bill. 3. That the bill could build up US-CERT instead of diffusing authority (and potential conflicts of interest) through DOJ, DOD, and DNI. I agree with the 1st, but not the 2nd or the 3rd concern. In particular: your 2nd concern militates for another bill, not an amendment to CISPA.
- ensignavenger 14y ago
  I agree that concern #2 would perhaps better be mitigated via a Seperate, more generic bill, but I won't hold my breath waiting for that to happen!
lawnchair_larry 14y ago
It's funny that you mention Qwest (Now CenturyLink), and the illegal spying program, because they (along with AT&T) are brokering access to the NSA's latest spying toy, which CISPA is intended to expand. http://www.dc3.mil/dcise/DIB%20Enhanced%20Cybersecurity%20Services%20Procedures.pdf http://www.dc3.mil/dcise/DIB%20Enhanced%20Cybersecurity%20Se... This DIB Enhanced Cybersecurity Service is being handled by the defense contractors who donate to Mike Rogers: http://www.opensecrets.org/politicians/contrib.php?cycle=2012&type=C&cid=N00009668&newMem=N&recs=20 http://www.opensecrets.org/politicians/contrib.php?cycle=201... 4. AT&T 8. General Dynamics 9. Raytheon 9. SAIC Inc 9. Lockheed Martin 9. Northrop Grumman 19. BAE Systems Their letters of support for CISPA, referencing the DIB program, are on the Senate website: http://intelligence.house.gov/sites/intelligence.house.gov/files/documents/NDIASupportofCyberBill.pdf http://intelligence.house.gov/sites/intelligence.house.gov/f... I write to you on behalf of the National Defense Industrial Association (NDIA) to express our support for The Cyber Intelligence Sharing and Protection Act of 2011 (HR 3523). ... As you are aware, NDIA is a non-profit organization, and is America's leading Defense Industry association, ... Our members represent the entire spectrum of the Defense Industrial Base (DIB). ... To illustrate, some NDIA members have participated in the Department of Defense's DIB Pilot program... http://intelligence.house.gov/sites/intelligence.house.gov/files/documents/ASISLetterSupportingHR3523.pdf http://intelligence.house.gov/sites/intelligence.house.gov/f... ASIS ... The bill also gives businesses certainty that cybersecurity information shared with the government would be provided safe harbor and would not lead to frivolous lawsuits, among other protections. http://intelligence.house.gov/sites/intelligence.house.gov/files/documents/CSC113011.pdf http://intelligence.house.gov/sites/intelligence.house.gov/f... "I am please to write to you to express CSC's wholehearted endorsement of the "Cyber Intelligence Sharing and Protection Act of 2011" which you released today and which requires the Director of National Intelligence to establish a program allowing certified organizations to use classified cyber signatures to help protect their IT enterprises... As you know, CSC was the first IT enterprise company invited to join the defense industrial base pilot program (DIB)... This program was quietly started around 2011: http://www.washingtonpost.com/national/major-internet-service-providers-cooperating-with-nsa-on-monitoring-traffic/2011/06/07/AG2dukXH_story.html http://www.washingtonpost.com/national/major-internet-servic... NSA allies with Internet carriers to thwart cyber attacks against defense firms The National Security Agency is working with Internet service providers to deploy a new generation of tools to scan e-mail and other digital traffic with the goal of thwarting cyberattacks against defense firms by foreign adversaries... The Internet carriers are AT&T, Verizon and CenturyLink. Together they are seeking to filter the traffic of 15 defense contractors, including Lockheed, CSC, SAIC and Northrop Grumman. There is at least $6B waiting to go to the defense contractors to help the NSA. (They're already working with the NSA on the big Utah datacenter): ttp://www.bizjournals.com/washington/blog/fedbiz_daily/2013/01/northrop-saic-mantech-among-those-to.html?page=all Northrop, SAIC, ManTech among those to bid for DHS' $6B cyber program Northrop Grumman Corp., ManTech International Corp. and SAIC all confirmed to me their plans to bid as a prime contractor for DHS' Continuous Monitoring as a Service program, which will be worth up to $6 billion over five years

tptacek 14y ago

Thank you for this comment. I actually disagree with a lot of it, but you clearly know what the bill is talking about. You have three concerns: 1. That even though the bill tries to specify what kinds of information can be shared under CISPA, the penalties for "over-sharing" with the USG are very fuzzy (you are immunized not just for sharing to the letter of the bill, but also for "good faith" sharing). 2. That the bill does not prevent the USG from retaliating for failing to cooperate with efforts outside the scope of the bill. 3. That the bill could build up US-CERT instead of diffusing authority (and potential conflicts of interest) through DOJ, DOD, and DNI. I agree with the 1st, but not the 2nd or the 3rd concern. In particular: your 2nd concern militates for another bill, not an amendment to CISPA.

ensignavenger 14y ago
I agree that concern #2 would perhaps better be mitigated via a Seperate, more generic bill, but I won't hold my breath waiting for that to happen!

lawnchair_larry 14y ago

It's funny that you mention Qwest (Now CenturyLink), and the illegal spying program, because they (along with AT&T) are brokering access to the NSA's latest spying toy, which CISPA is intended to expand. http://www.dc3.mil/dcise/DIB%20Enhanced%20Cybersecurity%20Services%20Procedures.pdf http://www.dc3.mil/dcise/DIB%20Enhanced%20Cybersecurity%20Se... This DIB Enhanced Cybersecurity Service is being handled by the defense contractors who donate to Mike Rogers: http://www.opensecrets.org/politicians/contrib.php?cycle=2012&type=C&cid=N00009668&newMem=N&recs=20 http://www.opensecrets.org/politicians/contrib.php?cycle=201... 4. AT&T 8. General Dynamics 9. Raytheon 9. SAIC Inc 9. Lockheed Martin 9. Northrop Grumman 19. BAE Systems Their letters of support for CISPA, referencing the DIB program, are on the Senate website: http://intelligence.house.gov/sites/intelligence.house.gov/files/documents/NDIASupportofCyberBill.pdf http://intelligence.house.gov/sites/intelligence.house.gov/f... I write to you on behalf of the National Defense Industrial Association (NDIA) to express our support for The Cyber Intelligence Sharing and Protection Act of 2011 (HR 3523). ... As you are aware, NDIA is a non-profit organization, and is America's leading Defense Industry association, ... Our members represent the entire spectrum of the Defense Industrial Base (DIB). ... To illustrate, some NDIA members have participated in the Department of Defense's DIB Pilot program... http://intelligence.house.gov/sites/intelligence.house.gov/files/documents/ASISLetterSupportingHR3523.pdf http://intelligence.house.gov/sites/intelligence.house.gov/f... ASIS ... The bill also gives businesses certainty that cybersecurity information shared with the government would be provided safe harbor and would not lead to frivolous lawsuits, among other protections. http://intelligence.house.gov/sites/intelligence.house.gov/files/documents/CSC113011.pdf http://intelligence.house.gov/sites/intelligence.house.gov/f... "I am please to write to you to express CSC's wholehearted endorsement of the "Cyber Intelligence Sharing and Protection Act of 2011" which you released today and which requires the Director of National Intelligence to establish a program allowing certified organizations to use classified cyber signatures to help protect their IT enterprises... As you know, CSC was the first IT enterprise company invited to join the defense industrial base pilot program (DIB)... This program was quietly started around 2011: http://www.washingtonpost.com/national/major-internet-service-providers-cooperating-with-nsa-on-monitoring-traffic/2011/06/07/AG2dukXH_story.html http://www.washingtonpost.com/national/major-internet-servic... NSA allies with Internet carriers to thwart cyber attacks against defense firms The National Security Agency is working with Internet service providers to deploy a new generation of tools to scan e-mail and other digital traffic with the goal of thwarting cyberattacks against defense firms by foreign adversaries... The Internet carriers are AT&T, Verizon and CenturyLink. Together they are seeking to filter the traffic of 15 defense contractors, including Lockheed, CSC, SAIC and Northrop Grumman. There is at least $6B waiting to go to the defense contractors to help the NSA. (They're already working with the NSA on the big Utah datacenter): ttp://www.bizjournals.com/washington/blog/fedbiz_daily/2013/01/northrop-saic-mantech-among-those-to.html?page=all Northrop, SAIC, ManTech among those to bid for DHS' $6B cyber program Northrop Grumman Corp., ManTech International Corp. and SAIC all confirmed to me their plans to bid as a prime contractor for DHS' Continuous Monitoring as a Service program, which will be worth up to $6 billion over five years