4 ms·
Can you tell a short story about how the legally-binding privacy protections in this bill work, that would prevent sharing with the government without a warrant
by mscarborough 14y ago
Can you tell a short story about how the legally-binding privacy protections in this bill work, that would prevent sharing with the government without a warrant?
The onus is not on the opposition to this bill to explain how privacy will go wrong, it is on the supporters since it is a new law with vague language and far-reaching potential consequences.
Also, having privacy amendments shot down or not brought to vote doesn't make CISPA seem very democratic.
- tptacek 14y agoThe whole point of the bill is to facilitate the sharing of a limited set of operational network security data without warrants or court orders, so it is very difficult to respond to your question.
- lawnchair_larry 14y agoNothing about the bill suggests it will be limited to operational network security data, so you should stop spreading this untruth. In fact, it's pretty obvious that it won't be just netflows. (For those following and don't know what a netflow is, it doesn't contain payload data. It's more or less headers and statistics. Nothing about CISPA attempts to limit information to netflows only.)
- diminoten 14y agoSo the whole "directly related to a cyber threat" thing doesn't limit the data that can be shared in any way? I wish this bill were more focused on network security events and didn't have any language in it to deal with stuff like cyberbullying, but I'm glad it's moving forward. Worst case scenario we find it in the Supreme Court where it gets narrowed to be more like what it should have been written as. Happens all the time, we're not going to wake up to a dystopian future with silent arrests and "we have always been at (cyber) war with Eastasia!" the day this passes.
- tptacek 14y agoI don't think it's very honest of you to suggest that I'm claiming CISPA only covers Netflow information. I use Netflow as an example of the kind of benign information that is difficult to share today, and would be easier to share under CISPA. I've explicitly described scenarios that could include message payloads on these threads, and I know you've read those messages because you've replied to them.
- moens 14y agoBut, a simple call to followTheMoney(Players, Amounts) will give you a pretty clear understanding. Note also that "limited" in governmental terms is about sigma shy of "all."
- warfangle 14y agoCompany holds Bob's health records on their servers, and also some of his emails. Company forwards health records along with emails to the USG, even though emails were only what was requested by the USG. Company cannot be held liable for HIPAA violation. IANAL.
- tptacek 14y agoCISPA allows only for the sharing of "cyber threat intelligence", which is defined as: (i) A vulnerability (ii) A threat to the integrity, confidentiality, or availability of a system or network or any info stored or transiting one (iii) Efforts to deny access (iv) Efforts to gain unauthorized access (with the exception that violations of consumer terms of service are not covered by CISPA) Help me understand the scenario in which anyone would push health records in response to any of these 4 scenarios?
- warfangle 14y agoAnd what kind of judicial oversight? Meant to say "accidentally" w.r.t. health records.
- tptacek 14y agoThe whole point of the bill is to enable real-time operational network security information. You can get a court order to share data today.
- warfangle 14y agoSo.... if some of said data was not actually necessary for network security, I'm SOL? Yeah. I'm not down with that. 4th amendment and all that.
- Daiz 14y ago>Efforts to gain unauthorized access So basically anything goes as per the CFAA definition of "unauthorized access"? weev got thrown into jail for it, and all he did was increment a number in a URL.