New Draft Of CISPA Announced: Some Progress, Still Big Problems

from the it's-a-start-I-guess dept

The House Intelligence Committee has published a new draft of CISPA (pdf and embedded below), which includes the two amendments that were already approved, plus several other additions and changes. In some areas, there is genuine progress—in others, things actually seem to have gotten worse. Unfortunately, some of the biggest problems with the bill remain, and some of the new language seems to have little effect at all. Some changes I will discuss in future posts, but there are two that I wanted to look at right away:

A Narrower Definition Of Cybersecurity
This is the one clearly positive change in the bill. Previously, the definition of cybersecurity and cyber threat information was:

(A) efforts to degrade, disrupt, or destroy such system or network; or

(B) theft or misappropriation of private or government information, intellectual property, or personally identifiable information.

While the first part remains unchanged, the second part is now much narrower:

(B) efforts to gain unauthorized access to a system or network, including efforts to gain such unauthorized access to steal or misappropriate private or government information

Where the original language could be construed to include all sorts of activity that goes beyond what most people could consider "cybersecurity", the new definition makes it clear that we are talking about unauthorized network access. Most notably, it removes the reference to "intellectual property", which makes sense: the authors have always insisted that they were talking about the misappropriation of secret R&D by foreign entities, which is sufficiently covered by language referring to privacy and unauthorized access. Including "intellectual property" opened it up to all sorts of additional interpretations that went beyond this stated intent.

Now, there's still reason to be a little concerned here, because the attempts to charge people for "unauthorized access" under the CFAA have been ridiculous in the past. If this language in CISPA were construed to include things like violating terms of service (as some have claimed of the CFAA language) then it would be very dangerous. However, with last week's Ninth Circuit ruling which narrowly construed unauthorized access, legal thinking on this matter seems to be heading in the right direction. There's still some gray area, and I think there's still room for a much better definition of cybersecurity in CISPA (I know they want to future-proof it, but it doesn't have to be that short and vague) but this is still a significant improvement over the previous draft.

Extremely Limited Liability For Companies
The new draft of CISPA includes a whole new section carving out the requirements for a company to be held liable if they share information improperly. Basically, a company that shares data with the government receives immunity from all existing privacy laws unless you can show that their actions caused you injury and constituted "willful misconduct"—which is very specifically defined in CISPA as an action taken:

(I) intentionally to achieve a wrongful purpose;
(II) knowingly without legal or factual justification; and
(III) in disregard of a known or obvious risk that is so great as to make it highly probably that the harm of the act or omission will outweigh the benefit.

Yes: and. A company's actions need to satisfy all three of those conditions. I'm not even sure how that's possible. They have to be trying to harm you, knowingly breaking the law and, in a bizarre third clause, they also have to know there is a risk that the harm to you will outweigh the benefits to them. How you are supposed to weigh the harm to individuals whose private data is handed to the government, versus the benefits to cybersecurity services who improve their networks with data, is beyond me. But no matter how you slice it, this is an insanely onerous definition of willful misconduct that makes it essentially impossible to ever sue a company for wrongly sharing data under CISPA.

Overall, despite the progress made on the definition of cybersecurity, CISPA is still a highly problematic bill which still doesn't properly safeguard people's privacy. One of the biggest problems—the fact that the government can use, retain and affirmatively search the information they gather for vaguely defined "national security" purposes—is untouched in the new draft. There are some attempts to alter the rules on how federal agencies can share information between themselves, but many of those changes seem essentially meaningless. It's good to see some reaction from Congress, but if CISPA is to be fixed (a prospect I'm still dubious about) there is still a long way to go.

Hide this

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.

Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.

While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

Filed Under: cispa, cybersecurity, house intelligence committee, liability


Reader Comments

Subscribe: RSS

View by: Time | Thread


  • identicon
    Anonymous Coward, 13 Apr 2012 @ 5:14pm

    "Fix the bill? You mean fix it passing through, right? Fix it after it passes?"

    *After it passes*

    "SORRY, WE HAVE OTHER THINGS TO FOCUS ON RIGHT NOW

    link to this | view in chronology ]

    • identicon
      Anonymous Coward, 14 Apr 2012 @ 2:24am

      Re:

      More like "Fix the bill? We don't know what's wrong with it yet! Pass it first, then talk."

      *after it passes*

      "What do you mean there's something wrong with the bill? You should have said so before it passed; we can't change it now it's passed! It's your fault!"

      link to this | view in chronology ]

  • icon
    Watchit (profile), 13 Apr 2012 @ 6:02pm

    at least some progress was made.

    link to this | view in chronology ]

    • identicon
      Idwal, 16 Apr 2012 @ 11:29am

      Re:

      We need to be careful of thinking like that. That's their tactic. Scare -> Amend -> Pass -> Ratchet

      This bill passes in any form, it's a dozen steps backward. Congress shouldn't get any credit for passing a terrible bill instead of a disasterous one. The Congresscritters who are willing to slay these legislative beasts, however, should get elected for life.

      link to this | view in chronology ]

  • identicon
    Eric Jaffa, 13 Apr 2012 @ 8:40pm

    Still a bill against whistle-blowers

    After a newspaper publishes a story about wrongdoing at an organization, someone can contact the journalist's email-provider and get the emails sent to the journalist, saying that files which show the wrongdoing may have been obtained through "unauthorized access."

    Without a warrant.

    link to this | view in chronology ]

    • icon
      Leigh Beadon (profile), 13 Apr 2012 @ 8:47pm

      Re: Still a bill against whistle-blowers

      That's not really true... CISPA doesn't work that way. Its problems exist on a broader scale to do with how the government is going to collect and mine this data, and the sort of actions it may end up supporting - but it wouldn't be possible for the government to wield CISPA as a weapon against a single journalist like that. I can definitely see ways that CISPA could be used to stifle whisleblowing - but not in such a surgical manner, I don't think

      link to this | view in chronology ]

  • identicon
    Pixelation, 13 Apr 2012 @ 11:01pm

    "including efforts to gain such unauthorized access to steal or misappropriate private...information."

    Wouldn't IP fit within that definition? Wouldn't downloading a song without permission be "unauthorized access"?

    Just sayin'

    link to this | view in chronology ]

    • identicon
      Anonymous Coward, 14 Apr 2012 @ 1:58am

      Re:

      my thoughts exactly. i bet the entertainment industries will be interpreting that part in exactly the way you and i have. we all know their rules. if there is a way for a piece of text to be twisted round and used to their advantage, gaining a way to sue a person for so-called 'copyright infringement', the entertainment industries will do so.
      if a Bill is to be introduced for specific purposes, then have the balls to state all of those specific purposes in a clear, well defined and open manner, so everyone can understand. dont wait until some poor fucker does something wrong, totally unintentionally, then crap all over him!

      link to this | view in chronology ]

      • identicon
        Anonymous Coward, 14 Apr 2012 @ 5:43am

        Re: Re:

        i bet the entertainment industries will be interpreting that part in exactly the way you and i have.

        It matters little what anyone other than the judge thinks.

        link to this | view in chronology ]

    • identicon
      Anonymous Coward, 14 Apr 2012 @ 6:54am

      Response to: Pixelation on Apr 13th, 2012 @ 11:01pm

      If you are referring to file sharing, no because the access isn't unauthorized.

      link to this | view in chronology ]

    • identicon
      Anonymous Coward, 14 Apr 2012 @ 6:57am

      Response to: Pixelation on Apr 13th, 2012 @ 11:01pm

      The provision says unauthorized access to a system or network not the information.

      link to this | view in chronology ]

  • identicon
    Rekrul, 14 Apr 2012 @ 8:00am

    But no matter how you slice it, this is an insanely onerous definition of willful misconduct that makes it essentially impossible to ever sue a company for wrongly sharing data under CISPA.

    That's exactly what they were aiming for. They want it to look like they included liability, without actually including any at all.

    link to this | view in chronology ]

  • identicon
    Pixelation, 14 Apr 2012 @ 9:35am

    What about protests?

    What if people protest against a company or government agency by "disrupting" the system or network?

    Will flooding a Senators servers with letters be considered disruption?

    link to this | view in chronology ]

  • identicon
    cj, 14 Apr 2012 @ 1:15pm

    (III) in disregard of a known or obvious risk that is so great as to make it highly probably that the harm of the act or omission will outweigh the benefit.

    So what will this do to people who post security risk? Sometimes the only way to get the security bug fixed is to post it online.

    link to this | view in chronology ]

  • identicon
    I've had it., 17 Apr 2012 @ 4:36pm

    Why does this keep happening?

    First two bills and an international treaty trying to censor information, and now a massive privacy invasion bill?

    link to this | view in chronology ]


Follow Techdirt
Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Discord

The latest chatter on the Techdirt Insider Discord channel...

Loading...
Recent Stories

This site, like most other sites on the web, uses cookies. For more information, see our privacy policy. Got it
Close

Email This

This feature is only available to registered users. Register or sign in to use it.