New Draft Of CISPA Announced: Some Progress, Still Big Problems
from the it's-a-start-I-guess dept
The House Intelligence Committee has published a new draft of CISPA (pdf and embedded below), which includes the two amendments that were already approved, plus several other additions and changes. In some areas, there is genuine progress—in others, things actually seem to have gotten worse. Unfortunately, some of the biggest problems with the bill remain, and some of the new language seems to have little effect at all. Some changes I will discuss in future posts, but there are two that I wanted to look at right away:
A Narrower Definition Of Cybersecurity
This is the one clearly positive change in the bill. Previously, the definition of cybersecurity and cyber threat information was:
(A) efforts to degrade, disrupt, or destroy such system or network; or
(B) theft or misappropriation of private or government information, intellectual property, or personally identifiable information.
While the first part remains unchanged, the second part is now much narrower:
(B) efforts to gain unauthorized access to a system or network, including efforts to gain such unauthorized access to steal or misappropriate private or government information
Where the original language could be construed to include all sorts of activity that goes beyond what most people could consider "cybersecurity", the new definition makes it clear that we are talking about unauthorized network access. Most notably, it removes the reference to "intellectual property", which makes sense: the authors have always insisted that they were talking about the misappropriation of secret R&D by foreign entities, which is sufficiently covered by language referring to privacy and unauthorized access. Including "intellectual property" opened it up to all sorts of additional interpretations that went beyond this stated intent.
Now, there's still reason to be a little concerned here, because the attempts to charge people for "unauthorized access" under the CFAA have been ridiculous in the past. If this language in CISPA were construed to include things like violating terms of service (as some have claimed of the CFAA language) then it would be very dangerous. However, with last week's Ninth Circuit ruling which narrowly construed unauthorized access, legal thinking on this matter seems to be heading in the right direction. There's still some gray area, and I think there's still room for a much better definition of cybersecurity in CISPA (I know they want to future-proof it, but it doesn't have to be that short and vague) but this is still a significant improvement over the previous draft.
Extremely Limited Liability For Companies
The new draft of CISPA includes a whole new section carving out the requirements for a company to be held liable if they share information improperly. Basically, a company that shares data with the government receives immunity from all existing privacy laws unless you can show that their actions caused you injury and constituted "willful misconduct"—which is very specifically defined in CISPA as an action taken:
(I) intentionally to achieve a wrongful purpose;
(II) knowingly without legal or factual justification; and
(III) in disregard of a known or obvious risk that is so great as to make it highly probably that the harm of the act or omission will outweigh the benefit.
Yes: and. A company's actions need to satisfy all three of those conditions. I'm not even sure how that's possible. They have to be trying to harm you, knowingly breaking the law and, in a bizarre third clause, they also have to know there is a risk that the harm to you will outweigh the benefits to them. How you are supposed to weigh the harm to individuals whose private data is handed to the government, versus the benefits to cybersecurity services who improve their networks with data, is beyond me. But no matter how you slice it, this is an insanely onerous definition of willful misconduct that makes it essentially impossible to ever sue a company for wrongly sharing data under CISPA.
Overall, despite the progress made on the definition of cybersecurity, CISPA is still a highly problematic bill which still doesn't properly safeguard people's privacy. One of the biggest problems—the fact that the government can use, retain and affirmatively search the information they gather for vaguely defined "national security" purposes—is untouched in the new draft. There are some attempts to alter the rules on how federal agencies can share information between themselves, but many of those changes seem essentially meaningless. It's good to see some reaction from Congress, but if CISPA is to be fixed (a prospect I'm still dubious about) there is still a long way to go.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: cispa, cybersecurity, house intelligence committee, liability
Reader Comments
Subscribe: RSS
View by: Time | Thread
*After it passes*
"SORRY, WE HAVE OTHER THINGS TO FOCUS ON RIGHT NOW
[ link to this | view in thread ]
[ link to this | view in thread ]
Still a bill against whistle-blowers
Without a warrant.
[ link to this | view in thread ]
Re: Still a bill against whistle-blowers
[ link to this | view in thread ]
Wouldn't IP fit within that definition? Wouldn't downloading a song without permission be "unauthorized access"?
Just sayin'
[ link to this | view in thread ]
Re:
if a Bill is to be introduced for specific purposes, then have the balls to state all of those specific purposes in a clear, well defined and open manner, so everyone can understand. dont wait until some poor fucker does something wrong, totally unintentionally, then crap all over him!
[ link to this | view in thread ]
Re:
*after it passes*
"What do you mean there's something wrong with the bill? You should have said so before it passed; we can't change it now it's passed! It's your fault!"
[ link to this | view in thread ]
Re: Re:
It matters little what anyone other than the judge thinks.
[ link to this | view in thread ]
Response to: Pixelation on Apr 13th, 2012 @ 11:01pm
[ link to this | view in thread ]
Response to: Pixelation on Apr 13th, 2012 @ 11:01pm
[ link to this | view in thread ]
That's exactly what they were aiming for. They want it to look like they included liability, without actually including any at all.
[ link to this | view in thread ]
What about protests?
Will flooding a Senators servers with letters be considered disruption?
[ link to this | view in thread ]
Re:
[ link to this | view in thread ]
So what will this do to people who post security risk? Sometimes the only way to get the security bug fixed is to post it online.
[ link to this | view in thread ]
Re: Re: Re:
[ link to this | view in thread ]
Re: Re: Re: Re:
[ link to this | view in thread ]
Re:
This bill passes in any form, it's a dozen steps backward. Congress shouldn't get any credit for passing a terrible bill instead of a disasterous one. The Congresscritters who are willing to slay these legislative beasts, however, should get elected for life.
[ link to this | view in thread ]
Why does this keep happening?
[ link to this | view in thread ]