As Predicted, Congress Turned CISA Into A Clear Surveillance Bill... And Put It Into The 'Must Pass' Gov't Funding Bill

from the but-of-course dept

Yesterday we warned that Congress was quietly looking to do two horrible things: (1) strip all pretense from the "cybersecurity" information sharing bills and turn them into full-on surveillance bills and (2) then shove it into the "must pass" omnibus bill which is supposed to be about funding the government and nothing more. And... it looks like our warning was almost entirely accurate, as the bill has been released and within its over 2000 pages, it includes CISA and has been stripped of many of the key privacy protections (if you want to find it, it's buried on page 1728), while expanding how the information can be shared and used. In part, due to concerns raised yesterday, a few of the absolutely worst ideas didn't make it into the final bill, but it's still bad (and clearly worse than what had previously been voted on, which was already bad!).

The bill is due for a vote tomorrow and so right now would be the time to call your elected officials and let them know that this is a serious problem. The EFF has spoken out about how problematic this is, as have a group of free market think tanks.

There is some opposition within Congress to this. We've seen a "Dear Colleague" letter sent around by a set of four members of Congress (two from each party) -- Reps. Zoe Lofgren, Justin Amash, Jared Polis and Ted Poe -- opposing this move, but chances are that most members of Congress actually have no idea that this is happening, which is why you should be calling today to let them know how problematic this is.

The House Intelligence Community counters that the claims being made against CISA are inaccurate, but they're being incredibly misleading. While the reports yesterday indicated that the bill would directly allow its use in "surveillance," the list of approved uses was changed slightly to effectively hide this fact. Specifically it says that the information via CISA can be used to investigate a variety of crimes -- and doesn't say "surveillance." But, obviously, surveillance isn't a "crime" that the government will be investigating. It's just the method that the government will use to investigate crimes... which is now allowed under CISA. In earlier versions, the information was only to be used for "cybersecurity." But now that list has been expanded to cover a wide variety of crimes: "a specific threat of death, a specific threat of serious bodily harm, or a specific threat of serious economic harm, including a terrorist act or a use of a weapon of mass destruction."

And how are those things going to be stopped? By ramping up surveillance, of course.

Also, yesterday we noted that the proposed change would "remove" the privacy scrub requirements. The final bill didn't completely do that, but basically changed the standard to pretend that it's in there. Rather than demanding a full privacy scrub, the bill lets the Attorney General determine if DHS is doing a reasonable job with its privacy scrub. The same Attorney General who will now be using this same information to investigate all sorts of "criminal" activity. Guess what incentive the Attorney General has to make sure that privacy scrub is legit?

Finally, the revised bill tries to hide the fact that the NSA will get access to this data with some super crafty language. Section 105(c) of the bill notes that the President can designate any other agency to set up a portal to receive information, but explicitly says that cannot be the Defense Department or the NSA. That sounds good, but is there as a total red herring. This is only about who runs the portal, not about who gets the information. So, DHS can still share the info with others and the President could still designate, say, the FBI to get a portal... or the Director of National Intelligence (which oversees the NSA). However, CISA's supporters are pointing to this sections as "proof" that it won't be used by the NSA.

Considering how much debate and concern there was over this bill, and the fact that basically all the major companies in Silicon Valley have come out against it -- and I still can't find a single computer security expert who thinks that this is needed for increasing our security, it's pretty obvious that this is not a cybersecurity bill. It's a surveillance bill that has no business being added to the omnibus bill.

Filed Under: cisa, cybersecurity, dhs, nsa, omnibus, omnibus bill, surveillance

Congress Drops All Pretense: Quietly Turns CISA Into A Full On Surveillance Bill

from the even-worse-than-before dept

Remember CISA? The "Cybersecurity Information Sharing Act"? It's getting much, much worse, with Congress and the administration looking to ram it through -- in the process, dropping any pretense that it's not a surveillance bill.

As you may recall, Congress and the White House have been pushing for a "cybersecurity" bill, for a few years now, that has never actually been a cybersecurity bill. Senator Ron Wyden was one of the only people in Congress willing to stand up and directly say what it was: "it's a surveillance bill by another name." And, by now, you should know that when Senator Wyden says that there's a secret interpretation of a bill that will increase surveillance and is at odds with the public's understanding of a bill, you should to listen. He's said so in the past and has been right... multiple times.

Either way, a version of CISA passed the House a while back, with at least some elements of privacy protection included. Then, a few months ago it passed the Senate in a much weaker state. The two different versions need to be reconciled, and it's been worked on. However, as we noted recently, the intelligence community has basically taken over the process and more or less stripped out what few privacy protections there were.

And the latest is that it's getting worse. Not only is Congress looking to include it in the end of year omnibus bill -- basically a "must pass" bill -- to make sure it gets passed, but it's clearly dropping all pretense that CISA isn't about surveillance. Here's what we're hearing from people involved in the latest negotiations. The latest version of CISA that they're looking to put into the omnibus:

1. Removes the prohibition on information being shared with the NSA, allowing it to be shared directly with NSA (and DOD), rather than first having to go through DHS. While DHS isn't necessarily wonderful, it's a lot better than NSA. And, of course, if this were truly about cybersecurity, not surveillance, DHS makes a lot more sense than NSA.
2. Directly removes the restrictions on using this information for "surveillance" activities. You can't get much more direct than that, right?
3. Removes limitations that government can only use this information for cybersecurity purposes and allows it to be used to go after any other criminal activity as well. Obviously, this then creates tremendous incentives to push for greater and greater information collection, which clearly will be abused. We've just seen how the DEA has regularly abused its powers to collect info. You think agencies like the DEA and others won't make use of CISA too?
4. Removes the requirement to "scrub" personal information unrelated to a cybersecurity threat before sharing that information. This was the key point that everyone kept making about why the information should go to DHS first -- where DHS would be in charge of this "scrub". The "scrub" process was a bit exaggerated in the first place, but it was at least something of a privacy protection. However, it appears that the final version being pushed removes the scrub requirement (along with the requirement to go to DHS) and instead leaves the question of scrubbing to the "discretion" of whichever agency gets the information. Guess how that's going to go?

In short: while before Congress could at least pretend that CISA was about cybersecurity, rather than surveillance, in this mad dash to get it shoved through, they've dropped all pretense and have stripped every last privacy protection, expanded the scope of the bill, and made it quite clear that it's a very broad surveillance bill that can be widely used and abused by all parts of the government.

There is still some hesitation by some as to whether or not this bill belongs in the omnibus bill, or if it should go through the regular process, with a debate and a full vote on this entirely new and different version of CISA. So, now would be a good time to speak out, letting your elected officials and the White House know that (1) CISA should not be in the omnibus and (2) that we don't need another surveillance bill.

In the meantime, if Congress were actually serious about cybersecurity, they'd be ramping up the acceptance and use of encryption, rather than trying to undermine it.

Filed Under: cisa, congress, cybersecurity, dhs, nsa, omnibus, surveillance

Final Text Of CISA Apparently Removed What Little Privacy Protections Had Been In There

from the surprise-surprise dept

Back in October, the Senate voted overwhelmingly to approve CISA, the Cybersecurity Information Sharing Act, which has nothing to with cybersecurity at all, and is almost entirely a surveillance bill in disguise. Want to know the proof: many of the most vocal supporters of CISA, who talked up how important "cybersecurity" is these days are the very same people now looking to undermine encryption.

Either way, there were significant differences between the version approved in the House, and thus Congress needed to reconcile the bills -- and apparently that means removing what little privacy protections were already in the bill:

And it now appears the final language is unlikely to include notable privacy provisions that digital rights and civil liberties groups insist are necessary to reduce the odds the bill enables greater government surveillance.

Basically, it looks like Congressional leadership decided to pull the worst parts from the various bills and mash them together into a super bill of pure terribleness. Not only will it favor the Senate bill, over the House's, but it will also pull ideas from the competing bill that was put forth by the House Intelligence Committee, rather than the one put forth by the Homeland Security Committee.

That, alone, should be rather telling. For all the talk about how this is about "security" and not at all about helping the intelligence community, why is it that the Intelligence Committee's bill whose language is surviving, while the Homeland Security Committee's language is being deleted?

Filed Under: cisa, congress, cybersecurity, house, privacy, senate

A Month Ago, Dianne Feinstein Said Cybersecurity Was Super Important... Now She Says We Should Undermine Encryption

from the which-side-is-she-on? dept

Look, everyone has known for quite some time that Senator Dianne Feinstein's big push for so-called "cybersecurity" legislation in the form of CISA had absolutely nothing to do with cybersecurity. It was always about giving another surveillance tool to her friends at the NSA. However, given that she was one of the most vocal in selling it as a "cybersecurity" bill (despite the fact that no cybersecurity experts actually thought the bill would help) it seems worth comparing her statements from just a month ago, with her new attacks on actual cybersecurity in the form of encryption.

Here is Feinstein just a month ago, claiming to worry about "cyberattacks" on Americans:

"Millions of personal records and hundreds of billions of dollars fall victim to cyber-attacks every year, and we’ve done little to stem the tide."

Of course, CISA does nothing to protect any of that. You know what does protect against that -- better use of encryption to keep that information from getting hacked in any useful manner.

Okay, fast forward. Following the Paris attacks, Feinstein has been among the most vocal in claiming that we need to undermine encryption, which is pretty amazing given that she represents California (and is from San Francisco), home to tons of tech companies that actually get this and think she's completely crazy for undermining actual cybersecurity.

Never mind that, though. Here she is this past weekend, on CBS's Face the Nation totally attacking encryption itself and mocking the tech companies that just a month ago she was insisting needed special government help to protect against cyberattacks. She was asked if the intelligence community has the tools it needs, and she decides to attack encryption -- even choosing to cite as a source CIA director John Brennan -- the same John Brennan who illegally spied on her staffers and then lied about it repeatedly.

"I can say this. [FBI] Director [James Comey] and, I think John Brennan, would agree, that the Achilles Heel in the internet is encryption. Because there are now... it's a black web! And there's no way of piercing it. And this is even in commercial products! PlayStation, John! Which our kids use. If the two ends communicate, that's encrypted. So terrorists can use PlayStation to be able to communication and there's nothing that can be done about it."

The host, John Dickerson, then points out that the tech industry (again, mostly based in or near Feinstein's hometown, and that she's supposed to be representing) says that backdooring encryption makes us less safe and opens us up to more attack, and Feinstein brushes it off, relying on her apparent years of computer security training...

No. I don't think so. I think with a court order, with good justification, all of that can be prevented. It can be prevented in Europe, because Europe has been a major driver for more encryption. And I think that they are now seeing the results. I have visited with all of the General Counsels of the tech companies, just to try to get them to take bomb building recipes off the internet. Recipes that have been tested and we know can explode a plane. Directions. Where to sit on the plane to blow it up. We know that there are bombs that can go through magnetometers. And to put that information out on the internet, is terrible. And I sorta got 'well, pass a law.' So, we may just have to do that. But I am hopeful that the companies, most of whom are my constituents -- not most, but many -- will understand what we're facing. And we're not crying wolf. There's good reason for this. And people are dying all over the world. And I think the Sinai-Russian airliner is a classic example of a bomb that got on a plane, that blew up that plane.

Where to start with this nonsense? First, note that she doesn't actually respond to the question concerning how undermining encryption will make us all less safe and make all that information Feinstein herself claimed was under attack just a month ago more vulnerable, other than to say that she, personally, doesn't think that what every computer security expert has been saying is true. Yikes.

Second, rather than focus on encryption, she pivots to her other pet projects, claiming that the government should force internet companies to censor The Anarchist's Cookbook. She keeps on this despite the fact that all the way back in 1997, the DOJ directly told Feinstein that this would violate the First Amendment. From the DOJ to Feinstein:

The First Amendment would impose substantial constraints on any attempt to proscribe indiscriminately the dissemination of bombmaking information. The government generally may not, except in rare circumstances, punish persons either for advocating lawless action or for disseminating truthful information -- including information that would be dangerous if used -- that such persons have obtained lawfully.

Third, this weird infatuation with The Anarchist's Cookbook, despite the fact that it's generally recognized as a joke for fools, where the likelihood of being able to build an actual bomb from it are minimal at best. And, while she pretends that the GCs of tech companies just sort of shrugged their shoulders about this, it's much more likely that it's because they thought she was being ridiculous trying to censor the internet in violation of the First Amendment. Whoever told her "well, pass a law" was almost certainly trying to get rid of her, knowing that any such law would be unconstitutional.

Fourth, this tangent about "bomb making instructions" online still has absolutely nothing to do with encryption or the question about how encryption makes us all much more vulnerable to attack and actually makes us all less safe.

Fifth, the comment about Europe is insane. Again, while the attackers may have used some encryption, it's been revealed (since long before Feinstein did this interview) that they did an awful lot of communicating in the clear, including unencrypted SMS and Facebook messenger. On top of that, what the hell does "Europe has been a major driver for more encryption" even mean? Perhaps it's true that they've been adopting more encryption to hide from the NSA's spying that Feinstein herself helped hide from everyone.

Sixth: the whole PlayStation thing has been debunked as a way that the Paris attackers communicated. They did not. Furthermore, she's just wrong that the PlayStation has end-to-end encryption. It does not.

Seventh, does she honestly believe that whoever blew up that Russian airplane downloaded bomb-making instructions from the internet? Also, if it were really so easy to get such instructions and get them through security, don't you think we'd have seen a lot more airplanes blown up by now?

In summary, Feinstein (a month ago) said we should all be deathly afraid of cyberattacks, and the only way to solve it was to give the government much greater access to companies' computer systems, via CISA. And, now, she insists that encryption is an "Achilles's heel" and that actual cybersecurity experts are lying when they say undermining encryption will put everyone at risk. Why? Because The Anarchist's Cookbook is online and Google won't take it down.

Is it really so much to ask for politicians to actually understand technology before they go off on ridiculous, ignorant, uninformed rants about it -- often leading to even more ridiculous and dangerous legislation?

Filed Under: cisa, cybersecurity, dianne feinstein, encryption, going dark, surveillance, terrorists

Senate Passes CISA, The Surveillance Bill Masquerading As A Cybersecurity Bill; Here's Who Sold Out Your Privacy

from the it's-not-over-yet dept

After rejecting all the good privacy amendments to CISA, the Senate has now officially passed the legislation by a 74 to 21 vote. About the only "good" news is that the vote is lower than the 83 Senators who voted for cloture on it last week. Either way, the Senate basically just passed a bill that will almost certainly be used mainly for warrantless domestic surveillance, rather than any actual cybersecurity concern.

If you'd like to know which Senators voted for greater domestic surveillance, here's your list:

• Alexander (R-TN)
• Ayotte (R-NH)
• Barrasso (R-WY)
• Bennet (D-CO)
• Blumenthal (D-CT)
• Blunt (R-MO)
• Boozman (R-AR)
• Boxer (D-CA)
• Burr (R-NC)
• Cantwell (D-WA)
• Capito (R-WV)
• Carper (D-DE)
• Casey (D-PA)
• Cassidy (R-LA)
• Coats (R-IN)
• Cochran (R-MS)
• Collins (R-ME)
• Corker (R-TN)
• Cornyn (R-TX)
• Cotton (R-AR)
• Donnelly (D-IN)
• Durbin (D-IL)
• Enzi (R-WY)
• Ernst (R-IA)
• Feinstein (D-CA)
• Fischer (R-NE)
• Flake (R-AZ)
• Gardner (R-CO)
• Gillibrand (D-NY)
• Grassley (R-IA)
• Hatch (R-UT)
• Heinrich (D-NM)
• Heitkamp (D-ND)
• Hirono (D-HI)
• Hoeven (R-ND)
• Inhofe (R-OK)
• Isakson (R-GA)
• Johnson (R-WI)
• Kaine (D-VA)
• King (I-ME)
• Kirk (R-IL)
• Klobuchar (D-MN)
• Lankford (R-OK)
• Manchin (D-WV)
• McCain (R-AZ)
• McCaskill (D-MO)
• McConnell (R-KY)
• Mikulski (D-MD)
• Moran (R-KS)
• Murkowski (R-AK)
• Murphy (D-CT)
• Murray (D-WA)
• Nelson (D-FL)
• Perdue (R-GA)
• Peters (D-MI)
• Portman (R-OH)
• Reed (D-RI)
• Reid (D-NV)
• Roberts (R-KS)
• Rounds (R-SD)
• Sasse (R-NE)
• Schatz (D-HI)
• Schumer (D-NY)
• Scott (R-SC)
• Sessions (R-AL)
• Shaheen (D-NH)
• Shelby (R-AL)
• Stabenow (D-MI)
• Thune (R-SD)
• Tillis (R-NC)
• Toomey (R-PA)
• Warner (D-VA)
• Whitehouse (D-RI)
• Wicker (R-MS)

And here's the tragically short list of the 21 who voted against this.

• Baldwin (D-WI)
• Booker (D-NJ)
• Brown (D-OH)
• Cardin (D-MD)
• Coons (D-DE)
• Crapo (R-ID)
• Daines (R-MT)
• Franken (D-MN)
• Heller (R-NV)
• Leahy (D-VT)
• Lee (R-UT)
• Markey (D-MA)
• Menendez (D-NJ)
• Merkley (D-OR)
• Risch (R-ID)
• Sanders (I-VT)
• Sullivan (R-AK)
• Tester (D-MT)
• Udall (D-NM)
• Warren (D-MA)
• Wyden (D-OR)

If you're wondering what happens now: the Senate version and the House version are different, so the differences need to be resolved in conference. There's a chance that could lead to the bill being made better, but it's more likely that the bill will actually be made worse. And then, of course, assuming no substantial changes, it would go to the President's desk for signature. So the bill is pretty far along, but it can still be stopped. Senator Ron Wyden, who has led the fight against it says he's not giving up yet.

Filed Under: cisa, congress, cybersecurity, senate, surveillance

Senate Rejects All CISA Amendments Designed To Protect Privacy, Reiterating That It's A Surveillance Bill

from the the-exclamation-point dept

In case you weren't already convinced that CISA is a surveillance bill masquerading as a cybersecurity bill, today the Senate rejected four separate amendments to the bill that attempted to better protect the privacy of Americans. Senator Wyden had an amendment to require the removal of personal information before information could be shared, which was voted down 55 to 41. Senator Heller had an amendment that was basically a backstop against the Wyden amendment, saying that if the Wyden amendment didn't pass, Homeland Security would be responsible for removing such personal information. That amendment also failed by a 49 to 47 vote. Senator Leahy had an amendment that would have removed FOIA exemptions in the bill (making it much less transparent how CISA was used). That amendment was voted down 59 to 37. Senator Franken then had an amendment that would have "tightened" the definition of cybersecurity threats, so that the shared information needed to be "reasonably likely" to cause damage, as opposed to the current "may" cause damage. And (you guess it, because you're good at this), it was also voted down by a 60 to 35 vote.

Meanwhile, Marcy Wheeler notes that the revised version of the bill by Senators Burr and Feinstein, which claimed to incorporate greater transparency requirements proposed by Senator Tester, actually takes away a lot of transparency and actually makes it more difficult for Congress to learn whether or not CISA is being used for domestic surveillance:

That Burr and DiFi watered down Tester’s measures so much makes two things clear. First, they don’t want to count some of the things that will be most important to count to see whether corporations and agencies are abusing this bill. They don’t want to count measures that will reveal if this bill does harm.

Most importantly, though, they want to keep this information from Congress. This information would almost certainly not show up to us in unclassified form, it would just be shared with some members of Congress (and on the House side, just be shared with the Intelligence Committee unless someone asks nicely for it).

But Richard Burr and Dianne Feinstein want to ensure that Congress doesn’t get that information. Which would suggest they know the information would reveal things Congress might not approve of.

Once again, these kinds of actions really only make sense if CISA is being used to justify warrantless domestic surveillance. Which once again raises the question of why Congress is willing to move forward with such a surveillance bill. We just went through a whole process showing that the public is not comfortable with secret laws and secret interpretations that lead to surveillance. Why would they immediately push for a new secret law that expands surveillance and reject any and all attempts at protecting the privacy of the American public or any sort of transparency and accountability in how the bill is used?

The bill is positioned as a cybersecurity bill, but good luck finding a single computer security expert who actually thinks the bill is either useful or necessary. I've been trying and so far I can't find any.

Filed Under: al franken, cisa, dean heller, dianne feinstein, pat leahy, privacy, richard burr, ron wyden, senate, surveillance, transparency

Senior Former Intelligence Official Admits That 'The Point' Of CISA Is Surveillance

from the of-course dept

Senator Ron Wyden -- who has been fighting back against secret laws expanding surveillance for years -- made it clear months ago that CISA was really "a surveillance bill by another name." Of course, if you just read the bill it might not appear that way, because you need to understand how it works with a variety of secret orders and surveillance authorities -- along with secret interpretations of the law. We've tried to piece together how CISA is filling in a big missing blank in what the intelligence community needs to conduct broad warrantless domestic surveillance on internet users (something that it has been restricted from doing in the past few years).

Marcy Wheeler has uncovered another little tidbit -- buried in a CNN article all about CISA, in which the reporter speaks to a former senior US intelligence official:

"Would it give our spy agencies greater visibility? Definitely. That's the point," the official said.

Except, of course, the backers of the bill, Senators Richard Burr and Dianne Feinstein have been basically shoving each other aside to insist that's not the point at all. They keep insisting that the bill has nothing to do with surveillance or the intelligence community and is just about domestic cybersecurity efforts, and that everyone's supposedly barred from doing more with it (until you look at the fine print, of course). Of course, it's possible that this is just a misstatement by the nameless former official, but it might also be a pretty clear admission of what most folks have been saying from the beginning. CISA is a surveillance bill, disguised to look like it's about "cybersecurity."

Filed Under: cisa, cybersecurity, fbi, nsa, surveillance

Reading The Tea Leaves To Understand Why CISA Is A Surveillance Bill

from the it's-not-as-easy-as-you'd-think dept

I've had a few conversations recently with people on Twitter who claim that CISA is "not a surveillance bill," claiming that they've read the bill and there's nothing about surveillance in it. It's true that the bill positions itself as nothing more than a "cybersecurity" bill that clarifies a few things and then provides some immunity for companies who "voluntarily" share information. However, as I've said in response, in order to understand why it's a surveillance bill, you have to look more closely at how CISA interacts with other laws and what the intelligence community is currently doing. Unfortunately, this isn't always easy, because part of what the intelligence community is doing and how they've interpreted other laws remains secret. But, as you've probably heard, some of that has been leaking out over the past few years.

Back in June, we wrote about Jonathan Mayer's analysis of another leak story done by Pro Publica and the NY Times, showing that the FBI and the NSA blurred the lines between "terrorism" and "cybercrime" in order to do more warrantless surveillance of people they deemed to be "hackers." As Mayer noted at the time, this revealed that beyond the kinds of selectors most people believed the FBI and NSA were allowed to search the "upstream" corpus of data on, it could also use "cybersignatures." And thus, it seemed clear that CISA was about expanding the ability of the FBI and the NSA to get access to more such signatures, in order to more widely do warrantless surveillance on Americans' communications.

You have to dig a bit deeper into the muck to understand why this is true, and it has to do with another recently revealed tidbit, which is that the NSA and FBI (and CIA, for that matter), frequently make use of backdoor searches of the upstream data -- a capability that was approved in 2011. Basically, the rules changed so that the intelligence community could sniff through data that was deemed collected "incidentally." And that includes basically anything that is picked up in the "upstream" collection of data (tapping internet backbone lines) under Section 702 of the FISA Amendments Act.

Now, Marcy Wheeler has taken this a step further, noting that it looks like Mayer's analysis may actually have underplayed things. Wheeler's post is long and detailed, and delves deeply into more partially secret things, and tries to read the tea leaves from some previously declassified and leaked documents and programs, but comes to the conclusion that CISA is likely to be the key piece for letting the NSA and FBI warrantless spy on Americans' after the FISA Court limited that ability a few years ago.

Without going into all the details of Wheeler's post, the short version is that it's well established that the NSA used to have a program very similar to the phone dragnet program, but for internet communications. Eventually that was determined to go too far and was shut down. But Wheeler is suggesting that a more narrow version was likely re-authorized later, and CISA is the way to expand it. It appears that the intelligence community was allowed to collect online info, but only to protect its own network. But, with the immunity granted under CISA, the NSA and FBI could effectively hand that power over to AT&T and Verizon, and freely "share" information back and forth with no liability for the telcos (both of which have a long history of proactively helping the NSA).

That is, CISA affirmatively permits private companies to scan, identify, and possess cybersecurity threat information transiting or stored on their systems. It permits private companies to conduct precisely the same kinds of scans the government currently obligates telecoms to do under upstream 702, including data both transiting their systems (which for the telecoms would be transiting their backbone) or stored in its systems (so cloud storage).

Thus, CISA permits the telecoms to do the kinds of scans they currently do for foreign intelligence purposes for cybersecurity purposes in ways that (unlike the upstream 702 usage we know about) would not be required to have a foreign nexus. CISA permits the people currently scanning the backbone to continue to do so, only without consideration of whether the signature has a foreign tie or not. Unlike FISA, CISA permits the government to collect entirely domestic data.

Of course, there’s no requirement that the telecoms scan for every signature the government shares with it and share the results with the government. Though both Verizon and AT&T have a significant chunk of federal business — which just got put out for rebid on a contract that will amount to $50 billion — and they surely would be asked to scan the networks supporting federal traffic for those signatures. But they can do so if they want to. And the telecoms are outspoken supporters of CISA, so we should presume they plan to share promiscuously under this bill.

As Wheeler notes, if this is true, then it actually makes CISA a super powerful surveillance tool for the government for a variety of reasons. First, it's all "voluntary" between the telcos and the NSA/FBI, so no FISA Court to get in the way. Next, she points out that, while the language of the bill says that Homeland Security will "scrub" private info before sharing it with other agencies, it actually notes that the FBI can "veto" that scrub. And working together, the NSA and FBI can do a lot of damage this way:

CISA, as written, would let FBI and NSA veto any scrub (including of content) at DHS. And incoming data (again, probably including content) would be shared immediately not only with FBI (which has been the vehicle for sharing NSA data broadly) but also Treasury and ODNI, which are both veritable black holes from a due process perspective. And what few protections for US persons are tied to a relevance standard that would be accomplished by virtue of a tie to that selector. Thus, CISA would permit the immediate sharing, with virtually no minimization, of US person content across the government (and from there to private sector and local governments).

As she notes, this makes CISA -- as Senator Ron Wyden has been saying for months -- not a cybersecurity bill at all, but a vast domestic internet surveillance bill.

Filed Under: cisa, cybersignatures, fbi, marcy wheeler, nsa, section 702, surveillance, upstream
Companies: at&t, verizon

While Most Of The Rest Of The Internet Industry Is Fighting Against CISA, Facebook Accused Of Secretly Lobbying For It

from the this-is-a-concern dept

For the past few years, much of the internet industry had been mostly silent on CISA, or vaguely for it, mainly because it would provide them immunity from liability if they share too much information with the government. However, as more details have come out about CISA, making it clear that it's a surveillance bill, rather than any sort of cybersecurity bill, the internet industry has finally, mostly come out against it. It started with Salesforce.com, after people started protesting a letter it had signed saying it favored "cybersecurity" legislation, but without naming CISA. In response, Salesforce came out directly and said that it did not support CISA. Soon after that, the BSA (the Business Software Alliance, which now prefers to just be called "The Software Alliance"), which had put together the letter Salesforce signed, said that it did not support CISA (or any of the other cybersecurity bills that have been introduced). Soon after that, CCIA, which represents a bunch of internet companies, came out directly against CISA, saying:

CCIA is unable to support CISA as it is currently written. CISA’s prescribed mechanism for sharing of cyber threat information does not sufficiently protect users’ privacy or appropriately limit the permissible uses of information shared with the government. In addition, the bill authorizes entities to employ network defense measures that might cause collateral harm to the systems of innocent third parties.

With that, the ball was rolling. Both Apple and Dropbox directly came out against CISA. Then Twitter, Yelp, Wikimedia and Reddit.

However, the folks at Fight for the Future, who have been working hard to stop CISA, are now claiming that they have it on good authority that Facebook is one of the only internet companies secretly lobbying in favor of the bill and is asking people to sign its petition to convince Facebook to back down:

This bill is toxic. The public hates it and tons of tech companies are against it, but Congress keeps trying to ram it through. Now that we know that Facebook lobbyists are working behind the scenes to get it passed, it makes more sense why Congress keeps coming back to it.

Facebook’s chief Senate lobbyist, Myriah Jordan, worked as General Counsel for CISA's sponsor, Senator Richard Burr, right up until taking the job at Facebook. On her lobbying disclosures she lists “cybersecurity” as one of the issues she's been discussing with senators. These “revolving door” connections give companies more power and influence than ordinary people could ever have, and it’s part of the reason why companies like Facebook think they can get whatever they want out of Washington.

Several offices on the Hill have heard from Facebook that they support CISA. As much as we wish we could reveal our sources, we agreed not to (selective leaking is part of how the lobbying game works, unfortunately). But this information matches with everything we know about Facebook's love for CISA over the years. They backed the bill loudly before it was unpopular and then stayed silent as other big tech companies came out against it. We've asked them to state their position publicly, bu they have said nothing. Facebook has backed this from day one, and now they're the lone tech voice still working to make sure it passes.

This would seem to be very unfortunate if it's true, and hopefully Facebook reconsiders. While Apple, Twitter, Yahoo, Google, LinkedIn and others have been quite vocal in fighting back against government surveillance, Facebook has been much less involved in those fights -- despite the fact that it often has more information than those other players. Facebook seems increasingly out of step with the rest of the internet industry in making sure that protecting the privacy of their users against government surveillance is a top priority. Hopefully, the company changes its position on this.

Update: For what it's worth, Facebook is now denying the story, saying that it has not taken a position either for or against CISA (and doesn't seem interested in doing so either way). That still seems like an odd position to take given that most of the other companies in the industry have come out against the bill. And, in addition, I've now heard from others on Capitol Hill as well supporting the statements from Fight for the Future that Facebook is considered to be in favor of CISA, though it's not clear if the company has been actively lobbying for it.

Filed Under: cisa, cybersecurity, lobbying, surveillance, tech industry
Companies: facebook

CISA Moves Forward: These 83 Senators Just Voted To Expand Surveillance

from the ridiculous dept

Well, it's not a huge surprise that it moved forward, but the faux "cybersecurity" bill, which is actually a surveillance bill in disguise, CISA, has moved forward in the Senate via an overwhelming 83 to 14 vote. As we've discussed at length, while CISA is positioned as just a "voluntary" cybersecurity information sharing bill, it's really none of those things. It's not voluntary and it's not really about cybersecurity. Instead, it's a surveillance bill, that effectively gives the NSA greater access to information from companies in order to do deeper snooping through its upstream collection points. Even the attempts to supposedly "clarify" the language to protect data from being used for surveillance shows that the language is deliberately written to look like it does one thing, while really opening up the ability of the NSA and FBI to get much more information.

This is bad news, which is why nearly all of the tech/internet industry have come out against the bill. Apple, Twitter, Facebook, Google and more have spoken out against the bill in recent days, recognizing that at a time when they're still trying to win back the trust of their users following the Snowden revelations, the last thing they need is for the US government to pass a new sneaky surveillance bill. But, apparently, 83 Senators chose not to listen. Here are the 83 Senators who just voted to increase surveillance and decrease trust in our internet companies, thereby harming the American economy and innovation:

• Alexander (R-TN)
• Ayotte (R-NH)
• Barrasso (R-WY)
• Bennet (D-CO)
• Blumenthal (D-CT)
• Blunt (R-MO)
• Boozman (R-AR)
• Boxer (D-CA)
• Burr (R-NC)
• Cantwell (D-WA)
• Capito (R-WV)
• Cardin (D-MD)
• Carper (D-DE)
• Casey (D-PA)
• Cassidy (R-LA)
• Coats (R-IN)
• Cochran (R-MS)
• Collins (R-ME)
• Corker (R-TN)
• Cornyn (R-TX)
• Cotton (R-AR)
• Crapo (R-ID)
• Cruz (R-TX)
• Daines (R-MT)
• Donnelly (D-IN)
• Durbin (D-IL)
• Enzi (R-WY)
• Ernst (R-IA)
• Feinstein (D-CA)
• Fischer (R-NE)
• Flake (R-AZ)
• Gardner (R-CO)
• Gillibrand (D-NY)
• Grassley (R-IA)
• Hatch (R-UT)
• Heinrich (D-NM)
• Heitkamp (D-ND)
• Heller (R-NV)
• Hirono (D-HI)
• Hoeven (R-ND)
• Inhofe (R-OK)
• Isakson (R-GA)
• Johnson (R-WI)
• Kaine (D-VA)
• King (I-ME)
• Kirk (R-IL)
• Klobuchar (D-MN)
• Lankford (R-OK)
• Lee (R-UT)
• Manchin (D-WV)
• McCain (R-AZ)
• McCaskill (D-MO)
• McConnell (R-KY)
• Mikulski (D-MD)
• Moran (R-KS)
• Murkowski (R-AK)
• Murphy (D-CT)
• Murray (D-WA)
• Nelson (D-FL)
• Perdue (R-GA)
• Peters (D-MI)
• Portman (R-OH)
• Reed (D-RI)
• Reid (D-NV)
• Risch (R-ID)
• Roberts (R-KS)
• Rounds (R-SD)
• Sasse (R-NE)
• Schatz (D-HI)
• Schumer (D-NY)
• Scott (R-SC)
• Sessions (R-AL)
• Shaheen (D-NH)
• Shelby (R-AL)
• Stabenow (D-MI)
• Sullivan (R-AK)
• Tester (D-MT)
• Thune (R-SD)
• Tillis (R-NC)
• Toomey (R-PA)
• Warner (D-VA)
• Whitehouse (D-RI)
• Wicker (R-MS)

There are some disappointing names on that list, including those like Heinrich who have spoken out against surveillance in the past, and those like Schumer and Moran who have both tried to position themselves as supportive of the internet industry. Yet here they just helped throw them under the bus.

The 14 principled votes against this bill are the following list, who should be thanked for taking a stand against expanded mass surveillance:

• Baldwin (D-WI)
• Booker (D-NJ)
• Brown (D-OH)
• Coons (D-DE)
• Franken (D-MN)
• Leahy (D-VT)
• Markey (D-MA)
• Menendez (D-NJ)
• Merkley (D-OR)
• Paul (R-KY)
• Sanders (I-VT)
• Udall (D-NM)
• Warren (D-MA)
• Wyden (D-OR)

Paul had introduced an amendment that sounded pretty straightforward, effectively requiring companies to adhere to their terms of service with customers and it, too, got overwhelmingly voted down. Senator Whitehouse's really bad CFAA amendment got basically ditched (there was one tiny bit of language from it that was kept in which was basically fine). There's a chance that more amendments could be voted on on Monday, but from the sound of it, none of them have a chance.

And now we have to worry about what will happen in conference when Congress tries to resolve differences between the House and Senate versions, and then see if the President signs the bill as well. Unfortunately, the Senate just did a really bad thing.

Filed Under: cisa, privacy, senate, surveillance