Snowden Leaks Have Likely Killed CISPA Dead

from the about-time dept

The cybersecurity legislation pushed by Reps. Mike Rogers and Dutch Ruppersberger, CISPA, was already probably dead in the water because the Senate had shown no interest in supporting their privacy-destroying legislation for the past two years -- preferring instead to introduce bills that actually took privacy seriously. However, as we'd explained at the time, CISPA was always really about giving more power to the NSA as part of a turf war between the Defense Department (which the NSA is a part of) and Homeland Security. In fact, the biggest concerns that activists were raising about CISPA was the fact that it would give companies broad immunity from liability if they handed any information over to the NSA. Supporters of the bill kept bending over backwards insisting that this was entirely "voluntary" and that, of course, the NSA wouldn't do anything bad with the data -- rather it was all to "protect" us from evil hackers from China.

Of course, given the revelations over the last few months concerning the NSA's activities, it appears that they've driven the final nail in CISPA's coffin, as a growing number of people in Congress realize that handing even more power to the NSA is not such a good idea.

"The plan was always a little vague, at least as [NSA boss] Keith [Alexander] described it, but today it may be Snowden's biggest single victim," one senior intelligence official said recently, referring to Edward J. Snowden, the former N.S.A. contractor who released documents revealing details of many of the agency's surveillance programs.

"Whatever trust was there is now gone," the official added. "I mean, who would believe the N.S.A. when it insists it is blocking Chinese attacks but not using the same technology to read your e-mail?"

Exactly. So kudos to Snowden for stopping another really bad bill that was always really about giving the NSA that much more power to spy on people.

Filed Under: cispa, congress, cybersecurity, dhs, dutch ruppersberger, ed snowden, mike rogers, nsa, privacy

CISPA's Sponsors Can't Keep Their Story Straight: If Snowden's Leaks Are False, How Do They Harm America?

from the keep-trying dept

We already discussed how bizarre it is to see NSA defenders trying to claim both that this story is nothing new and a huge danger to America, but that kind of thing continues. Witness two of Congress' biggest NSA defenders, Rep. Mike Rogers and Rep. Dutch Ruppersberger -- the two sponsors of CISPA -- try to claim that Snowden was both lying and exposing secrets that harm us all.

"He was lying," Rogers said. "He clearly has over-inflated his position, he has over-inflated his access and he's even over-inflated what the actually technology of the programs would allow one to do. It's impossible for him to do what he was saying he could do."

"He's done tremendous damage to the country where he was born and raised and educated," Ruppersberger said.

So, um, if he's lying and the information he leaked is not true, then how is he doing "tremendous damage" to the country? I guess the "damage" could be to our reputation as a freedom loving country that respects the 4th Amendment and basic rights to privacy, but that doesn't seem to be what Ruppersberger is claiming.

"Some people are saying that he's a hero. He's broken the law," Ruppersberger said. "We have laws in the United States for whistle-blowers, for people that think there's an injustice being done. All he had to do was raise his hand. ... Under the whistle-blower law, he is protected. Yet he chose to go to China."

Er... except we've seen exactly what happens to NSA whistleblowers who go that route. They get completely ignored and then charged with trumped up claims of leaking secrets anyway, and threatened with over 30 years in jail. It's pretty clear that just "raising his hand" doesn't work and actually puts you even more at risk. Furthermore, the current "whistle-blower" law is rarely used and even more rarely successful, with whistleblowers almost never winning their cases.

"I hope that we don't decide that our national security interests are going to be determined by a high-school dropout who had a whole series of both academic troubles and employment troubles," Rogers said.

Yup. The best Rogers can do is try to smear the guy, rather than respond to what he actually leaked, which is apparently all lies, but threatens us all. Sorry, Rogers, but the story doesn't hold up.

Filed Under: cispa, dutch ruppersberger, ed snowden, mike rogers

CISPA Wouldn't Actually Solve The Reasons Congress Is Giving For Why We Need CISPA

from the it's-the-little-things... dept

As expected, Representatives Mike Rogers and Dutch Ruppersberger have reintroduced CISPA, exactly as it was when it passed the House last year. Incredibly, we've been hearing that they've brushed off the massive privacy concerns by claiming that those were all "fixed" in the final version of the bill that got approved. This is highly disingenuous. While it is true that they made some modifications to the bill at the very end before it got approved, most privacy watchers were (and are) still very concerned. They did convince one organization to flip-flop, and they seem to think that's all they need.

But, here's the thing that no one has done yet: explain why this bill is needed. With President Obama's executive order in place, the government can more easily share threat info with companies, so really the only thing that CISPA piles on is more incentives for companies to cough up private information to the government with little in the way of oversight or restrictions on how that information can be used. And given how frequently the government likes to cry "cyberattack" when it's simply not true, it's only a matter of time before they start using claims of "cyberthreat!" to troll through private information.

And they still refuse to explain why this is needed. We hear lots of scare stories, but no explanation for how this bill helps. For example, Ruppersberger has written up an oped for the Baltimore Sun in which he lays out the reasons we need CISPA, but it's all scare stories, without a single explanation for how CISPA would help. And that's because it wouldn't.

March: Hackers allegedly steal the credit card numbers from 1.5 million Visa and MasterCard customers by breaking into the computer systems of the company's payment processor in New York. The thieves stockpiled the stolen credit card numbers for months before beginning to use them.

Payment processors already have some of the best security people in the world and have a large and widespread community of folks who do nothing but think about security issues for this industry. At what point would that lead the payment processor or Visa or Mastercard to need to hand information over to the government?

August: Cyber attackers disrupt production from Saudi Aramco, the world's largest exporter of crude oil, taking out 30,000 computers in the process, according to press reports.

Saudi Aramco is a Saudi Arabian company. Not sure why they would be sharing info with the US government or how CISPA would relate to them at all.

January: PNC Bank announces to its 5 million customers that its website is getting hit with high traffic consistent of a cyber attack meant to delay business with its online banking customers.

Again, why would PNC need to give information to the government? And, if they could alert their customers to the threat, they can also alert the government. None of that requires the ability to share customer info.

These are just three reported examples of cyber attacks in the past 12 months. Each could have had a devastating impact on the U.S. and global economies. That's more than a bad dream — that's a full-blown nightmare.

These are just three scare stories of cyber attacks in the past 12 months, none of which would have been impacted by CISPA. So why do we need it again?

Highly trained Chinese, Russian and Iranian hackers are probing, pilfering and plotting every second of every day. They're often after personal data: In November, reports suggested a hacker was able to access nearly 4 million tax returns in South Carolina with a single malicious email. And they're often after the trade secrets of our companies: The media has reported that Coca-Cola may have fallen victim to hackers from a Chinese beverage company.

Again, what does any of that have to do with CISPA?

Many believe that what is happening to American business may be the largest transfer of wealth in the history of the world. It's costing our companies billions of dollars, and it's costing our country thousands of jobs.

Many believe that's pure hogwash. It's not the largest transfer of wealth in the history of the world. It's not costing companies billions of dollars and it's certainly not costing our country thousands of jobs.

Preventing the U.S. government from sharing information about malicious computer code it detects is akin to preventing forecasters from warning citizens about a hurricane.

Except the government already could share a lot of information, and with the executive order can now share more. So why do we need CISPA?

Our legislation doesn't just protect companies. It will also protect every American citizen who, for example, uses electricity or banks online, or whose doctor compiles medical records electronically.

How? It's a serious question. You can talk about all of these hacks, and you can say "yay, cybersecurity bill!" but if you don't explain specifically how that bill does anything to actually stop those attacks or to protect Americans, you're full of it.

It's important to note that under my legislation, your private information will also be kept private from the government. Information-sharing between companies and the government will be entirely voluntary. Businesses do not have to share information with the government in order to receive information from the government. The bill does not authorize the government to monitor your computer or read your email, Tweets or Facebook posts. Nor does it authorize the government to shut down websites or require companies to turn over personal information.

The first sentence is simply not true. Your private information can be shared with the government, so to say that it absolutely will be kept private is simply wrong. The second and third sentences are misleading. Yes, the information sharing is "voluntary" but since there are broad immunity exemptions, if the government is coming to most companies and saying "share this info for cybersecurity reasons, and you can't get sued for doing so," how many companies are going to stand up to the government and say no? There may be a very small number, but for the most part, companies will hand over the info. The fourth and fifth sentences are simply meaningless, because they are unrelated to the legitimate privacy concerns raised.

Once again, we're left in the same boat as before. Lots of scare stories but no explanation of why CISPA is needed or how it actually helps. The whole thing is just way too broad, with vague justifications that simply don't make much sense when you look at the actual threats compared to what the bill would allow.

Filed Under: cispa, congress, cyberattacks, cybersecurity, dutch ruppersberger, mike rogers, privacy

The CISPA Circus Goes To Baltimore With Another Misleading 'Local Pride' Editorial

from the maryland-versus-china dept

Recently, I responded to an editorial by CISPA author Mike Rogers in the Detroit News, wherein he took some blatant China fearmongering and targeted it at Michigan's specific industry concerns to rouse the local rabble in CISPA's favor. Now Rep. Ruppersberger—the other driving force behind the bill—is applying the same tactic in Maryland, with an editorial in the Baltimore Sun that focuses on the supposed cyber-threat to the life sciences industry:

Here in Maryland, for example, our growing life sciences sector has generated one-third of all job gains over the last 10 years. It's now supporting more than $9.6 billion in salaries for Maryland families and contributes nearly $500 million to incomes and sales tax revenues each year.

The 500 bioscience companies in Maryland are developing ground-breaking therapies for diseases like muscular dystrophy, inventing state-of-the-art medical devices and testing cutting-edge vaccines. These innovations are valuable and worth protecting. Indeed, just like designer handbags or secret family recipes, many want to imitate — and even duplicate — such successes.

For decades, countries like China have been using every means possible to steal the ideas of American corporations. Today, thousands of highly trained Chinese, Russian and Iranian hackers are pilfering our trade secrets by breaking into the computer networks of U.S. corporations. And we're leaving the door unlocked for them.

Something seems off about comparing the desire to copy new disease therapies with the desire to make knockoff handbags, but I guess that was just meant to clarify things for anyone who didn't understand why ground-breaking medical research is valuable. Of more concern is his statement that the door is left "unlocked"—a blatant exaggeration that makes it sound like CISPA's data-sharing provisions are the difference between airtight security and no security at all, even though security experts question whether CISPA would have any real impact. He then goes on to do exactly what I criticized Rogers for doing, by focusing in on the one (supposedly) useful and genuine cybersecurity aspect of the bill while ignoring the rest:

Currently, the U.S government can identify malicious computer code that could be an incoming cyber attack on a government or corporate network. But the law won't allow us to share this information with private companies so that they can protect themselves.

That's why House Intelligence Committee Chairman Mike Rogers, a Michigan Republican, and I have crafted the Cyber Intelligence and Sharing Protection Act (H.R. 3523), which the House overwhelmingly passed this month in a bipartisan vote. This common-sense bill will simply allow the federal government and American companies to share suspicious computer code. Despite recent media reports, the bill does not authorize the government to monitor your computer use or read your email, Tweets or Facebook posts. Nor does it authorize the government to shut down websites or require companies to turn over personal information.

This is just a bunch of half-truths, semantics and disingenuous statements. Firstly, while there may be some data sharing the government wants to do that is currently blocked by the law, there are also existing mechanisms that allow some sharing to happen. Rather than carve out specific exceptions to the specific laws that are getting in the way, CISPA creates broad immunity provisions that wipe out all existing privacy concerns.

Secondly, the bill does not "simply" allow what Ruppersberger says it allows. CISPA's definition of the information that can be shared allows for much more than just "suspicious computer code," instead potentially including all sorts of tangential data related to a network attack—which, yes, could include lots of personal information. CISPA also does not limit the government to using this information for merely technical purposes related to cybersecurity—it permits them to dig through whatever data they collect for evidence of certain types of crime. You'll notice that investigating violent crime and child exploitation (both specifically listed in the text of CISPA) are not mentioned anywhere in this editorial.

Thirdly, while both of Ruppersberger's assertions about what the bill "does not authorize" the government to do are technically accurate, only the latter is giving the full story. It's true that CISPA does not permit the government to shut down websites or require information from companies—but as for monitoring people and reading their communications, as I just described, it's a bit more complicated. No, CISPA does not allow the government to go out and monitor whoever they wish, but it does allow them to thoroughly mine whatever data is given to them—data that will undoubtedly include private information.

For good measure, Ruppersberger throws in some more fearmongering about terrorist hackers taking down power grids (even though CISPA doesn't include anything that would let the government put a common sense regulation in place, like, say, don't connect power grids to the internet) before circling back to the talking-point of Maryland's valuable medical research. Like Rogers, he plays up the imminence of the threat, claiming "it wouldn't take years from China to steal it all from us" and in fact "it could happen in mere keystrokes"—as if at any moment someone could just select "U.S. Economy" and press delete.

I have a feeling this won't be the last of these locally-focused editorials from the pro-CISPA camp. I'm rooting for a Las Vegas feature on the need to protect casino secrets, because while it would surely still be inaccurate and misleading, it might at least be interesting.

Filed Under: baltimore, cispa, dutch ruppersberger, maryland, medical research, mike rogers