Spyware-For-Business Company Thinks Concerns About 'Medical Bills' Are Indicators Of An 'Insider Threat'

from the terminated-for-googling-'student-loans' dept

It's no secret that many companies monitor their employees' computer use. But things are going much further than simply ensuring the normal "don'ts" -- file sharing, porn viewing, etc. -- are tracked for disciplinary reasons. Companies are now on the lookout for the next "insider threat." Some companies are viewing the Snowden saga as the ultimate cautionary tale, albeit one that results in more surveillance rather than less. (via Dealbreaker)

Guarding against such risks is an expanding niche in the security industry, with at least 20 companies marketing software tools for tracking and analyzing employee behavior. “The bad guys helped us,” says Idan Tendler, the founder and chief executive officer of Fortscale Security in San Francisco. “It started with Snowden, and people said, ‘Wow, if that happened in the NSA, it could happen to us.’ ”

But the effort to find -- and prevent -- the next "insider threat" from damaging his or her company seems to be just as misguided as the government's efforts to do the same. Looking for potential threats often results in viewing almost everything as an indicator of future treachery.

One company cited "changes in email habits" as being indicative of an "insider threat." Others, like Stroz Friedberg, aren't as selective. The company, started by former FBI agent Edward Stroz, veers into the same dangerous territory the government does when rooting out "threats." In its hands, normal activities are viewed with suspicion by its monitoring software.

The software establishes a base line and then scans for variations that may signal that an employee presents a growing risk to the company. Red flags could include a spike in references to financial stresses such as “late rent” and “medical bills.”

And what better way to tackle "late rent" or "medical bills" than suddenly finding yourself unemployed simply because re-purposed FBI analytic software thinks any small sign of (possibly temporary) financial instability indicates your next move will be to steal something. Millions of people in the US deal with these realities frequently -- especially the latter. And yet, millions of employees still find other ways to tackle these problems instead of dipping their hands in the tills or running off with sensitive documents.

Stroz's software also thinks -- like the government -- that an unhappy employee is a malicious employee.

He offers the scenario of a star trader at a bank who’s disappointed with the size of her annual bonus. Instead of being blindsided when she defects to a rival, a bank using Scout could identify her discontent early and make sure she doesn’t take sensitive data or other team members with her.

Or, the company could try to work with the employee rather than just secretly track her until her eventual exit. Once again, unhappy employees leave companies all the time without taking anything with them. Sure, a few do, but the deployment of software like this will generally produce more false positives (and a further strain work relationships) than insider threats. And there's nothing like firing people for something they haven't done (but might!) to endear a company to its remaining employees.

Despite all of this, Edward Stroz believes his company's predictive employee policing software is just another way for companies to show their employees how much their staff means to them.

He’s still careful when discussing the software, describing it as a way to help employers build a “caring workplace.”

Oh, it's anything but. While employees will often accept monitoring of their internet/computer usage as being a necessary part of the employee-employer relationship, they're not going to be happy to find out that searching for information about medical bills might see them lose a source of income. And they're definitely not going to be thrilled to learn that expressing displeasure about company practices and policies may result in the same thing. If a company wants to foster a "caring workplace," it should be addressing employee discontent, not monitoring it. But what do you expect from companies -- and the entities that provide them with spyware -- that view the Snowden leaks as justifying increased surveillance?

Oh, and employees had better believe their file sharing use will be actively monitored (and used against them). Stroz Friedberg may be making enterprise pre-crime software now, but its past as an RIAA lobbying firm (and its slightly-later past as a Six Strikes "independent expert") has been well-noted.

Filed Under: insider threats, monitoring, spyware
Companies: fortscale security

Copyright Industry Keeps Asking For More In Australia: VPN Ban Next?

from the collateral-damage dept

Techdirt has been following the rather depressing saga of the Australian government's attempt to ram through new copyright powers for some time now. As TorrentFreak reports, under great pressure from the Australian government, local ISPs have put together a draft voluntary code for dealing with alleged copyright infringement (pdf). The Australasian Music Publishers Association (AMPAL) has now weighed in, and basically wants everything to be much harsher, including the following:

"The Code does not place a general obligation on ISPs to monitor and detect online copyright infringement," the publishers write. "AMPAL submits that ideally the Code should include such a duty using ISPs’ monitoring and filtering techniques."

...

"The Code does not require ISPs to block access to infringing material. AMPAL submits that ideally the Code should include provisions obliging ISPs to take such action following provision of the relevant information by Rights Holders and/or following discovery of copyright infringing websites by ISPs’ monitoring and filtering techniques," the publishers write.

...

"AMPAL submits that ideally additional options should be available to Rights Holders in the form of sanctions or mitigation procedures to be imposed on Account Holders," the publishers write.

In other words, AMPAL wants to get ISPs do all the dirty work, turning them into both cops and executioner. But AMPAL isn't alone in coming up with disproportionate responses to the ISP code. Via ZDNet, here's a comment from BBC Worldwide (pdf), the wholly-owned commercial arm of the British broadcaster:

The Code is ill-equipped [to] deal with consumers who spoof or mask their IP addresses to avoid detection, behaviour that we believe will increase as a result of an introduction of a notice scheme.

The footnote for that point refers to a TorrentFreak article about Canadian piracy notifications boosting demand for VPNs, which confirms that what BBC Worldwide is concerned about here is the ease with which Australians will be able to use things like VPNs to evade sanctions by masking their IP address.

Of course, anyone who understands how the Internet works -- and how people use it -- has been pointing this out for years. But the worrying thing is that the copyright industry seems to be surprised by this possibility. Knowing the way it thinks, and its complete indifference to the collateral damage it might cause, the fear has to be that the next stage in its war on sharing will be demanding that governments ban VPNs.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: australia, copyright, copyright police, isps, monitoring, vpns
Companies: ampal

Search Something, Say Something: David Cameron Asks Google, Yahoo To Be 'Good Citizens' And Report Users Searching For 'Terrorist' Subject Matter

from the so,-why-is-the-GCHQ-still-collecting-paychecks? dept

UK Prime Minister David Cameron doesn't ask for much from the world's tech companies. All he wants is for them to proactively police the web for child pornography, piracy and extremist content. He's not offering to pay for these services. He just expects Google et al to do this on their own time and own dime to make the world a better place.

Now, he's enlisting Google and Yahoo into the counterterrorism battle. As if the GCHQ and its stateside partner didn't have enough tendrils intertwined with every cable and backbone between here and the UK, Cameron now wants the two search companies to be a part of an informal "search something, say something" program… all for free and all because it would be the neighborly thing to do.

Internet companies like Google and Yahoo should tell the police if possible terrorists are searching for tips to make bombs on the internet, David Cameron has said.

The Prime Minister said he wanted to apply to the internet the "principles of common sense, decency, moral responsibility as we do to real life".

It's simply not enough to index the web for searchability. Now, search engines need to act as unpaid informants for the world's law enforcement agencies, turning over information on questionable searches to the proper authorities.

Of course, Google and Yahoo have no way of knowing whether searches for bomb-making tips are originating from terrorism suspects or screenplay writers or bored youths using search engines as an Anarchist's Cookbook proxy. These prickly issues have likely never troubled Cameron's grey matter. If so, these inane soundbites never would have escaped his lips. The more he talks, the more inane his platitudes-masquerading-as-solutions sound.

Mr Cameron said he wanted internet companies to take the same moral responsibility as if someone overheard a group planning a bombing in a pub.

"See something, say something" has done little more than tie up limited resources with a mass of false positives. Putting Google and Yahoo in this position is just asking for more of the same. What Cameron is asking for is the compilation of useless information that will only snag the innocent and the inept. If these are the sorts of "terrorists" Cameron wants removed from circulation, he should just ask his local law enforcement to follow the FBI's lead. Busting handcrafted terrorists is far easier than hunting down actual threats, but it still sounds like real "wins" in press releases or politicians' mouths.

Any would-be terrorist who doesn't want to end up behind bars knows better than to plan violent acts in public, unlike the metaphorical extremists in Cameron's fantasy. Using the two largest search engines isn't much different than mapping out a bombing over a few pints at the local pub, but asking Google and Yahoo to treat their search engines like overheard conversations is guaranteed to end in futility.

Cameron compares it to child porn (because of course he does) even though there's a big difference between searching out plainly illegal content and searches that may seem ominous when observed without context. Search engines track searches to provide relevant results to users, so there's little doubt this information is retained somewhere. But it isn't something that should be turned over to law enforcement just because certain terms were used. There are plenty of legitimate reasons for researching topics that are "terrorist-related" but Cameron's request doesn't leave any room for essential nuances like these.

We expect our search providers to return search results, not subject us to additional government scrutiny simply because our searches contain a few arbitrarily-flagged terms. If search engines become just another form of direct government surveillance, more and more users will take their business elsewhere. Terrorists -- at least those with any instinct for self-preservation -- already have.

Filed Under: david cameron, monitoring, privacy, search something say something, search terms, surveillance, terrorism, uk
Companies: google, yahoo

Why Requiring Social Networks To Monitor Posts To Spot Terrorists Will Make It Even Harder To Catch Them

from the false-positives dept

Last week we wrote about how the UK government was clearly signalling it wanted social networks to start monitoring users' activity for tell-tale signs of terrorist intentions -- without, of course, worrying about how that might be done. Now, James Ball in the Guardian has put together a great summary of why that approach cannot possibly work.

He runs through various ways Facebook, Twitter and the rest might try to spot potential terrorists before they acted -- for example, by using keywords, lists of suspicious sites, social graphs etc. But one feature automated systems all share is that to avoid the risk of letting individuals slip through the net, the criteria for flagging up people have to be loose. And that, inevitably, means there will be false positives:

However sophisticated these systems are, they always produce false positives, so if you are unlucky enough to type oddly, or to say the wrong thing, you might end up in a dragnet.

Here's what that would mean in practice:

Data strategist Duncan Ross set out what would happen if someone could create an algorithm that correctly identified a terrorist from their communications 99.9% of the time -- far, far more accurate than any real algorithm - with the assumption that there were 100 terrorists in the UK.

The algorithm would correctly identify the 100 terrorists. But it would also misidentify 0.01% of the UK's non-terrorists as terrorists: that’s a further 60,000 people, leaving the authorities with a still-huge problem on their hands. Given that Facebook is not merely dealing with the UK’s 60 million population, but rather a billion users sending 1.4bn messages, that's an Everest-sized haystack for security services to trawl.

Requiring social networks to bring in any kind of automated monitoring -- the only kind that is feasible given the huge volume of posts involved -- will simply cause the intelligence agencies to be swamped with a huge number of false leads that will make it impossible to pick out the real terrorists from among the data supplied. In other words, the UK government's plans, if implemented, will just make a bad situation much, much worse.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: false positives, haystacks, liability, monitoring, policing, statistics, terrorists, uk

Government Employees Suddenly Worried About Surveillance As New Plans To Stop The Next Snowden Strip All Privacy

from the surveillance-on-themselves dept

The Associated Press has a story about how the US intelligence community is ramping up efforts to stop the next Ed Snowden by basically monitoring nearly everything that government employees and contractors with security clearance do:

Stung by internal security lapses, U.S. intelligence officials plan to use a sweeping electronic system to continually monitor workers with secret clearances.... The system is intended to identify rogue agents, corrupt officials and leakers and draws on a Defense Department model under development for more than a decade.... Intelligence officials have long wanted a computerized system that could monitor employees, in part to foil leakers like former National Security Agency analyst Edward Snowden....

Of course, now that it's about the intelligence community spying on the intelligence community, those government employees are suddenly feeling a bit uncomfortable about all of this:

Privacy advocates and government employee union officials expressed concerns that electronic monitoring could intrude into individuals' private lives, prompt flawed investigations and put sensitive personal data at greater risk.

The officials backing the program claim this is no real risk because "the system would have safeguards." Of course, that's the excuse we've been hearing for ages about the bulk data collection programs that the NSA and FBI use -- that supposedly they have "safeguards." Considering that the government employees union doesn't seem satisfied with that response indicates that the folks who actually work in the intelligence community know that such "safeguards" are pretty bogus and do little to actually protect privacy.

Of course, there seems to be no recognition from those who are complaining about this new system that it shows why the American public (and, well, the rest of the world) are so concerned about the other surveillance programs of the intelligence community.

Filed Under: intelligence community, leaks, monitoring, privacy, whistleblowers

CA School District Announces It's Doing Round-The-Clock Monitoring Of Its 13,000 Students' Social Media Activities

from the incarcerating-13,000-students-would-make-them-'safer' dept

The Glendale School District in California is facing some backlash from the recent news that it has retained the services of Geo Listening to track its students' social media activity. The rationale behind the program is (of course) the students' safety.

After collecting information from students' posts on social media platforms such as Facebook, Instagram, YouTube and Twitter, Geo Listening will provide Glendale school officials with a daily report that categorizes posts by their frequency and how they relate to cyber-bullying, harm, hate, despair, substance abuse, vandalism and truancy.

Glendale Unified, which piloted the service at Hoover, Glendale and Crescenta Valley high schools last year, will pay the company $40,500 to monitor posts made by about 13,000 middle school and high school students at eight Glendale schools.

It would appear that the school district knew there would be some backlash, hence its decision to delay this announcement until the beginning of this school year, rather than "last year," when the program was actually put into place. (The date stated in this article may be incorrect. The founder of Geo Listening's LinkedIn page says the company formed in January -- unless "last year" means "last school year.") Administration officials are already on the defensive.

Glendale Unified Supt. Dick Sheehan said the service gives the district another opportunity to "go above and beyond" when dealing with students' safety.

"People are always looking to see what we're doing to ensure that their kids are safe. This just gives us another opportunity to ensure the kids are safe at all times," he said.

A rather overwrought paragraph on the company's About Us page attempts to sell fear and monitoring system at the same time, much as Superintendent Sheehan did in the above paragraph.

The Facts

Your students are crying for help. We have heard these cries of despair, and for help and attention, loud and clear from students themselves via their public postings on social networks. Many feel as though no one is listening, and they are falling away from societal connections. This trend can be reversed with more timely information that we can provide to the appropriate school staff.​

What Geo Listening appears to do is nothing more than aggregate public social media posts linked to either the students or school district. Geo Listening repeatedly points out that it doesn't "monitor email, SMS, MMS, phone calls, voicemails or unlock any privacy setting of a social network user."

This seems to be true, but not necessarily because Geo Listening is concerned about privacy. In its privacy policy, it breaks down exactly what it does monitor.

Geo Listening is a social media monitoring system that allows school districts to locate and process publicly available social media content. School districts use the Geo Listening Services to access and aggregate publicly available content on the Internet into regular reports and dashboards. Public content is collected and provided to school districts from the following websites:

·         Twitter;
·         Facebook;
·         Instagram;
·         Picasa;
·         Vine;
·         Flickr;
·         Ask.fm;
·         YouTube; and
·         Google+.

By monitoring only public posts on social media services, Geo Listening is able to provide the district with reports on 13,000 students. Without having access to a report, it's tough to say exactly what Geo Listening is turning over to the district. Here's what it says it's looking for:

Geo Listening provides social media monitoring services (“Geo Listening Services”) that enable school districts to locate and process publicly available information about their students for the purposes of combating bullying, cyber-bullying, hate and shaming activities, depression, harm and self harm, self hate and suicide, crime, vandalism, substance abuse and truancy.

There are some very broad terms in that list and without more information on how Geo Listening tracks or aggregates posts that fall into this very wide net, it looks as though the system is apt to produce a lot of false positives.

Then there's the question about how it searches for offending posts. Does it only run current students through its digital sifter or does it include anyone who lists a Glendale school on their profile? Does this dragnet also capture comments, tweets, etc. from non-students who interact with Glendale students? If a student interacts with a non-student's post that falls afoul of the guidelines, can they be punished? These are just a few of the many questions this monitoring service raises.

Beyond that, there's the fact that the service, as it's currently implemented, is incredibly easy to circumvent, something Geo Location's site even discusses in its privacy policy.

How to Opt Out

If you would like to ensure content that you post through a social media platform or profile is not monitored by Geo Listening, you should ensure that your social media posts are non-public. Geo Listening only collects publicly available information. Therefore, if a social media platform includes settings that allow you to designate your posts as private, doing so will ensure your posts will not be collected.

It would seem that stating this openly somewhat defeats the purpose of the program, but it does give Geo Listening a pretty strong defense against privacy violations. Geo Listening, however, seems fairly confident that most students won't "opt out," according to this answer in its FAQ.

Most users below the age of 25 do not utilize the available privacy settings because they are seeking to be recognized for their respective posts. They have chosen to post in the public domain in exchange for popularity and a decreasing ability to communicate effectively face to face.

Personally, I feel Geo Listening is underestimating the teens it's monitoring and the little dig it throws in during the last sentence is unseemly. Insulting the people you're spying on is the sort of thing that comes back to haunt you.

Geo Listening doesn't address one of the biggest flaws in its system anywhere in its statements: trolling. Once students realize their public posts are being monitored, they're likely to respond with deliberately objectionable statements in order to trigger a response from the school system. Once this starts happening with any frequency, it will be much harder to separate the legitimate problems from the fake, while also providing legitimate bullies with a handy excuse.

Then there's the fact that the monitoring makes no distinction between posts made at school (where the school should presumably have some sort of say, especially if these are made using school equipment) and those made outside of school, away from the school's jurisdiction. Some will argue that the type of behavior being monitored crosses both boundaries and therefore should be the concern of the school. But opening this door will lead to more monitoring of kids' (theoretically) private lives rather than what should actually be under the school's purview.

Also of some concern is Geo Listening's mobile app, which basically turns any phone possessed by a student, parent or school staff member into a "Report" button.

Geo Listening also provides a free mobile application to each respective school's parents, students and staff. This mobile application provides each stakeholder the ability to anonymously report incidents that are experienced or witnessed.

While having an easy way to collect anonymous tips on incidents of bullying is a theoretically good idea, in practice it often just becomes another avenue of abuse. The district may have thought it was offloading something it didn't have the time and resources for (monitoring students' social network use 24/7) to a third party, but the exploitable flaws in the system indicate a significant amount of investigative and followup work will be generated -- all of which will have to be handled by school administrators.

If administrators are sluggish in their response to reported issues, it will give the appearance that they only really care about appearing to do something, rather than actually doing something. And Geo Listening's rationale ("only public posts") for tracking students off-campus isn't really that much different than the FBI, NSA, et al abusing the Third Party Doctrine in order to hoover up huge amounts of metadata. Just because it's been created doesn't automatically mean it should be collected.

It's another bad administrative decision based on an impossibility (keeping children safe "all the time"), one that's likely to hurt the school in the long run. Unfortunately, this news has attracted the attention of another California school district, one which obviously hasn't read the comments attached to the dozens of stories about the monitoring system.

Burbank’s schools chief said she plans to keep an eye on neighboring Glendale Unified, who recently hired a Hermosa Beach-based company to monitor the public social networking accounts of its middle and high school students.

“We do not currently monitor students’ social media sites and we have not yet researched the program that Glendale Unified has implemented, but we will be gathering more information,” Burbank Unified Supt. Jan Britz said in an email Thursday.

No one "keeps an eye" on something like this unless they think it's a good idea, but just need some additional justification or a lower bidder. Officials don't "keep an eye" on ideas they've dismissed out of hand as being "terrible" or "not for us." The expectation of privacy as it pertains to public posts is very limited, but as diminished as it is, it's not completely unwarranted for the student body to feel they should be able to leave campus without the school following it around and reading its posts over its shoulder.

[More excellent posts on the same subject at Free Range Kids and Popehat.]

Filed Under: california, monitoring, social media

Pakistan To Start Monitoring All Emails, Phone Calls & 'Other Communications' With Foreigners

from the for-whose-safety? dept

You may remember that, a year ago, Pakistan announced they were banning encryption online. Not that any such ban would likely to be effective, but it seems to fit in with the claim that the government has told PTCL, the Pakistani telco, that within 90 days it must monitor basically all communications that go across the Pakistani border:

All emails, telephone calls and other communications with the rest of the world will begin to be monitored within 90 days at a cost of million of dollars, according to a deadline given by the government to operators including PTCL.

The government has assigned PTCL and other operators to install monitoring equipment by the end of this year for checking voice and email communications from abroad and the services of the country’s spy agency will be used basically to check and curb blasphemous and obscene websites on the Internet.

Yeah, sure, just to "curb blasphemous and obscene websites." I'm sure all that monitoring won't be abused otherwise at all... right? Somehow, despite that earlier ban, I'm guessing that encryption technologies just became a lot more popular in Pakistan.

Filed Under: encryption, monitoring, pakistan, surveillance
Companies: ptcl

New Research Sets The Stage For Next Round Of Cat-And-Mouse Between BitTorrent Users & Snoopers

from the don't-look-now,-you're-being-watched dept

The BitTorrent protocol is an extremely efficient way of moving files around the Internet, especially big ones. That makes it highly popular with those seeking to download unauthorized copies of music and films, for example. But the clever approach that enables BitTorrent to do that, which involves downloading fragments of a file from a shifting swarm of fellow peers holding some or all of it, is also a weakness from these users' point of view: it means that downloads take place in public, rather than as a private transaction from a client to a server (as with cyber lockers.)

Fascinating new research entitled "The Unbearable Lightness of Monitoring: Direct Monitoring in BitTorrent" (pdf), from researchers at the University of Birmingham, explores just how public. It seeks to quantify how many peers in a swarm are actually being run by companies monitoring unauthorized downloads, and how long it takes for them to detect such activity:

From our experiments, we derived a number of interesting properties of monitoring, as it is currently performed: e.g., that monitoring is prevalent for popular content (i.e., the most popular torrents on The Pirate Bay) but absent for less popular content, and that peers sharing popular content are likely to be monitored within three hours of joining a swarm.

Many BitTorrent users are aware that such monitoring is going on, and try to avoid detection by using some kind of blocklist designed to catch peers being run by companies offering digital forensics. But if the current research is accurate, those lists have big gaps: of the peers the researchers identified as likely to be run by monitoring companies, only 69% were found on the blocklists they checked. In other words, there was nearly a one in three chance that they would not be blocked, and would therefore be able to monitor unauthorized downloads. Despite this, one of the study's authors, Tom Chothia, told New Scientist that file sharers needn't be worried too much by the revelation they are being monitored -- at least, not yet:

"All the monitors connected to file sharers believed to be sharing illegal content. However, they did not actually collect any of the files being shared. So it is questionable whether the observed evidence of file-sharing would stand up in court."

More cautious users of BitTorrent may find other ways to avoid detection, using VPNs or proxies. But as Tim Lee points out, the main effect of this new analysis will probably just be an escalation of the long-standing arms race between file-sharers and copyright enforcers:

Users will presumably take advantage of the new monitor-detection techniques identified by Chothia et al to produce more accurate blocklists. Monitoring firms may respond by tweaking their monitoring clients to behave more like real clients, and by more frequently changing the subnets they use for monitoring.

And so the game of cat-and-mouse will continue.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: bittorrent, monitoring

Norwegian Security Service Wants Details Of Citizens' Web Comments Retained For Six Months

from the anything-else? dept

Governments around the world are seeking to monitor more and more of their citizens' online activities -- and it's not just the most obviously repressive regimes doing this. In the US, there is CISPA, while the UK is drawing up the Communications Capability Development Programme. Thomas Steen alerts us to a further escalation of this desire to spy on the public, in Norway. The secret service there (known by the acronym PST) want details about comments posted on all Web sites retained (via Google Translate):

"This will make it possible to identify which IP address to publish a given post at a particular time," writes PST letter also signed the acting chief Roger Berg.

The current requirement is to store information detailing where, when, how and with whom Norwegians communicate using the phone, mobile or e-mail. The latest proposal would be a major extension to that, since it would require data about highly personal content to be stored. Here's how the PST would access that information:

If it becomes subject to compulsory saving for six months, it will mean that the district court, upon request from the PST, may require that those who have online discussion must submit the information about who wrote a given post and when it was done.

In addition, prosecutors called a "rush of competence" in cases where data is needed very quickly. Then the police and PST require data directly from the supplier, but as the court approve it afterwards.

Aside from that retrospective approval for data grabs, the other worrying aspect of this proposal from the Norwegian secret service is that, if implemented, it would establish a precedent that other countries may seek to follow.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: comments, ip address, monitoring, norway

Forget SOPA, You Should Be Worried About This Cybersecurity Bill

from the this-is-not-good dept

While most folks are looking elsewhere, it appears that Congress is trying to see if it can sneak an absolutely awful "cybersecurity" bill through Congress. We've discussed how there's been some fighting on the Senate side concerning which cybersecurity bill to support, but there's a similar battle going on in the House, and it appears that the Rogers-Ruppersberger bill, known as CISPA (for Cyber Intelligence Sharing and Protection Act) or HR 3523 is winning out, with a planned attempt to move it through Congress later this month. The bill is awful -- and yet has somehow already gained over 100 sponsors. In an attempt to pretend that this isn't a "SOPA-like" problem, the supporters of this bill are highlighting the fact that Facebook, Microsoft and TechAmerica are supporting this bill.

However, this is a terrible bill for a variety of reasons. Even if we accept the mantra that new cybersecurity laws are needed (despite a near total lack of evidence to support this -- and, no, fearmongering about planes falling from the sky doesn't count), this bill has serious problems. As CDT warned when this bill first came out, it's way too broad and overreaching:

However, the bill goes much further, permitting ISPs to funnel private communications and related information back to the government without adequate privacy protections and controls. The bill does not specify which agencies ISPs could disclose customer data to, but the structure and incentives in the bill raise a very real possibility that the National Security Agency or the DOD’s Cybercommand would be the primary recipient.

If it's confusing to keep track of these different cybersecurity bills, the ACLU has put together a handy dandy (scary) chart (pdf) comparing them all. And what comes through loud and clear is that the Rogers-Ruppersberger CISPA bill will allow for much greater information sharing of companies sending private communication data to the government -- including the NSA, who has been trying very, very hard to get this data, not for cybersecurity reasons, but to spy on people. CISPA has broad definitions, very few limits on who can get the data, almost no limitations on how the government can use the data (i.e. they can use it to monitor, not just for cybersecurity reasons) and (of course) no real oversight at all for how the data is (ab)used.

CDT has put together a reasonable list of 8 things that should be done if politicians don't want to turn cybersecurity into a new SOPA, but so far, Congress is ignoring nearly all of them. Similarly, EFF is asking people to speak out against CISPA, noting that it basically creates a cybersecurity exemption to all existing laws. If the government wants your data, it just needs to claim that it got it for "cybersecurity purposes" and then it can do pretty much whatever it wants.

This is a really bad bill and it looks like it's going to pass unless people speak up.

Filed Under: cispa, cybersecurity, monitoring, privacy, rogers-ruppersberger, sopa