Congress Planning To Debate CISPA Behind Closed Doors; No Public Scrutiny Allowed

from the shameful dept

We've been hearing for a while that when the planned markup occurs next week for CISPA, that the House Intelligence Committee is intending to hold a closed markup, basically hiding the discussion and the possible amendments from the public. There is no good reason for this. The Intelligence Committee will claim, of course, that it needs to do this so that confidential information can be discussed in debating the markup, but that's hogwash. There are numerous concerns with the bill that can and should be addressed publicly. If there are key concerns about classified info getting out, that's easy enough to avoid, since so much that CISPA touches on has nothing to do with classified info -- and whatever comes up can be dealt with appropriately.

The truth is that this is yet another way to try to hide from the public on this issue. Congress doesn't want an open discussion on the many problems with CISPA, so it does what it does best: try to hide things away and rush them through when (hopefully) not enough people are looking. It makes you wonder just what CISPA's supporters are so worried about. Congress is supposed to work for the public, not hide things away from the public. This isn't a situation where they're discussing classified info or plans -- but merely a bill focused on information sharing between the government and private companies. Any markup on CISPA needs to be public.

Filed Under: cispa, congress, house intelligence committee, markup, openness, privacy, scrutiny

CISPA Sponsor Tweets, Then Deletes, About How Much More Lobbying Dollars Have Come From Pro-CISPA Groups

from the read-before-you-retweet dept

Ah, transparency. The Sunlight Foundation put together Politwoops last year to highlight tweets that elected officials deleted. Mostly it's innocuous stuff, but sometimes some real gems come through. For example, the account of Rep. Mike Rogers, who is the main Representative behind CISPA, retweeted but then deleted a MapLight tweet about how the House Intelligence Committee, which Rogers chairs, "received 15 times more from pro-CISPA groups than anti-CISPA orgs." You can see MapLight's data here. Of course, we've said from the beginning that much of this "cybersecurity" stuff is really about money, and that tweet just highlighted that plenty of that money is flowing directly into Congress. Obviously, that doesn't look too good for Rep. Rogers (or whatever poor staffer runs his Twitter feed), and it took someone all of 23 minutes to realize that Rogers was more or less promoting the fact that his side had received 15x more in lobbying dollars -- and that probably doesn't look too good. Still, for those who believe in transparency, it was a nice admission, albeit a brief one.

Update: Oh, and it gets better. Rogers has been using the hashtag #CISPAalert in a bunch of his tweets in support of CISPA. But that hashtag was set up by the EFF, and every tweet that uses that hashtag helps fund the EFF in its fight against CISPA.

Rogers (R-Mich.)'s official Twitter account has, since Wednesday, been using the hashtag #CISPAalert to address criticism of his Cyber Intelligence Security Protection Act (CISPA). Activists are wrong, he says. CISPA wouldn't allow government "monitoring anyone’s email or personal information."

But the congressman—or whoever runs his Twitter account—doesn't seem to have gotten the memo. A domain name registrar called Namecheap is running a promotion: offering a dollar to Internet activists at the Electronic Frontier Foundation for each tweet with that hashtag. The EFF is actively campaigning against CISPA, calling it a “privacy-invading cybersecurity spying bill.”

I'm sure once CISPA is in place, Rogers will figure out this Twitter stuff.

Filed Under: cispa, house intelligence committee, lobbying dollars, mike rogers, politwoops, transparency

Congress: Fear Chinese Networking Companies! But Ignore That China Makes All Our Networking Equipment!

from the where's-the-smoking-gun? dept

For years, there have been reports or whispers about how Chinese networking giant, Huawei, might not be trustworthy. Specifically, people talked about how China might hide trojan horses in the equipment for economic espionage or even cyberattack reasons. These rumors got so loud that Huawei last year flat out told the US government to investigate it and come to its own conclusion. Well, the House Intelligence Committee has done exactly that... and Huawei is not pleased (pdf). Despite the investigation coming at its own request, with its promises to be as open as it could be, the report slams Huawei and another company ZTE, and basically says "don't trust these companies."

Huawei has hit back hard, claiming that the report is "libel" and "utterly lacking in substance." They also note that it appears to just be political, calling it "an exercise in China-bashing and misguided protectionism." Indeed, some commentators are noting that this has all the indications of blatant protectionism, rather than a legitimate concern, with some pointing out that the Intelligence Committee seems to consistently ask Huawei to prove a negative and then bashes the company for failing.

But again and again, throughout the report, the pattern emerges: an allegation is made, Huawei denies it, without providing evidence deemed detailed enough to substantiate the denial, and the Committee is unimpressed.

As that writeup notes, Huawei has not been found guilty, but is repeatedly asked to prove its innocence, and being unable to prove conclusively that it hasn't done anything, the Intelligence Committee insists that the threat is just too great.

It is, of course, quite possible that something nefarious is going on with Huawei and ZTE. But there doesn't appear to be any detals in the report that actually proves anything. Instead, it's all just baseless allegations, followed by Huawei (and ZTE) not providing enough details to convince investigators that they're innocent. Given Congress' history of grandstanding, this certainly raises some questions.
But... an even bigger issue is that the whole focus on Huawei may be kind of silly. Yes, it's a Chinese company, but as others have noted, basically all of our electronics products are made in China, and if that country really wanted to do something questionable, why not sneak in trojan horses there as well?

One fundamental failure of all this official hand-wringing is that it neglects the fact that many if not most of the components, with the exception of certain higher-value chips like those from Intel, are manufactured in China. Cisco Systems and Juniper Networks in the U.S., Alcatel-Lucent in France and Ericsson in Sweden, all use Chinese-made parts and carry out at least some portion of the final assembly of their equipment in China.

Furthermore, that same report notes that, if this is just kicking off a trade war between the US and China over telco products, the US companies may get hurt a lot more than the Chinese:

Might China respond with its own restrictions against U.S. telecom firms like Cisco and Juniper? Is this the first shot of a telecom trade war? We’ll see.

If that happens, expect Cisco to be hurt more than Huawei. U.S. sales account for only 4 percent of its overall revenue, whereas Cisco’s operations in Asia, the Pacific Rim and China account for more than 16 percent, and China was its second fastest-growing market in that region after Japan.

Yes, it's entirely possible that Huawei and ZTE are doing something bad -- but you'd think any report claiming that would have a lot more evidence than what's in this report. Of course, considering it's by the same FUD-spewing folks responsible for CISPA, perhaps we should get used to the fact that FUD without evidence is their standard operating procedure.

Filed Under: china, congress, cybersecurity, espionage, house intelligence committee, mike rogers, protectionism
Companies: huawei, zte

Congress Decides To Ignore Privacy Concerns, Refuses To Even Consider Key CISPA Amendments

from the major-failure dept

Remember how we said that there were a few key amendments that were necessary to make CISPA even close to palatable? Yeah, well, the House Intelligence Committee House Rules Committee issued its rules for the House debate over CISPA... and basically barred the discussion on all of those key amendments. In other words, for all the talk of how they knew they had to make changes and were willing to compromise and come to a real solution? Yeah, it seems like that was all for show.

Amazingly, CDT, who had been a major player fighting against CISPA had backed off its opposition on Tuesday, believing that the authors of CISPA really were willing to negotiate some changes in good faith. This fact was trumpeted by supporters of the bill to show "proof" that they were listening to constructive ideas. However, by barring the consideration of these amendments, they've shown their true colors. CDT is back to fully opposing the bill.

Filed Under: cdt, cispa, cybersecurity, house intelligence committee

New Draft Of CISPA Announced: Some Progress, Still Big Problems

from the it's-a-start-I-guess dept

The House Intelligence Committee has published a new draft of CISPA (pdf and embedded below), which includes the two amendments that were already approved, plus several other additions and changes. In some areas, there is genuine progress—in others, things actually seem to have gotten worse. Unfortunately, some of the biggest problems with the bill remain, and some of the new language seems to have little effect at all. Some changes I will discuss in future posts, but there are two that I wanted to look at right away:

A Narrower Definition Of Cybersecurity
This is the one clearly positive change in the bill. Previously, the definition of cybersecurity and cyber threat information was:

(A) efforts to degrade, disrupt, or destroy such system or network; or

(B) theft or misappropriation of private or government information, intellectual property, or personally identifiable information.

While the first part remains unchanged, the second part is now much narrower:

(B) efforts to gain unauthorized access to a system or network, including efforts to gain such unauthorized access to steal or misappropriate private or government information

Where the original language could be construed to include all sorts of activity that goes beyond what most people could consider "cybersecurity", the new definition makes it clear that we are talking about unauthorized network access. Most notably, it removes the reference to "intellectual property", which makes sense: the authors have always insisted that they were talking about the misappropriation of secret R&D by foreign entities, which is sufficiently covered by language referring to privacy and unauthorized access. Including "intellectual property" opened it up to all sorts of additional interpretations that went beyond this stated intent.

Now, there's still reason to be a little concerned here, because the attempts to charge people for "unauthorized access" under the CFAA have been ridiculous in the past. If this language in CISPA were construed to include things like violating terms of service (as some have claimed of the CFAA language) then it would be very dangerous. However, with last week's Ninth Circuit ruling which narrowly construed unauthorized access, legal thinking on this matter seems to be heading in the right direction. There's still some gray area, and I think there's still room for a much better definition of cybersecurity in CISPA (I know they want to future-proof it, but it doesn't have to be that short and vague) but this is still a significant improvement over the previous draft.

Extremely Limited Liability For Companies
The new draft of CISPA includes a whole new section carving out the requirements for a company to be held liable if they share information improperly. Basically, a company that shares data with the government receives immunity from all existing privacy laws unless you can show that their actions caused you injury and constituted "willful misconduct"—which is very specifically defined in CISPA as an action taken:

(I) intentionally to achieve a wrongful purpose;
(II) knowingly without legal or factual justification; and
(III) in disregard of a known or obvious risk that is so great as to make it highly probably that the harm of the act or omission will outweigh the benefit.

Yes: and. A company's actions need to satisfy all three of those conditions. I'm not even sure how that's possible. They have to be trying to harm you, knowingly breaking the law and, in a bizarre third clause, they also have to know there is a risk that the harm to you will outweigh the benefits to them. How you are supposed to weigh the harm to individuals whose private data is handed to the government, versus the benefits to cybersecurity services who improve their networks with data, is beyond me. But no matter how you slice it, this is an insanely onerous definition of willful misconduct that makes it essentially impossible to ever sue a company for wrongly sharing data under CISPA.

Overall, despite the progress made on the definition of cybersecurity, CISPA is still a highly problematic bill which still doesn't properly safeguard people's privacy. One of the biggest problems—the fact that the government can use, retain and affirmatively search the information they gather for vaguely defined "national security" purposes—is untouched in the new draft. There are some attempts to alter the rules on how federal agencies can share information between themselves, but many of those changes seem essentially meaningless. It's good to see some reaction from Congress, but if CISPA is to be fixed (a prospect I'm still dubious about) there is still a long way to go.

Filed Under: cispa, cybersecurity, house intelligence committee, liability

CISPA Authors Launch Twitter Account To Preach False Merits Of The Bill

from the yeah,-that'll-change-everything dept

Still desperate to prove that they are in touch with the online community, the House Intelligence Committee has launched a new Twitter account apparently dedicated to talking about how totally awesome CISPA is. They haven't been at it for very long, but they've already blessed the hashtags #CISPA and #cyber (they really love that word, don't they?) with several disingenuous tweets full of misinformation and flat-out inaccuracies:

Firstly, how does a federal law that creates an internet security exemption to every other existing law represent keeping the "federal govt’s hands off the Internet"? The entire point of CISPA is to give every federal agency that already has its hands on the internet more information and power. Similarly, while the bill itself does not have any provisions relating to blocking website access, it creates clear provisions for companies to give data to Homeland Security—the people who already seize websites.

Strong privacy protections? CISPA includes virtually no privacy protections, beyond a call for annual recommendations from the Privacy and Civil Liberties Oversight Board. Meanwhile, it eliminates existing privacy protections, because as soon as a company deems its data "cyber threat information", it can turn it over to the government without worrying about any other laws. As for how CISPA "strictly limits" what the government can do with the data, that depends on your definition of "strictly"—and, of course, whether you're honest about what the bill says, which the House Intelligence Committee is not:

Maybe they'll blame Twitter's character limit, but they left out a very important part there. Information can only be shared with the government if it is related to cybersecurity, but it can be used by the government for the purposes of cybersecurity or national security. That's a much, much broader field, and the cybersecurity heading is already pretty wide open, when you remember how it's defined in CISPA—as anything relating to protecting a network from:

‘(A) efforts to degrade, disrupt, or destroy such system or network; or

‘(B) theft or misappropriation of private or government information, intellectual property, or personally identifiable information.

Moreover, there are no limitations on how long the government can keep the data, or on how often they can come back and search it for whatever they want—as long as they can justify the search as either cybersecurity or national security. That's not what most people call "strict".

Resistance to CISPA is growing, and more flimsy misinformation isn't going to change anything just because the committee puts it on Twitter. We already wrote about how astonishing it is that Congress expected no resistance to the bill, and now it seems like they're finally waking up to the fact that they were wrong—but, as usual, they have no idea how to respond.

Filed Under: cispa, house intelligence committee, misinformation, privacy