The Law Should Never Be Secret, So Why Will CISPA Debate Be Secret?

from the ridiculous dept

As we mentioned last week, CISPA is scheduled for markup tomorrow, and the markup will be done behind closed doors without any public scrutiny allowed. This makes no sense. They are not debating the reason for the law, but rather the text of the law itself. The law will be public, and any debate about the language and amendments included should be public as well. As Julian Sanchez points out, it makes perfect sense for intelligence briefings to be held in secret, but it never makes sense to hold debates about what the law should be in secret. So why is Congress doing so?

In the meantime, it appears that the main backers of the bill will be supporting some amendments (and may release a manager's amendment), which marginally limits how the information it gets from companies can be used. However, this does little to deal with the real problems of the bill: the immunity companies get for sharing pretty much any private info with any government agency. At the very least, there's no reason that CISPA shouldn't require that companies strip personally identifiable information from any data they share with the government.

But, really, this deserves to go much further. At no point -- in the many years that cybersecurity legislation has been discussed -- has anyone in Congress explained why we need this. Yes, they've given FUD-like horror stories about planes falling from the sky, or they've pointed to Chinese hackers. But what they have not done is show how (a) current law gets in the way of the necessary information sharing to help combat any threats or (b) how CISPA will help stop such attacks. You'd think that both of these points would be at the top of the list of the things that Congress would be explaining to get support for this bill. Instead, we hear scare stories about evil hackers out to destroy us, and an awful lot of "trust us." It's tough to trust the government, though, when they won't even let you know what they're debating.

Filed Under: cispa, cybersecurity, hearings, markup, secrecy

Congress Planning To Debate CISPA Behind Closed Doors; No Public Scrutiny Allowed

from the shameful dept

We've been hearing for a while that when the planned markup occurs next week for CISPA, that the House Intelligence Committee is intending to hold a closed markup, basically hiding the discussion and the possible amendments from the public. There is no good reason for this. The Intelligence Committee will claim, of course, that it needs to do this so that confidential information can be discussed in debating the markup, but that's hogwash. There are numerous concerns with the bill that can and should be addressed publicly. If there are key concerns about classified info getting out, that's easy enough to avoid, since so much that CISPA touches on has nothing to do with classified info -- and whatever comes up can be dealt with appropriately.

The truth is that this is yet another way to try to hide from the public on this issue. Congress doesn't want an open discussion on the many problems with CISPA, so it does what it does best: try to hide things away and rush them through when (hopefully) not enough people are looking. It makes you wonder just what CISPA's supporters are so worried about. Congress is supposed to work for the public, not hide things away from the public. This isn't a situation where they're discussing classified info or plans -- but merely a bill focused on information sharing between the government and private companies. Any markup on CISPA needs to be public.

Filed Under: cispa, congress, house intelligence committee, markup, openness, privacy, scrutiny

The List Of Government Agencies That Can Get Your Data Under CISPA

from the does-the-council-of-economic-advisors-need-your-emails? dept

One of the key complaints about CISPA is the fact that it does absolutely nothing to make sure any data of yours that is shared with the government by third parties is sent narrowly to folks working to protect us from cybersecurity threats. Instead, the information can be shared with any agency of the government, so long as they can claim, vaguely, that it's being used for "cybersecurity purposes." But, as the EFF points out, without any limitations on who in the government can see your data, every government agency can see your data. They've even put together a helpful "list."

One question we sometimes get is: Under CISPA, which government agencies can receive this data? For example, could the FBI, NSA, or Immigration and Customs Enforcement receive data if CISPA were to pass?

The answer is yes. Any government agency could receive data from companies if this were to pass, meaning identifiable data could be flowing to the Bureau of Alcohol, Tobacco, Firearms and Explosives, the National Security Agency, or even the Food and Drug Administration.

We've reposted the list below as well, just so you can get an idea of which government agencies could get access to your data on CISPA (and which ones thought that, perhaps, that's not such a good idea).

Filed Under: cispa, cybersecurity, data, government agencies, privacy

CISPA Sponsor Tweets, Then Deletes, About How Much More Lobbying Dollars Have Come From Pro-CISPA Groups

from the read-before-you-retweet dept

Ah, transparency. The Sunlight Foundation put together Politwoops last year to highlight tweets that elected officials deleted. Mostly it's innocuous stuff, but sometimes some real gems come through. For example, the account of Rep. Mike Rogers, who is the main Representative behind CISPA, retweeted but then deleted a MapLight tweet about how the House Intelligence Committee, which Rogers chairs, "received 15 times more from pro-CISPA groups than anti-CISPA orgs." You can see MapLight's data here. Of course, we've said from the beginning that much of this "cybersecurity" stuff is really about money, and that tweet just highlighted that plenty of that money is flowing directly into Congress. Obviously, that doesn't look too good for Rep. Rogers (or whatever poor staffer runs his Twitter feed), and it took someone all of 23 minutes to realize that Rogers was more or less promoting the fact that his side had received 15x more in lobbying dollars -- and that probably doesn't look too good. Still, for those who believe in transparency, it was a nice admission, albeit a brief one.

Update: Oh, and it gets better. Rogers has been using the hashtag #CISPAalert in a bunch of his tweets in support of CISPA. But that hashtag was set up by the EFF, and every tweet that uses that hashtag helps fund the EFF in its fight against CISPA.

Rogers (R-Mich.)'s official Twitter account has, since Wednesday, been using the hashtag #CISPAalert to address criticism of his Cyber Intelligence Security Protection Act (CISPA). Activists are wrong, he says. CISPA wouldn't allow government "monitoring anyone’s email or personal information."

But the congressman—or whoever runs his Twitter account—doesn't seem to have gotten the memo. A domain name registrar called Namecheap is running a promotion: offering a dollar to Internet activists at the Electronic Frontier Foundation for each tweet with that hashtag. The EFF is actively campaigning against CISPA, calling it a “privacy-invading cybersecurity spying bill.”

I'm sure once CISPA is in place, Rogers will figure out this Twitter stuff.

Filed Under: cispa, house intelligence committee, lobbying dollars, mike rogers, politwoops, transparency

Time To Speak Up About CISPA: We Shouldn't Be Scared Into Giving Up Our Privacy

from the speak-out-now dept

A bunch of groups are teaming up this week to call for a week of action against CISPA just as Congress is gearing up, yet again, to push through this cybersecurity bill based on a lot of FUD, with little to back it up. To be clear, there are a lot of challenges around online (can we dump the stupid "cyber" prefix?) security out there, and it's clear that there is plenty of malicious and government-sponsored hacking and attacks. But we need to put this all in perspective. First off, there is already tremendous incentive to combat these attacks, and there are existing methods to do so. Second, no one has given a reasonable response to explain how something like CISPA will do anything at all to help prevent such attacks in the future. Third, while these attacks may be economically damaging, there is little evidence of them creating real physical harm to date. That's not to say it's not possible in the future, but stories of airplanes falling from the sky are quite exaggerated. Fourth, and most importantly, no one has explained why we all need to sacrifice our own privacy for these vague and undefined benefits.

A bunch of groups are fighting this, and now is the time to take part. EFF and Fight for the Future have put together a simple page to help you take action. As they point out there are three key objectionable parts to CISPA:

• Eviscerating existing privacy laws by giving overly broad legal immunity to companies who share users' private information, including the content of communications, with the government.
• Authorizing companies to disclose users' data directly to the NSA, a military agency that operates secretly and without public accountability.
• Broad definitions that allow users' sensitive personal information to be used for a range of purposes, including for "national security," not just computer and network security.

None of these are even remotely necessary to allow for effectively combating online attacks, but all certainly would be quite handy in helping the government snoop on the activities of citizens (and non-citizens) without much oversight. Considering how often we've seen other laws passed in a flurry of FUD around other "threats" later turn out to be abused by government officials for the sake of snooping, rather than any legitimate reason, we should be very concerned about these efforts here.

Filed Under: cispa, cybersecurity, fud, privacy, security, speak out, week of action

Facebook Backs Away Quietly From Its CISPA Support

from the good-for-them dept

Many in the internet community were disappointed a year ago when Facebook came out in favor of CISPA. Facebook made its case publicly, agreeing that there were some privacy and civil liberties concerns with the bill, but that on the whole the bill was good. Of course, more cynical people might point out that since the general immunity provisions of CISPA would protect Facebook from liability in sharing info with the government, that of course they'd like it. However, it appears that Facebook is reconsidering that position, perhaps aware of how much public opposition there is to CISPA. Facebook is no longer listed as a CISPA supporter, though it also has not come out directly against the bill. Instead, it issued a statement that says basically nothing:

We are encouraged by the continued attention of Congress to this important issue and we look forward to working with both the House and the Senate to find a legislative balance that promotes government sharing of cyberthreat information with the private sector while also ensuring the privacy of our users.

Still, it's encouraging that a company, like Facebook, which really does rely on the support of their userbase, appears to at least recognize that something like CISPA might not be good for its users. In fact, this seems similar to when Microsoft backed away from its CISPA support last year as well. The article linked above notes that Microsoft still feels the same way, citing the concerns about user privacy with the current draft of CISPA.

So, who is supporting CISPA? The telcos are still there, not surprisingly, as well as mostly infrastructure providers, rather than any company that has a bunch of its own internet users. So, you see IBM, Intel and Juniper Networks. But there is not a single real "internet" company in the bunch any more. Perhaps that should be a loud hint for CISPA's sponsors that the bill is not a good thing for the internet world.

Filed Under: cispa, internet, privacy, telcos
Companies: at&t, comcast, facebook, ibm, intel, juniper networks, microsoft, time warner cable, verizon

Why CISPA Could Actually Lead To More Hacking Attacks

from the unintended-consequences dept

One thing we've talked about for years is that lawmakers are notoriously bad at thinking through the unintended consequences of legislation they put forth. They seem to think that whatever they set the law to be will work perfectly, and that there won't be any other consequences. This is one reason why we're so wary of simple "fixes" even when the idea or purpose sound good up front. "Protecting artists" sounds good... unless it destroys the kinds of services artists need. Cybersecurity sounds good, unless it actually makes it easier to violate your privacy. And, now, people are realizing that not only may cybersecurity rules like CISPA be awful for privacy, but they could potentially lead to more "cyber" attacks, as companies look to "hack back" against those who attack them. As Politico describes:

The idea is known as "active defense" to some, "strike-back" capability to others and "counter measures" to still more experts in the burgeoning cybersecurity field. Whatever the name, the idea is this: Don't just erect walls to prevent cyberattacks, make it more difficult for hackers to climb into your systems — and pursue aggressively those who do.

So, how would cybersecurity rules create more hacking? Well, possibly by encouraging this kind of behavior by providing some amount of cover for it. The Cybersecurity bill in the Senate last year included an undefined allowance for "counter measures." CISPA doesn't explicitly mention that, but some in the security field are interpreting the bill to provide some amount of cover for such "counter measures" in which they could "perform hacks against threats." But, if you're trying to discourage online attacks, that seems like a problem. The likelihood of someone attacking the wrong target is quite high, and it could create quite a mess.

Thankfully, the folks behind CISPA suggest that they're willing to change the bill to make it more explicit that such countermeasures are not allowed, but until that's in place, it's a serious concern:

Some of those fears have reached Rep. Mike Rogers (R-Mich.), chairman of the chamber's Intelligence Committee and one of CISPA's lead authors. In fact, panel aides told POLITICO they're open to revising the relevant definitions in the bill. And Rogers himself this year has railed on the idea of an aggressive active defense, describing it as a "disaster for us" at a time when the country's digital defenses remain subpar.

Even if they fix this particular hole, it's these kinds of things that should worry all of us about broad laws that provide things like blanket immunity over ill-defined concepts like "cybersecurity" and "cyberattacks." The likelihood of it being abused is quite high, especially in an ever changing technology world. Just look at computer laws like the CFAA and ECPA, which cover various computer crimes and privacy today. Both are ridiculously outdated, with concepts that are laughable by any rational view today. And thus, there are massive unintended consequences associated with both laws. Before we rush into creating new laws with big broad vague terms, perhaps we should focus on fixing the old laws and proceeding with caution on any new ones.

Filed Under: active defense, cispa, counter measures, cybersecurity, hacking, privacy, strike back, unintended consequences

Director Of National Intelligence Admits That There's Little Risk Of A 'Cyber Pearl Harbor'

from the so-why-are-we-rushing? dept

We've been pointing out for years that all the talk about "cyberattacks" and "cybersecurity" appear to be FUD, mostly designed to scare up money for "defense" contractors looking for a new digital angle. And yet, we keep seeing fear-mongering report after fear mongering report insisting that we're facing imminent threats of such a dire nature that multiple people keep referring to this ridiculous concept of the "cyber Pearl Harbor" which is going to happen any day now if we don't pass vaguely worded bills that will surely ramp up huge contracts. And yet, every time we'd hear these cinematic scare stories, we'd point out that no one has yet died from a "cyber attack" and ask: where was the actual evidence of real harm? Yes, we've seen hack attacks that are disruptive or really about espionage. But that "big threat" coming down to get us all? There's been nothing to support it.

And perhaps that's because it doesn't exist. Amazingly, the Director of National Intelligence, James Clapper, actually admitted in a Senate hearing that there's little risk of any "cyber Pearl Harbor" in the foreseeable future:

“We judge that there is a remote chance of a major cyber attack against U.S. critical infrastructure systems during the next two years that would result in long-term, wide-scale disruption of services, such as a regional power outage,” Clapper said in his statement to the committee. “The level of technical expertise and operational sophistication required for such an attack — including the ability to create physical damage or overcome mitigation factors like manual overrides — will be out of reach for most actors during this time frame. Advanced cyber actors — such as Russia and China — are unlikely to launch such a devastating attack against the United States outside of a military conflict or crisis that they believe threatens their vital interests.”

He later admitted that some others -- who weren't as knowledgeable -- might be able to sneak in some attacks here or there, but that the impact would likely be minimal:

“These less advanced but highly motivated actors could access some poorly protected US networks that control core functions, such as power generation, during the next two years, although their ability to leverage that access to cause high-impact, systemic disruptions will probably be limited. At the same time, there is a risk that unsophisticated attacks would have significant outcomes due to unexpected system configurations and mistakes, or that vulnerability at one node might spill over and contaminate other parts of a networked system,” he said.

Of course, at the very same hearing, the NSA's General Keith Alexander kept up the propaganda about threats. Alexander has been among those who have been spreading FUD about the "threats" -- including ridiculous claims about Anonymous shutting down the power grid -- so sticking to that line is hardly much of a surprise. This time around he focused on an increasing rate of attacks on Wall Street banks.

He also pulled out the old "the Chinese are stealing our business secrets!" claim. That always sounds good for Congress, but it is unclear how much real impact it has had.

But the Cyber Command chief stressed that the U.S. needs to clamp down on this intellectual property theft, warning it will ultimately "hurt our nation significantly."

"For the nation as a whole, this is our future. This intellectual property, from an economic perspective, represents future wealth and we're losing that," Alexander said.

It doesn't appear he has any real basis for saying that. There are all sorts of ways to compete and to innovate, and falling back on relying intellectual property laws may be the least useful and least efficient manner for doing so.

It would be nice if we could stop all the blatant fear mongering and focus on any actual problems, such as highlighting what important information isn't being shared today, since we keep getting told that it's our lack of information sharing that will lead to a cyber pearl harbor. Now that we know the threat isn't imminent, can we sit back and look at the actual evidence, understand what the real problem is, and see if there's a way to solve it that doesn't involve giving up everyone's privacy rights?

Filed Under: cispa, cybersecurity, digital pearl harbor, dni, james clapper, keith alexander, nsa

White House Petition Against CISPA Gets Over The 100,000 Signature Threshold

from the good-sign dept

Yet another White House petition has made it over the 100,000 signature mark, which is necessary to get a response. This one is asking the White House not to support CISPA, arguing that the terms are too broad, and the possibility of abuse is simply too high. To date, the White House has actually been rather cool on CISPA, preferring an approach that actually does include some privacy protections (but, also one that has a few more mandates for companies). Just last week, DHS boss Janet Napolitano gave a speech in which she suggested that CISPA did not do enough to protect privacy -- and made it even more clear during Q&A, in which she said of CISPA:

"There were no privacy protections built within it and it resided almost all of the cyber information monitoring responsibilities within the NSA, which of course is part of the military."

Of course, some of this is a turf battle. CISPA gives more power to the Defense Department (which the NSA is a part of). The approach favored by the White House gives more power to Homeland Security.

Either way, this would make it easy for the White House to quickly come out in support of the petition, but still say that "something needs to be done" on cybersecurity -- but exactly what that is still fairly murky. There have been a number of rumors that CISPA supporters have been "negotiating" with the White House, and that could mean tradeoffs that allow a bad bill to get through. This is something that needs to be watched carefully.

Filed Under: cispa, petition, privacy, signatures

Will Jurisdictional Fight Slow Down CISPA's Momentum?

from the one-hopes dept

Thanks to a fair bit of propaganda making the rounds, it feels like CISPA -- the cybersecurity bill that seeks to obliterate privacy protections without explaining how that will increase our security -- is on a bit of a fast track towards approval. However a bit of a stumbling block may have popped up. Congressional Representatives Bennie Thompson and Yvette Clarke -- the ranking members on the Committee on Homeland Security and the Subcommittee on Cybersecurity, Infrastructure Protection and Security Technologies -- have suddenly realized that all of this is happening without their support. That is, they finally realized that, while this is being handled by the Intelligence Committee, it directly impacts Homeland Security and Cyersecurity (obviously), and so they're suddenly asking why it's not going through their committees.

This is just a basic jurisdictional dispute between various fiefdoms within Congress. They pop up every now and again, and usually get resolved in due time. However, in the short term, it could certainly represent a speed bump that hopefully slows down the pace at which Congress seems to want to rush into approving CISPA.

Filed Under: bennie thompson, cispa, congress, cybersecurity, homeland security, jurisdiction, momentum, yvette clarke