The CISPA Circus Goes To Baltimore With Another Misleading 'Local Pride' Editorial

from the maryland-versus-china dept

Recently, I responded to an editorial by CISPA author Mike Rogers in the Detroit News, wherein he took some blatant China fearmongering and targeted it at Michigan's specific industry concerns to rouse the local rabble in CISPA's favor. Now Rep. Ruppersberger—the other driving force behind the bill—is applying the same tactic in Maryland, with an editorial in the Baltimore Sun that focuses on the supposed cyber-threat to the life sciences industry:

Here in Maryland, for example, our growing life sciences sector has generated one-third of all job gains over the last 10 years. It's now supporting more than $9.6 billion in salaries for Maryland families and contributes nearly $500 million to incomes and sales tax revenues each year.

The 500 bioscience companies in Maryland are developing ground-breaking therapies for diseases like muscular dystrophy, inventing state-of-the-art medical devices and testing cutting-edge vaccines. These innovations are valuable and worth protecting. Indeed, just like designer handbags or secret family recipes, many want to imitate — and even duplicate — such successes.

For decades, countries like China have been using every means possible to steal the ideas of American corporations. Today, thousands of highly trained Chinese, Russian and Iranian hackers are pilfering our trade secrets by breaking into the computer networks of U.S. corporations. And we're leaving the door unlocked for them.

Something seems off about comparing the desire to copy new disease therapies with the desire to make knockoff handbags, but I guess that was just meant to clarify things for anyone who didn't understand why ground-breaking medical research is valuable. Of more concern is his statement that the door is left "unlocked"—a blatant exaggeration that makes it sound like CISPA's data-sharing provisions are the difference between airtight security and no security at all, even though security experts question whether CISPA would have any real impact. He then goes on to do exactly what I criticized Rogers for doing, by focusing in on the one (supposedly) useful and genuine cybersecurity aspect of the bill while ignoring the rest:

Currently, the U.S government can identify malicious computer code that could be an incoming cyber attack on a government or corporate network. But the law won't allow us to share this information with private companies so that they can protect themselves.

That's why House Intelligence Committee Chairman Mike Rogers, a Michigan Republican, and I have crafted the Cyber Intelligence and Sharing Protection Act (H.R. 3523), which the House overwhelmingly passed this month in a bipartisan vote. This common-sense bill will simply allow the federal government and American companies to share suspicious computer code. Despite recent media reports, the bill does not authorize the government to monitor your computer use or read your email, Tweets or Facebook posts. Nor does it authorize the government to shut down websites or require companies to turn over personal information.

This is just a bunch of half-truths, semantics and disingenuous statements. Firstly, while there may be some data sharing the government wants to do that is currently blocked by the law, there are also existing mechanisms that allow some sharing to happen. Rather than carve out specific exceptions to the specific laws that are getting in the way, CISPA creates broad immunity provisions that wipe out all existing privacy concerns.

Secondly, the bill does not "simply" allow what Ruppersberger says it allows. CISPA's definition of the information that can be shared allows for much more than just "suspicious computer code," instead potentially including all sorts of tangential data related to a network attack—which, yes, could include lots of personal information. CISPA also does not limit the government to using this information for merely technical purposes related to cybersecurity—it permits them to dig through whatever data they collect for evidence of certain types of crime. You'll notice that investigating violent crime and child exploitation (both specifically listed in the text of CISPA) are not mentioned anywhere in this editorial.

Thirdly, while both of Ruppersberger's assertions about what the bill "does not authorize" the government to do are technically accurate, only the latter is giving the full story. It's true that CISPA does not permit the government to shut down websites or require information from companies—but as for monitoring people and reading their communications, as I just described, it's a bit more complicated. No, CISPA does not allow the government to go out and monitor whoever they wish, but it does allow them to thoroughly mine whatever data is given to them—data that will undoubtedly include private information.

For good measure, Ruppersberger throws in some more fearmongering about terrorist hackers taking down power grids (even though CISPA doesn't include anything that would let the government put a common sense regulation in place, like, say, don't connect power grids to the internet) before circling back to the talking-point of Maryland's valuable medical research. Like Rogers, he plays up the imminence of the threat, claiming "it wouldn't take years from China to steal it all from us" and in fact "it could happen in mere keystrokes"—as if at any moment someone could just select "U.S. Economy" and press delete.

I have a feeling this won't be the last of these locally-focused editorials from the pro-CISPA camp. I'm rooting for a Las Vegas feature on the need to protect casino secrets, because while it would surely still be inaccurate and misleading, it might at least be interesting.

Filed Under: baltimore, cispa, dutch ruppersberger, maryland, medical research, mike rogers

A Speculative Example Of CISPA's Potential For Abuse

from the just-barely-fiction dept

In all the talk about how CISPA represents a threat to privacy and civil liberties, it's easy to get lost in the legislative semantics and to lose track of the very real dangers the bill presents. It's not as though CISPA is going to be signed and the next day everyone's going to wake up having always been at war with Eastasia, but the bill is a significant step in the erosion of key privacy rights that stem from the 4th Amendment—the sort of rights citizens are supposed to be vigilant about giving up to the government, even if it doesn't mean their lives are going to change overnight. At the same time, it's not a purely philosophical issue: CISPA or a similarly problematic bill can and will be abused if it becomes law.

Over at Lifehacker, Adam Dachis spoke to law professer Derek Bambauer and used their conversation as the basis for a piece of speculative fiction from the point of view of someone who falls victim to CISPA abuse. It's a well-executed concept that steers clear of sensationalism and presents a realistic example of how CISPA would grant the government new powers in areas far beyond cybersecurity, and how innocents might get swept up by those powers. The fictional narrator, who struggles through an ethically challenging college assignment on child pornography laws, has his name dragged through the mud after the school turned its computer logs over to the feds as part of a hacking investigation and his search history landed him under scrutiny. This nicely demonstrates one of the big problems with CISPA: the affirmative search permissions it would grant, which allow the government to dig through cybersecurity data for evidence of other crimes.

The story's message can't really be conveyed in snippets, but here's a brief excerpt:

As I continued my research I found more and more instances of laws with vaguely-defined terms that were designed to be tough on crime. No one bothered to oppose them in fear of being painted weak, or as a lover of terrorism and sexual deviancy. As a result, innocent people ended up in jail as collateral damage. The law had chosen to try and assuage our fears by sacrificing our freedoms as payment. But even worse, it didn't seem to be working. When you cast a wide net, you not only catch too many fish but so many that you can't find the fish you're actually looking for. People who broke the law weren't getting caught because the resources previously utilized to catch them were diverted to finding offenders before they actually offended. It's a nice thought to think we can preemptively prevent a crime, but it just doesn't work.

Whether it's Chinese hackers or child pornography, it's vital that hot-button panics don't override evidence and common sense in crafting legislation. Even more importantly, people should only allow the government to bypass their rights under extremely limited circumstances, if at all. There's a famous quote about liberty and security, but I don't want to Google it lest I end up on a watch-list somewhere...

Filed Under: cispa, cybersecurity, derek bambauer, fiction, privacy

CISPA Sponsor Warns Bill Is Needed Because China's Chinese Hackers From China Are Stealing All-American Secrets (China!)

from the give-them-to-us-instead dept

While the focus on the cybersecurity debate shifts to the Senate, the supporters of CISPA are still loudly trumpeting that bill's supposed merits. Though the final legislation that will go before the President is undecided, and may not even be based on CISPA in the end, the details of the bill are still very important, as they contribute to the overall shape of the discussion about cybersecurity. As part of the ongoing media campaign, CISPA author Mike Rogers took to the pages of The Detroit News last week to drum up support with a screed that reeks of nationalist fearmongering and utterly misrepresents the scope and purpose of the language in the bill.

The United States, over time, became a global superpower with its hard work and know-how leading to innovations in new manufacturing, health care and information technologies. Now China is trying to use cyber espionage and theft to take a short cut to achieving superpower status.

It began with China stealing hard-copy business plans and sensitive research-and-development information from U.S. and other Western companies when their executives traveled to China. U.S. companies soon began noticing a surge in counterfeit products as their innovations were being stolen, re-engineered, and sold by Chinese companies on global markets.

With the Internet boom, China turned its focus to cyber espionage and began stealing the hard work and innovations of U.S. companies on a far larger scale.

Rogers should be careful—if he says 'China' any more times, Fu Manchu might appear in the mirror and drain his 401(k). Once he's got the reader good and scared of the Yellow Menace (having thrown in a few emotional appeals to hardworking Michigan autoworkers for good measure), he explains how CISPA is needed to take care of all those annoying regulations that limit government power and protect people's privacy:

Unfortunately, American companies are not getting the best protection available.Today, the U.S. government has intelligence information about the threat posed by nation-state actors that could help the American private sector better protect itself. However, we don't currently have a mechanism for allowing the government to share intelligence about cyber threats with the private sector, nor do we have the ability for private sector companies to share information with others in the private sector, and with the government on a voluntary basis, so that the private sector can better protect itself.

And you know what? That's fine. Even though there is a lot of debate about the true scope of foreign cyber threats, if there is a way for the government and the private sector to share anonymous network analysis data in order to improve technological defenses against hacking and malware attacks, it makes sense to legislate a mechanism for them to do so. Unfortunately, CISPA goes way beyond that—now explicitly so.

This goes back to my opinion when CISPA was amended and passed in the House: my initial reaction that it had gotten much worse was partially incorrect, but even though the amendments did technically limit the government's power under the bill, I still had (and have) a problem with the way they expanded the stated intent and purpose. From the very start, CISPA supporters have insisted (as Rogers does in this column) that it's basically all about technical considerations in fighting off foreign cyber attacks. Initially, privacy and civil liberties groups objected that it would allow the government to do much more, including accessing the private data of American citizens without a warrant—and the response was basically "no, no, it has nothing to do with that".

Right up to the last minute of debate before the House vote, CISPA's backers held to the talking points and expounded on the threat from China and the need to share technical network data. But, to appease privacy groups, they supported an amendment to limit the ways the government could use shared data under the bill to a set of explicit purposes. And what were those purposes? Far from just foreign threats, they include investigating domestic cybercrime, investigating domestic violent crime, protecting children from exploitation, and of course the catch-all "national security" that was already in the language.

It feels trite to add the obligatory preventing violence and protecting children is a good thing here, because d'uh, but when exactly did CISPA become a bill about these things? If the government wants new exceptions to privacy laws for the purposes of fighting crime, that's a major discussion with obvious constitutional implications—a discussion that privacy groups have been trying to start all along, but have been brushed off with claims that CISPA is just about rebuffing those devious foreigners. Now CISPA explicitly includes provisions for collecting evidence on domestic crime, but Rogers is still writing editorials like this one that don't mention anything to do with child exploitation, violent crime, or anything else that doesn't have the word China attached to it.

Rogers finishes the piece with a rather astonishing little rallying call:

It took Michigan's auto industry decades to achieve its prominence and the United States centuries to become a global superpower. We cannot let China steal it all away in a few short years.

I'm not sure how long it's been since Rogers visited Flint, but I think it's changed a little since he was last there. Nonetheless, the point is clear: if the government can't snoop your data for child porn and affiliations with Anonymous, the Chinese are going to start manufacturing American cars and destroy the Michigan auto industry, in turn toppling the U.S. as an economic superpower. Wait, did I say "clear"?

Filed Under: china, cispa, cybersecurity, michigan, mike rogers, nationalism

White House Reiterates Plans To Veto CISPA In Its Current Form; Though For The Wrong Reasons

from the amendments-not-convincing dept

As I'm sure you remember, the House passed CISPA with a few amendments -- some of which may have limited the possible abuses, while at the same time expanding the scope. Right before the bill went up for a vote, the White House stated that it would veto CISPA, if it got to the President's desk. It appears that, even with the amendments, the White House is still not willing to support the bill. White House "Cybersecurity Coordinator" Howard Schmidt appeared on CSPAN reiterating the White House's objections to CISPA, specifically calling out the problematic privacy issues.

That said, the White House is still supporting the Lieberman cybersecurity bill in the Senate, which isn't quite as bad as some of the other proposals, but still has plenty of problems. And, most importantly, still doesn't include any clear explanation for why it's needed. It's bizarre and troubling that no one in the federal government seems willing to provide a real justification for any of these bills others than "oooooh, it's scary out there on the internet!!"

Filed Under: cispa, cybersecurity, veto, white house

Fearmongering Around 'Cyber' Threats Puts Internet Openness At Risk

from the it's-a-problem dept

Susan Crawford has an intriguing column over at Bloomberg where she notes that the ongoing effort by politicians to fearmonger around the idea of "cybersecurity" and "cyberwar," is a lot more problematic than just a sneaky way to do away with basic privacy protections. Instead, she argues, it's going to create massive damage to one of the key features of the internet that has made it so successful and so useful: its openness:

The dangers of this digital special-ops saber-rattling are breathtaking. Secretary of State Hillary Clinton has been valiantly advocating for Internet freedom, strategic multilateralism, engagement and “smart power” around the world. The White House has said its objective is to work with other nations to “encourage responsible behavior and oppose those who would seek to disrupt networks and systems.”

Purveyors of cyberfear are going in the opposite direction. They are not interested in engaging with other countries to come up with codes of online conduct or to translate the Geneva Conventions for cyberspace -- so as to avoid collateral damage and protect hospitals, electrical grids, and so on. They want to be able to change ones to zeros on servers around the globe, whatever that means for speech and commerce at home and worldwide.

Given the undeniable benefits that the open global Internet has brought to the U.S., building moats around our networks and subjecting them to constant, unaccountable audits and other restraints -- all in the service of an immense online warfighting machine staffed by military contractors -- would be burning the village in order to save it

Plenty of people have argued that SOPA was quite different from CISPA, because SOPA did attack fundamental principles of the internet, while CISPA was just an attack on privacy. So it's interesting to see Crawford's opinion suggesting that CISPA, and other bills like it, also put some aspects of the traditional internet at risk, though in a more indirect manner.

At this point, it's impossible to deny that the people behind both bills have written them with little understanding of the internet, or how it reacts to attempts to take away openness or lock things up. Such moves will have significant unintended consequences. I wouldn't go so far as to say that CISPA itself is an attack on the internet, but it does seem reasonable to say that the theories behind it are a significant departure from the openness that the internet has thrived on in the past.

Filed Under: cispa, cybersecurity, cyberwar, open internet, sopa

Microsoft Slowly Backing Away From CISPA Support; Worries About Privacy Issues

from the take-a-stand dept

One of the key points that backers of CISPA had made throughout the debate on the bill was that it had the support of the "tech industry" -- with Facebook and Microsoft being the key supporters of the bill. Of course, a few weeks ago, Facebook re-pledged its support for the bill... but also stated that it was aware of the privacy concerns and that it would work with lawmakers to fix the bill. Seeing as it's not clear that much was really done to fix the bill, does that mean Facebook may drop its support?

Similarly, Microsoft is now admitting that there are some privacy concerns with CISPA and has softened its stance on it slightly, while not completely pulling its support. Declan McCullagh at CNET reports:

In response to queries from CNET, Microsoft, which has long been viewed as a supporter of the Cyber Intelligence Sharing and Protection Act, said this evening that any law must allow "us to honor the privacy and security promises we make to our customers."

Microsoft added that it wants to "ensure the final legislation helps to tackle the real threat of cybercrime while protecting consumer privacy."

This sounds similar to what Facebook was saying. Of course, what's not clear is why they're unwilling to pull support from the bills until such changes are made. Either way, combined with the fact that a few CISPA sponsors even voted against the bill suggests that -- even though it may have passed the House -- support for the overall bill is eroding. That's important, as the fight now moves to the Senate, where the existing cybersecurity proposals are quite different.

Filed Under: cispa, cybersecurity
Companies: facebook, microsoft

Law Enforcement Already Has A Way To Share 'Cybersecurity' Info With Companies; Why Do We Need CISPA?

from the this-makes-no-sense dept

The whole CISPA situation keeps looking more and more questionable. For months, we've been raising the question of why we needed such a law in the first place, because the evidence of any online threat that required such a law seemed hyperbolic at best, and perhaps naively anecdotal, at worst. However, there's another dimension to the "why" question. It's not just that the actual risk hasn't been quantified, it's not clear that the government and companies actually need a new law to share such security info in the first place. As we stated, the "right" way to do this would be to look at where the actual roadblocks are today in sharing such info. And there's some evidence that such roadblocks don't even exist.

Kashmir Hill has a great post showing how the FBI and companies already share the kind of info that the bill's sponsors claim the bill is needed to allow.

The FBI has been information-sharing with private industry for over a decade without a bill like CISPA in place.

In 1997, long-time FBI agent Dan Larkin helped set up a non-profit based in Pittsburgh that “functions as a conduit between private industry and law enforcement.” Its industry members, which include banks, ISPs, telcos, credit card companies, pharmaceutical companies, and others can hand over cyberthreat information to the non-profit, called the National Cyber Forensics and Training Alliance (NCFTA), which has a legal agreement with the government that allows it to then hand over info to the FBI. Conveniently, the FBI has a unit, the Cyber Initiative and Resource Fusion Unit, stationed in the NCFTA’s office. Companies can share information with the 501(c)6 non-profit that they would be wary of (or prohibited from) sharing directly with the FBI.

In other words, if sharing info was important, we already had a perfectly functional model that's been in place for 15 years. This means, either that the Congressional authors and supporters of this bill were completely ignorant of this or CISPA is really meant to sneak through something worse. Neither makes CISPA or its supporters look very good. I'm actually hoping that the truth is that they're just ignorant and passing laws on issues they don't understand, because the other choice is even more depressing.

Filed Under: cispa, cybersecurity, fbi, information sharing

Did CISPA Actually Get Better Before Passing? Not Really

from the depends-on-how-you-define-"better" dept

Yesterday, after I asserted that CISPA had gotten much worse before it was passed in a rushed vote, I heard from several people (even those in the anti-CISPA camp) who took the opposite position. They feel that, while CISPA is still a highly problematic bill, the Quayle amendment which I roundly criticized actually represented a significant last-minute improvement to the text. I still don't see it that way, for reasons I explain below, but they did make an important point that is worth calling attention to.

Basically, under their reading of the previous text, it allowed the government to use the data for any non-regulatory purpose as long as it has one cybersecurity or national security purpose. I hadn't initially read it that way but I completely agree, and that is indeed a troublesome wild card to hand to the government. The amendment removed the broad "any lawful purpose" language, replacing it with the list of five specific uses (cybersecurity, cyber crime, protecting people from harm, protecting children from exploitation, and national security), thus closing that gaping hole in the bill. In that sense, it's a good amendment.

But, does it really improve CISPA? That depends on how you look at it. CISPA is supposed to be a "cybersecurity" bill, and both its supporters and its opponents in Congress have repeatedly stated that cybersecurity means protecting networks and systems from disruption, hacking and malicious code—primarily coming from overseas. Even during yesterday's debate, virtually every representative who spoke opened with a speech on this topic, and Ruppersberger himself insisted that CISPA's sole purpose was allowing companies and the government to share "formulas, Xs and Os, the virus code". (I'm pretty sure he meant "1s and 0s", but what do you expect from someone who doesn't understand the thing he's trying to legislate?)

Now, critics of the bill have of course been saying all along that it could be used for things way beyond this stated cybersecurity purpose. But the response from supporters has been consistent: no, it can't, and even if it can, it won't be. [Insert another impassioned speech about the cyber-threat from China.] Then, suddenly, only a few minutes before the final vote, the representatives near-unanimously amend CISPA to include these brand new targets of bodily harm and child exploitation, which have nothing to do with cybersecurity and which have rarely if ever been mentioned in relation to the bill.

Basically, the amendment closes a loophole but opens a door. It takes away some of the language that allows overreach of the bill, but then explicitly endorses the exact things people were worried the government would do with that language—as in, start using the data to investigate and build cases against American citizens without regard for the laws that would normally protect their privacy.

Is that an improvement? CISPA would now grant the government less vague power, which is good, but would also grant it brand new specific powers, which is bad and frankly pretty insulting. Because, if this is indeed an improvement and a narrowing of the government's power, how are we to take that if not as a confession that virtually every representative has been baldly lying this whole time? They have said over and over again that they don't want or plan to use the bill for anything except shoring up network security, but we're supposed to see the addition of these brand new applications as limiting CISPA's target? To me, that sounds like they're saying: "Okay, you got us—we really wanted to secretly do all this other stuff. As long as you still let us do that, we'll change the bill."

So the way I see it, there are two ways to look at the Quayle amendment: either it made the bill worse, by massively expanding its stated purpose to whole new areas of the law such that it can no longer accurately be called a "cybersecurity" bill at all, or else it made the bill better by codifying the ways it can be abused for non-cybersecurity purposes.

Of course, it's not as though everyone trusted what supporters were saying about the bill's purpose before. We all knew it would be used for these other things. But simply getting them to admit that is not really progress. It's accurate to say that the amendment has limited the government's power under CISPA by changing the language, but it's also ludicrous to say that turning a cybersecurity/national-security bill into a cybersecurity/cybercrime/violent-crime/child-exploitation/national-security bill at the last minute represents narrowing or improving it. In fact, the only way that's an improvement is if the representatives are admitting that they were planning on it being used for even more unstated purposes all along, but are now content with choosing only a few of the things they have repeatedly denied they wanted. I see how that can be framed as progress, but it's not exactly something that the House deserves any praise for.

Filed Under: cispa, congress, cybersecurity

Insanity: CISPA Just Got Way Worse, And Then Passed On Rushed Vote

from the this-is-crazy dept

Update: Several people have asserted that Quayle's amendment actually made CISPA better, not worse. I've now posted my thoughts on that.

Up until this afternoon, the final vote on CISPA was supposed to be tomorrow. Then, abruptly, it was moved up today—and the House voted in favor of its passage with a vote of 248-168. But that's not even the worst part.

The vote followed the debate on amendments, several of which were passed. Among them was an absolutely terrible change (pdf and embedded below—scroll to amendment #6) to the definition of what the government can do with shared information, put forth by Rep. Quayle. Astonishingly, it was described as limiting the government's power, even though it in fact expands it by adding more items to the list of acceptable purposes for which shared information can be used. Even more astonishingly, it passed with a near-unanimous vote. The CISPA that was just approved by the House is much worse than the CISPA being discussed as recently as this morning.

Previously, CISPA allowed the government to use information for "cybersecurity" or "national security" purposes. Those purposes have not been limited or removed. Instead, three more valid uses have been added: investigation and prosecution of cybersecurity crime, protection of individuals, and protection of children. Cybersecurity crime is defined as any crime involving network disruption or hacking, plus any violation of the CFAA.

Basically this means CISPA can no longer be called a cybersecurity bill at all. The government would be able to search information it collects under CISPA for the purposes of investigating American citizens with complete immunity from all privacy protections as long as they can claim someone committed a "cybersecurity crime". Basically it says the 4th Amendment does not apply online, at all. Moreover, the government could do whatever it wants with the data as long as it can claim that someone was in danger of bodily harm, or that children were somehow threatened—again, notwithstanding absolutely any other law that would normally limit the government's power.

Somehow, incredibly, this was described as limiting CISPA, but it accomplishes the exact opposite. This is very, very bad.

There were some good amendments adopted too—clarifying some definitions, including the fact that merely violating a TOS does not constitute unauthorized network access—but frankly none of them matter in the light of this change. CISPA is now a completely unsupportable bill that rewrites (and effectively eliminates) all privacy laws for any situation that involves a computer. Far from the defense against malevolent foreign entities that the bill was described as by its authors, it is now an explicit attack on the freedoms of every American.

Filed Under: cispa, congress, cybersecurity

There Is A 'Right Way' To Do Cybersecurity Information Sharing, But CISPA Is Not It

from the sharing-is-caring dept

We've argued, repeatedly, that the backers of various cybersecurity bills have failed to give a real reason for why such bills are needed. What is the imminent threat and why does it need legislation? The only point of issue that has made some sense is that you can envision areas where it would be quite useful for companies and governments to share specific threat- or attack-related information, for the purpose of stopping that (or related) threats and attacks. But that's a very limited scenario. The entire framework of CISPA ignores that, which is why it's unclear if the bill even could be fixed. That said, Julian Sanchez, over at the Cato Institute, has posted an interesting analysis of what information sharing regulation should look like. First, he discusses the problem with the CISPA setup:

CISPA worked by creating a sweeping exception to all other privacy and surveillance laws, granting blanket immunity to any “entity” that chose to share vaguely defined “cyber threat information”—potentially including the contents of e-mails or other online communications—with both private actors and the government. When civil liberties advocates cried foul at the prospect of such vast quantities of private data being handed over to government on a silver platter, the bill’s supporters tried to placate them by tacking on an array of after-the-fact anonymization requirements and use restrictions—forbidding the use of the data except for a “cybersecurity purpose” or for “the protection of the national security of the United States.”

That wasn’t much consolation to anyone who’s watched how the government has tried to interpret similar “purpose” restrictions in the past. In 2002, for example, then–Solicitor General Ted Olson argued for a highly expansive view of the “foreign intelligence purposes” for which information obtained through national security wiretaps could be used, including using evidence of misconduct unrelated to terrorism or espionage to force people to become informants. If a wiretap turned up evidence of tax evasion or rape, for instance, Olson suggested the government “could go to that individual and say we’ve got this information and we’re prosecuting and you might be able to help us. I don’t want to foreclose that.” It’s no great leap to imagine a future solicitor general arguing that extorting the cooperation of hackers, penetration testers, or other tech professionals would similarly serve a “cybersecurity purpose.”

Basically, take a broad, vaguely defined law for a specific purpose... but leave it open to allowing the government to stretch that definition, and the government will almost always do so.

But, again, you can see cases where information sharing could be useful, so Sanchez suggests what might make sense there:

Instead of indiscriminately adding a cybersecurity loophole to every statute on the books, why not figure out which specific kinds of information are useful to security professionals without compromising privacy, figure out which laws raise obstacles to that sharing, and then craft appropriately narrow exemptions? (One assumes the intelligence agencies can be afforded more discretion about when to share the information already in their own possession—whatever else one might say about it, “oversharing” is not among the NSA’s problems.)

The exceptions could be appropriately narrowly tailored depending on the sensitivity of the information involved. For instance, different sections of the Electronic Communications Privacy Act deal with different kinds of data. Subsections (1) and (2) of 18 USC §2702 deal with the contents of communications in transit through or stored by a communications provider, generally prohibiting use or disclosure of that information without specific consent. Subsection (3) covers subscriber information and transactional data about those communications, and generally permits voluntary sharing, but specifically prohibits sharing with governmental entities. Since that transactional information is typically less sensitive than communications themselves, an exemption there might allow providers a fair amount of discretion to determine what constitutes “cyber threat information” and permit sharing with government also, subject to the appropriate anonymization and use requirements. For the more sensitive contents, the exception might be limited to a relatively specific laundry list of kinds of data that are both unquestionably security-related and limited in their implications for privacy, such as malware signatures and attack payloads.

In other words, let's more carefully define the real problem here. The government is insisting that information needs to be shared, but that's not "the problem." Information can be shared already. The reason that CISPA works by creating a huge immunity umbrella is that the "problem" with sharing isn't that information can't be shared, but that certain already overburdensome regulations block certain kinds of sharing in situations where it makes sense. The answer isn't to remove all liability for the oversharing of info, but to narrowly create exceptions to where key information that actually is necessary to be shared can have that done without violating the law. In other words, as you dig deeper, it appears that the problem isn't about sharing information -- it's about a series of existing laws that failed to take into account future realities. So, a much more targeted and reasonable solution is to figure out exactly where that friction is, and to clear out those blockages. But, that's not what CISPA does.

Filed Under: cispa, cybersecurity, information sharing, julian sanchez
Companies: cato institute