Can CISPA Be Fixed?

from the perhaps-not dept

We've been arguing for quite some time now that we'd like to see the actual evidence for why a "cybersecurity" bill is actually needed. We've heard fearmongering and warnings of planes falling from the skies, but no evidence that there's a real problem here -- or, if there is a problem, that it needs a legislative solution. And yet, still, CISPA moves forward. Of course, while we still believe that some amendments could fix some of the more egregious problems with CISPA, there is still the big question of whether or not it's needed at all. Larry Downes has taken on the question of whether or not CISPA can be fixed and has decided that it cannot be, and that it represents a real threat to some key elements of the internet ecosystem. He lists out some key rules for policy makers (and goes into great detail on each, so click through):

• Don’t legislate technology using definitions that are either too specific or too general
• Don’t legislate technology until you can articulate concrete and calculable harms
• Don’t encourage or require information sharing with the government unless it’s unavoidable

All of this seems quite reasonable... which is why it's an uphill battle to get people to follow through on it.

Filed Under: cispa, cybersecurity

Congress Decides To Ignore Privacy Concerns, Refuses To Even Consider Key CISPA Amendments

from the major-failure dept

Remember how we said that there were a few key amendments that were necessary to make CISPA even close to palatable? Yeah, well, the House Intelligence Committee House Rules Committee issued its rules for the House debate over CISPA... and basically barred the discussion on all of those key amendments. In other words, for all the talk of how they knew they had to make changes and were willing to compromise and come to a real solution? Yeah, it seems like that was all for show.

Amazingly, CDT, who had been a major player fighting against CISPA had backed off its opposition on Tuesday, believing that the authors of CISPA really were willing to negotiate some changes in good faith. This fact was trumpeted by supporters of the bill to show "proof" that they were listening to constructive ideas. However, by barring the consideration of these amendments, they've shown their true colors. CDT is back to fully opposing the bill.

Filed Under: cdt, cispa, cybersecurity, house intelligence committee

Stupid Politics As Usual To Drive The CISPA Narrative

from the unfortunate dept

Well, this is not too surprising, but it is unfortunate. As the Obama administration has said it would veto CISPA, the House has now turned this into a partisan fight. As with IP issues, I tend to think it's dangerous and stupid when privacy fights become partisan. Once the debate is partisan, it seems to lose all sense of reason and perspective and just degrades into name calling. And there's a chance exactly that is happening with CISPA and other cybersecurity bills, as the Republicans are "daring" the Democrats to support these bills, with the political calculus being that if they don't support these bills and something terrible happens (planes falling from the sky, etc.) that they can then blame the Democrats for being soft on cybercrime. That narrative, of course, ignores the very real privacy concerns that are being raised by a variety of parties. It effectively shifts the entire debate away from finding a real solution, and into a situation where some are pressured to accept a bad solution for the sake of political optics.

Filed Under: cispa, cybersecurity, democrats, obama administration, privacy, republicans

Obama Administration Threatens To Veto CISPA

from the in-no-uncertain-terms dept

Yesterday, the Guardian reported that the Obama administration officially opposed CISPA—but they also noted that there was no mention of the V-word. Now that's changed. The executive office just released a statement which says in no uncertain terms that they will be pushing for a veto of the bill:

Legislation should address core critical infrastructure vulnerabilities without sacrificing the fundamental values of privacy and civil liberties for our citizens, especially at a time our Nation is facing challenges to our economic well-being and national security. The Administration looks forward to continuing to engage with the Congress in a bipartisan, bicameral fashion to enact cybersecurity legislation to address these critical issues. However, for the reasons stated herein, if H.R. 3523 were presented to the President, his senior advisors would recommend that he veto the bill.

The administration's concerns mirror those of civil liberties groups, and could be (partially) addressed by some of the amendments we looked at earlier. But hopefully this clear statement from the White House provides the necessary final push to stop CISPA in its tracks and start working on a better security bill with the help of people who actually know what they're doing.

Filed Under: cispa, obama, veto

Now Is The Time To Improve CISPA Before Friday's Vote By Pushing These Critical Amendments

from the last-minute-push dept

Update: The White House has now officially threatened to veto CISPA.

In Congress, this week is CISPA week. With the bill going up for debate tomorrow, and the final vote scheduled for Friday, it's clear that the voice of the internet community has had an impact. The reps have been proposing their final amendments, and all are clear attempts to address some of the biggest criticisms from civil liberties groups and the public. CISPA has strong bi-partisan support and a very good chance of passing—and unfortunately, it's still a highly problematic bill. But, while the proposed amendments cannot perfect it, some of them could certainly reduce its potential for abuse in significant ways. If you're looking for a practical way to fight back against the serious privacy violation that CISPA represents in these final days before its potential passage, encouraging your representative to support these amendments is a good place to start.

There are two in particular that, though simple, would make drastic improvements on CISPA by refocusing it on network security and minimizing the chance of shared data being used to go after individuals. An amendment from Rep. Barton (pdf and embedded below) would insert the sensible requirement that shared data will only include personal information (further defined to include the content of any communications and even IP addresses) if it is necessary to combat a specific cyber attack. Another, even better amendment from Rep. Akin (pdf and embedded below) goes a step further and would bring CISPA back in line with the fourth amendment by barring the sharing of any personally identifiable information without a warrant. Of course, it's annoying that such an amendment is necessary—but the whole point of CISPA is to route around well-established requirements like going to a judge before violating someone's privacy. Though the bill still creates all sorts of potential privacy problems, the Akin amendment fixes a big one.

Rep. Thompson has also proposed an amendment (embedded below) that is supposed to address privacy concerns, and TPM reports that it is being backed by Ron Paul, who got attention earlier this week with a strong condemnation of CISPA. However, the Thompson amendment seems to lack teeth: it has a lot of talk about "minimizing" the impact on privacy and making "reasonable efforts" to remove personal information, and graciously offers to consult with "civil liberties stakeholders" (wouldn't that be everybody?), but it sets down no firm requirements or limitations. Despite being a fraction of the length, both the Akin and Barton amendments would do far more to fix CISPA, because they clearly prohibit certain activities.

Thompson's other proposed amendment (embedded below), however, is very good: it would limit the government recipients of the data from the overly broad "Federal Government" in the current bill to just Homeland Security and other civilian agencies. This addresses the significant fear that the NSA could use CISPA to expand their already-aggressive data collection programs. While civilian agencies and the DHS especially are hardly perfect, this would still be a lot better than handing data collected under CISPA over to the intelligence community.

There are other amendments on the table too, but these are some of the ones that get directly to the core privacy issues that make CISPA so dangerous. The CDT has a post taking a look at others. Ultimately the best solution would be to toss the bill out and start again, drafting sensible cybersecurity legislation that is evidence-based (starting with an evaluation of whether or not its even needed), and since Friday's vote is still not guaranteed there's no reason to stop speaking out against CISPA as a whole. But it's also a good idea to ensure that the bill is as good as it can possibly be when it goes up for vote, by pressuring Congress to adopt these critical amendments.

Filed Under: cispa, congress, dhs, fourth amendment, nsa

As CISPA Hits Congress, Cybersecurity Company Hypes The Fear Of Anonymous

from the fearing-fear-itself dept

Through TNW, we learn of a survey published by threat protection company Bit9 that states an attack by Anonymous is the number one thing IT security professionals fear. Doubtless the release of this survey was timed to coincide with CISPA, the dangerous cybersecurity bill that is being debated in the House this week. It's no surprise that a security provider would want to play up the fear of cyber attack, but I'm reminded of a quote from comedian Dara O'Briain: "Zombies are at an all time low level, but the fear of zombies could be incredibly high. It doesn't mean we have to have government policies to deal with the fear of zombies."

Apart from the fact that the fear of something is pretty meaningless (except to those who sell security, and those who want to pass bad laws), the details of the survey make it clear that this is entirely a matter of the hype around Anonymous:

61% believe that their organizations could suffer an attack by Anonymous, or other hacktivist groups.

Despite the utter sense of fear that Anonymous has created over the years, 62% were more worried about the actual method of attack, with malware accounting for the most cause for concern at 48%.

Only 11% of the respondents were concerned about one of Anonymous’ actual methods of attack – DDoS, while fears over SQL injections dipped to a measly 4%. Phishing was a concern for 17% of the respondents.

So, despite the fact that Anonymous apparently has them shaking in their boots, they know that their real vulnerability is malware—and that's not really Anonymous' game. The fear is manufactured.

What this survey calls attention to, though, is a fact that deserves more attention: under CISPA or a similar law, Anonymous would make a juicy target. Security companies and the government could collude and share data not only to strengthen their networks against attack, which would itself be perfectly reasonable, but also to identify and investigate Anonymous members, notwithstanding any other privacy laws. Regardless of how you feel about Anonymous' tactics, this should concern you: privacy rights and the 4th Amendment exist for a reason, and CISPA would wash them away online. The authors of the bill insist that it targets foreign entities, but it is arguably an even stronger weapon against domestic hacktivism that will inevitably be used and abused.

Filed Under: anonymous, cispa, cybercrime, fear, security

Congressional Reps Pushing CISPA Cybersecurity Bill Don't Even Know How To Secure Their Own Websites

from the don't-regulate-what-you-don't-know dept

One of the big concerns we've had over politicians trying to regulate technology, is how gleefully ignorant they often seem to be about the technology they seek to regulate. It's no different with the cybersecurity bill CISPA. We've been asking for months for some actual evidence that shows that we really need a cybersecurity bill, and all we get are fanciful stories about planes falling from the sky and hackers taking down powergrids. If either thing was possible, the real response shouldn't be to set up a cybersecurity bill, but to disconnect those key infrastructure pieces from the internet.

Either way, we're learning, once again, that the backers of CISPA don't seem to know the slightest thing about "cybersecurity." Actual cybersecurity expert, Chris Soghoian has highlighted how the key sponsors of CISPA fail at basic cybersecurity for their own websites, raising serious questions about their competence in writing a cybersecurity bill.

Congressmen Rogers and Ruppersberger are, respectively, the chairman and ranking member of the House Intelligence Committee. Although it is no secret that most members of Congress do not have technologists on staff providing them with policy advice, we can at least hope that the two most senior members of the Intelligence Committee have in-house technical advisors with specific expertise in the area of information security. After all, without such subject area expertise, it boggles the mind as to how they can at least evaluate and then put their names on the cybersecurity legislation that was almost certainly ghostwritten by other parts of the government - specifically, the National Security Agency.

So, given that these two gentlemen feel comfortable forcing their own view of cybersecurity on the rest of the public, I thought it would be useful to look at whether or not they practice what they preach. Specifically, how is their own information security. While I am not (for legal reasons) going to perform any kind of thorough audit of the two members' websites or email systems, even the most cursory evaluation is pretty informative.

Take a wild guess what he found. First, he looks at whether or not they use HTTPS. As he notes, "It is now 2012. HTTPS is no longer an obscure feature used by a few websites. It is an information security best practice and increasingly becoming the default across the industry." So, what did Soghoian find? It appears that neither Reps Rogers nor Ruppersberger do a very good job securing their own sites. He finds some sites without any HTTPS at all, and the others have it configured incorrectly.

When I manually tried to visit the HTTPS URL for Congressman Ruppersberger's website last night, it instead redirected me to the Congressional Caucus on Intellectual Property Promotion. Soon after I called the Congressman's office this morning to question his team's cybersecurity skills, the site stopped redirecting visitors, and now instead displays a misconfiguration error.

Congressman Dutch's campaign webserver appears to support HTTPS, but returns a certificate error.

He notes that there is really no excuse for these configuration errors, because the House appears to be setup with an HTTPS server, and other Reps. have it properly configured on their site. Not much really needs to be done. However, the fact that other Reps have set up HTTPS really raises concerns about these two Reps and their staff when it comes to cybersecurity:

The webserver that runs all of the house.gov websites is listening on port 443 and it looks like Akamai has issued a wildcart *.house.gov certificate that can be used to secure any Congressional website. As an example, Nancy Pelosi's website supports HTTPS without any certificate errors (although it looks like there is some non-HTTPS encrypted content delivered from that page too.) This means that the Congressional IT staff can enable HTTPS encryption for Rogers, Ruppersberger and every other member without having to buy any new HTTPS certificates or setting up new webservers. The software is already all there - and the fact that these sites do not work over HTTPS connections already suggests that no one in the members' offices have asked for it.

Rep. Rogers, of course, recently stated that he's so concerned with the threats of cybersecurity that he literally "can't sleep at night." Funny, then, that he never bothered to make sure his own website was secure, huh?

Filed Under: cispa, congress, cybersecurity, fail, https

CISPA Has NOT Been Fixed; It Could Allow The Gov't To Effectively Monitor Private Networks

from the don't-buy-the-hype dept

When the new discussion draft of CISPA was published, many people including myself praised the one point of sincere improvement in the bill: the modified definition of cybersecurity that focused on network attacks. Unfortunately, the authors of the bill are spinning this to suggest that CISPA is now nearly perfect, and some media outlets and even advocacy groups are buying it—even though nothing could be further from the truth, and the White House still opposes the nature of the bill. CISPA still has big, big problems. In fact, closer analysis by the CDT and EFF suggest that the language may be worded to allow what is effectively direct government monitoring of private networks.

Government networks are protected by a network security system called Einstein, which is being steadily expanded to do things like analyze the content of communications. Such software meets all the criteria of a "cybersecurity system" under CISPA, and there is serious concern that the bill would permit the government to offer Einstein or a similar system to private cybersecurity companies. By CISPA's definitions, everything collected by such a system would qualify as "cyber threat information" and thus be open game for sharing with the government—and nothing in the bill would prevent these private systems from being connected live to government databases, effectively uniting them with the government's own security network.

Yes, it would still be voluntary—the government couldn't force a cybersecurity provider to install their software, and the provider would need to get permission from its clients to share the data. But it's not hard to envision a situation developing very quickly, in which the government gets a few major security players hooked up and their clients routinely agree without a second thought. After all, CISPA's extremely limited liability provisions mean there's little to no risk for companies. Some may question whether the government would actually move in this direction under CISPA, but given the fact that the NSA has been trying to expand Einstein to private networks since the Bush administration, giving them the legal ability to do so is a very bad idea.

Filed Under: cdt, cispa, cybersecurity, eff, einstein, surveillance, white house

White House Criticizes CISPA, Though Meekly And For Partially Wrong Reasons

from the still,-it's-something dept

With next week's vote on CISPA looming, the White House has made an official statement that implicitly criticizes the bill without mentioning it by name. The Hill reports that National Security Council spokeswoman Caitlin Hayden issued the statement after a cybersecurity briefing in Congress:

"The nation’s critical infrastructure cyber vulnerabilities will not be addressed by information sharing alone," Hayden said.

"Also, while information sharing legislation is an essential component of comprehensive legislation to address critical infrastructure risks, information sharing provisions must include robust safeguards to preserve the privacy and civil liberties of our citizens. Legislation without new authorities to address our nation’s critical infrastructure vulnerabilities, or legislation that would sacrifice the privacy of our citizens in the name of security, will not meet our nation's urgent needs," she said, without explicitly mentioning CISPA.

While it's very good to hear them to make privacy concerns a central point, the administration's reasons for this position are not entirely the same as the citizens and civil liberties groups who oppose CISPA. The White House endorses the Lieberman-Collins bill in the Senate, which does indeed include better privacy protections (including an all-important requirement to anonymize shared data whenever possible), but also grants the federal government broad new regulatory powers relating to cybersecurity and critical infrastructure. This is in stark contrast to CISPA, which explicitly forbids regulatory usage. The White House wants to be able to start creating rules for "critical infrastructure" providers, which is undoubtedly the number one reason they support the Lieberman-Collins bill—but granting them that power is opening up a whole different can of worms. Nevertheless, though not an explicit or especially strong condemnation, this statement from the White House still adds significant weight to the growing CISPA opposition. The fact that the bill they are backing has its own problems really just points to the bigger and more important question: is there really any need to rush to create new cybersecurity legislation.

Filed Under: cispa, cybersecurity, white house

CISPA Sponsor Mike Rogers Says Protests Are Mere 'Turbulence' On Landing

from the tmi dept

It appears that Congress still doesn't get it. Rep. Mike Rogers, the sponsor of the bad CISPA bill that puts your privacy at risk, really doesn't seem particularly concerned about the protests that have been happening online this week. He referred to them as being "like turbulence on the way down to landing" for the bill. He also said that he fully expects the bill to easily pass next week when its brought to the floor.

What really comes through in the article -- which mostly talks about how Rogers has been supposedly working with Google to change some of the language in the bill to make it more acceptable -- is how little concern Rogers has for the public. Instead, most of the article just talks about how he's been working with tech companies to make sure they're okay with the bill. And while that's a start, it's no surprise that lots of tech companies would be okay with CISPA, because it grants them broad immunity if they happen to hand over all sorts of private info to the government.

But to then call the protests mere "turbulence" is pretty damned insulting to the actual people this will impact the most: the public, whose privacy may be violated. While we appreciate Rogers' willingness to amend the bill, it seems clear that there are still major problems with it, and Rogers does not seem to be actually listening to the privacy concerns of the public -- just the various tech companies.

In the meantime, the protests continue, and if Rogers thinks they're mere "turbulence" then it appears that not enough people are speaking out. The folks at Fight for the Future have put together an excellent page to make it easier to speak out, over at CongressTMI.org. At the very least, is it that difficult for Congress to present a real reason why this bill is needed? Bogus stories of planes falling from the sky or evil Chinese hackers really aren't cutting it. Perhaps Congress should talk to some of the experts who note that Congress doesn't understand the tech enough to regulate it properly. As privacy expert Jim Harper notes:

"Congress has no particular capacity or knowledge of how to do cybersecurity," Harper says. "It's not a choice between two different versions in the House and two different versions in the Senate. The question is still open: is Congress capable of doing any good here?"

Unfortunately, in the mad dash to pass these bills (which appear to be much more about who gets to control multi-billion dollar "cybersecurity budgets" than anything else), no one in Congress seems willing to address the basic question of what problem this really solves.

Filed Under: cispa, congress, cybersecurity, mike rogers, protest, tmi