Speak Out Against CISPA: Join The Twitter Campaign And Contact Your Representative

from the get-involved dept

On Friday, the House Intelligence Committee released a new draft of CISPA, the dangerous cybersecurity bill that threatens to give the government access to huge amounts of personal data. Despite small improvements in some areas, the bill still has huge problems and lacks adequate privacy safeguards—and the House is going to vote on it next week. As part of a final push to let Congress know what people think of this bad legislation, several organizations have launched public action campaigns that you can get involved in.

Firstly, there is the Congress Wants Too Much Information campaign on Twitter. Multiple groups are asking you to tweet your thoughts on CISPA with the hashtags #CongressTMI and #CISPA. U.S. citizens can look up and tag their representatives' Twitter accounts—and you can also include @HouseIntelComm, the authors of the bill. The groups behind the campaign suggest pointing out examples of data that could, but shouldn't, be shared under CISPA, such as:

@Myrepresentative Does the FBI need to know what books I checked out from my local library? #CongressTMI Stop #CISPA

@Myrepresentative Does the military need to know I send my Mom lolcat pictures? #CongressTMI Stop #CISPA

@Myrepresentative Does the NSA need to know I watch Netflix from my work computer? #CongressTMI Stop #CISPA

Now is also the time to directly contact members of Congress by phone or by email. There are tools to make this easier from the ACLU, the EFF and Free Press.

Pressure is also increasing on the companies that back CISPA, especially those in the technology sphere. In addition to contacting Congress, you can send a message to CISPA's private supporters by signing AccessNow's petition to all of them, and Demand Progress' petition directed specifically at Facebook.

CISPA still enjoys a lot of support in Congress, but the growing public backlash means the bill's future is uncertain. With continued effort, Congress can be convinced to back off and work on crafting smarter, more narrowly tailored cybersecurity legislation that protects people's privacy.

Of equal importance is the bigger message this sends to lawmakers. There are many people who still think what happened with SOPA was a fluke, driven by the technology lobby and a few key tech companies. But the growing opposition to CISPA—a bill supported by many of the same tech giants that opposed SOPA—proves that it was something much more significant, and that the online community will not be ignored when it comes to decisions that govern the internet.

Filed Under: cispa, congress, petition, tmi, twitter
Companies: aclu, demand progress, eff, free press

New Draft Of CISPA Announced: Some Progress, Still Big Problems

from the it's-a-start-I-guess dept

The House Intelligence Committee has published a new draft of CISPA (pdf and embedded below), which includes the two amendments that were already approved, plus several other additions and changes. In some areas, there is genuine progress—in others, things actually seem to have gotten worse. Unfortunately, some of the biggest problems with the bill remain, and some of the new language seems to have little effect at all. Some changes I will discuss in future posts, but there are two that I wanted to look at right away:

A Narrower Definition Of Cybersecurity
This is the one clearly positive change in the bill. Previously, the definition of cybersecurity and cyber threat information was:

(A) efforts to degrade, disrupt, or destroy such system or network; or

(B) theft or misappropriation of private or government information, intellectual property, or personally identifiable information.

While the first part remains unchanged, the second part is now much narrower:

(B) efforts to gain unauthorized access to a system or network, including efforts to gain such unauthorized access to steal or misappropriate private or government information

Where the original language could be construed to include all sorts of activity that goes beyond what most people could consider "cybersecurity", the new definition makes it clear that we are talking about unauthorized network access. Most notably, it removes the reference to "intellectual property", which makes sense: the authors have always insisted that they were talking about the misappropriation of secret R&D by foreign entities, which is sufficiently covered by language referring to privacy and unauthorized access. Including "intellectual property" opened it up to all sorts of additional interpretations that went beyond this stated intent.

Now, there's still reason to be a little concerned here, because the attempts to charge people for "unauthorized access" under the CFAA have been ridiculous in the past. If this language in CISPA were construed to include things like violating terms of service (as some have claimed of the CFAA language) then it would be very dangerous. However, with last week's Ninth Circuit ruling which narrowly construed unauthorized access, legal thinking on this matter seems to be heading in the right direction. There's still some gray area, and I think there's still room for a much better definition of cybersecurity in CISPA (I know they want to future-proof it, but it doesn't have to be that short and vague) but this is still a significant improvement over the previous draft.

Extremely Limited Liability For Companies
The new draft of CISPA includes a whole new section carving out the requirements for a company to be held liable if they share information improperly. Basically, a company that shares data with the government receives immunity from all existing privacy laws unless you can show that their actions caused you injury and constituted "willful misconduct"—which is very specifically defined in CISPA as an action taken:

(I) intentionally to achieve a wrongful purpose;
(II) knowingly without legal or factual justification; and
(III) in disregard of a known or obvious risk that is so great as to make it highly probably that the harm of the act or omission will outweigh the benefit.

Yes: and. A company's actions need to satisfy all three of those conditions. I'm not even sure how that's possible. They have to be trying to harm you, knowingly breaking the law and, in a bizarre third clause, they also have to know there is a risk that the harm to you will outweigh the benefits to them. How you are supposed to weigh the harm to individuals whose private data is handed to the government, versus the benefits to cybersecurity services who improve their networks with data, is beyond me. But no matter how you slice it, this is an insanely onerous definition of willful misconduct that makes it essentially impossible to ever sue a company for wrongly sharing data under CISPA.

Overall, despite the progress made on the definition of cybersecurity, CISPA is still a highly problematic bill which still doesn't properly safeguard people's privacy. One of the biggest problems—the fact that the government can use, retain and affirmatively search the information they gather for vaguely defined "national security" purposes—is untouched in the new draft. There are some attempts to alter the rules on how federal agencies can share information between themselves, but many of those changes seem essentially meaningless. It's good to see some reaction from Congress, but if CISPA is to be fixed (a prospect I'm still dubious about) there is still a long way to go.

Filed Under: cispa, cybersecurity, house intelligence committee, liability

A Challenge To Facebook: Withdraw CISPA Support Until The Bill Is Fixed Or Replaced

from the get-off-the-fence dept

One of the more concerning aspects of CISPA that sets it apart from SOPA/PIPA is the number of technology companies that support it. Of chief concern is Facebook, which handles a lot of sensitive private data, but is standing behind the bill. Joel Kaplan, Facebook's VP of U.S. Public Policy, has now released a statement explaining their support, which basically amounts to "we promise not to abuse the gray areas in the bill".

A number of bills being considered by Congress, including the Cyber Intelligence Sharing and Protection Act (HR 3523), would make it easier for Facebook and other companies to receive critical threat data from the U.S. government. Importantly, HR 3523 would impose no new obligations on us to share data with anyone –- and ensure that if we do share data about specific cyber threats, we are able to continue to safeguard our users’ private information, just as we do today.

That said, we recognize that a number of privacy and civil liberties groups have raised concerns about the bill – in particular about provisions that enable private companies to voluntarily share cyber threat data with the government. The concern is that companies will share sensitive personal information with the government in the name of protecting cybersecurity. Facebook has no intention of doing this and it is unrelated to the things we liked about HR 3523 in the first place -- the additional information it would provide us about specific cyber threats to our systems and users.

Kaplan then goes on to say that Facebook is engaging lawmakers to see about amending the bill to address people's concerns. But that creates a pretty big question: why are they still supporting the bill if they recognize its problems? Based on this statement, Facebook wants to use cybersecurity laws the right way—to give and receive anonymized and minimized data about specific threats, to be used solely in relation to those and similar threats. But CISPA does not require any of that. It's nice that Facebook is "able to" protect private information, but why aren't they and all other companies forced to? If the authors of the bill want to tout its "strong privacy protections", then a requirement to eliminate personal user information from shared data seems like a necessity.

Moreover, while Facebook may only be worried about specific cyber-threats, they can't control what the government does with the information. As currently written, CISPA basically allows the feds to keep whatever data Facebook shares on file, and search it whenever they want, for anything they want, as long as there is a "cybersecurity" or "national security" purpose. And "cybersecurity" is very broadly described, and includes things like intellectual property. If this bill is supposed to be about protecting networks from disruptive attacks, why aren't the terms and limitations narrowly defined to ensure that's the only thing it can be used for?

If Facebook's cybersecurity motivations are good—and I'm willing to grant them the benefit of the doubt and assume that they are—then they should withdraw their support of CISPA until it is fixed to exclude the broad provisions that go well beyond what Facebook wants to use it for. If the company is so proud of its commitment to user privacy, then surely it has to acknowledge that there are other companies which are not so responsible, and which will abuse the same powers and immunities that Facebook promises to handle responsibly. Unless they can show us that they are making meaningful demands of Congress, this attempt to soften their support of CISPA is just hot air.

Filed Under: abuse, cispa, cybersecurity, pipa, privacy, sopa
Companies: facebook

CISPA Authors Launch Twitter Account To Preach False Merits Of The Bill

from the yeah,-that'll-change-everything dept

Still desperate to prove that they are in touch with the online community, the House Intelligence Committee has launched a new Twitter account apparently dedicated to talking about how totally awesome CISPA is. They haven't been at it for very long, but they've already blessed the hashtags #CISPA and #cyber (they really love that word, don't they?) with several disingenuous tweets full of misinformation and flat-out inaccuracies:

Firstly, how does a federal law that creates an internet security exemption to every other existing law represent keeping the "federal govt’s hands off the Internet"? The entire point of CISPA is to give every federal agency that already has its hands on the internet more information and power. Similarly, while the bill itself does not have any provisions relating to blocking website access, it creates clear provisions for companies to give data to Homeland Security—the people who already seize websites.

Strong privacy protections? CISPA includes virtually no privacy protections, beyond a call for annual recommendations from the Privacy and Civil Liberties Oversight Board. Meanwhile, it eliminates existing privacy protections, because as soon as a company deems its data "cyber threat information", it can turn it over to the government without worrying about any other laws. As for how CISPA "strictly limits" what the government can do with the data, that depends on your definition of "strictly"—and, of course, whether you're honest about what the bill says, which the House Intelligence Committee is not:

Maybe they'll blame Twitter's character limit, but they left out a very important part there. Information can only be shared with the government if it is related to cybersecurity, but it can be used by the government for the purposes of cybersecurity or national security. That's a much, much broader field, and the cybersecurity heading is already pretty wide open, when you remember how it's defined in CISPA—as anything relating to protecting a network from:

‘(A) efforts to degrade, disrupt, or destroy such system or network; or

‘(B) theft or misappropriation of private or government information, intellectual property, or personally identifiable information.

Moreover, there are no limitations on how long the government can keep the data, or on how often they can come back and search it for whatever they want—as long as they can justify the search as either cybersecurity or national security. That's not what most people call "strict".

Resistance to CISPA is growing, and more flimsy misinformation isn't going to change anything just because the committee puts it on Twitter. We already wrote about how astonishing it is that Congress expected no resistance to the bill, and now it seems like they're finally waking up to the fact that they were wrong—but, as usual, they have no idea how to respond.

Filed Under: cispa, house intelligence committee, misinformation, privacy

CISPA Is A Really Bad Bill, And Here's Why

from the time-to-speak-up dept

Update: There is now a new draft of CISPA that has rendered some (though unfortunately not all) of this analysis obsolete.

The forces behind HR 3523, the dangerous Cyber Intelligence Sharing and Protection Act which is going to move forward in Congress at the end of the month, are beginning to get cagey about the growing backlash from the internet community. In an attempt to address some of the key concerns, the bill's authors, representatives Mike Rogers and Dutch Ruppersberger, hosted a conference call specifically geared at digital reporters. The invitation was for "Cyber Media and Cyber Bloggers" (seriously) and took place at 7am Silicon Valley time—thus demonstrating that they are totally in touch with the tech community. During the call, the representatives were intent on hammering certain points home: that the bill respects privacy and civil liberties, is not about surveillance, is targeted at actions by foreign states, and is nothing like SOPA.

Unfortunately, none of that is really true. The text of the bill, even with the two key amendments made since (all pdf links and embedded below), is still full of extremely broad definitions which fail to create the safeguards that the representatives insist are present, and which leave room for dangerous unintended consequences.

CISPA at a Glance
In broad terms, CISPA is about information sharing. It creates broad legal exemptions that allow the government to share "cyber threat intelligence" with private companies, and companies to share "cyber threat information" with the government, for the purposes of enhancing cybersecurity. The problems arise from the definitions of these terms, especially when it comes to companies sharing data with the feds.

Is CISPA the new SOPA?
This is the notion that the reps behind the bill are most desperate to kill. Their primary response is that CISPA has nothing to do with seizing domains or censoring websites, but that's only true on the surface. The bill defines "cybersecurity systems" and "cyber threat information" as anything to do with protecting a network from:

‘(A) efforts to degrade, disrupt, or destroy such system or network; or

‘(B) theft or misappropriation of private or government information, intellectual property, or personally identifiable information.

It's easy to see how that definition could be interpreted to include things that go way beyond network security—specifically, copyright policing systems at virtually any point along a network could easily qualify. And since one of the recipients of the shared information would be Homeland Security—the department that includes ICE and its ongoing domain seizures—CISPA creates the very real possibility for this information to be used as part of a SOPA-like crusade to lock down the internet. So while the bill itself has nothing to do with domain seizures, it gives the people behind such seizures a potentially powerful new weapon.

The reps insist that when they refer to intellectual property, they are not thinking about media piracy or even counterfeiting, but about foreign-based attacks on domestic companies to steal their research and development (they tout examples like the plans for jet fighters). Unfortunately, the bill's definitions create no such restriction, leaving the door wide open for more creative interpretations.

How can the government use the information?
The original text of the bill was really bad, simply saying the government cannot use the information for "regulatory purposes." This was amended to be more restrictive, but not by much: now, the same broad "cybersecurity" definition applies to what they can use the data for, and as if that wasn't enough, they can also use it for "the protection of the national security of the United States." I don't need to tell you that the government is not exactly famous for narrowly interpreting "national security."

So is CISPA a surveillance bill?
The bill specifically prohibits the government from requiring anyone to hand over information, or offering any sort of "quid pro quo" data sharing arrangement. Sharing information is voluntary, and as far as the bill's supporters are concerned, that should end the debate. Of course, as we've seen with things like the warrantless wiretapping scandal, complicity between companies and the government, even when legally questionable, is common and widespread. But even if the safeguards work, CISPA will undoubtedly allow for invasions of privacy that amount to surveillance.

Firstly, while the reps insist that the bill only applies to companies and not individuals, that's very disingenuous. CISPA states that the entity providing the information cannot be an individual or be working for an individual, but the data they share (traffic, user activity, etc.) will absolutely include information about individuals. There is no incentive in the bill to anonymize this data—there is only a clause permitting anonymization, which is meaningless since the choice of what data to share is already voluntary. Note that any existing legal protections of user privacy will not apply: the bill clearly states that the information may be shared "notwithstanding any other provision of law".

So we've got the government collecting this data, potentially full of identifying information of users in the U.S. and elsewhere, and they are free to use it for any of those broadly defined cybersecurity or national security purposes. But, it gets worse: the government is also allowed to affirmatively search the information for those same reasons—meaning they are by no means limited to examining the data in relation to a specific threat. If, for example, a company were to provide logs of a major attack on their network, the government could then search that information for pretty much anything else they want.

Can CISPA be fixed?
Most of the new provisions currently being considered for CISPA have to do with adding oversight and liability to prevent the government from violating any of the terms—but that doesn't address the problems in the bill at all, since the terms are already so broad. CISPA would require significant new restrictions to come anywhere close to being a good bill—a fact that points to Congress' inability to effectively design internet regulation. Moreover, there isn't even clear evidence that new cybersecurity laws are necessary. This is a bill that needs to die.

The EFF has a tool to help you contact your representative about CISPA and the broader issue of cybersecurity legislation. The bill is going to the House the week of April 23rd, so now is the time to get involved. As with SOPA, this is not an issue that solely effects Americans: the data may come from U.S. companies, but it will involve people from all over the world—and, indeed, foreign entities are one of the bill's prime targets. It's once again time for the internet to speak up and send a clear message to Congress: don't mess with something you don't understand.

Filed Under: cispa, congress, cybersecurity, sopa

Did Congress Really Not Pay Attention To What Happened With SOPA? CISPA Ignorance Is Astounding

from the again-and-again dept

Update: Check out our breakdown of the reasons CISPA is a really bad bill.

We recently wrote about how HR 3523, the Cyber Intelligence Sharing and Protection Act -- or CISPA -- is an incredibly bad bill that would basically make it much, much easier for the government to spy on all sorts of private communications. The bill already has over 100 sponsors, some of whom were on the right side of SOPA, but seem to have gone astray here. The concern over CISPA has been growing rapidly and the netroots are speaking out and warning Congress that this is a bill they do not want.

And yet... Congress still appears ready to move forward with CISPA the week of April 23rd. And the amazing (no, astounding) thing is that many politicians in Congress have no idea that people are up in arms over this yet. In talking to different people on Capitol Hill, the story is along the lines of "oh, is there some controversy over this?" Like SOPA early on, it appears that Congress simply takes for granted that if you call something one thing (whether it's "stopping piracy" or "protecting cybersecurity") no one will bother looking at the details to realize just how problematic the bill actually is.

But this is a bad, bad bill, which effectively will lead to significant spying on internet usage and private communications by the government with little to no oversight -- and that includes not just domestic law enforcement, but military spying as well. The whole thing is absolutely crazy (especially when there are less onerous bills that are much more sensible).

The truly amazing part to me is the fact that politicians in Congress would simply think that there's no problem making massive internet regulatory change without actually looking at the impact on ordinary users and how they feel about it so soon after SOPA. It seems clear that many elected officials still haven't received the message that politicians should not be mucking with the internet when they clearly don't understand it.

Filed Under: cispa, congress, cybersecurity, sopa

Forget SOPA, You Should Be Worried About This Cybersecurity Bill

from the this-is-not-good dept

While most folks are looking elsewhere, it appears that Congress is trying to see if it can sneak an absolutely awful "cybersecurity" bill through Congress. We've discussed how there's been some fighting on the Senate side concerning which cybersecurity bill to support, but there's a similar battle going on in the House, and it appears that the Rogers-Ruppersberger bill, known as CISPA (for Cyber Intelligence Sharing and Protection Act) or HR 3523 is winning out, with a planned attempt to move it through Congress later this month. The bill is awful -- and yet has somehow already gained over 100 sponsors. In an attempt to pretend that this isn't a "SOPA-like" problem, the supporters of this bill are highlighting the fact that Facebook, Microsoft and TechAmerica are supporting this bill.

However, this is a terrible bill for a variety of reasons. Even if we accept the mantra that new cybersecurity laws are needed (despite a near total lack of evidence to support this -- and, no, fearmongering about planes falling from the sky doesn't count), this bill has serious problems. As CDT warned when this bill first came out, it's way too broad and overreaching:

However, the bill goes much further, permitting ISPs to funnel private communications and related information back to the government without adequate privacy protections and controls. The bill does not specify which agencies ISPs could disclose customer data to, but the structure and incentives in the bill raise a very real possibility that the National Security Agency or the DOD’s Cybercommand would be the primary recipient.

If it's confusing to keep track of these different cybersecurity bills, the ACLU has put together a handy dandy (scary) chart (pdf) comparing them all. And what comes through loud and clear is that the Rogers-Ruppersberger CISPA bill will allow for much greater information sharing of companies sending private communication data to the government -- including the NSA, who has been trying very, very hard to get this data, not for cybersecurity reasons, but to spy on people. CISPA has broad definitions, very few limits on who can get the data, almost no limitations on how the government can use the data (i.e. they can use it to monitor, not just for cybersecurity reasons) and (of course) no real oversight at all for how the data is (ab)used.

CDT has put together a reasonable list of 8 things that should be done if politicians don't want to turn cybersecurity into a new SOPA, but so far, Congress is ignoring nearly all of them. Similarly, EFF is asking people to speak out against CISPA, noting that it basically creates a cybersecurity exemption to all existing laws. If the government wants your data, it just needs to claim that it got it for "cybersecurity purposes" and then it can do pretty much whatever it wants.

This is a really bad bill and it looks like it's going to pass unless people speak up.

Filed Under: cispa, cybersecurity, monitoring, privacy, rogers-ruppersberger, sopa