Hacker News Reader

Comment by _delirium | Hacker News Reader

I could be missing a further limitation, but doesn't Section 4(a) de facto amount to a repeal of all other laws that limit monitoring? Yes, the exception is limited to monitoring for a "security purpose", but a pretty broad range of things can be justified as a "security purpose". I'm also skeptical that courts will seriously second-guess companies' representations on that point.

View on HN

Yep, I called that section out for that reason. I'm not particularly worried about it (I think this part of CISA mostly just clarifies something that was already pretty much settled).

Companies aren't allowed to just make up "security purpose", though; under CISA, they have to be monitoring for threats as construed in CISA, which means, for instance, they can't find exemption for liability for monitoring for mere ToS violations.

Couldn't one collect logs of all things, under the auspices of collecting logs that (may) contain "recon activity" and "exploits"? It seems on a surface reading that one could collect all those under the umbrella of collecting Indicators, and then also use it also for things like selling-to-advertisers or other business-related things.

Of course, our terms of use on most sites already say they can collect + monetize such things, so maybe this is moot.

I'm not sure I see the part of CISA that allows you to sell your logs to advertisers. I do see lots of places in the bill that allow sharing to other private entities or to the USG for cybersecurity purposes.

Sounds like a loophole.

What specific part of the bill reads like a loophole that would allow Facebook to sell its security logs to advertisers?

I was just responding to what you'd said above:

> I do see lots of places in the bill that allow sharing to other private entities or to the USG for cybersecurity purposes.

"For cybersecurity purposes".

It's a short bill. Read it again! These terms are defined, reasonably well.

Reply on news.ycombinator.com