Hacker News Reader

Comment by egwynn | Hacker News Reader

I believe that CISA is mostly about changes within the government itself about sharing data between agencies. It seems to interface with the non-government world insofar as it lets companies share their data with government agencies without getting sued. I do NOT believe it contains any further provisions requiring private companies to share their data without a warrant. Can someone tell me if I’m reading it correctly? Not saying I like it, but if it’s not specifically requiring cooperation, then I guess there’s still some hope left.

View on HN

You are reading it correctly. CISA explicitly establishes by statute that private entities are never required to share data, but that the government is required to share with private entities.

It also seems to be addressing, by "cybersecurity threats," the act of trying to hack into information systems. The law seems to be paving the legal way for facebook to work with google and ycombinator if there was a network attack by <insert cyber bad-guys> in order to set up defensive measures against the attack and perhaps share information as to who and where it is coming from. Personal information must be removed from such shared information, and if not the insulted party must be notified.

Specific details of how to do this must be decided in the next 90 (or was it 180)days and compliance oversight reports are required regularly.

I'm a little embarrassed, but I must have missed the part where this makes things worse. I'm being honest here: If I should be upset about this I need to know why, please.

There are reasons not to like CISA. I'm pretty irritated by it: I think organizations like Fight For The Future organized a campaign against CISPA based on a whole lot of FUD, and for their efforts got us a law that actually justifies (a very little bit) of that FUD.

Unlike CISPA, CISA allows shared information to be used for law enforcement purposes. Ideally, threat information shared with the government should be used solely to improve defenses and prevent breaches; instead, anyone who shares data now needs to be cognizant of the other uses to which it will be put.

Law enforcement outside of cyber security? OK, I did miss that. Thanks.

Law enforcement can use indicators to RESPOND TO, PREVENT or MITIGATE "an imminent threat of death, serious bodily harm, or serious economic harm" (e.g. almost anything), but can only use it to assist in the PROSECUTION of identity theft, trade secret theft, or espionage.

(PCNA had broader language that enabled prosecutions of a variety of crimes with indicator data).

Again, CISPA, the bill FFTF takes credit for killing, had none of this language.

I couldn't find language that states the fed has to share data back with private entities. I did see provisions allowing the fed to share submitted data with other federal agencies and even some health care operators.

Where does it state that private cos get access to this data?

Section 103.(a)(2)

103(a)(3) also requires them to share, when possible, with the general public.

In the Senate CISA draft, the language about "entities" is a little confusing. "Entities", unqualified, are private companies; government agencies are "Federal entities".

One the few changes in the budget bill CISA is to have the law now refer to "Federal entities" and "Non-federal entities".

I'm sure Techdirt found a way to spin that into a conspiracy to chopper away the Open Whisper System developers in black helicopters.

It also says that non-related personal information will be removed from the shared data, and (surprise!) that if someone's personal data were accidentally (I presume) shared then the feds must notify that person of the breach. That's actually a positive in this bill.

https://www.govtrack.us/congress/bills/114/hr2029/text/eah#l...

> I do NOT believe it contains any further provisions requiring private companies to share their data without a warrant.

Sure, but that means the companies now face minimal incentive to protect user data but doubtless will experience pressure from the government to give it up even without a warrant.

This bill only allows companies to share data that fit the definition of "cybersecurity threat indicator", and that definition requires companies to not knowingly share personally identifying information. It is not a particularly effective vector for slurping messages out of Facebook.

Does that roughly mean that FB must (to be shielded from lawsuits) anonymize the data before passing it to the government? This isn't particularly comforting, since it could still be used to prosecute individuals if identity can be inferred from other context.

The EFF's criticism is basically that the bill is overly broad and can be used nefariously, even if it's not an all purpose FB message vacuum:

> The bill's broad immunity clauses, vague definitions, and aggressive spying powers combine to make the bill a surveillance bill in disguise. Further, the bill does not address problems from the recent highly publicized computer data breaches that were caused by unencrypted files, poor computer architecture, un-updated servers, and employees (or contractors) clicking malware links.

https://www.eff.org/deeplinks/2015/10/eff-strongly-oppose-ci...

That seems consistent with my aforementioned worry.

They have to do one of two things:

1. They can establish and run a process that ensures that data doesn't have personally identifying information in it. For instance, they can have a process by which they sign off on the types of things they're willing to share, and share only the stuff that never has PII in it.

2. They can instead run software that tries to spot PII and zaps it before sharing it.

I don't know how people can take EFF seriously when they say things like "aggressive spying powers". Whatever "spying powers" are in this bill are subtle; I don't think they're there at all. EFF does this a lot: they know their readers aren't going to read the bill, and further that their readers want to believe that the bill is horrifying, and they play that to the hilt.

Thanks very much for info. Much appreciated.

Agreed that the EFF risks its reputation when it freely uses hyperbolic language. But I think some of this is due to (mostly philosophical) difference about how much we should worry about granting vague powers to the government which are mostly not abused. People similarly differ in how fiercely they fight free speech restrictions, etc.

I think the underlying worry here is very legitimate.

But my interest is in making sure we know the truth as precisely as we can, and I believe nobody is well-served by the propagation of falsehoods, even when the falsehoods support a valid narrative.

3. They aren't required to share any data, and can keep it to themselves.

The bill itself reads mostly mundane, which I think is part of the intention. The main issues are the liberal definitions of "cybersecurity purpose," "cybersecurity threat" and "cyber threat indicator," along with the really half-assed integrity requirements ("Make sure you scrub out personally identifiable information, but only if you're aware of it, so no big deal.") and a repeated insistence on the data being "shared as quickly as operationally practicable".

As such, it strikes me as a try-hard and forced attempt to implement private-to-governmental-entity data sharing with little assurance, and cloaked as a seemingly routine bill. It thus makes perfect tactical sense to bundle it with an omnibus, since it blends in well.

Could you be more specific about the "liberal definitions" of "cybersecurity purpose, threat, and indicator"? I've read all the computer security legislation that's been proposed in the last 8 years or so, and CISA had the least egregious definitions I'd read.

They even inherited the CISPA amendment that established that terms of service violations weren't cybersecurity threats.

That it does, along with consumer licensing agreements (presumably EULAs).

"Cybersecurity purpose" is itself mostly a pointer contingent to the meaning of "cybersecurity threat":

   Except as provided in subparagraph (B), the term 
   cybersecurity threat means an action, not protected by
   the First Amendment to the Constitution of the United
   States, on or through an information system that may 
   result in an unauthorized effort to adversely impact the
   security, availability, confidentiality, or integrity of
   an information system or information that is stored on,
   processed by, or transiting an information system.

(6) Cyber threat indicator is rather loose with F, G and H. B drops the term "security control". A seems to be legitimately trying to address automated scanning, but might seem to let through legitimate scraping since it doesn't further qualify.

If this is, as you say, one of the least egregious definitions, then I'm not sure whether this is a cause for concern or hope.

Let’s assume a government asks Facebook about private information. In the US, it can do so via with secret courts, so the people being surveilled cannot know about and oppose it. In that case, Facebook is the only one who could do something about it: they can do so by arguing that revealing that information would put them in legal trouble. How that works, I have no idea: the court is secret, so is the idiosyncrasies of its appeal process.

The possibility that Facebook could be attacked makes the lawyers unhappy: their job includes minimising risks, and this is a big one given the PR around it. The ability to oppose abusive requests makes the (very many) privacy-concerned employees happy: they really don’t like spending their career helping ideas they strongly oppose. That’s why you can have contradictory statements.

The real issue here is the existence of secret courts, and administrative processes that exclude judges and the basic legal protection (guaranteed by the Fourth amendment in the US). Facebook can’t really oppose that without exposing itself to spin around being pro-terrorists (which is mind-boggling when you think about how loudly the same people talk about “Freedom”). Allowing an appeal and maintaining needed discretion in certain matters is a delicate problem, but hardly a new one in law.

It sounds to me (not a legal expert) that what would be preferable is to have a Public defender for privacy, fluent in legal and technical matter, who be made privy to secret decision, and not allowed to contact the people being targeted before they know about the surveillance. The ACLU sounds like they could recommend good candidates. A judge should be able to do that, and Congress at a higher level — but whomever was in charge lately has dropped the ball quite dramatically, being both lied to and far too lenient in what they knew.

Reply on news.ycombinator.com