The 28 Corporations Supporting CISPA | Hacker News Reader

The 28 Corporations Supporting CISPA

intelligence.house.gov

65 pointsCowboyRobot26 comments

Please read the actual text of CISPA before making any judgements. It's reasonably short and not all that hard to understand. It's also nowhere near as evil as it is being made out to be.

For those interested, here's a link: http://www.opencongress.org/bill/112-h3523/text

As far as I can tell, it appears to be essentially a data-sharing bill for network intrusions, to allow companies and government to get around existing barriers to investigate network intrusions. I'm certainly open to the possibility that it is somehow worse, but I am really having a hard time seeing how.

SOPA was a rageview bonanza for sites like Wired and Mashable. This bill could declare the sky to be periodically be blue; so long as it contained the word "cyber" or mentioned computers, a credulous mob will vote it up.

In this particular case, venues like the EFF blog are counting on the idea that readers don't know what the ECPA is, and that they'll believe that it was somehow unlawful for companies like AT&T and Google to monitor their networks and, yes, your data for evidence of intrusions, or to share that data once it's uncovered. It is not unlawful. This bill does virtually nothing. It's probably just a ploy for attention.

ECPA primarily covers networks and attacks on networks, and incidentally protects certain forms of communication, including stored information. In general, ECPA seems to restrict government activity. I don't think it goes far enough (it protects certain types of communication more than others, and the way they were picked seems to be a historical accident.)

CISPA, as I read it, both protects networks AND "information rights holders". Given the history with DMCA, COPA, (+ SOPA, PIPA), etc., it doesn't seem at all unreasonable to think the government (and those information rights holders) will use CISPA to use the tools provided for national security to address copyright violation.

This is the same government using PATRIOT to go after local drug dealers.

I could support CISPA if it focused solely on information sharing from government to private enterprise (and protection from liability) for network or infrastructure attacks.

Most of the legitimate network-defense activities which would be permitted under CISPA are already allowed under existing laws. There might be a few corner cases around classified intelligence and uncleared entities, but this legislation is overly broad.

What action currently unlawful under the ECPA would be made lawful in a plain reading of CISPA?

I'm not sure. (You probably know/care more about this than I do; I assume everything can be done under NSL already, or entirely internal to large companies or their existing business partners, or by criminal organizations, so the legal protections are largely irrelevant.)

I assume by ECPA you mean "ECPA as modified by the Patriot Act", which is a substantial change in protections. Under ECPA as originally enacted, a great many things currently done would be illegal.

However, there's at least one major area which is currently illegal but would become lawful under CISPA:

Providing classified intelligence to private companies in violation of the NSA of 1947 (which I don't think is permitted by ECPA; ECPA just allows info to go from private company to government in ways which would otherwise be wiretap act violations without specific court orders). Couple this with the government enjoying overclassifying everything, and it's a problem.

I don't really have a problem with this, except that the procedures and safeguards need to be built well to protect that information. I think they can do this.

The other addition is that intellectual property is covered. If "theft of [...] private information, intellectual property ..." provides "exemption from all liability [...] acting in good faith", this would seem to allow private entities to do a lot of things. I don't think ECPA/Patriot gives those powers to private entities, so a provider could have one (badly written) legal contract with customers (violation of which might lead to civil liability), then invoke CISPA to violate it. Most contracts are written to permit information sharing for security issues, but adding copyright protection would greatly expand their scope. I think it would allow a copyright holder to request (with no legal basis) information from an ISP, including ECPA protected information like VOIP/email in transit/etc., and or the ISP to turn it over with no legal protections to the requestor.

So, overall: The Lungren (http://www.govtrack.us/congress/bills/112/hr3674) HR 3674 does not have this feature/defect. I'd support Lungren as written.

This act doesn't allow private companies to provide classified intelligence to other private companies, or the government to provide classified intelligence to anyone (the government can obviously just declassify).

To keep things simple though: what's lawful under this act that was unlawful under pre-PATRIOT ECPA? I'm most familiar with the pre-PATRIOT ECPA anyways.

I agree, basically nothing, in a non-paranoid reading. You could stretch interpretation of the law in crazy ways (which has been done), but it's not reasonable to predict that.

The most clear example I can think of is protection from civil liability for a provider turning over information (stored messages or on-wire communications) to another third-party where the user hasn't already consented to terms of service which allow that. I don't think any ToS are written to not allow that kind of thing, for this very reason.

I'm still against the law, but it's in one house now; it could change for the better or worse. If they struck some of the language related to intellectual property/copyright to make it more clear, I'd actually support it.

> In this particular case, venues like the EFF blog are counting on the idea that readers don't know what the ECPA is

I assume you're talking about this post by the EFF?

https://action.eff.org/o/9042/p/dia/action/public/?action_KE...

I read through the text of the bill, which someone else helpfully posted: http://www.opencongress.org/bill/112-h3523/text

All those information sharing clauses begin with "Notwithstanding any other provision of law." That leads me to wonder why you believe the provisions of the Electronic Communications Privacy Act are not overridden by that.

I don't think the ECPA is/needs to be overridden by this law. That's my point. There's nothing this law allows companies under network (er "cyber") attack to do that they couldn't already do.

I have firsthand experience (and not in my current company) with what Internet service providers are already doing to share the kinds of information contemplated by this bill. CISPA is just a showpiece.

But of course: people love- luv- LUV! this Your Rights Online stuff, so they'll mod up any half-assed attempt to twist any law into "the next SOPA". Like I said: SOPA was a bonanza for the TechCrunches and Panderdailies of the world. I just wish more people would notice that they're being duped into crying wolf, because someday soon one of these bills is going to have actual teeth.

> I don't think the ECPA is/needs to be overridden by this law.

Well, the EFF seems to think it creates a giant exception to pretty much everything so long as you're dealing with network security and I've read those "notwithstanding" clauses for myself, so we'll have to disagree on that. It has a huge catch-all net and we both know that there's always some joker trying to exploit random machines on the internet and you'll catch plenty of automated attempts if you watch your IDS & firewall logs.

Insofar as the law is unnecessary, that's all the more reason not to pass it in the first place. You may very well be right about it being a favor for whomever. But it is the burden of the proponents to make the case that it is necessary and I've not seen anyone do that.

I haven't seen anyone running through the streets shouting that the end is near, here, but I didn't bother to read any Wired or TC pieces on it, either. There's no reason we can't calmly explain to our reps that we oppose this unnecessary bill. I have no interest in defending whatever hyperbolic articles you've read. I haven't even bothered to read much of anything except the bill itself and the EFF piece.

Even so, I find it to be a poorly considered law and I see good reason to calmly explain to my reps that I oppose it, even if nothing comes of it in the end.

EFF has two reasons to oppose this bill other than that it's bad public policy:

(a) EFF consistently objects to the language used in every law pertaining to the Internet; in this case, their lede is that the language is "too broad". It's possible that no bill with any reasonable chance of escaping committee will ever have language locked down enough to satisfy the EFF publicly.

(b) The EFF can fundraise (and, at the very least, draw attention) out of every one of these controversies. I personally think the EFF has overspent it's credibility doing this over the past several years. Note the difference in coverage between EFF and ACLU (which I do support, and contribute to), on both CISPA and SOPA.

The do-nothing attention-grabbing nature of this bill is a reason to oppose it, and probably one that I share. But that does not make it OK to stir up pointless controversy, to extrapolate wildly from its text, to invent features of the bill out of whole cloth, or to demonize any company associated with it. (Not that you're doing any of that.)

> Note the difference in coverage between EFF and ACLU (which I do support, and contribute to), on both CISPA and SOPA.

Is this the ACLU coverage of CISPA you're talking about?

https://www.aclu.org/technology-and-liberty/aclu-opposition-...

The ACLU appears to oppose CISPA just as strongly as the EFF. I may have missed something, but I'm not able to find substantial disagreement between their positions on this one. Am I missing something here, or is it a matter of style rather than substance that you dislike?

I note in particular that the ACLU agrees with the EFF about the language of CISPA being too broad. One of its recommendations is that CISPA should be amended to "Narrowly define the privacy laws it will contravene. The committee must carefully consider what privacy laws truly inhibit necessary information-sharing and craft narrow exceptions limited to just those critical circumstances." I have to agree with both the ACLU & EFF on this point. While this is indeed a common complaint about internet legislation, it is not an unreasonable one.

Admittedly, I have not compared their stances on SOPA, but SOPA should be pretty much irrelevant now, I hope.

Two items worth highlighting for consideration:

- Blanket exemption from 5 USC 552, AKA the Freedom of Information Act. While that seems potentially reasonable at first glance (since this information may represent active intelligence), this would also provide for more instances of the same kind of consequence-free "sharing" that telcos do for Internet traffic.

- Blanket exemption from liability for sharing information. See above.

It's a giant blank check. Broadly speaking, it lets companies do anything, shields them from liability and keeps the whole thing under wraps with the FOIA exemption so long as they're dealing with a cybersecurity threat. What's wrong with the existing laws? They didn't tell us. They just asked for a blank check.

I've seen comments saying this does nothing. If that's true, it ought to make you even more nervous. If it doesn't, please send me a blank check. I promise that I won't do anything I wasn't already going to do. You trust me... right?

Exactly what "liability" were you thinking of here? There are at least two (very different) kinds of liability people are expressing concern about with CISPA. Which is it for you?

> Exactly what "liability" were you thinking of here?

(3) EXEMPTION FROM LIABILITY- No civil or criminal cause of action shall lie or be maintained in Federal or State court against a protected entity, self-protected entity, cybersecurity provider, or an officer, employee, or agent of a protected entity, self-protected entity, or cybersecurity provider, acting in good faith--

(A) for using cybersecurity systems or sharing information in accordance with this section; or

‘(B) for not acting on information obtained or shared in accordance with this section.

===========

Part (B) is pretty troubling. Suppose they find out, due to information shared in accordance with that section, that they're compromised. In spite of this, they fail to protect your money or data. Are they covered by that?

They're not liable simply by dint of receiving the information, meaning that there's no legal disincentive for them to accept information about compromises, such that an elaborate, expensive, and time consuming legal facade would be required for them to receive it.

It's not a blanket shield of liability against breaches. It confers immunity from liability only for transmitting and receiving information. In the spectacularly unlikely event that Google received information that they were compromised through this channel and then did not act on it (!), they would still be liable for information that comes to them about the compromise through other channels.

Suppose that was the only information they had about their own servers being compromised. That would seem to land in a bit of a grey area, no? You're probably right and the courts could find some way around this shield if someone was too obviously negligent, though.

Anyhow, that aside, my primary opposition comes from the fact that this is a poorly-drafted, unnecessary bill, not from how well I can imagine ways to abuse it. I mean, I don't think it's the end of civil liberties online or whatever its being billed as in the articles I haven't even read, but it's worth opposing simply for being such a crude blunt instrument.

I am somewhat shocked that Facebook is on the list. I'd like to know their reasoning.

I am more shocked that Facebook have a "Vice President, US Public Policy"!

> "800 million users entrust Facebook with their personal information" [1]

Make that 799,999,999. I do not trust any corporation that supports further institutionalized intervention in our lives.

[1] - http://intelligence.house.gov/sites/intelligence.house.gov/f...

Facebook wants better intel on new attacks as they happen. The same intrusion tactics that are tried against, say, Google or RSA, are used against Facebook. But right now Facebook would have no idea what those are until they hit, because there is no legal framework for sharing detailed network intrusion data, without risking legal liability.

In addition the only government clearinghouse for this sort of data is US-CERT, which is so slow that its alerts are only good for nostalgic remembrances of attacks long past.

A cybersec tightening is inevitable. The US is getting hit hard. The lockheed hack ( http://www.dailytech.com/Reports+Hackers+Use+Stolen+RSA+Info... ) was a pretty loud wake-up call. The "not a nerds" in DC are slowly realizing that this issue can help them get election money.

The US's infrastructure is predominantly private so the tightening will inevitable be in (a) policy and (b) spending. Not speaking directly about this bill, but when the government does both for security, it's always a cluster-!@#$ shit-show.

The RSA -> Lockheed attacks were what led directly to this bill. That is why, for instance, the bill includes language on "intellectual property". The attackers were trying to steal design and software files from Lockheed, which could both be considered intellectual property. Personally I think they could drop that language from the bill entirely, since unauthorized network access is already a crime in the U.S.

The private ownership of U.S. infrastructure is why this bill is built primarily around limitation of liability. The idea is that U.S. private companies will do a better job communicating with one another on cybersecurity if they don't have to worry about getting sued for admitting that they got attacked.

Most of these are not terribly surprising. Defense contractors, telecom, Facebook, etc.

Microsoft being there is not that surprising either. They will always support an anti-piracy or similar law, at least until the public outrage is big enough for them to withdraw.

Reply on news.ycombinator.com