"CISA would give companies like Facebook legal immunity for violating privacy laws as long as they share information with the government."
Whether or not Facebook is secretly lobbying for CISA, the article describes the way the incentives look.
Whether or not Facebook is secretly lobbying for CISA, the article describes the way the incentives look.
Aka, a Letter Of Marque[1]. Facebook wants to be a modern privateer. Selling plundered data and reputation is less violent than the cargo that was traditionally the target of privateering, but it's still government-backed piracy.
[1] https://en.wikipedia.org/wiki/Letter_of_marque
edit: Wow. +5 to -1. That's more than the usual number of people using down-votes as a substitute for rebuttal.
CISA is a vehicle for the distribution of Indications of Compromise and other standard infosec threat intelligence between Government entities as well as the public and large corporations. The liability protections are completely reasonable if private companies were going to participate at all. The privacy protections built in are also much more thorough than I was expecting in a bill of this nature.
Really the only thing that really worries me about is that the things that the Government is allowed to do with shared information includes "identifying the use of an information system by a foreign adversary or terrorist". Which seems a little too broad for my tastes.
In fact, I was on the CISA hate train but after reading it I feel that it's an entirely inoffensive law and my outrage has fizzled into indifference. I'm not going to lose sleep if this passed nor if it isn't but likening it to a Letter of Marque is not warranted.
Here's the text for anyone interested: https://www.congress.gov/bill/114th-congress/senate-bill/754
The first thing this bill allows for is to have Facebook rat out whatever communication they deem "malicious" to the federal government and be shielded from the fallout.
Meanwhile, the clear implication of the article we're commenting on, and the idea FFTF is trying to spread, is that CISA allows Facebook to violate user privacy, and to build its business doing so, by leveraging CISA. That's a nonsensical argument, and a terribly dishonest one.
CISA is a bad law, much more so than CISPA, which preceded it. The reason we have CISA instead of CISPA? FFTF.
I'm not opposed in principle to new investigative tools, but I don't think debate about them should be avoided by sticking them into cybersecurity bills.
Still: virtually everything organizations like FFTF say about CISA seems to be false, and all you have to do to see how is to read the actual text of the bill.
They are basing that on this article [2].
[1] https://www.reddit.com/r/technology/comments/3q1kgl/facebook...
[2] https://www.emptywheel.net/2015/10/14/time-to-get-very-conce...