Hacker News Reader

Comment by tptacek | Hacker News Reader

That summary is also grossly inaccurate, easy crossing the bar for "dishonest".

I had to ask the two main people from FFTF that post here and on Reddit twice here on HN and around six times on Reddit, but one of them finally answered my question [1] as to exactly what part of CISA would give companies immunity as long as they also share with the government.

They are basing that on this article [2].

[1] https://www.reddit.com/r/technology/comments/3q1kgl/facebook...

[2] https://www.emptywheel.net/2015/10/14/time-to-get-very-conce...

Because surely the government will interpret "cyber threat indicator" in the most restricted, privacy-saving way imaginable?

The first thing this bill allows for is to have Facebook rat out whatever communication they deem "malicious" to the federal government and be shielded from the fallout.

That's not true. The bill does not allow Facebook to "deem" any communication "malicious". It can share only indicators, a term that has a definition in the bill more detailed than that of any other computer security term anywhere else in US law.

Meanwhile, the clear implication of the article we're commenting on, and the idea FFTF is trying to spread, is that CISA allows Facebook to violate user privacy, and to build its business doing so, by leveraging CISA. That's a nonsensical argument, and a terribly dishonest one.

CISA is a bad law, much more so than CISPA, which preceded it. The reason we have CISA instead of CISPA? FFTF.

After reading the text of the bill I'm full of indifference towards it. Can you expand on why you think it's a bad law? I'd like to know because I'm probably missing an angle.

Where you are with CISA, I was with CISPA. But CISA extends CISPA so that data collected from providers can be used to further a whole set of unrelated criminal investigations, which blurs the line, from trying to solve a computer security problem to building new investigative tools.

I'm not opposed in principle to new investigative tools, but I don't think debate about them should be avoided by sticking them into cybersecurity bills.

Still: virtually everything organizations like FFTF say about CISA seems to be false, and all you have to do to see how is to read the actual text of the bill.

Thanks for the explanation. The terrorism and law enforcement angles on the use of IoCs were my least favorite parts for me as well.

Reply on news.ycombinator.com