Hacker News Reader

Comment by tptacek | Hacker News Reader

SOPA was a rageview bonanza for sites like Wired and Mashable. This bill could declare the sky to be periodically be blue; so long as it contained the word "cyber" or mentioned computers, a credulous mob will vote it up.

In this particular case, venues like the EFF blog are counting on the idea that readers don't know what the ECPA is, and that they'll believe that it was somehow unlawful for companies like AT&T and Google to monitor their networks and, yes, your data for evidence of intrusions, or to share that data once it's uncovered. It is not unlawful. This bill does virtually nothing. It's probably just a ploy for attention.

View on HN

ECPA primarily covers networks and attacks on networks, and incidentally protects certain forms of communication, including stored information. In general, ECPA seems to restrict government activity. I don't think it goes far enough (it protects certain types of communication more than others, and the way they were picked seems to be a historical accident.)

CISPA, as I read it, both protects networks AND "information rights holders". Given the history with DMCA, COPA, (+ SOPA, PIPA), etc., it doesn't seem at all unreasonable to think the government (and those information rights holders) will use CISPA to use the tools provided for national security to address copyright violation.

This is the same government using PATRIOT to go after local drug dealers.

I could support CISPA if it focused solely on information sharing from government to private enterprise (and protection from liability) for network or infrastructure attacks.

Most of the legitimate network-defense activities which would be permitted under CISPA are already allowed under existing laws. There might be a few corner cases around classified intelligence and uncleared entities, but this legislation is overly broad.

What action currently unlawful under the ECPA would be made lawful in a plain reading of CISPA?

I'm not sure. (You probably know/care more about this than I do; I assume everything can be done under NSL already, or entirely internal to large companies or their existing business partners, or by criminal organizations, so the legal protections are largely irrelevant.)

I assume by ECPA you mean "ECPA as modified by the Patriot Act", which is a substantial change in protections. Under ECPA as originally enacted, a great many things currently done would be illegal.

However, there's at least one major area which is currently illegal but would become lawful under CISPA:

Providing classified intelligence to private companies in violation of the NSA of 1947 (which I don't think is permitted by ECPA; ECPA just allows info to go from private company to government in ways which would otherwise be wiretap act violations without specific court orders). Couple this with the government enjoying overclassifying everything, and it's a problem.

I don't really have a problem with this, except that the procedures and safeguards need to be built well to protect that information. I think they can do this.

The other addition is that intellectual property is covered. If "theft of [...] private information, intellectual property ..." provides "exemption from all liability [...] acting in good faith", this would seem to allow private entities to do a lot of things. I don't think ECPA/Patriot gives those powers to private entities, so a provider could have one (badly written) legal contract with customers (violation of which might lead to civil liability), then invoke CISPA to violate it. Most contracts are written to permit information sharing for security issues, but adding copyright protection would greatly expand their scope. I think it would allow a copyright holder to request (with no legal basis) information from an ISP, including ECPA protected information like VOIP/email in transit/etc., and or the ISP to turn it over with no legal protections to the requestor.

So, overall: The Lungren (http://www.govtrack.us/congress/bills/112/hr3674) HR 3674 does not have this feature/defect. I'd support Lungren as written.

This act doesn't allow private companies to provide classified intelligence to other private companies, or the government to provide classified intelligence to anyone (the government can obviously just declassify).

To keep things simple though: what's lawful under this act that was unlawful under pre-PATRIOT ECPA? I'm most familiar with the pre-PATRIOT ECPA anyways.

I agree, basically nothing, in a non-paranoid reading. You could stretch interpretation of the law in crazy ways (which has been done), but it's not reasonable to predict that.

The most clear example I can think of is protection from civil liability for a provider turning over information (stored messages or on-wire communications) to another third-party where the user hasn't already consented to terms of service which allow that. I don't think any ToS are written to not allow that kind of thing, for this very reason.

I'm still against the law, but it's in one house now; it could change for the better or worse. If they struck some of the language related to intellectual property/copyright to make it more clear, I'd actually support it.

> In this particular case, venues like the EFF blog are counting on the idea that readers don't know what the ECPA is

I assume you're talking about this post by the EFF?

https://action.eff.org/o/9042/p/dia/action/public/?action_KE...

I read through the text of the bill, which someone else helpfully posted: http://www.opencongress.org/bill/112-h3523/text

All those information sharing clauses begin with "Notwithstanding any other provision of law." That leads me to wonder why you believe the provisions of the Electronic Communications Privacy Act are not overridden by that.

I don't think the ECPA is/needs to be overridden by this law. That's my point. There's nothing this law allows companies under network (er "cyber") attack to do that they couldn't already do.

I have firsthand experience (and not in my current company) with what Internet service providers are already doing to share the kinds of information contemplated by this bill. CISPA is just a showpiece.

But of course: people love- luv- LUV! this Your Rights Online stuff, so they'll mod up any half-assed attempt to twist any law into "the next SOPA". Like I said: SOPA was a bonanza for the TechCrunches and Panderdailies of the world. I just wish more people would notice that they're being duped into crying wolf, because someday soon one of these bills is going to have actual teeth.

> I don't think the ECPA is/needs to be overridden by this law.

Well, the EFF seems to think it creates a giant exception to pretty much everything so long as you're dealing with network security and I've read those "notwithstanding" clauses for myself, so we'll have to disagree on that. It has a huge catch-all net and we both know that there's always some joker trying to exploit random machines on the internet and you'll catch plenty of automated attempts if you watch your IDS & firewall logs.

Insofar as the law is unnecessary, that's all the more reason not to pass it in the first place. You may very well be right about it being a favor for whomever. But it is the burden of the proponents to make the case that it is necessary and I've not seen anyone do that.

I haven't seen anyone running through the streets shouting that the end is near, here, but I didn't bother to read any Wired or TC pieces on it, either. There's no reason we can't calmly explain to our reps that we oppose this unnecessary bill. I have no interest in defending whatever hyperbolic articles you've read. I haven't even bothered to read much of anything except the bill itself and the EFF piece.

Even so, I find it to be a poorly considered law and I see good reason to calmly explain to my reps that I oppose it, even if nothing comes of it in the end.

EFF has two reasons to oppose this bill other than that it's bad public policy:

(a) EFF consistently objects to the language used in every law pertaining to the Internet; in this case, their lede is that the language is "too broad". It's possible that no bill with any reasonable chance of escaping committee will ever have language locked down enough to satisfy the EFF publicly.

(b) The EFF can fundraise (and, at the very least, draw attention) out of every one of these controversies. I personally think the EFF has overspent it's credibility doing this over the past several years. Note the difference in coverage between EFF and ACLU (which I do support, and contribute to), on both CISPA and SOPA.

The do-nothing attention-grabbing nature of this bill is a reason to oppose it, and probably one that I share. But that does not make it OK to stir up pointless controversy, to extrapolate wildly from its text, to invent features of the bill out of whole cloth, or to demonize any company associated with it. (Not that you're doing any of that.)

> Note the difference in coverage between EFF and ACLU (which I do support, and contribute to), on both CISPA and SOPA.

Is this the ACLU coverage of CISPA you're talking about?

https://www.aclu.org/technology-and-liberty/aclu-opposition-...

The ACLU appears to oppose CISPA just as strongly as the EFF. I may have missed something, but I'm not able to find substantial disagreement between their positions on this one. Am I missing something here, or is it a matter of style rather than substance that you dislike?

I note in particular that the ACLU agrees with the EFF about the language of CISPA being too broad. One of its recommendations is that CISPA should be amended to "Narrowly define the privacy laws it will contravene. The committee must carefully consider what privacy laws truly inhibit necessary information-sharing and craft narrow exceptions limited to just those critical circumstances." I have to agree with both the ACLU & EFF on this point. While this is indeed a common complaint about internet legislation, it is not an unreasonable one.

Admittedly, I have not compared their stances on SOPA, but SOPA should be pretty much irrelevant now, I hope.

Reply on news.ycombinator.com