Hacker News Reader

Comment by Xuzz | Hacker News Reader

Remember guys, this bill does pretty much nothing. If you read it, it simply allows some completely optional data sharing for prevention against attacks. However, in most cases, there is already no law against completely optionally sharing data with the government or private security firms.

But, tptacek said it better than I can: http://news.ycombinator.com/item?id=3815912

View on HN

I'm trying to understand this bill better before taking a true stance on it. Is there a possibility that the powers that it grants can be abused?

If one is a fan of the National Security State, this is a great bill. For the rest of us, not so much.

https://www.cdt.org/blogs/greg-nojeim/112cyber-intelligence-... :

- The bill has a very broad, almost unlimited definition of the information that can be shared with government agencies notwithstanding privacy and other laws;

- The bill is likely to lead to expansion of the government’s role in the monitoring of private communications as a result of this sharing;

- It is likely to shift control of government cybersecurity efforts from civilian agencies to the military;

- Once the information is shared with the government, it wouldn’t have to be used for cybersecurity, but could instead be used for any purpose that is not specifically prohibited.

What information that service providers and app providers are currently not authorized to share under the 1986 ECPA would become lawful to share under this act?

The vagueness of this bill IS the problem. Vagueness in the law makes for really bad laws.

Give me one reason I should support this bill.

I don't support it (I think it's a NOP designed solely to gain attention for its sponsors), so I certainly won't be offering you any such arguments.

Where I take exception is with efforts to stir up hysteria about it.

Valid concern ≠ hysteria.

Sure, that's true. But not all the concerns regarding CISPA are valid.

Which ones?

See: every other comment of mine on this thread.

To answer that question, you need to have a pretty complete understanding of the "powers" service providers already have under the ECPA, and the "powers" they can enforceably claim through contracts (like privacy policies). Those preexisting "powers" are already very broad; they are not, for instance, nailed down to specific definitions of "cybersecurity threats".

Reply on news.ycombinator.com