The Disturbing Privacy Dangers in CISPA and How To Stop It
eff.org
eff.org
Can we save the grandstanding for actual privacy issues?
In other words: service providers can share any information that is ostensibly about abuse of their own services; what they can't do is feed information about e.g. drug trafficking conducted over their service to help build a case against drug trafficking.
CISPA also relies on voluntary sharing and is also framed around efforts to protect services.
That doesn't make it a good bill. I don't think it is, and I "oppose" it (for whatever that's worth). But I oppose it because it's an ineffective measure, not because it's a threat to the Internet.
It is always important to ask how the language of a law might be abused. As history shows, it probably will be if it can.
My take at the moment is that the bill is probably salvageable if:
(a) the definitions of what information can be shared without judicial oversight are tightened substantially;
(b) a judicial oversight process is introduced for information that is potentially more sensitive;
(c) businesses that exceed what is allowable under those provisions expose themselves to liability; and
(d) clear and strict restrictions are placed on what the government is allowed to do with the information, along the lines that it may use it only to facilitate cybersecurity investigations.
(a) what could you have done if Hotmail decided that your mail was relevant to an investigation about an attack on their service?
(b) what protections did you have that once the investigation wrapped up, your emails would not end up in a database at DoJ?
(c) under what specific law would you have been able to sue Hotmail for sharing your mail illegitimately?
It should be obvious that my belief is that you had no recourse then, that you could not have sued, and that DoJ could easily have banked your mail or, to raise revenue for the state, sold it to direct marketing companies. But IANAL and it's wholly possible that despite the (limited) direct experience I've had with the ECPA and email privacy, I'm totally wrong.
I think it doesn't make much sense to introduce sweeping, meaningful privacy controls in the context of a bill that aims to help organizations coordinate defenses against nation-state attackers. The net effect would simply be to hamstring defenders. This bill is an attempt to increase sharing.
(I don't think we need CISPA at all and don't support it).
I think it makes a lot of sense to introduce sweeping new privacy controls in general. The ECPA predates the public Internet and could use a thorough update.
The ACLU has had a much more measured response. Instead of trying to mobilize opposition to the bill by depicting it as "SOPA 2" (which it clearly isn't), they provided a list of suggestions for narrowing and refining the language in CISPA. The new draft reflects many of their concerns.
At its heart, CISPA is mostly a publicity measure meant to provide its sponsors with a veneer of having "done something" about the growing threat to industry by determined nation-state attackers (which is a real, if perhaps overhyped, threat to our national security). The kernel of intervention in CISPA --- the only thing CISPA actually "does" --- is an "official" provision for sharing information between service providers.
Some things you should know before you make up your mind about how dangerous that sharing is:
* It is already broadly allowed by the pre-PATRIOT 1986 Electronic Communications Privacy Act, which requires only that information be shared in conjunction with an actual effort to maintain services by the provider of the service itself, establishes no limits on the amount of information share or who it's shared with, explicitly carves out the ability for providers to share information with officials acting under color of law during criminal investigations (without a warrant!), and makes no mention whatsoever of anonymizing or stripping PII (ironically unlike CISPA).
* It reflects already- in- place common industry practice: providers are already sharing often-detailed information about attacks.
* The "monitoring" of your emails is already so commonplace and widely accepted that it forms the basis for products like Google Mail; the capture and sharing of your email during criminal investigations is, sadly, already allowed without a warrant in many US venues!
It is one thing to suggest that the state of affairs for electronic privacy is sad indeed, and to militate in favor of better laws. Count me in.
It's another thing entirely to attempt to twist every meaningless, do-nothing piece of legislation to come out of Washington as an attempt to rewire the Internet in favor of the MPAA, which is exactly what the EFF appears to be doing here.
I felt like the concern over SOPA was slightly overblown but at least fundamentally valid. Here I see virtually no validity to the concerns, and any epsilon of valid concern that is present is so outweighed by hysteria that the net effect on civic discourse is negative, not positive.
Support organizations that aren't trying to play off your emotions.
Personally, when it comes to ambiguity in laws like these, I tend to be suspicious, because it's almost inevitable that someone will end up being targeted disproportionately, whether intentionally or not. (I explained my reasoning in a post about SOPA, but the principle applies here as well, since the law is ambiguous enough that I'm not sure what powers it does or does not grant: http://bit.ly/HOfYnt)
But what we don't have is any bills that are actually good. Spolsky said it best[1]: we need to fight actively for what we want to see, not [just] oppose stuff that we dislike. But right now, Congress isn't doing any of that, and it looks like that isn't changing anytime soon.
I respect the EFF, but I can't imagine they have the kind of lobbying power that the MPAA does, so I'm not sure who would be the right person to push for the kind of bill that we do want to see. Whoever that is, let's hope that they do it soon.
[1]https://plus.google.com/117114202722218150209/posts/4GgaRiSy...
The bill as originally drafted mentioned the protection of intellectual property. Because we're on HN, I think we're all wired to think IP means "DVD rips". But I don't think normal people or policymakers think of it that way; I think IP was a natural way to write "the things that we think of protecting from hackers who are trying to break into SSL CAs".
As evidence for my point of view I offer the fact that the very next draft of the bill removed intellectual property entirely.
I'm honestly not sure if there are any privacy laws that would affect it, anyhow. I question whether video rental privacy could even apply to a pirated movie, but who knows? And the plan itself is unknown and subject to change.
So there might actually be something there, but I would never argue this one. This argument is weak at best and harmful at worst. Even though big copyright holders have shown scandalous negligence in their DMCA notices and there are good reasons to believe that wide-scale efforts are likely to harm many innocent people, they haven't actually enacted that plan yet and arguing it puts you into a copyright quagmire, so it's best to focus on the more immediate problems with this bill and slough all the weak arguments.
I didn't say it does; my point is that there are a number of Internet-related bills in the media these days, and they range from ambiguous to unambiguously bad (nothing unambiguously good or even close to it, as far as I can think of).
The ACLU has had a much more measured response
Say what? http://www.aclu.org/blog/national-security-technology-and-li... Sounds to me like they're singing from the same hymnal (and the ACLU page specifically says that they're joining the EFF, among others, in opposing CISPA).
It's another thing entirely to attempt to twist every meaningless, do-nothing piece of legislation to come out of Washington as an attempt to rewire the Internet in favor of the MPAA, which is exactly what the EFF appears to be doing here.
Say what? The linked page specifically acknowledges a proposed amendment to remove "intellectual property" from the relevant spot in the text -- while reminding us that said amendment has not yet been voted on. If CISPA were to pass with that phrase "intellectual property" intact, of course content owners would do their best to use it for their purposes. How far they might get, I don't know, but I think we can all agree that the amendment, once accepted, will be a valuable clarification.
Basically your argument seems to be that CISPA isn't a big deal because it's not much worse than ECPA. This is an important point, I agree. But if the goal is to improve online privacy generally, it seems to me that further steps in the wrong direction need to be opposed successfully before there can be any hope of positive movement.
If the arguments against CISPA are ultimately arguments for revising ECPA and PATRIOT, those arguments need to gain currency. People need to be sensitized to them and to think about them. That's going to take time and many battles. You seem to think we should skip this battle and save our powder. I am more inclined to the view that even if this is not the most important battle, every victory helps and this is not the time to concede anything.
I fundamentally disagree with the argument that we should pick sides and strive towards victory for victory's sake. That's a bad policy mechanism, but more pragmatically, it also creates fatigue, attenuates opposition to real issues, and generates a deficit of goodwill. While I don't think the legislative sponsorship of CISPA is done in good faith, I think its industry backers genuinely do feel like something needs to be done about online attacks.
Though you clearly disagree with me, I think you've done a good job of summarizing my points. I'd only add this: my problem is less with opposition to the bill (I think it's a bad bill) and more with the way it's been covered by EFF, Demand Progress and Boing Boing.
Ultimately, I think what we really need to do here is to push for better privacy laws, rather than fighting off every half-baked half-measure some legislator comes up with, and if I've understood you correctly, we agree on that.
If you have a contract with a company not to release your private information, the CISPA immunity clause seems to nullify that part of your contract.
I imagine there might also be some common law legal restrictions on handling of personal information, but all I can find at the moment relates to information disclosed publicly ("privacy torts"); I'm not sure if that applies to disclosure to specific 3rd parties.
If Facebook or Google or Microsoft can share your personal information and messages with Hollywood or Stratfor if they notice that those messages detail, hypothetically, a possible copyright violation, or even something as vague as messages where you talk about Anonymous and computer security, respectively... then you might be able to sue or you might not, depending on whether there's a contract or privacy policy involved, and depending on whether the sharing gets into the area of torts. However, if CISPA passed, the sharing would certainly be legal.
> It reflects already- in- place common industry practice: providers are already sharing often-detailed information about attacks.
I'm not surprised to hear that ISPs share info, but what about in the corporate space? Say, between JP Morgan Chase and Google, or between Facebook and Apple. My (limited) experience is that the broad sharing of detailed threat data are limited by fears of competitive intelligence and legal liability. Which would be why CISPA limits liability and puts the government in the role of a central clearinghouse.
http://www.fiercegovernmentit.com/story/cispa-sponsors-narro...