Rep. Mike Rogers Calls CISPA Opponents "14 Year Old Tweeters in Their Basement"

1. You're a web app company that routinely comes under DDOS attacks. A private security company would like you to subscribe and push Netflow traces to them during attacks, so they can derive minimal ACLs and relay them to ISPs so the attack could be filtered upstream. That Netflow data could in theory contain some of your traffic, and further could be statistically de-anonymized to reveal your personal usage of that service. Currently, you need authorization from your counsel every time you share that Netflow data; post-CISPA, you could get a one-time authorization and automatically push Netflow to the anti-DDOS provider.

2. You're working with several social networking companies to track down a browser malware attack that transmit itself through online messages. You'd like to collect a large volume of samples programmatically to share with other providers and LEOs, but you're extremely concerned that in doing so you might reveal details about private messages, perhaps even by sharing which users have messaging relationships with other users. Pre-CISPA, your counsel might refuse that sharing outright; post-CISPA, you'd have statutory protections for sharing that operational data in the course of responding to malware.

I guess you could argue that malware often uses mail to spread, and that a social media provider might dragnet a whole bunch of email spools to collect malware samples and then forklift it to LEOs for investigation. That would be bad.

The bill takes some small steps to keep that from happening, but probably not enough.

     4) CYBER THREAT INFORMATION.— 
      ‘‘(A) IN GENERAL.—The term ‘cyber 
      threat information’ means information directly 
      pertaining to— 
      ‘‘(i) a vulnerability of a system or net-
      work of a government or private entity; 
      ‘‘(ii) a threat to the integrity, con-
      fidentiality, or availability of a system or 
      network of a government or private entity 
      or any information stored on, processed on, 
      or transiting such a system or network; 
      ‘‘(iii) efforts to deny access to or de-
      grade, disrupt, or destroy a system or net-
      work of a government or private entity; or 
      ‘‘(iv) efforts to gain unauthorized ac-
      cess to a system or network of a govern-
      ment or private entity, including to gain 
      such unauthorized access for the purpose 
      of exfiltrating information stored on, proc-
      essed on, or transiting a system or network 
      of a government or private entity	

Taking the opposing position, I might argue:

(a) Our total ineffectiveness at responding to current network security attacks is such a pressing issue that a legislative "patch" makes sense, rather than spending time litigating fiddly changes to tens of existing statutes.

(b) It might not be to our benefit to relitigate the protections of those existing privacy bills; the result might be a weakening of existing privacy protections. Creating a common-sense exception that says "you can share malware or DDOS netflow traces no matter what kind of company you are" might leave our civil liberties safer in the long run.

Incidentally, the DPPA wasn't written to lock down the DMV.

I use the DPPA as an example of surprising limitations on the ability of private companies to share operational data that could conceivably due to operator error or time constraints potentially include protected information. Another example: FERPA.