CISPA Passes in the House - Full Roll Call
clerk.house.gov
clerk.house.gov
Can someone help me out here?
Politicians really support the views of the people who actually matter to them - the donors who fund their campaigns, the lobbyists who give them nice perks while they're in office, and the companies who promise them high-paying jobs once they've left public office.
Seriously though, the Republican party isn't a libertarian organization and never has been. They've been marketing themselves that way lately, since they are a bit closer to the libertarian ideal than the Democrats (I guess not in this case though!).
But definitely agree about punks. Or punks with jobs. Also cypherpunks, crypto-anarchists, etc.
I think what happens is that the deeper you go into the left, if you are of a generally radical anti-mainstream bent like I was entering school, you're attracted to leftist ideology because of the fairness aspect of the politics. It's a great time to read Howard Zinn and get pissed off about government, but I think as people who still hold that anti-government bent get older, they do tend to lean Libertarian. I know lots of ex-punks that are hard paleoconservatives now.
I went to all the left-wing anticapitalist protests and was routinely mistreated and violated by police and government. While my politics have moved center, I still maintain that distrust of the system because I know when you are outside of it, you're going to get mowed down. As I've gotten older, I care less about unfairness and more about interference. I've found unfairness can be overcome while interference cannot.
In short, I've found that while I've pretty much abandoned any desire to become a communist hobo, I still have a starting point of extreme suspicion and distaste for central authority.
Anarcho-capitalists are _not_ capitalists. So liberal liberal arts students can be anarcho-capitalists, despite not being capitalists.
Actually, the term "anarcho-capitalism" is completely invalid. It's like "blue-reddish" or "big-smallism."
Capitalism is a social system based on the recognition of individual rights, including property rights, in which all property is privately owned. (Credit goes to the Ayn Rand Lexicon for this particular wording of the definition)
No form of anarchism can protect individual rights, therefore, anarcho-capitalism is not capitalism.
Except the scenario that _my_ gang, also known at the U.S. government, happens to expand its territory to cover the entire United States, which is the goal, and enforces a monopoly on government.
(Source: Until recently I served on the State Central Committee of a major swing state's GOP.)
That might not be the majority but it's certainly the loudest group.
The left-right divide is best described as a tendency to support established power versus a tendency to support those who seek to overturn established power. Hence "conservative" (meaning "preserve the existing social order, or return to the social order of the recent past"). Republicans on the whole are, without a doubt, right-wing, since the best way to predict what cause they will support is to look at the causes of the already wealthy and privileged.
The left roots for the underdogs, the right roots for the top dog. This explains why, today, the left more sides with Palestine and the right with Israel. Why rightwing-types are more likely to defend the rich (low taxes helps most those who pay the most) and leftwing-types to defend the poor. Why in Soviet Russia, the "right" were those who supported the ruling party, and the "left" were those who supported the opposition.
Yes, the more-left(/less right) party currently controls the White House and 1/2 of Congress. This doesn't mean that they have become the established order that the left should now oppose, since the established order is much bigger than mere politics.
The terms "right wing" and "left wing" date back to the French Revolution and the preferred seating positions of the nobility and the reformists in the Estates General. I'm really stretching my powers of speculation, but given that the nobility would have received training in arms, is it coincidence that they would have preferred a seating position that allowed the easier use of their sword-arm when directed toward the center of mass of the opposition party?
When all you have is a right, everything looks like a left.
Also if you were thinking about Rand Paul, in a way he's his father's son, and unlike others who just pay lip service for liberty and such, he's actually fought hard against the Patriot Act, FISA, NDAA, drones and so on. He filibustered them for many hours, introduced amendments (which obviously got rejected), etc. However, he also seems to play way too much towards the overly religious base in the Republican party, and in that way he's also much like the "old" Republicans, which is a shame, and I think it makes even libertarians have second thoughts about him. The "always lower taxes" attitude at least could work on most libertarians, but the very religious side of him, kind of ruins it for libertarians, too.
This changed in the '60s- Democratic support for the civil rights movement caused a massive shift in the south, in which a huge number of voters (evangelical, socially conservative voters who had supported the Democrats since the end of the Civil War) switched allegiances from Democrats to Republicans. That period also saw the rise of Barry Goldwater, who also wasn't a traditional Republican- he was more of a demagogue who engaged in a lot of flag waving and and emotional oratory to get people riled up.
Ever since then there's been a cognitive dissonance within the GOP- the old-school libertarianesque beliefs wedded to the social conservatives and demagogues of the Religious Right (who aren't traditionally right-wing (or left-wing) at all, they've just latched on to the Republican party as being more amenable to being bent to their will).
This cognitive dissonance has reached epic proportions in the last 10 years, in some cases leading to polarization in the party (fiscal conservative/social liberals vs. those who are completely driven by religion and social conservatism). In other cases it leads to politicians who somehow try to appeal to both the libertarians and the Religious Right (Ron Paul being a prime example), and I just don't know what to make of that. The views of the world embodied by those two groups could not be more different, and seems impossible to reconcile in any intellectually honest way.
If you don't know or don't remember your congressperson: http://house.gov/representatives/find/
Republicans stand for strong tribalism - doing only what the tribe approves and not applying any actual rationality to it. Insanely pro-team people are regularly kicked out of this party for mild disagreement with a small subset of this weeks ideals.
Democrats stand for weak triablism - they are sort of in the same camp on some stuff, but generally are allowed to disagree with the cult on things too. No one is kicked out, but bickering gets in the way of standing up to a strong voting block of the super-tribalist republicans.
The point still stands, republicans very vocally value tribalism over most other things. They loudly rant about "real americans" and "how they don't matter, just us" and "I don't like it, but thats just how we play" (the last a particularly vile buck passing - rather than take responsibility, it gets to be no one's fault "cuz the party").
- Libertarians evaluate things on a freedom/tyranny axis.
- Republicans evaluate things on a civilization/savagery axis.
- Democrats evaluate things on a fair/unfair axis.
I think that explains Republican voting behavior here fairly well. They're not for small government because they're libertarian; they're for small government because the US is historically connected with libertarian philosophies.
A really powerful argument in this vein comes from the Nixon tapes. It's very much worth listening to, no matter what your views on the matter are, because I think it really crystallizes why conservatism and the religious right have so much common ground.
Edit: Found it: http://nixontapes.org. It's a lot, which one should I look at?
It's not like they're shy about it.
Obama.
Healthcare ideas that originated from the heritage foundation? No way.
Romney 'won' the first debate by agreeing with Obama's platform on every single issue. The difference between them? Obama.
That's like a Democrat saying that Republicans like "letting the poor die" except when it comes to veterans, children, and those wounded by terrorist attacks. What hypocrites!
I agree with your point in that it was an invective, pithy statement, but the big government categorization wasn't unfounded.
"Small government" isn't purposeless, it's (supposed) tenet is to limit the government in both scope and authority to those powers enumerated by the Constitution. Either way, the point isn't just that the government should be non-existent, or smaller for its own sake, but that it should allow the citizens to provide for their own welfare and provide the minimal in opposition to that. The Republican mantra believes that people can and will fend for themselves, and either enjoy their own successes or failures with minimal intervention.
The democratic mantra is to provide a minimum standard for all, at the expense of those in excess of that standard.
It's a contrast in ideology, but neither is good or bad on its own. Also worth noting is that over time, the parties have effectively flipped positions on matters entirely. The Republicans, for example, freed the slaves despite FIERCE opposition by the democrats. Nowadays, the Democrats generally carry the African-American vote.
In short, it's a popularity contest. Both parties have ideals that they live up to some percentage of the time, but any individual politician (or party dynamic) is likely to shift their belief in the interests of getting elected, staying elected, appeasing campaign contributors or even to appease their constituency.
It's an advertising term, not itself a communication of fact.
For what it's worth, it wasn't meant as a slight to democrats, just a slightly less aggrandizing presentation of the point made.
Arguably, Republicans that claim to prefer a smaller government often would take the surplus from the cut of safety-net programs and apply them to the military. In practice, that may be fair, but it doesn't necessarily result in a smaller government either.
If I were critiquing both parties on effectiveness, I would easily fault the Republican party for failing to substantially reduce the size of government, while at the same time, I would critique democrats for settling for a reduced quantity of freedom in the interest of allowing everyone to share equally in the freedoms that remain.
That said, I prefer neither party, so feel free to critique however you see fit.
The phrase is being used in lieu of the specific and extensive arguments that would have to be made connecting business regulation, social safety nets and progressive taxation with marriage being defined as heterosexual, abortion restrictions, and war(?).
Note: this assumes that there isn't just fancy grift in the whole set of red tape procedures.
>I agree with your point in that it was an invective, pithy statement, but the big government categorization wasn't unfounded.
It may take a lot of money to have a social safety net, but we spend a crazy amount on the military, too.
When Republicans say they don't want "big government", it really is entirely a code phrase for the social safety net. Ask any Republican whether trimming $300 billion from the Pentagon's budget would be a good idea, and (except for a few Libertarians) you'll get a resounding no way, with vague references to national security. Despite the fact that the US spends more on the military than all other countries combined.
So no, the "big government" accusation is entirely unfounded. It's all about what they want to spend billions of dollars on, not whether they want to spend it.
It's only "big government" if you accept the Republican premise that fixing other people's roads and teaching other people's kids is a waste of money.
For much greater detail about why Democrats and Republicans think they way they do, read what the cognitive scientist George Lakoff has to say.[1] By the end things like "We respect life!" but "We want the death penalty!" on the same platform actually make sense.
It is simply impossible to make a de-facto two-party system like the US make sense.
There are more than 2kinds of people, so uou need more than 2 parties to represent them.
It's a sham. The voting process is just there to create an illusion of control and provide a circus for the masses; just another means of control by manufacturing consent.
The Republican Party's purpose is just to mobilize a certain segment of the population when a war needs fighting or some banks need bailing out, and as controlled opposition to the Democratic Party's social agenda. The Democratic Party likewise serves as controlled opposition to the Republican agenda: Obama is President, but you still get the wars and Wall Street anyway.
EDIT: Seeing now that the measure does not require participants to remove user data, but it doesn't prohibit that, correct?
EDIT2: The CISPA Myths vs. Facts and the EFF articles are informative. Regardless, I think it is important to note that because of classification this information may not have been able to be communicated to organizations prior to something like this bill being in place. I would highly recommend encapsulating each constructive measure in its own bill (and I favor that for all legislative endeavors) however that may not work given the difficulty of the process these days.
The research community has a thing or two to say about that:
https://www.usenix.org/conference/usenixsecurity12/social-ne...
Under CISPA, there's no longer any legal obligation to protect your information. There is full immunity for not doing so.
If an ISP suffers a breach and coughs up huge amounts of PII that they handled negligently, they are absolutely still liable after CISPA becomes a law.
In my case, as a service provider, we are encrypting as much as we can, so that we can't even read the data even if obliged to. It becomes troublesome for some pieces of data because we need to decrypt it so that it can be displayed in the website. So if we can decrypt it, as a provider, then we would be obliged to decrypt it for government agencies.
It would be interesting to see what can we do as a provider, to protect our own customers without breaking the law.
Also, the so called protections that it must be a cyber-security threat also hold little check and balance, how about an attack just happening when an agency needs information, or waiting for an attack by baiting it, any protection against creating honeypots to bait certain services? Probably not. Everyday servers and systems are attacked, so it is pretty much open season for getting information. There are no checks and balances and 'volunteering' means nothing. Try getting a gov't contract or deflecting problems without volunteering.
I am glad all these freedom giving up people have nothing to hide such as their business ideas, sites they visit, downloads, emails etc will all be tracked now. I am sure they have something to hide from then. All of this will now be stored not only on their computers and their services, but at the ISP and the NSA now as well. Lots more chances, especially at the ISP level, of identity theft and threats.
Crypto products might be a big market after this.
For instance, SpiderOak makes a point of not knowing what their clients store on their servers, because all encryption happens on the client side, and the key never reaches the server side.
The problem with JS is that the browser may be not good enough, failing to prevent certain attacks from other tabs.
The OS may be compromised, too, so that the data is available before encryption, or the key phrase gets stolen and siphoned out by a keylogger. However good your software is, you can't fight against it.
As memory is getting cheaper, running each domain in a different process in a different container or VM becomes more feasible (see Qubes OS). In a well-insulated environment, JS encryption should be as safe as any other.
Nothing is 100% secure, specially in the web, but anything is better that what we have today.
I will start doing some research on the solutions to this. We are going to do for our clients, what I expect my providers do for me.
Maybe it was just primarily a technology contribution among the nerds at NSA, and not the bureaucrats intended goals?
Really, if you want to point to the NSA/NIST helping to advance the state of cryptography, point to the AES contest.
Here's one summary of the ECC patent situation:
http://cr.yp.to/ecdh/patents.html
ECC is increasingly common in commercial systems. Who's asserting patents against those systems?
When last I checked, the 20-year-old GNFS algorithm was the most efficient way to attack RSA. Yes, this is faster than the best known attacks on ECDLP, but ECDLP attacks are still subexponential. Nothing has changed in the past ten years about the complexity class of ECDLP (it is still both in NP and in coNP).
Really, the future of cryptography is not elliptic curves, it is systems based on lattices, hidden linear codes, and hard learning problems (these are all related). You can do some interesting things with ECC, but there are far more interesting lattice cryptosystems being developed by researchers.
"ECC is increasingly common in commercial systems. Who's asserting patents against those systems?"
Certicom filed this famous lawsuit:
http://www.certicom.com/index.php/2007-press-releases/20-cer...
Really though, Dan Bernstein is not a lawyer, and I would not trust his analysis if I had a business to run. Even if he is right, that does not change the fact that ECC deployment is lagging because of fears about patent suits. The NSA's response to concerns about patents was to get a special license, specifically for government uses of ECC; they did nothing at all to encourage ECC deployment elsewhere, and they did not demonstrate that such deployment was a priority.
Good background on PQ cryptography (McEliece, &c, the stuff you're referring to later in your comment): Bernstein's intro to Post-Quantum Crypto: http://pqcrypto.org/www.springer.com/cda/content/document/cd...
I've never seen anyone use McEliece, NTRU, &c commercially. Unlike ECC, these schemes aren't on the horizon for TLS.
ECC goes back to Lenstra and Koblitz in the mid-80's. I'm not wading into the validity of the patents the way DJB does, just saying, we're coming to the end of their lifespan.
This isn't the cold war anymore.
Why?
There's a logic and motive to state intelligence organizations, it's not just a blind "everything must be readable!"
Instead of rejoicing, the man forced MS to build a backdoor into it.
The man is glad if your valuable communication can't be stolen by some Chinese spies. But you are a good citizen and have nothing to hide from your own government, right?
Beats a compute cluster hands down.
This is why encryption is good against a foreign government, but not as good against your own.
Call your congressperson. They do care what you think, at least a little bit, especially if you take the time to call or write their office thoughtfully.
Normally, once the two sides pass relatively similar bills, a conference committee is formed to resolve any differences, and then that resulting legislation is voted on.
Congresspeople are currently very afraid of "getting SOPAed" where they try to make some kind of tech policy regulation and then accidentally set off a huge wave of activism.
Keep in mind, just because something passes in the House doesn't mean it's law. There's a long process - right now it's still just a bill (that they voted for on Capitol Hill (sorry)). There's a lot that can be done, and, now, probably will be done to mobilize on this issue. I doubt that it will come to SOPA-level activity (SOPA would have affected the bottom lines of big tech companies. This is "just" about privacy). But there's always room for trying to make things more reasonable.
This is roughly like saying "I voted for X, but Y still happened."
I'm looking for a European provider of virtual machines, with competitive prices and features, but with no US company behind it and ideally not even a US datacenter. Just a strong IaaS offering within the EU and a commitment to stay out of the US.
The first site collates prices/deals, where you can filter by location.
They also carry out a quarterly survey as an attempt to gauge customer satisfaction for each provider (http://www.lowendtalk.com/wiki/top-providers).
I've been looking for a VPS recently and found the above 2 sites very useful.
It shouldn't surprise anyone that choosing their VPS provider by price alone can be a bad idea, but I really don't recommend it.
You have to look at the companies with a critical eye but there are well established ones.
Buyvm.net is a no fuss provider and they have been around for a while.
They are very highly regarded and are an European provider.
They may not be the cheapest but are reasonable.
So far the Russians have been pretty cool - when America told them to shut down their mp3 search engines, their reply was something along the lines of "go fk yourself". I assume they have this saved as a template.
I've dropped them an email asking about those things, as they do appear to be good.
http://intelligence.house.gov/sites/intelligence.house.gov/f...
Anyways, I believe you're referring to this section: 'Does CISPA do enough to prevent abuse of the law for copyright enforcement?'
Here's the relevant text from that section:
CISPA’s definition of "cyber threat information" includes information directly pertaining to a threat to "confidentiality." But what does confidentiality mean? The definition encompasses measures designed for preserving "authorized restrictions on access," including means for protecting "proprietary information." "Proprietary information" is not defined, and could be read to include copyrighted information. For example, one type of restriction on access that is designed to protect proprietary information is digital rights management (DRM).
The problem here is the vagueness of the language. As others as have pointed out, the concern is not so much about intent of the language, but abuse of the vagueness to strongly serve the interests' of copyright holders over the general public.
Additionally, published content isn't confidential.
Unless you happen to increment a public-facing URL in a numeric fashion...
There are just easier ways to string someone up for copyright infringement if you really wanted to than CISPA.
Could you please point out the text of the bill that you're describing here?
I think the problem is one of perspective. In the Boston bombings, it's incredibly simple to see the harm and it directly affects those being asked to share the information they have to help. In the persistent and ongoing computer intrusions that are now a reality for any successful business, the public is largely unaware and only indirectly affected by such events. Hence, why try to solve it?
The "Cat Signal" was activated prior to this debacle as a means to urge netizens to contact their elected representatives and garner opposition to CISPA.
My elected representative voted no. Thank you Tulsi!
Dear Internet Defense League member,
Last year, right on the heels of our historic victory against SOPA, a piece
of really nasty legislation almost passed that would have radically undermined
online privacy.
It was called CISPA. And it raced through the US House of Representatives,
passing before any of us had a chance to react. We stalled the bill in the
Senate, but now CISPA is back, and we don't want to make the same mistake twice.
Before there is *any* movement on the bill, we want to send a strong message
to Congress that CISPA shouldn't pass.
That's why we're partnering with the Electronic Frontier Foundation to launch
an Internet Defense League action starting tomorrow, Tuesday March 19th.
Can you participate? If so, get the code for your site here: http://members.internetdefenseleague.org
It must really not be working if someone like me who reads tech sites every day didn't notice it?
It seems to me like we need a new generation of tools that allow people to take actions that matter. Beyond relatively poorly designed click-to-call your congress person tools, we really don't have much right now. I think with better software we can do a lot more, but I'm still trying to figure out exactly what that'll look like.
I'd love to hear HN's thoughts.
I have a few ideas.
First and foremost I think the internet needs to focus on one issue at a time. Once you divide the activists the whole message gets blurred and no one cares. (Case in point, look at occupy wall street, what exactly did the protesters want??)
Point two, it can't involve petitions, those are stupid and counter-productive.
Point Three, activists like to be involved. Have a way for people to earn points contacting their representatives or helping the site in other ways and perhaps be able to use those points to vote on what issue to tackle next, or the actions presented for an issue?
Really I'm picturing something like a cross between reddit and stack overflow geared towards political action. Power users can vote on issues, have meta discussions in the background, but normal users just see the one issue that's going on at the moment with a simple interface that explains the issue and has 1-3 meaningful actions they can take.
My thoughts for the 3 actions could be: Call your representative, Request a pre-addressed envelope be mailed to you so you can write a letter in your own words, or donate money to pay for mailing the pre-addressed letters to people.
Regarding the points system - I agree on that. Gamification might be a good way to keep people engaged.
And regarding actions, I'm working on that already. The pre-adressed envelope might be achievable in different ways too (type a letter, and we'll print and email it).
My first step is going to be to set up a http://discourse.org site for us to discuss. I do like the reddit model too, though it perhaps promotes sensationalism over actual content. That being said, it does seem to work quite well.
1) Single issue organizations are quick to grow but hard to sustain. Once the first fight is over, how do you take your list and pivot to a new issue? People lose interest quickly unless there's a hook to keep them involved.
2) Petitions may seem silly, and many of them are, but some have actually had big successes. These are due more to the strategy behind them than the actual numbers; you have to find the right leverage point in the political process to make the numbers matter. They are also useful as signals to organizers that people are interested in an issue, even if they won't be successfully delivered.
3) Gamification in this space is hard. You're one step away from the "slacktivism" critique, and sliding ever closer with each point or badge you give out. For some examples of this being done well, see http://repurpose.workersvoice.org/
For the "3 actions you must take", the handwritten letter is probably the most impactful. Staffers tend to weight online signatures, phone calls, letters, and in person visits by increasing orders of magnitude of importance. Getting 100,000 signatures is now "worth" less than 1,000 letters, particularly as petition numbers continually increase.
Instead of working to sustain single-issue organizations, a better strategy might be to reduce the friction to creating successful, short-term organizations in the first place. Something like an activist flash mob.
It seems to me that if you told me that you're running for the House in my district and you'll answer my questions on 8thdistrictva.com or whatever, I would completely believe you're better than the other guy. You might listen to me.
Has anybody tried to do this? To be fair I've barely looked at my representative's web page. But this seems much better than calling or writing a letter. I guess you could email them, but every standard means of communication I just imagine an office full of overcaffeinated interns skimming the message for keywords and picking the closest automatic reply. Most of the time, I'd just want to communicate a simple feeling (eg I don't like this bill) and I'd be okay with them looking at a graph of the poll results.
It's almost impossible to get an email to your actual representative. What you want to do is get your sentiment to their aide via email. Simply put, your subject should be one of:
"Please oppose Senate Bill <number>" or "Please support Senate Bill <number>". Make sure you know if it's a senate bill or a house bill, and make sure you know the number. If you can't be bothered to perform that simple amount of research, then it's a signal to them you probably aren't a voter, or don't have strong opinions on the matter (right or wrong).
In the contents of the email, which probably won't be read, but in the case that they are, state your name, district (if applicable), and whether you're registered to vote, and if it's for their party, then say so. If it isn't, omit it.
After that, do whatever you like, but keep it brief, polite and on-topic.
A lot of the "rest of the world" data is stored in the US, or passes through US servers. That gives them access to it.
Anything you have in Google services, Microsoft services, Yahoo, Apple iCloud, etc etc etc
Edit: For clarity, I'm from the Netherlands.
So technically feasible, yes. Realistically... depends on whether developers of these clones can find something that gives them an advantage over the originals, besides privacy or legal issues. Businesses want to keep data in-house regardless, and not many consumers care enough. Having one global network for social networks has certainly advantages, but when the laws in the "home country" (for the lack of a better word, if there is any) become hostile and privacy invading... then I don't know. If I could pay to get off of all google services and have my data imported into a dutch google clone, I'd do it.
If so, any of this information can be easily shared with the US Government free of charge to you!
Basically the government had previously stated that capturing of any electronic information and storing it is not the same as wire-tapping/reviewing the information.
They can capture and record whatever they want and should they at a later date want to look at anything you did, they can get the warrant and look at this historical info.
With CISPA -- the legal process for doing any of this is now far easier for them.
(please correct me if this is not true)
Why not simply say what the bill says:
"The term ‘cyber threat information’ means information directly pertaining to a vulnerability of, or threat to, a system or network of a government or private entity."
This way people can decide for themselves what could be the possible interpretations of that which a lawyer could successfully defend to be "in good faith" -- which is all that the bill requires. I would be surprised if anybody would come to the conclusion that the only defensible interpretation of that is "operational network information".
‘(A) IN GENERAL.—The term ‘cyber threat information’ means information directly pertaining to— ‘‘(i) a vulnerability of a system or network of a government or private entity; `‘(ii) a threat to the integrity, confidentiality, or availability of a system or network of a government or private entity or any information stored on, processed on, or transiting such a system or network; ‘‘(iii) efforts to deny access to or degrade, disrupt, or destroy a system or network of a government or private entity; or ‘‘(iv) efforts to gain unauthorized access to a system or network of a government or private entity, including to gain such unauthorized access for the purpose of exfiltrating information stored on, processed on, or transiting a system or network of a government or private entity.
So the actual meaning hasn't changed much. Because this only clarifies the threats/vulnerabilities/evil efforts and not the information about such threats/vulnerabilities/evil efforts that can be shared, my point applies equally well to this wording. This version of the bill also still has no mention of "operational" or "network information".
[1] http://intelligence.house.gov/sites/intelligence.house.gov/f...
Just to make sure, is that the version you're reading too, or do I still have the wrong one?
I do not think your point stands with this definition. You're right that I used a shorthand rather than copying that exact language from the bill into yet another comment, as a cursory Google search will tell you that I've done repeatedly. There was no way the bill was going to use the term "operational network security data", because that term is even more vague than the bill's definition.
A more productive thing for you debate other than semantics would be how this specific definition --- which is far more complete than anything else in the US Code, unless you'd like to correct me on that --- should be tightened.
If it was up to me then I would certainly first change other aspects of the bill which are far worse than this definition, but as far as this particular definition goes, I would limit the information that can be shared to the information that can reasonably lead to the solution of the problem (fixing vulnerability / removing threat / stopping evil efforts) not "information pertaining to the vulnerability / threat / efforts". It may well turn out that in court that is already how this will be interpreted, but the problem is that this wording does not make that clear at all. And in a legal case where it has to be decided whether a company gets immunity for a particular piece of information that was shared, "reasonably" should be determined by an external technical expert, and not according to the private opinions of the person who shared the information.
The onus is not on the opposition to this bill to explain how privacy will go wrong, it is on the supporters since it is a new law with vague language and far-reaching potential consequences.
Also, having privacy amendments shot down or not brought to vote doesn't make CISPA seem very democratic.
(For those following and don't know what a netflow is, it doesn't contain payload data. It's more or less headers and statistics. Nothing about CISPA attempts to limit information to netflows only.)
I wish this bill were more focused on network security events and didn't have any language in it to deal with stuff like cyberbullying, but I'm glad it's moving forward.
Worst case scenario we find it in the Supreme Court where it gets narrowed to be more like what it should have been written as. Happens all the time, we're not going to wake up to a dystopian future with silent arrests and "we have always been at (cyber) war with Eastasia!" the day this passes.
Note also that "limited" in governmental terms is about sigma shy of "all."
IANAL.
(i) A vulnerability
(ii) A threat to the integrity, confidentiality, or availability of a system or network or any info stored or transiting one
(iii) Efforts to deny access
(iv) Efforts to gain unauthorized access (with the exception that violations of consumer terms of service are not covered by CISPA)
Help me understand the scenario in which anyone would push health records in response to any of these 4 scenarios?
Meant to say "accidentally" w.r.t. health records.
Yeah. I'm not down with that. 4th amendment and all that.
So basically anything goes as per the CFAA definition of "unauthorized access"? weev got thrown into jail for it, and all he did was increment a number in a URL.
1. Cyber threat intelligence is defined as information pertaining to the things you listed. That is much more broad than your definition, for example sharing information pertaining to a vulnerability is much more broad than sharing the vulnerability itself since the latter only includes e.g. the code that results in the vulnerability whereas the former also includes any customer data directly related to it.
2. CISPA does not just grant immunity for the sharing of "cyber threat intelligence". It grants immunity for anything that is shared as such "in good faith". So in reality, it can include anything, as long as it was shared "in good faith". I quote: "EXEMPTION FROM LIABILITY.—No civil or criminal cause of action shall lie or be maintained in Federal or State court against a protected entity, self-protected entity, cybersecurity provider, or an officer, employee, or agent of a protected entity, self-protected entity, or cybersecurity provider, acting in good faith— ‘‘(A) for using cybersecurity systems or sharing information in accordance with this section; or ‘‘(B) for decisions made based on cyber threat information identified, obtained, or shared under this section."
As you can see, the set of things you get immunity for is extremely broad. Far broader than you describe.
Furthermore, this bill puts no oversight in place that even checks that things were shared according to these (extremely broad) rules. And people have no way of knowing what information about them has been shared. So warfangle's scenario is very conceivable. For example if a company thinks you have in some way triggered a vulnerability (accidentally, or though a programming error on their side, or you didn't trigger anything at all but they just think that you have ("in good faith"), doesn't matter), some lazy chap can just dump the database with all data related to your user ID and send that over as long as it is his private opinion that it is information "pertaining to a vulnerability". Not only is that perfectly OK according to this bill, but you'll also have no way of knowing that that happened, and there is nobody evaluating if sharing all that data was actually OK or not.
""" CISPA allows for the sharing of information that the company doing the sharing can "in good faith" believe to be "cyber threat intelligence", which is defined as:
(i) Information pertaining to a vulnerability
(ii) Information pertaining to a threat to the integrity, confidentiality, or availability of a system or network or any info stored or transiting one
(iii) Information pertaining to efforts to deny access
(iv) Information pertaining to efforts to gain unauthorized access (with the exception that violations of consumer terms of service are not covered by CISPA)
So indeed your scenario of sharing health records may be a valid concern."""
Then I would have wholeheartedly agreed with it.
And if they can vote absentee for 'extreme' circumstances only, who gets to decide? The party leaders? The proponents of the bill? The opponents?
Feingold is the only one that sticks out in my mind as bucking this trend - he never missed a single vote, even as he was losing his 2010 re-election campaign and his opponent was working the campaign trail every day.
Unfortunately, people like Feingold are the exception, not the rule.
There's a reason we have police and local authorities in addition to high-level politicians. They handle local politics and issues. If we actually need our state representatives so involved in something like this that they can't perform the functions they were elected for, then that's a systemic problem that should be addressed.
Is this a bit insensitive? Perhaps. But these people have a responsibility to look at the big picture, and if that means ignoring something tragic but not related to their responsibilities, they need to recognize that and act appropriately.
His track record tells me he'll sign it happily while saying "I have serious reservations about this".
Libertarians are probably the weakest leg of the Republican coalition. The religious right and the neocons are much stronger, the former has little reason to oppose this, the latter might be naturally inclined to support it.
Interestingly, I've been hearing a bit about Democratic-leaning "civil libertarians" -- people who want small government without buying into any of the Republican social agenda. Maybe there's a way to build a coalition that can take a big enough bite out of both parties to force them to take notice...
Having your veto overturned is a bad thing. That alone would be a reason. The other reason being that Obama chose to stay silent on the SOPA/PIPA/CISPA issue the first time around. Coming out against it would have cost him relatively little in public opinion, which must mean there are interests relevant to him that aren't entirely opposed to the bill.
Happy to be wrong.
<vote-data>
<recorded-vote><legislator name-id="A000055" sort-field="Aderholt" unaccented-name="Aderholt" party="R" state="AL" role="legislator">Aderholt</legislator><vote>Yea</vote></recorded-vote>Even if it doesn't come to that, a credible veto threat is often enough to get the President to sign the thing. So bending even a few votes in either direction may have some political meaning here.