CISPA legislation seen by many as SOPA 2.0-gctid50532

[Agya Yaw]

CISPA legislation seen by many as SOPA 2.0

By Morgan Little
April 9, 2012, 11:42 a.m.

Reporting from Washington—

In spite of their hopes, Internet activists are finding that their efforts to
keep the digital world free of further regulation did not end with SOPA's
defeat.

The  is working its way through
Congress, and is the latest proposed legislation to raise concerns among privacy
activists. Introduced in November by Rep. Mike Rogers (R-Mich.)
and Rep.  (D-Md.), the stated goal of CISPA is to create new channels
for communication between government intelligence entities and private firms
regarding potential and emerging cyber-security threats.

The communication would deal primarily with what the legislation deems "cyber
threat intelligence," which it defines as "information in the possession of an
element of the intelligence community directly pertaining to a vulnerability of,
or threat to, a system or a network of a government or private entity."

The threats listed under the umbrella of cyber-threat intelligence include
"efforts to degrade, disrupt or destroy" systems or networks, as well as "theft
or misappropriation of private or government information, intellectual property  
or personally identifiable information."

It's the inclusion of intellectual property that's
a major point of contention for those looking at the bill's broad language with
a skeptical gaze. Many fear that CISPA is essentially a retooled version of
SOPA, which was taken off the table in Congress after a concentrated effort by
Internet giants such as Google, Wikipedia
and Reddit, which either supported or held blackouts in protest of the bill.

Rainey Reitman and Lee Tien of the Electronic
Frontier Foundation released a statement outlining their concerns about the inclusion of
intellectual property in CISPA.

"It's a little piece of SOPA wrapped up in a bill that's supposedly designed
to facilitate detection of and defense against cybersecurity threats. The
language is so vague that an ISP could use it to monitor communications of
subscribers for potential infringement of intellectual property. An ISP could
even interpret this bill as allowing them to block accounts believed to be
infringing, block access to websites like The Pirate Bay believed to carry
infringing content, or take other measures provided they claimed it was
motivated by cybersecurity concerns."

Its supporters paint CISPA in another light, framing it as an essential
national security safeguard and a shield against the continued targeting of U.S.
businesses by "nation-state actors like China," according to Rogers.

"Without important, immediate changes to American cybersecurity policy, I
believe our country will continue to be at risk for a catastrophic attack to our
nation's vital networks – networks that power our homes, provide our clean water
or maintain the other critical services we use every day," Ruppersberger said in
a statement celebrating the bill reaching 105 co-sponsors.

CISPA has the support of organizations that
include AT&T, Facebook, IBM, Microsoft,
Oracle, Symantec,  the U.S.
Chamber of Commerce, Verizon,
with Facebook sending over a particularly supportive letter of endorsement.

The process by which CISPA facilitates information sharing revolves around
the director of National Security, who would appoint members of the intelligence
community as gatekeepers to weed through employees of firms seeking to link up
with the government and grant security clearances as they see fit. The bill also
would give the intelligence employee discretion to speed up the process.

Once given clearances, any concerns falling under the cyber-threat
intelligence category that are exchanged between the government and private
party would be  "considered proprietary information" not to be divulged beyond
the two parties without approval.

All of this sharing, as the legislation currently stands, "supersedes any
statute of a State or political subdivision of a State that restricts or
otherwise expressly regulates" the exchanges between the government and those it
exchanges information with.

And it's within this sharing that the key
difference between SOPA and CISPA lies. SOPA was focused on establishing
punitive measures, mainly through revoking domains found to be hosting
copyrighted content, which in turn would make Google responsible for every music
video or movie clip posted to YouTube
without the expressed consent of copyright holders. CISPA, on the other hand, is
focused on information being made readily available between approved entities
and the government.

That distinction may explain the support of Facebook, which was one of the
many technology firms opposed to SOPA. CISPA includes an exemption of liability
granted to those firms taking part in CISPA's information exchanges -- possibly
freeing tech firms from the responsibility of regulating users and the danger of
being taken offline for alleged copyright violations -- so long as they get
approval from the government, actively divulge cyber-threat intelligence
concerns and are "acting in good faith."

And it's the widespread distrust of these parties,
both in private industry and the government, of actually acting in good faith
that is driving the growing concerns over CISPA's progression in Congress, and
the nearly 600,000-person petition against it currently sitting on Avaaz.org.

To read CISPA in its entirety, click here.

morgan.little@latimes.com

Original source: CISPA legislation seen by many as SOPA 2.0

[Ɔbenfo Ọbádélé]

Insanity: CISPA Just Got Way Worse, And Then Passed On Rushed Votefrom the this-is-crazy deptAvailable from: Insanity: CISPA Just Got Way Worse, And Then Passed On Rushed Vote | Techdirt

Up until this afternoon, the final vote on CISPA was supposed to be tomorrow. Then, abruptly, it was moved up today—and the House voted in favor of its passage with a vote of 248-168. But that's not even the worst part.
  The vote followed the debate on amendments, several of which were passed. Among them was an absolutely terrible change  (pdf and embedded below—scroll to amendment #6) to the definition of  what the government can do with shared information, put forth by Rep.  Quayle. Astonishingly, it was described as limiting the  government's power, even though it in fact expands it by adding more  items to the list of acceptable purposes for which shared information  can be used. Even more astonishingly, it passed with a near-unanimous  vote. The CISPA that was just approved by the House is much worse than  the CISPA being discussed as recently as this morning.
  Previously, CISPA allowed the government to use information for "cybersecurity" or "national security" purposes. Those purposes have not been limited or removed.  Instead, three more valid uses have been added: investigation and  prosecution of cybersecurity crime, protection of individuals, and  protection of children. Cybersecurity crime is defined as any crime  involving network disruption or hacking, plus any violation of the CFAA.
  Basically this means CISPA can no longer be called a cybersecurity  bill at all. The government would be able to search information it  collects under CISPA for the purposes of investigating American citizens  with complete immunity from all privacy protections as long as they can  claim someone committed a "cybersecurity crime". Basically it says the  4th Amendment does not apply online, at all. Moreover, the government  could do whatever it wants with the data as long as it can  claim that someone was in danger of bodily harm, or that children were  somehow threatened—again, notwithstanding absolutely any other law that  would normally limit the government's power.
  Somehow, incredibly, this was described as limiting CISPA, but it accomplishes the exact opposite. This is very, very bad.
  There were some good amendments adopted too—clarifying some  definitions, including the fact that merely violating a TOS does not  constitute unauthorized network access—but frankly none of them matter  in the light of this change. CISPA is now a completely unsupportable  bill that rewrites (and effectively eliminates) all privacy laws for any  situation that involves a computer. Far from the defense against  malevolent foreign entities that the bill was described as by its  authors, it is now an explicit attack on the freedoms of every American.

[Ɔbenfo Ọbádélé]

Insanity: CISPA Just Got Way Worse, And Then Passed On Rushed Votefrom the this-is-crazy deptAvailable from: Insanity: CISPA Just Got Way Worse, And Then Passed On Rushed Vote | Techdirt

Up until this afternoon, the final vote on CISPA was supposed to be tomorrow. Then, abruptly, it was moved up today—and the House voted in favor of its passage with a vote of 248-168. But that's not even the worst part.
  The vote followed the debate on amendments, several of which were passed. Among them was an absolutely terrible change  (pdf and embedded below—scroll to amendment #6) to the definition of  what the government can do with shared information, put forth by Rep.  Quayle. Astonishingly, it was described as limiting the  government's power, even though it in fact expands it by adding more  items to the list of acceptable purposes for which shared information  can be used. Even more astonishingly, it passed with a near-unanimous  vote. The CISPA that was just approved by the House is much worse than  the CISPA being discussed as recently as this morning.
  Previously, CISPA allowed the government to use information for "cybersecurity" or "national security" purposes. Those purposes have not been limited or removed.  Instead, three more valid uses have been added: investigation and  prosecution of cybersecurity crime, protection of individuals, and  protection of children. Cybersecurity crime is defined as any crime  involving network disruption or hacking, plus any violation of the CFAA.
  Basically this means CISPA can no longer be called a cybersecurity  bill at all. The government would be able to search information it  collects under CISPA for the purposes of investigating American citizens  with complete immunity from all privacy protections as long as they can  claim someone committed a "cybersecurity crime". Basically it says the  4th Amendment does not apply online, at all. Moreover, the government  could do whatever it wants with the data as long as it can  claim that someone was in danger of bodily harm, or that children were  somehow threatened—again, notwithstanding absolutely any other law that  would normally limit the government's power.
  Somehow, incredibly, this was described as limiting CISPA, but it accomplishes the exact opposite. This is very, very bad.
  There were some good amendments adopted too—clarifying some  definitions, including the fact that merely violating a TOS does not  constitute unauthorized network access—but frankly none of them matter  in the light of this change. CISPA is now a completely unsupportable  bill that rewrites (and effectively eliminates) all privacy laws for any  situation that involves a computer. Far from the defense against  malevolent foreign entities that the bill was described as by its  authors, it is now an explicit attack on the freedoms of every American.