10:23 AM

CISPA Bill: 5 Main Privacy Worries

Privacy rights groups have launched a week of protests against the House bill, warning that CISPA will weaken current wiretapping and electronic communication laws.

Does the Cyber Intelligence Sharing and Protection Act (CISPA) threaten people's privacy in unacceptable ways?

That's one criticism being leveled at CISPA, the House cybersecurity bill introduced by Rep. Mike Rogers (R-Mich.) and Dutch Ruppersberger (D-Md.) in November, 2011. Many privacy watchers, notably, have said that the 11-page bill, which focuses on government monitoring, suffers a similar problem to the Stop Online Piracy Act (SOPA), which was defeated earlier this year after a wave of mass protests. Namely, the language of CISPA is so broad, that while it attempts to tackle a real issue--in this case, government monitoring--it may spur unintended and detrimental side effects.

As a result, numerous civil rights groups--including the American Civil Liberties Union, the Center for Democracy & Technology (CDT), the Electronic Frontier Foundation (EFF), and Reporters Without Borders--announced Monday that they were launching a "Stop Cyber Spying" week of protests against CISPA, before a scheduled House of Representatives vote on the bill next week.

What are the privacy-related worries with CISPA? Civil liberties groups have detailed 5 main concerns:

1. Widespread Employee Monitoring. The CISPA bill states that any business can "use cybersecurity systems to identify and obtain cyber threat information to protect [its] rights and property"--which privacy watchers said will include email or Facebook message contents--while having immunity from prosecution or lawsuits under any other law. According to the EFF, that provision would subvert privacy protections offered by existing wiretapping laws and electronic privacy communications laws, allowing companies to "bypass all existing laws, as long as they claim a vague 'cybersecurity' purpose," without threat of reprisal.

[ What can enterprises learn from a recent security fight against Anonymous? See Anonymous Vs. DNS System: Lessons For Enterprise IT. ]

2. No Information-Sharing Restrictions. Another criticism of CISPA is that, as worded, it doesn't restrict the reasons for which information may be gathered. "It lacks meaningful use restrictions--it should be made clear that information shared for cybersecurity should be used for cybersecurity purposes, not unrelated national security purposes or criminal investigations," said CDT senior counsel Greg Nojeim in a statement.

3. Information May Be Shared With NSA. Under CISPA, companies could voluntarily share any communications they like with the Department of Homeland Security (DHS). "After collecting your communications, companies can then voluntarily hand them over to the government with no warrant or judicial oversight whatsoever as long is the communications have what the companies interpret to be 'cyber threat information' in them," said the EFF. DHS would also then be free to share the information with other government agencies, including the National Security Agency, over which there's little oversight, according to civil rights groups.

4. Bill May Encourage Broad Surveillance. As with SOPA and PIPA, many privacy watchers aren't lobbying for no legislation. Rather, privacy groups say that they want more carefully constructed bills, which take into account existing civil liberties, and which monitor government access to people's personal communications. "We need cybersecurity legislation, not surveillance legislation," said CDT President Leslie Harris, in a statement criticizing CISPA.

5. CISPA Alternatives Do Exist. Better alternatives to CISPA may already exist, according to privacy groups. For example, the CDT is backing a different cybersecurity bill, known as the PRECISE Act, which was written by Rep. Dan Lungren (R-Calif.). According to the CDT, that bill "has information-sharing language that offers a better alternative to CISPA, balancing cybersecurity, industry, and civil liberties concerns." Might CISPA succeed where SOPA and PIPA failed? Last week, members of the hacktivist group Anonymous launched a series of distributed denial-of-service (DDoS) attacks against Boeing, as well as the trade associations TechAmerica and USTelecom, all of which have publicly backed CISPA.

In other words, before CISPA might pass into law, you can expect to see the fight to scuttle CISPA intensify.

At a time when cybercrime has never been more prolific and sophisticated, budgets are being cut. In response, IT is taking a hard look using third-party services--outsourcing--to meet security challenges. Our Making The Security Outsourcing Decision report outlines the various security outsourcing options available. (Free registration required.)

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Andrew Hornback
Andrew Hornback,
User Rank: Apprentice
4/20/2012 | 2:37:52 AM
re: CISPA Bill: 5 Main Privacy Worries
On point 1 - every organization that I've been involved with has made it very clear that any information accessed or input on their systems is their property. Data that travels across their circuits (which were procured under the guise of empowering employees to do work) also becomes their property - whether they choose to examine it or not. Having built a sniffer system in the past for a previous employer, it is not only possible for them to examine that data, but also look at it in near real time. When you are using an employer's computing facilities to do personal tasks (e-mail, Facebook, eBay, etc.) you may be in violation of the terms of usage agreement that you may have signed prior to being granted access on the network. Point blank - don't use company resources for personal tasks.

On point 2 - who makes the determination as to what information should be passed along as being threat-related and who redacts that information to protect the civil liberties of the users? Then, who watches these watchers? Could turn into a downward logical spiral.

On point 3 - this really isn't a new item. Anyone, anywhere, at any time, can share any information they want with the National Security Agency. It's when the NSA or any of the other alphabet-soup organizations come looking for your information that the "rules of engagement" change.

On point 4 - it sounds to me like we either need to a) elect officials who actually know the difference between cybersecurity threats and fried green tomatoes or b) have the lobbyist groups draft the legislation and put it before a group of legislators that still don't know the difference between cybersecurity threats and fried green tomatoes. Passing legislation on things that you know little to nothing about is a recipe for disaster.

On point 5 - see point 4 and look for the fried green tomatoes. Passing legislation on things that you know little to nothing about is a recipe for disaster. I'm quite convinced that no piece of legislation in this arena is going to satisfy all parties and stakeholders. It's generally accepted that something needs to be done, but how it gets done is a point of contention that brings out the best in some people, even Anonymous, apparently.

Andrew Hornback
InformationWeek Contributor
User Rank: Ninja
4/18/2012 | 3:56:57 PM
re: CISPA Bill: 5 Main Privacy Worries
@readers - numbers 2 and 3 touch on the issue of information sharing, which some in the critical infrastructure companies and intelligence community say there isn't enough of, while critics here say it could be dangerous. How should the balance be struck here between the need to share information and the need to protect civil liberties?
Brian Prince, InformationWeek/Dark Reading Comment Moderator
Register for Dark Reading Newsletters
White Papers
Current Issue
E-Commerce Security: What Every Enterprise Needs to Know
The mainstream use of EMV smartcards in the US has experts predicting an increase in online fraud. Organizations will need to look at new tools and processes for building better breach detection and response capabilities.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio