10:23 AM

CISPA Bill: 5 Main Privacy Worries

Privacy rights groups have launched a week of protests against the House bill, warning that CISPA will weaken current wiretapping and electronic communication laws.

Does the Cyber Intelligence Sharing and Protection Act (CISPA) threaten people's privacy in unacceptable ways?

That's one criticism being leveled at CISPA, the House cybersecurity bill introduced by Rep. Mike Rogers (R-Mich.) and Dutch Ruppersberger (D-Md.) in November, 2011. Many privacy watchers, notably, have said that the 11-page bill, which focuses on government monitoring, suffers a similar problem to the Stop Online Piracy Act (SOPA), which was defeated earlier this year after a wave of mass protests. Namely, the language of CISPA is so broad, that while it attempts to tackle a real issue--in this case, government monitoring--it may spur unintended and detrimental side effects.

As a result, numerous civil rights groups--including the American Civil Liberties Union, the Center for Democracy & Technology (CDT), the Electronic Frontier Foundation (EFF), and Reporters Without Borders--announced Monday that they were launching a "Stop Cyber Spying" week of protests against CISPA, before a scheduled House of Representatives vote on the bill next week.

What are the privacy-related worries with CISPA? Civil liberties groups have detailed 5 main concerns:

1. Widespread Employee Monitoring. The CISPA bill states that any business can "use cybersecurity systems to identify and obtain cyber threat information to protect [its] rights and property"--which privacy watchers said will include email or Facebook message contents--while having immunity from prosecution or lawsuits under any other law. According to the EFF, that provision would subvert privacy protections offered by existing wiretapping laws and electronic privacy communications laws, allowing companies to "bypass all existing laws, as long as they claim a vague 'cybersecurity' purpose," without threat of reprisal.

[ What can enterprises learn from a recent security fight against Anonymous? See Anonymous Vs. DNS System: Lessons For Enterprise IT. ]

2. No Information-Sharing Restrictions. Another criticism of CISPA is that, as worded, it doesn't restrict the reasons for which information may be gathered. "It lacks meaningful use restrictions--it should be made clear that information shared for cybersecurity should be used for cybersecurity purposes, not unrelated national security purposes or criminal investigations," said CDT senior counsel Greg Nojeim in a statement.

3. Information May Be Shared With NSA. Under CISPA, companies could voluntarily share any communications they like with the Department of Homeland Security (DHS). "After collecting your communications, companies can then voluntarily hand them over to the government with no warrant or judicial oversight whatsoever as long is the communications have what the companies interpret to be 'cyber threat information' in them," said the EFF. DHS would also then be free to share the information with other government agencies, including the National Security Agency, over which there's little oversight, according to civil rights groups.

4. Bill May Encourage Broad Surveillance. As with SOPA and PIPA, many privacy watchers aren't lobbying for no legislation. Rather, privacy groups say that they want more carefully constructed bills, which take into account existing civil liberties, and which monitor government access to people's personal communications. "We need cybersecurity legislation, not surveillance legislation," said CDT President Leslie Harris, in a statement criticizing CISPA.

5. CISPA Alternatives Do Exist. Better alternatives to CISPA may already exist, according to privacy groups. For example, the CDT is backing a different cybersecurity bill, known as the PRECISE Act, which was written by Rep. Dan Lungren (R-Calif.). According to the CDT, that bill "has information-sharing language that offers a better alternative to CISPA, balancing cybersecurity, industry, and civil liberties concerns." Might CISPA succeed where SOPA and PIPA failed? Last week, members of the hacktivist group Anonymous launched a series of distributed denial-of-service (DDoS) attacks against Boeing, as well as the trade associations TechAmerica and USTelecom, all of which have publicly backed CISPA.

In other words, before CISPA might pass into law, you can expect to see the fight to scuttle CISPA intensify.

At a time when cybercrime has never been more prolific and sophisticated, budgets are being cut. In response, IT is taking a hard look using third-party services--outsourcing--to meet security challenges. Our Making The Security Outsourcing Decision report outlines the various security outsourcing options available. (Free registration required.)

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Andrew Hornback
Andrew Hornback,
User Rank: Apprentice
4/20/2012 | 2:37:52 AM
re: CISPA Bill: 5 Main Privacy Worries
On point 1 - every organization that I've been involved with has made it very clear that any information accessed or input on their systems is their property. Data that travels across their circuits (which were procured under the guise of empowering employees to do work) also becomes their property - whether they choose to examine it or not. Having built a sniffer system in the past for a previous employer, it is not only possible for them to examine that data, but also look at it in near real time. When you are using an employer's computing facilities to do personal tasks (e-mail, Facebook, eBay, etc.) you may be in violation of the terms of usage agreement that you may have signed prior to being granted access on the network. Point blank - don't use company resources for personal tasks.

On point 2 - who makes the determination as to what information should be passed along as being threat-related and who redacts that information to protect the civil liberties of the users? Then, who watches these watchers? Could turn into a downward logical spiral.

On point 3 - this really isn't a new item. Anyone, anywhere, at any time, can share any information they want with the National Security Agency. It's when the NSA or any of the other alphabet-soup organizations come looking for your information that the "rules of engagement" change.

On point 4 - it sounds to me like we either need to a) elect officials who actually know the difference between cybersecurity threats and fried green tomatoes or b) have the lobbyist groups draft the legislation and put it before a group of legislators that still don't know the difference between cybersecurity threats and fried green tomatoes. Passing legislation on things that you know little to nothing about is a recipe for disaster.

On point 5 - see point 4 and look for the fried green tomatoes. Passing legislation on things that you know little to nothing about is a recipe for disaster. I'm quite convinced that no piece of legislation in this arena is going to satisfy all parties and stakeholders. It's generally accepted that something needs to be done, but how it gets done is a point of contention that brings out the best in some people, even Anonymous, apparently.

Andrew Hornback
InformationWeek Contributor
User Rank: Ninja
4/18/2012 | 3:56:57 PM
re: CISPA Bill: 5 Main Privacy Worries
@readers - numbers 2 and 3 touch on the issue of information sharing, which some in the critical infrastructure companies and intelligence community say there isn't enough of, while critics here say it could be dangerous. How should the balance be struck here between the need to share information and the need to protect civil liberties?
Brian Prince, InformationWeek/Dark Reading Comment Moderator
Microsoft Word Vuln Went Unnoticed for 17 Years: Report
Kelly Sheridan, Associate Editor, Dark Reading,  11/14/2017
Companies Blindly Believe They've Locked Down Users' Mobile Use
Dawn Kawamoto, Associate Editor, Dark Reading,  11/14/2017
121 Pieces of Malware Flagged on NSA Employee's Home Computer
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/16/2017
Register for Dark Reading Newsletters
White Papers
Current Issue
Managing Cyber-Risk
An online breach could have a huge impact on your organization. Here are some strategies for measuring and managing that risk.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.