New Draft Of CISPA Announced: Some Progress, Still Big Problems

Privacy

from the it's-a-start-I-guess dept

The House Intelligence Committee has published a new draft of CISPA (pdf and embedded below), which includes the two amendments that were already approved, plus several other additions and changes. In some areas, there is genuine progress—in others, things actually seem to have gotten worse. Unfortunately, some of the biggest problems with the bill remain, and some of the new language seems to have little effect at all. Some changes I will discuss in future posts, but there are two that I wanted to look at right away:

A Narrower Definition Of Cybersecurity
This is the one clearly positive change in the bill. Previously, the definition of cybersecurity and cyber threat information was:

(A) efforts to degrade, disrupt, or destroy such system or network; or

(B) theft or misappropriation of private or government information, intellectual property, or personally identifiable information.

While the first part remains unchanged, the second part is now much narrower:

(B) efforts to gain unauthorized access to a system or network, including efforts to gain such unauthorized access to steal or misappropriate private or government information

Where the original language could be construed to include all sorts of activity that goes beyond what most people could consider “cybersecurity”, the new definition makes it clear that we are talking about unauthorized network access. Most notably, it removes the reference to “intellectual property”, which makes sense: the authors have always insisted that they were talking about the misappropriation of secret R&D by foreign entities, which is sufficiently covered by language referring to privacy and unauthorized access. Including “intellectual property” opened it up to all sorts of additional interpretations that went beyond this stated intent.

Now, there’s still reason to be a little concerned here, because the attempts to charge people for “unauthorized access” under the CFAA have been ridiculous in the past. If this language in CISPA were construed to include things like violating terms of service (as some have claimed of the CFAA language) then it would be very dangerous. However, with last week’s Ninth Circuit ruling which narrowly construed unauthorized access, legal thinking on this matter seems to be heading in the right direction. There’s still some gray area, and I think there’s still room for a much better definition of cybersecurity in CISPA (I know they want to future-proof it, but it doesn’t have to be that short and vague) but this is still a significant improvement over the previous draft.

Extremely Limited Liability For Companies
The new draft of CISPA includes a whole new section carving out the requirements for a company to be held liable if they share information improperly. Basically, a company that shares data with the government receives immunity from all existing privacy laws unless you can show that their actions caused you injury and constituted “willful misconduct”—which is very specifically defined in CISPA as an action taken:

(I) intentionally to achieve a wrongful purpose;
(II) knowingly without legal or factual justification; and
(III) in disregard of a known or obvious risk that is so great as to make it highly probably that the harm of the act or omission will outweigh the benefit.

Yes: and. A company’s actions need to satisfy all three of those conditions. I’m not even sure how that’s possible. They have to be trying to harm you, knowingly breaking the law and, in a bizarre third clause, they also have to know there is a risk that the harm to you will outweigh the benefits to them. How you are supposed to weigh the harm to individuals whose private data is handed to the government, versus the benefits to cybersecurity services who improve their networks with data, is beyond me. But no matter how you slice it, this is an insanely onerous definition of willful misconduct that makes it essentially impossible to ever sue a company for wrongly sharing data under CISPA.

Overall, despite the progress made on the definition of cybersecurity, CISPA is still a highly problematic bill which still doesn’t properly safeguard people’s privacy. One of the biggest problems—the fact that the government can use, retain and affirmatively search the information they gather for vaguely defined “national security” purposes—is untouched in the new draft. There are some attempts to alter the rules on how federal agencies can share information between themselves, but many of those changes seem essentially meaningless. It’s good to see some reaction from Congress, but if CISPA is to be fixed (a prospect I’m still dubious about) there is still a long way to go.

Filed Under: cispa, cybersecurity, house intelligence committee, liability