New Draft Of CISPA Announced: Some Progress, Still Big Problems

from the it's-a-start-I-guess dept

The House Intelligence Committee has published a new draft of CISPA (pdf and embedded below), which includes the two amendments that were already approved, plus several other additions and changes. In some areas, there is genuine progress—in others, things actually seem to have gotten worse. Unfortunately, some of the biggest problems with the bill remain, and some of the new language seems to have little effect at all. Some changes I will discuss in future posts, but there are two that I wanted to look at right away:

A Narrower Definition Of Cybersecurity
This is the one clearly positive change in the bill. Previously, the definition of cybersecurity and cyber threat information was:

(A) efforts to degrade, disrupt, or destroy such system or network; or

(B) theft or misappropriation of private or government information, intellectual property, or personally identifiable information.

While the first part remains unchanged, the second part is now much narrower:

(B) efforts to gain unauthorized access to a system or network, including efforts to gain such unauthorized access to steal or misappropriate private or government information

Where the original language could be construed to include all sorts of activity that goes beyond what most people could consider “cybersecurity”, the new definition makes it clear that we are talking about unauthorized network access. Most notably, it removes the reference to “intellectual property”, which makes sense: the authors have always insisted that they were talking about the misappropriation of secret R&D by foreign entities, which is sufficiently covered by language referring to privacy and unauthorized access. Including “intellectual property” opened it up to all sorts of additional interpretations that went beyond this stated intent.

Now, there’s still reason to be a little concerned here, because the attempts to charge people for “unauthorized access” under the CFAA have been ridiculous in the past. If this language in CISPA were construed to include things like violating terms of service (as some have claimed of the CFAA language) then it would be very dangerous. However, with last week’s Ninth Circuit ruling which narrowly construed unauthorized access, legal thinking on this matter seems to be heading in the right direction. There’s still some gray area, and I think there’s still room for a much better definition of cybersecurity in CISPA (I know they want to future-proof it, but it doesn’t have to be that short and vague) but this is still a significant improvement over the previous draft.

Extremely Limited Liability For Companies
The new draft of CISPA includes a whole new section carving out the requirements for a company to be held liable if they share information improperly. Basically, a company that shares data with the government receives immunity from all existing privacy laws unless you can show that their actions caused you injury and constituted “willful misconduct”—which is very specifically defined in CISPA as an action taken:

(I) intentionally to achieve a wrongful purpose;
(II) knowingly without legal or factual justification; and
(III) in disregard of a known or obvious risk that is so great as to make it highly probably that the harm of the act or omission will outweigh the benefit.

Yes: and. A company’s actions need to satisfy all three of those conditions. I’m not even sure how that’s possible. They have to be trying to harm you, knowingly breaking the law and, in a bizarre third clause, they also have to know there is a risk that the harm to you will outweigh the benefits to them. How you are supposed to weigh the harm to individuals whose private data is handed to the government, versus the benefits to cybersecurity services who improve their networks with data, is beyond me. But no matter how you slice it, this is an insanely onerous definition of willful misconduct that makes it essentially impossible to ever sue a company for wrongly sharing data under CISPA.

Overall, despite the progress made on the definition of cybersecurity, CISPA is still a highly problematic bill which still doesn’t properly safeguard people’s privacy. One of the biggest problems—the fact that the government can use, retain and affirmatively search the information they gather for vaguely defined “national security” purposes—is untouched in the new draft. There are some attempts to alter the rules on how federal agencies can share information between themselves, but many of those changes seem essentially meaningless. It’s good to see some reaction from Congress, but if CISPA is to be fixed (a prospect I’m still dubious about) there is still a long way to go.

Filed Under: , , ,

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “New Draft Of CISPA Announced: Some Progress, Still Big Problems”

Subscribe: RSS Leave a comment
Idwal (profile) says:

Re: Re:

We need to be careful of thinking like that. That’s their tactic. Scare -> Amend -> Pass -> Ratchet

This bill passes in any form, it’s a dozen steps backward. Congress shouldn’t get any credit for passing a terrible bill instead of a disasterous one. The Congresscritters who are willing to slay these legislative beasts, however, should get elected for life.

Eric Jaffa says:

Still a bill against whistle-blowers

After a newspaper publishes a story about wrongdoing at an organization, someone can contact the journalist’s email-provider and get the emails sent to the journalist, saying that files which show the wrongdoing may have been obtained through “unauthorized access.”

Without a warrant.

Leigh Beadon (profile) says:

Re: Still a bill against whistle-blowers

That’s not really true… CISPA doesn’t work that way. Its problems exist on a broader scale to do with how the government is going to collect and mine this data, and the sort of actions it may end up supporting – but it wouldn’t be possible for the government to wield CISPA as a weapon against a single journalist like that. I can definitely see ways that CISPA could be used to stifle whisleblowing – but not in such a surgical manner, I don’t think

Anonymous Coward says:

Re: Re:

my thoughts exactly. i bet the entertainment industries will be interpreting that part in exactly the way you and i have. we all know their rules. if there is a way for a piece of text to be twisted round and used to their advantage, gaining a way to sue a person for so-called ‘copyright infringement’, the entertainment industries will do so.
if a Bill is to be introduced for specific purposes, then have the balls to state all of those specific purposes in a clear, well defined and open manner, so everyone can understand. dont wait until some poor fucker does something wrong, totally unintentionally, then crap all over him!

Rekrul says:

But no matter how you slice it, this is an insanely onerous definition of willful misconduct that makes it essentially impossible to ever sue a company for wrongly sharing data under CISPA.

That’s exactly what they were aiming for. They want it to look like they included liability, without actually including any at all.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...