Did CISPA Actually Get Better Before Passing? Not Really

Privacy

from the depends-on-how-you-define-"better" dept

Yesterday, after I asserted that CISPA had gotten much worse before it was passed in a rushed vote, I heard from several people (even those in the anti-CISPA camp) who took the opposite position. They feel that, while CISPA is still a highly problematic bill, the Quayle amendment which I roundly criticized actually represented a significant last-minute improvement to the text. I still don’t see it that way, for reasons I explain below, but they did make an important point that is worth calling attention to.

Basically, under their reading of the previous text, it allowed the government to use the data for any non-regulatory purpose as long as it has one cybersecurity or national security purpose. I hadn’t initially read it that way but I completely agree, and that is indeed a troublesome wild card to hand to the government. The amendment removed the broad “any lawful purpose” language, replacing it with the list of five specific uses (cybersecurity, cyber crime, protecting people from harm, protecting children from exploitation, and national security), thus closing that gaping hole in the bill. In that sense, it’s a good amendment.

But, does it really improve CISPA? That depends on how you look at it. CISPA is supposed to be a “cybersecurity” bill, and both its supporters and its opponents in Congress have repeatedly stated that cybersecurity means protecting networks and systems from disruption, hacking and malicious code—primarily coming from overseas. Even during yesterday’s debate, virtually every representative who spoke opened with a speech on this topic, and Ruppersberger himself insisted that CISPA’s sole purpose was allowing companies and the government to share “formulas, Xs and Os, the virus code”. (I’m pretty sure he meant “1s and 0s”, but what do you expect from someone who doesn’t understand the thing he’s trying to legislate?)

Now, critics of the bill have of course been saying all along that it could be used for things way beyond this stated cybersecurity purpose. But the response from supporters has been consistent: no, it can’t, and even if it can, it won’t be. [Insert another impassioned speech about the cyber-threat from China.] Then, suddenly, only a few minutes before the final vote, the representatives near-unanimously amend CISPA to include these brand new targets of bodily harm and child exploitation, which have nothing to do with cybersecurity and which have rarely if ever been mentioned in relation to the bill.

Basically, the amendment closes a loophole but opens a door. It takes away some of the language that allows overreach of the bill, but then explicitly endorses the exact things people were worried the government would do with that language—as in, start using the data to investigate and build cases against American citizens without regard for the laws that would normally protect their privacy.

Is that an improvement? CISPA would now grant the government less vague power, which is good, but would also grant it brand new specific powers, which is bad and frankly pretty insulting. Because, if this is indeed an improvement and a narrowing of the government’s power, how are we to take that if not as a confession that virtually every representative has been baldly lying this whole time? They have said over and over again that they don’t want or plan to use the bill for anything except shoring up network security, but we’re supposed to see the addition of these brand new applications as limiting CISPA’s target? To me, that sounds like they’re saying: “Okay, you got us—we really wanted to secretly do all this other stuff. As long as you still let us do that, we’ll change the bill.”

So the way I see it, there are two ways to look at the Quayle amendment: either it made the bill worse, by massively expanding its stated purpose to whole new areas of the law such that it can no longer accurately be called a “cybersecurity” bill at all, or else it made the bill better by codifying the ways it can be abused for non-cybersecurity purposes.

Of course, it’s not as though everyone trusted what supporters were saying about the bill’s purpose before. We all knew it would be used for these other things. But simply getting them to admit that is not really progress. It’s accurate to say that the amendment has limited the government’s power under CISPA by changing the language, but it’s also ludicrous to say that turning a cybersecurity/national-security bill into a cybersecurity/cybercrime/violent-crime/child-exploitation/national-security bill at the last minute represents narrowing or improving it. In fact, the only way that’s an improvement is if the representatives are admitting that they were planning on it being used for even more unstated purposes all along, but are now content with choosing only a few of the things they have repeatedly denied they wanted. I see how that can be framed as progress, but it’s not exactly something that the House deserves any praise for.

Filed Under: cispa, congress, cybersecurity