It's really looking like the cybersecurity legislation fight for 2013 is merely a remake of the 2012 edition. First, the House passes CISPA in April, despite widespread privacy concerns (and CISPA's backers pretending they've taken care of them). Then, the Senate goes in a totally different direction with a bigger, more complex cybersecurity bill (last year there were multiple versions before the compromise Cybersecurity Act became the bill of choice) that at least (eventually, with amendments) is a little more conscious of privacy issues, but which then fails to pass the Senate because the Chamber of Commerce freaks out about "something something regulations." And, then cybersecurity regulations, CISPA and all, die out until the following year. At least the first part of that, with CISPA happened both years, and now the Senate has made clear that it's going in its own direction again in part because it feels that CISPA does not do enough to protect privacy (whether or not that's the real reason is left open to speculation). Who knows if the rest of the script will play out the same, or if the sequel will have some plot-defying twists. Either way, it seems pretty clear that CISPA, as written, is officially stalled out. And that's a good thing, though we'll be paying close attention to what comes out of the Senate in the months ahead.

Want to know one reason why the feds are so interested in giving blanket immunity to anyone who helps them spy on people? Perhaps because they're already telling companies that they have immunity if they help them spy on people. Specifically, they've issued special letters of immunity, more or less helping companies like AT&T ignore the Wiretap Act.

Senior Obama administration officials have secretly authorized the interception of communications carried on portions of networks operated by AT&T and other Internet service providers, a practice that might otherwise be illegal under federal wiretapping laws.

The secret legal authorization from the Justice Department originally applied to a cybersecurity pilot project in which the military monitored defense contractors' Internet links. Since then, however, the program has been expanded by President Obama to cover all critical infrastructure sectors including energy, healthcare, and finance starting June 12.

Basically, the Justice Department, at the urging of the NSA, went to various telcos and ISPs and issued secret letters which told them that if they violated the Wiretap Act, the DOJ promised them it would not prosecute. Not surprisingly, this kind of thing is not what you would generally consider legal. However, after CISPA... it would likely be more protected:

A report (PDF) published last month by the Congressional Research Service, a non-partisan arm of Congress, says the executive branch likely does not have the legal authority to authorize more widespread monitoring of communications unless Congress rewrites the law. "Such an executive action would contravene current federal laws protecting electronic communications," the report says.

Because it overrides all federal and state privacy laws, including the Wiretap Act, legislation called CISPA would formally authorize the program without the government resorting to 2511 letters. In other words, if CISPA, which the U.S. House of Representatives approved last week, becomes law, any data-sharing program would be placed on a solid legal footing. AT&T, Verizon, and wireless and cable providers have all written letters endorsing CISPA.

Apparently, the DOJ knew how problematic this was, and the CEOs of the various ISPs had indicated how worried they were about this program, but it still went forward. In secret, of course. Until now.

Suddenly the emphasis on getting CISPA approved, and the attempts to frighten everyone with scare stories of what will happen without it, make a bit more sense...

In case you were wondering why so many Democrats switched sides during the most recent CISPA vote, the answer is exactly what you think it is: $$$. And lots of it. Last year's CISPA vote only managed to secure 40 Democrat supporters. This time around, the number leapt to 92.

[A] new coalition of special interests, which include America's two largest cellular service providers AT&T, Inc. and Verizon Wireless -- jointly owned by Verizon Communications Inc. and Vodafone Group Plc. -- as well as two of the nation's largest software firms Microsoft Corp. and Intel Corp., came together to create a similar data grab bill (Microsoft has since renounced its support). Security firms like Symantec Corp. also backed the bill.

Pushing the bill through was $84M USD in funding from special interest backers.

$84 million is change-of-heart money, although one imagines those contributing checked and double-checked their "sponsored" representatives to make sure they were all on the same page. As DailyTech points out, nearly $86 million went into the SOPA push and most of that turned out to be wasted money.

Last Monday, two hundred IBM executives visited the White House to make a last minute push for CISPA. Whatever they said or did must have been very persuasive. By the end of the day, 36 new sponsors had signed on to the bill, up from a very lonely two previous to IBM's visit. Unsurprisingly, financial motivation was involved, according to numbers gathered by Maplight.

New co-sponsors have received 38 times as much money ($7,626,081) from interests supporting CISPA than from interests opposing ($200,362).

Members of the House in total have received 16 times as much money ($67,665,694) from interests supporting CISPA than from interests opposing ($4,164,596).

Now, it's up to Senate to come up with some sort of cyber-security bill that has a chance to get passed and dodge a Presidential veto. Fortunately, there's no clear favorite at the moment (although Lieberman's bill seems to have the President's blessing) and with the limited number of voters, the Senate is much more prone to be gridlocked by partisan politics. Of course, a daylong visit by a few lobbyists could win over just enough hearts and minds to be dangerous. In the meantime, it would probably do these senators a world of good to hear from their constituents, if only to remind them that there are plenty of actual people out there who have to live with the consequences of bad legislation.

This is not wholly surprising, but after some debate and some half-hearted attempts at pretending they care about the public's privacy rights, the House has passed CISPA, 288 votes against 127. The vote breakdown did not go fully along party lines, though it was clearly Republican driven. 196 Republicans voted for it, while just 29 voted against it (despite numerous conservative groups coming out against the bill). The Democrats split down the middle. 92 Dems voted for it and 98 against. If you compare this to last year, it looks like a lot more Democrats went from opposing to being in favor of trampling your privacy rights. Last year, 140 Dems voted against CISPA and only 42 for it. Either way, this seems like a pretty bi-partisan decision to shaft the American public on their privacy rights. That said, there is still the threat of a Presidential veto (though, with the vote today, the House is close to being able to override a veto). The bigger question is now the Senate, which couldn't agree on a cybersecurity bill last year, and has shown no signs of improvement this year. If you want to protect your privacy, it's time to focus on the Senate, and make sure they know not to pass a privacy-destroying bill like CISPA.

It would appear that Rep. Mike Rogers, the main person in Congress pushing for CISPA, has kept rather quiet about a very direct conflict of interest that calls into serious question the entire bill. It would appear that Rogers' wife stands to benefit quite a lot from the passage of CISPA, and has helped in the push to get the bill passed. It's somewhat amazing that no one has really covered this part of the story, but it highlights, yet again, the kind of activities by folks in Congress that make the public trust Congress less and less.

It has seemed quite strange to see how strongly Rogers has been fighting for CISPA, refusing to even acknowledge the seriousness of the privacy concerns. At other times, he can't even keep his own story straight about whether or not CISPA is about giving information to the NSA (hint: it is). And then there was the recent ridiculousness with him insisting that the only opposition to CISPA came from 14-year-old kids in their basement. Wrong and insulting.

Of course, as we've noted all along, all attempts at cybersecurity legislation have always been about money. Mainly, money to big defense contractors aiming to provide the government with lots of very expensive "solutions" to the cybersecurity "problem" -- a problem that still has not been adequately defined beyond fake scare stories. Just last month, Rogers accidentally tweeted (and then deleted) a story about how CISPA supporters, like himself, had received 15 times more money from pro-CISPA group that the opposition had received from anti-CISPA groups.

So it seems rather interesting to note that Rogers' wife, Kristi Clemens Rogers, was, until recently, the president and CEO of Aegis LLC a "security" defense contractor company, whom she helped to secure a $10 billion (with a b) contract with the State Department. The company describes itself as "a leading private security company, provides government and corporate clients with a full spectrum of intelligence-led, culturally-sensitive security solutions to operational and development challenges around the world."

Hmm. Sounds like a company like that would benefit greatly to seeing a big ramp up in cybersecurity FUD around the globe, and, with it, big budgets by various government agencies to spend on such things. Indeed, just a few months ago, Rogers penned an article for Washington Life Magazine all about evil hackers trying to "steal information." In it, there's a line that might sound a wee-bit familiar, referring to the impression of hackers as being "the teenager in his or her parent's basement with bunny slippers and a Mountain Dew." Apparently, both of the Rogers really have a thing about teens in basements. The article is typical FUD, making statements with no proof, including repeating the NSA's ridiculous allegation that hackers have led to the "greatest transfer of wealth in American history." It's such a good line, except that it's completely untrue. The top US companies have recently admitted to absolutely no damage from such attacks. The article also lumps in "hacktivists" like Anonymous, as if they're a part of this grand conspiracy that needs new laws.

Tellingly, in the print version of Washington Life that this article appeared in, which you can see embedded below, you'll note that there's a side bar right next to her article about the importance of passing cybersecurity legislation in Congress. Guess what's not mentioned anywhere at all? The fact that Kristi Rogers, author of the fear-mongering article, happens to be married to Rep. Mike Rogers, the guy in charge of pushing through cybersecurity legislation. That sure seems like a rather key point, and a major conflict of interest that neither seemed interested in disclosing. Oh, and Kristi Rogers recently changed jobs as well, such that she's now the "managing director of federal government affairs and public policies" at Manatt a big lobbying firm, where (surprise, surprise) she's apparently focused on "executive-level problem solving in the defense and homeland security sectors." I'm sure having CISPA in place will suddenly create plenty of demand for such problem solving.

A few months ago, on one of his FUD-filled talks about why we need cybersecurity, Rogers claimed that it was all so scary that he literally couldn't sleep at night until CISPA was passed due to an "unusual source" threatening us. The whole statement seemed odd, until you realize that his statement came out at basically the same time as his wife's fear-mongering article about cybersecurity. I guess when your pillow talk is made up boogeyman stories about threats that don't actually exist, it might make it difficult to fall asleep.

Either way, even if we assume that everything here was done aboveboard -- and we're not suggesting it wasn't -- this is exactly the kind of situation that Larry Lessig has referred to as soft corruption. It's not bags of money shifting hands, but it appears highly questionable to the public, leading the public to trust Congress a lot less. At the very least, in discussing all of this stuff, when Mrs. Rogers is writing articles that help the push for CISPA, it seems only fair to disclose that she's married to the guy pushing for the bill. And when Mr. Rogers is pushing for the bill, it seems only right to disclose that his wife almost certainly would benefit from the bill passing. And yet, that doesn't seem to have happened... anywhere.

Update: It has become a little unclear what the status of this amendment is now. Yesterday we heard that it had passed, but now it seems to have been changed, and it's back up for debate on the floor. We'll get you more updates on whether or not it goes through, and the latest changes, as soon as we can.

In the latest round of changes to CISPA, the House passed a new amendment that supposedly (according to CISPA supporters) addresses the privacy and civil liberty concerns about the bill. The amendment (pdf and embedded below) ostensibly establishes civilian agency control (through Homeland Security) over information shared under CISPA, since many people are reasonably worried about all this data ending up in the hands of the NSA. Unfortunately, as the EFF determined in their initial analysis, it doesn't really change anything—it just lets the DHS go along for the ride:

The amendment in question does not strike or amend the part of CISPA that actually deals with data flowing from companies to other entitities, including the federal government. The bill still says that: “Notwithstanding any other provision of law, a self-protected entity may, for cybersecurity purposes...share such cyber threat information with any other entity, including the Federal Government." The liability immunity provisions also remain.

While this amendment does change a few things about how that information is treated within the government, it does not amend the primary sharing section of the bill and thus would not prevent companies from sharing data directly with military intelligence agencies like the National Security Agency if they so choose.

Indeed, the text of the amendment appears to create a significant role for the DHS in information sharing procedures, but gives it little power in terms of actually protecting privacy or filtering information—the amendment mandates that information still be shared with other agencies in realtime, and it still appears to allow companies and organizations to bypass the DHS entirely.

A portion of the amendment outlines certain privacy guidelines, but they are the same as those we discussed before: filled with enough release valves and escape routes to render them virtually meaningless, closer to a list of "best practices" than actual rules. The fact is that, despite what the bill's supporters and some of the media reporting on it would have you believe, the core problems with CISPA have not been addressed, nor have any of the "efforts" in that direction amounted to much more than a smokescreen. With a final CISPA vote looming at any time, it's never been more important to voice your opposition to the bill.

One of the key things we've seen in the pushback on CISPA is that its backers insist that people arguing against it don't really understand how the bill works, and that it does protect privacy. CISPA sponsor Rep. Mike Rogers himself took to Twitter this morning to tell the EFF that it's misreading his bill. But, of course, as we've seen, it seems that Rogers himself is the one being misleading when it comes to privacy. If he truly believed in privacy protections, he would have supported a variety of straightforward amendments that made it clear how privacy could be protected. But he didn't. Instead, he clearly left it open for abuse.

One of the key points that Rogers keeps saying over and over again is that this bill is not a "surveillance" bill. Why? Because it doesn't allow the NSA or others to go in and automatically get info. But Rogers is choosing his words very carefully, such that he absolutely misrepresents how the bill can and almost certainly will be used. And while he and other CISPA supporters will (and have) argued that the possible abuses of CISPA are crazy conspiracy theories that wouldn't happen in practice, we have too many examples of how the US government's intelligence infrastructure very quickly expands to make use of every single loophole provided to them within the law -- sometimes going so far as to interpret laws in ways clearly contrary to Congressional intent, just because they can. Let's just highlight two examples:

1. The FISA Amendments Act, which was passed in association with the Patriot Act, supposedly to give the NSA more powers to scoop up communications of folks involved in terrorist activity. Now, the NSA is -- by mandate -- not allowed to spy on Americans. And yet, multiple whistleblowers and hints from folks who know in Congress have made it quite clear that the NSA has interpreted the FISA Amendments Act to allow exactly that -- even as many in Congress clearly don't understand how the bill is being used.
   
   While it's still not official, enough information has been revealed to show that the NSA interprets the requirement that its surveillance target foreign persons to mean that as long as it's looking for foreign terrorist activity, it can spy on everyone. Get that? It's a sneaky trick that many have not realized. The NSA argues -- likely with agreement from a secret court ruling -- that so long as it can claim that it is investigating a foreign threat somewhere, somehow, the prohibition on spying on Americans does not apply. There is increasing evidence that this now means that the NSA is scooping up pretty much all data it can get its hands on. While it may not be going through it in real time, it appears to believe that as long as it can make the argument that it's searching for a foreign threat, that it can delve into that treasure chest of, well, everything.
   
   
2. Next: the "national security letters" (NSL) issue. While a court recently ruled these unconstitutional, this process has been widely abused by the FBI for years to get private information on people without a warrant and with a gag order on recipients. Every time it's been investigated, it's been shown that the FBI has widely abused its NSL powers. However, since there's almost no oversight, the FBI still feels free to make widespread use of the tool, which was only supposed to be used in extreme circumstances.
   
   Along those lines, the FBI has gotten so comfortable with asking companies for data without a warrant or any formal oversight process, that it was revealed a few years ago that, rather than going through the drudge of actually processing paperwork to get private info from AT&T, some agents simply used Post-It Notes to make their requests, which AT&T readily coughed up without question.

The point, hopefully, is clear. We've never seen law enforcement show any hint of not making use of any and all powers it has at its disposal to twist and interpret laws to allow it to get private information on people without a warrant or any real oversight. While the latest version of CISPA pays some tiny lip service to privacy, the simple fact is that, by definition, it wipes out all privacy laws in protecting companies entirely from liability for coughing up your information.

CISPA supporters also like to claim that since CISPA is "voluntary," companies will have no reason to give up your private info. That's nice in theory. And, sure, perhaps some principled companies will resist, but we've already seen the AT&T example above. And, even more importantly, we've seen how pressure from the US government, or even threats of the government shaming them publicly for not "helping" have been incredibly effective in making "voluntary" action suddenly seem obligated.

The saying goes "fool me once, shame on you. Fool me twice, shame on me." We've been fooled many times by the US government insisting that certain laws won't be used to violate our privacy, when it later comes out that they were used in exactly that way. So forgive us for calling bullshit on Mike Rogers' claims that CISPA doesn't "allow" the government to spy on Americans. It absolutely does. It opens up a clear path for law enforcement and intelligence agencies (and others!) to hide behind the liability protections within the law to pressure companies to reveal whatever they want with absolutely no repercussions.

That seems like a pretty serious issue, and one that Congress and supporters of CISPA don't seem to want to admit.

CISPA's sponsors insist the law is 100% voluntary—it doesn't compel companies to do anything. But as we've been warning for a year and warned again yesterday, the bill's blanket immunity provision doesn't merely clear a "legislative thicket" of laws restricting information-sharing about cyber threats. It also bars companies from making enforceable promises to their users about how they might share users' information with the government or other companies in the name of protecting cybersecurity. Yesterday the House Rules Committee refused to allow a bipartisan amendment, sponsored by Rep. Justin Amash to fix this problem, to be brought to the floor for a vote.

At that Committee meeting (1:01:45), the bill's chief sponsor Chairman Rogers emphatically repeated his earlier assertions that CISPA wouldn't breach private contracts in response to questions from Jared Polis:

Polis: Why wouldn't it work to leave it up, getting back to the contract part, and I think again there may be a series of amendments to do this, if a company feels, if it's voluntary for companies, why not allow them the discretion to enter into agreements with their customers that would allow them to share the information? ...

Rogers: I think those companies should make those choices on their own. They develop their own contracts. I think they should develop their own contracts. They should enforce their own contracts in the way they do now in civil law. I don't know why we want to get in that business.

And yet... CISPA will go to the House floor as written, providing an absolute immunity from "any provision of law," including private contracts and terms of service.

Only in Congress can you swear up and down that your bill doesn't do X, then refuse to amend it so that it really doesn't do X—and then lecture those who note the disconnect, like Polis, with patronizing comments like "once you understand the mechanics of the bill..." (1:02:50).

It brings to mind what Galileo said after he was forced to sign a confession recanting belief in Copernicus's heretical idea that the Earth revolves around the sun: "And yet, it moves."

And yet... for all Rogers' bluster, CISPA moots private contracts—and House Republican leadership won't fix the problem, even when five of their GOP colleagues offer a simple, elegant fix.

This is the same stubborn refusal to accept criticism and absorb new information that brought us SOPA, PIPA and a host of other ill-conceived attempts to regulate the Internet. It's the very opposite of what should be the cardinal virtue of Internet policy: humility. Tinkering with the always-changing Internet is hard work. But it's even harder when you stuff your fingers in your ears and chant "Lalalala, I can't hear you."

The good news is that, as with SOPA, this fight transcended partisan lines, uniting a Democrat like Jared Polis (an openly gay progressive from Boulder) with a strict constitutionalist like Justin Amash (the "Ron Paul Republican" from Grand Rapids Michigan)—and four more traditional Republicans. This is precisely the realignment predicted 15 years ago by Virginia Postrel in The Future and Its Enemies. On one side are those profoundly uncomfortable with change, desperate to control and plan the future, and so insecure about their own understanding of technology that they inevitably perceive criticism as a personal attack. On the other are those far more humble and more willing to let the future play out in all its messy unpredictability. The first camp is always pushing for the one, right piece of legislation that will avert a crisis. The second camp admits they don't know the one, best way to deal with a problem like encouraging sharing of cyberthreat information while protecting user privacy, so they reject static rules that can only be changed by Congress. They want simple rules for a complex world. At a minimum, they want what law Professor Richard Epstein argues in his book Simple Rules for a Complex World--the perfect slogan for this camp--"the most ubiquitous legal safety hatch adds three words to the formal statement of any rule: unless otherwise agreed."

It's not a battle between Left and Right, or conservatives and progressives. It's a battle between attitudes towards the future: the stasis mentality of Congressmen like Mike Rogers and Lamar Smith (of SOPA infamy) and the dynamism of Justin Amash and Jared Polis, and SOPA foes like Republicans Darrell Issa and Jason Chaffetz and Democrats Ron Wyden and Zoe Lofgren.

The dynamists may have lost this battle. But, like Galileo, we'll eventually win the war. The only questions are: How many more poorly crafted, one-size-fits-all laws will the stasists put on the books in the meantime? How long it will take to clear the real "legislative thicket"--all the complex laws that attempt to provide a single answer for a complex and unknowable future? And when will it finally become unacceptable for Congressmen like Mike Rogers to ram through legislation that doesn't even do what they claim?

Berin Szoka (@BerinSzoka) is President of TechFreedom (@TechFreedom), a dynamist tech policy think tank.

The US government is already fighting wars on several fronts, including the perpetual War on Terror. "War is the health of the state," as Randolph Bourne stated, and the state has never been healthier, using this variety of opponents as excuses to increase surveillance, curtail rights and expand power.

Bruce Schneier highlights a piece written by Molly Sauter for the Atlantic which poses the question, "If hackers didn't exist, would the government have to invent them?" The government certainly seems to need some sort of existential hacker threat in order to justify more broadly/badly written laws (on top of the outdated and overbroad CFAA). But the government's portrayal of hackers as "malicious, adolescent techno-wizards, willing and able to do great harm to innocent civilians and society at large," is largely false. If teen techno-wizards aren't taking down site after site, how is all this personal information ending up in hackers' hands? Plain old human carelessness.

According to the Privacy Rights Clearinghouse, the loss or improper disposal of paper records, portable devices like laptops or memory sticks, and desktop computers have accounted for more than 1,400 data-breach incidents since 2005 -- almost half of all the incidents reported. More than 180,000,000 individual records were compromised in these breaches...

By comparison, only 631 breaches were attributed to actual hacking, or at least hacking as it's portrayed by the government. Private entities aren't very worried about being hacked either, at least not from the outside. Their main concern, according to the Privacy Rights Clearinghouse, is "inside jobs" by disgruntled employees.

Nonetheless, the narrative advanced by the government (and passed along by the largely credulous mainstream media) of unstoppable hackers and their omnipresent threat to major companies, the government itself, average Americans and underlying infrastructure, continues nearly unimpeded. This narrative is essential to those in the government who wish to justify large-scale surveillance of anything and anyone connected to the internet. The scarier the image, the more it can get away with.

It is the hacker -- a sort of modern folk devil who personifies our anxieties about technology -- who gets all the attention. The result is a set of increasingly paranoid and restrictive laws and regulations affecting our abilities to communicate freely and privately online, to use and control our own technology, and which puts users at risk for overzealous prosecutions and invasive electronic search and seizure practices. The Computer Fraud and Abuse Act, the cornerstone of domestic computer-crime legislation, is overly broad and poorly defined. Since its passage in 1986, it has created a pile of confused caselaw and overzealous prosecutions.

We've seen the overzealous prosecution and expressed disbelief and amazement at some of the interpretations of this outdated law. (Amazingly, Sauter's post was written before the most recent cases of overzealous prosecution.) And instead of fixing the CFAA, legislators are actively working to make it worse, even as overly-broad cybersecurity legislation is being negotiated in secret.

The "modern folk devil" image has become part of the mass consciousness. Anonymous and its various offshoots roam the internet, at turns wreaking havoc and helping the oppressed, like an electronic manifestation of Loki, the Distributed. These activities are duly reported by the media in ominous tones, further driving home the image of the hacker at Millennial Public Enemy No. 1. The acts and the perception of the damage caused by this hacking are miles apart, as is perfectly illustrated by xkcd.

Many members of the American public are already convinced something should be done about hackers. Many of our representatives feel the same way. A lack of knowledge of the underlying technology, much less the methods or culture, hasn't deterred legislators from crafting an overbroad response with the CISPA bill. Examining the issues more closely or reconsidering the legislation doesn't seem to be an option. After all, a "cyber Pearl Harbor" is all but inevitable, a conclusion confirmed by shouting "HACKER!" in the halls of Congress and hearing it echoed back by like-minded representatives, sympathetich government agencies, the media and a subset of the American public.

In the effort to protect society and the state from the ravages of this imagined hacker, the US government has adopted overbroad, vaguely worded laws and regulations which severely undermine internet freedom and threaten the Internet's role as a place of political and creative expression.

The endgame is more control, and the "hacker" provides an ominous, omnipresent threat that, because of the hacker's naturally secretive nature, can neither be confirmed or denied with any veracity. Much like the War on Terror, this War on Hacking takes rights from the American public, carves out huge chunks and sends the gutted remains back to citizens in a package marked "Safety."

We just noted how Rep. Mike Rogers, the sponsor for the CISPA cybersecurity bill that wipes out a variety of privacy protections for companies handing private info to the government had told the House Rules Committee that the only real opposition was 14-year-olds in their basement. It seems that many opponents to CISPA think Rogers is ignorant. A campaign quickly went viral on Twitter in which people are tweeting at Rep. Rogers' account about how they're not 14, not in their basement, but still very much opposed to CISPA. In just an hour or so, there have been well over 1,500 tweets, and the number keeps growing rapidly. By the time this post is edited and live, it will almost certainly be well over 2,000 and growing.
Those are just two quick screenshots showing some of the top complaints. That's not me pulling out a few, those were just the most recent ones and new ones keep piling up.

Perhaps Congressman Mike Rogers might want to rethink his assessment of the opposition and recognize that maybe there are legitimate privacy concerns that he has chosen to not properly address in his bill.