No Good Can Come Of Any Cybersecurity Bill Without A Clear Definition Of The Problem

Legal Issues

from the putting-the-cybercart-before-the-horse dept

With CISPA dead (mercifully) from a critical case of Senate disinterest, the conversation has inevitably turned to what the next cybersecurity bill should look like. Over at Wired, Julian Sanchez has laid out some guidelines for a cybersecurity bill that actually works, achieving the stated goals of CISPA without butchering civil liberties. His key point is that, according to CISPA’s authors, the bill’s sole purpose is to let companies and the government share technical data (or as Dutch Ruppersberger adorably called it last year, “formulas, Xs and Os, the virus code”) to help shore up network security and anticipate major attacks — and there’s no real reason that has to conflict with privacy at all.

Few object to what technology companies and the government say they want to do in practice: pool data about the activity patterns of hacker-controlled “botnets,” or the digital signatures of new viruses and other malware. This information poses few risks to the privacy of ordinary users. Yet CISPA didn’t authorize only this kind of narrowly limited information sharing. Instead, it gave companies blanket immunity for feeding the government vaguely-defined “threat indicators” — anything from users’ online habits to the contents of private e-mails — creating a broad loophole in all federal and state privacy laws and even in private contracts and user agreements.

…

There’s no need to share [personally identifiable] data for security purposes anyway: Kevin Mandia, head of the cybersecurity firm Mandiant, insisted at a February hearing on CISPA that in 20 years in the industry, he had “never seen a package of threat intelligence that’s actionable” that included personally identifiable information.

Sanchez suggests some straightforward basic requirements for a cybersecurity bill that might actually get consensus from privacy watchdogs and the broader public: the removal of personal information before data reaches the government, a limited lifespan on the data (CISPA’s authors have stated that real-time information sharing to deal with immediate threats is the key point of the bill anyway), and the ability for companies to respect their contracts with customers. As written, CISPA would have exonerated service providers from keeping any promise they made to not share user data. Even a service provider that wanted to offer you the contractual certainty that they would protect your data would have been unable to do so.

The reason for that is a key piece of language that’s been drifting around CISPA since the beginning: “notwithstanding any other provision of law.” There are lots of bits and pieces to the bill, but that line is the exemption granted to companies that wish to share cyber threat information with the government, and it’s incredibly broad, allowing companies to ignore even the contracts they have with their customers.

So why is it there? That’s the question nobody seems to want to answer, and that’s the real issue with the whole push for cybersecurity legislation. Supposedly, according to the message that has accompanied CISPA and similar bills from the beginning, companies and the government are currently prevented from doing some harmless, common-sense information sharing to improve network security, because existing laws block such sharing. But… what laws? That has never been clear. Why does CISPA need to provide immunity “notwithstanding any other provision of law” rather than simply creating specific exceptions to the specific laws that are causing a problem? Why has nobody in Congress even been able to point out these problematic laws?

Perhaps it’s not just one or two laws; perhaps it’s a whole cluttered legal framework that can’t easily be cleaned up and needs some broad, sweeping exceptions. But… nobody has made that case either. They just keep saying, non-specifically, “existing laws prevent it”. And yet we know that’s not true, at least to some degree: the FBI has had a system for sharing threat information back and forth with companies for 15 years. Why is that model not sufficient? Again, if there are reasons, nobody in Congress is offering them.

I’d like to say Sanchez’s guidelines make an excellent starting point for cybersecurity legislation, but a starting point for legislation has to be a definition of the problem it’s trying to solve, and we still don’t have that. Nevertheless, they do serve as an excellent set of rules to hold Congress to if it is really so intent on barreling forward blindly. Cybersecurity grandstanders are likely to say that such restrictions would gut the legislation. Whether that’s ignorance, cognitive dissonance or a tacit admission of dishonesty I’m not sure, but the restrictions suggested by Sanchez, the EFF, the ACLU and others would do nothing to hinder CISPA’s stated and largely innocuous purpose — they would only interfere with the other much scarier potential uses that Congress insists aren’t going to happen.

The longer Congress offers only the vaguest of vague definitions of the problem it’s trying to solve, while at the same time seeming to betray even that vague definition with its response to suggested safeguards and restrictions, the harder it gets to afford them even one iota of trust on the subject of cybersecurity.

Filed Under: cispa, cybersecurity