President Obama To Encourage Cybersecurity Information Sharing, Highlighting Why We Don't Need CISPA

from the don't-destroy-privacy-in-the-name-of-cybersecurity dept

There's a big "White House Cybersecurity Summit" down the road at Stanford today, where the President will release the details of a new executive order promoting "a framework for sharing information about cyber threats" which the administration hopes will lead organizations to better protect their data from malicious hacks.
The new executive order encourages businesses to form "information sharing and analysis organizations," or ISAOs, which would gather data about hacking attacks and share it with companies and the government.
And, of course, a bunch of companies are going to announce that they're doing just that:
A number of companies will announce Friday that they are incorporating the administration's cybersecurity framework, which was created after a 2013 executive order, into their companies. The framework helps businesses decide how to use cybersecurity investments, ways to implement cybersecurity for new companies and measure their programs against others. Intel, Apple and Bank of America use framework and will announce that they will require all vendors to use it. Both QVC and Walgreens will say they will employ the framework in their risk management practices, while Kaiser Permanente will commit to using it as well.
Of course, if you've been following the big fights over the past few years on cybersecurity legislation, you'll know that such "information sharing" has been a key component in most of the proposed bills, none of which have become law. Most of the bills have focused on one key thing: giving companies liability protection, so that they can't be sued over the information they share. From the beginning, however, we've asked a pretty simple question that no one has answered: what is currently preventing companies from sharing such threat information?

The answer, as reinforced by this move today by the White House, is absolutely nothing. Companies can (and in some cases already do) share "threat" information, and having them do so in a more organized fashion to prevent malicious attacks is, in fact, a good idea. What's not needed is a law that basically gives blanket immunity for companies to share almost any information to any government agency. That's been the problem with CISPA, CISA and similar bills: they're not about truly making information sharing about threats easier, since that can be done already. They're about giving blanket cover for companies to share even more information with government agencies such as the NSA.

With this new executive order and companies adopting the suggested framework, many of the "benefits" backers of cybersecurity legislation talk about will happen without the need for any new legislation. True threat information can be shared and companies can get wiser about protecting their information. But it doesn't give them blanket immunity if they start handing over other information to the government for other purposes, such as surveillance. That's important.

Yes, working together to prevent the growing number of online attacks is important. But that should never be used as a backdoor process to enable greater surveillance. Doing it this way, rather than by passing a questionable law, seems like a much more reasonable first step.
Hide this

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.

Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.

While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

Filed Under: cisa, cispa, cybersecurity, cybersecurity summit, cyberthreat information, dhs, executive order, information sharing, obama administration, president obama, white house

Reader Comments

Subscribe: RSS

View by: Thread

  • icon
    That One Guy (profile), 13 Feb 2015 @ 9:16am

    It'll be interesting to see how the supporters of the CISPA-type bills will react to this. After all, if companies are already sharing threat information, then that would seem to remove a pretty large chunk of the justification for the bill(s) they're pushing.

    Of course I hardly expect honesty from the likes of those fear-mongers, so really the question is how they'll change their 'the terrorists are going to get us all!' scare tactics after something like this.

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 13 Feb 2015 @ 9:55am

    The irony, I just signed up for FaceBook's ThreatExchange: link
    I'm hoping it's going to be an addition to something like Emerging Threats' GPL database with an API to submit new hacks, malware, et al as they come in. Something that's much more practical than just saying there's something new out there like the Senator's would like.

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 13 Feb 2015 @ 10:02am

    I hope EFF or ACLU sue these companies as soon as they seem them violate the 4th amendment right of their users in any way.

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 13 Feb 2015 @ 12:39pm

    They need to specify EXACTLY what information is shared........since this is a hack threat, exploits would be one of those definitions, information belonging to an individual would not

    Im curious about the details to this, i like the idea of what is being said, its just i dont know, if what is being said is actually what is being proposed.......once shy, twice burnt

    What i like, or what appears to be being said, a recognition that DEFENSIVE security is in the, for lack of a better description, in the limelight........and more devs might actually start taking this into account when programming

    reply to this | link to this | view in chronology ]

    • icon
      John Fenderson (profile), 13 Feb 2015 @ 12:51pm


      Yes. Also, if any data is shared that came from or is about their users, then the affected users should be notified. And there should be no liability shield.

      reply to this | link to this | view in chronology ]

      • identicon
        Anonymous Coward, 13 Feb 2015 @ 1:59pm

        Re: Re:

        It's more about who watches the watchman, imho.

        While a rule like
        #by stillsecure
        alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Campsite article_id Parameter UNION SELECT SQL Injection Attempt"; flow:established,to_server; content:"GET"; http_method; content:"/plugins/campsiteattachment/attachments.php?"; nocase; http_uri; content:"article_id="; nocase; http_uri; content:"UNION"; nocase; http_uri; content:"SELECT"; nocase; http_uri; pcre:"/UNION.+SELECT/Ui"; reference:url,; reference:url,; classtype:web-application-attack; sid:2011217; rev:5;)

        is great to catch people trying to take out your database on a web server, but if I'm pen testing my dedicated server and set off this alert than that was the whole point. Are responsible netizens now going to be punished for improving security? The government already tries to throw the book on whitehat's, so I have a hard time justifying their involvement other than as another bystander in an open database of publicly available information.

        reply to this | link to this | view in chronology ]

        • icon
          John Fenderson (profile), 13 Feb 2015 @ 2:18pm

          Re: Re: Re:

          "It's more about who watches the watchman, imho"

          And the more power the watchman has, the more important this becomes. But make no mistake, "watching the watchers" is really just a fallback defensive position. It would be better if the watchers were much more restricted in what they can watch.

          However, as I've said before, if we're going to have ubiquitous surveillance (as current seems to be the case), then it really needs to be an omnopticon rather than a panopticon.

          reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 13 Feb 2015 @ 4:51pm

    how about we wait and see what he actually says instead of believing what he says he will say

    reply to this | link to this | view in chronology ]

  • icon
    Seegras (profile), 14 Feb 2015 @ 2:28am

    paradigm shift

    Unless the mission is

    Eliminate all vulnerabilities, making everyone more secure

    and not

    Hoard or produce vulnerabilities to attack adversaries, making EVERYONE less secure

    Nobody is going to trust these agencies. They won't even trust each other, because this second case means agencies like the NSA is deliberately putting others like the DOA or the DEA or even the DOD at risk. Since the more people know (and need to know) details of these issues, they will inevitably leak, making them useless to attack anyone.

    So it's pretty much a given the NSA won't tell the companies managing the power grid, since then the information would basically be public. And of course with not telling them, they put the power grid at risk.

    Unless there's a paradigm shift within these agencies, NOBODY can trust them.

    reply to this | link to this | view in chronology ]

Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here

Subscribe to the Techdirt Daily newsletter

Comment Options:

  • Use markdown. Use plain text.
  • Remember name/email/url (set a cookie)


Add A Reply

Have a Techdirt Account? Sign in now. Want one? Register here

Subscribe to the Techdirt Daily newsletter

Comment Options:

  • Use markdown. Use plain text.
  • Remember name/email/url (set a cookie)

Follow Techdirt
Special Affiliate Offer

Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Chat
Recent Stories

This site, like most other sites on the web, uses cookies. For more information, see our privacy policy. Got it

Email This

This feature is only available to registered users. Register or sign in to use it.