CISPA Not the Right Way to Achieve Cybersecurity

Justin - Here are some of the worst provisions of #CISPA ........

CISPA 1104(b)(4) gives complete civil and criminal immunity to private corporations (and their "officers, employees, and agents") for their "good faith" decisions "based on cyber threat information identified, obtained, or shared under [CISPA]."

So let's see, here are some ways this statute might work:

Hypothetical #1: (intended consequences)

NSA obtains information on an ISP address they claim is associated with the hacker group Anonymous. However, the information does not give them probable cause needed to obtain a search warrant of any person or location. So, NSA agent approaches a public utility, let's say power, and says "we believe this ISP address is affiliated with a cyber security threat, can you please tell us the name of the person who's on the bill for the utility services at the physical address affiliated with the ISP?"

Even if the public utility would be breaking the law by disclosing that information without a search warrant, CISPA immunizes that company and its agents from any liability if it makes that disclosure in "good faith."

Hypothetical #2: (unintended consequences)

Now, let's say, that the public utility is a cell phone company, and the NSA has information that a cell phone subscribed to AT&T is part of a hacker group. So, the NSA agent approaches AT&T, and says "Here is some information showing that this cell phone is affiliated with Anonymous. Will you voluntarily let us listen to the voice mail messages, and read the text messages for this account?" However, the NSA and AT&T don't know that the number was actually written down wrong, and what they thought was the number of an Internet hacker, is actually your cell phone number!

Under CISPA, even if AT&T contractually promised you they would never disclose that information and even if there is a criminal statute that punishes that disclosure, AT&T and its officers, agents and employees will be immune from any criminal or civil consequence, if they allow the federal government to listen to your voicemail messages and read your text messages, as long as a judge believes they acted in "good faith."

If you can't see the problem with this scenario, let me point out a few. First, if the government asked anyone for information, and they say it's necessary for national security, how could anyone realistically prove the disclosure of that information was NOT made in good faith? Absent some contractual or legal privacy requirement, most people would give up the private information without thinking twice.

Second, let's say that the government stumbled upon voicemail messages from your brother, wherein he is telling you all about his company's upcoming merger deal. Even though cyber security was the purpose of the investigation, the NSA forwards this to SEC insider trading enforcement which then opens up a full blown investigation of you and your brother. Under CISPA, you have no legal recourse.

Bernard of CA 11:32PM April 29, 2012