What We Now Know

As you know Chris Hayes will be hosting a new MSNBC show beginning April 1 at 8 PM EDT that he promises will be the same format as Up. Up’s new host Steve Carnacki takes over as the Saturday and Sunday host of the new “Up with Steve Carnacki” on April 13. This Sunday and next the best segments of the last two years will be aired.

Before his January suicide, Aaron Swartz was a leader in the fight against the Stop Online Piracy Act, or SOPA.  The groups with which Swartz worked-Demand Progress, the Electronic Frontier Foundation, and many others-continue to fight for information transparency and reforms to the laws currently used to prosecute individuals for alleged crimes committed online.

Swartz’ death shifted debate from piracy and regulation to the Computer Fraud and Abuse Act and the government’s attitude towards what it deems cybercrime, and hackers continue to be arrested and prosecuted. On March 26, the Justice Department announced that it had arrested a Wisconsin man for his alleged involvement in a Dedicated Denial of Service attack on two websites owned by Koch Industries. This arrest comes only a week after another hacker, Andrew Auernheimer, was sentenced to more than three years in prison for exposing a security hole in AT&T’s iPad user database.

Cases like these and actions like those of Operation KnightSec, the group of hackers who leaked information about the Steubenville rape investigation are sure to become more common, which means that over the issues SOPA raised will surface again.

Chris leads a debate on the controversial Stop Online Piracy Act (SOPA) with NBC Universal Executive Vice President and General council Richard Cotton; Reddit co-founder Alexis Ohanian; former Rep. Joe Sestak (D-PA); and former lobbyist Jack Abramoff.

SOPA is gone but it’s ugly twin is back. Meet the “Patriot Act of the Internet“, the Cyber Intelligence Sharing and Protection Act (CISPA) which the House is expected to vote on in mid-April:

The House is expected to vote on a set of cybersecurity-focused bills in mid-April. One of those bills would include the Cyber Intelligence Sharing and Protection Act (CISPA) by Mike Rogers (R-Mich.) and Rep. Dutch Ruppersberger (D-Md.), which is aimed at removing the legal hurdles that prevent companies from sharing information about cyber threats with the government.

The bill boasts support from a broad swath of industry sectors – including the telecommunications, banking and tech industries – but has stoked criticism from privacy and civil liberties groups.

Privacy advocates charge that CISPA lacks sufficient privacy protections for people’s personal data and would increase the pool of Americans’ electronic communications that flow to the intelligence community, including the secretive National Security Agency.

The bill passed the House last spring but went untouched in the Senate, largely because it was working on its own comprehensive measure.

CISPA’s Problem Isn’t Bad PR, It’s Bad Privacy

by  Robyn Greene, Washington Legislative Office of the ACLU

Representative Mike Rogers (R-MI) made the argument last week that the privacy community’s significant concerns with CISPA, the privacy-busting cybersecurity bill, don’t stem from actual problems with the bill language, but rather from a misunderstanding of the bill itself. Speaking on behalf of himself and his co-sponsor, Representative Dutch Ruppersberger (D-MD), he told The Hill, “We feel that the bill clearly deals with privacy, that the checks and balances are there, but [we] know there’s still a perception and we’re still trying to deal with that.”  

The ACLU, along with a coalition of 41 privacy and civil liberties groups, are very concerned about the real-world impact that the authorities proposed in CISPA could have on Americans’ privacy and civil liberties. President Obama, along with top administration officials including Department of Homeland Security Secretary Janet Napolitano, have echoed many of our concerns. CISPA, in its current form (pdf):    

• Creates an exception to all privacy laws to allow companies to share our personal information, including internet records and the content of emails, with the government and other companies, for cybersecurity purposes;
• Permits our private information to be shared with any government agency, like the NSA or the Department of Defense ‘s Cyber Command;
• Fails to require the protection of Americans’ personally identifiable information (PII), despite repeated statements by the private sector that it doesn’t want or need to share PII;
• Once shared with the government, allows our information to be used for non-cybersecurity “national security” purposes – an overbroad “catch-all” phrase that can mean almost anything;
• Immunizes companies from criminal or civil liability, even after an egregious breach of privacy;
• Fails to implement adequate transparency and oversight mechanisms.

In a recent article in Wired, Chris Finan, former White House director for cybersecurity, urged Congress to fix CISPA by amending the bill so as to require companies to strip their customers’ PII before sharing it with the government; restrict information sharing to civilian agencies; restrict the further dissemination and use of information to cybersecurity purposes; place reasonable limits on companies’ liability protections; and establish a non-profit to act as an “independent ‘watchdog'”  over any information sharing program to enhance oversight and transparency.

It will would be great if Congress amended CISPA to address all of our privacy concerns, but it’s hard to hold out hope for sufficient changes so long as its chief sponsor thinks that it doesn’t have a privacy problem so much as a PR problem. Everyone, from the privacy community to the president, agrees that CISPA is bad on privacy – the problem isn’t our perception.

For Aaron and for us.