GalesburgPlanet.com

By Megha Rajagopalan — ProPublica

The Cyber Intel­li­gence Sharing and Protection Act, up for debate in the House of Repre­sen­ta­tives today, has privacy activists, tech companies, security wonks and the Obama admin­is­tration all jousting about what it means – not only for security but Internet privacy and intel­lectual property. Backers expect CISPA to pass, unlike SOPA, the Stop Online Piracy Act that melted down amid contro­versy earlier this year.

Here’s a rundown on the debate and what CISPA could mean for Internet users.

What exactly is CISPA?

The act, spon­sored Rep. Mike Rogers, R-Mich., and Rep. Dutch Ruppers­berger, D-Md., would make it easier for private corpo­ra­tions and U.S. agencies, including military and intel­li­gence, to share infor­mation related to “cyber threats.” In theory, this would enable the government and companies to keep up-to-date on security risks and protect them­selves more effi­ciently. CISPA would amend the National Security Act of 1947, which currently contains no reference to cyber security. Companies wouldn’t be required to share any data. They would just be allowed to do so.

Why should I care?

CISPA could enable companies like Facebook and Twitter, as well as Internet service providers, to share your personal infor­mation with the National Security Agency and the CIA, as long as that infor­mation is deemed to pertain to a cyber threat or to national security.

How does the bill define “cyber threat”?

The bill itself defines it as infor­mation “pertaining to a vulner­a­bility of” a system or network — a defi­n­ition that oppo­nents have crit­i­cized as too broad. The bill gained support after sponsors agreed to allow votes on several amend­ments they said would make conces­sions to privacy activists; one aims to narrow the defi­n­ition of “cyber threat.”

When can data be shared?

Rogers said the amended version of the bill would only enable companies and intel­li­gence agencies to share infor­mation related to 1) cyber security purposes; 2) inves­ti­gation and pros­e­cution of cyber security crimes; 3) protection of indi­viduals from death and bodily harm; 4) child pornog­raphy; or 5) protection of the national security of the United States.

Why are privacy activists upset about CISPA?

Privacy activists like the American Civil Liberties Union and the Elec­tronic Frontier Foun­dation contend CISPA isn’t specific enough about just what consti­tutes a “cyber threat.” They say it enables Internet companies and service providers to hand over sensitive user infor­mation to intel­li­gence agencies without enough over­sight from the civilian side of government. Finally, they say it does not explicitly require Internet companies to remove iden­ti­fying infor­mation about users before sharing. Oppo­nents contend, for instance, that Facebook or Twitter could share user messages with the NSA or FBI without redacting the user’s name or personal details.

CISPA also protects the private sector from liability even if they share private user infor­mation, as long as that infor­mation is deemed to have been shared for cyber­se­curity or national security purposes. Even though sharing is voluntary and not required under the law, privacy activists say the legal immunity CISPA provides would make it easy for the government to pressure Internet companies to give up user data.

What kind of infor­mation can be shared?

Private companies and government agencies can share any infor­mation that pertains to a “cyber threat” or that would endanger national security. That could include user infor­mation, emails, and direct messages. Companies would be allowed to share with each other as well as the government. The government is not allowed to proac­tively search company-provided infor­mation for purposes unre­lated to cyber security, but oppo­nents say this would be tough to enforce. The bill does not place any explicit limit on how long that infor­mation can be kept. Several proposed amend­ments would limit the amount and kinds of infor­mation that can be shared, but it remains to be seen which — if any — will be adopted.

Is CISPA basi­cally SOPA 2.0?

No, it’s very different.

SOPA was about intel­lectual property; CISPA is about cyber security, but oppo­nents believe both bills have the potential to trample consti­tu­tional rights. The compar­isons to SOPA stem from language in an earlier version of CISPA that refer­enced intel­lectual property. That wording was removed early on in response to mounting crit­icism. SOPA would have strengthened copy­right laws, barring search engines and other websites from linking to sites that violated intel­lectual property regu­la­tions. That prompted a First Amendment concern from critics that it would give government the power to block websites wholesale, tram­pling free speech. CISPA’s liability shield, on the other hand, has sparked a concern based on the Fourth Amendment, which protects against unrea­sonable search and seizure. Oppo­nents contend the law would make it too easy for private companies and the intel­li­gence community to spy on users in the name of cyber security.

Why are some of the tech companies that protested SOPA, like Facebook and Microsoft, now supporting this bill?

CISPA gives Internet companies the ability to share threat infor­mation with intel­li­gence agencies and receive infor­mation back from them, an ability they say would enable them to deal with cyber threats more effec­tively. It does not compel them to protect users’ privacy (though a variety of proposed amend­ments aim to add more stringent privacy protec­tions). Companies could not be held liable for divulging a user’s identity or data to the government if the infor­mation relates to a “cyber threat.”

What’s the Obama administration’s take?

The White House is backing a Senate bill proposed by Homeland Security and Govern­mental Affairs Committee Chairman Sen. Joe Lieberman, I-Conn., and has threatened to veto CISPA. Offi­cials cite a lack of personal privacy protec­tions. They say CISPA would enable military and intel­li­gence agencies to take on a policing role on the internet, which the admin­is­tration points out is a civilian sphere.

What is CISPA’s path forward in Congress?

A vote is set for Friday. CISPA has accu­mu­lated more than 100 cosponsors and will most likely pass the House. “This isn’t about scram­bling to meet 218 votes, we are well past that,” co-sponsor Rogers said during a conference call with reporters. But the Senate is a different story — there, it must compete with the Lieberman cyber security bill and one from Sen. John McCain, R-Ariz.

Would CISPA really make us more secure?

It’s unclear.

Some cyber security specialists note that neither CISPA nor other cyber security bills in Congress would compel companies to update software, hire outside specialists or take other measures to preemp­tively secure them­selves against hackers and other threats. CISPA’s backers respond that the bill would fore­stall a “digital Pearl Harbor,” allowing a freer flow of infor­mation for a quicker and more effective response to hackers by both the government and the private sector.