I appeared on CNN this morning to talk about why I'm not buying Facebook (CISPA)

The point of not buying Facebook because of CISPA would tell more if the point were expanded to the sustainability of their business model. For example, what does their support say about their relationship with users going forward? Bearing in mind that, as users currently don't seem to care, we're talking about a set of concerns that presumably will emerge down the road. What are those concerns and how will they emerge?

Remember that we're talking about questions that didn't exist five years ago, and to which there isn't any community consensus. Most investors won't understand the argument, never mind Alex's side of it. So educate them: Tell them how the issue speaks to how these choices will evolve, and bring forth concerns that are currently held by only a few people. Point out that it was a similar group of people that worried about the Microsoft OS model twenty years ago, and that they were so right that the work they did on own on open source laid much of the groundwork for our current environment.

If you can get investors to link stuff like CISPA to business model sustainability, they'll go to school on the issues, and the conclusions they form will shape the equity marketplace for every social media company to come. But they have to hear what the debate is, and its implications for the businesses.

As a persuasive strategy this makes a lot of sense and I see the value of the comment. But on the specifics: do you have something in mind as to how CISPA might impact Fb's relationship with its users, or its business model? Obviously, I'm asking because I'm skeptical that there is any such impact, but I'm very interested in your reasoning.

Honestly I'm not a CISPA expert. I do see two concerns:

1. It seems to me that inviting government examination and regulation of network traffic, in the name of security, seems unlikely to make the 'net _more_ flexible, and potentially could lead real rigidity that would be bad for development of 'net businesses and degrading the experience possible over the 'nets.

2. Stuff like CISPA is generally validating of 'net control regimes such as in Iran and China. As the malice of those becomes ever more apparent, US policies viewed as precedents and justifications will be suspect, as will supporters of those policies. Supporting this stuff will be like supporting tobacco companies and netting dolphins to catch tuna -- and may cause deep customer suspicion in a field where trust will be crucial.

Now item item 1, more rigidity, could be seen as positive for incumbents like FB. To which I'd would say that technology has already evolved around a lot of rigidity and that any business founded on a particular regulatory environment is dated to the moment when technology obviates those regulations.

Item 2 is more speculative, but I actually think more likely to prove telling. But it's going to take 5 - 10 years.

Someone more knowledable of CISPA could do better. The broader point of my remark is, figure out how those details relate to the Facebook business model and speak to that. Do that and you'll have an audience. And there's no need to rush, the stock will be around for a while.

> Apple users will continue using the products even if their friends do not.

A lot of the value in Apple's products comes from the ecosystem: iTunes, the App Store, and so on. Don't discount the value of a platform on which a large number of developers are incentivized to build.

CISPA doesn't add any regulation to network traffic. It doesn't impose government controls. It's an opt-in mechanism that purports to allow private companies to share information incident to security attacks on their services; what it does, essentially, is clarify the (already very weak) privacy controls of the ECPA to make it clear that companies who are being attacked can share traffic captures without being sued the way Google is now for the Street View fiasco.† It doesn't authorize countermeasures; it doesn't enable services to be shut off; it doesn't alter due process controls for the government to seize information from non-cooperative services.

With that in mind, I'm curious as to how your reasoning might change. Do you think an opt-in information sharing mechanism for corporations really validates the state-sponsored network access control used in Iran and China? I'm interested in how.

† They already probably can't be sued for that, but I believe the thinking here is that by spelling it out in black-letter law, companies will be encouraged to share information more than they already do; note that ISPs already do have programs to share attack information among themselves, but application service providers tend not to.