Tech group representing Google, Yahoo backs CISPA • Hacker News Board

Re: Tech group representing Google, Yahoo backs CISPA

#61

Post by tptacek » Fri, Apr 12, 2013, 9:04 PM UTC

declan wrote: post #60

declan wrote: post #45

Earlier quoted context omitted.

I agree with tptacek (hi there!) that CISPA is not that difficult to parse, and that people might as well read it for themselves. More: http://news.cnet.com/8301-13578_3-57579012-38/privacy-protec... But I disagree with his "Michigan Militia" analogy, which is a bit silly. Another way to look at it is that starting with Clipper, CDA, CALEA, crypto export controls (plus mandatory domestic key escrow approved by a Hous…

tptacek: You're quite right that neither are with us today. The reason: Clipper and key escrow were defeated by the same advocacy groups you claim, without any evidence, are trying to "fundraise by convincing willfully ignorant nerds" CISPA is bad. I can imagine FBI director Louis Freeh saying the same thing when he was defending bans on non-escrowed encryption in the late 1990s: "Nothing wrong with mandatory key esc…

What does EFF's opposition to Clipper have to do with what CISPA says?

You yourself have conceded on HN that advocacy groups have directly misstated details about CISPA. Now you're writing comments suggesting that I'm being misleading by pointing that track record out. That is not honest debate, Declan.

Re: Tech group representing Google, Yahoo backs CISPA

#62

Post by msandford » Fri, Apr 12, 2013, 9:04 PM UTC

tptacek wrote: post #25

msandford wrote: post #7

Earlier quoted context omitted.

Like all new laws this one will be sold one way and used another -- likely very expansionary -- way. For example the Patriot Act was sold as a thing that would only be used to catch terrorists. It's total terrorist-catching prosecutions to date is trivial, zero to a few. But it's still getting used quite a bit. http://www.nytimes.com/2003/09/28/us/us-uses-terror-law-to-p... http://www.cbsnews.com/2100-201_162-573155.…

If the text of the bill doesn't matter, the text of every other privacy-related bill doesn't matter either, and we can skip all these pointless arguments and let them pass SOPA. After all, they're just going to use milk safety regulations to combat piracy.

It's not that the text of the bill is COMPLETELY irrelevant. It's that the big companies will use their newfound powers in ways that fall into a gray area in the bill and of course the government will choose not to prosecute them for doing so, or judges will allow it because it's a gray area and not EXPLICITLY disallowed.

Re: Tech group representing Google, Yahoo backs CISPA

#63

Post by [deleted] » Fri, Apr 12, 2013, 9:09 PM UTC

declan wrote: post #60

declan wrote: post #45

Earlier quoted context omitted.

I agree with tptacek (hi there!) that CISPA is not that difficult to parse, and that people might as well read it for themselves. More: http://news.cnet.com/8301-13578_3-57579012-38/privacy-protec... But I disagree with his "Michigan Militia" analogy, which is a bit silly. Another way to look at it is that starting with Clipper, CDA, CALEA, crypto export controls (plus mandatory domestic key escrow approved by a Hous…

tptacek: You're quite right that neither are with us today. The reason: Clipper and key escrow were defeated by the same advocacy groups you claim, without any evidence, are trying to "fundraise by convincing willfully ignorant nerds" CISPA is bad. I can imagine FBI director Louis Freeh saying the same thing when he was defending bans on non-escrowed encryption in the late 1990s: "Nothing wrong with mandatory key esc…

[deleted]

Re: Tech group representing Google, Yahoo backs CISPA

#64

Post by declan » Fri, Apr 12, 2013, 9:16 PM UTC

tptacek wrote: post #57

declan wrote: post #55

Earlier quoted context omitted.

I halfway agree. Google and some other left-coast companies are the least likely to take advantage of CISPA's wildcard override-all-existing-privacy-laws loophole. Google has fought the DOJ in court before to protect the privacy of their users; they're fighting the FBI now. Facebook, Amazon, and Twitter have done the same. But other companies, including AT&T, are far more likely to exploit this loophole (in fact they…

You wrote a lengthier comment that enumerated the failed CISPA amendments that I need to take some time to respond to, but in the meantime: Regarding PII in threat data, we're talking about orthogonal concerns. The amendment you're talking about would require all threat data to use (presumably commercially reasonable methods) to scrub PII. The concern there is accidental inclusion of PII; it's that disclosure of, say…

I upvoted this post as a way to say thank you for a polite debate.

Re: Tech group representing Google, Yahoo backs CISPA

#65

Post by declan » Fri, Apr 12, 2013, 9:16 PM UTC

tptacek wrote: post #61

declan wrote: post #60

Earlier quoted context omitted.

tptacek: You're quite right that neither are with us today. The reason: Clipper and key escrow were defeated by the same advocacy groups you claim, without any evidence, are trying to "fundraise by convincing willfully ignorant nerds" CISPA is bad. I can imagine FBI director Louis Freeh saying the same thing when he was defending bans on non-escrowed encryption in the late 1990s: "Nothing wrong with mandatory key esc…

What does EFF's opposition to Clipper have to do with what CISPA says? You yourself have conceded on HN that advocacy groups have directly misstated details about CISPA. Now you're writing comments suggesting that I'm being misleading by pointing that track record out. That is not honest debate, Declan.

tptacek: Two points. First, if an employee has a history of writing bad code, you may scrutinize their efforts more closely in the future. Same with Congress. I was making a historical point for context that based on rdl's mention below.

Second, I'm not aware that anything ACLU EFF EPIC said that's intentionally false re: CISPA. As you correctly say, other groups may not be as careful (although even then, you could have unintentional falsehoods, and I rarely like to speculate about motives).

Re: Tech group representing Google, Yahoo backs CISPA

#66

Post by [deleted] » Fri, Apr 12, 2013, 9:18 PM UTC

[deleted] wrote: post #63

declan wrote: post #60

Earlier quoted context omitted.

tptacek: You're quite right that neither are with us today. The reason: Clipper and key escrow were defeated by the same advocacy groups you claim, without any evidence, are trying to "fundraise by convincing willfully ignorant nerds" CISPA is bad. I can imagine FBI director Louis Freeh saying the same thing when he was defending bans on non-escrowed encryption in the late 1990s: "Nothing wrong with mandatory key esc…

[deleted]

[deleted]

Re: Tech group representing Google, Yahoo backs CISPA

#67

Post by [deleted] » Fri, Apr 12, 2013, 9:18 PM UTC

declan wrote: post #65

tptacek wrote: post #61

Earlier quoted context omitted.

What does EFF's opposition to Clipper have to do with what CISPA says? You yourself have conceded on HN that advocacy groups have directly misstated details about CISPA. Now you're writing comments suggesting that I'm being misleading by pointing that track record out. That is not honest debate, Declan.

tptacek: Two points. First, if an employee has a history of writing bad code, you may scrutinize their efforts more closely in the future. Same with Congress. I was making a historical point for context that based on rdl's mention below. Second, I'm not aware that anything ACLU EFF EPIC said that's intentionally false re: CISPA. As you correctly say, other groups may not be as careful (although even then, you could h…

[deleted]

Re: Tech group representing Google, Yahoo backs CISPA

#68

Post by tptacek » Fri, Apr 12, 2013, 9:19 PM UTC

declan wrote: post #65

tptacek wrote: post #61

Earlier quoted context omitted.

What does EFF's opposition to Clipper have to do with what CISPA says? You yourself have conceded on HN that advocacy groups have directly misstated details about CISPA. Now you're writing comments suggesting that I'm being misleading by pointing that track record out. That is not honest debate, Declan.

tptacek: Two points. First, if an employee has a history of writing bad code, you may scrutinize their efforts more closely in the future. Same with Congress. I was making a historical point for context that based on rdl's mention below. Second, I'm not aware that anything ACLU EFF EPIC said that's intentionally false re: CISPA. As you correctly say, other groups may not be as careful (although even then, you could h…

How many of the names on CISPA were in Congress for Clipper? Answer: Frank LoBiondo. That's it, out of a long list of names. Congress is not one monolithic thing.

Re: Tech group representing Google, Yahoo backs CISPA

#69

Post by rdl » Fri, Apr 12, 2013, 9:19 PM UTC

rdl wrote: post #56

declan wrote: post #46

Earlier quoted context omitted.

I have read the 2013 House CISPA amendments and wrote about them here: http://news.cnet.com/8301-13578_3-57579012-38/privacy-protec... I'd be interested to hear defenders of the legislation explain why CISPA remains such a lovely bill after the House Intelligence committee rejected these four amendments that were aimed at protecting privacy: * Limiting the sharing of private sector data to civilian agencies, and spec…

I kind of hate those amendments (without having read them). I'm not really defending CISPA (I would like better security, but I generally distrust the government both for competence and for goals/morality/ethics). 1) NSA and USAF are specifically the only parts of the USG I want to have access to this data. I trust NSA and DOD way more than I trist FBI, DEA, etc. to not fuck me personally if my data is somehow includ…

in reply to tptacek below (I think I'm still within the too-many-nested-replies thing)

I don't know if it's possible to limit CISPA, while keeping it useful, enough to keep civil libertarians happy. The best solution is probably to take a page from my much more seriously followed personal legislative issue: gun rights.

I'm actually in favor of universal licensing/background checks and such for firearms, if implemented correctly (not building a registry, using a technical solution to make it possible to trace ownership of a gun without enumerating all guns owned by a person, etc.)

But, the gun lobby/gun owners rightly fear any new regulations are just there to kick them down the slippery slope, so they dig in their heels and oppose everything.

The way around it, I think, is to have a good background check bill proposed which ALSO eliminates a bunch of ineffective existing regulations (allow import of 1968+ MGs, non-sporting-use weapons, no 922(r) parts count, sale of transferable new post 1986 MG under existing NFA rules, removal of SBS/SBR/suppressors from NFA, potentially CCW reciprocity). There's enough pro gun stuff in that to make up for the risk/fear of the new licensing regulation.

Maybe do the same thing with CISPA -- information sharing, but at the same time address the NSL issue, fix anti-circumvention in DMCA, potentially limit CALEA (I hate that it applies to anything but POTS telephony), etc. I'm not sure what specific concessions should be made, but the idea of trading some relaxing ineffective or bad existing law for new law seems like the best way forward.

Re: Tech group representing Google, Yahoo backs CISPA

#70

Post by declan » Fri, Apr 12, 2013, 9:25 PM UTC

tptacek wrote: post #20

rdl wrote: post #17

Earlier quoted context omitted.

Right, a lot of the issue is that SOPA/PIPA (and before that, PATRIOT, NDAA, etc) have poisoned the water between ~the users of the Internet and ~the Government.

That is probably true, but that fact is not an all-access pass to making inaccurate claims about the bill. But it gets used that way all the time.

This is a continuation of our disagreement above, I know, but if you have an entity that has advanced problematic proposals multiple times when it comes to regulating technology -- and at times demonstrated a near-complete lack of understanding of what they're trying to regulate -- it's not unreasonable to apply more scrutiny to future proposals.

You're right that nobody should be making inaccurate claims about the bill (though I try to be charitable and say inaccurate claims in either direction are misunderstandings, not intentional distortions). I'm making a slightly different point, which is an argument for lower threshold to trigger scrutiny, and a higher threshold to legislate in the first place.