FAQ: What you need to know about CISPA
The House version of the information-sharing bill passed last week
Computerworld - The U.S. House of Representatives last week passed the controversial Cyber Intelligence Sharing and Protection Act despite opposition from privacy advocates, lawmakers and even the White House, which threatened to veto the bill if it lands on the president's desk in its current form.
Here's what you need to know about CISPA.
What is CISPA? CISPA is short for the Cyber Intelligence Sharing and Protection Act (H.R. 3523). U.S Reps. Mike J. Rogers (R-Mich.) and C.A. Dutch Ruppersberger (D-Md.) introduced the bill in the House in November. The bill is designed to bolster cybersecurity by enabling better information sharing between Internet companies and the government. An amended version of the bill passed the House by a 248-168 vote Thursday.
What sort of information sharing? CISPA would allow Internet companies, such as Internet service providers, to monitor their networks and to collect, analyze and share information on any user activities that they believe present a threat to their networks. The law would allow companies to share any information "pertaining to the protection" of their networks with the National Security Agency and other federal agencies. In return, federal agencies would share both classified and unclassified cyberthreat information in their possession to help Internet companies bolster their defenses against cyberthreats.
Who supports CISPA? CISPA has broad support from many technology companies, industry trade groups and lawmakers who say that information sharing is vital to cybersecurity.
Why do privacy advocates and rights groups oppose the bill? Organizations such as the Electronic Frontier Foundation, the American Civil Liberties Union and the Center for Democracy and Technology say the bill is dangerous because it is too vaguely worded. They worry that the bill would allow Internet companies to collect an almost unlimited set of information about Internet users and would allow the companies to share the information with government agencies such as the NSA, without judicial oversight. The law would also allow Internet companies to use a "cybersecurity exception" clause to skirt the privacy protection provided by statutes such as the Federal Wiretap Act and the Electronic Communications Privacy Act.
What do you mean by vaguely worded? Critics claim the bill uses loose language to describe cyberthreats, network security attacks, countermeasures, cybersecurity systems, and other crucial terms. They claim the ambiguity can create big problems. For instance, CISPA offers no clear explanation of what activity defines a cyberthreat, although companies would be allowed to monitor and share information about those activities. The language would also allow companies to collect information on almost all Internet communications, and justify it on cybersecurity grounds. Even innocuous activity such as using a proxy server or an anonymizer could be deemed a suspicious activity under CISPA.
- Big Data, Big Mess: Sound Risk Intelligence Through Complete Context This paper examines the insecurity of the small businesses in the supply chain and offers tips to close those backdoors into the enterprise.
- Using Cyber Insurance and Cybercrime Data to Limit Your Business Risk This paper examines the challenges of understanding cyber risks, the importance of having the right cyber risk intelligence, and how to use this...
- 5 Tips to Secure Small Business Backdoors in the Enterprise Supply Chain This paper examines the insecurity of the small businesses in the supply chain and offers tips to close those backdoors into the enterprise.
- Confront consumerization with convergence Virtualization expert Elias Khnaser spotlights the security, compliance, and governance issues that arise when enterprise users "consumerize" with shadow IT and public cloud...
- NSS Labs & Cisco Present: Evaluating Leading Breach Detection Systems Today's constantly evolving advanced malware and APTs can evade point-in-time defenses to penetrate networks. Security professionals must evolve their strategy in lockstep to...
- Will the Real Endpoint Threat Detection and Response Please Stand Up? This webinar explores new technologies & process for protecting endpoints from advanced attackers as well as the innovations that are pushing the envelope... All Gov't Legislation/Regulation White Papers | Webcasts