Feeds

Zombie CISPA cybersecurity bill rises from Congressional grave

Obama put on the spot over veto threat

3 Big data security analytics techniques

The Cyber Intelligence Sharing and Protection Act (CISPA), which President Obama threatened to veto for its lack of privacy protection, has been resurrected by its sponsors and will be reintroduced to the US House of Representatives this week.

CISPA sets up a framework to allow government agencies to share information on new security threats and attack vectors with private companies. In return, those companies can choose to share information about their users with the government whatever their privacy policies state, have a measure of control to strip out identifying information, and enjoy immunity from any subsequent legal action by customers.

The bill was originally introduced last year by representatives Mike Rogers (R-MI) and "Dutch" Ruppersberger (D-MD), but failed to pass, thanks to a Republican filibuster in the Senate and the addition of numerous extraneous amendments, including two adding anti-abortion laws and an amendment by Senate Minority Leader Mitch McConnell (R-KY) to repeal the Affordable Care Act.

Facebook was one of CISPA's most prominent supporters, saying the bill would allow it to get security information while ensuring that the company could protect the privacy of its users. Other technology companies such as IBM, Intel, Microsoft, Oracle, and EMC issued letters of support for CISPA, but declined to make further statements on the issues raised.

But a coalition of civil rights and business groups, including the US Chamber of Commerce, organized to fight the legislation, pointing out that the range of data the government could scrape – and the lack of oversight of how it is used – makes the bill fatally flawed. There are also virtually no controls as to what the government can do with donated data, other than it must be for purposes relating to cyber or national security.

"If the House wants smart cyber legislation that also protects privacy, it needs to ensure that the programs are civilian-led, minimize the sharing of sensitive personal information between government and corporations, and protect collected information from non-cyber uses," said Michelle Richardson, legislative counsel for the ACLU.

There have been hints that President Obama will announce an executive order on cyber security during – or shortly after – his State of the Union address on Tuesday. The reintroduction of CISPA, in an unchanged form from the original, could be a sign that Congress is trying to get its own rules in first ahead of any announcement.

"American businesses are under siege," CISPA co-sponsor Representative Rogers told The Hill. "We need to provide American companies the information they need to better protect their networks from these dangerous cyber threats. It is time to stop admiring this problem and deal with it immediately."

President Obama sort of threatened to veto CISPA on privacy grounds, saying in a statement that "his senior advisors would recommend that he veto the bill." The Republican-controlled House of Representatives may be willing to overlook the privacy failings of the bill in exchange for a chance to put one over on Obama.

High performance access to file storage

More from The Register

next story
Did a date calculation bug just cost hard-up Co-op Bank £110m?
And just when Brit banking org needs £400m to stay afloat
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Whoever you vote for, Google gets in
Report uncovers giant octopus squid of lobbying influence
Lavabit loses contempt of court appeal over protecting Snowden, customers
Judges rule complaints about government power are too little, too late
MtGox chief Karpelès refuses to come to US for g-men's grilling
Bitcoin baron says he needs another lawyer for FinCEN chat
Don't let no-hire pact suit witnesses call Steve Jobs a bullyboy, plead Apple and Google
'Irrelevant' character evidence should be excluded – lawyers
EFF: Feds plan to put 52 MILLION FACES into recognition database
System would identify faces as part of biometrics collection
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Ex-Tony Blair adviser is new top boss at UK spy-hive GCHQ
Robert Hannigan to replace Sir Iain Lobban in the autumn
Alphadex fires back at British Gas with overcharging allegation
Brit colo outfit says it paid for 347KVA, has been charged for 1940KVA
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.