Feeds

Zombie CISPA cybersecurity bill rises from Congressional grave

Obama put on the spot over veto threat

High performance access to file storage

The Cyber Intelligence Sharing and Protection Act (CISPA), which President Obama threatened to veto for its lack of privacy protection, has been resurrected by its sponsors and will be reintroduced to the US House of Representatives this week.

CISPA sets up a framework to allow government agencies to share information on new security threats and attack vectors with private companies. In return, those companies can choose to share information about their users with the government whatever their privacy policies state, have a measure of control to strip out identifying information, and enjoy immunity from any subsequent legal action by customers.

The bill was originally introduced last year by representatives Mike Rogers (R-MI) and "Dutch" Ruppersberger (D-MD), but failed to pass, thanks to a Republican filibuster in the Senate and the addition of numerous extraneous amendments, including two adding anti-abortion laws and an amendment by Senate Minority Leader Mitch McConnell (R-KY) to repeal the Affordable Care Act.

Facebook was one of CISPA's most prominent supporters, saying the bill would allow it to get security information while ensuring that the company could protect the privacy of its users. Other technology companies such as IBM, Intel, Microsoft, Oracle, and EMC issued letters of support for CISPA, but declined to make further statements on the issues raised.

But a coalition of civil rights and business groups, including the US Chamber of Commerce, organized to fight the legislation, pointing out that the range of data the government could scrape – and the lack of oversight of how it is used – makes the bill fatally flawed. There are also virtually no controls as to what the government can do with donated data, other than it must be for purposes relating to cyber or national security.

"If the House wants smart cyber legislation that also protects privacy, it needs to ensure that the programs are civilian-led, minimize the sharing of sensitive personal information between government and corporations, and protect collected information from non-cyber uses," said Michelle Richardson, legislative counsel for the ACLU.

There have been hints that President Obama will announce an executive order on cyber security during – or shortly after – his State of the Union address on Tuesday. The reintroduction of CISPA, in an unchanged form from the original, could be a sign that Congress is trying to get its own rules in first ahead of any announcement.

"American businesses are under siege," CISPA co-sponsor Representative Rogers told The Hill. "We need to provide American companies the information they need to better protect their networks from these dangerous cyber threats. It is time to stop admiring this problem and deal with it immediately."

President Obama sort of threatened to veto CISPA on privacy grounds, saying in a statement that "his senior advisors would recommend that he veto the bill." The Republican-controlled House of Representatives may be willing to overlook the privacy failings of the bill in exchange for a chance to put one over on Obama.

High performance access to file storage

More from The Register

next story
Android engineer: We DIDN'T copy Apple OR follow Samsung's orders
Veep testifies for Samsung during Apple patent trial
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Big Content goes after Kim Dotcom
Six studios sling sueballs at dead download destination
Alphadex fires back at British Gas with overcharging allegation
Brit colo outfit says it paid for 347KVA, has been charged for 1940KVA
Jack the RIPA: Blighty cops ignore law, retain innocents' comms data
Prime minister: Nothing to see here, go about your business
Singapore decides 'three strikes' laws are too intrusive
When even a prurient island nation thinks an idea is dodgy it has problems
Banks slap Olympus with £160 MEEELLION lawsuit
Scandal hit camera maker just can't shake off its past
France bans managers from contacting workers outside business hours
«Email? Mais non ... il est plus tard que six heures du soir!»
Reprieve for Weev: Court disowns AT&T hacker's conviction
Appeals court strikes down landmark sentence
US taxman blows Win XP deadline, must now spend millions on custom support
Gov't IT likened to 'a Model T with a lot of things on top of it'
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.