Feeds

Zombie CISPA cybersecurity bill rises from Congressional grave

Obama put on the spot over veto threat

Intelligent flash storage arrays

The Cyber Intelligence Sharing and Protection Act (CISPA), which President Obama threatened to veto for its lack of privacy protection, has been resurrected by its sponsors and will be reintroduced to the US House of Representatives this week.

CISPA sets up a framework to allow government agencies to share information on new security threats and attack vectors with private companies. In return, those companies can choose to share information about their users with the government whatever their privacy policies state, have a measure of control to strip out identifying information, and enjoy immunity from any subsequent legal action by customers.

The bill was originally introduced last year by representatives Mike Rogers (R-MI) and "Dutch" Ruppersberger (D-MD), but failed to pass, thanks to a Republican filibuster in the Senate and the addition of numerous extraneous amendments, including two adding anti-abortion laws and an amendment by Senate Minority Leader Mitch McConnell (R-KY) to repeal the Affordable Care Act.

Facebook was one of CISPA's most prominent supporters, saying the bill would allow it to get security information while ensuring that the company could protect the privacy of its users. Other technology companies such as IBM, Intel, Microsoft, Oracle, and EMC issued letters of support for CISPA, but declined to make further statements on the issues raised.

But a coalition of civil rights and business groups, including the US Chamber of Commerce, organized to fight the legislation, pointing out that the range of data the government could scrape – and the lack of oversight of how it is used – makes the bill fatally flawed. There are also virtually no controls as to what the government can do with donated data, other than it must be for purposes relating to cyber or national security.

"If the House wants smart cyber legislation that also protects privacy, it needs to ensure that the programs are civilian-led, minimize the sharing of sensitive personal information between government and corporations, and protect collected information from non-cyber uses," said Michelle Richardson, legislative counsel for the ACLU.

There have been hints that President Obama will announce an executive order on cyber security during – or shortly after – his State of the Union address on Tuesday. The reintroduction of CISPA, in an unchanged form from the original, could be a sign that Congress is trying to get its own rules in first ahead of any announcement.

"American businesses are under siege," CISPA co-sponsor Representative Rogers told The Hill. "We need to provide American companies the information they need to better protect their networks from these dangerous cyber threats. It is time to stop admiring this problem and deal with it immediately."

President Obama sort of threatened to veto CISPA on privacy grounds, saying in a statement that "his senior advisors would recommend that he veto the bill." The Republican-controlled House of Representatives may be willing to overlook the privacy failings of the bill in exchange for a chance to put one over on Obama.

Top 5 reasons to deploy VMware with Tegile

Whitepapers

Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Protecting against web application threats using SSL
SSL encryption can protect server‐to‐server communications, client devices, cloud resources, and other endpoints in order to help prevent the risk of data loss and losing customer trust.