CISPA passes House in unexpected last-minute vote
RT | 27 April, 2012
The House of Representatives has approved Cyber Intelligence Sharing and Protection Act with a vote count of 248-168. The bill is now headed for the Senate. President Barack Obama will be able to sign or cancel it pending Senate approval.
Initially slated to vote on the bill Friday, the House of Representatives decided to pass Cyber Intelligence Sharing and Protection Act (CISPA) Thursday after approving a number of amendments.
Apart from cyber and national security purposes, the bill would now allow the government to use private information obtained through CISPA for the investigation and prosecution of “cybersecurity crime,” protection of individuals and the protection of children. The new clauses define “cybersecurity crime” as any crime involving network disruption or hacking.
“Basically this means CISPA can no longer be called a cyber security bill at all. The government would be able to search information it collects under CISPA for the purposes of investigating American citizens with complete immunity from all privacy protections as long as they can claim someone committed a ‘cybersecurity crime.’ Basically it says the Fourth Amendment does not apply online, at all,” Techdirt’s Leigh Beadon said.
Declan McCullagh, correspondent from CNET News, says CISPA will cause more trouble than is immediately apparent.
“The most controversial section of CISPA is the language – that notwithstanding any other portion the of law, companies can share what they want as long as it’s for what they call a ‘cyber security purpose,'” he told RT.
CISPA was introduced in the House last November. Critics chided the bill, saying its broad wording could allow the government to spy on individual Internet users and block websites that publish vaguely defined ‘sensitive’ data.
“[CISPA] doesn’t really have any protections against cyber threats, all it does is make people share their information. But that’s not going to solve the problem. What’s going to solve the problem is actual security measures, protecting the service in the first place, not spying on people after the fact,” Internet activist Aaron Swartz told RT.
The White House issued a statement Wednesday saying President Barack Obama would be advised to veto the bill if he receives it. The Obama administration denounces the proposed law for potentially giving the government cyber-sleuthing powers that would allow both federal authorities and private businesses to sneak into inboxes and online activities in the name of combating Internet terrorism tactics.
Earlier, the House of Representatives and Senate also considered adopting the Stop Online Piracy Act (SOPA) and Protect IP Act (PIPA). These bills sought to entitle the US government to curb access to “rogue websites” that illegally hosted intellectual property. The bills could effectively force search engines to remove these websites from search results, an action many private companies considered intrusive.
PIPA and SOPA were opposed by many Internet giants including Google, Mozilla, Facebook, Yahoo!, Wikipedia and Reddit. Google organized a petition against the legislation, while Wikipedia held a 24-hour blackout to protest the bill in January. As a result, SOPA was recalled while PIPA was postponed indefinitely.
However, CISPA was actually backed by Facebook, despite its opposition to SOPA and PIPA. In a blog post on April 13, Joel Kaplan, Vice President of US Public Policy at Facebook, argued that if enacted into law, the bill would “give companies like ours the tools we need to protect our systems and the security of our users’ information, while also providing those users confidence that adequate privacy safeguards are in place.”
A number of big companies, including AT&T, Microsoft, Boeing, Verizon and Oracle have also supported CISPA.
Security for the 99%
By Dan Auerbach | EFF | April 25, 2012
The House of Representatives kicked off their “cybersecurity week” yesterday with a hearing titled “America Is Under Cyber Attack: Why Urgent Action is Needed.” Needless to say, the rhetoric of fear was in full force. A lot of topics were raised by members of Congress and panelists, but perhaps the most troublesome theme came from panelist and Former Executive Assistant Director of the FBI Shawn Henry, who repeatedly urged that good cybersecurity means going on the offensive:
“the problem with existing […] tactics is that they are too focused on adversary tools (malware and exploits) and not on who the adversary is and how they operate. Ultimately, until we focus on the enemy and take the fight to them […], we will fail.”
This offensively-minded approach has major pitfalls, as it could lead to more government monitoring and control over our communications. While we think an increased focus on catching criminals using existing tools is a fine tactic that could be used by law enforcement, we fear the temptation for law enforcement to increase their surveillance capabilities in order to successfully go on the offensive in the context of computer crimes. This could mean things like breaking into people’s computers without warrants, or disrupting privacy-enhancing tools like Tor. Needless to say, we think it would be a very bad idea to link our safety to the ability for law enforcement to effectively monitor people, and that is a danger of focusing solely on an offensive strategy. Instead, we would like to offer an alternative, defensively-oriented point of view regarding security, an important view that we think was not adequately represented in yesterday’s panel.
Securing U.S. critical infrastructure networks, corporate networks, and the Internet at large depends upon securing our computers and networked devices. Fundamentally, it’s very simple: fewer software vulnerabilities means more security. Once a vulnerability is patched and an upgraded version of software is available and in use, that increases safety for all of us. Ensuring that the right mechanisms are in place to maximize this baseline security should be a major focus area of any organized effort to secure our critical and other Internet infrastructure. This means encouraging the disclosure of vulnerabilities when they are found so that they can be fixed, and no longer exploited. This is what we mean when we talk about security for everyone. This defensive strategy also takes a view of vulnerabilities that includes engineering with security in mind: if software doesn’t force good security on administrators and other humans who have a role to play to keep things secure, then that should be considered a security vulnerability in that software.
In order to understand why vulnerabilities are the foundation of insecurity and ought to be the focus of defensive efforts, let’s take a bit of time for those new to the computer security world to define bugs, vulnerabilities, exploits, and a particularly nasty class of exploits called “zero-day” exploits.
What are bugs, vulnerabilities, exploits and “zero-day” exploits?
A software bug is a general term referring to an unintentional problem with a piece of software that causes the software to work in an unexpected or unintended way. Bugs can refer to low-level issues (“we started counting from 0 over here, but from 1 over there, and now this array is messed up”), or to high-level issues (“we didn’t implement a feature allowing people to see their open orders on this website”).
Security vulnerabilities are a class of bugs in software; these are the bugs that allow an attacker to gain unauthorized access to do something that she couldn’t before. This could mean gaining access to a remote computer, or to a private network, or to other private information. Once again, these range from low-level vulnerabilities (“We weren’t expecting the user to give a name that was 4 gigabytes long; our oversight allowed the user to crash the program and execute her malicious code on the victim’s system”) to high-level (“Since we didn’t force a user to use a strong passphrase, his account could be compromised”).
Exploits are pieces of software that actually take advantage of the security vulnerability and give the user running the software unauthorized access. A security vulnerability could lead to an exploit, although not all vulnerabilities lead to exploits.
Zero-day exploits are exploits that take advantage of an undisclosed vulnerability. Suppose there is a publicly known vulnerability in the browser Internet Explorer 6. Then any exploit based on that vulnerability is NOT considered a zero-day, and you can (often, theoretically) protect yourself from such a vulnerability. In this case, for example, you could do so by downloading Internet Explorer 9. However, if there is a “zero-day” in Internet Explorer 9, there’s nothing you can knowingly do as a user to protect yourself. This makes this type of vulnerability especially scary, since it could be used not just against unwitting users who haven’t upgraded their software, but against anyone.
Ok, got it. To make us safer, we need to patch vulnerabilities and prevent exploits, especially zero-day exploits. Does CISPA encourage this?
Unfortunately, the “cybersecurity” bill CISPA and other legislation under debate does NOT focus on this baseline security. Instead of encouraging the patching of vulnerabilities as quickly as possible, or offering solutions to improve the general security of networked computers, the bill encourages broad surveillance of personal data by companies and the government. This type of information sharing is largely unrelated to the core issue of vulnerabilities that need to be patched at the software level. It’s certainly possible that by mining that data one could come across an exploit or an unknown vulnerability and share it with the vendor, but the bill is NOT about sharing vulnerabilities so that they can be patched – it’s about sharing raw data in a way that could legitimize a public-private surveillance partnership. And this data sharing between companies and the government in no way encourages security vulnerabilities themselves to be shared with the relevant software vendors and developers so that they can be patched. In other words, it just doesn’t attack the root of the problem.
Why is fixing vulnerabilities at odds with taking an offensive approach to security?
If we take an offensive approach as Mr. Henry suggests, a “security for the 1%” situation seems likely to arise, in which vulnerabilities are sometimes kept secret, and mitigations or fixes for these vulnerabilities are selectively doled out by the government or other private security firms only to critical infrastructure or paying clients (the “1%” deemed worthy of protection). The government might even deploy black box systems to companies and infrastructure designed to mitigate exploits based on secret vulnerabilities while giving as little information as possible about those underlying vulnerabilities, even to the companies they are protecting. Either way, the vendor would not be told about the vulnerability and so anyone who wasn’t a recipient of the “privileged” information would be hung out to dry.
What is a better approach to security?
Changing the incentives and culture to encourage the right sort of information sharing concerning vulnerabilities is a complex problem, and we do not purport to have a complete solution. There are many pieces to the puzzle: what should be done about vendors who don’t care about security? What about users who don’t upgrade software, or go out of their way to be vulnerable? What about security researchers who discover vulnerabilities, and choose to sell this knowledge to the highest bidder, instead of ensuring that the vendor knows about the vulnerability and it gets fixed?
There are some common sense tactics that the government can take to help solve these problems. For starters, the government can itself commit to disclosing any known vulnerabilities to vendors so that they are promptly patched. Next, incentives could be put in place to encourage research that has broad beneficial effects for everyone’s security. For example, suppose a researcher invents a new testing technique that reduces how many exploitable vulnerabilities there are in software in general. This is a win for everyone, and we think the government should strongly encourage such research.1
But beyond these common sense suggestions, the main point we want to raise in this post is not to offer a solution to these problems, but rather suggest that anyone interested in security at the national and international level should be thinking hard about them. Taking an offensive approach has the potential to put our civil liberties in danger, and could create a situation in which our safety ebbs and flows with how well the intelligence community can spy on us. This precarious and undesirable situation can be avoided if instead we take a defensive approach to stop the problem at its core, working to ensure that everyone is maximally protected. Mr. Henry suggests that “offense outpaces the defense.” That seems like an oversimplification, but even if one accepts it to be true, we should not take this to be an immutable property of the world. Instead, we should work to change it by increasing our defensive efforts. Unfortunately, the “cybersecurity” debate does not seem to be addressing this point of view, but we hope that somebody brings it up during “cybersecurity week”.
In the mean time, please speak out against the misguided cybersecurity legislation by taking action against CISPA.
Related articles
The right to water: Water cistern demolitions in Hebron area
23 April 2012 | International Solidarity Movement, West Bank
On Monday April 23, 2012, the Israeli occupation forces destroyed four water cisterns outside of the city of al-Khalil (Hebron). Two of the destroyed cisterns were located in the Abweire area, a small agricultural neighborhood of 400-500 residents northeast of al-Khalil. The other two cisterns destroyed were located in Hal-Houl, south of al-Khalil. The demolitions came just one week after another four cisterns were destroyed in the Meshroona area south of al-Khalil.
Palestinians in these areas, who are located in Area C, are forced to depend on rain water cisterns for their crops and livestock because of unequal distribution of water resources to surrounding illegal, Zionist settlements. The destruction of such cisterns is part of a calculated strategy of forced displacement and ethnic cleansing in occupied Palestine. According to the Israeli organization Diakonia, water cistern demolitions over the past two years have directly affected almost 14,000 Palestinians, among whom several hundred have been forced to leave their homes because of lack of water. International law forbids the targeting of structures essential for the survival of the civilian population.
The day after their water cistern was demolished, activists with ISM visited members of the Ashfour family in Abweire in order to talk and survey the damage. The occupation forces did not stop with removing the top of the cistern, but actually smashed the sidewalls, rendering the structure totally useless. The occupation forces came without warning in four jeeps, an armored personnel carrier, an armored bulldozer, and another armored earth-wrecking machine, along with personnel from the Israeli permits and construction offices. They claimed that the cistern was constructed illegally, without the necessary permits, and began to destroy the cistern.
Within an hour the Ashfour family’s hopes for irrigating their crops lay in ruins. According to Hisham Ashfour, the cistern had been built almost ten years ago and served not only his family but about fifty people in his neighborhood. The other cistern destroyed in Abweire was also rendered completely unusable, having been filled in with dirt by an Israeli bulldozer.
Related articles
- International activists assaulted by extreme settlers in Al Khalil (alethonews.wordpress.com)
- Israeli occupation authority destroys Spanish-financed power station in Al-Khalil village (alethonews.wordpress.com)
- Israeli Brutality: Violent arrests of Palestinians in Hebron and disappearance of Dutch volunteer (alethonews.wordpress.com)
- Settler Violence: Broken Glass on Shuhada Street (alethonews.wordpress.com)
- Israeli demolition ‘displaces 120′ in Hebron village (alethonews.wordpress.com)
- Impunity Under the Law: Settler attack in Jabari neighborhood (alethonews.wordpress.com)
- Under Attack – the Golani Brigade’s war on the Palestinian population of Al-Khalil/Hebron (alethonews.wordpress.com)
FAA approves spy drones to fly US skies
Press TV – April 23, 2012
US law enforcement agencies have received the approval of the Federal Aviation Administration (FAA) to use unmanned aircraft known as drones for mass surveillance.
More than 50 non-military organizations within the United States have received approval to fly drones, according to documents obtained via the Freedom of Information Act requests by the advocacy group, Electronic Frontier Foundation.
Major agencies like the FBI, the US Department of Homeland Security and the US Department of Justice had been cleared to launch drones, US President Barack Obama administration’s favorite weapon of war which is being used in countries such as Pakistan, Afghanistan and Yemen.
The Electronic Frontier Foundation civil liberty group warned that the use of drones poses a serious threat to personal privacy.
The documents revealed that individual city police forces are also drawing up plans to use the reconnaissance aircraft.
In February, the US Congress passed a bill which approved the government’s deployment of up to 30,000 spy drones in American airspace by 2020.
The Federal Aviation Administration Reauthorization Act, which President Obama is expected to sign, also ordered the FAA to develop regulations for the testing and licensing of drones by 2015.
According to some estimates, the commercial drone market in the United States will be worth hundreds of millions of dollars. Currently almost 50 companies are developing some 150 different drone systems.
The US has been using the unmanned vehicles for its spy operations and assassination missions worldwide and the strikes have intensified since Obama took office three years ago.
Ex-Palestinian prisoner: captivity in Israel, living in graves
Press TV – April 22, 2012
Interview with former Palestinian prisoner Abdulaziz Umar
“They (Palestinian prisoners) just live in graves and their families do not know anything about them; they’re not allowed to contact their families and they are deprived of everything. Some of them are suffering from handicaps and others are even suffering from psychological problems. Of course they spend all this long time in these dark cells under occupation without having any access to the external world.”
Related articles
- 1,600 Palestinian prisoners begin open-ended hunger strike in Israeli jails (alethonews.wordpress.com)
- Meshaal: We will definitely get our prisoners released (occupiedpalestine.wordpress.com)
- Haneyya: Palestinian prisoners are victims of ferocious Israeli campaign (occupiedpalestine.wordpress.com)
Bahrain: Why Should the Media Care About One Man’s Fast?
By Preethi Nallu | Al Akhbar | April 21, 2012
Bahrain, with a total population of approximately 1.3 million, is smaller than most metropolitan cities in the world. But, over the past week the country has made headlines across global media. The fact that the Formula One Grand Prix is going to be held in the capital Manama this weekend while a majority of the island is besieged by protests, clashes, and arrests has become an ethical quandary with multiple dimensions.
The hunger strike of the country’s most well-known human rights activist, Abdulhadi al-Khawaja has finally “earned” the attention of worldwide media. Despite being in a prison cell, the hunger striker has become the beating pulse of protests in Bahrain, with his photos and posters splashed across the streets and banners calling for his immediate release. After months of torture and 70 days into a painfully prolonged “fast for freedom” al-Khawaja is finally “news.”
But long before the sporting event became an “angle” of focus, al-Khawaja and hundreds of thousands of people in Bahrain have been fighting for greater political rights with sparse attention from the media or the international community-at-large. Geopolitics, sectarian divides, and short attention spans overshadowed grave human rights abuses that have been ongoing for more than one year in Bahrain, without signs of near future reconciliation.
Here are reasons why Bahraini-Danish hunger striker al-Khawaja’s story has always been important, well before he entered this critical phase, where his time is now numbered in days or even hours.
As a man known to practically every household in Bahrain, he commands a mobilizing effect needed to carry on the pro-democracy protests that have been overshadowed by geopolitics involving the US and Iran. The Bahraini regime has taken away an important leader of the revolution because they are simply threatened by his singular presence on the streets that strengthens the voices of more than 70 percent of the population in the country. It is an act of cowardice.
Al-Khawaja has spent his entire adult life advocating for greater political rights for the majority population of Bahrain, starting as a university student in the United Kingdom.
This is not just al-Khawaja’s story. It is also the story of his two activist daughters, son-in-laws, brothers, and wife, all of whom have been persistently targeted by the government and arrested for their dissidence. His story is intertwined with hundreds of thousands of people who have been marching on the streets from Bahrain to London calling for his immediate release. Al-Khawaja’s story illustrates the powerful ties between the Al-Khalifa family in Bahrain and the Saudis, who would like to prevent a similar scenario in Saudi Arabia. The US government, that is in turn close allies with the Saudis, has been unabashedly silent on the issue while simultaneously calling for imminent action on Syria. His story is one that could cause a ripple effect in the Gulf States that continue to stifle protests with unhindered force.
The accusations against al-Khawaja of attempting “to overthrow the Government by force in liaison with a terrorist organisation working for a foreign country” have been unfounded. The “terrorist” organization in question is of course Hezbollah and the foreign country is Iran. The Shias of Bahrain do not wish to see Iranian/Hezbollah influence in their country. They do not wish to have an Islamic theocracy for a leadership. There has been no evidence, whatsoever, of exchanges between al-Khawaja or the February 14th coalition and Iranian/Hezbollah agents.
Al-Khawaja has spent his entire adult life advocating for greater political rights for the majority population of Bahrain, starting as a university student in the United Kingdom. He has been persistently targeted by the government of Bahrain even before he co-founded the Bahrain Center for Human Rights, formed not in Iran or Lebanon, but in Denmark, where al-Khawaja and his family sought political asylum for 11 years. He was repeatedly arrested and beaten for championing human rights and democracy, since his return to Bahrain in 2001, upon an official pardon from the king.
We, as a the media community, remained passive in the face of blatant injustice for a long time.
If the Bahraini government is looking for culpability, they should point toward Copenhagen where he received training as a human rights defender. But since al-Khawaja’s background hardly constitutes grounds for a life sentence based on “conspiring with foreign agents,” the al-Khalifa regime has sought the tried and tested strategy of manipulating sectarian divides. Based on al-Khawaja’s Shia identity and that of at least 70 percent of the population in Bahrain, whose voices have been stifled, they blame the Iranians and their purported aims to create a “Shia Crescent” across the Middle East.
Al-Khawaja must not be allowed to die.
His critical condition has already led to heightened tensions in a country, where protesters have been marching in tens of thousands for his immediate release. His death will lead to irreconcilable anger amongst the protesters who have been promised change again and again, but with no consequence. His death will create a fault line in the movement and minds of the youth who have been met only with resistance to change and oppression without accountability.
We, as the media community, have remained passive in the face of blatant injustice for a long time. We have failed to empower the tens of thousands in Bahrain by highlighting the story of one man’s plight. We have simply stood by until his penultimate moments.
But, It is not too late for us to look beyond the simple appeal of al-Khawaja’s hunger strike and render greater meaning to his struggle. We must learn to better decipher the current state of affairs in the Island Kingdom of Bahrain and the larger picture of how it affects the Gulf and beyond. We must maintain the momentum.
Preethi Nallu is a print and broadcast journalist with a special focus on human rights issues.
Related articles
- Another Bahraini killed by poisonous tear gas (alethonews.wordpress.com)
Proposed Amendments to #CISPA Don’t Protect Privacy
By Michelle Richardson | ACLU | April 19, 2012
Yesterday, the House Intelligence Committee released proposed changes to the Cyber Intelligence Sharing and Protection Act of 2011, also known as CISPA that, according to its sponsors, represent “huge progress” towards addressing the privacy and internet freedom community’s concerns.
But, many privacy advocates, including the ACLU, and groups including the Center for Democracy and Technology, Free Press, the Electronic Frontier Foundation and the Constitution Project still maintain their opposition. The changes are so underwhelming that even the Obama administration issued a statement yesterday that their privacy concerns persist.
Here are some of the main problems with CISPA:
1. CISPA still allows companies to share lots of sensitive and private information about our internet use with the government. The proposal amended the definition of what could be shared by taking out its explicit reference to stealing “intellectual property.” But it still allows the sharing of Internet use records or the content of emails for “cybersecurity purposes” and unlike proposals drafted by Sens. Joe Lieberman and Dianne Feinstein or the Obama administration, CISPA does not require companies to even make an effort to remove information that could be tied to a specific individual.
2. CISPA still lets military agencies such as the National Security Agency directly collect the Internet records of American citizens who use the public, domestic, civilian Internet. The proposed changes state that the Department of Homeland Security should be cc’d when companies share our private details with the military and others, but this is no substitute for ensuring that a civilian agency is put in charge of collecting Americans’ information.
3. CISPA still lets the government use the private information it collects about us for any purpose it deems fit outside of regulation. For four months, the draft bill has remained the same: the government can use information collected under this broad new program for “any lawful purpose” so long as a “significant purpose” of its use is a cybersecurity or national security one. But as former federal and FISA court judge James Robertson said at a congressional briefing this week, this “significant purpose” limitation is meaningless. The Patriot Act inserted this language into our foreign intelligence surveillance laws, and since then, in Judge Robertson’s words, they’ve had a “hole you could drive a truck through.”
Hard to see the progress here.
CISPA is still expected to hit the House floor for “Cybersecurity Week” next week. You can find out more about the bills in this memo, and more importantly, help us spread the word on Twitter and write to your Member of Congress today. Let Congress know that in spite of the minor changes floated by the House Intelligence Committee, you still oppose CISPA.
Related articles
- The Disturbing Privacy Dangers in CISPA (alethonews.wordpress.com)
- Worse than SOPA? CISPA to censor Web in name of cybersecurity (alethonews.wordpress.com)
- 5 Reasons the CISPA Cybersecurity Bill Should Be Tossed (techland.time.com)
- CISPA Lacks Protections for Individual Rights (usnews.com)
- Week of Action Against CISPA Begins, But Don’t Expect Web Blackouts (mashable.com)



