Given that recent experience has shown companies shielded by secrecy often err on the side of oversharing with the government, that loophole was a key concern. So why the gap between what the law permits and its supporters’ aims?
It’s a principle wonks call tech neutrality. Nobody wants to write a bill that refers too specifically to the information needed to protect current networks (like “Internet Protocol addresses” or “Netflow logs”) since technological evolution would render such language obsolete over time.
Unfortunately, the alternative has been to extend a broad, vague immunity for sharing and attach a series of back‐end restrictions designed to prevent misuse.
Fortunately, there’s a better way: A law embodying three simple principles could permit all the sharing that’s actually useful for security purposes … without compromising privacy.
Respect Contractual Agreements With Users
CISPA’s broad immunity effectively overrode contractual promisesnot to share particular types of data. A more limited immunity would not only create space for diverse users and companies to determine what degree of information sharing they find acceptable, it would also compensate for the vagueness inherent in CISPA’s broad tech neutral definitions.
Instead of creating an indiscriminate loophole, a new and improved CISPA should establish immunity from state and federal criminal statutes that limit information sharing by communications service providers — but require the companies to “opt in” to the protection by giving users more specific details about the categories of information they intend to share.
This approach leaves the statutory definitions flexible enough to deal with evolving technology, but guarantees users will have clear notice of what companies plan to share and advance warning if some seem disposed to overshare. Companies would then have some market incentive not to disclose more than is really necessary for security purposes, and users would retain a legal mechanism to punish companies that break their own privacy promises.
Strip Out Personal Information From Shared Data
Companies — not the government — should be responsible for stripping out personal information from their data before it’s shared, as they’ve already said they’re perfectly capable of doing. There’s no need to share such data for security purposes anyway: Kevin Mandia, head of the cybersecurity firm Mandiant, insisted at a February hearing on CISPA that in 20 years in the industry, he had “never seen a package of threat intelligence that’s actionable” that included personally identifiable information.
Of course, some kinds of theoretically anonymous information — such as IP addresses — are useful for security but also capable of being tied back to individual users if linked with other databases.
To ensure that anonymous data stays anonymous, the law should limit the sharing of raw data to a designated civilian agency, like the Department of Homeland Security, and ensure that only aggregate information or derivative analyses are subsequently shared with entities like the National Security Agency, whose vast trove of data might allow them to tie numbers to names.
Erase the Data
Information shared with the government should come stamped with what geeks call time‐to‐live (TTL), a marker that tells a computer system when a particular packet of data should be automatically erased.
The primary purpose of information sharing is to provide a real‐time early warning system that could detect patterns suggesting an impending attack before it happens. But that data has little practical use a week or two after the fact — which means there’s no legitimate cybersecurity purpose served by retaining it longer than that.
When particular types of data are needed for longer — the government begins a criminal investigation into an attack, for instance — current law gives law enforcement ample recourse. They already have the power to issue “preservation orders” requiring private companies to hang on to data that may be useful in an investigation, data which can then be obtained using traditional tools like subpoenas and court orders. And victims of an attack (as opposed to their internet provider) can already share data without such restrictions.
Mandating a TTL for CISPA‐shared information avoids what is probably the central civil concern about the law: that it would lead to the creation of a vast database of detailed information about internet activity — one that would eventually tempt the government to use it for other purposes.
***
With these features, new legislation would achieve all the essential aims of CISPA’s sponsors — while leaving civil libertarians with little to object to.
That lawmakers haven’t already simply incorporated such safeguards suggests that perhaps they, too, have fallen victim to zero‐sum thinking about privacy and security, wrongly assuming that less of the former automatically yields more of the latter.
The sooner they — and we — recognize that fallacy, the sooner Americans can get legislation that protects both.