Senator Exploits JP Morgan Data Breach to Push Surveillance Bill

The hackers who stole
information from
76 million households and 7 million businesses aren’t the only
ones exploiting people in the JP Morgan Chase security breach.
Politicians are, too.

Sen. Angus King (I-Maine), who sits on the Senate Intelligence
Committee, issued a
statement pushing for some government action:

This terrible news only further underscores the urgent need for
Congress to pass comprehensive cyber security legislation. …
Congress must work to pass legislation that will improve our
capabilities and protect us against more attacks like these. The
next Pearl Harbor will be cyber, and shame on us if we’re not
prepared for it. We have a bi-partisan bill teed up in the Senate
and I’d like to see it move before the end of the year.

That bill is the
Cybersecurity Information Sharing Act (CISA).

Earllier this year, a broad coalition of about two dozen
organizations, including the National Coalition Against Censorship
and the National Whistleblower Center,
signed a letter to congressional leaders earlier this year
explaining why this bill has little to do with cybersecurity and
more to do with prosecuting whistleblowers, curtailing people’s
online privacy, and making government less transparent.

The Electronic Frontier Foundation
notes that this is just latest iteration of unpopular
“cybersecurity” bills (like CISPA and SOPA) that lawmakers have
been pushing for the last four years, and points out some serious
problems:

The bill authorizes companies to launch countermeasures for a
“cybersecurity purpose” against a “cybersecurity threat.”
“Cybersecurity purpose” is so broadly defined that it means
almost anything related to protecting (including physically
protecting) an information system, which can be a computer or
software. The same goes for a “cybersecurity threat,” which
includes anything that “may result” in an unauthorized effort to
impact the availability of the information system. Combined, the
two definitions could be read by companies to permit attacks on
machines that unwittingly contribute to network congestion. The
countermeasures clause will increasingly militarize the Internet—a
prospect that may appeal to some “active defense” (a.k.a.
offensive) cybersecurity companies, but does not favor
the everyday user.

Second, the bill adds a new authority for companies to monitor
information systems to protect an entity’s rights or property. Here
again, the broad definitions could be used in conjunction with the
monitoring clause to spy on users engaged in potentially innocuous
activity. Once collected, companies can then share the information,
which is also called “cyber threat indicators,” freely with
government agencies like the NSA.

The American Civil Liberties Union
adds that CISA would esentially “circumvent the warrant
requirement [of the Fourth Amendment] by allowing the government to
approach companies directly to collect personal information.”

[Hat tip:
Techdirt, Mike Masnick]