Congress is doing it again: they’re proposing overbroad regulations that could have dire consequences for our Internet ecology. The Cyber Intelligence Sharing and Protection Act of 2011 (H.R. 3523), introduced by Rep. Mike Rogers and Rep. Dutch Ruppersberger, allows companies or the government free rein to bypass existing laws in order to monitor communications, filter content, or potentially even shut down access to online services for “cybersecurity purposes.” Companies are encouraged to share data with the government and with one another, and the government can share data in return. The idea is to facilitate detection of and defense against a serious cyber threat, but the definitions in the bill go well beyond that. The language is so broad it could be used as a blunt instrument to attack websites like The Pirate Bay or WikiLeaks. Join EFF in calling on Congress to stop the Rogers’ cybersecurity bill.
Under the proposed legislation, a company that protects itself or other companies against “cybersecurity threats” can “use cybersecurity systems to identify and obtain cyber threat information to protect the rights and property” of the company under threat. But because “us[ing] cybersecurity systems” is incredibly vague, it could be interpreted to mean monitoring email, filtering content, or even blocking access to sites. A company acting on a “cybersecurity threat” would be able to bypass all existing laws, including laws prohibiting telcos from routinely monitoring communications, so long as it acted in “good faith.”
The broad language around what constitutes a cybersecurity threat leaves the door wide open for abuse. For example, the bill defines “cyber threat intelligence” and “cybersecurity purpose” to include “theft or misappropriation of private or government information, intellectual property, or personally identifiable information.”
Yes, intellectual property. It’s a little piece of SOPA wrapped up in a bill that’s supposedly designed to facilitate detection of and defense against cybersecurity threats. The language is so vague that an ISP could use it to monitor communications of subscribers for potential infringement of intellectual property. An ISP could even interpret this bill as allowing them to block accounts believed to be infringing, block access to websites like The Pirate Bay believed to carry infringing content, or take other measures provided they claimed it was motivated by cybersecurity concerns.
The language of “theft or misappropriation of private or government information” is equally concerning. Regardless of the intent of this language, the end result is that the government and Internet companies could use this language to block sites like WikiLeaks and NewYorkTimes.com, both of which have published classified information. Online publishers like WikiLeaks are currently afforded protection under the First Amendment; receiving and publishing classified documents from a whistleblower is a common journalistic practice. While there’s uncertainty about whether the Espionage Act could be brought to bear against WikiLeaks, it is difficult to imagine a situation where the Espionage Act would apply to WikiLeaks without equally applying to the New York Times, the Washington Post, and in fact everyone who reads about the cablegate releases. But under Rogers' cybersecurity proposal, the government would have new, powerful tools to go after WikiLeaks. By claiming that WikiLeaks constituted “cyber threat intelligence” (aka “theft or misappropriation of private or government information”), the government may be empowering itself and other companies to monitor and block the site. This means that the previous tactics used to silence WikiLeaks—including a financial blockade and shutting down their accounts with online service providers—could be supplemented by very direct means. The government could proclaim that WikiLeaks constitutes a cybersecurity threat and have new, broad powers to filter and block communication with the journalistic website.
Congress is intent on passing cybersecurity legislation this year, and there are multiple proposals in the House and the Senate under debate. But none is as poorly drafted and dangerously vague as the Rogers bill. We need to stop this bill in its tracks, before it can advance in the House and before the authors can negotiate to place this overbroad language into other cybersecurity proposals.
Internet security is a serious problem that needs to be addressed. But we don’t need to sacrifice our civil liberties to do so. Help us safeguard the web by contacting Congress today.
Mike Rogers e Dutch Ruppersberger hanno proposto al Congresso degli Stati Uniti un disegno di legge volto a prevenire gli attacchi informatici ai siti Internet e "ad altri scopi". Il ''Cyber Intelligence Sharing and Protection Act'' (CISPA) autorizzerà soggetti privati a monitorare il traffico Internet e le comunicazioni private dei cittadini americani, su richiesta del governo, aggirando le leggi che sono attualmente in vigore.

Kendall Burman, del ''Center for Democracy and Technology'', intervistata a Russia Today, afferma che «La sicurezza in Rete, quando fatta bene e in modo ristretto, può dare benefici a tutti; ma ciò essere fatto in modo incrementale ... e l'approccio oppressivo che stanno adottando con queste leggi ... dà luogo a problemi veri e seri».

Secondo la Electronic Frontier Foundation, «il linguaggio del CISPA è così generico che potrebbe essere interpretato in modo da consentire agli Internet Service Provider (ISP) e a società come Google e Facebook di intercettare i tuoi messaggi e trasmetterli al governo». Anche la protezione di «informazioni private o governative» e di «informazioni personalmente identificabili», secondo EFF, rischia di portare alla chiusura siti come WikiLeaks, i quali attualmente sono protetti dal Primo Emendamento, che garantisce libertà di parola. In aggiunta, rileva la EFF, tra gli obiettivi dichiarati del CISPA c'è anche la lotta all'appropriazione non autorizzata di materiale coperto da proprietà intellettuale, riproponendo con una veste diversa lo scopo dello Stop Online Piracy Act già ritirato al Congresso, e autorizzando anche in questo caso le pratiche come il blocco delle utenze private e l'oscuramento dei siti.

Tra le società che si sono dichiarate favorevoli all'approvazione del disegno di legge, spiccano Facebook, IBM, Intel, Microsoft, Oracle, Verizon.. La legge prevede l'immunità per le società che collaborano nel raccogliere e nel comunicare al governo americano le informazioni richieste.

Come riportato da Wired, la National Security Agency americana sta già costruendo un complesso da 2 miliardi di dollari, destinato alla raccolta delle informazioni, noto come ''Utah Data Center''. Si prevede che entrerà in funzione nel settembre 2013.

Desta stupore anche la tempistica: proprio in questo periodo, il governo britannico sta valutando una legge che, se approvata, autorizzerebbe il monitoraggio delle comunicazioni online dei privati cittadini, come le e-mail e le telefonate, con lo scopo dichiarato di aumentare le informazioni a disposizione contro la criminalità.