Who Needs CISPA? FBI Has a Non-Profit Workaround
nonprofiteer writes "What has been left out of the CISPA debate thus far is the FBI's long time workaround for information sharing with private industry: 'In 1997, long-time FBI agent Dan Larkin helped set up a non-profit based in Pittsburgh that "functions as a conduit between private industry and law enforcement." Its industry members, which include banks, ISPs, telcos, credit card companies, pharmaceutical companies, and others can hand over cyberthreat information to the non-profit, called the National Cyber Forensics and Training Alliance (NCFTA), which has a legal agreement with the government that allows it to then hand over info to the FBI. Conveniently, the FBI has a unit, the Cyber Initiative and Resource Fusion Unit, stationed in the NCFTA's office. Companies can share information with the 501(c)6 non-profit that they would be wary of (or prohibited from) sharing directly with the FBI.'"
who needs laws in a country ruled by money?
Isn't this pretty obvious? I'm sure if you went into the Address Book of any CIO, they would have the cell phone and e-mail for the other CIOs. And it proves that CISPA is worthless, a waste of time, a distraction, and I want a refund of the salaries of elected officials wasting their time on this bill.
sudo make me a sandwich
So this whole CISPA thing is just an inter-agency turf war?
Private organizations and citizens can collect evidence that the police cannot due to legal restrictions. This is not news. However, sharing with a non-profit can still violate contractual agreements; This is what CISPA aims to kill, along with the notion that companies can refuse until a warrant is served. By removing all risk, law enforcement can just look at a company and say "Gee, that's a really nice data center you have there. A shame it would be if we had to search it for drugs..." And viola, instant and total compliance -- company lawyers can no longer say there's a liability, so even the slightest coerceion makes surrendering the data the right business move.
#fuckbeta #iamslashdot #dicemustdie
So basically the protesting is all for naught because the same sharing is already happening and has been for years. I'm sure the chicken littles will waste little time downmodding me because I disagree with them.
Say the letters, and know what they were thinking...
I am afraid that we have moles in our company, Consolidated Blacksheep LLC, that are feeding infornation on our illegal activities in bid-rigging, international bribery for market position, political fixing, governmental espionage, and all around dirty deeds done dirt cheap. This information, in the right hands, could have a material effect on our profitability. Can you check to see if there is indeed such activity going on? Mr. Cayman Islands, heh, would like to meet with you.
signed,
CEO
if this is supposed to be a new economy, how come they still want my old fashioned money?
I love to hear people complain about how corrupt and hopeless government is. And then do nothing about it.
Sure, you can't get your politicians to fix it for you because they are the problem.
So why aren't more people working on getting rid of the politicians. It is a long and difficult road, but... what precisely is the alternative?
Interesting to think about whether the Fourth Amendment applies here. The Fourth Amendment only protects us from government action. This non-profit would be considered a private person, whom are only covered when they are acting in their capacity as an agent of the government. This is determined by the level of government involvement in the situation and the totality of the circumstances. I'm not a lawyer, but based on the facts here it seems like this non-profit would be considered an agent of the government, and therefore you may not be able to sue them for money damages, but the material they collect probably cannot be used as evidence in a crime.
There has been a crazy boom in contracting out U.S. intelligence work in the last ten years. And hey, they even contract out their torturing to other countries. So why not contract out their rape of the 4th Amendment too?
What political party do you join when you don't like Bible-thumpers *or* hippies?
First off .... If you're claiming to be a professional service, make sure your formatting is correct in EVERY BROWSER! (I hate that)
Now, I'm really trying to find out legally how they can do this, since they claim to be getting 'network data', and not 'personally identifiable information' from private industry, and being the conduit of that to Agecies of interest.
Non-profit? It started in 1997. Ok. Do a full IRS audit on every member from that point forward to confirm said 'Non-profit' status. Anyone want to take the over under on that outcome?
and therefore you may not be able to sue them for money damages,
And since they are a non-profit, there's probably nothing you can sue them for in a civil case either. They'll just declare bankruptcy and open under a different name.
And you can't sue the private entities behind NCFTA, because that communication is protected as free speech.
Have gnu, will travel.
So they're going to exploit a legal loophole to violate the intent of the law.
This is truly a sad thing to hear. Hopefully a court will rule that this is expressly illegal and revokes the charitable status -- this is just doing an end-run around the law.
Brilliant, we'll set up a charity which can be used to facilitate giving data to the FBI they'd otherwise be legally prevented from having.
Very sad. How do those freedom fries taste, guys?
Lost at C:>. Found at C.
Smell the Freedom (tm)?
.
.
.
Nope, me neither.
If FedGov was honest (HA!), they'd just drop the pretense of all their lofty oaths. "Protect and defend the Constitution, yadda-yadda, rutabaga, rutabaga, rutabaga...."
This FBI/Private Non-Profit is no more legal then what the NSA has been doing, and its why they want to pass CISPA: it legalizes warrantless wiretapping.
Now that it's undeniable the government hasn't been obeying it's own laws for a decade, they have to either make it legal or face political consequences. Political consequences because, while people don't really care, they can no longer deny it, and they can't ignore it forever. A decade of massively illegal activity (unconstitutional!) must eventually be acknowledged and condemned by the average person.
It's like the US Internment camps for Japanese citizens during WWII -- the government gets a decade long 'free pass' to do whatever, then we either make it legal or fix it.
tomorrow who's gonna fuss
I've run into the issue before where I've found phishers actually signed up to our service (rather than utilising hacked accounts), and I've been unable to share their billing information despite the high probability that they include stolen credit card information. The reason why this is awesome isn't because law enforcement can't or shouldn't get a search warrent for this sort of thing, but rather because its so completely difficult to get law enforcement to take hacking/phishing/online crime seriously that I don't see any police officer actually getting a search warrent for a phishing site ever. It's nearly impossible to even get them to take a report. ("So the victim is outside our juristiction/The perpetrator is outside our jurisdiction/etc").
It would be more useful however to have congress address the real problem however, and figure out a way that the average system administrator can actually get a police report filed when an online crime is committed.
In the end, that basically describes worldwide communism.
From TFA:
As part of a non-profit, Plesko could not comment specifically on CISPA, which would, as currently drafted, allow companies to share much richer and more individualized data directly with the government. “We get network data,” says Plesko. “Not PII (personally identifiable information).”
That means the NCFTA can pass along information, for example, about suspicious servers or IP addresses and content from spear-phishing emails that companies are seeing in their networks, but not the names or addresses of those who appear to be affiliated with the schemes.
If NCFTA is restricting itself to data like that, I have no problem with it. Problem is, without oversight we can't be sure they really are restricting themselves to that.
I'd like to see privacy-by-default become the norm with personal data. Right now the default is usually "we can share your data arbitrarily unless you opt out, and you have to renew the option every time we change our privacy policy or it goes back to share-with-anyone".
Which is wonderful for the businesses, but sucks for users.
To a Lisp hacker, XML is S-expressions in drag.
See How Less Government = More Government
"One empirical experiment is worth a thousand expert opinions." --Bill Nye, the Science Guy
http://www.bloomberg.com/news/2012-04-26/wall-street-tracks-wolves-as-may-1-protests-loom.html This post reminds me of this article. The banks are doing the investigations and identifying people who they feel may be a threat and passing the information on to police. I guess it's totally legal for them to do this, but if you were arrested for a crime, would your conviction be based on evidence gathered by police or by the "firms"?
Namaste
We do the same thing at work, we hand off information of users whose files match md5 sums of known child porn to a non-profit that works with law enforcement. People don't realize anytime you use a cloud service provider, good change those files are scanned not just for viruses but for illicit content.
Does your phone auto-backup its content?
Is legal, and don't tell me that none of you would use them to your advantage f you could. If you say you will, you are either lying or deluded.
The key is that they are LEGAL..
---- Booth was a patriot ----
The FBI's Non-Profit is a model for US Treasury owned and run prostitution which goes by the monkeyer "information sharing".
How many of the FBI brothels (male and child prostitutes and otherwise) has Obama enjoyed as US President?
LoL
Yes a LoL crying shame that the CEO of the White House is a sex pervert like Tiger Woods.