Netflix Could Be Classified As a 'Cybersecurity Threat' Under New CISPA Rules

Jason Koebler (3528235) writes "The cybersecurity bill making its way through the Senate right now is so broad that it could allow ISPs to classify Netflix as a "cyber threat," which would allow them to throttle the streaming service's delivery to customers. "A 'threat,' according to the bill, is anything that makes information unavailable or less available. So, high-bandwidth uses of some types of information make other types of information that go along the same pipe less available," Greg Nojeim, a lawyer with the Center for Democracy and Technology, said. "A company could, as a cybersecurity countermeasure, slow down Netflix in order to make other data going across its pipes more available to users.""

Comments

Throttling = "less available"?

[Anonymous Coward]

Wouldn't throttling Netflix count as making Netflix "less available," thereby making the ISPs themselves a "cybersecurity threat?"

Re: Throttling = "less available"?

[O('_')O_Bush]

Yea, but an ISP isn't going to classify itself as a cyber security threat to itself and then throttle itself.

Re:Throttling = "less available"?

[ganjadude]

error ERROR!!!!

Re:Throttling = "less available"?

[aix tom]

Hey, it gets even more fun.

DMCA = Congress = "making information less available" = Cyber-security threat.

So when do the drones start bombing congress?

Re: Throttling = "less available"?

[davester666]

I'm sure there are plenty of people willing to drop by the ISP headquarters and spend 15-30 minutes throttling the CEO. For free.

Re:Throttling = "less available"?

[Jeremy Erwin]

Not if it interferes with the mission critical aspects of the network, such as the ISP's video on demand products.

Re:Throttling = "less available"?

[djdanlib]

I did this to a former roommate as well. He would have HD videos (Netflix, Youtube, etc) streaming on his computer AND game consoles at the same time, while he was uploading videos he was editing and downloading games and stuff like that.

Re: Throttling = "less available"?

[rtb61]

The question then who is the claim of cyber security threat limited too. Can the end users launch a mass claim of cyber security threat by the ISP for throttling and censoring the data from to those affected individuals. "any action that may result in an unauthorized effort to adversely impact the security, confidentiality and availability of an information system or of information stored on such system. Countermeasures can be employed against such threats absent risk of liability." So I as the end user can claim that the ISP interfered with my right to access data without specific authorisation (a blanket authorisation would have to be illegal, as the contract would be contradictory, we agree to supply you something except when we supply you nothing, you can write it down but it will fail in court). Forcing the ISP to seek approval each and every time they take any action to throttle or censor data without express authorisation to throttle or censor that data. So you can legally hack the ISP absent the risk of liability, youch, that's a bit strong. Class action law suite time.

Re: Throttling = "less available"?

[Keyboard Rage]

Please stop promoting anti-ISP terrorism.

I guess my ISP is a threat

[Y-Crate]

Pretty sure Time Warner is great at making "information unavailable or less available".

Re:I guess my ISP is a threat

[lagomorpha2]

Pretty sure Time Warner is great at making "information unavailable or less available".

You should throttle your connection to them.

Wait...

What a coincidence!

[Anonymous Coward]

Politicians write a bill for our "safety" and "protection" that just so happens to benefit major campaign contributors!

Wow! I tell you, some of the random things that just happen!

no, it's not true

[YesIAmAScript]

According to the bill a threat is anything which is anything which is part of an unauthorized effort to deny access. Netflix streaming which inadvertently leads to a denial of access would not be part of an effort to deny access.

Here is the bill.

http://www.feinstein.senate.go...

Re:no, it's not true

[camg188]

Key words seem to be:
"an action, not protected by the First Amendment"
and "unauthorized".

Some clarification would be nice, but Netflix is protected by the first amendment.
Not sure exactly what they mean by "unauthorized", but I'd bet that Netflix is in compliance with the Digital Millennium Copyright Act (DMCA).

Re:no, it's not true

[niftymitch]

According to the bill a threat is anything which is anything which is part of an unauthorized effort to deny access. Netflix streaming which inadvertently leads to a denial of access would not be part of an effort to deny access.

Here is the bill.

http://www.feinstein.senate.go...

Thanks for the link....
I think Feinstein is missing a detail.
A better approach might be to reserve bandwidth for demand use by state
and local government. Sure this is a glass half full/ half empty thing but
it is important to identify what services we wish to protect from denial of
service.

I have not checked the math and details but "sbrook" on a forum noted:
"Remember that through that same cable you have to push a lot of TV channels and
Radio channels, Digital phone and internet.

"The top frequency is about 900 MHz, so that gives you just shy of 1500 channels
times 42 Mbps would be the theoretical max down a single coax ... absolutely
stunning! But you've got to share upstream channels.

"Now depending on the company, you might have about 100 to 500 customers passed
by a single coax. (More TV etc channels, few customers) But in theory you could
have 600,000 customers on one coax ... wouldn't work too well though!"

My point is the cable providers give themselves almost 1500 channels to deliver their content
and only eight or so for other content providers like Netflix.

A law needs to look at the 1500 channels as a single pool and if bandwidth is
to be throttled the eight that the likes of Netflix use can only be throttled
if the 1500-(8+4) used by my provider for their content are throttled in a like
manner.

Yes behind the cable is optical and other hardware but no one discusses
the fundamental lack of cross sectional bandwidth possibilities that modern
network provides. All conversations are centered on the one to many service
model where the internet design was many to many with multicast tossed
in later for the one to many case.

This single minded power centric ego centric flawed thinking by regulators
and legislators needs to be changed (by education) and IMO is
at the heart of most of the stupidity we see.

Re:no, it's not true

[radarskiy]

Read the actual bill? That's crazy talk!

Re:no, it's not true

[AK Marc]

So ordering Netflix is "unauthorized", and using your connection you paid for to access services is an "effort" to deny access? Netflix doesn't attempt to deny anything, and exerts no effort to do so, and the data from it is "authorized", in that it's as intended as any other data. Unless the data is 100% Netflix, then you could just as easily assert the HTTP is the cyberthreat. Arbitrarily picking a "competitor" to be the threat is absurd, and hopefully the first judge this makes it in front of will recognize such.

Re:no, it's not true

[kwbauer]

Feinstein is generally missing a whole bunch of details...

If Netflix, then DRM too

[NotInHere]

DRM also makes "information less available". Finally a bill that makes EME, HDCP and alike illegal!

Re:If Netflix, then DRM too

[grahammm]

As do territorial rights/restrictions - you cannot access this information because of where you are (or where geolocation of your IP address thinks you are). Or "we do not support the browser/OS you are using.

Do your worst!

[itsenrique]

I have a cheap Time Warner "High Speed" Lite connection. My Netflix is already so throttled I literally do not beleive a lower quality stream is possible.

Re:Ob

[ganjadude]

or XBMC anyway

Re:Ob

[Runaway1956]

CISPA was authored by corporations, for the purpose of reigning in "pirates" and the like. Every "rights holder" in the world will become partners with the government, and search out any of us who don't comply with every draconian rule they can think up.

CISPA is most definitely unconstitutional.

Or just cancel.

[skogs]

I just canceled my subscription. Had it since 2006. When I called to complain that my Wii, my Roku, and my computers were having trouble...in addition to them not having a Linux client...they told me to contact my ISP so that they could 'speed it up'. I have a commercial line...and every other streaming service in full HD works just fine. They refused to open up a ticket to have it looked into, so I cancelled.

I give zero @#'s about their problems.

Re:Or just cancel.

[king neckbeard]

You do realize that the problem you experienced was likely due to your ISP refusing to do the proper upgrades so they could either extort Netflix for your business or pitch their own to you, right?

Re: Or just cancel.

[skogs]

Actually they did reach an agreement with the provider a couple months ago. That is actually when it got worse, not better.

Re: Or just cancel.

[skogs]

Not Verizon.

We Have to Start Thinking Around Them

[phmadore]

Okay then, Google and the rest should be saying: we'll find a way to directly hook into the home as if this were the early days and we owned everything except the dirt we buried the cables in though sometimes we own that too. Silicon Valley needs to grow up and swing its weight. A tax protest from just a few major corporations would be costly, and if they encouraged their employees to join, the impact would be ten fold. It's time we got together and, as a people, told the government it is not taking another step without our damn permission.

Re:We Have to Start Thinking Around Them

[camg188]

Isn't that what elections are for? Your suggestion is just a small group of people (some of whom may not even be US citizens who can vote) throwing a tantrum until they get what they want.

Re:We Have to Start Thinking Around Them

[westlake]

Google and the rest should be saying: we'll find a way to directly hook into the home as if this were the early days and we owned everything except the dirt we buried the cables in

In the early days, ca. 1880, the telephone company owned the phone and the wire.

At least one local telephone exchange in the Northeast began experimenting with phonographic music-on-demand over the lines about ten years later.

The courts began looking at the use of the public airways for paid subscription services no later than the 1920s. Then and now such services were regarded by the courts as far too useful to be compromised by the cheap and the greedy.

Then and now the courts have had no trouble whatever assigning different rights to the energy which falls from the sky and the information it may carry.

Re:We Have to Start Thinking Around Them

[mrbester]

That's a whole new aspect to contention ratio when you can't hear Irving Berlin's "Always" because they don't have enough phonographs / copies free...

Re: We Have to Start Thinking Around Them

[wpgsteve88]

Why do you think that one politician is any more honest than the next? Politicians represent the PARTY not you.

Re: We Have to Start Thinking Around Them

[NotSanguine]

Why do you think that one politician is any more honest than the next? Politicians represent the PARTY not you.

An honest politician is one who, when he is bought, will stay bought.

--Simon Cameron

Re: We Have to Start Thinking Around Them

[camg188]

You are advocating that "a few major corporations" tell the government what to do.
Which corporations get to pick the agenda? Just the ones that do no evil? What is your recourse if you don't happen to agree with these few major corporations?
Wouldn't be a better idea, for the sake of each individual citizen's rights, to take all the effort expended on a tax protest and use that to promote a candidate, educate the electorate and convince them to vote for them?

Besides, I agree with Otter about protests, "I think that this situation absolutely requires a really futile and stupid gesture be done on somebody's part."

Re: We Have to Start Thinking Around Them

[phmadore]

When you look at it, my position makes the most sense out of what is being said around this issue. There is a minority (the cable providers) effecting decisoins for the majority (everyone else, from Google to Netflix). The majority should simply protest this and the government won't be left with a choice.

Re: We Have to Start Thinking Around Them

[NotSanguine]

When you look at it, my position makes the most sense out of what is being said around this issue. There is a minority (the cable providers) effecting decisoins for the majority (everyone else, from Google to Netflix). The majority should simply protest this and the government won't be left with a choice.

You actually think the people have any say in our government? That's so adorable!

It's actually not a bad idea, but you're operating under the misconception that our politicians aren't honest (see my previous post). They will stay bought and will ride that gravy train as long as they can. Which means that unless you're willing to buy out our elected "representatives" in the federal, state and local governments as well as the corporate lackeys running the regulatory agencies, we're out of luck.

Wow. That sounds really cynical doesn't it? Perhaps I've lost perspective. I hope I have, because the alternative is that we're all penned up waiting to be sucked dry by our corporate overlords. I, for one, do not welcome our corporate overlords.

Re: We Have to Start Thinking Around Them

[phmadore]

Hey man, at least you're not under the impression that any of this is more than the impulse of men with a bit less intellect than those reading this forum... I'm not operating under assumptions, no matter what you say. :P

Re: We Have to Start Thinking Around Them

[NotSanguine]

Hey man, at least you're not under the impression that any of this is more than the impulse of men with a bit less intellect than those reading this forum... I'm not operating under assumptions, no matter what you say. :P

I guess I'm just much more easily amused than you are. Or maybe it's that perspective thing again.

Re:Ob

[phmadore]

Yeah for real. I have Netflix and I use it now and then with netflix-desktop, which is pretty nice if you ask me, but all things being equal, you can always just install QtWeb, block everything, and hit up TPB on a daily basis. It's a waste of time trying to have morals in a situation where even when you pay what you're supposed a third party thinks it has the right to stop you.

Interesting

[ItMustBeEsoteric]

Wouldn't, by doing this, the ISPs also meet the same definition of "cyber threat," as they are making data "less available"? I certainly hope so. :-P

it's not not an effort

[YesIAmAScript]

"that may result in an unauthorized effort to adversely impact the security, availability, confidentiality, or integrity of an information system or information that is stored on, processed by, or transiting an information system."

It's not an effort (authorized or unauthorized) to adversely impact any of those things. It is an effort to deliver video.

You changed "effort" to "impact". You're changing the meaning of the sentence.

If someone were to hijack Netflix' traffic to create an effort to deny service, then that would be a denial of service attack and ISPs could counter that, as ISPs already counter DoS attacks.

politician + technician == ??

[kermyt]

Politechnician? Re-Engineering the internet for political reasons.

Re:Ob

[niftymitch]

CISPA was authored by corporations, for the purpose of reigning in "pirates" and the like. Every "rights holder" in the world will become partners with the government, and search out any of us who don't comply with every draconian rule they can think up.

CISPA is most definitely unconstitutional.

Freedom of speech implies freedom to listen. Since there are more listeners than speakers
the value of "listener" needs to be strongly considered in all of this.

Manipulation of bandwidth to listeners as a whole must be even handed.
If a content delivery company __Your_Cable_Company__ does not throttle
their content in the same way they throttle the likes of Netflix, HBO-Go, NBC,
etc. they are crossing a line I do not want crossed.

If they throttle content because of a phone call from a branch of the government
we have a larger problem!

There are technologies that can help. Much content from Netflix and others
has a large audience and is ideal for p2p caching and bandwidth boost in
the same way that bittorrent amplifies the bandwidth of a single seeding
site. My DOCSIS 3 modem is an eight down four up device and could host
a p2p caching service that amplifies the cross sectional bandwidth of my
cable service. Xfinity is already selling "spare bandwidth" as WiFi connectivity.

My digital TV recorder and decoder uses different channels
and different tricks to deliver on demand and live content. It is already one
of the most serious power consumers in the house and could be replaced by
a more power efficient unit that also has p2p caching abilities that utilize the
multi channel bandwidth of cable coax a couple fold locally and orders of
magnitude better in a community.

Sadly they are looking for a political power grabbing solution and not
at a more net neutral technical solution.

Threat? I got 'yer cybersecurity threat.

[Anonymous Coward]

Dear Sen. Feinstein, please don't hand-wave "cybersecurity" when what we all know what you really mean here is "Anti-trust exemption for (some, so-called, Wall St.) ISPs", and finally ramming home CISPA. "Cybersecurity" is not just a magic buzzword you get to use to sanction whatever policital scam you happen to be pulling at the moment.

IETF and network operators require RFC's, not legislation. Please leave the engineering to the engineers, and the security, as well.

Thanks for listening, and good luck with your next election.

Another 'thin edge of the wedge' moment.

[Mr307]

I have not read all the comments or the FA, but my knee jerk thinking is this is another in a long history of 'thin edge' moments.

So many negative and 'unforeseen' consequences would follow something like a law including wording of a 'cyber threat', once the framework is in place allowing things to be classified a such, the whole game changes to what is or isn't a cyber threat, and the root problem(the law) is forgotten. Much like what happened with DMCA, Patriot Act and so much more.

Its been my experience that the 'internet' takes care of itself and when there are attacks we all find ways to fix them and don't need a law to 'help' with doing that.

What do you think?

Re:That's your argument.

[tepples]

If it's not intentional, I don't see how it's "effort".

Re:Ob

[fustakrakich]

...p2p caching...

Not a good idea if there are caps on your service. The one and only solution is to elect politicians who will turn the ISPs into common carriers and make the internet a public utility (and defund the NSA, bring the troops home, and legalize weed, etc) Everything else is lipstick on a pig and polishing turds.

No it wouldn't allow them to throttle

[HalAtWork]

ISPs could not throttle Netflix, if they made it less available then they would be making themselves out to be "cyber" security threats themselves.

Makes sense really.

[linear a]

99+% of the terrorists *I* see are in movies and most of my movies are from Netflix.

By that logic ....

[PPH]

... Verizon, AT&T and Comcast are all cybersecurity threats for throttling select data sources.

ISPs don't have the final say in classifying traffic priority. Customers do.

Re:If you didn't vote Libertarian you ASKED FOR TH

[NotSanguine]

Between CISPA and the ruling against Aereo restricting the rights of others is it any wonder the Republicrats and Democans popularity is at an all time low. They are so far out of touch with realitythey don't give a damn about the rights of anyone but the rich and passing laws and regulations that favor them. Because of that anyone who has voted and will vote Republicrat or Democan, shut up and go sit on the sidelines. You've already demonstrated that you want an intrusive, activist government and as such you have no room to complain. You ASKED FOR THIS.

______________________________________ A vote against a Libertarian candidate is a vote to abolish the Constitution itself

Strange. You encourage people to self-censor on the one hand, while strongly implying your support for free speech (via your sloganeering) with the other. So which is it, AC? Do you want the "blessings of Liberty" or do you want those who disagree with you to, as you put it, "shut up and go sit on the sidelines?" You can't have it both ways.

I realize that no one actually read...

[NotSanguine]

The bill or the letter criticizing it that were linked in TFS, but there are so many more important freedoms (sharing of data with the DOD/NSA, further erosion of the Fourth Amendment, inadequate protection of Personally Identifiable Information and more) at risk than throttling streaming of the latest Hollywood garbage.

It amazes me that the poster would choose to focus on something both so innocuous and so unlikely, rather than the important issues. Sigh. One can only hope that there will soon be a new Darwin Award winner. Sigh.

Re:Ob

[NotSanguine]

...p2p caching...

Not a good idea if there are caps on your service. The one and only solution is to elect politicians who will turn the ISPs into common carriers and make the internet a public utility (and defund the NSA, bring the troops home, and legalize weed, etc) Everything else is lipstick on a pig and polishing turds.

Amen, brother. The big problem with effecting such a solution is the outsized influence of money in political campaigns. Unfortunately, until we get the slurry of filthy lucre out of our political system, it's just a pipe dream IMHO.

Torrents

[nurb432]

That is one way to stop them i guess.. Then the content wont matter, just the act of engaging is enough to get you labeled.

( and bandwidth caps.. )

Re:Ob

[niftymitch]

...p2p caching...

Not a good idea if there are caps on your service. The one and only solution is to elect politicians who will turn the ISPs into common carriers and make the internet a public utility (and defund the NSA, bring the troops home, and legalize weed, etc) Everything else is lipstick on a pig and polishing turds.

Good point about capacity limits, but my thought is that the local modem being property of the service would have
local memory or flash and tools to manage bandwidth billing. i.e. the p2p bandwidth your modem
generates is not covered by your service cap. Download service caps likewise can be
adjusted because the expensive long haul links are not involved. AND the p2p channels
are fully managed (and sold as service, see also Akami) by the ISP.

Have you ever noticed that on a phone or IPV6 link that your location can move half
a continent away... Why because the network is not well meshed and well connected.
This lack of mesh and connections is one of the big problems.

Re: Ob

[Anonymous Coward]

Today ISPs want to throttle Netflix using bandwidth as an excuse. Tomorrow the ISPs will want to throttle slashdot or other websites (you know, the ones you use). They might use other excuses or not. Where does it end?

Re:Ob

[fustakrakich]

I don't know about you, but I don't vote for big money. The money they spend is wasted on me. However, it does provide a good reference to who the politicians' owners are. It's not the money's fault when a corrupt politician takes it. And it's not just the individuals. We have to vote out the institutional party. And the thing is, if you can elect a politician to change the rules, then you already solved the problem. The fact is that nothing has to change except everybody's vote.

Sat TV is also a Cybersecurty Threat

[thirty2bit]

Classify satellite TV as a cybersecurity threat also. I have to pay for a "package" in order to get certain channels. Other channels are then denied to me. Also when satellite providers can't reach an agreement with a network (FOX, ABC etc.) then I suddenly lose channels. I'm not getting my information. Before you throw any rocks this way: c'mon, it's the same as the title. It's some jacked-up idea that looks great on paper to a committee making theoretical decisions of how the world actually works outside of a carefully crafted bubble they live. So tack on articles such a DRM and dipshit patents before you send this one up, because they are holding up progress all the same by denying access to information.

Re:Ob

[NotSanguine]

I don't know about you, but I don't vote for big money. The money they spend is wasted on me. However, it does provide a good reference to who the politicians' owners are. It's not the money's fault when a corrupt politician takes it. And it's not just the individuals. We have to vote out the institutional party. And the thing is, if you can elect a politician to change the rules, then you already solved the problem. The fact is that nothing has to change except everybody's vote.

Sadly, it's not wasted on the vast majority of voters. It's a catch-22 -- the folks who are in a position to remove the money from the political system are the ones who benefit the most from that money. One strategy could be to vote for those who don't take the money. Who might those folks be? It certainly isn't clear to me.

Re:Ob

[NotSanguine]

I don't know about you, but I don't vote for big money. The money they spend is wasted on me. However, it does provide a good reference to who the politicians' owners are. It's not the money's fault when a corrupt politician takes it. And it's not just the individuals. We have to vote out the institutional party. And the thing is, if you can elect a politician to change the rules, then you already solved the problem. The fact is that nothing has to change except everybody's vote.

Sadly, it's not wasted on the vast majority of voters. It's a catch-22 -- the folks who are in a position to remove the money from the political system are the ones who benefit the most from that money. One strategy could be to vote for those who don't take the money. Who might those folks be? It certainly isn't clear to me.

Let me qualify that -- It's not clear to me that *anyone* who actually gets elected (especially in national elections) isn't bought and paid for by the monied interests. Perhaps I'm wrong, but, sadly, I don't think so.

Re:Ob

[cheater512]

Why go to TPB daily? Why not just use Sickbeard which will get your shows for you automatically?

of course

[roc97007]

Actually... you know, using the internet is a cybersecurity threat. The highest security is, like, when the internet is quiet. (Inevitably someone says, Too quiet...)

It reminds me of what us sysadmins were always saying. This job would be so easy if it weren't for all the damned users.

Re:Ob

[amxcoder]

MashUp is a good one if you have XBMC too. XBMC running on RaspberryPi with MashUp app.

Time to relegate politicians to the dumpster

[TrentTheThief]

What the fuck?

How the fuck can we keep allowing knee-jerk idiots to continue making decisions in technical areas where they have no fucking experience or knowledge?

All this shit's being driven by the same assholes who come up with ideas like "x-strikes and you're banned from the net."

Wise up.

STOP RE-ELECTING FAILURE. VOTE FROM THE ROOFTOPS.

Code red: free nation undet assault

[Impy the Impiuos Imp]

Attention congressional assclowns! We view you as a cybersecurity threat, and intend to take care of it at the next election.

Victoria's Secret Superbowl Show = a Threat

[jsepeta]

fucking jesus. these government assholes are so full of crap. but then again, i repeat myself.

The whole internet is a "threat"

[MooseTick]

""A 'threat,' according to the bill, is anything that makes information unavailable or less available."

With this definition, the whole internet is a 'threat'. If you are downloading something from site x, you are using bandwidth that could be making site y "less available". Therefore, any site that requires the use of bandwidth to access could be consider a threat.

Re:Ob

[phmadore]

Interested. Link?

Re:Ob

[cheater512]

http://sickbeard.com/

Language

[mgcarley]

The language seems to suggest that they're trying to outlaw things like DOS attacks and "hacking"/revealing information on US persons, government activities and the like (so all the Snowden type stuff despite the whistleblower act, as well as identity theft or release of credit card numbers and stuff), especially on private/corporate/government networks (so target/tj maxx security breaches etc) -- rather than things like Netflix on residential connections.

I'd have thought the computer fraud and abuse act 1986 already had stuff about doing malicious things to systems (including but not limited to DOS attacks and all of the rest), meaning this bill appears... redundant, despite some of the new terminology introduced in there.

But, maybe I'm skim-reading too much and not delving in to the references cited in the bill; or maybe the language really is too broad to be safe for our "Internet rights" and I just haven't picked up on it, but can anybody point me at the passage(s) which could be interpreted to mean that high-bandwidth services such as Netflix on the public Internet would be a problem?