A Guide To the 5 Cybersecurity Bills Now Before Congress
blottsie writes: At press time, the House had passed two cybersecurity bills, one Senate bill had been passed out of committee and reported to the full chamber for a final vote, and a third House bill and a second Senate bill were awaiting review by the appropriate committee. The two House bills that passed earlier this week will be combined and sent to the Senate, but the Senate won't take up them up directly; instead, it will vote on its own two bills. It's complicated, so here's a quick breakdown of the key details.
That's the "short" version? Yeesh. Anyway, here's what that article was trying to say:
Two things are likely to pass:
1) Cybersecurity Information Sharing Act: Lets Homeland Security invent regulations to let companies and governments at all levels share data about people. Good for law enforcement, bad for privacy and civil rights, good for corporations who share too much trying to please the government (because of a liability shield).
2) Something else similar with some provisions keeping the NSA at arms length to molify the public, but I lost interest exactly what it was because the article was pretty confusing.
The word cyber has been abused to the point where it means little if anything.*
*Of course to be fair nobody really understood what Norbert Weiner when he coined it to talk about self regulating control systems
I hope that the elected officials in Congress, that promised to serve the public, actually read the bills before voting on them.
Here is an outline of the response to this week's congressional activity from the Open Technology Institute at the New America Foundation:
http://www.newamerica.org/oti/house-passes-second-flawed-cybersecurity-information-sharing-bill/
To be completely transparent, I worked at OTI and think they are great.
Will
remove nospam. to email!
Just great. We already share vulnerability reports through Mitre's CVE database. Mitre might as well be the DoD. The Pentagon already hosts several cyber warfare organizations. They seem to play well with NIST and its _National_ Vulnerabilities Database. We already have rules and regulations on submitting vulnerability data, and our customer will sue us if we reveal _any_ personal identifying information. We certainly aren't going to reveal any when publishing a vulnerability.
So now Congress wants to transfer control over to the DHS, who have no previous experience in cyber security, and even worse, have demonstrated their competence and lack thereof with our airport security. Funny how my right to avoid search and seizure without due process goes out the window when I want to board an airplane -- and strangely, I don't feel any safer. I take solace in that the terrorists seem less competent than DHS.
This going to turn out well. Not.