My thoughts on CISPA

Here's another article on the problems with CISPA (Uproxx):

It’s called the Cyber Intelligence Sharing and Protection Act, although it’s not actually a law, but rather something tacked onto a security law passed in the ’40s. It’s designed to deal with what amounts to the new Cold War: American, Chinese, and Russian security agencies are currently busy hacking the crap out of each other, so this law is designed to make it easier to track and penalize, say, somebody stealing the plans of a new widget.

The big problem is, the way the bill is written, it supersedes all other wiretapping and intelligence laws, although a corporation does not have to comply with any request under the current language.

And another (Huffington Post):

CISPA demolishes existing barriers between the government and the private sector -- and between government agencies, including the military -- that restrict casual data sharing. It would effectively allow information about Americans' use of the Internet to slosh back and forth uninhibited.

So, I'm officially worried.*

I wrote a while ago that privacy is an important and complicated ethical issue, and in that article I tried to stress that there are a variety of considerations in the issue of privacy that pull my conclusion from both directions, and that you can't simplify the debate down to a few slogans without fatally oversimplifying it.

And I do think that, eventually, we're going to need some smart, complicated legislation that deals with the issue of gathering information on the internet in a rational, considered way that obligates companies to protect the privacy of their customers while still allowing the government to guard against the real and serious risks of cyber terrorism**.

The thing I don't like about CISPA is the point that the Huffington Post article makes -- it would allow a lot of inter-organization information sharing.  And I'm against that, especially when it comes to the government.

I think branches of the government, and organizations that deal with the care or wellbeing of human beings (which I think the internet does) should be intrinsically separate, and only overlap in extreme circumstances.

For example, I don't want people to do heroin.  But I also don't want people overdosing on heroin to refuse to go to the hospital, because they know there'll be handcuffs waiting for them on the other side.  And I don't want people who use heroin to refuse to go to the hospital for other illnesses (which, I cannot stress this enough, they might be spreading†) because if a blood test comes back with heroin in it they'll go to jail.

People sometimes need to talk about things that are illegal.  The world is messy and unpleasant, and it doesn't get better by pretending it isn't.  It gets better by embracing those complexities and offering compassion.

We need legislation to protect us from the dangers of the internet.  But CISPA doesn't sound like that.  It sounds like another reactionary, SOPA-like bill designed to make old people feel better about the monster behind their monitor.  It seems like it has less teeth than SOPA did, but it's not good enough.

And if we keep pushing, maybe three or four bills down the road, we'll get some legislation that doesn't suck.

*Yes, there's an 'official' and 'non-official' worrying category set.  Formal worrying requires that the concern pass an advisory board, that I've slept on it, used the bathroom before considering it and properly hydrated.  I can't become formally worried if I've had a headache for the entire space of time I've been considering it, and I can't become formally worried if my data set contains only secondhand reports from people I personally know.

**Cyber Terrorism (n.) The scary internet monsters coming to take away your children and replace them with sophisticated Furbies. Seriously, though.  I accept that cyber terrorists are a real thing, and I would also like to stress that they are, apart from that, used as a scare tactic to push irresponsible, reactionary legislation -- just like real terrorists.

†One of my firmest opinions about drug policy is that it's not okay to reject individuals' health on the basis that they deserve it for doing drugs.  Healthcare doesn't happen in a bubble, and the less institutional help addicts have access to, the more the consequences of their decline spill over into the lives of everyone else.  As it happens, I have a lot of sympathy for addicts.  But even if you don't, it's counterproductive not to try to help them -- not out of concern for the addicts themselves, but for the benefit of everyone else who has to live in a society where addiction is a thing that sometimes happens.