CISPA, the cyberspying bill, is back in Congress and plagued with many of the
same problems as last year—
vague definitions and the grim
government access loophole to name just a few. The bill also grants broad immunity to companies as long as a company acts in "good faith." One section of the immunity clause even grants immunity for any "decision made" based on information about a perceived threat. The clause opens up a wide door for abuse and is yet another reason why we urge users to
stop CISPA.
The most dangerous section grants immunity for any "decision" a company makes based on information it learns about a perceived network threat. The clause is yet another example of why the bill must be killed. A company could use this section to act against a perceived threat believing it was immune from any legal liability as long as the decision was based on information about a threat. The immunity could cover decisions to violate other laws, like computer crime laws or privacy laws intended to protect users. Companies should not be given
carte blanche immunity to violate long-standing computer crime and privacy law.
The requirement that companies act in good faith is an ineffective check on CISPA power grant. It is notoriously hard to prove that a company acted in bad faith, in the few cir stances where you would actually find out your privacy had been violated.
It also opens the door for government abuse. If the government asks for your information, and only tells the company it's needed for secret cybersecurity reasons, the company could claim to rely, in good faith, on the government’s unverified tale. Voila! Immunity from lawsuits.
This was precisely the problem with the FISA Amendment Act (FAA), which granted retroactive immunity to telecoms for the NSA warrantless wiretapping program. Tragically, the FAA allowed immunity for disclosures just on the government's say-so. Let's not make the same mistake again.