WEBVTT - TechStuff Looks at CISPA 0:00:00.320 --> 0:00:02.880 Brought to you by the reinvented two thousand twelve camera. 0:00:03.200 --> 0:00:08.960 It's ready. Are you get in touch with technology? With 0:00:09.039 --> 0:00:17.640 tech Stuff from how stuff works dot com. Hello, everybody, 0:00:17.640 --> 0:00:20.040 welcome to tech Stuff. My name is Chris Poulette, and 0:00:20.040 --> 0:00:22.400 I am an editor at how stuff works dot Com. 0:00:22.400 --> 0:00:25.800 Sitting across from me as usual as senior writer Jonathan Strickland. 0:00:26.120 --> 0:00:29.960 Hey there, Oh my gosh, I know I've I've changed 0:00:29.960 --> 0:00:34.479 things up. I got tired of pulling out quotes, and 0:00:34.560 --> 0:00:39.240 so I have decided spontaneously and without precedent, to drop 0:00:39.280 --> 0:00:44.080 it and uh and just just say Holly or whatever. 0:00:44.159 --> 0:00:46.839 You know. I wonder how many listeners we have from 0:00:46.920 --> 0:00:49.120 that early period when you used to do that all 0:00:49.159 --> 0:00:52.000 the time. Yeah, the hey there, and then I after 0:00:52.080 --> 0:00:54.520 Hey there. I think I went to various greetings from 0:00:54.520 --> 0:00:57.880 around the world, and then I started doing random quotes 0:00:58.000 --> 0:01:01.720 of I think it was for movies, and then music, 0:01:01.800 --> 0:01:04.720 and then I went to novels. Yeah, you know, you've 0:01:04.720 --> 0:01:06.360 got to change things up every now and then. We've 0:01:06.360 --> 0:01:09.880 we've done more than four episodes now. So but let's 0:01:09.920 --> 0:01:12.520 let's talk about Let's talk about what our topic is 0:01:12.560 --> 0:01:14.600 going to be today, because it's it's a heavy topic 0:01:14.640 --> 0:01:17.360 and this was something that was requested by several of 0:01:17.400 --> 0:01:20.120 our listeners. Well, it's not much of a surprise that 0:01:20.160 --> 0:01:23.119 people would be interested in hearing about it. It's been, uh, 0:01:23.160 --> 0:01:25.080 spending a lot of time in the news right around 0:01:25.080 --> 0:01:27.360 the time that we're recording this, which is very early. 0:01:27.480 --> 0:01:31.120 May I just technically we're recording this on Star Wars Day. 0:01:31.520 --> 0:01:34.200 May the fourth be with you, that's right. And uh, 0:01:34.280 --> 0:01:37.360 it is all about the Cyber Intelligence Sharing and Protection 0:01:37.440 --> 0:01:43.240 Act of eleven, also known as SISPA and CISPA is 0:01:43.319 --> 0:01:44.920 one of those things that a lot of people have 0:01:45.000 --> 0:01:47.520 probably heard about. I mean, it's one of those you know, 0:01:47.680 --> 0:01:52.200 like I've seen the acronym pop up on Twitter a lot. Yeah, 0:01:52.320 --> 0:01:54.200 which makes sense. I mean, it's you know, it's it 0:01:54.240 --> 0:01:58.840 does involve traffic on the Internet and uh, and so 0:01:59.000 --> 0:02:02.680 clearly anyone who uses the Internet is interested in this 0:02:02.720 --> 0:02:05.720 sort of thing, at least from a tangential perspective, even 0:02:05.760 --> 0:02:07.920 if they don't know what all the deal is. Now 0:02:07.920 --> 0:02:10.040 there's a lot of confusion out there too, because I 0:02:10.040 --> 0:02:13.760 see a lot of people who assume that SISPA is 0:02:13.800 --> 0:02:19.600 just a reworded approach to doing SOPA or Pippa, which 0:02:19.639 --> 0:02:24.840 are the piracy acts that were proposed in Yeah, and 0:02:24.880 --> 0:02:28.239 those were acts against piracy, not for so I don't 0:02:28.240 --> 0:02:31.040 want to give the wrong impression, but yeah, but those 0:02:31.120 --> 0:02:35.760 those were all um about, uh, you know, finding ways 0:02:35.840 --> 0:02:41.320 to allow the government to to pursue people who pirated 0:02:41.440 --> 0:02:44.640 intellectual property. Yeah, and we're talking about the United States government. 0:02:44.639 --> 0:02:46.919 Of course, we do have a lot of foreign won't 0:02:46.919 --> 0:02:49.880 foreign to us, foreign to US, their domestic to themselves. 0:02:50.520 --> 0:02:53.520 But yeah, we have are more domestic than others. That's true. 0:02:53.600 --> 0:02:55.040 That's true. Well, we we do have a lot of 0:02:55.040 --> 0:02:57.520 listeners from around the world, many many countries around the world. 0:02:57.520 --> 0:03:02.320 So nonetheless, since the Internet is uh a worldwide entity 0:03:02.360 --> 0:03:04.640 and a lot of the content we're talking about is 0:03:05.120 --> 0:03:07.680 born in the United States, it would have an effect 0:03:08.400 --> 0:03:11.520 on traffic worldwide. And and Soap and Pippa were both 0:03:11.680 --> 0:03:15.680 actually directed by the United States to to target sites 0:03:16.400 --> 0:03:19.320 that were outside the jurisdiction of the United States in 0:03:19.440 --> 0:03:22.560 order to find a way to combat piracy. Because as 0:03:22.760 --> 0:03:24.560 christ just pointed out, you know, the Internet is a 0:03:24.560 --> 0:03:27.800 global entity. It does not belong to the United States. 0:03:27.880 --> 0:03:30.840 It is not housed in the United States. It is 0:03:30.880 --> 0:03:34.359 truly all over the world. Which causes some issues when 0:03:34.360 --> 0:03:38.200 you're talking about legislation, because clearly one country cannot claim 0:03:38.280 --> 0:03:41.360 to be able to legislate over other countries in the 0:03:41.400 --> 0:03:45.600 world that are our sovereign nations. So SOAP and PIPPA 0:03:45.720 --> 0:03:49.120 were both approaches to try and head off piracy that 0:03:49.320 --> 0:03:52.320 was hosted in in UH in countries other than the 0:03:52.400 --> 0:03:55.640 United States, Like, how do you protect the interests of 0:03:55.720 --> 0:03:58.520 companies within the United States when he attacks themselves or 0:03:58.600 --> 0:04:01.280 the theft or however you want to frame it is 0:04:01.280 --> 0:04:05.360 occurring outside the border. Well, CISPA is not about that, 0:04:05.400 --> 0:04:10.920 at least not on its surface. CISPA was truly it's 0:04:10.960 --> 0:04:14.240 it's the the actual purpose of it, according to the 0:04:14.280 --> 0:04:17.760 act itself is and I quote, to provide for the 0:04:17.839 --> 0:04:21.920 sharing of certain cyber threat intelligence and cyber threat information 0:04:21.960 --> 0:04:26.040 between the intelligence community and cybersecurity entities and for other 0:04:26.120 --> 0:04:30.520 purposes and for other purposes. I hate that phrase. That's 0:04:30.560 --> 0:04:34.359 like the job description as a sign. Yes, that is 0:04:34.400 --> 0:04:36.960 the worst thing to see on a job description because 0:04:37.000 --> 0:04:40.560 you're you're like, I'm the senior vice president of finance 0:04:40.600 --> 0:04:43.000 at such and such, like go make me some coffee. 0:04:43.200 --> 0:04:45.320 What do you mean, Well, it's other duties and I 0:04:45.400 --> 0:04:53.080 just assigned them to you exactly. Yeah. Anyway, So although 0:04:53.160 --> 0:04:56.920 that rarely happens to senior executives, true from what I understand, 0:04:57.000 --> 0:05:01.880 could it happens to senior writers any a? So the uh, 0:05:01.960 --> 0:05:04.040 that's not that's not true. I'm making a joke. I 0:05:04.080 --> 0:05:06.960 love you. How stuff words dot com and Discovery Communications 0:05:06.960 --> 0:05:11.880 and sparing company. Uh, the some restrictions apply. Your knowledge 0:05:11.920 --> 0:05:15.400 may vary. The so, yeah, this this is really to 0:05:15.720 --> 0:05:19.080 protect The idea anyway, is that it would help protect 0:05:19.400 --> 0:05:23.080 the United States from cyber attacks by allowing the government 0:05:23.360 --> 0:05:28.440 to share information that's normally of classified or secret levels 0:05:28.880 --> 0:05:32.919 with other entities, which could include cyber security firms, so 0:05:33.040 --> 0:05:37.440 companies that are specifically formed around the idea of protecting 0:05:37.520 --> 0:05:41.120 data and making secure systems and detecting intrusions that kind 0:05:41.160 --> 0:05:45.040 of thing, as well as other companies so Internet service 0:05:45.040 --> 0:05:48.440 providers could be an example, or even other types of 0:05:48.480 --> 0:05:52.680 private companies. It's also meant to allow these companies, these 0:05:52.720 --> 0:05:56.280 private entities that have no connection to the government other 0:05:56.320 --> 0:05:57.919 than the fact that they happen to be within the 0:05:57.960 --> 0:06:01.039 realm of the United States. UH, allows them to share 0:06:01.040 --> 0:06:04.560 information with the government. And the key word there's it 0:06:04.600 --> 0:06:11.040 allows because the fear among people who oppose this act 0:06:11.600 --> 0:06:15.880 is that it would compel these companies to share information. So, 0:06:15.920 --> 0:06:20.640 in other words, one of the main concerns around this act, 0:06:20.720 --> 0:06:24.159 and it's it's a legitimate concern, is that the government 0:06:24.240 --> 0:06:28.360 might come up to say a company like Facebook and say, hey, Facebook, 0:06:28.920 --> 0:06:32.719 we suspect that there are eight or nine people that 0:06:32.800 --> 0:06:35.680 we have on this list who are involved in some 0:06:35.760 --> 0:06:39.919 sort of terrorism group cyber terrorism. You know, they're playing 0:06:39.920 --> 0:06:42.680 a big hacking attack and they have, uh, they have 0:06:42.800 --> 0:06:45.680 accounts on Facebook, and we're able to access some of 0:06:45.680 --> 0:06:48.640 that information, but we really want all the information you 0:06:48.680 --> 0:06:51.240 have on them. So could you please give us all 0:06:51.320 --> 0:06:54.080 the data you have on these people, including all the 0:06:54.120 --> 0:06:56.839 messages they send to each other, messages they send to 0:06:56.960 --> 0:06:59.880 other people that are not connected to the eight names 0:06:59.880 --> 0:07:03.800 on this list, uh, their their contact information, everything you 0:07:03.880 --> 0:07:07.719 have on them we want And then Facebook would say sure, 0:07:08.120 --> 0:07:10.920 here you go. And that's the big fear is that 0:07:11.120 --> 0:07:14.360 this would allow the government to get access to private 0:07:14.360 --> 0:07:16.880 information that most of the time we would say the 0:07:16.880 --> 0:07:20.000 government has no business knowing um, and they would do 0:07:20.040 --> 0:07:23.840 it under the the umbrella of trying to protect national 0:07:23.880 --> 0:07:29.360 security from cyber threats. Now, if you actually read the 0:07:28.440 --> 0:07:34.480 the full proposed legislation, which I have, you see that 0:07:35.080 --> 0:07:38.640 you can kind of see where where the the representatives 0:07:38.680 --> 0:07:40.880 who introduced this. In the United States, we have the 0:07:40.920 --> 0:07:43.280 House of Representatives and we have the Senate. These are 0:07:43.480 --> 0:07:47.760 two bodies that propose legislation, and once it passes through 0:07:47.840 --> 0:07:50.520 one body, it has to go to the other and 0:07:50.600 --> 0:07:52.600 pass through that one as well before it goes to 0:07:52.640 --> 0:07:55.080 the President of the United States, who can then either 0:07:55.240 --> 0:07:59.200 sign the the the bill into law, or veto it, 0:08:00.280 --> 0:08:03.240 or just let it sit there. That's really those are 0:08:03.240 --> 0:08:06.080 the three options. Really. Yeah, by the way, the President 0:08:06.080 --> 0:08:09.840 of United States currently has said he would veto SISPA 0:08:10.280 --> 0:08:12.960 vitos can be overridden. But that's you know, that's kind 0:08:12.960 --> 0:08:15.400 of beyond the scope at this discussion. Anyway, it's it's 0:08:15.440 --> 0:08:17.680 gone through the House of Representatives. It will next go 0:08:17.880 --> 0:08:21.040 to the Senate. It was pasted, Yes, it was past. 0:08:21.200 --> 0:08:26.640 Uh the vote, that's right, And it was not straight 0:08:26.680 --> 0:08:30.840 down party lines, but in general, more Republicans voted in 0:08:30.960 --> 0:08:34.280 favor of it and more Democrats voted against it. But 0:08:34.280 --> 0:08:38.640 but there was bipartisan support and bipartisan opposition. So it's 0:08:38.679 --> 0:08:40.959 not it's not cut and clear. It's not like this 0:08:41.000 --> 0:08:43.560 is a Republican issue. Now, this is this is broader 0:08:43.600 --> 0:08:45.600 than that. Yeah. And as a matter of fact, you 0:08:45.679 --> 0:08:50.160 can you can see different lists of the organizations and 0:08:50.200 --> 0:08:53.360 companies that are foreign against it and the same thing 0:08:53.440 --> 0:08:56.480 you'll see. Uh, you'll see there. Um, some of the 0:08:56.520 --> 0:08:59.679 companies that you might expect to be for it are 0:08:59.720 --> 0:09:01.880 again said in vice versa, and some of the other 0:09:02.400 --> 0:09:07.679 lobbying groups and grassroots support organizations that you know, try 0:09:07.720 --> 0:09:10.600 to get people involved in the issues like this. Um, 0:09:10.640 --> 0:09:12.480 it's very interesting to see the people who are working 0:09:12.520 --> 0:09:15.920 together for or against the bill. Yeah. I mean, this 0:09:16.000 --> 0:09:19.400 is another example of how SISPA is different from SOPA 0:09:19.480 --> 0:09:22.800 and PIPPA because SOPA and PIPPA, there were quite a 0:09:22.840 --> 0:09:29.360 few major companies, technology companies that opposed that legislation, right 0:09:29.720 --> 0:09:33.840 the SOPA and PIPPA like companies like Google and Facebook 0:09:34.360 --> 0:09:37.680 opposed those but in fact, sorry to interrupt ahead, some 0:09:37.720 --> 0:09:41.400 of them were very outspoken. They they had the Internet 0:09:41.440 --> 0:09:44.960 blackout days where they would take their sites, uh you know, 0:09:45.040 --> 0:09:48.640 make the first page sort of uh uh, Well, this 0:09:48.720 --> 0:09:51.880 is what you would see if this legislation passes, and 0:09:51.960 --> 0:09:54.920 it would be a very drab you know, uh start 0:09:54.960 --> 0:09:56.920 contrast to what you would see on the you know, 0:09:56.960 --> 0:09:59.439 everyday site. Either this I would be taken down or 0:09:59.480 --> 0:10:02.520 there was like a censored bar over the logo and 0:10:02.600 --> 0:10:04.800 you could proceed from there into the site, but you know, 0:10:04.800 --> 0:10:07.000 would be shut down and when you first got there, 0:10:07.040 --> 0:10:10.400 just with an explanation. Yeah, yeah, so that it would 0:10:10.600 --> 0:10:12.640 inform people what was going on. Well, some of those 0:10:12.640 --> 0:10:16.200 companies are actually in support of SISPA, now, not Google. 0:10:16.320 --> 0:10:18.400 Google has yet to come out one way or the 0:10:18.440 --> 0:10:20.480 other on the issue. A lot of them are are 0:10:20.840 --> 0:10:25.040 mute on the topic, right, But Facebook said that they 0:10:25.080 --> 0:10:29.920 supported or they the company representatives in Facebook spoke out 0:10:29.960 --> 0:10:33.600 in support of SISPA, and Microsoft did as well and 0:10:33.600 --> 0:10:37.160 then sort of backed off. But um, there are several 0:10:37.200 --> 0:10:40.400 companies that have spoken out in favor of it. And 0:10:40.720 --> 0:10:43.880 uh again that that illustrates that there's a difference here. Now, 0:10:44.040 --> 0:10:47.360 there were points during the debate of SISPA while it 0:10:47.400 --> 0:10:50.959 was going through the House about adding in language or 0:10:51.679 --> 0:10:55.080 or modifying language that would also have it applied to 0:10:55.160 --> 0:10:58.720 intellectual property theft. Yeah, the Center for Democracy and Technology 0:10:58.960 --> 0:11:02.440 used to support the bill but dropped off after the 0:11:02.440 --> 0:11:08.480 bill was modified and then that language subsequently was dropped again. UH. 0:11:08.679 --> 0:11:11.320 Problem pretty much at the last minute, so that it 0:11:11.360 --> 0:11:16.200 didn't it didn't expressly include intellectual property theft as one 0:11:16.240 --> 0:11:19.200 of the reasons for the bill itself. UH. And like 0:11:19.240 --> 0:11:21.839 I said, the bill really what what its purposes is 0:11:21.880 --> 0:11:27.320 to allow intelligence agencies like the FBI, the CIA, the 0:11:27.440 --> 0:11:30.280 n s A. UH. These are all intelligence agencies within 0:11:30.320 --> 0:11:33.160 the United States and law enforcement in the case of FBI. 0:11:33.679 --> 0:11:38.160 But these are agencies that are all about collecting information 0:11:38.280 --> 0:11:42.320 and using that to try and protect the interests of 0:11:42.360 --> 0:11:47.440 the United States. And the issue is a lot of 0:11:47.440 --> 0:11:50.600 the information is very sensitive and the government is not 0:11:50.760 --> 0:11:55.360 allowed to share that information with with non government, non 0:11:55.920 --> 0:12:00.000 UH certified entities. Yeah, don't talk badly about this information. 0:12:00.000 --> 0:12:02.000 It will start to cry well at any rate. Like 0:12:02.280 --> 0:12:05.800 they are not allowed to actually share that information by law. 0:12:06.080 --> 0:12:10.040 And this this legislation would allow them to then share 0:12:10.080 --> 0:12:15.760 information with parties that could actually affect whatever is going on. So, 0:12:15.960 --> 0:12:22.239 for example, if the CIA has has created some dossier 0:12:22.440 --> 0:12:27.840 about a domestic group of folks who are trying to 0:12:27.880 --> 0:12:31.560 get together and cause problems on the internet. Let's say 0:12:31.559 --> 0:12:34.760 that it's an anonymous group of people Let's say the 0:12:34.800 --> 0:12:38.160 CIA has gathered up this information to SEGA. The CIA 0:12:38.240 --> 0:12:41.120 may want to pass on this information about these anonymous 0:12:41.160 --> 0:12:47.080 individuals two to private companies. They might be cyber security companies, 0:12:47.080 --> 0:12:50.120 they might be Internet service providers, and the purpose of 0:12:50.160 --> 0:12:52.600 sending the information might be to help head off an 0:12:52.600 --> 0:12:56.559 attack or to uh to just be on the alert 0:12:56.600 --> 0:12:59.960 for potential attacks, or maybe even to track down these 0:13:00.080 --> 0:13:04.440 people so that whatever intelligence agency is interested in them 0:13:04.559 --> 0:13:08.640 can actually go and say, hey, you know, we need 0:13:08.679 --> 0:13:13.480 to talk remember that thing or you were going to 0:13:13.520 --> 0:13:16.800 do about that, We need to chat about this. So 0:13:17.600 --> 0:13:21.720 the you know, the idea of it being all about 0:13:21.840 --> 0:13:27.640 sharing information on the surface seems like it's a wise thing, 0:13:28.080 --> 0:13:31.800 and that the more people know about what's going on, 0:13:32.000 --> 0:13:34.960 the more likely they can head off disaster. Because that's 0:13:34.960 --> 0:13:38.160 one of the big issues about cybersecurity is that, you know, 0:13:38.240 --> 0:13:41.840 the systems, the systems can only be so secure. What 0:13:41.960 --> 0:13:44.560 can help us is knowing more about what's going on 0:13:44.640 --> 0:13:48.520 so that we can anticipate things and uh either head 0:13:48.559 --> 0:13:52.360 them off or reduce the effectiveness of an attack upon 0:13:52.400 --> 0:13:57.360 any given system. The problem is that this is giving 0:13:57.400 --> 0:14:00.720 the government and these entities a little bit more freedom 0:14:00.760 --> 0:14:03.160 to share information than a lot of people are comfortable 0:14:03.200 --> 0:14:05.960 with UM and that there are things built into the 0:14:06.000 --> 0:14:12.120 bill itself that make it pretty worrisome. For example, one 0:14:12.320 --> 0:14:14.760 of the amendments or or not an amendment, I'm sorry, 0:14:14.840 --> 0:14:19.400 one of the passages within this bill gives all the 0:14:19.520 --> 0:14:25.880 entities involved exemption from legal recourse if they cooperate with 0:14:25.920 --> 0:14:28.680 the federal government. So, in other words, let's say that 0:14:28.800 --> 0:14:33.000 your I s P sends the federal government a list 0:14:33.040 --> 0:14:35.640 of information about all the sites you visit, all the 0:14:35.640 --> 0:14:39.200 packets of data that you send through that Internet service provider. 0:14:39.640 --> 0:14:43.080 They send that information to the government in its efforts 0:14:43.120 --> 0:14:46.200 to prosecute you for something. Well, you would not be 0:14:46.280 --> 0:14:50.480 able to turn around and sue the Internet service provider 0:14:50.560 --> 0:14:55.119 for violating your privacy because they would have exemption underneath 0:14:55.160 --> 0:14:59.000 this legislation. So in other words, it's like a get 0:14:59.040 --> 0:15:02.000 out of jail free hard for any company that is 0:15:02.560 --> 0:15:06.240 part of this. That's that's you know, sharing information in 0:15:06.280 --> 0:15:10.360 this way as covered by this bill, which is scary. 0:15:10.840 --> 0:15:13.120 It's probably also why a lot of companies are like, yeah, 0:15:13.120 --> 0:15:16.840 I'm behind this, because this means if the government comes 0:15:16.840 --> 0:15:18.840 to me and says I need this information and I 0:15:18.920 --> 0:15:20.920 give that information, I don't have to worry about a 0:15:21.040 --> 0:15:26.000 multimillion dollar lawsuit hitting hitting me, and then I'm gonna 0:15:26.080 --> 0:15:28.040 take a hit and my shareholders are going to be 0:15:28.120 --> 0:15:31.240 really upset because my company just had to spend all 0:15:31.280 --> 0:15:34.280 this money to settle out of court with this other 0:15:34.440 --> 0:15:37.920 person because we sent their information to the government. This 0:15:37.920 --> 0:15:40.760 this passage would say, uh, yeah, you can sue us, 0:15:40.800 --> 0:15:43.160 but you have no grounds to stand on because the 0:15:43.240 --> 0:15:45.880 law says we can do this and you can't sue us. 0:15:46.720 --> 0:15:49.480 I wonder if there is a feeling among some of 0:15:49.520 --> 0:15:53.480 the companies that going along with this legislation would make 0:15:54.000 --> 0:15:58.480 the federal government more inclined to look favorably on them 0:15:58.640 --> 0:16:02.880 and other business matters as well. I can't read their minds, 0:16:02.880 --> 0:16:04.800 of course, and I don't know that anybody has come 0:16:04.800 --> 0:16:06.680 out and said, well, you know, we really love the 0:16:06.720 --> 0:16:10.760 government because hey, guys, you're awesome. Within within the bill itself, 0:16:10.800 --> 0:16:14.280 there's language that that is meant to protect against that, 0:16:14.520 --> 0:16:18.880 but whether or not that holds any real authority remains 0:16:18.920 --> 0:16:20.880 to be seen. Like there's there's a passage in there 0:16:20.920 --> 0:16:26.440 that says that the the uh, the articles within SISPA 0:16:26.520 --> 0:16:29.360 could not be used for regulatory purposes. So the government 0:16:29.400 --> 0:16:32.440 would not be able to regulate the Internet or Internet 0:16:32.440 --> 0:16:37.920 traffic using CISPA as its foundation. Also, no entity can 0:16:38.080 --> 0:16:43.120 use the information that they're sharing two uh to gain 0:16:43.240 --> 0:16:47.200 a competitive advantage over some other entity. So in other words, 0:16:47.200 --> 0:16:49.920 if you get you know, this information from the federal government, 0:16:49.960 --> 0:16:53.200 you could not somehow leverage that to give yourself a 0:16:53.240 --> 0:16:57.360 better business stance, because that's not what it's meant for. Now, 0:16:57.400 --> 0:17:01.880 how that ends up being enforceable or detective? You got me? 0:17:02.400 --> 0:17:04.800 I mean, I just don't. I don't understand, especially when 0:17:04.800 --> 0:17:10.320 you're talk about classified information. This information remains classified, right, 0:17:10.359 --> 0:17:13.640 So if the government has this classified information and they 0:17:13.640 --> 0:17:18.040 have authorized a particular entity to have the information, that 0:17:18.200 --> 0:17:21.720 entity can't share the information with other other you know people, 0:17:22.359 --> 0:17:25.480 they if they're within that umbrella with the federal government. 0:17:25.520 --> 0:17:28.919 There can be sharing between entities and the government, but 0:17:29.040 --> 0:17:33.199 you can't release it to the general public. So, you know, 0:17:33.480 --> 0:17:37.000 how would the government the government would have to acknowledge 0:17:37.280 --> 0:17:40.440 what the information is if a company were to try 0:17:40.520 --> 0:17:45.080 and use it to gain leverage in the competitive market space. Thus, 0:17:45.119 --> 0:17:49.840 the information that was private becomes public. This is problematic, right, 0:17:49.920 --> 0:17:52.600 How where where do you draw the line between, all right, 0:17:52.600 --> 0:17:55.560 this intelligence is all about national security, and we need 0:17:55.600 --> 0:17:58.439 to make sure it's secret. We cannot acknowledge it, we 0:17:58.480 --> 0:18:02.119 cannot reveal it, and we need to make sure the 0:18:02.160 --> 0:18:06.360 market remains fair and that companies don't take advantage of 0:18:06.400 --> 0:18:12.200 this new avenue of information. Uh, you know, if they 0:18:12.240 --> 0:18:15.240 if they do take action, then you've got a compromise 0:18:15.280 --> 0:18:19.280 between those two silos. And and that's a problem. It's 0:18:19.320 --> 0:18:23.720 not a big problem as far as the average consumers concern. 0:18:24.000 --> 0:18:27.159 The average consumers more concerned about the fact that, hey, 0:18:27.200 --> 0:18:29.560 this is kind of like wire tapping without a warrant. 0:18:30.359 --> 0:18:33.600 The government essentially can ask a company to give it information, 0:18:33.880 --> 0:18:37.840 and the company can give that information, no warrants, nothing, 0:18:38.080 --> 0:18:42.400 no no legal uh loopholes that you have to leap through. 0:18:42.640 --> 0:18:47.040 It's just request. Now, with that in mind, like I said, 0:18:47.080 --> 0:18:48.840 with the way the information is worded in the bill, 0:18:48.920 --> 0:18:52.760 the company is not compelled to share information. So the 0:18:52.800 --> 0:18:56.560 federal government comes to Facebook and asks for that information 0:18:56.600 --> 0:19:00.520 about those aid individuals, Facebook can tell the government, we're 0:19:00.520 --> 0:19:03.120 not going to share that unless you have a warrant. 0:19:03.359 --> 0:19:07.440 And in that case, whichever intelligence agency it is that's 0:19:07.800 --> 0:19:10.960 in question. Would theoretically have to go through the whole 0:19:11.000 --> 0:19:14.320 process of securing a warrant, serving at the Facebook, and 0:19:14.359 --> 0:19:18.480 then waiting to get the information. Uh now, how likely 0:19:18.640 --> 0:19:21.359 is it that companies are going that that support this 0:19:21.480 --> 0:19:24.760 are going to do that. That depends on each individual company. 0:19:24.800 --> 0:19:27.480 For some companies, it makes perfect sense for them to 0:19:27.520 --> 0:19:32.240 say no, because if they said yes, they risk alienating 0:19:32.400 --> 0:19:36.200 their user base. I know that if I if I 0:19:36.280 --> 0:19:38.960 had an I s P and I found out that 0:19:39.000 --> 0:19:42.080 I s P was sharing information about users to the 0:19:42.119 --> 0:19:45.439 government without the use of a warrant, I would not 0:19:45.600 --> 0:19:47.720 want that I s P as my I s P. 0:19:48.600 --> 0:19:51.360 And it's not that I'm doing anything clandestine or illegal. 0:19:51.800 --> 0:19:54.639 It's just I don't like the idea of companies just 0:19:54.760 --> 0:19:59.400 freely handing over private information to the government without there 0:19:59.440 --> 0:20:03.600 being a legal reason to do so, you know, I 0:20:03.640 --> 0:20:07.119 mean that just that just doesn't seem right. It's almost 0:20:07.119 --> 0:20:11.040 the same as imagine having a government official show up 0:20:11.040 --> 0:20:13.840 at your door one day, and that government officials job 0:20:14.000 --> 0:20:16.440 is to follow you around and watch everything you do 0:20:16.520 --> 0:20:19.399 and write a report every single day about everything you do, 0:20:19.840 --> 0:20:22.119 and it doesn't matter if you're doing something right or wrong. 0:20:23.119 --> 0:20:26.920 That's just what they do. Wait, you mean they don't 0:20:26.920 --> 0:20:31.199 do that to you? Well, you know, not that I'm guilty. 0:20:31.240 --> 0:20:33.679 I feel guilty for putting you on that list. That 0:20:33.760 --> 0:20:37.160 was a great aper fool's joke, but it's had implications 0:20:37.200 --> 0:20:40.840 that went beyond what I had originally intended in five years. Yeah, 0:20:40.960 --> 0:20:44.000 well you know, um aper fools. Well yeah, I think 0:20:44.000 --> 0:20:47.159 the the I think the language in the bill is 0:20:47.160 --> 0:20:49.960 what gives people uh so much trouble is that it 0:20:50.160 --> 0:20:54.040 it's it started off broader, admittedly, but it's still broad 0:20:54.160 --> 0:20:57.880 enough where it gives a lot of power that um. 0:20:58.520 --> 0:21:01.800 You know, people feel that the government shouldn't have um. 0:21:01.840 --> 0:21:04.640 But you know, that's that's the nature of a lot 0:21:04.680 --> 0:21:06.359 of these these bills that have gone through. I was 0:21:06.400 --> 0:21:10.399 one of the main criticisms of SOPA UM, so you 0:21:10.440 --> 0:21:13.480 know that that's what's given so much pause to a 0:21:13.520 --> 0:21:16.600 lot of these organizations that have come out against it. Well, 0:21:16.680 --> 0:21:21.560 there's also there's a specific phrase within the bill itself 0:21:21.600 --> 0:21:27.119 which says notwithstanding any other provision of law. So what 0:21:27.280 --> 0:21:32.000 that means is that SISPA overrides all other laws when 0:21:32.040 --> 0:21:34.760 it comes to sharing information. So any privacy law that 0:21:34.800 --> 0:21:38.800 would protect your privacy is negated. By SISPA exactly. So 0:21:38.840 --> 0:21:41.960 if even if you had a state law or there 0:21:42.000 --> 0:21:44.080 was some other law in the books that would protect 0:21:44.119 --> 0:21:49.120 your rights as a citizen to specific private information, SISPA 0:21:49.200 --> 0:21:52.320 overrides it and says doesn't count. As long as it 0:21:52.359 --> 0:21:54.640 falls under this category, it does not count. And there's 0:21:54.680 --> 0:21:57.439 nothing there's no burden of evidence on the part of 0:21:57.480 --> 0:22:02.120 any any entity, whether it's the government or the private company, 0:22:02.160 --> 0:22:05.720 to show that this is a justifiable approach for any 0:22:05.880 --> 0:22:09.520 given case. It's not like there's a burden of proof 0:22:09.560 --> 0:22:12.920 that you must meet in order to count as this 0:22:12.960 --> 0:22:16.760 whole sharing of information to head off cyber crime. There's 0:22:16.800 --> 0:22:20.560 nothing there in the bill that says in order for 0:22:20.600 --> 0:22:23.800 this to apply, you must meet these criteria. So, in 0:22:23.800 --> 0:22:27.080 other words, you might as well just say privacy laws 0:22:27.119 --> 0:22:31.160 don't exist, because CISPA means that it's not. It's they 0:22:31.160 --> 0:22:36.640 don't they don't apply. Well. Mozilla UH, the organization that 0:22:37.480 --> 0:22:41.880 creates and maintains the Firefox web browser, made a statement 0:22:41.880 --> 0:22:44.919 against it that says, while we wholeheartedly support aim more 0:22:45.160 --> 0:22:47.840 secure internet, SISPA has a broad and alarming reach that 0:22:47.880 --> 0:22:51.360 goes far beyond internet security. The bill infringes on our privacy, 0:22:51.400 --> 0:22:55.160 includes vague definitions of cybersecurity, and grants immunities to companies 0:22:55.160 --> 0:23:00.280 and government that are too broad around information misuse. Um. 0:23:00.320 --> 0:23:02.720 And then you know, end quote. And then they go 0:23:02.800 --> 0:23:06.080 on to say that they hope the Senate takes a 0:23:06.080 --> 0:23:10.800 a careful consideration of the issues before promoting, before passing 0:23:10.800 --> 0:23:13.199 this legislation. And and we should also point out there 0:23:13.200 --> 0:23:16.439 are at least two other bills within the Senate itself 0:23:16.800 --> 0:23:21.760 that that also are cybersecurity bills. And so that's a 0:23:21.760 --> 0:23:24.880 complicated matter in the Senate because it's you know, it's 0:23:24.880 --> 0:23:28.040 this bill would also address the same issues that other 0:23:28.080 --> 0:23:31.679 bills that are on in consideration are already you know, 0:23:31.800 --> 0:23:34.960 they're already there. So so it may be that the 0:23:34.960 --> 0:23:36.880 Senate just as you know, this doesn't even make sense 0:23:36.880 --> 0:23:39.000 because we have these other bills here that address the 0:23:39.040 --> 0:23:42.680 same problem but don't have the same issues. Or cybersecurity 0:23:42.800 --> 0:23:48.400 is sort of difficult to to capture anyway, um, far 0:23:48.480 --> 0:23:52.760 more than than you know, physical security. There there are 0:23:52.760 --> 0:23:56.840 just so many loopholes and ways to get into electronic 0:23:56.920 --> 0:24:01.679 systems compared to a physical system. Yes, and uh, you 0:24:01.720 --> 0:24:04.600 know they're they're it's difficult to do. And I think 0:24:04.680 --> 0:24:09.240 that's one of the reasons that the legislation is so broad. Um. Also, 0:24:09.280 --> 0:24:15.280