Even I was really happy, when in January SOPA got shelved and it seemed that this story practically ended. The online and street protests delivered a result, most people were delighted with the outcome. However, there are campaigns still, in which they address the President of the United States. „Tell Obama to promise: ‘I will never advance legislation that blocks websites or disconnects Americans’ internet access.'”

1984 coming to life?

No newer proposals have been shown to the public concerning this topic. However, we have CISPA, another Internet-based bill, dealing with cybersecurity issues. As Ernesto wrote on TorrentFreak: „In short CISPA would allow companies to spy on Internet users and collect and share this data with third-party companies or Government agencies. As long as the company states that these privacy violations are needed to protect against ‘cybersecurity’ threats, they are immune from civil and criminal liabilities.”

CISPA is not a brand new proposal: it was introduced on 30th November 2011 by Michigan Republican Michael J. „Mike” Rogers. If we look at the text, we would see that it is basically an amendment to the National Security Act of 1947. It is interesting that the definitions are not at the beginning of Section 2, they are at the end, in paragraph (h). So we have to read through almost the complete text to find out, what this is all about. In Sec. 2. (a) there are general provisions about cyber threat intelligence and information sharing. It defines the persons with whom the informations could be shared – (b) describes the use and the sharing itself. (c) is about the „Federal Government Use of Information,” which is important and questionable. Let us see the text:

The Federal Government may use cyber threat information shared with the Federal Government in accordance with subsection (b)—
‘‘(A) for cybersecurity purposes;
‘‘(B) for the investigation and prosecution of cybersecurity crimes;
‘‘(C) for the protection of individuals from the danger of death or serious bodily harm and the investigation and prosecution of crimes involving such danger of death or serious bodily harm;
‘‘(D) for the protection of minors from child pornography, any risk of sexual exploitation, and serious threats to the physical safety of such minor, including kidnapping and trafficking and the investigation and prosecution of crimes involving child pornography, any risk of sexual exploitation, and serious threats to the physical safety of minors, including kidnapping and trafficking, and any crime referred to in 2258A(a)(2) of title 18, United States Code; or
‘‘(E) to protect the national security of the United States.

Michael J. „Mike” Rogers

I cannot argue with (A), (B) and (E). But I do not see the point in putting (C) and (D) in this paragraph. Even, in this bill. Do you remember the Protecting Children From Internet Pornographers Act of 2011? It was the previous proposal of Lamar Smith, the Texas Republican Representative, who later introduced SOPA. Jim Hood, the Democratic attorney general of Mississippi, and co-chair of a National Association of Attorneys General committee recently likened rogue Web sites to child porn. Maybe this is the reason, why they try to push it in this bill. In the same paragraph we have the part (4), „Protection of Sensitive Personal Documents”, which is quite important, but a little too narrow in my opinion. Because it does not include for example energy providers’ records, which could cause cybersecurity issues, but also contains information that identifies a person. Robert Pear has an idea, why: „The Senate is working on a more comprehensive bipartisan bill that directs the secretary of the Department of Homeland Security to issue regulations to protect ‘critical infrastructure,’ including the electric power grid, water and sewer systems, transportation hubs and financial service networks.”

They are not the same, but people think so.

The main problem with this proposal is that it allows practically every company to share information with the government of possible cybersecurity problems. Of course it is voluntary, but we know, how things work. The other concerning fact that it is dealing with individual Internet subscribers, not copyright infringing websites. They are trying to go after the small fish, instead of the big one. We should note, that the word copyright is not even mentioned in the proposal. It is the most important evidence that CISPA is not a new version of SOPA/PIPA. The fear is that by giving „cyber threat intelligence” to the government of the citizens, they should see the possible copyright infringements as well. This would be quite an effective tie-in, I guess.