We've written extensively about CISPA over the last year, but since the House Permanent Select Committee on Intelligence is set to mark the bill up next week, and the full House to vote on it the week after that, we're dissecting its shortcomings. Information sharing isn't offensive per se; it's really a question of what can be shared, with whom, and what government agencies and corporations can do with it. Previously, we've discussed what information can be shared and with whom it can be shared. Today we discuss what can be done with your information after it has been shared.
What can be done with information after it is shared?
The answer: a lot of things, many of which have nothing to do with cybersecurity.
As we mentioned in Explainer #2, shared information can travel one or both of two paths – to other companies or to the government. There are traditionally two types of limitations on collected information – use limitations that generally list the permissible categories of use, and minimization procedures that more explicitly discuss the details of collection, retention, use and destruction. CISPA fails on all accounts, but let's address corporate and government recipients since CISPA does too.
Corporate-Use Limitations and Minimization Procedures: None included
The first path leads to other corporations. Under CISPA, telecoms, banks, internet service providers, and others holding sensitive personal information can share it with other corporations if it pertains to a cybersecurity threat (see Explainer #1). Once they do so, there is no limitation on what that recipient can do with it. Even if the information is originally shared for legitimate cybersecurity purposes, that information doesn't just disappear, and nothing in CISPA bars the recipient organizations from repurposing personal information for other activities unrelated to resolving cybersecurity threats. For example, a company might validly share personally identifiable information , maybe in a bulk fashion, and corporate recipients could then use some of that same information for a marketing or research purpose wholly unrelated to cybersecurity. There' isn't any oversight over the use of CISPA information and companies that repurpose such personal information for their own benefit would not be held to account.
There is an easy fix. CISPA could be amended to limit a receiving corporation's use of CISPA information to cybersecurity purposes. Such a change would help maintain the status quo instead of dumping vast additional amounts of personal data into the corporate stream where CISPA would otherwise provide few, if any, protections.
Government Use Limitations and Minimization Procedures: Overbroad, Weak, Optional
The second path for shared CISPA information leads to the government. For some reason, the government use limitations in CISPA only apply to the federal government. If a company shares private data with a local or state law enforcement agency, it's a free for all.
However, if the federal government receives CISPA information, it can only use that data for five general purposes: 1) addressing cybersecurity, 2) prosecuting cybersecurity crimes, 3) investigating and prosecuting crimes involving danger of death or serious harm, 4) investigating crimes against children, and 5)"to protect the national security of the United States."
CISPA also lacks requirements to create specific policies about government collection, use, dissemination, and destruction of information – commonly called minimization procedures. It instead simply says that the government may or may not issue "privacy" guidelines and does not state that they shall encompass important minimization principles such as limiting collection, transparency, anonymity, and other issues.
To be clear, CISPA does not compel companies to turn over personal information to the government, but those companies sure can elect to do so. More importantly, CISPA fails to provide even minimal protection requirements of a subpoena or the more meaningful one of a warrant. CISPA's authors promise that this broad collection program is okay because there will be meaningful post-sharing protections but that is belied by the text itself. For comparison purposes, consider pretty much all other modern collection programs, like the Electronic Communication Privacy Act and Foreign Intelligence Surveillance Act. CISPA allows for the broadest collection authority while providing the weakest use restrictions. The result: a privacy disaster.
The good news is that there's an easy fix for this defect, too. CISPA could be amended to limit federal, state, and local government use of information just to cybersecurity purposes and prosecutions and also require some of the excellent minimization requirements in the Senate bill or in the Fair Information Practice Principles the President just endorsed. None of these amendments would affect the information the government receives - only what it can do with that information once it's in hand. If this is really just a cybersecurity bill, such protections should not be controversial.
Next up: Is there anything besides information-sharing hidden in CISPA? Check back tomorrow for CISPA Explainer #4 and click here to sign a petition to the president asking him to veto CISPA.
Other blogs in this series:
CISPA Explainer #1
CISPA Explainer #2
CISPA Explainer #4
Learn more about cybersecurity and other civil liberty issues: Sign up for breaking news alerts, follow us on Twitter, and like us on Facebook.
Learn More About the Issues on This Page
-
News & CommentaryDec 2024
Civil Liberties
National Security
Where Defense Secretary Nominee Pete Hegseth Stands on Civil LibertiesWhere Defense Secretary Nominee Pete Hegseth Stands on Civil Liberties
The ACLU has more than 100 years’ experience holding power accountable. As President-elect Donald Trump rolls out his cabinet picks, we analyze how his nominee for secretary of defense will impact civil liberties. -
Press ReleaseDec 2024
Free Speech
National Security
ACLU and Partners Urge Supreme Court to Block TikTok BanACLU and Partners Urge Supreme Court to Block TikTok Ban
WASHINGTON — Today, the American Civil Liberties Union, the Electronic Frontier Foundation (EFF), and the Knight First Amendment Institute at Columbia University filed an amicus brief urging the Supreme Court to block the enforcement of a law that would effectively ban people in America from using TikTok as soon as January 19, 2025. Earlier this month, the U.S. Court of Appeals for the D.C. Circuit rejected TikTok’s challenge to the law. TikTok has asked the Supreme Court for a temporary injunction to prevent the app from being banned while the court considers whether to take the case, saying that unless the justices intervene, the law will “shutter one of America’s most popular speech platforms the day before a presidential inauguration.” “The Constitution imposes an extraordinarily high bar on this kind of mass censorship,”said Patrick Toomey, deputy director of ACLU’s National Security Project. “The Supreme Court should take up this important case and protect the rights of millions of Americans to freely express themselves and engage with others around the world.” The brief argues that the D.C. Circuit failed to fully address the law’s profound implications for the First Amendment rights of the 170 million Americans who use TikTok. While the lower court’s decision correctly recognized that the statute triggers First Amendment scrutiny, it barely addressed users’ First Amendment interests in speaking, sharing, and receiving information on the platform. The court also perplexingly attempted to cast the government’s ban on TikTok as a vindication of users’ First Amendment rights, which it is not. The rights groups also explain that the law was intended to suppress certain content and viewpoints that many legislators believe could be amplified on TikTok, including the risk of foreign “propaganda.” But under the First Amendment, the government must meet a very high bar to restrict speech based on concerns about its “motivating ideology” or “perspective,” and the government has not come close to meeting that bar here. “The government should not be able to restrict speech, especially to the extent here, based on guessing about the mere possibility of uncertain future harm,” said David Greene, civil liberties director at EFF. “The Supreme Court should put the TikTok ban on hold while it considers the DC Circuit’s erroneous ruling.” Finally, the brief underscores that the government can’t impose this type of sweeping ban unless it’s necessary to prevent extremely serious and imminent harm to national security. But the government has not provided evidence of impending harm, or evidence that banning TikTok is the only available way to address its concerns. As the brief explains, the D.C. Circuit improperly treated the government’s invocation of “national security” as a trump card and failed to hold the government to its burden. “Restricting citizens’ access to foreign media is a practice that has long been associated with repressive regimes, and we should be very wary of letting the practice take root here,” said Jameel Jaffer, executive director at the Knight First Amendment Institute at Columbia University. “It would do lasting damage to the First Amendment and our democracy if the Supreme Court let this ban go into effect even temporarily.” You can find the brief online here: https://www.supremecourt.gov/DocketPDF/24/24A587/335380/20241217144322392_24A587%20TikTok%20v%20Garland%20Amicus%20Brief%20pdfa.pdf -
Press ReleaseDec 2024
National Security
Religious Liberty
ACLU Statement on New White House Strategy to Counter IslamophobiaACLU Statement on New White House Strategy to Counter Islamophobia
WASHINGTON – The Biden administration today released the first-ever national strategy to counter Islamophobia and related forms of bias and discrimination, including hate against Arab, Sikh, and South Asian Americans. In advance of the strategy, American Civil Liberties Union and its partners had urged the administration to overhaul government programs that reflect anti-Muslim discrimination. In particular, we have called for urgent action to constrain governmental agencies from continuing to exercise their authorities and technology to wrongly surveil and investigate, watchlist, and question and detain Muslims at the border, as well as deny immigration benefits to people from Muslim-majority countries. While the White House raised expectations that many of these issues would be addressed, the final strategy ended up falling far short. The following is a statement from Hina Shamsi, director of the ACLU’s National Security Project: “While this strategy acknowledges discrimination and its harms, it does little to end them and is a squandered opportunity. For decades, American officials have invoked national security to pass laws and implement programs that disproportionately harm Muslims and people perceived to be Muslim. A serious anti-discrimination strategy would concretely address multiple bias-infused government practices that deny our communities equal participation in civic life and our democracy, like federal watchlisting, surveillance, and investigation. We’re profoundly frustrated that the administration didn’t take even the basic, overdue step of recognizing that anti-Muslim discrimination is uniquely normalized and embedded in government policies.” -
VirginiaDec 2024
National Security
Trabelsi v. Crawford, et al. – Lawsuit Challenging Unlawful Detention and Inhumane Treatment of Acquitted ManTrabelsi v. Crawford, et al. – Lawsuit Challenging Unlawful Detention and Inhumane Treatment of Acquitted Man
Our client, Nizar Trabelsi, is in the United States against his will. The federal government brought him here from Belgium more than a decade ago and charged him with terrorism-related crimes. At trial, the government’s case failed: a federal jury found Mr. Trabelsi not guilty. But instead of allowing Mr. Trabelsi to return to Belgium after his acquittal, the United States placed him in highly restrictive immigration detention and began an ongoing effort to force him to Tunisia, where he was born and where he will very likely be tortured. Mr. Trabelsi’s detention violates the Constitution, immigration law, and the extradition treaty between the United States and Belgium. Through this lawsuit, he seeks to return to Belgium, and he demands an immediate improvement of his detention conditions.