Since it's linked upthread: Techdirt is one of the least trustworthy sources on the Internet for information about Internet law.

(Here's a summary of CISA I wrote a few months ago on HN: https://news.ycombinator.com/item?id=10454172 )

Today (and yesterday), Techdirt claims the following changes to CISA:

1. Removes the prohibition on information being shared with the NSA, allowing it to be shared directly with NSA (and DOD), rather than first having to go through DHS.

2. Directly removes the restrictions on using this information for "surveillance" activities.

3. Removes limitations that government can only use this information for cybersecurity purposes and allows it to be used to go after any other criminal activity as well.

4. Removes the requirement to "scrub" personal information unrelated to a cybersecurity threat before sharing that information.

'yuhong helpfully posted a link to the revised bill attached to the budget bill.[1] I compared it clause for clause to the version that passed the house. That is 10 minutes of my life I will never get back. Unsurprisingly, only one of Techdirt's claims is true (but worded misleadingly). The other three are simply false.

Here's the breakdown:

<strike>1. The "CERTIFICATION OF CAPABILITY AND PROCESS" part of Section 107 now allows the President, after CISA has been started by DHS, and after publicly notifying Congress, to delegate to any federal agency, including NSA, the authority to run the process described by the rest of the bill. The previous version required DHS to run the entire process. Techdirt isn't wrong about that change. Techdirt is wrong to be confused about why NSA would be a designated coordinator for threat indicators under CISA (NSA houses virtually all of the USG's threat intelligence capability; no other department has comparable expertise coordinating vulnerability information).</strike>

I was wrong about this; the new bill specifically disallows DoD or NSA from running the CISA portal.

2. The bill doesn't change the authorized usage of cyber threat indicators at all (nor does it change any of the definitions of threat indicators, vulnerabilities, and so on). The few places I found changes at all actually improved the bill (for instance: Section 105 5(A) no longer allows threat indicators to be shared to investigate "foreign adversaries").

3. CISA has always allowed the USG to use cyber threat information in law enforcement pertaining to a specific list of crimes --- that is one of the ways CISA is significantly worse than CISPA. But Techdirt suggests that CISA can be used by the DEA to investigate drug crimes. You cannot have read the bill and believe that to be an illustrative example, because drug crimes aren't among the listed crimes: fraud/identity theft, espionage, and protection of trade secrets. It should not surprise you that the list of applicable crimes has not changed in the budget bill version.

4. The new CISA act retains all the "specific person" and "technical capability configured to remove any information" language regarding personally identifiable information in "cyber threat indicators". The "scrub", by the way, has always applied to private entities (Techdirt may have tripped over themselves to write this bullet point, because the new bill clarifies "entity", "federal entity", and "non-federal entity", and so the scrubbing language now reads "non-Federal entity" --- but the original bill defined "entity" as "private entity"!)

[1]: http://docs.house.gov/billsthisweek/20151214/CPRT-114-HPRT-R...