When the Business Software Alliance released this letter a while back, I was perplexed.
In addition to its call for Congress to pass a set of designated bills, including ECPA reform, that would give assurances to international customers that US services weren’t more exposed to US spying, the letter also called for passage of cybersecurity sharing legislation.
Cyber Threat Information Sharing Legislation will promote cybersecurity and protect sensitive information by enabling private actors in possession of information about vulnerability and intrusions to more easily share that information voluntarily with others under threat, thus enabling the development of better solutions faster.
As TechDirt noted, the letter didn’t name any particular cyber sharing bill, but there are three and all expand US government access to data. Even if some or all tech companies that make up BSA wanted such a bill it seemed odd to include in a call for legislation that would reassure international customers. I asked around and the impression was it was just convenience to include a CISA-type legislation (but why include it at all)?
So then Fight for the Future went to work. It got thousands of activists to complain to the companies directly about their stated support for a CISA-type legislation. And also announced their intention to stop using Heroku, which is part of Salesforce, as their host.
That led first Salesforce then BSA more generally to deny they had ever supported CISA. The BSA language pretended their original letter called for balanced legislation. And it also claimed to consistently advocate for strong privacy protections on such legislation — which of course they didn’t do in the letter.
There have been questions about our views of the current CISA legislation. For clarity, BSA does not support any of the three current bills pending before Congress, including the Cybersecurity Information Sharing Act (CISA), the Protecting Cyber Networks Act (PCNA), and the National Cybersecurity and Communications Integration Center (NCCIC) Act.
Consistent with this view, BSA’s September 14 data agenda letter to Congressional leaders identified five key areas where Congress can pass legislation to strengthen the policy environment around digital commerce, including voluntary information sharing, and highlighted the need for balanced legislation in this area.
BSA has consistently advocated for strong privacy protections in all information sharing bills currently pending before the Congress.
We will continue to work with the Congress, others in industry and the privacy community to advance legislation that effectively deals with cyber threats, while protecting individual privacy.
All of raises more questions about how the endorsement for cyber sharing at a time when all the cyber sharing bills before Congress don’t balance privacy interests got into the letter.
Especially given the signatories. The signatories include companies — like Apple — that have fought hard to protect their customers’ privacy. It included several — notably Adobe and Siemens — that could significantly benefit from any kind of immunity, given that their products are among the most consistent targets of hacks. Most interesting, it includes several companies — including IBM and Symantec — that will benefit when a CISA bill makes it easier for cybersecurity contractors to get more data with which to serve customers.
Indeed, the language from the original bullet support cyber sharing — “enabling private actors in possession of information about vulnerability and intrusions to more easily share that information voluntarily with others under threat” — might well describe how cybersecurity contractors will get a boost from CISA.
Some members of BSA probably do, individually, support CISA for the immunity and data it would give them. Others neither need it nor want the stigma.
So how did it get in this letter?
I’ve become increasingly convinced that DOJ’s head of Criminal Division, Lanny Breuer is the rotting cancer at the heart of a thoroughly discredited DOJ. Which is why I’m not surprised to see this speech he gave at the NYC Bar Association selling the “benefits” of Deferred Prosecution Agreements. (h/t Main Justice) He spends a lot of his speech claiming DPAs result in accountability.
And, over the last decade, DPAs have become a mainstay of white collar criminal law enforcement.
The result has been, unequivocally, far greater accountability for corporate wrongdoing – and a sea change in corporate compliance efforts. Companies now know that avoiding the disaster scenario of an indictment does not mean an escape from accountability. They know that they will be answerable even for conduct that in years past would have resulted in a declination. Companies also realize that if they want to avoid pleading guilty, or to convince us to forego bringing a case altogether, they must prove to us that they are serious about compliance. Our prosecutors are sophisticated. They know the difference between a real compliance program and a make-believe one. They know the difference between actual cooperation with a government investigation and make-believe cooperation. And they know the difference between a rogue employee and a rotten corporation.
One of the reasons why deferred prosecution agreements are such a powerful tool is that, in many ways, a DPA has the same punitive, deterrent, and rehabilitative effect as a guilty plea: when a company enters into a DPA with the government, or an NPA for that matter, it almost always must acknowledge wrongdoing, agree to cooperate with the government’s investigation, pay a fine, agree to improve its compliance program, and agree to face prosecution if it fails to satisfy the terms of the agreement. All of these components of DPAs are critical for accountability.
But the real tell is when he confesses that he “sometimes–though … not always” let corporations off because a CEO or an economist scared him with threats of global markets failing if he held a corporation accountable by indicting it.
To be clear, the decision of whether to indict a corporation, defer prosecution, or decline altogether is not one that I, or anyone in the Criminal Division, take lightly. We are frequently on the receiving end of presentations from defense counsel, CEOs, and economists who argue that the collateral consequences of an indictment would be devastating for their client. In my conference room, over the years, I have heard sober predictions that a company or bank might fail if we indict, that innocent employees could lose their jobs, that entire industries may be affected, and even that global markets will feel the effects. Sometimes – though, let me stress, not always – these presentations are compelling. [my emphasis]
None of this is surprising, of course. It has long been clear that Breuer’s Criminal Division often bows to the scare tactics of Breuer’s once and future client base. (In his speech, he boasts about how well DPAs and NPAs have worked with Morgan Stanley and Barclays, respectively.)
It’s just so embarrassing that he went out in public and made this pathetic attempt to claim it all amounts to accountability.