There's been a bunch of buzz around this bill in the House, formally HR 3523.

The bill allegedly "improves" the United States' defenses against cyberattacks of various sorts.  Anyone who has followed the news, or the Ticker for that matter, knows that the issues raised in the general sense are real -- there has been an enormous uptick in the instance of things that could be called "cyberwarfare" over the last number of years, with a huge percentage of the attacks coming from China.

The bill facially appears to be pretty pedestrian, essentially trying to "encourage" private and government interaction on sharing of threats detected and actions taken to deter them.  What's not to love about such a thing?

Critics point here:

‘‘(4) EXEMPTION FROM LIABILITY.—No civil or criminal cause of action shall lie or be maintained in Federal or State court against a protected entity, self-protected entity, cybersecurity provider, or an officer, employee, or agent of a protected entity, self protected entity, or cybersecurity provider, acting in good faith—

‘‘(A) for using cybersecurity systems to identify or obtain cyber threat information or for sharing such information in accordance with this section;
or
‘‘(B) for decisions made based on cyber threat information identified, obtained, or shared under this section.

Ehhhh..... that's where the problem is.

There's an allegedly "good faith" requirement but that's pretty weak.  And further on in the statute is an extremely weak redress provision for intentional breaches by the Federal Government (only!) limiting recovery to $1,000 or actual damages plus harm.  There is no liability, civil or criminal, that can be imposed in a punitive form even where the breach is intentional.

Worse, there's an absolute bar against liability being attached to private parties associated with such an action as they're immune!

There is one (and only one) good set of exempted records in the bill, including library records, book sales, firearms records, tax returns, education and medical records -- but that leaves open telephone, internet and other related records.

Nobody is arguing that we shouldn't increase our threat protection when it comes to cybersecurity or that it is isn't a real problem.  It is a real problem, but a lot of it is coming from easily-identified places and a plurality of that is coming from one place -- CHINA.

Immunity grants to private parties, however, are inherent vice and must be opposed.  There's simply no argument for them -- if you're doing something evil and a private party reports it there's no liability issue involved.

Your right to seek redress under the law for abuses served up at the hand of private entities, however, must be maintained.

CISPA does not do that, and in fact is carefully crafted to prevent you from recovering from firms that violate your rights or even their own written policies, provided they claim there is some "cybersecurity" involvement, and as such it must not become law.