LET it be agreed that something serious needs to be done to contain the mounting cost of cyber-crime. Though no-one knows for sure, corporate America is believed to lose anything from $100 billion to $1 trillion a year from online theft of proprietary information—trade secrets, research findings, internal costs, marketing plans, personal information, credit-card numbers, bank-account details and much more. In many instances, digital fingerprints implicate hackers in China, Russia and elsewhere. This is a serious issue that undermines American competitiveness, costs the country jobs, hurts exports, erodes companies' bottom lines and saps the nation's entrepreneurial vigour. Without question, something has to be done.



Let it also be agreed that cracking down on cyber-crime does not—and should not—require the population at large to surrender any constitutional rights. It is not beyond the wit of government sleuths to devise procedures for tracking online criminals without causing harm to the general public. That, surely, is the first commandment of law enforcement in any democracy.



Let it further be agreed that Americans are among the most fortunate of people. The wisdom of the country's founders has bequeathed them a set of inalienable rights that are the envy of the world. In particular, the ten constitutional amendments promulgated in 1791 and embodied in the Bill of Rights endow the common people with sovereign authority over their own freedom and well-being.



What, then, are American citizens to make of their government's latest attempt to fight online crime on their behalf? To say the Cyber Intelligence Sharing and Protection Act (CISPA), which the House of Representatives approved on April 26th by a 248-168 majority, is controversial is to put it mildly. The bill is essentially an amendment of the National Security Act of 1947, which contains no direct provisions for dealing with cyber-crime. CISPA's aim is to make it easier for the federal government and private companies to share data about online threats with one another.



At present, government information about such matters is classified. As such, it is illegal for government agencies to share what they know about online threats with the private sector. Meanwhile, companies are reluctant to share their own knowledge with one another and the government for fear of running foul of anti-trust rules. Were it to become law, CISPA would facilitate the exchange of information between the two.



At first glance, CISPA looks a good deal for companies confronting such threats on a daily basis. Unlike last year's Stop Online Piracy Act or the PROTECT IP Act—both of which died on the floor of Congress after being skewered by the private sector for violating free speech and raising the cost of doing business—CISPA has been widely backed by information-technology firms, including AT&T, Facebook, Microsoft, IBM, Intel, Oracle and Symantec. As Robert Holleyman of the Business Software Alliance notes, the act “unties the hands of companies on the front lines of the digital economy”.



Yet companies are deluding themselves if they think CISPA is there to help them. The act's congressional sponsors have little interest in the private sector's woes over online crime. Instead, CISPA treats cyber-security as strictly an intelligence operation against individuals, rather than an attempt to thwart crime against corporations. In the circumstances, the flow of information would be almost exclusively one way—from the private sector to the central government.



If CISPA were to become law, firms that collect lots of information on individuals (eg, internet service providers, phone companies, tech firms and online retailers) would quickly find themselves being coerced into helping the National Security Agency (NSA) and the Department of Homeland Security (DHS), among others, to ferret out members of the public with anti-social tendencies. Given CISPA's ability to exempt companies from prosecution, they would be pressed to hand over customers' e-mails, web-postings and even social-media musings without the latter's knowledge or consent, nor with any justifiable cause for believing them to be a danger to society.



Regrettably, such government pressure is not uncommon. From 1945 onwards, the NSA ran a clandestine telegram-interception programme called Operation Shamrock. This forced telegraph companies, foreign as well as domestic, to hand over copies of all the messages sent to and from the United States. Later, President Nixon, plagued by anti-Vietnam-war protests, had Operation Shamrock eavesdrop on American citizens as well.



More recently, the NSA sought, and received, billions of customer records from AT&T, Verizon and other phone companies. Only Qwest refused to comply. Verizon also turned over customer data to the Federal Bureau of Investigation without a court order. In 2008, after a whistle-blower at AT&T accused his employer of illegally opening its network to the NSA, the practice was retroactively legalised by Congress.



CISPA would go further still. If it became the law of the land, it would trump all existing federal and state laws concerning privacy, wire-tapping and surveillance. In so doing, it would allow the NSA, DHS and any other government eavesdroppers to spy on private individuals without having to face criminal charges, independent oversight or the need to obtain a warrant from a judge. (The British government likewise is planning to eavesdrop on all web traffic.)



Many Americans find such unrestricted collection of personal data an unwarranted intrusion by the government and more than a little scary. The First Amendment is supposed to protect citizens' freedom to say more or less whatever they like without fear of retribution. The Fourth Amendment protects them from unreasonable search and seizure. CISPA would ride roughshod over both. And, in the process, it would do little to help solve the problem of corporate cyber-crime.



It is not as though it would do much for national security, either. Today, the NSA is swamped with data on American citizens. William Binney, who served with the agency for 30 years and was once director of its World Geopolitical and Military Analysis Reporting Group, reckons the NSA has already collected some 20 trillion “transactions” (ie, telephone calls, e-mail messages and other forms of personal data) from American citizens without their knowledge. That is over 60,000 items of information for every man, woman and child in the country.



The data are collected mainly by NaruInsight monitoring devices, which analyse traffic at choke points on the internet. The equipment, made by Narus, a subsidiary of Boeing based in Sunnyvale, California, is alleged to have been used by AT&T to collect customer data on behalf of the NSA. The company's latest technology, codenamed Hone, uses artificial intelligence to identify the voice-prints and photographs of individuals that fit a particular target profile, and then identifies them with specific phone numbers.



Meanwhile, the NSA has had to build a huge storage facility in Bluffdale, Utah, to handle the enormous spillover from its data-processing centres in San Francisco and elsewhere around the country. The additional flood of data from CISPA would bring Bluffdale and the NSA's other centres to their knees.



According to IDC's Digital Universe Study, some 1.8 sextillion (1021) bytes of data were added to the world's memory banks last year, about a third of which passed through American networks. Not even companies that specialise in “big data”, let alone government agencies, could hope to analyse such an inundation.



The task of analysing the world's data to identify potential cyber-threats “has gone from difficult to impossible,” concludes “Future Tense”, a study by Arizona State University, the New America Foundation and Slate, an online magazine. “This shift completely redefines the cyber-security problem,” noted John Villasenor, a professor of electrical engineering who is also a fellow of the Brookings Institution, an American think tank, in a posting on Slate last week. “The idea underpinning CISPA—that the government should sit at the centre of the cyber-security universe, collecting all the information about cyber-threats, analysing it and dispensing solutions—will no longer work.” There are just too many data points today.



The answer, surely, is to focus on specific domains where the amount of data has remained more manageable—like the electricity grid, the financial system, and the mobile-phone networks. The government has a vital role to play in securing such critical infrastructure. This much was at least recognised by the Cybersecurity Act of 2012, the Senate's alternative to CISPA. The Senate bill aims more realistically to enhance merely the reliability and resilience of America's computer and communications networks.



As the “Future Tense” study concludes, the days when the government could act effectively as the cyber-security czar for all of digital America are gone. With or without legislation, those days are not coming back. The proper cyber-security strategy is one that is both agile and distributed—just like many of the threats it will need to counter.