OTI Very Disappointed By Senate Intelligence Committee’s Cyber Bill

Late Tuesday night, the Senate Select Committee on Intelligence released the final version of its cybersecurity information sharing bill, the Cybersecurity Information Sharing Act of 2015 (CISA). Based on a review by New America’s Open Technology Institute, that version of the bill—approved by the committee in a closed-door meeting last week—fails to effectively address the most significant privacy concerns that were raised by the discussion draft of the bill. Committee leaders have suggested that the bill will go to the Senate floor for a vote as early as April.

OTI strongly opposed the CISA discussion draft, along with a coalition of 47 other privacy advocates and security experts that sent a letter to the Committee raising serious concerns about the threat CISA posed to privacy and Internet security. While Committee members stated that they amended the bill to address those concerns, the final version of the bill falls far short when it comes to adequately protecting Americans’ privacy.

In its final form, the bill:

One positive change made to the bill was a narrowing of the dangerously broad allowance for companies to engage in undefined “countermeasures” against intruders, countermeasures that could themselves unintentionally cause cybersecurity harms. Now, the bill speaks in terms of “defensive measures,” which lessens—but may not completely eliminate—the concern.

A redlined version of the CISA discussion draft that incorporates all of the Committee’s changes is available here.

“We are gravely disappointed by the Senate Intelligence Committee’s failure to add any significant new privacy protections to the the Cybersecurity Information Sharing Act. Most of the changes the Committee made when approving the bill last week are cosmetic, such that the final bill—like the draft bill before it—does more to authorize cyber-surveillance than to protect cybersecurity,” said Robyn Greene, Policy Counsel at New America’s Open Technology Institute. “CISA’s broad authorization of indiscriminate information-sharing would open the digital floodgates and give the NSA access to much more of Americans’ personal Internet data—which is all the more objectionable considering that Congress has failed to do anything to rein in the massive NSA surveillance programs revealed almost two years ago,” she continued. “CISA’s supporters should expect strong opposition from the privacy and civil liberties community if the bill reaches the Senate floor, especially if it gets there before the Senate votes to enact strong surveillance reforms.”