Privacy Advocates Warn the New Cybersecurity Bill Compromises User Data

Cybersecurity legislation has been a hot topic this year, especially since President Obama’s comments during his State of the Union address. Since the address, the President has called for sweeping changes to the government’s priorities on cybersecurity. And while the Cybersecurity Information Sharing Act represents progress to some, privacy advocates are concerned.

President Obama’s requests for funding for the initiative included funds for a \"Civilian Cyber Campus,\" which aims to increase information sharing between the private and public sector. This is a primary goal of the CISA bill; however, it could also compromise the privacy of user data.

Oregon Senator Ron Wynden, the lone voice of dissent on the Senate Intelligence Committee wrote:

If information-sharing legislation does not include adequate privacy protections then that’s not a cybersecurity bill—it’s a surveillance bill by another name.It makes sense to encourage private firms to share information about cybersecurity threats. But this information sharing is only acceptable if there are strong protections for the privacy rights of law-abiding American citizens.

Earlier versions of the bill raised similar concerns. Robin Green, Policy Counsel for the Open Technology Institute, said she isn’t convinced the bill is problem free. While Green was glad the committee considered some of the privacy concerns, she’s isn’t convinced that the changes will be enough to sway privacy advocates.

Based on how dangerously broad and vague the last version of the bill was, it would be surprising if the bill agreed to in secret today will garner the support of the privacy community.

However, other committee members have attempted to put these concerns to rest. Committee chair Richard Burr wrote in a statement that amendments have been added to the bill that will require companies and the government to remove personally identifiable information before sharing. Additionally he noted, the data may only be used in the case of a cyber threat, and all information sharing is voluntary.

There are always concerns with regard to internet related legislation, and sometimes the concerns are justified. If CISA has undergone significant revisions, and Burr’s claims hold true, then the bill could serve to strengthen the internet. Those who are less optimistic think the bill could function as Patriot act 2.0.