The Cybersecurity Act of 2012, bipartisan legislation recently introduced by senators Joe Lieberman and Susan Collins, failed to pass a key vote in the Senate on Thursday. The bill had sought to provide an overarching framework to defend the United States' computer systems against cyber threats from foreign countries and from attacks on America's critical infrastructure, like the electricity grid. Unfortunately, in doing so, the bill granted companies new powers to spy on users, to share that information with the government, and to claim broad legal immunity for their actions. This would have created serious risks to privacy by creating a new spying regime where users could be surveilled as long as a company perceived any vague threat to its network.
Every year for the past three years, some form of cybersecurity bill has been introduced, and every year for the past three years civil liberties organizations like the American Civil Liberties Union and the Electronic Frontier Foundation have fought hard for privacy. This time, a cybersecurity bill in the Senate reached its farthest point ever and would've been key in determining how America handles its public and private sector cybersecurity. At over 200 pages, the bill provided for investment in cybersecurity research and development, the creation of public-private exchanges to share cybersecurity information, and non-mandatory regulatory practices for companies to secure computer systems.
But it also would have granted companies the power to spy on users, share personal information of innocent users with the government, and use countermeasures, which could involve blocking or dropping packets – all in the name of protecting against vaguely defined "cybersecurity threats". For example, under the bill, a "cybersecurity threat" existed whenever a company perceives a user impairing the availability of its networks. As a result, surveillance would be outsourced to private companies that are not governed by the fourth amendment – the constitutional amendment granting protection from unreasonable search and seizure. And when using countermeasures, companies can modify, block, or disrupt internet traffic so long as they believe the actions are allowed by the vague definitions of the bill.
The data exchanges between companies and the government created by the bill have been characterized as "voluntary" – companies aren't forced to hand data to the government if they don't want to. But it's not voluntary for users. Millions of Internet users worldwide store their sensitive data in American-based companies like Google, Facebook, Yahoo! and others. This data – from lists of friends to content of emails – should not be placed in the hands of the government without strict judicial oversight and due process. Whatever else you can say about this legislation, it is most certainly not voluntary for users.
While companies were supposed to take "reasonable efforts" under the proposed bill to remove any personal information of users unrelated to cyber threats, it would have been challenging for the public to hold companies accountable to that standard. Most individuals wouldn't have known if their data was being handed to the government. And even if an individual discovers data being shared improperly, the bill granted broad legal immunity to companies that participate in the cybersecurity information sharing programs. That means it would be very challenging for a user whose privacy was invaded to sue a company in order to hold them accountable. Paul Rosenzweig of the Heritage Foundation notes that the immunity is written as "a complete and absolute liability protection for monitoring activity." Immunity is a powerful tool. Just like the government can be held accountable to its citizens, companies should be able to be held accountable to its customers.
At the end of the day, these fundamental flaws are situated in a larger premise: sharing data with the government without warrants or judicial process. Despite this being a surveillance bill in disguise, some privacy-protective amendments like the Franken-Paul amendment would have ensured companies were not given new powers to spy on users. Other amendments, like those proposed by John McCain and Kay Bailey Hutchison, sought to grant even broader immunity and allowed the National Security Agency to be a direct recipient of cyber threat information. The latter is particularly troubling because the data being collected and shared under the guise of cybersecurity is potentially immense. The senators should heed NSA's shadowy history of running roughshod over the constitution and its own insistence that it doesn't want to run cybersecurity.
In attempting to protect networked computer systems, the proposed Cybersecurity Act fell woefully short of protecting users' privacy. Its intent was to increase security of both public and private computer systems, but its methods would have forged invasive, and dangerous, new weapons.