Cybersecurity Information Sharing Act of 2015--Motion to Proceed

Floor Speech

BREAK IN TRANSCRIPT

Mr. WYDEN. Mr. President, I will be very brief. I understand there has already been an objection.

I will speak later in the afternoon or early evening in some detail about why I have significant reservations with respect to this legislation.

To say--as we heard again and again throughout the day--that this is about voluntary information sharing is essentially only half true. The fact is, companies could volunteer to share their customers' information with the government, but they wouldn't have to ask for permission from their customers before handing it over. That is one reason every major organization with expertise and interest on privacy issues has had reservations about the bill. It may be voluntary for companies, but it is mandatory for their customers and their consumers. They are not given the opportunity to opt out.

The legislation has been public for months, and dozens of cyber security experts have said it wouldn't do much to stop sophisticated, large-scale attacks such as the horrendous attack at the Office of Personnel Management.

On Friday, the Department of Homeland Security--an absolutely essential agency as it relates to this bill--wrote a letter to our colleague, the distinguished Senator from Minnesota, Mr. Franken, and said if this bill's approach is adopted, ``the complexity and inefficiency of any information sharing program will markedly increase.'' The Department of Homeland Security added that the bill ``could sweep away important privacy protections.'' That is a pretty strong indictment from the agency that would be in charge of implementing the legislation.

As I have indicated a couple of times in the last day or so, I think the managers, Senator Feinstein and Senator Burr, have made several positive changes, but the bottom line is it doesn't address the very substantial privacy concerns that relate to this bill. The fact is, cyber security is a very serious problem in America.

Oregonians know a lot about it because one of our large employers was hacked by the Chinese. SolarWorld was hacked by the Chinese because they insisted on enforcing their rights under trade law. In fact, our government indicted the Chinese for the hack of my constituents and others.

So cyber security is a serious problem. Information sharing can play a constructive role, but information sharing without robust privacy safeguards is really not a cyber security bill. It is going to be seen by millions of Americans as a surveillance bill, and that is why it is so important that there be strong privacy guidelines.

The fact is, in the managers' legislation, the section allowing companies to hand over large volumes of information with only a cursory review would be essentially unmodified. The Department of Homeland Security asked for some specific changes to the language, which the managers' amendment does not include. So my hope is, we are going to have a chance to have a real debate on this issue. Personally, I would rather go down a different route with respect to cyber security legislation. In particular, I recommend the very fine data breach bill of our colleague from Vermont Senator Leahy, but if Senators have their hearts set on doing the bill before us, it is going to need some very substantial amendments, both to ensure that we show the American people that security and privacy are not mutually exclusive, that we can do both, and to address the very serious operational reservations the Department of Homeland Security has raised. Neither set of concerns is thoroughly addressed by the managers' amendment.

So my hope is that we are going to have a chance to make some very significant reforms in this legislation. After seeing what has happened over the last few weeks, where the government isn't exactly doing an ideal job of securing the data it has, and now we are going to propose legislation that has private companies, without the permission of their customers, for example, to dump large quantities of their customers' data over to the government with only a cursory review--this legislation is not going to be real attractive to the millions of Americans who sent us to represent them.

In fact, in just the last few days, I read in the media that some of the opponents of this legislation have sent something like 6 million faxes to the Senate--and people wonder if there are still fax machines. I guess the point is to demonstrate it is important that we understand, as we look at digital communications, what the challenge is.

I will have more to say about this later in the afternoon and in the evening, but I wanted to take this opportunity, since we have just gotten out of the party caucuses, to make some corrections with respect to what we were told this morning and particularly on this question about how this is a voluntary bill. Ask millions of Americans whether it is voluntary when companies can hand over their private information to the government without their permission.

I yield the floor.

BREAK IN TRANSCRIPT

Source