Cybersecurity Information Sharing Act of 2015--Motion to Proceed

Floor Speech

BREAK IN TRANSCRIPT

Mr. WYDEN. Mr. President, so that all are clear with respect to where matters are with the cyber security legislation, a couple of days ago it was my fear that this bill would be brought up--it is a badly flawed bill--with no opportunity for Senators on either side of the aisle to fix the legislation. I was afraid that it would come up with no amendments and people would say ``Oh my goodness, there are serious cyber threats.'' And that is unquestionably correct. My constituents in Oregon, for example, have been hacked by the Chinese. I was concerned that people would say ``We have all of these cyber threats; we have to act'' and there would be no real opportunity to show how the legislation in its current form creates more problems than it solves.

So that all concerned understand where things are, there are going to be more than 20 amendments to this badly flawed bill. Those of us who want to make sure there is a full airing of the issues have come to understand that there is no time limit that has yet been agreed to on those amendments. So there is going to be a real debate, and, of course, that is what the Senate is all about.

I particularly wish to commend the millions of advocates around the country who spoke out. I understand there was something like 6 million faxes that were sent to Members of this body.

I am going to take a few minutes--I see my colleagues are here as well--to describe where I think this debate is and give a sense of what the challenge is going forward.

I start with the basic proposition that we have a very serious set of cyber security threats, and I touched on seeing it at home. Second, information sharing can be valuable. There is certainly a lot of it now. It can be constructive. Information sharing, however, without vigorous, robust privacy safeguards, will not be considered by millions of Americans to be a cyber security bill. Millions of Americans will say that legislation is a surveillance bill.

So what I am going to do tonight--just for a few minutes because it is my understanding there are colleagues who would also like to speak--is describe exactly where this debate is.

As written, the cyber security legislation prevents law-abiding Americans from suing private companies that inappropriately share their personal information with the government. When I say personal information, I am talking about the contents of emails, financial information, basically any data at all that is stored electronically. CISA, as the bill is called, would allow private companies to share large volumes of their customers' personal information with the government after only a cursory review. Colleagues who want to look at that provision ought to take a look at page 16 of the bill.

We were told repeatedly that this legislation is voluntary. The fact is, it is voluntary for the companies, but for the citizens of Pennsylvania, the citizens of Oregon, citizens across this country, it is not voluntary. The people of Pennsylvania won't be asked first whether they want their information sent to the government. Oregonians won't have the chance to say whether they want that information sent. For them, this legislation is mandatory.

To explain the damage that I believe this legislation would do, I want to take a minute to explain how cyber security information sharing works now. Right now the Department of Homeland Security operates a national cyber security watch center 24 hours a day, 7 days a week. This watch center receives cyber security threat information from around the Federal Government and from private companies, and this watch center sends out alerts and bulletins to security professionals to provide them with technical information about cyber security threats. In fiscal year 2014, this watch center sent out nearly 12,000 of these alerts to more than 100,000 recipients. That happens today, with lots of companies participating.

The system that is in place today includes rules to protect the privacy of law-abiding Americans. These rules ensure that companies have a strong interest in protecting the privacy of their customers. But the legislation as it has been written now overrides those rules. The bill in front of us prevents individual Americans from suing companies that have mishandled their private information. As a result, companies would suddenly, in my view, not have the same incentives with respect to caring about sharing their customers' personal information with the government. And my concern and the concern, I believe, of millions of Americans is that the interests of some who are overzealous--overzealous in government, overzealous in the private sector--would overwhelm the interests of all of those customers who voluntarily handed over their information.

I thought I would give a couple of examples of the problems the bill in its current form causes. Imagine that a health insurance company finds out that millions of its customers' records have been stolen. If that company has any evidence about who the hackers were or how they stole this information, of course it makes sense to share that information with the government. But that company shouldn't simply say ``Here you go'' and hand millions of its customers' financial and medical information over to a wide array of government agencies.

The records of the victims of a hack should not be treated the same way that information about the hacker is treated. If companies are sharing information for cyber security purposes, they ought to be required to make reasonable efforts to remove personal information that isn't needed for cyber security before that information is handed over to the government. And those government agencies ought to focus on using that information to combat a cyber security threat.

That, I say to my colleagues, is not what the bill says. Page 16 of the bill would very clearly authorize companies to share large amounts of personal information that is unnecessary for cyber security, after only a cursory review.

Now I wish to speak about just one other issue specifically that I think Senators are not familiar with, and that is the issue of cyber signatures. Cyber signatures are essentially recognizable patterns in online code. A number of informed observers have raised the concern that once individual cyber signatures are shoveled over to the government by private companies, they could be used as the basis for broad surveillance affecting law-abiding Americans. I am not going to confirm or deny any of the press reports that have raised concerns about cyber signatures being used in this way, but I believe Senators should understand that this is certainly--and it is being widely discussed in the public arena--a theoretical possibility, and that helps underscore the importance of including a strong requirement for private companies to remove unrelated personal information about their customers before dumping data over to the government.

In wrapping up, I would be remiss if I didn't note that a secret Justice Department legal opinion that is clearly relevant to the cyber security debate continues to be withheld from the public. This opinion interprets common commercial service agreements, and in my judgment it is inconsistent with the public's understanding of the law. So once again we have this question of what happens when the people of Pennsylvania, Virginia, or Oregon think there is a law because they have read it in the public arena or on their iPad at home and then there is a secret interpretation.

I have urged the Justice Department to withdraw that secret Department of Justice opinion that relates directly to the cyber security debate. They have declined to do so. I suspect many Senators haven't had the chance to review it. As I have done before on this type of topic, I would urge Senators or their staffs to take the time to read it because I believe that understanding the executive branch's interpretation of these agreements is an important part of understanding the relevant legal landscape on cyber security.

I am going to close by speaking about the question of effectiveness. I think we all understand that we are facing very real cyber threats. I am of the view that this bill in its present form would do little, if anything, to stop large, sophisticated cyber attacks like the Office of Personnel Management had.

I don't think Senators ought to just take my word for it. In April, 65 technologists and cyber security professionals expressed their opposition to the bill in a letter to Chairman Burr and Vice Chairman Feinstein. In referring to the bill and two similar bills, they wrote:

We appreciate your interest in making our networks more secure, but the legislation proposed does not materially further that goal, and at the same time it puts our users' privacy at risk.

As they wrap up their letter, this group of technologists and cyber security professionals state:

These bills weaken privacy law without promoting security.

That has always been my concern. If we look back at our experiences, we have tried to write these new digital ground rules. Fortunately, we took a step in the right direction as it related to NSA rules. The challenge has always been the same. The people of our country want to be safe and secure in their homes and in their businesses and in their communities, and they want their liberty. Ben Franklin said anybody who gives up their liberty to have security doesn't deserve either.

What troubled me and why I am glad that the Senate has stepped back from precipitous action where we would have just passed this bill without any amendments--we will have a chance in the fall to look at ways to address cyber security in a fashion that I think does respond to what our people want, and that is to show that security--in this case, cyber security--and liberty are not mutually exclusive. It is sensible policies worked out in a bipartisan way that will respond to the needs of this country in what is unquestionably a dangerous time.

With that, I yield the floor.

BREAK IN TRANSCRIPT

Source