Cybersecurity Act--Motion to Proceed

Floor Speech

BREAK IN TRANSCRIPT

Mr. DURBIN. Madam President, consider these ominous words:

To the loved ones of the victims who are here in this room ..... to those who are watching on television, your government failed you. Those who you entrusted with protecting you failed you. And I failed you. We tried hard, but that doesn't matter, because we failed.

Those are not my words. They contain a sentiment I hope none of us ever has to convey to the American people. Those are the words of Richard Clarke, the senior White House official who was in charge of counterterrorism efforts in the previous administration when the September 11 terrorist attacks occurred.

Mr. Clarke's testimony before the Ð9/11 Commission was apologetic, remorseful and tragic because he knew, he knew like no one else, our government had failed, failed to act on repeated warnings. This failure led to 9/11 and the largest loss of life on American soil at the hands of a foreign enemy since December 7, 1941, at Pearl Harbor.

Today, the national alarm security bells are ringing once again. This time, however, the enemy is not in a terrorist training camp learning how to make an explosive device or commandeer an aircraft. The enemy is not trying to sneak its way into the United States. The enemy we face does not need to hijack an airplane in order to wreck the American economy and to cause widespread loss of life. The only tool this enemy needs is a computer and access to the Internet.

The threat our Nation faces from a cyber attack will soon equal or surpass the threat from any terrorism that has consumed our attention so much since September 11. That is not my assessment. That is the assessment of the Director of the Federal Bureau of Investigation, Robert Mueller. In fact, he is not alone. There is an overwhelming bipartisan consensus among officials in the intelligence, defense, and national security community that America is incredibly vulnerable to a cyber attack that can be launched at any moment from anywhere in the world.

Michael Hayden, the former Director of the National Security Agency, Michael Chertoff, the former Secretary of Homeland Security who served under President George W. Bush, agreed. They and many other officials have joined the current Secretary of Homeland Security, Janet Napolitano, the current Director of the National Security Agency, GEN Keith Alexander, and others in warnings as follows: The cyber threat is imminent to America. It poses as serious a challenge to our national security as the introduction of nuclear weapons in the global debate 60 years ago.

The experts are sounding the alarm, telling us to take action now to prevent a catastrophic cyber attack that could cripple our Nation's economy, cause widespread loss of life, sadly send our economy into free fall. When the Cybersecurity Act of 2012 comes up for a vote, the Senate will have an opportunity to take action on this critical bill that will enhance our national security. In light of these warnings from the experts, the least we can do in the Senate is to vote to open the debate on this critically important bill.

I wish to thank its sponsors: Senator Lieberman, the chairman of the subcommittee, Senator Collins, the ranking member, Senator Feinstein of the Intelligence Committee, Senator Rockefeller on the Commerce Committee. They have put a lot of time and effort into this important piece of legislation. They have worked together on a bipartisan basis. They have listened to a wide range of comments, including a few I have offered, and I am pleased the revised Cybersecurity Act of 2012 incorporates many suggestions.

It will help make America safe by enhancing our Nation's ability to prevent, mitigate, and rapidly respond to cyber attacks. The bill contains important provisions for securing our Nation's critical infrastructure. Every day, without thinking about it, we rely on powerplants, pipelines, electric power grids, water treatment facilities, transportation systems, and financial networks to work, to live, to travel, to do so many things we take for granted.

All those critical systems are increasingly vulnerable to cyber attack from our enemies. Last year, there was a 400-percent increase in cyber attacks reported by the owners of critical infrastructure, according to the Department of Homeland Security. That increase does not even account for the many attacks that went unreported.

We do not think twice about it, but this infrastructure is the backbone of America's economy and our way of life. This bill has provisions that will help minimize our vulnerability and shore up our defenses. The bill also includes a new framework for voluntary information sharing so government agencies and private companies can improve their mutual understanding of cyber threats and vulnerabilities and develop good practices to keep us safe.

I thought it was worth doing a few months ago to call together a dozen major corporations in Chicago and across Illinois that I thought, with the advice of some people who were experts, might be vulnerable to cyber attack. I asked those experts in a closed setting, outside the press, what Congress could do to help them secure their infrastructure at their business and networks from cyber attacks.

The answer from each and every one of them was the same: We need to be able to share information on cyber threats with the government and other private entities. We need to receive information from them in order to know what they have done to effectively prevent and mitigate attacks.

Estimates are that 85 percent of America's critical infrastructure is owned by the private sector. Since we depend so much on the private sector for our critical infrastructure, the lines of communication between government and the private sector must be open. If we share best practices, the result could be to make us a secure nation.

Let me say as well, I have the highest regard for my friend and colleague Senator John McCain of Arizona. Senator McCain's life story is a story of patriotism and commitment to America. He understands the military far better than I ever will, having served and spent so many years working on the House Armed Services Committee. But I take exception to one of his statements earlier, at least what I consider to be the message of that statement, about how we have to be extremely careful in how we engage the private sector in keeping America safe from cyber attack.

I believe we should be open, transparent, and we should be respectful of the important resources and capacity of the private sector. But I think back 70 years now to what happened in London, when there was a blitzkrieg, and the decision was made by the British Government to appeal to every business, every home, every family, every individual to turn out the lights, because if the lights were on, those bombers from Germany knew where the targets could be found. It was a national effort to protect a nation. Should it have been a voluntary effort? Should we have had a big town meeting and said: Some of you can leave your lights on if you like, if you think it might be an inconvenience.

There comes a moment when it comes to national defense when we need to appeal to a higher level in protecting America. My experience has been that the private sector is right there. They are as anxious to protect this country as anyone. They are as anxious to protect individuals, families, even their own businesses. So this notion that somehow we are adversarial in protecting America with the private sector I do not think is the case.

In fact, Senator Collins is here representing the other side of the aisle. I know it is not the case. She and I have worked together. I have been very respectful of the efforts she and Senator Lieberman put into rewriting the rules for our intelligence community. They did it in a thoughtful and balanced way. This bill does too.

Are there amendments we might take? Of course. This is not perfect. No product of legislation is. But I have to say I believe the private sector will be our ally, our friend, our partner in making America safe. This should not be a fight to the finish as to whether it is government or the private sector which will prevail. Ultimately, America has to prevail.

Let me say a word about one part of this bill that I played a small role in addressing. Even through the threat in cyberspace is new and emerging, it calls to the forefront a familiar attention which we witnessed in Washington; on the one hand a mutually shared goal of protecting our country, on the other hand an important obligation to safeguard constitutionally protected rights to privacy and civil liberties.

It is this tension that led us to a conversation about some provisions and trying to find the right balance. The Cybersecurity Act of 2012 is not perfect, but it effectively strikes that balance between national security and individual liberty. The bill will enhance our national security and still do it in a way that is far superior to some of the alternatives that will be offered on the floor.

CISPA, the cybersecurity act that was passed by the House of Representatives, and SECURE IT, the alternative approach that has been introduced in the Senate, do not meet this standard, by my estimation. I wish to thank Senator Collins, Senator Lieberman, and all those engaged in this conversation but special thanks to my colleague Senator Franken because he is chair of the Privacy Subcommittee of our Senate Judiciary Committee.

We joined together with some colleagues: Senators Coons, Blumenthal, Sanders, and Akaka. We asked the sponsors of the legislation to work with us and they did. The revised bill now requires that the government cybersecurity exchange, to which private companies can send threat indicators, must be operated by civilian agencies. I think that is smart.

The cybersecurity threat indicator could be a sensitive, personal communication, such as an e-mail from a spouse or private message on a social media site. As a result of our efforts, no longer can personal communications be indiscriminately sent directly to the NSA or CIA. The people who work at these agencies are fine, dedicated public servants, but these agencies are often shrouded in secrecy. I learned that as a member of the Senate Intelligence Committee.

To have the appropriate oversight, we ask that the first line of review be with a civilian agency subject to congressional oversight. This does not mean our intelligence and defense agencies will never be able to apply their experience and expertise to analyze and mitigate cyber threats.

They should not be the first recipients, but the bill requires--and I think it is entirely appropriate--relevant cyber threat information can be shared by these agencies in real time. Waste no time doing it. Send it to the agencies if there is any perceived threat to America's security.

The revised bill no longer provides immunity for companies that violate the privacy rights of Americans in a knowing, intentional, or grossly negligent way--not simple negligence but things that go over that line dramatically.

I can support providing immunity for companies to share cybersecurity threats with the government, as long as they take adequate precautions and follow commonsense rules established in the bill.

The revised bill enables law enforcement entities to receive information about cyber crimes from cybersecurity exchanges without first going to court to obtain a warrant. To ensure these exchanges are not used to circumvent the Constitution and they do not create a perpetual warrantless wiretap, the bill requires law enforcement to only use information from the exchanges to stop cyber crimes, prevent imminent death or bodily harm to adults or prevent exploitation of minors.

The revised bill now requires that the rules for how the government will use and protect the private information it receives must be in place before companies begin sending information to the new cybersecurity exchanges. That makes sense. To be sure that government agencies follow the rules for using and protecting private information, the revised bill gives individuals the authority to hold the government accountable for privacy violations.

To ensure transparency and accountability, the revised bill requires recurring, independent oversight by the inspector general and the Privacy and Civil Liberties Oversight Board.

These are commonsense reforms. Senator Lieberman spoke to the Democratic Senate caucus luncheon the other day and addressed these directly. He said he took these changes to those who were in charge of our cybersecurity and said to them: Give me an honest, candid assessment. If you think this ties our hands in protecting America, tell me right now. They reviewed them carefully, debated them, and came back and said: No, these are things we can live with and work with. That is the kind of approval we are looking for from those who have this awesome responsibility.

So as a result, this bill will have my support, because I think it keeps America safe from a threat which many Americans don't even know about but could literally take or change our lives in a heartbeat. It also has the support of many progressive groups from the left and center and right. It is an indication to me we have struck the right balance.

I thank those who helped us reach this point. As with any piece of substantial legislation, there is going to be disagreement. Senator McCain expressed some areas of concern. That is what debate and amendments are all about. Let's move this bill forward this afternoon. Let's entertain relevant, germane amendments. Let's take this as seriously as the threat is serious to the United States. That, to me, is the right way to go.

Again, I thank Senator Collins personally and all the others who made this bill a reality in bringing it to the floor for our consideration.

I yield the floor.

BREAK IN TRANSCRIPT

Source