Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

That is the $64,000 question. This being Washington, DC, it&rsquo;s more likely a multi-million dollar question, and the answer is unclear. The Senate voted 84-11 last Thursday to end debate on a procedural motion that allows <a href="http://www.gpo.gov/fdsys/pkg/BILLS-112s3414pcs/pdf/BILLS-112s3414pcs.pdf">a revised bill, S. 3414</a>, sponsored by Homeland Security and Government Affairs Committee Chairman Joe Lieberman (D-CT) to be brought up for consideration. However, agreeing to debate a bill doesn&rsquo;t mean agreeing to a vote on it, much less support for it. As of Tuesday afternoon Senators were still negotiating how to move forward on the 90 amendments the bill has already attracted. There is little time left to consider more than a few&nbsp;before the Senate is scheduled to recess this Friday for a month-long summer break. As this blog has described since the beginning of the year, there is widespread support among Democrats, Republicans, and the White House on the need for cybersecurity legislation. But there is fierce disagreement over what it should look like. A principal issue all along has been whether the bill should impose certain security standards on the private sector, with which most of the nation&rsquo;s critical infrastructure resides, or set up a voluntary program. The government&rsquo;s authority over information collected in the name of cybersecurity has also raised concerns among privacy advocates. The <a href="http://www.gpo.gov/fdsys/pkg/BILLS-112s3414pcs/pdf/BILLS-112s3414pcs.pdf">200-page revised bill</a>, (<a href="http://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2012/07/Summary07312012.pdf">summary</a> and <a href="http://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2012/07/Outline07312012.pdf">outline</a>) has shifted away from a regulatory approach toward providing incentives for businesses to adopt best practices. It also contains restrictions on what government agencies can receive cybersecurity information and on how that information can be used and provides legal recourse for individuals if the law is violated. These and other changes have garnered the support of <a href="http://www.hsgac.senate.gov/issues/cybersecurity">numerous businesses and the ACLU</a>, as well as the <a href="http://www.whitehouse.gov/sites/default/files/omb/legislative/sap/112/saps3414s_20120726.pdf">Obama Administration</a>. However, divisions in the business community remain, as demonstrated by continuing <a href="http://www.freeenterprise.com/enough-distractions-it-s-time-consensus-oriented-cybersecurity-legislation">opposition by the US Chamber of Commerce</a>, which fears the bill could ultimately lead to regulation. Further complicating the picture are the host of amendments &ndash; some related, some not &ndash; to the bill: Sen. Pat Toomey (R-PA) has filed his <a href="http://www.gpo.gov/fdsys/pkg/BILLS-112s3333is/pdf/BILLS-112s3333is.pdf">Data Security and Breach Notification Act</a> as an amendment and Oversight of Government Management Subcommittee Chairman Daniel Akaka (D-HI) said at today&rsquo;s hearing on the &ldquo;<a href="http://www.hsgac.senate.gov/subcommittees/oversight-of-government-management/hearings/state-of-federal-privacy-and-data-security-law-lagging-behind-the-times">State of Federal Privacy and Data Security Law: Lagging Behind the Times?</a>&rdquo; that he will do the same with his <a href="http://www.gpo.gov/fdsys/pkg/BILLS-112s1732is/pdf/BILLS-112s1732is.pdf">Privacy Act Modernization for the Information Age Act</a>. The Chamber and several other industry trade associations oppose the addition of such data privacy and breach notification measures to the bill, preferring that they be vetted in committees and taken up independently. Read <a href="http://www.uschamber.com/issues/letters/2012/joint-association-letter-us-senate-regarding-amendment-s-3414">Joint Association Letter to the U.S. Senate Regarding Amendments to S. 3414</a>. The bill could also become a focal point for gun control amendments in light of the recent tragedy in Colorado and for any number of pet issues various Senators have been trying to move for the last 19 months. To wax metaphorical, when the last train appears to be leaving the station, all sorts of folks try to hitch a ride. It&rsquo;s hard to tell how this will end up. With the elections only three months away, at least 1/3 of the Senate is very sensitive to lobbying by key constituencies and Members may decide that the Hippocratic oath / political rule of thumb &ldquo;first, do no harm&rdquo; means don&rsquo;t pass an obscure bill the public isn&rsquo;t clamoring for. But outside-the-beltway events such as the massive power outages across India (which so far don&rsquo;t appear to involve cyber breaches) may yet spur action, as no candidate wants to be caught flat footed were a cybersecurity incident to occur before November 6. For now, the Senate Chamber is spending most of the day in a quorum call while leaders work to resolve issues off the floor, so check back here for updates as things progress.

Senate Takes Up Cybersecurity Bill: Can National Security Trump Politics This Close to the Election?