Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

Congress is back from a two week Easter recess and despite lingering concerns from privacy groups, House leaders plan to bring to the floor for votes one or more cybersecurity bills designed to protect the nation&rsquo;s critical infrastructure &ndash; from power plants to financial markets &ndash; by encouraging information sharing about cyber threats between the government and private business. The bills could be considered as early as next week. House Intelligence Committee Chairman Mike Rogers (R-MI) has been working over the recess to address concerns of privacy advocates about his <a href="http://intelligence.house.gov/sites/intelligence.house.gov/files/documents/04162012HR3523.pdf">Cyber Intelligence Sharing and Protection Act, H.R. 3523</a>. In recent redrafts, the bill has been revised to include data minimization language to reduce the amount of detailed information businesses would share with the government.&nbsp; Further, the bill now eliminates references to theft of IP that raised concerns similar to the anti-piracy/anti-counterfeiting bills that withered in the face opposition earlier this year (SOPA/PIPA, S. 968/H.R. 3261).&nbsp;It would also now allow lawsuits against the government for intentional or willful improper disclosure of personal data that&rsquo;s been collected.&nbsp;(Note:&nbsp;the above link&nbsp;to the April 16 discussion draft which incorporates amendments adopted at markup (in green) and new potential amendments under consideration (in yellow for changes from the April 12, 2012 draft and in blue for new changes in this draft).) However, opposition to a communications monitoring provision in Rogers&rsquo; bill continues from a coalition of privacy and civil liberties groups that fear the language is too vague and would allow companies to share user data with the government without a court order. The Electronic Frontier Foundation is leading a twitter campaign against &ldquo;CISPA&rdquo; this week using the hashtags #CongressTMI and #CISPA.&nbsp;Other groups are concerned about provisions that would cut off FOIA access to information companies share with the government. More about their concerns can be found <a href="https://www.eff.org/deeplinks/2012/04/internet-congress-cispa-tmi">here</a> and <a href="http://www.openthegovernment.org/sites/default/files/Rogers%20cybersecurity%20letter%202.pdf">here</a>. Business groups are also weighing in on cybersecurity this week.&nbsp; A coalition of 26 associations wrote House leaders today urging them to focus on several policy principles without endorsing or opposing any of the bills.&nbsp; The organizations range from the American Chemistry Council to the Real Estate Roundtable and they want Congress to take a &ldquo;nonregulatory step forward&rdquo; on cybersecurity by improving liability protections, strengthening cyber R&amp;D, reforming FISMA, educating the public, and supporting public-private collaboration.&nbsp;<a href="http://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2012/04/Letter_to_House_Leadership_Regarding_Cybersecurity.pdf">Read&nbsp;the full letter</a>. Another House bill that could come up next week is the Promoting and Enhancing Cybersecurity and Information Sharing Effectiveness or &ldquo;PRECISE&rdquo; Act, H.R. 3674, which would define DHS&rsquo; roles and responsibilities and create a private, not-for-profit organization to facilitate best practices, provide technical assistance, and enable the sharing of cyberthreat information.&nbsp; The bill was approved by the Homeland Security Committee yesterday on a 16-13 party line vote. Democrats said the scaled-back&nbsp;bill doesn't establish DHS as the lead cybersecurity agency.&nbsp;<a href="http://homeland.house.gov/sites/homeland.house.gov/files/ANS%20HR%203674.pdf">Read Rep. Lungren&rsquo;s (R-CA) revised bill</a>.&nbsp; Also approved separately yesterday by the Oversight and Government Reform Committee, by voice vote, was the <a href="http://oversight.house.gov/wp-content/uploads/2012/04/H.R.-4257-Chaffetz-ANS-passed.pdf">Federal Information Security Amendments Act, H.R. 4257</a>, which would require federal agencies to continuously monitor government&nbsp;IT systems and perform regular threat assessments. A&nbsp;fourth bill that the House could vote on next week is the <a href="http://www.gpo.gov/fdsys/pkg/BILLS-112hr2096rh/pdf/BILLS-112hr2096rh.pdf">Cybersecurity Enhancement Act, H.R. 2096</a>, intended to improve cybersecurity R&amp;D and technical standards.&nbsp; It was approved last fall by the House Science, Space, and Technology Committee.&nbsp; The same committee also recently approved <a href="http://www.gpo.gov/fdsys/pkg/BILLS-112hr3834rh/pdf/BILLS-112hr3834rh.pdf">H.R. 3834</a>, which overhauls policies for funding R&amp;D in unclassified computing, networking and information technology, including cybersecurity, and could also be considered next week. A&nbsp;sixth bill, the <a href="http://www.gpo.gov/fdsys/pkg/BILLS-112hr4263ih/pdf/BILLS-112hr4263ih.pdf">SECURE IT Act of 2012, H.R. 4263</a>, was recently introduced as the House companion to Sen. McCain&rsquo;s alternative cybersecurity bill (S. 2151), but has yet to see committee action and is unlikely to come to the House floor next week. House Commerce, Manufacturing, and Trade Subcommittee Chairwoman Mary Bono Mack has expressed her desire to bring up her data breach notification measure, the SAFE Data Act, H.R. 2577, during the cybersecurity debate, but odds are slim that it could garner enough support to hitch a ride on cybersecurity legislation. Several of her colleagues are not on board that such legislation is necessary, despite continuing reports of data breaches. On the Senate side, the primary bill, the Cybersecurity Act, S. 2105, which would establish minimum security standards that certain companies must meet, remains stalled while the bipartisan sponsors work to address Republican concerns with the bill, <a href="https://www.dataprivacymonitor.com/federal-legislation/bipartisan-senate-cybersecurity-bill-introduced-amid-partisan-opposition/">described in a&nbsp;February 15, 2012, post</a>. If one or more of the House bills advance next week, the Senate could act on cybersecurity in May. The outlook for data breach notification legislation on the Senate side also remains doubtful, though work continues at the staff level.

Update to Cybersecurity / Data Breach Notification Legislative Outlook