Responding to Sony Hack, Senate Advances Major Cybersecurity Bill

The Senate Intelligence Committee approved a bill Thursday seeking to increase the sharing of digital data between the government and private sector, marking the first serious move to upgrade the nation's cyber defenses since the crippling hack on Sony Pictures late last year.

In a closed-door meeting, the panel advanced 14-1 the Cybersecurity Information Sharing Act, which would provide expanded legal liability to companies so they more easily share digital data with the government—an arrangement the bill's backers say would help detect, prevent, and respond to cyber intrusions.

The bill's passage comes despite concerns from privacy advocates that the measure will bolster the government's powers to conduct even more surveillance on Americans.

Senate Intelligence Committee Chairman Richard Burr called the vote a "truly historic" step forward that will allow companies to deploy "different defense mechanisms" to block and limit cyberattacks.

"This bill will not prevent [all cyberattacks] from happening," Burr told reporters. But he added that the legislation would have gone a long way in minimizing the damage wrought by recent hacks on companies ranging from Anthem Insurance to Home Depot.

Only Democratic Sen. Ron Wyden, a staunch civil-liberties advocate, opposed the measure, calling it "a surveillance bill by another name."

"Cyberattacks and hacking against U.S. companies and networks are a serious problem for the American economy and for our national security," Wyden said in a statement immediately after the vote. "It makes sense to encourage private firms to share information about cybersecurity threats. But this information sharing is only acceptable if there are strong protections for the privacy rights of law-abiding American citizens."

The vote marks Congress's first major step on cyber vulnerabilities since last year's Sony hack made data security a top priority for the White House and lawmakers in both parties. It also arrives amid a string of hacks, such as the recent theft of data of some 80 million Anthem Insurance customers.

Senate leadership has indicated it wants to move quickly on the information-sharing bill. An aide for Senate Majority Leader Mitch McConnell said the legislation was a "priority" but did not yet have a timetable for hitting the floor. Burr indicated a floor vote could happen as soon as April.

"14-1 means I have all the confidence in the world to go to Sen. McConnell and get this expedited," Burr said.

The measure still faces several potential roadblocks—and chief among them are the privacy concerns that helped stall the bill's progress last summer.

After the Senate intelligence committee passed a similar version on a 12-3 vote, that bill failed to gain traction amid concerns that it would pave the way for companies such as Google and Facebook to share more personal data with intelligence agencies. Under the bill, cyber information is routed through the Department of Homeland Security, which can then be shared in real-time with other government agencies.

"This isn't an information sharing bill at all," Gabe Rottman, a legislative counsel with the American Civil Liberties Union, said in a statement. "It's a new and vast surveillance authority that might as well be called Patriot Act 2.0 given how much personal information it would funnel to the NSA," he added, referring to the post-9/11 legislation under which the intelligence community derives much of its spying authority.

Despite the pushback, information-sharing has leapfrogged other policy priorities in recent months—both in Congress and at the White House—due largely to the Sony breach, which government officials publicly blamed on North Korea. Lawmakers of both parties have said the Sony hit awakened them to the importance and urgency of passing cybersecurity legislation, and the issue earned some dedicated attention during President Obama's State of the Union address in January.

It is not immediately clear whether the White House supports the language the Senate panel approved, however. Though the administration views information sharing as a key cybersecurity priority, Obama did issue a veto threat in 2013 when the House passed a CISA counterpart. The legislation lacked appropriate privacy safeguards and ran the risk of granting corporations too much immunity, the president said at the time.

Sen. Dianne Feinstein, the intelligence panel's top Democrat, told reporters after the vote that she had been in discussions with White House chief of staff Denis McDonough and that "he believes a number of improvements have been made."

To combat privacy concerns, the intelligence committee circulated a CISA draft last month that contained additional protections, such as tougher requirements on scrubbing personally identifiable information before companies can enter into the information-sharing arrangement. On Thursday, Feinstein said that Democrats had submitted 15 privacy amendments, and that 12 had been accepted either in part or in full.

CISA's passage indicates it is the preferred route forward on information-sharing among congressional leadership. Sen. Thomas Carper, the top Democrat on the Homeland Security Committee, introduced a separate info-sharing bill last month with language that closely adhered to the White House's recommendations. But Carper introduced the measure without a single co-sponsor, and it has yet to gain traction.

Privacy advocates generally saw the White House proposal on information-sharing, which was trotted out this year, as an improvement over previous iterations of CISA. But some also said they could not support any information-sharing legislation if Congress did not first pass substantive NSA reform. Existing authorities to NSA spying under the Patriot Act are due to sunset on June 1, meaning lawmakers will have to act in some fashion before then or risk letting certain surveillance programs expire entirely.

Skeptics of the bill passed Thursday were further agitated by the secrecy of the process. The vote was held during a closed-door meeting—a standard practice for the intelligence committee.

"The bill is complex and it needs a lot of work," said Greg Nojeim, a senior counsel at the Center for Democracy & Transparency. "The committee's consideration of a bill like this, which will impact the privacy of Internet users world wide, should never be undertaken behind closed doors."

The committee is expected to publicly release the passed language Friday or Monday, a Feinstein aide said.