Despite hacks, cybersecurity bill stalled in Congress
WASHINGTON — Despite hack attacks against high-profile targets ranging from Home Depot to the White House, Congress is headed toward adjournment in a few days without passing a major cybersecurity bill.
"You would think Congress would have the motivation to act given all the cyber attacks," said Darrell West, director of the Center for Technology Innovation at the Brookings Institution. "But even on an issue as important as cybersecurity, it's been hard to get members of Congress to agree on a solution."
With action unlikely this year, the bill will roll over to the Republican-led 114th Congress that convenes in January. Key lawmakers from both parties who have tackled the issue are retiring or losing clout, making the fate of the legislation uncertain.
Supporters and analysts say there are bound to be more cyber attacks, and more pressure on Congress to act.
"The need for the legislation isn't going to go away," said Matt Eggers, who handles cybersecurity issues at the U.S. Chamber of Commerce and is pressing for Congress to pass a bill. "I don't think the chances for it to pass will get much easier in the next Congress. But we're gong to keep pushing."
Prep for the polls: See who is running for president and compare where they stand on key issues in our Voter Guide
The chamber is leading a coalition of business groups lobbying hard for passage this year of a bipartisan Senate bill to increase information-sharing about cyber attacks between private companies and the U.S. government to try to detect crimes faster and thwart hackers. A separate cybersecurity bill already has been passed by the House, but time is running out for an agreement as Congress heads for a Dec. 12 adjournment.
Supporters of the Cybersecurity Information Sharing Act by Senate Intelligence Chairwoman Dianne Feinstein, D-Calif., and Vice Chairman Saxby Chambliss, R-Ga., have been unable to overcome fears that the legislation could end up sharing Americans' private data with the government, including the Department of Defense and the National Security Agency.
The bill's future is uncertain because Chambliss is retiring and Feinstein will relinquish her chairmanship next month. On the House side, House Intelligence Chairman Mike Rogers, R-Mich., is retiring, and Rep. Dutch Ruppersberger, D-Md., the panel's senior Democrat, is leaving the committee.
Proponents and opponents of the Senate legislation said efforts to pass the bill were damaged last month when separate legislation to stop the NSA's bulk collection of Americans' phone records was blocked by just two votes in the Senate. The USA Freedom Act, by Sen. Patrick Leahy, D-Vt., would have ended the controversial NSA program revealed last year by former NSA contractor Edward Snowden.
The issue is likely to resurface next year as Congress faces a June deadline to renew portions of the Patriot Act anti-terrorism law, including the section that the NSA is using to collect the phone records of Americans not suspected of any crime.
"The privacy community has said all along that NSA reform should come first," said Gabe Rottman, legislative counsel for the American Civil Liberties Union, which supported Leahy's bill and opposes the Feinstein-Chambliss legislation. "We haven't reined in the NSA, and this cybersecurity bill could give the government even more of our data."
Supporters of the cybersecurity bill say those fears are unfounded.
They say the information-sharing between businesses and the government would be narrow in scope, with companies removing personal data about customers before passing information on to the Department of Homeland Security.
Americans are at more risk without the cybersecurity bill because their personal data is more likely to be hacked by criminals, Eggers said.
"Sharing information among companies and the government actually increases the security of ordinary Americans' private data," Eggers said. "The cybersecurity bill would give Americans more privacy and more security, and that's a good thing."
The Feinstein-Chambliss bill encourages businesses to voluntarily share information about cyber attacks with the Department of Homeland Security by giving them protection from lawsuits and anti-trust actions if they disclose when they've been hacked and provide details of the attacks.
The problem with that is companies are protected even if they inadvertently share their customers' personal data with DHS, which may go on to share it with the NSA or Defense Department, Rottman said.
"The information could become an investigative tool in law enforcement and foreign intelligence surveillance," he said. "And it would create a repository of information inside the government that would be highly attractive to cyber hackers. It could result in less security than we have now."
Homeland Security Secretary Jeh Johnson is urging Congress to find a compromise. If companies don't tell anyone when their data has been breached, it allows criminals to continue to target them along with other businesses and government agencies, Johnson said.
"Some private companies can and do resist sharing information with DHS about cyber attacks on their systems, for fear of potential liability," Johnson in a recent op-ed in The Hill. "In the few legislative days left, I urge Congress to, at the very least, pass the provisions of cyber legislation for which there is bipartisan consensus, while we continue to work on outstanding areas of disagreement."
David Inserra, a cybersecurity expert at the Heritage Foundation, said he doubts Congress will be able to reach consensus this year. But he agrees with Eggers that the issue is likely to re-emerge next year.
"Without action from Congress, we're not as secure as we could be," Inserra said.