Obama, Congress may find cybersecurity consensus
WASHINGTON — President Obama and Congress appear to have found a rare area of potential agreement: cybersecurity.
In his State of the Union speech, Obama called on lawmakers to pass legislation to encourage businesses to share cyber-threat information with the federal government. The idea is to alert the Department of Homeland Security quickly when private companies are hacked so federal law enforcement officials can help stop cyber criminals from striking again.
Congress tried to pass information-sharing bills in the last Congress, but the bills stalled in the Senate. Now key committee leaders in the House and Senate say they plan to introduce updated legislation soon.
"The president's proposal is an important first step in developing that legislation," said Sen. Ron Johnson, R-Wis., the new chairman of the Senate Homeland Security and Governmental Affairs Committee. Johnson has scheduled a hearing Wednesday on the importance of information-sharing in protecting Americans from cyberattacks.
The White House and lawmakers from both parties are feeling pressure to act in the wake of the high-profile hack attacks against Sony Pictures, Target, Home Depot, and JPMorgan Chase, said Darrell West, director of the Center for Technology Innovation at the Brookings Institution.
Prep for the polls: See who is running for president and compare where they stand on key issues in our Voter Guide
"Cybsecurity is not a Republican or Democratic problem," he said. "It's a serious problem that both parties have the same self-interest to solve before something really devastating happens like an attack against our electric grid."
That doesn't mean that there are no conflicts between the White House and Congress on the issue. House Republican leaders are still angry that the president threatened to veto an information-sharing bill they passed in the last Congress. Obama said the bill did not do enough to protect the privacy of Americans' personal data in the information-sharing process.
Privacy is likely to be an issue again.
The president's proposal would give businesses protection from lawsuits for sharing their data with the Department of Homeland Security and other businesses to try to thwart hackers. To gain that protection, companies would be required to remove "unnecessary personal information" and take other measures to protect any personal information that must be shared.
Business leaders say it would be difficult for small companies to remove personal data from their systems while trying to quickly share information about cyberattacks with federal officials. Civil liberties groups say they fear any information-sharing bill will end up handing Americans' personal data over to the government to use in law enforcement investigations that have nothing to do with hack attacks.
"We don't think any bill is necessary," said Gabe Rottman, legislative counsel for the American Civil Liberties Union. "The high-profile hacks we're hearing about tend to be cases where the companies need to more careful in defending their own systems. An information-sharing bill would not have stopped any of those hacks."
But business groups say that sharing information quickly could stop a hacker from going after other companies. They are hopeful that Obama's support for a bill will help speed passage of legislation this year.
"We think it's very important that the administration wants to get engaged and wants a seat at the table to discuss the bill with lawmakers and the private sector," said Matt Eggers, who handles cybersecurity issues at the U.S. Chamber of Commerce. "It's good that the administration has made the cybersecurity information-sharing bill a priority. Once the Senate and House pass the bill and send it to the president's desk, we would expect that he would sign it."