The final text of cybersecurity legislation passed Congress as part of the $1.1 trillion spending package on Friday.
The legislation was approved 316-113 by the House early in the day, with 95 Republicans and 18 Democrats voting in opposition. It passed the Senate 65-33. The completed text of the cybersecurity component was less intrusive than some privacy advocates feared, though still short of what they desired.
Calling it “the new Patriot Act,” privacy group Fight for the Future said the legislation would “dramatically expand” surveillance programs and make the nation more vulnerable “by letting corporations off the hook instead of holding them accountable when they fail to protect their customers’ sensitive information.”
The “Cybersecurity Act of 2015,” as it was titled, begins on page 1,728 of the 2,009-page omnibus package, which was edited frantically in the days leading up to passage. Nonetheless, some elements of earlier privacy provisions managed to survive, including a requirement that the Department of Homeland Security take most of the responsibility for processing information shared by private companies.
The most significant feature of the legislation is that it will provide civil liability relief for companies that share customer information with other companies and the government for reasons they deem relevant to a cybersecurity threat. For instance, it could provide liability protection for a telecommunication company that shares information about its cellular subscribers.
In theory, companies are required to strip out personally identifiable information that they know to be unrelated to a threat. Critics say that requirement is too vague and could allow the government to harvest even more information than it has under its past surveillance regimes.
“It’s a weak requirement,” said Evan Greer, executive director of Fight for the Future. “Companies only have to to remove info that they ‘know’ is unrelated to identifying the cyber threat, which is vague enough to make the restriction almost meaningless,” Greer added.
“It’s not perfect,” Senate Homeland Security Chairman Sen. Ron Johnson, R-Wis., acknowledged after the bill’s passage. “But it’s a big step in the right direction… This legislation protects us. It’s necessary, and it’s long overdue.”
