The Senate quietly passed a bill Tuesday they claimed is aimed at improving cybersecurity by encouraging companies and the government to share information about threats.
But civil liberties advocates are angry, saying the government is using this bill to gather secret information from major US companies on their customers. And citizens aren’t allowed to know what information on them is being shared, and with whom.
The Cybersecurity Information Sharing Act passed by a 74-21 vote. It overcame concerns about privacy and transparency from voters, civil liberty organizations and major technology companies, such as Apple and Yelp.
Before passing the bill, the Senate rejected amendments limiting information sharing, including one addressing concerns that companies could give the government personal information about their customers. Another failed amendment would have eliminated part of the bill that would keep secret information about which companies participate and what they share with the government.
Companies would receive legal protections from antitrust and consumer privacy liabilities.
Sen. Ron Wyden, D-Ore., who opposed the bill, offered an amendment addressing privacy concerns, but it failed to pass. It would have required companies to make “reasonable efforts” to remove unrelated personal information about their customers before providing the data to the government.
“You just can’t hand it over,” Wyden said. “You’ve got to take affirmative steps, reasonable, affirmative steps, before you share personal information.”
Senators also rejected an amendment Sen. Patrick Leahy, D-Vt., had offered that would have removed a provision to keep secret more information about materials that companies provide to the government. Leahy criticized the bill’s new exemption from the U.S. Freedom of Information Act as overly broad because it pre-empts state and local public information requests, and it was added without public debate.
The Sunshine in Government Initiative, a Washington organization that promotes open government policies, urged the Senate last week to support Leahy’s amendment.
Despite the lengthy road to pass the Senate bill, it’s unclear whether it would improve Internet security.
“Passing the bill will have no effect on improving cybersecurity,” said Alan Paller, director of research for the SANS Institute.
The U.S. and the technology industry already operate groups intended to improve sharing of information among the government and businesses, including the Homeland Security Department’s U.S. Computer Emergency Readiness Team.
“What this bill means is more internet users’ personal information being funneled, will be directed to, the National Security Agency under a cybersecurity umbrella,” said Greg Nojeim, senior counsel for the Center for Democracy and Technology, a Washington-based civil liberties group.
The White House has said it supports the information-sharing bill.
The Associated Press contributed to this article