McCain’s retooled Secure IT act still a privacy threat, critics say

Sen. John McCain (R-Ariz.), with the support of seven Republican senators, has reintroduced the controversial Secure IT Act with amendments intended to provide better protection for civil liberties, but it has failed to win over critics who see it as an expansion of military authority and a threat to personal privacy.

The revamped Strengthening and Enhancing Cybersecurity by Using Research, Education, Information and Technology Act, S. 3342, tightens definitions of the kinds of information that would be shared and clarifies responsibilities of cybersecurity centers receiving information from the private sector. Like the previous version, the bill steers clear of any regulation of industry and makes the National Security Agency rather than the Homeland Security Department the focus of security for the nation’s cyber resources.

“The key to successfully fighting this threat is not adding more bureaucrats or forcing [industry] to comply with government red tape,” McCain said in a statement.

Related coverage:

GOP's alternative cyber bill sets up 'classic Washington duel'

Breakthrough? Cyber bills could reach Senate floor in July.

But critics rated the improvements from modest to virtually nonexistent.

“In our view the sponsors have made modest improvements to the bill by tightening the description of the threat information that can be shared as well as narrowing the mandatory information sharing requirement,” said Kendall Burman, senior national security fellow at the Center for Democracy & Technology. “But, they have left a lot of room for further improvement.”

“The Secure IT Act still fails to provide meaningful transparency and accountability protections,” said Amie Stepanovich, a litigation counsel for the Electronic Privacy Information Center. “In addition, any bill that hands over U.S. cybersecurity operations to the National Security Agency and gives broad exemptions from the Freedom of Information Act drastically limits necessary public oversight.”

One security industry observer said that Congress has yet to find the proper balance between the business interests of the private sector and national security.

“I cannot agree with a hands-off approach,” presented in the McCain bill, said Ashar Aziz, CEO and CTO of the security company FireEye. “I cannot believe in an inept bureaucracy to do it, either.” He said enforceable standards without prescriptive regulation are needed.

The Secure IT Act was introduced in March as a Republican alternative to bipartisan comprehensive legislation offered in February by Sen. Joseph Lieberman (I-Conn.). The Lieberman bill would give DHS the authority to set minimum security standards for designated privately owned critical infrastructure. Although sponsors of the Cybersecurity Act of 2012 say it takes a light touch on regulation, the bill was criticized by some for imposing too many regulations on industry and for being introduced via an end-run around multiple Senate committees claiming cybersecurity jurisdiction.

The McCain bill focuses instead on removing barriers to information sharing between industry and government and enables the use of that information by agencies. The NSA would be the lead cybersecurity agency by virtue of its expertise in this area and because of the national security ramifications of many cyber threats.

“We have worked closely with members and stakeholders over the past months, and we believe we have come up with a consensus bill that will significantly advance the security of our government and private-sector networks,” Texas Sen. Kay Bailey Hutchison, ranking member of the Senate Commerce, Science and Transportation Committee and a co-sponsor of the new bill, said in a statement.

The McCain bill was quickly criticized as giving government sweeping access to consumer information with few limitations on what information companies could share and how that information could be used.

The American Civil Liberties said the bill lacks meaningful protections for the sensitive consumer information gathered by companies and opens the door to online spying by the government.

Information collected under the act “can be used by the government not only for cybersecurity purposes but for undefined national security purposes and to prosecute a long list of crimes unrelated to cybersecurity,” legislative counsel Michelle Richardson wrote in a blog post.

The bill’s authors state that they recognize the “need to protect the privacy and civil liberties of individuals through anonymization or other appropriate methods . . . ,” and specifies that personal information “shall not be disclosed to, retained by, or used by any federal agency or department for any use not permitted under this paragraph.” But the referenced paragraph permits broad use of the information.

Senate Majority Leader Harry Reid has said he hopes to bring cybersecurity legislation to the floor this month, but finding a balance between regulation and voluntary security that both sides will sign onto could prove difficult.

“The fundamental challenge is that this is a public safety issue, and the government has a right and responsibility to act,” Aziz said. “Market forces are designed for profit. They do not take public safety into account.”

A standard of required security is needed for privately owned critical infrastructure, but “the question is, who is going to set the right standards?” he said. Government so far has not demonstrated the ability to do this.