Sen. Ron Wyden: Congress’ fix for high-profile hacks is yet another way to grab your private data
By Sen. Ron Wyden for The Guardian
The government can’t keep its own data safe, but Congress wants companies to give it even more of your private information
In the wake of a series of widely-publicized hacks, including the recent compromise of government personnel records, the US Senate rushed to take up a bill that supporters say will protect the typical supporters from the sophisticated hacks of the future. It appears Republican leaders have stepped back from that plan, but rest assured, just as night follows day, supporters are planning to bring this bill back to the Senate floor this year.
The supporters are wrong. The Senate’s bill would unfortunately do little to protect your information from hackers and actually puts your personal privacy at greater risk.
Dozens of cybersecurity experts have said that this bill – known as the Cybersecurity Information Sharing Act, or CISA – will do very little to stop high-profile hacks like the government personnel records breach. What it will do is make it a lot easier for private corporations to give your information – everything from medical records, shopping history, even GPS tracking data – over to the government, even when there is no need to do so.
Defenders of this bill say that this information sharing would be voluntary. But that’s only half-true. Companies could volunteer to share your information with the government. But they wouldn’t have to ask your permission before handing it over. Instead of being required to filter out private information unrelated to cybersecurity, corporations would be permitted to hand the government large volumes of their customers’ data, with only a cursory review.
The bill would also create a bizarre double-standard: the government would be prohibited from using this information to police the companies that provided it, but would be free to use it to investigate you for matters unrelated to cybersecurity. The corporations’ privacy rights would matter more than your privacy rights.
Here’s an example of the consequences this could have: imagine that an employee of your health insurance company clicks on a link in a malicious email, and accidentally installs malware on the company’s network. Hackers then use that malware to steal financial and medical information about you and all of the company’s other customers.
Upon discovering the hack, the company notifies the Department of Homeland Security, but instead of just sharing information about the malware, it shares the profiles of every customer impacted by the breach. Then, DHS immediately shares your information with other government agencies – including the NSA and FBI – without delay, as CISA requires.
From there, the FBI might decide that there is a correlation between patients seeking certain drug treatments and violent drug-related felonies and use this as a justification for combing through your medical records. Even if it were later determined that your private information had been shared inappropriately, CISA would not require the government to notify you, and you would likely have no recourse against the company for mishandling your information.
This is likely not the intent of CISA’s proponents, but the bill is written broadly enough to permit it. And the recent experience of NSA mass surveillance shows that the executive branch can be expected to exploit any vagueness or opening in legislative language to expand the government’s ability to vacuum up data. The only protections Americans can depend on are those written clearly into the law. Meanwhile, dozens of technologists and cybersecurity experts have publicly warned that CISA would “weaken privacy law without promoting security.”
Private companies already share a lot of information about cybersecurity threats. And it makes sense to encourage this. But any “information sharing” bill that lacks adequate protections for Americans’ privacy rights is not a cybersecurity bill – it’s a surveillance bill by another name.
CISA won’t put an end to high-profile hacks, and it will have real consequences for the privacy of many Americans. Given its limited value and significant downsides, the Senate should scrap CISA and start focusing on real solutions. These include investing in the education of the next cybersecurity leaders, ensuring that network owners take responsibility for network security and requiring companies to notify their customers if their information has been compromised. They do not – and should not – include tossing aside long-established protections for Americans’ privacy.