Talk Elections

H.R. 3523 fails to provide authorities to ensure that the Nation's core critical infrastructure is
protected while repealing important provisions of electronic surveillance law without instituting
corresponding privacy, confidentiality, and civil liberties safeguards.  For example, the bill
would allow broad sharing of information with governmental entities without establishing
requirements for both industry and the Government to minimize and protect personally
identifiable information.

...

The bill also lacks sufficient limitations on the sharing of personally identifiable information
between private entities and does not contain adequate oversight or accountability measures
necessary to ensure that the data is used only for appropriate purposes.  Citizens have a right to
know that corporations will be held legally accountable for failing to safeguard personal
information adequately.  The Government, rather than establishing a new antitrust exemption
under this bill, should ensure that information is not shared for anti-competitive purposes.
In addition, H.R. 3523 would inappropriately shield companies from any suits where a
company's actions are based on cyber threat information identified, obtained, or shared under this
bill, regardless of whether that action otherwise violated Federal criminal law or results in
damage or loss of life.  This broad liability protection not only removes a strong incentive to
improving cybersecurity, it also potentially undermines our Nation's economic, national security,
and public safety interests.

...

The American people expect their Government to enhance security without undermining their
privacy and civil liberties.  Without clear legal protections and independent oversight,
information sharing legislation will undermine the public's trust in the Government as well as in
the Internet by undermining fundamental privacy, confidentiality, civil liberties, and consumer
protections.  The Administration's draft legislation, submitted last May, provided for information
sharing with clear privacy protections and strong oversight by the independent Privacy and Civil
Liberties Oversight Board.

Moreover, such sharing should be accomplished in a way that permits appropriate sharing within the Government without undue restrictions imposed by private sector companies that share information.

...

The Administration's proposal also provided authority for the Federal Government to ensure that the Nation's critical infrastructure operators are taking the steps necessary to protect the American people. The Congress must also include authorities to ensure our Nation's most vital critical infrastructure assets are properly protected by meeting minimum cybersecurity performance standards. Industry would develop these standards collaboratively with the Department of Homeland Security. Voluntary measures alone are insufficient responses to the growing danger of cyber threats.