New Cybersecurity Bill May Actually Take Privacy Concerns Seriously
from the it's-a-start dept
- Ensure that companies who share cybersecurity information with the government give it directly to civilian agencies, and not to military agencies like the National Security Agency. The single most important limitation on domestic cybersecurity programs is that they are civilian-run and do not turn the military loose on Americans and the internet.
- Ensure that information shared under the program be “reasonably necessary” to describe a cybersecurity threat.
- Restrict the government’s use of information it receives under the cyber info sharing authority so that it can be used only for actual cybersecurity purposes and to prosecute cyber crimes, protect people from imminent threat of death or physical harm, or protect children from serious threats.
- Require annual reports from the Justice Department, Homeland Security, Defense and Intelligence Community Inspectors General that describe what information is received, who gets it, and what is done with it.
- Allow individuals to sue the government if it intentionally or willfully violates the law.
The bill also removes some of the regulatory requirements for organizations that run "critical infrastructure," in favor of a more voluntary approach to setting up best practices, which may make the bill more palatable for some.
That said, we're still waiting for an actual justification of cybersecurity bills that doesn't include exaggerations of the threats that are out there, or Hollywood-scripted stories about planes falling from the skies that have little basis in reality. Moreover, though the claim has always been that these bills are important because the government is being legally prevented from sharing and receiving vital information, nobody has actually pointed to the specific legal obstacles that exist -- and the government already has information sharing programs that don't seem to require any new legislation. Also, any bill that's 211-pages long is something to be concerned about, as the number of "hidden" easter eggs could be immense and serious. But, compared to previous cybersecurity bills, this certainly sounds like a big step in the right direction.