Thoughts on CISPA as we move to the Senate

I was disappointed to read a blog post by Randy Sabett on ZwillGen’s blog. Once again, someone frames privacy concerns as being a more radical “stop the bill at all costs” or “privacy at all costs” argument, although most privacy advocates agree that a bill is needed. Randy writes, in part:

While the White House position is correct that information sharing “must be conducted in a manner that preserves Americans’ privacy, data confidentiality, and civil liberties and recognizes the civilian nature of cyberspace,” an emphasis on privacy at all costs could jeopardize security by stalling the passage of needed cyber legislation. As Rep. Rogers observed yesterday, “we can’t stand by and do nothing as U.S. companies are hemorrhaging from the cyber looting coming from nation states like China and Russia.”

Who’s saying “at all costs?” CISPA, as passed by the House, could have been strengthened and improved without sacrificing what should have been the main purposes of the bill.

Including language like “notwithstanding any other…” that totally negates the protections of other laws was a lazy legislature’s way of dealing with what would otherwise pose a conflict with ECPA and other laws. Just trump the other laws, et voila, right? Wrong. Of course, CISPA could have included such “notwithstanding” language without causing such concern if it had actually included a section on privacy and civil liberties protections that incorporated Fourth Amendment protections and restricted the use of information to actual national security or cybersecurity concerns. Instead, the bill only “voluntarily” encouraged certain practices. Given our government’s history, it is understandable that savvy portions of the population do not trust such “voluntary” schemes.

Randy’s blog post was certainly not the worst exaggeration of privacy advocates’ views, however. I was even more disappointed in Rep. Mary Bono Mack’s statement on the floor of the House during the CISPA debate:

“Boogeyman,” Congresswoman? Seriously? Maybe you didn’t pay attention to the government’s own officials who agreed that ECPA needed to be revised. Do you really think EU citizens will want to have their data stored on U.S. servers with so little firm privacy protections?

Failure to incorporate meaningful protections will not only damage our country’s democracy but will hurt the U.S. in international commerce.

The legislature can do better and must do better in terms of writing a bill that allows information sharing without throwing Fourth Amendment protections out the window. We’re just not buying the FUD anymore or any suggestion that we have to give up our civil liberties to improve security. We’ve already given up too much with very little to show for it.