REPEAL CISA!

Campaign for Liberty has joined a broad-based coalition in support of HR 4350, Representative Justin Amash (MI-03)’s legislation repealing the Cyber-Security Information Act (CISA). CISA, which does little or nothing to protect our cyber-security but does a lot to take away our privacy, was snuck into the last year’s Omnibus spending bill.

The version of CISA that was included in the Ominbus is actually worse than the versions that passed the House and Senate as stand-alone bills last year. As I wrote at the time of the debate over the Ominbus:

As you can see from this chart prepared by the  Open Technology Institute, almost every aspect of the new version of CISA is worse than the alternatives. Perhaps the worst aspect of this bill is that the changes make it clear that this bill has nothing to do with cyber security and everything to do with spying on us. As Techdrist reports:

The latest version of CISA that they’re looking to put into the omnibus:

1. Removes the prohibition on information being shared with the NSA, allowing it to be shared directly with NSA (and DOD), rather than first having to go through DHS. While DHS isn’t necessarily wonderful, it’s a lot better than NSA. And, of course, if this were truly about cybersecurity, not surveillance, DHS makes a lot more sense than NSA.

2. Directly removes the restrictions on using this information for “surveillance” activities. You can’t get much more direct than that, right?

3. Removes limitations that government can only use this information for cybersecurity purposes and allows it to be used to go after any other criminal activity as well. Obviously, this then creates tremendous incentives to push for greater and greater information collection, which clearly will be abused. We’ve just seen how the DEA has regularly abusedits powers to collect info. You think agencies like the DEA and others won’t make use of CISA too?

4. Removes the requirement to “scrub” personal information unrelated to a cybersecurity threat before sharing that information. This was the key point that everyone kept making about why the information should go to DHS first — where DHS would be in charge of this “scrub”. The “scrub” process was a bit exaggerated in the first place, but it was at leastsomething of a privacy protection. However, it appears that the final version being pushed removes the scrub requirement (along with the requirement to go to DHS) and instead leaves the question of scrubbing to the “discretion” of whichever agency gets the information. Guess how that’s going to go?

In short: while before Congress could at least pretend that CISA was about cybersecurity, rather than surveillance, in this mad dash to get it shoved through, they’ve dropped all pretense and have stripped every last privacy protection, expanded the scope of the bill, and made it quite clear that it’s a very broad surveillance bill that can be widely used and abused by all parts of the government.

Campaign for Liberty members who want to roll back the Surveillance State should call their Representatives and tell them to cosponsor HR 4350.

Corie Whalen at RARE Liberty has an interview with Representative Amash on his efforts to repeal CISA, as well as a story on the broad-based collation supporting Representative Amash’s efforts.

Here and below is the collation letter Campaign for Liberty cosigned in support of HR 4350:

Dear Representative,

On behalf of civil liberties and government accountability organizations from across the political spectrum, we encourage you to support H.R. 4350, introduced by Reps. Justin Amash, R-Mich., and John Conyers, D-Mich.

This bipartisan bill would repeal the Cybersecurity Act of 2015, secretly negotiated provisions that were hastily incorporated into the omnibus appropriations bill enacted late last year. As we and others have stated consistently, these provisions are unlikely to increase the government’s ability to detect, intercept and thwart cyber attacks, yet they institute broad and undefined data-collection capabilities that are certain to undermine government accountability and further erode privacy protections.

Questions of cybersecurity and privacy should be debated openly in a manner that allows legislators and the public to criticize and participate. These questions should not be obscured by backroom deals that exclude critical perspectives and due process, and that many security experts have argued could result in worse security problems and worse privacy violations than before.

The Cybersecurity Act of 2015 included provisions unacceptable to the technology community, privacy and open-government advocates, as well as ordinary Americans, including:

1. A new avenue through which the government will receive personally identifiable information and communications content, expanding surveillance on innocent Americans;
2. Immunity from liability for companies that unnecessarily share private user information with the government and other companies;
3. No reasonable limits on the type of information that can be shared, such as individuals’ personal online communications;
4. Authorization for law enforcement and the intelligence community to use this information for purposes unrelated to cybersecurity, including the investigation and prosecution of unrelated crimes.
5. An exemption to the Freedom of Information Act, and preemption of state and local laws on disclosure that seriously undermine government accountability and transparency.

Measures to strengthen cybersecurity should not come at the expense of exposing law-abiding Americans’ private information to government surveillance. Additionally, it should not be necessary to extend law-enforcement authorizations to non-cybersecurity purposes.

We call on Congress to repeal these unnecessary provisions and start a new conversation about the right way to address real cybersecurity threats, without undermining the privacy and security of all Americans and the accountability of government.

Sincerely,

R Street Institute
American Civil Liberties Union
American Library Association
Campaign for Liberty
Center for Democracy and Technology
Defending Dissent Foundation
Demand Progress
Fight For The Future
Free Press Action Fund
FreedomWorks
Government Accountability Project
Niskanen Center
Open Technology Institute
Open the Government
Restore the Fourth
Roots Action
X Lab