Late this afternoon, the Senate passed its new surveillance bill--the Cybersecurity Information Sharing Act of 2015 (CISA)--by a vote of 74 to 21.
Here's a reminder of what the bill does:
Requires that any Internet user information volunteered by a company to the Department of Homeland Security for cybersecurity purposes be shared immediately with the NSA, other elements of the Intelligence Community, with the FBI/DOJ, and many other Federal agencies – a requirement that will discourage company participation in the voluntary information sharing scheme envisioned in the bill;
Risks turning the cybersecurity program it creates into a backdoor wiretap by authorizing sharing and use of CTIs (cyber threat indicators) for a broad array of law enforcement purposes that have nothing to do with cybersecurity;
Authorizes cybersecurity “countermeasures” that would violate the Computer Fraud and Abuse Act and cause harm to others;
Will have unintended consequences – it trumps all law in authorizing companies to share user Internet communications and data that qualify as “cyber threat indicators;”
Does nothing to address conduct of the NSA that actually undermines cybersecurity, including the stockpiling of zero day vulnerabilities.
And as I noted earlier, the bill offers
legal immunity to corporations that violate the terms of privacy contracts with their users, rendering them meaningless.
The group of 21 who stood up for civil liberties and privacy rights consisted of 15 Democrats (or Democratic caucus members) and 6 Republicans.
Here are the 15:
Tammy Baldwin (D-WI)
Cory Booker (D-NJ)
Sherrod Brown (D-OH)
Ben Cardin (D-MD)
Chris Coons (D-DE)
Al Franken (D-MN)
Pat Leahy (D-VT)
Ed Markey (D-MA)
Bob Menendez (D-NJ)
Jeff Merkley (D-OR)
Bernie Sanders (I-VT)
Jon Tester (D-MT)
Tom Udall (D-NM)
Elizabeth Warren (D-MA)
Ron Wyden (D-OR)
Here are the 6:
Mike Crapo (R-ID)
Steve Daines (R-MT)
Dean Heller (R-NV)
Mike Lee (R-UT)
Jim Risch (R-ID)
Dan Sullivan (R-AK)
Note that self-proclaimed defender of liberty Rand Paul (R-KY) was not in attendance for any of today's votes because voting against a massive surveillance bill was just not a priority for him.
Earlier today, I wrote about the four amendments that received votes in the morning.
The Senate cast votes on two other amendments today.
Coons Amendment
Chris Coons (D-DE) offered an amendment to require DHS to remove personally identifiable information not necessary to identify or describe a cybersecurity threat before sharing a CTI. The amendment would give DHS time, when necessary, to apply privacy protective measures to the automated information sharing envisioned in the bill.
Here is some analysis from the Center for Democracy & Technology:
---This 11-page amendment requires DHS to remove any PII not necessary to identify or describe a cybersecurity threat before DHS shares a CTI with other Federal entities. It also permits necessary delays before CTIs are shared with other Federal entities.
---While it requires DHS to be able to receive CTIs in real time, it requires that DHS share CTIs with all appropriate Federal entities “as quickly as operationally possible” as opposed to “in real time.”
---Requiring DHS to remove PII not necessary to describe a cybersecurity threat, and giving it the time that it needs to do so, before sharing CTIs with other entities, helps ensure that personal information is not needlessly shared with the NSA, the FBI and others. It replaces an unrealistic provision in the manager’s substitute that would require the heads of seven huge Federal entities to agree unanimously to such delays.
---The amendment provision requiring that the Attorney General guidelines identify types of information that would qualify as a CTI that would be unlikely to include personal information “not necessary” to describe a cybersecurity threat, already appears in the Managers’ Substitute.
It failed
41 to 54.
8 Republicans voted for the amendment:
Steve Daines (R-MT)
Jeff Flake (R-AZ)
Corey Gardner (R-CO)
Dean Heller (R-NV)
Mike Lee (R-UT)
Jerry Moran (R-KS)
Lisa Murkowski (R-AK)
Dan Sullivan (R-AK)
13 Democrats voted against it:
Tom Carper (D-DE)
Bob Casey (D-PA)
Joe Donnelly (D-IN)
Dianne Feinstein (D-CA)
Heidi Heitkamp (D-ND)
Tim Kaine (D-VA)
Angus King (I-ME)
Joe Manchin (D-WV)
Claire McCaskill (D-MO)
Barbara Mikulski (D-MD)
Bill Nelson (D-FL)
Mark Warner (D-VA)
Sheldon Whitehouse (D-RI)
Cotton Amendment
The other amendment voted on this afternoon was an amendment from Tom Cotton (R-AR). It would permit companies to share cyber threat information with the FBI and Secret Service.
Here is CDT again:
Allowing, and privileging, information sharing with the FBI and Secret Service would raise serious privacy concerns because these entities’ missions center around criminal investigations, not cybersecurity. Companies already have ample legal authority to share information that is evidence of crime with the FBI and the Secret Service. The bill includes a provision making it clear that nothing in the bill diminishes that authority.
Extending the ability to share CTIs with the FBI and Secret Service would undermine the DHS cybersecurity mission by encouraging companies to share CTIs with entities other than DHS, the lead agency in civilian cybersecurity. DHS has cautioned that allowing companies to share CTIs with any agency they choose would complicate the information sharing program and undermine its ability to protect the privacy of the Internet users whose communications data would be shared.
It failed
22 to 73.
Only one Democrat--Sheldon Whitehouse (D-RI)--voted for it.
The other 21 supporters were Republicans:
John Boozman (R-AR)
Shelley Moore Capito (R-WV)
John Cornyn (R-TX)
Tom Cotton (R-TX)
Deb Fischer (R-NE)
Chuck Grassley (R-IA)
Jim Inhofe (R-OK)
Johnny Isakson (R-GA)
Mark Kirk (R-IL)
Jim Lankford (R-OK)
John McCain (R-AZ)
Mitch McConnell (R-KY)
David Perdue (R-GA)
Rob Portman (R-OH)
Mike Rounds (R-SD)
Ben Sasse (R-NE)
Tim Scott (R-SC)
Jeff Sessions (R-AL)
Richard Shelby (R-AL)
John Thune (R-SD)
Pat Toomey (R-PA)
Stalwarts
If you look at the votes from today as well as the votes last Thursday (see here and here, there are only 12 senators who consistently took the civil libertarian side:
Tammy Baldwin (D-WI)
Cory Booker (D-NJ)
Chris Coons (D-DE)
Al Franken (D-MN)
Pat Leahy (D-VT)
Ed Markey (D-MA)
Bob Menendez (D-NJ)
Jeff Merkley (D-OR)
Bernie Sanders (I-VT)
Tom Udall (D-NM)
Elizabeth Warren (D-MA)
Ron Wyden (D-OR)
