Barack Obama unveiled new cybersecurity measures on Tuesday amid warnings from privacy campaigners about unnecessarily “broad legal immunity” that could put personal information at risk in the wake of attacks like the Sony Pictures hack.



Just one day after the Pentagon’s own Twitter account was compromised and Obama pushed a 30-day window for consumer security breaches, his administration was hoping the proposed legislation would toughen the response of the private sector by allowing companies to share information with government agencies including the NSA, with which the White House admitted there were “overlapping issues”.

“I’ve got a State of the Union next week,” Obama said after a Tuesday meeting with Republican leaders at the White House. “One of the things we’re going to be talking about is cybersecurity. With the Sony attack that took place, with the Twitter account that was hacked by Islamist jihadist sympathizers yesterday, it just goes to show much more work we need to do both public and private sector to strengthen our cybersecurity.”

The administration believes the legislation is necessary partly to give companies legal immunity for sharing information on attacks so that counter-measures can be coordinated, but the White House has stepped back from suggestions that companies should be allowed to individually retaliate against hackers, fearing such encouragement could lead to an escalation of cyber warfare.

On Monday, the Pentagon’s own Twitter account was compromised. Photograph: twitter

“Cyber threats are an urgent and growing danger,” Obama said during a speech in Virginia outlining his proposals on Tuesday. He insisted there was hope for legislation to be passed “soon” – a sentiment echoed by Republican leadership after the White House summit.

A White House statement released in advance of the speech said it “encourages the private sector to share appropriate cyber threat information with the Department of Homeland Security’s National Cybersecurity and Communications Integration Center”.



This agency will in turn share real-time information on hacking with other federal agencies and private-sector bodies known as Information Sharing and Analysis Organizations (ISAOs) who are being set up to help monitor and disrupt attacks.

However, privacy groups including the Electronic Frontier Foundation have questioned the proposed legal immunity, arguing existing rules allow companies to coordinate sufficiently already and challenging a potential provision that could allow the Homeland Security Department to share data in “near real time” with the NSA, FBI and secret service.

Officials insist their proposed information-sharing system would not put privacy at risk as the information disclosed will principally concern the method of attack on computer data and systems, rather than its content.

“We shouldn’t allow a disagreement on NSA reforms to impact on the necessity of cybersecurity reforms,” said White House spokesman Josh Earnest when asked about the ongoing stalemate over reforming the National Security Agency’s domestic surveillance programs in the wake of the Snowden revelations. He said the two should not be confused although acknowledged there were “overlapping issues”.

The proposal contains extra powers for law enforcement agencies to target hackers including provisions that would allow for the prosecution of the sale of “botnets”, which are programs built to coordinate attacks.

“[It] would criminalize the overseas sale of stolen US financial information like credit card and bank account numbers, would expand federal law enforcement authority to deter the sale of spyware used to stalk or commit ID theft, and would give courts the authority to shut down botnets engaged in distributed denial of service attacks and other criminal activity.”

The proposed new cybersecurity bill includes separate protections for consumers and children announced on Monday, which also require companies to notify customers of data breaches and which Obama announced at approximately the same time as the Pentagon Twitter episode.

To become law, the new cybersecurity proposals will also have to win over Republican leaders who met with Obama at the White House to discuss areas of common interest where they can agree on legislation with the president.

After the meeting, Obama cited cybersecurity as one of those areas. “I think we agreed that this is an area where we can work hard together, get some legislation done and make sure that we are much more effective in protecting the American people from these kinds of cyberattacks.”

In a statement, the office of House speaker John Boehner said that “Republicans are ready to work with both parties to address this important issue.”

Speaking about the proposals at an event at the Department of Homeland Security, Obama conceded that the American people had an interest in making sure the government was not abusing information it got from the private sector and insisted the information sharing rules would come with checks and balances to protect privacy.

“We’ve got to stay ahead of those who would do us harm,” he said. “The problem is that government and the private sector are still not always working as closely together as we should. Sometimes it’s still too hard for government to share threat information with companies”.

Privacy campaigners were somewhat comforted by administration assurances that information shared with government agencies would be restricted to non-personal data but said it should not be left up to the agencies to decide how this was defined.



“It’s good that they are starting to talk about data security but it should be in the bill, not left to officials to decide – this is a huge red flag,” Mark Jaycox of the Electronic Frontier Foundation told The Guardian.

“It’s a very real threat and it’s why privacy arguments have won the day so far in Congress.”