An amendment to a controversial cybersecurity bill will allow US courts to pursue and jail foreign nationals even if the crimes they commit are against other foreigners and on foreign soil.

The main aim of the amendment to the Cybersecurity Information Sharing Act (Cisa), which passed a key Senate hurdle on Thursday, is to lower the barrier for prosecuting crimes committed abroad. But the amended law would make it a crime punishable by US prison time not merely to clone the credit card or steal the Netflix password of an American citizen, but to take unauthorized information from any American company, no matter where it happens.

In other words, if a French national hacks a Spanish national’s MasterCard, she could be subject to 10 years in US prison under laws changed by the bill.

The law has already attracted heavy criticism from American privacy advocates. The Electronic Frontier Foundation points out that the computer fraud laws that would be broadened by Cisa were used to prosecute the late founder of Demand Progress, Aaron Swartz, for downloading articles from JSTOR, the digital library of academic journals.



The amendment was proposed by Sheldon Whitehouse, a Democratic senator from Rhode Island. “The White House folks have been pretty clear that that’s what they’re trying to do, ease prosecutions for trafficking when the assets are held abroad,” said Gabe Rottman, legislative counsel and policy advisor for the American Civil Liberties Union (ACLU).

Cisa’s stated purpose is to create a reporting system for private industry allowing any company with a digital record of consumer behavior to send “cyber threat indicators” to the Department of Homeland Security. DHS is then required to pass the information on the FBI and the director of national intelligence, to whom the director of the CIA reports. The DHS has come out against the bill, arguing it could sweep away “important privacy protections”. Cisa is also facing mounting pressure from tech companies, which have called for it to be rewritten or scrapped.

The bill would also block any disclosures, with specific mention of the Freedom of Information Act, about what information had been shared.



Cyber threat indicators and defensive measures provided to the Federal Government under this Act shall be deemed voluntarily shared information and exempt from disclosure under [FOIA] and any State, tribal, or local law requiring disclosure of information or records; and withheld, without discretion, from the public [...] and any State, tribal, or local provision of law requiring disclosure of information or records.

Republican senator Rand Paul of Kentucky introduced an amendment to the bill disallowing it from breaking user agreements between companies and their users. The amendment failed to pass, 32-65.

Republican senator Richard Burr of North Carolina, co-sponsor with California Democrat Dianne Feinstein, said he would not entertain any more amendments to the bill, which is now expected to receive a vote next week.