AMERICA’s Congress has been struggling for years to come up with legislation to address cyber-security issues, without success. Now it is trying yet again. On July 8th a draft bill, known as the Cyber Information Sharing Act, or CISA, cleared the Senate’s intelligence committee and will now be debated by the full chamber. The proposed legislation is likely to face stiff opposition from privacy groups, who have already given warning about some of its provisions. We have been here before. In 2012 another cyber-security bill, the Cyber Information Sharing and Protection Act (CISPA), was heavily promoted by its supporters, but ended up being stymied because of concerns that it did not do enough to protect people’s privacy. Since then, Edward Snowden’s revelations about the mass surveillance activities of the National Security Agency (NSA) have made folk even warier of anything that could result in more information ending up in the hands of government. That is why CISA faces an uphill struggle. The bill has provisions that would, among other things, encourage the government to share more classified information about cyber-threats with private firms and give companies greater legal protection against potential lawsuits when sharing data about cyber-risks with government agencies. Swiftly circulating intelligence about hackers’ activities is a great way to make life harder for them, because companies can quickly adapt their defences to new risks. But privacy experts have a couple of concerns about the bill’s provisions. One is that although it requires firms to strip data of any information that could be used to identify individuals before sharing it (unless the people involved are closely associated with a threat), it does not impose the same requirement on government agencies.

Another concern is that the draft bill’s wording would mean information about cyber-threats could also be used for other purposes, including in things such as criminal cases that have nothing to do with the original cyber-threat to which the data are related. This worries civil liberties groups, who also fear that the NSA and other agencies could use the act’s provisions as a backdoor for snooping on people.

“Any cyber-security bill must acknowledge what we’ve learned by incorporating robust privacy protections and robust transparency protections,” says Mark Jaycox of the Electronic Frontier Foundation, a civil-liberties group. “This bill does neither.” Even some of the Senate intelligence committee’s members recognise this fact. In a joint statement issued yesterday, Ron Wyden and Mark Udall, two Democrats who voted against the draft legislation, lamented the fact that the bill “lacks adequate protections for the privacy rights of law-abiding Americans”.

While that is disturbing, there may be no need to mount the same kind of online protest campaigns that have helped scupper poorly crafted cyber-security legislation in the past. This year’s legislative agenda is already very crowded, so unless there is some kind of big cyber-attack, CISA will struggle to get anywhere near the statute books.

(Photo credit: JIM WATSON / AFP)