Obama’s recent proposals have failed to win the support of privacy groups, who warn that legislation would expand US government’s reach into private data

With online security ramping up as a 2015 priority for his administration, President Obama is expected to unveil new plans to make the internet a safer place in his State of the Union speech on Tuesday. But experts warn his proposals would expand the US government’s reach into private data – and face an uphill struggle in Congress.

In a series of speeches last week, Obama signalled his intention to devote greater emphasis to domestic and military cybersecurity in 2015, citing recent breaches as “a reminder that cyber threats are an urgent and growing danger”. But the president has been trying to pass new cybersecurity legislation for three years. Despite the massive, high-profile hacks of Sony, Target and Home Depot, new legislation will struggle to gain traction, said Anindya Ghose, professor of Information, Operations and Management Sciences at New York University’s Stern School of Business.

“I don’t think anyone wants to see another Sony. It’s bad for everyone, but I find it difficult to see any legislation going through despite the importance of it,” said Ghose.

Ghose said the Sony attack, which the Obama administration claims was orchestrated by North Korea and which revealed the personal details of 50,000 Sony employees, was the perfect example of how cybersecurity and personal data protection were linked. The hack might help Obama win over some Republicans to his cause, Ghose said, but given the hostility between the two parties and Republican control of Congress and the Senate, new legislation would be difficult.

Obama and Cameron’s ‘solutions’ for cybersecurity will make the internet worse | Trevor Timm Read more

Currently there are very few restrictions on the data that companies can collect from digital apps and how they are allowed to use that information. Privacy advocates, including the American Civil Liberties Union and the Electronic Frontier Foundation (EFF), have called on Obama to strengthen consumer protection. At the Federal Trade Commission earlier this month, Obama argued that customers ought to know when sensitive data like credit card information has been compromised, and previewed a “Consumer Privacy Bill of Rights” he wants Congress to pass by late February.

Obama’s recent proposals have failed to win the support of privacy groups. “The Obama administration is on a roll with proposing legislation that endangers our privacy and security,” EFF’s Mark Jaycox and Lee Tien wrote in a blog post last week, calling Obama’s recent proposals “recycled ideas that have failed in Congress since their introduction in 2011. They should stay on the shelf.”

Any new bill will also face intense lobbying from Silicon Valley and the advertising community, which is keen on protecting their access to a treasure trove of marketable data. David Le Duc, senior director of public policy at the Software and Information Industry Association, a lobby group for the software and digital content industry, said: “We agree with the goal of securing people’s privacy but we are concerned that a broad, overreaching approach will affect the ability to maximise the economic and social use of data.”

Le Duc said that technology was evolving and restrictive legislation would stifle that progress. “We already have one of the strongest systems in the world,” he said. “A lot of us enjoy tremendous benefits from apps that are customised and immediate based on our preferences and likes. Going too far to limit that to protect our ‘privacy’ would not be an effective endeavour.”

Thus far, Obama has framed his forthcoming cybersecurity proposals in terms of consumer protection, following the high-profile data breaches at consumer companies. But fallout from the Sony hack in particular has returned attention to the military aspects of cybersecurity.

While the US military’s emphasis on cybersecurity is rapidly expanding – it plans to field 6,000 “cyberwarriors” by next year, triple its 2014 levels – that rush has tended to focus on what technical experts consider the least likely cyber vulnerabilities: those that compromise or destroy physical systems. “There’s a strong likelihood that the next Pearl Harbor we confront could be a cyber attack,” Leon Panetta, Obama’s second defense secretary, warned in 2011.

But other aspects of Obama’s proposals have attracted criticism for expanding intelligence and law-enforcement access to private data, which privacy advocates worry will leave that data less secure. A new joint venture with the United Kingdom, announced last week, will bring the two countries’ already-close security agencies into deeper cooperation over cybersecurity.

Facebook Twitter Pinterest A new joint venture with the UK will bring the two countries’ already-close security agencies into deeper cooperation over cybersecurity. Photograph: Rex

Obama would give law enforcement greater power under the Computer Fraud and Abuse Act to investigate cyber crimes, though privacy groups have questioned the need for expanding what they consider overbroad security-agency access to private data.

Resurrecting a long-stalled idea, the president also wants businesses, and particularly financial institutions, to secretly share observed digital attacks on their networks with the government. The initial steward of those threat patterns would be the Department of Homeland Security. But the National Security Agency would receive access, prompting fears that the government will both make an end-run around warrant requirements for private information and stockpile or use previously unknown vulnerabilities, undermining the secure internet Obama advocates in other contexts. Obama has already permitted “a clear national security or law enforcement need” to trump disclosure of so-called “zero day exploits”.

The data-sharing proposal has powerful advocates: it is the top legislative priority of the current NSA director, Admiral Michael Rogers, as well as his predecessor. A predecessor of the initiative passed the Senate intelligence committee last year but went no further.

Sparked by revelations of the NSA undermining encryption and collecting vast swaths of personal data, civil libertarians have reacted to the information-sharing proposal with alarm. The EFF called Obama’s proposals “unnecessary and unwelcome”.

Obama has planned a summit at Stanford University on cybersecurity for 13 February. Meanwhile, his nominee for defense secretary, Ashton Carter, has likened the Edward Snowden leaks to a “cyber Pearl Harbor”, a conceptualisation that places more emphasis on data insecurity than on the potential for physical destruction.