House panel approves cyber bill after adding surveillance restrictions

The House Homeland Security Committee on Tuesday approved by unanimous voice vote a bill that gives companies liability protection when sharing cyber threat data with the Department of Homeland Security (DHS).

It was the third and final markup of the three cyber info-sharing bills lawmakers are hoping to pass, combine and get to President Obama’s desk by mid-May.

“To defend American’s vital digital networks, the public and private sector must work together,” said Committee Chairman Michael McCaul (R-Texas).

{mosads}While the measure — known as the National Cybersecurity Protection Advancement Act — passed without opposition, several protracted debates did break out during the markup.

Democrats unsuccessfully fought to implement a sunset clause for the bill and infuse language they argued would ensure companies don’t receive liability protections for inaction.

Republicans pushed back, cautioning that the changes would create a chilling effect and dissuade companies from sharing data.

All committee members did agree to tack on language that prohibits any cyber threat data from being used for surveillance purposes, a key concern of privacy advocates.

A cyber threat sharing bill has been a top priority this year for lawmakers, the White House and most industry groups. They argue the government and private sector need to swap more data in order to better understand cyber threats and bolster network defenses.

Companies have historically been hesitant to share data with the government, fearing shareholder lawsuits or regulatory action.

The legislation is one of two House bills intended to address the issue. The House Intelligence Committee also approved a measure that would grant liability protections for companies sharing cyber threat data with any other civilian agency, such as the Commerce Department or Treasury Department.

Neither bill would grant protections for companies sharing data with the National Security Agency or Department of Defense, a move intended to quell privacy concerns that have derailed previous efforts.

During Tuesday’s markup, the committee unanimously agreed to an amendment meant to further mitigate privacy advocates’ fears.

The added language expressly forbids the government from using any data collected under the bill from being used for surveillance purposes.

Privacy groups have maintained that the cyber threat-sharing bills currently under consideration would shuttle more sensitive data to the National Security Agency (NSA).

“My amendment will allay the privacy concerns of many,” said Rep. John Ratcliffe (R-Texas), who chairs the House Subcommittee on Cybersecurity, Infrastructure Protection and Security Technologies.

Lawmakers also tacked on a number of amendments without opposition that mostly added extra DHS oversight and reporting requirements.

Other amendments will require the DHS to conduct cybersecurity public education campaigns as part of its threat-sharing efforts.

Lawmakers did split over a proposed five-year sunset provision.

“We all know that technology is evolving at an unprecedented pace,” said Committee ranking member Bennie Thompson (D-Miss.), who offered the failed amendment. A sunset clause “would help us assess what changes in the law might be necessary.”

Republicans countered that a five-year window could make the law feel like a pilot project. Certainty encourages companies to participate in the voluntary sharing program the bill would establish, they said.

“I normally favor sunset provisions,” McCaul said. However, he added, “I believe it’s important that industry knows this operation … will be around.”

Instead, the committee agreed to sunset all reports mandated by the bill after seven years.

With both House bills now out of committee, leaders are expected to combine them and send one measure to the floor between April 21 and 23.

The Senate Intelligence Committee has also passed its own bill meant to mirror the House efforts. Majority Leader Mitch McConnell (R-Ky.) said Tuesday that measure would hit the floor “in the near future.”