Civil-liberties groups slam GOP Senate cyber bill

By Brendan Sasso - 05/14/12 06:40 PM ET

Civil-liberties groups announced their opposition to the White House's preferred cybersecurity bill last week, but in an open letter on Monday, they said the GOP version is not a "viable alternative."

The American Civil Liberties Union, the Center for Democracy and Technology, the Electronic Frontier Foundation and others warned that the Secure IT Act, which is sponsored by Sen. John McCain (R-Ariz.) and other Republicans, would encourage companies to hand over their customers' private information to the National Security Agency.

The civil-liberties groups oppose the Cybersecurity Act, which is backed by Sens. Joe Lieberman (I-Conn.), Susan Collins (R-Maine) and the White House, but they said the Republican bill could be even worse.

"It does not address the concerns many of us have raised with the Cybersecurity Act, and in some respects poses even greater threats to privacy and civil liberties," the groups wrote. "Therefore, SECURE IT is not a viable alternative to the Cybersecurity Act. Both bills require substantial amendments to address these concerns."

The goal of both bills is to remove legal barriers that prevent companies from sharing information about cyber threats with the government. The Lieberman-Collins bill would also set mandatory cybersecurity standards for critical infrastructure, such as electrical grids.

The civil-liberties groups noted that unlike the Lieberman-Collins bill, Secure IT would not require companies to strip out personally identifiable information, such as names and birth dates, from the information they share with the government.

The bill would give the National Security Agency access to all cyber threat information shared with the government. The civil liberty groups argue that a domestic agency such as the Homeland Security Department would be more appropriate for handling cyber threats.

Secure IT would force companies that contract with the government for communication services to share cyber threat information related to the contract. The groups said that requirement would undermine "private sector autonomy" and would create a "substantial incentive to overshare private information."

The groups also said the bill's immunity provisions are overly broad.