Senate passes bill to push sharing of info on hacker threats

WASHINGTON – The Senate passed a bill Tuesday aimed at improving cybersecurity by encouraging companies and the government to share information about threats. It took roughly six years to win approval for such a program.

The Cybersecurity Information Sharing Act passed by a 74-21 vote. It overcame concerns about privacy and transparency from some senators and technology companies, such as Apple and Yelp.

The Senate rejected amendments, including one addressing concerns that companies could give the government personal information about their customers. Another failed amendment would have eliminated part of the bill that would keep secret information about which companies participate and what they share with the government.

The bill’s co-sponsors, Sens. Dianne Feinstein, D-Calif., and Richard Burr, R-N.C., said the measure was needed to limit high-profile cyberattacks, such as the one on Sony Pictures last year.

“From the beginning we committed to make this bill voluntary, meaning that any company in America, if they, their systems are breached, could choose voluntarily to create the partnership with the federal government. Nobody’s mandated to do it,” Burr said.

Companies would receive legal protections from antitrust and consumer privacy liabilities for participating in the voluntary program.

The House passed its version of the bill earlier this year with strong bipartisan support. The two versions of the bill will need to be reconciled before being sent to the White House.

Sen. Ron Wyden, D-Ore., who opposed the bill, offered an amendment addressing privacy concerns, but it failed to pass. It would have required companies to make “reasonable efforts” to remove unrelated personal information about their customers before providing the data to the government.

“You just can’t hand it over,” Wyden said. “You’ve got to take affirmative steps, reasonable, affirmative steps, before you share personal information.”

Senators also rejected an amendment Sen. Patrick Leahy, D-Vt., had offered that would have removed a provision to keep secret more information about materials that companies provide to the government. Leahy criticized the bill’s new exemption from the U.S. Freedom of Information Act as overly broad because it pre-empts state and local public information requests.