Sen. Dianne Feinstein’s Frontal Assault On The 4th Amendment And Whistleblowers

By Michael Krieger

There’s not much good you can count on Congress to accomplish, but when it comes to introducing and passing oligarch protecting, civil liberties destroying legislation, our “representatives” are absolutely relentless in their determination. Unsurprisingly, the only “distinctly native American criminal class,” as Mark Twain described Congress, is at it again when it comes to institutionalizing spying and attempting a legal run around the Bill of Rights.

One thing that has become crystal clear since the Edward Snowden revelations, is that much of Congress has no problem at all with unconstitutional spying. Rather, they are primarily upset that it became exposed and they are dead set on making sure no other whistleblower can ever do the same. Enter CISA, or the Cyber Intelligence Sharing and Protection Act.

I’ve spent much of today reading about the bill, and have compiled what I think are the most astute observations. First, from the ACLU:

A new cybersecurity bill poses serious threats to our privacy, gives the government extraordinary powers to silence potential whistleblowers, and exempts these dangerous new powers from transparency laws.

“The bill would create a massive loophole in our existing privacy laws by allowing the government to ask companies for ‘voluntary’ cooperation in sharing information, including the content of our communications, for cybersecurity purposes. But the definition they are using for the so-called ‘cybersecurity information’ is so broad it could sweep up huge amounts of innocent Americans’ personal data.

“The Fourth Amendment protects Americans’ personal data and communications from undue government access and monitoring without suspicion of criminal activity. The point of a warrant is to guard that protection. CISA would circumvent the warrant requirement by allowing the government to approach companies directly to collect personal information, including telephonic or internet communications, based on the new broadly drawn definition of ‘cybersecurity information.’”

In addition to the threats to every American’s privacy, the bill clearly targets potential government whistleblowers. Instead of limiting the use of data collection to protect against actual cybersecurity threats, the bill allows the government to use the data in the investigation and prosecution of people for economic espionage and trade secret violations, and under various provisions of the Espionage Act.

The always excellent Electronic Frontier Foundation (EFF) has also chimed in:

CISPA purports to allow companies and the federal government to “share” threat information for a “cybersecurity” purpose—to protect and defend against attacks against computer systems and networks. But the bill is written broadly enough to permit your communications service providers to identify, obtain, and share your emails and text messages with the government. While business leaders have conceded that they do not need to share personally identifying information to combat computer threats, the bill provides an exception to existing law designed to protect your personal information.

The newly granted powers are intended to thwart computer security threats against a company’s rights and property. But the definitions are broad and vague. The terms allow purposes such as guarding against “improper” information modification and ensuring “timely” access to information, functions that are not necessarily tied to attacks.

Once handed over, the government is able to use this information for investigating crimes that are unrelated to the underlying security threat and, more broadly, for “national security” purposes, which is a poorly defined term that includes “threats to the United States, its people, property, or interests” and “any other matter bearing on United States national or homeland security.”

Companies would also be immune from both civil and criminal liability for any action, including but not limited to violating a user’s privacy, as long as the company used the powers granted by CISPA in “good faith.” The immunity even extends to “decisions made based on” any information “directly pertaining” to a security threat. The consequences of such a clause are far-reaching.

Meanwhile, Trevor Timm, executive of the Freedom of the Press Foundation, noted in the Guardian that:

One of the most underrated benefits of Edward Snowden’s leaks was how they forced the US Congress to shelve the dangerous, privacy-destroying legislation– then known as Cispa – that so many politicians had been so eager to pass under the guise of “cybersecurity”. Now a version of the bill is back, and apparently its authors want to keep you in the dark about it for as long as possible.

Now it’s called the Cybersecurity Information Sharing Act (Cisa), and it is a nightmare for civil liberties. Indeed, it’s unclear how this kind of law would even improve cybersecurity. The bill was marked up and modified by the Senate intelligence committee in complete secrecy this week, and only afterward was the public allowed to see many of the provisions passed under its name.

Cisa is what Senator Dianne Feinstein, the bill’s chief backer and the chair of the committee, calls an “information-sharing” law that’s supposed to help the government and tech and telecom companies better hand information back and forth to the government about “cyberthreat” data, such as malware. But in reality, it is written so broadly it would allow companies to hand over huge swaths of your data – including emails and other communications records – to the government with no legal process whatsoever. It would hand intelligence agencies another legal authority to potentially secretly re-interpret and exploit in private to carry out even more surveillance on the American public and citizens around the world.

Under the new provisions, your data can get handed over by the tech companies and others to the Department of Homeland Security (not exactly a civil liberties haven itself), but then it can be passed along to the nation’s intelligence agencies … including the NSA. And even if you find out a company violated your privacy by handing over personal information it shouldn’t have, it would have immunity from lawsuits – as long as it acted in “good faith”. It could amount to what many are calling a “backdoor wiretap”, where your personal information could end up being used for all sorts of purposes that have nothing to do with cybersecurity.But it’s not just privacy advocates who should be worried: transparency also takes a huge hit under this bill. Cisa would create a brand-new exception to the Freedom of Information Act (which is already riddled with holes), all the better to ensure everything in this particular process remains secret. 

In typical intel-committee fashion, the Foia amendment wasn’t even made public until after it was passed by committee.

The fact of the matter is the Snowden leaks have done more for cybersecurity than any info-sharing bill ever could. The major tech companies have leapt forward and are now competing on who is more secure because of worries that the NSA, and other intelligence agencies for that matter, are snooping wherever they can. Certainly there is more to do, but eviscerating privacy rights in the process is not the solution.