POGO and Partners Say Cybersecurity Bill is Flawed

Dear Senators:

On behalf of the undersigned organizations concerned with government openness and accountability, we are writing to let you know of our serious concerns with sections of S.2105, the Cybersecurity Act of 2012, that create unnecessary, overbroad and unwise limitations to access of information, including broad exemptions to the Freedom of Information Act (FOIA), and jeopardize the rights of whistleblowers.

Section 107, as drafted, includes an exceedingly broad definition of “critical infrastructure information,” encapsulating information that is crucial for the public to understand public health and safety risks and information already protected under one of the FOIA’s other exemptions. Furthermore, the proposed exemption conflicts with Congress’ recent effort in the National Defense Authorization Act (NDAA) of 2012 to limit the scope of CII information that can be withheld by the Department of Defense. In the language signed into law this December, Congress rightly recognizes that there can be an overwhelming public interest in disclosing some CII information, and requires the Secretary of Defense to weigh the public interest in disclosure before it can be withheld under FOIA.

Similarly, the language in Section 704(d) relating to cybersecurity threat indicators is troublingly broad, especially considering we do not know what kind of information may be shared in the newly-created cybersecurity exchanges. Cutting off all public access to information in the cybersecurity exchanges before we understand the types of information that may be covered and how best to protect that information while promoting accountability, is bad policy.

We also have concerns about how this bill would limit the lawful disclosures of wrongdoing by whistleblowers. In particular, Section 107(e) would far too narrowly define free speech rights and is not inclusive of existing protections under law. Realistically, whistleblowers will be proceeding at their own risk.

We urge you to not fast track this bill. The unaddressed issues we have identified demand a more careful and thorough consideration. We look forward to working with you to ensure the bill protects our nation’s computer networks and promotes transparency and accountability.