US Senate passes CISA, a very bad spying bill dressed up as a cybersecurity bill

CISA won’t make you and I any more secure, and it threatens what’s left of our online privacy. The very helpful sounding “Cybersecurity Information Sharing Act” will definitely help the government, though: it’ll make it a lot easier for technology companies to share your personal data with the government, and everyone knows that this data never ends up in the wrong hands, so you’re fine.

The gaping privacy flaws in CISA didn’t stop the Senate from passing it by a wide margin today: 74 to 21. CISA now goes to a conference committee between House and Senate.

Here’s the EFF’s take, by Mark Jaycox:

CISA passed the Senate today in a 74-21 vote. The bill is fundamentally flawed due to its broad immunity clauses, vague definitions, and aggressive spying authorities. The bill now moves to a conference committee despite its inability to address problems that caused recent highly publicized computer data breaches, like unencrypted files, poor computer architecture, un-updated servers, and employees (or contractors) clicking malware links.

The conference committee between the House of Representatives and the Senate will determine the bill’s final language. But no amount of changes in conference could fix the fact that CISA doesn’t address the real cybersecurity problems that caused computer data breaches like Target and the U.S. Office of Personnel Management (OPM).

The passage of CISA reflects the misunderstanding many lawmakers have about technology and security. Computer security engineers were against it. Academics were against it. Technology companies, including some of Silicon Valley’s biggest like Twitter and Salesforce, were against it. Civil society organizations were against it. And constituents sent over 1 million faxes opposing CISA to Senators.

With security breaches like T-mobile, Target, and OPM becoming the norm, Congress knows it needs to do something about cybersecurity. It chose to do the wrong thing. EFF will continue to fight against the bill by urging the conference committee to incorporate pro-privacy language. And we will never stop fighting for lawmakers to either understand technology or understand when they need to listen to the people who do.

Wired’s analysis today is worth reading, too.