吃瓜大本营

We learned last week that the government is just as cyber-insecure as Sony. The White House finally disclosed that hackers, reportedly from China, had stolen more than four million personnel records, including security clearance information that could potentially be used for espionage. Senate Majority Leader Mitch McConnell鈥檚 answer? Let鈥檚 give the government even more sensitive information, this time about you and me, and let鈥檚 do so with the utmost secrecy.

For years now, the forces of industry and national security hawks in Congress have pushed to drive a tractor through existing privacy law in the name of cybersecurity 鈥渋nformation sharing.鈥� These measures, the most high-profile of which was the ill-fated , or 鈥淐ISPA,鈥� in 2013, have so far faced righteous opposition by the privacy and civil liberties community (which, incidentally, is advocating for more effective security measures that wouldn鈥檛 imperil basic freedoms).

This year, Majority Leader McConnell and head of the Senate intelligence committee, Richard Burr (R-SC), are trying something different. Burr moved the bill to the full Senate in secret session of his committee, and McConnell is planning to attach the bill as a 鈥渟econd degree鈥� amendment to a military spending bill. That means, assuming the bill passes, CISPA 2.0 will have breezed through with no debate on the floor of the Senate. This is the sacred crucible of democracy in action, folks.

So, what does the bill鈥攄ubbed the Cybersecurity Information Sharing Act, or 鈥淐ISA鈥濃�攄o? It鈥檚 a surveillance bill, pure and simple. It says that any and all privacy laws, including laws requiring a warrant for electronic communications, and those that protect financial, health or even video rental records, do not apply when companies share 鈥渃ybersecurity鈥� information, broadly defined, with the government. For much more detail, please see this blog and coalition letter, this analysis from the and a deep dive by the .

Once that information is shared, it will be automatically disseminated government-wide, including to outfits like the National Security Agency, CIA, and FBI, where it can be used for garden-variety law enforcement investigations and intelligence activities. It can also be used to investigate and prosecute whistleblowers under the Espionage Act, the World War I-era law that has been used by the Obama administration to go after more national security 鈥渓eakers鈥� than all other presidencies combined.

In short, it makes mincemeat of basic notions of due process. But that鈥檚 not all. This isn鈥檛 just a problem in the abstract for 鈥減rivacy.鈥� It would actually make things less secure.

The hack targeted the Office of Personnel Management. OPM is what it sounds like: the federal agency responsible for maintaining detailed records on the millions of government workers in the United States. Those records include social security numbers, birth dates, and information on families, friends, co-workers鈥攜ou name it. OPM runs security clearances, which can involve the collection of very sensitive information. In other words, OPM is the ultimate honeypot for hackers; a one-stop shop to create a database that can be used to guess passwords, compromise accounts or craft sophisticated attacks like those that were probably used to get into Sony and Anthem.

Worse, this is only the latest, though possibly the largest, in a series of data breaches at the federal government, which, in just the past year, have included hacks at the IRS, State Department, and the White House.

If the federal government can鈥檛 secure the most sensitive intelligence and military data against spies and cyber-thieves, what does that mean for the vast amount of personal information that would flow to the government from the private sector under CISA? The answer is obvious. The honeypot would grow all that much sweeter. Not only would you have a one-stop shop for government worker information, you would have a new trove of personal information about all of us, held in what have proved to be tempting and vulnerable targets for the baddest of actors.

That all this is happening without any debate is just salt in the wound. Senator Ron Wyden (D-OR), the only member of the intelligence committee to vote against CISA, is waging a lonely fight against the bill, and has vowed to push for a full and open debate on the measure. He deserves our support. It would be truly tragic if legislation this dramatically terrible passed without anyone even talking about it.