Lawmakers Have Snuck CISA Into a Bill That Is Guaranteed to Become a Law

To anyone who has protested the sweeping, vague, and privacy-killing iterations of the Cybersecurity Information Sharing and Protection Act or the Cybersecurity Information Sharing Act over the last several years, sorry, lawmakers have heard you, and they have ignored you.

That sounds bleak, but lawmakers have stripped the very bad CISA bill of almost all of its privacy protections and have inserted the full text of it into a bill that is essentially guaranteed to be passed and will certainly not be vetoed by President Obama.

CISA allows private companies to pass your personal information and online goings-on to the federal government and local law enforcement if it suspects a "cybersecurity threat," a term so broadly defined that it can apply to "anomalous patterns of communication" and can be used to gather information about just about any crime, cyber or not.

The Senate passed a version of CISA earlier this fall, but now a more invasive version of it (renamed the Cybersecurity Act of 2015) has been inserted into an extremely important budget bill.

At 2 AM Wednesday morning, Speaker of the House Paul Ryan unveiled a 2000-page budget bill that will fund the federal government well into next year. The omnibus spending bill, as it's usually referred to, is the result of countless hours of backroom dealings and negotiations between Republicans and Democrats.

Without the budget bill (or a short-term emergency measure), the government shuts down, as it did in 2013 for 16 days when lawmakers couldn't reach a budget deal. It contains dozens of measures that make the country run, and once it's released and agreed to, it's basically a guarantee to pass. Voting against it or vetoing it is politically costly, which is kind of the point: Republicans get some things they want, Democrats get some things they want, no one is totally happy but they live with it anyway. This is how countless pieces of bad legislation get passed in America—as riders on extremely important pieces of legislation that are politically difficult to vote against.

As Politico notes:

You see how it is. This is some House of Cards-type shit, and anyone who values their privacy is screwed, because, let's face it—CISA is small potatoes politically speaking compared to the other stuff in here. Every major political media outlet is already talking about how the deal avoids a government shutdown and is talking as though it has already been passed. And that's because, for all intents and purposes, the agreement on the text of the bill itself was the politically difficult hurdle to clear—the actual passage of it is a foregone conclusion.

Perhaps because lawmakers knew the bill would not be vetoed or pushed back against, many of the already weak privacy protections remaining in the Senate version of CISA have been stripped.

The version of CISA in the budget bill allows "cybersecurity threat" information to be shared directly with the NSA and the department of defense, specifically removes a provision that banned the government from using the information for "surveillance" activities, and allows the government to use the information it gleans to prosecute any type of criminal activity, not just "cyber" crimes.

Finally, the new version does not require personal information unrelated to "cyber threats" to be scrubbed before it's shared with government agencies.

So we are left with a worse version of a bill that hundreds of thousands of internet users and Silicon Valley's largest companies (including Apple, Yelp, Twitter, Reddit, Google, and Facebook) opposed because of its weak privacy protections and the fact that security experts believe it would do little to actually improve cybersecurity.

At this point, there is very little anyone can do about it. The budget bill is going to pass—political prognosticators are saying it'll happen by Friday at the latest. And then it's off to President Obama's desk. Obama has been asking for cybersecurity reform since the Sony hack last year—he probably wasn't going to veto a standalone version of CISA; there's roughly a 0 percent chance he's going to shut down the federal government because of a minor little thing like privacy.