On April 26, the House of Representatives passed HR 3523, the Cyber Intelligence Sharing and Protection Act of 2011, by a vote of 248-168 despite a White House veto threat. While amendments were made to HR 3523 prior to passage, none in any way address the wholesale attack on public access to information under the Freedom of Information Act (FOIA) included in the bill.
As many of you know, in the interest of encouraging private companies to share cybersecurity threat information, HR 3523 unwisely and unnecessarily cuts off all public access to cyber threat information before the public and Congress have the chance to understand the types of information that are withheld under the bill. Much of the sensitive information private companies are likely to share with the government is already protected from disclosure under the FOIA. Other information that may be shared could be critical for the public to ensure its safety. The public needs access to some information to be able to assess whether the government is adequately combating cybersecurity threats and, when necessary, hold officials accountable.
Representative Mike Quigley, the Co-Chair of the Congressional Transparency Caucus, attempted to improve the FOIA provision by introducing an amendment that was would require the Director of National Intelligence to determine if the public interest in releasing any of the cyber threat information shared with the federal government outweighs the interest in protecting the information before it could be withheld under the FOIA. The amendment was not ruled in order by the House Rules Committee.
It is not clear at this time how the Senate will react to the House bill. Several competing cybersecurity bills have been introduced in the Senate, each of which also includes problematic FOIA provisions. We urge Congressional Committees in the House and Senate with expertise in FOIA to use their expertise in public access to information to help make sure any FOIA-related provision promotes transparency and public accountability while allowing the government to withhold only that information which truly requires protection.