Providing for consideration of the bill (H.R. 624) to provide for the sharing of certain cyber threat intelligence and cyber threat information between the intelligence community and cybersecurity entities, and for other purposes.

Mr. Speaker, I ask unanimous consent that all Members may have 5 legislative days to revise and extend their remarks and include extraneous material on the bill H.R. 624.

I yield myself such time as I may consume.

I want to thank my ranking member and both the Republican and Democratic staffs and the Republican and Democratic members of the Intelligence Committee for 2 years of long hours in negotiated efforts to reach the point that we are.

I want to back up just a little bit and tell you how we got to where we are today. We sat down some 2 years ago when the ranking member and I assumed the leadership of the Intelligence Committee and we looked at the one threat that we knew existed but we were not prepared to handle as Americans, both the private sector and the government. And we knew that we had to do something about this new and growing and misunderstood cyber threat and what it was doing to our intellectual property across the country, what it was doing to the freedom and open Internet that we so enjoy and are increasingly dependent on and the commercial value of our growing economy. And it was at risk. The private sector was at risk because people were stealing their identities, their accounts, their intellectual property, and subsequent to that, their jobs, and people began to question the value of getting on the Internet and using it for commercial purposes. Their trust in the free and open Internet the way we've embraced it in the United States really was at risk.

How do we solve that problem? We knew that nation states were investing millions and billions of dollars to generate cyber warriors to go in and crack your computer network. I don't care if you had intellectual property--those blueprints that made your business successful, or maybe it was your bank account, or your ability to have a transaction. If they could interrupt that, they could do great harm to our economy and to the United States.

We saw nation-states like Russia and China and now Iran and North Korea and others developing military-style attacks to actually do harm to the U.S. economy, to hurt the very men and women who get up every day and play by the rules and think that the Internet would be a safe place for them to interact when it comes to commerce. We want that to continue.

So we sat down and we talked to industry folks, people who are in the business, high-tech industry folks from Silicon Valley, financial services folks from New York City, manufacturers from across the Midwest, who were losing intellectual property due to theft from nation-states like China. We talked to privacy groups. We talked to the executive branch. And over the last 2 years, there were some 19 adjustments to this bill on privacy.

We believe this: this bill will not work if Americans don't have confidence that it will protect your privacy and civil liberties while allowing one very simple thing to happen: cyber threat material, that malware that goes on your computer and does bad things, allows somebody else to take over your computer to attack a bank, allows them to go on your computer and steal your personally identifiable information and use it in a crime, allows them to go into your network at work and steal your most valuable company secrets that keep you alive and build great products here in the United States--could we allow the government to share what they know with the private sector and allow the private sector to share when it comes to just that cyber threat, those zeros and ones in a pattern that equates to malicious code traveling at hundreds of millions of times a second the speed of light, can we share that in a way to stop them from getting in and stealing your private information?

And the good news is the answer is, yes, we can do this. We can protect privacy and civil liberties, and we can allow this sharing arrangement, but not of your identity, not of your personally identifiable information. As a matter of fact, if that's what's happening, it won't work. But at the speed of light, from machine to machine, from your Internet service provider before it ever gets into your network they bounce out the nastiest stuff that's in there that's going to take over your computer, steal your money, steal your personally identifiable information, steal your company secrets. And they can identify that by a pattern and kick it out. They'll say, Something looks bad about that. Can the government take a look at that and say, you know what? This is a Chinese attack, it's an Iranian attack, it's a North Korean attack--let's defend our networks. It's really very simple.

Today, what you see is a collaborative effort. This isn't a bill by Dutch Ruppersberger and Mike Rogers and this is the only way it has to be. We have taken suggestions from all the groups I just talked about, from privacy to the executive branch to industry to other trade associations. And this is the bill that mutually all of those people, representing tens of millions of employees around this country, said this is the way you do this and protect the free and open Internet and you protect civil liberties. And you finally raise that big red sign that tells people like China and Iran and Russia, stop. We're going to prevent you from stealing America's prosperity.

I heard a lot of debate earlier on the rule. I've heard a lot of misinformation. There are people who don't like it for whatever reason, maybe it's conviction, maybe it's politics, maybe it's political theater. And I have a feeling there's a little bit of all of that when they talk about this bill.

This bill does none of the things I've heard talked about in the rule--that

it's an exchange of information that they've never seen with the government. This is not a surveillance bill. It does not allow the national security agencies or the Department of Defense or any of our military organizations to monitor our domestic networks. It does not allow that to happen. We would not allow that to happen.

So some notion that that's happening is just wrong, and some of the folks who are pretending otherwise know it's wrong. This is important.

You know, the Iranians, by public report, are laughing at our shores, looking for weaknesses in our financial institutions. They're not doing it for benevolence. They're doing it to try to create chaos in our markets here at home. This isn't 10 years or 20 years. This is today. It's happening today.

The average credit card in your purse, Madam Chair, will be hit 300,000 times today by bad actors trying to get in and steal your personal information--all those cardholders' information--and use it to commit a crime.

Today, hundreds of millions of times across this great country companies will be besieged by DDoS attacks trying to overwhelm their systems and shut them down and not allow commerce to happen, by people who are trying to get into their networks and steal something valuable.

This bill is that right balance between our privacy, civil liberties, and stopping bad guys in their tracks from ruining what is one-sixth of the U.S. economy. It's that important, and it's important that we get at it today.

We must do more to improve our cybersecurity, and this bill is that vital first step toward that bill. Our intelligence agencies collect important information overseas about advanced foreign cyber threats that could dramatically assist the private sector. That information is the intelligence community's unique value-added when it comes to our cybersecurity.

Unfortunately, we are not getting the full value of those intelligence insights. As I said, the intelligence community is not monitoring the Internet. They don't know what's happening on the domestic Internet. So when there is a nasty piece of source code or malicious source code attacking the private sector, the only way we're going to know that is if we--and these folks are victims of crime, by the way--if we allow them, in a classified environment, to share malicious source codes--zeros and ones in the right pattern--with the government and say, Hey, I am the victim of a crime. Here's what it looks like. Can you help? The government needs to be able to share this threat intelligence so that the private sector can protect its own networks.

The government is going to reciprocate. Our intelligence services go overseas. They find out what the bad guys are doing. They come back and protect the government networks. The problem is, because of laws and policies and procedures, we can't share that with the private sector so they can protect their own networks. Wouldn't it be great if they know what's coming? If you know what you're looking for, you can stop it. That's really what we're talking about doing here, Madam Chair.

We must also modernize the law to give the private sector clear authority to share cyber threat information within the private sector, as well as the government, on a voluntary, anonymous basis.

Again, if you believe in the free and open Internet and you look at all the bills that have been introduced, there is a chomping at the bit in this town to go out and try to put their mitts on the Internet. They want to get in there and start regulating and standards and setting up procedures. They want to get in from business-to-business communication. They want the government to be at every corner of the Internet. I reject that wholly. It's the wrong approach. It will not work. It will bring the Internet to a halt. This is the only bill that doesn't have new mandates, new authorizations for any government involvement in the Internet.

It does something very simple. I'm going to repeat it a lot today, Madam Chair. It allows the government to share zeros and ones in the right pattern with the private sector. And zeros and ones from the private sector, when they know it's malicious and attacking their networks, they share it with the government and say, This is a problem. Can you help me? That's what this bill does. And we've got a long list of privacy protections and restrictions to make sure that that's all that this bill does. The bill achieves all of these important goals that I just walked through, and it will empower the private sector, which already does significant work to protect computer networks, to do even more.

The bill will allow the government to share cyber threat intelligence more widely with American companies in operationally usable form so they can help prevent state-sponsored cyber spies from stealing American trade secrets. It also provides clear, positive authority to allow companies to share cyber threat information with others in the private sector. It also provides authority to allow those companies to share threat information on a purely voluntary and anonymized basis with the government, meaning no personal identifying information.

This bill will not require additional Federal spending. It will not require the creation of a vast new government bureaucracy. It will not impose any Federal regulations or unfunded mandates on the private sector. To the contrary, it will be a critical, bipartisan first step toward enabling America's private sector to better defend itself from the advanced state-sponsored cyber threats in which we live in today.

I'm very proud of the open and transparent process that produced this bill. We've had a great conversation over the last 2 years with a broad range of private sector companies, trade groups, privacy and civil liberties advocates, and the executive branch. I appreciate all the constructive input we have received from the process. This bill has been revised every step of the way in this process, and all of that has been based on discussions with all the groups I just mentioned.

I just want to cover some of the privacy protections we've added along the way.

The bill prohibits the government from requiring private sector entities to provide information to the government. There is nothing in here that has any requirement that the private sector must share cyber threat information. If they don't think it's in their best interest to stop that cyber crime, they don't have to say a word. If they do, they're allowed to share just that cyber threat information with the right agencies in real time. Again, this is machine to machine so that they can deal with the international nature of that threat.

It encourages the private sector to anonymize or minimize the information it voluntarily shares with others, including the government.

In addition, the bill requires an annual independent inspector general audit and report to Congress of all voluntary information sharing with the government. That's another layer of oversight. We have built multiple layers of oversight into this bill so that we can gain the confidence of the public in its purpose, intent, and success.

The bill significantly limits the Federal Government's use of information voluntarily provided by the private sector, including a restriction on the government's ability to search that data--very important.

The bill also enforces the restrictions on the government by levying penalties against the government through Federal court lawsuits for any violations of those restrictions. Again, another layer of oversight.

In the markup, we've made some progress, as well, between the ranking member and the members on the committee negotiating and working out what changes we can make to, again, improve the confidence that people have in this bill. We have improved this bill every step of the way for the last 2 years, and the markup was no different. At our markup, which voted the bill out of committee on a strong 18-2 vote, we adopted five important amendments to further strengthen the bill's protections and safeguards.

We adopted an amendment by Mr. Langevin that made it clear that the bill contained no new authority to allow companies to hack back into networks in other companies. It certainly wasn't intended in the legislation. I thought it was a well-intended amendment. The last thing we want to do is

unleash digital vigilantism across the country and what that might do to our ability to continue to rely on the Internet as an engine of commerce.

We've put in place the private sector use restriction that limits companies' use of information received to only cybersecurity purposes. Mr. Heck and Mr. Himes worked diligently on this amendment to improve the bill and make it very clear that this is just about cybersecurity and cybersecurity purposes.

The bill previously gave the government authorization to create procedures to protect privacy and civil liberties and prevent the government's retention of personal information not necessary to understand a cyber threat. Last week's amendment makes those procedures mandatory. That was by Mr. Himes. We agreed that was the right place to put the burden to make sure there was no personal identifiable information that was not necessary to determine the nature of the attack.

We also struck the bill's authorized government ``national security'' use of information received from the private sector. This would have provided the government flexibility in the future to address advanced cybersecurity threats. In conversations with government national security lawyers in recent months, they assured us that this flexibility wouldn't be required in the near future. In light of that, and given the widespread misunderstanding this language was generating, we thought it was prudent to take it out. Ms. Sewell from Alabama offered that amendment and worked with the committee to make sure it was adopted.

We also added additional oversight in the already very strong oversight structure in the bill to monitor the government's receipt and use of cyber threat information voluntarily provided by the private sector. We added roles for the Privacy and Civil Liberties Board and the individual agency privacy officers to provide additional oversight of the government's use of information received from the private sector under this bill.

I'm also very proud to cosponsor an amendment today with Mr. McCaul and Mr. Thompson of Mississippi, Mr. Ruppersberger and myself that would put a civilian face on the privacy sector cyber information sharing with this government. It was a concern by many. It was something we had long debates and conversations on, and I think we came to an agreement that will at least end that debate. It puts the appropriate civilian face so that, again, people can have confidence in the intention of this bill and what it will do to protect cybersecurity on networks or allow the private sector to protect their own networks and protect civil liberties of Americans.

Other elements of the government, such as the intelligence community, will still receive the information they need to play their important roles, but only after it has been minimized and screened by a civilian entity like the DHS or, in some rare cases, the FBI.

This bill already contains several levels of strong protections to ensure that it improves cybersecurity without compromising our important civil liberties, but this bill will add a significant new privacy protection to that existing structure.

Again, Madam Chair, you can see the level of effort that we are doing here to protect privacy and civil liberties and still have a workable bill that stops nation-states like China, Russia, Iran, and North Korea from getting into your networks and stealing your property.

We have yet to find a single U.S. company that opposes this bill. In fact, we have the enthusiastic support of nearly every sector of the economy, because they are under assault from foreign cyber attacks and they need our help. They need it now. Companies and industry groups from across the country, including Intel, the chip maker, IBM, the Internet Security Alliance, the U.S. Chamber of Commerce, the Business Roundtable, TechAmerica, TechNet, companies of Silicon Valley, the Financial Services Roundtable, U.S. Telecom, the Nuclear Energy Institute, and the National Association of Manufacturers, just to name a few, have sent the committee letters of support. And that list is growing by the day of people who are encouraged by the very light touch of the government; no new programs, no new authorizations, it's not a surveillance bill. This is the only appropriate way to try to deal with this problem.

By allowing the private sector to expand its own cyber defense efforts and to employ classified information to protect systems and networks, this bill will harness private-sector drive and innovation while also keeping the government out of the business of monitoring and guarding private-sector networks.

This important legislation would enable cyber threat sharing and provide clear authority for the private sector to defend its own networks while providing strong protections for privacy and civil liberties.

Madam Chair, with this great collaborative effort, with the effort facing this country, when you see this many Republicans and Democrats coming together, recognizing the threat and crafting a bill that meets that very important standard, this is the bill we should all stand up and enthusiastically support, and I reserve the balance of my time.

Madam Chair, I yield 3 minutes to a current military officer and great member of the Intelligence Committee, the gentleman from Nevada (Mr. Heck).

Madam Chair, I am proud to yield 3 minutes to a leader on the Homeland Security

Committee and the chair of the House Admin Committee, the gentlelady from Michigan (Mrs. Miller).

Madam Chair, I yield 2 minutes to a former military officer, the distinguished gentleman from Kansas (Mr. Pompeo).

I yield an additional 60 seconds to the gentleman.

I don't have any further speakers, and so I will continue to reserve the balance of my time to close.

Madam Chair, I yield myself 30 seconds.

I just want to make very, very clear--and I thank the gentlelady for working with us, she is a great member of the committee--nowhere in this bill does it allow the military to collect information on private citizens in the United States. This is not a surveillance bill. It does not allow it to happen. That needs to be very, very clear in this debate. It does not allow the military to surveil private networks in the United States. Period. End of story. That's the biggest part of our privacy protections. Again, I want to thank the gentlelady for working with us, but that's just an inaccurate statement, and I want to make that clear for the Record.

I reserve the balance of my time.

I continue to reserve the balance of my time.

Madam Chair, I yield myself the remaining time.

I just want to quickly, Madam Chair, address some of the moving targets on the bill. When we move to change something in the bill, the 19 privacy amendments, people who still decide they don't like it for, again, whatever reason, move their challenges of why they don't like it.

The newest, I think, straw man is that this somehow would violate contract law. Nothing in this bill allows you to avoid contract law. Nothing.

It's a red herring. It is not accurate. Nothing in this bill would allow this to happen. The fact that someone who was in the technical business would say this hurts job growth, that's interesting. The sheer number of companies who support this, from the Business Roundtable to the Financial Services Business Group to TechNet, who has companies like Intel Corporation, Symantec, Juniper, Oracle, EMC, social media, all stand up and say this is the right approach. It will allow us to protect our consumers of our product from foreign governments stealing their private information.

We need to understand what this bill is and what it is not. It is not a surveillance bill. Nothing in here authorizes surveillance. We're going to have an amendment to clarify that, to say it in the law so people can regain that confidence.

We argue, Read the bill. It's 27 pages. It is very clear. It is predominantly protections of your civil liberties, and it also allows companies to voluntarily share malicious source code--and that's source code that's committing a crime against their consumers and their company--with the Federal Government so they can go back overseas and find the Chinese or the Iranians or the Russians or the North Koreans who are perpetrating that crime. This bill is nothing more. It does do that.

Thanks to the ranking member and all who have gotten to this point. I look forward, Madam Chair, to the debate on the amendments, and I yield back the balance of my time.

Madam Chair, I have an amendment at the desk.

I offer this amendment to ensure that library records, firearm sales records, medical records, and tax returns are not included in any information voluntarily shared with the government under CISPA. Though the underlying bill would not permit this information unless it was cyber threat information, I will support this amendment, as it is a clarification amendment that settles some Members' concerns and reflects an amendment that was passed last year overwhelmingly.

With that, Madam Chair, I urge this body's support of this clarification amendment, and I reserve the balance of my time.

I yield back the balance of my time.

Madam Chair, I demand a recorded vote.

Madam Chair, while I do not oppose the amendment, I ask unanimous consent to claim the time in opposition.

Madam Chair, I do not oppose this amendment, which clarifies that classified intelligence shared by the government with a certified cybersecurity entity may only be used, retained, or further disclosed for cybersecurity purposes. The amendment is consistent with language that is already in the bill requiring the DNI, the Director of National Intelligence, to ensure that such classified information is carefully protected.

I appreciate the gentleman's working with us and the ACLU to find an amendment that we could all agree on. I do not oppose this further clarification and would urge support by this body of the amendment.

I reserve the balance of my time.

Madam Chair, I yield myself such time as I may consume to clarify that this doesn't call for investigations of those crimes based on this material, but only protection of the individuals that may--and I want to stress ``may,'' because, again, the PII, the personal identifying information, is stripped clean. But in some rare, rare cases, you might find that you have located the child who has been subjugated to child pornography. In those cases, you don't want to throw that away. There are parents out there begging for us to find this child. It's very rare, it's exceptional, doesn't happen often, but in that very rare case--and, remember, there's no personally identifiable information. It would allow for the protection, not investigation.

I reserve the balance of my time.

Madam Chair, I yield back the balance of my time.

Madam Chairman, while I do not oppose the amendment, I ask unanimous consent to control the time in opposition.

Madam Chairman, I will support the clarification in this amendment.

The amendment clarifies that independent contractors are eligible to receive security clearances to handle cyber threat intelligence and cyber threat information shared under the bill, an important clarification amendment.

I appreciate the gentleman's work and effort in offering this amendment; And because the bill was not intended to exclude independent contractors, I will support this important clarification and would reserve the balance of my time.

I yield myself such time as I may consume.

I just want to address my friend from California, who is a thoughtful member of the intelligence community.

This is a position that much has been debated about: Should the government regulate into the private sector their use of the Internet? I argue that is a dangerous place to go. They will have to promulgate rules; they will have to set what reasonable standards are; they will have to determine what the private sector does on the Internet. That's government in the Internet. One of the things that we decided to avoid in this bill was not to make that mandate, the burden to make sure that no PII, personal identifying information, is mandated in this bill; and it's stripped out at the place where the burden should be: on the government. To make sure it happens, we have four different layers of oversight built in just to make sure what we say that they're supposed to do according to the law, they follow the law--four levels of review.

We shouldn't put the burden on the victims. We don't do it if somebody sticks a gun in your face on the street or robs the bank or robs your home. What's the difference if they're robbing your Internet or stealing your blueprints that steals American jobs? The difference? There is none. Theft is theft.

Let us not move to get the government into regulating. Aspects of the Internet between private to private has been the explosion of growth in one-sixth of our economy. Keep the government out of it.

That's what we decided to do. We came to a very sensible place that protects that PII, that personal identifying information, and allows the government to stay out of regulating the Internet.

I think that's the right prudent course. I think most Americans are with us. Certainly the broad specter of industries who have joined this, from the high-tech industry to the financial services to manufacturing, have said, This is the right way to go. You stay out of our business. We'll share with you when we're victims of a crime.

With that, I reserve the balance of my time.

Madam Chair, while I do not oppose the amendment, I ask unanimous consent to control the time in opposition.

Madam Chair, I yield myself such time as I may consume.

I want to thank the gentleman from Rhode Island (Mr. Langevin), who has been a tremendous leader on cybersecurity efforts on the Intelligence Committee. Much of our work there is classified and it goes unnoticed, and rightly so. I think it would be wrong for us not to commend in public your great leadership and efforts and work with us to try to make sure that this bill does what we say we want it to do. It has been a great privilege and pleasure to work with you throughout that process, and without that leadership, we wouldn't be standing on the floor today. I want to thank the gentleman for that.

I will support the amendment, which clarifies that entities located across multiple localities are intended to be covered by provisions in the bill exempting information shared under the bill from certain disclosures otherwise required of public or quasi-public entities. The amendment replaces the term ``local'' with ``political subdivision.'' Because there is no intention to exclude such entities, this is intended as a clarification, an important clarification, and I will gladly support the amendment, and again thank the gentleman for his work on the totality of both national security issues and cybersecurity.

I reserve the balance of my time.

Madam Chair, I move that the Committee do now rise.

Madam Chair, I yield to the gentleman from Illinois (Mr. Gutierrez) for the purpose of making a unanimous consent request.

(Mr. GUTIERREZ asked and was given permission to revise and extend his remarks.)

Madam Chair, I yield myself such time as I may consume.

Chairman Rogers and I are here today to discuss the Cyber Intelligence Sharing and Protection Act, known as CISPA. The bill simply allows the government to give cyber threat intelligence to the private sector to protect its networks from cyber attacks.

I don't want to repeat a lot of what the chairman has said, but the first

thing I want to do is to acknowledge the leadership of the chairman. Three years ago, the chairman and I, when we took over the leadership of the House Select Intelligence Committee, realized how serious the threat of cyber attacks were to our country, to our businesses, to our health, safety, and welfare.

We decided to pull together a group of representatives from different parts of this issue--we had the administration involved, we had the privacy groups involved, including the ACLU, we brought in the industry--because we knew that we had to put together a bill that would pass the House, the Senate and be signed by the President.

So, what we attempted to do was get input, and then we put together a bill. And, by the way, the bill is only 27 pages--it's probably a record in this Congress--and we did read the bill.

Now, what we attempted to do in this bill is to address a situation where now, the government cannot really communicate with the private sector to try to help protect our citizens, our businesses from cyber attacks. The reason for that is in 1947, there is a law that says that the intelligence community cannot communicate or pass information to another entity that does not have clearances. So, basically what our bill does is to allow the sharing of information, which we can't do now, to the private sector.

Now, why is this important? This is something that is very important because most people don't understand this. In the United States of America we have 10 companies, called the providers, that control 80 percent of our network--80 percent of our network. So in order for us to protect the United States of America from cyber attacks, we need to make sure that the government has a partnership with the private sector and that they can pass the threat information so that the government can help protect.

As an example, if your house is being robbed, you call 911 and the police department comes. That's the same scenario that we're looking at here, only it's a lot more sophisticated. Again, as the chairman said, passing information, mostly zeroes and ones, to the government so that we can work together to protect our network.

Now, why is this so important? And I think it's important that we get into some of the issues of threats. Just recently, we understand, and we know, that The Washington Post, The New York Times, The Wall Street Journal, were cyber-attacked. And basically, our understanding is that they did this, especially China, to intimidate the paper sources within China. We had our U.S. banks. It is very serious for U.S. banks to be attacked and hacked. Most of what our banks have are records and information. And to be able to shut down a bank or to be able to manipulate or get privacy information could be very destructive to our banks, and yet this is being done, and it's been done for a period of time.

Media reports have said that Iran, a rogue country that we know exports terrorism--we know what Iran's beliefs are, and yet reports have said that Iran attacked Saudi Arabia's oil company, one of the largest in the world, Aramco, and wiped out 30,000 computers in a weekend. And let me say this: Iran is not a very sophisticated company as it comes to cyber, but they have the sophistication to be able to knock out 30,000 computers and really shut their businesses down for a period of time. This is what's happening in the United States.

Cyber Command, whose job it is to protect our military networks, estimated that in the last couple of years that we have had, the United States of America has had $400 billion--not million, billion--worth of American trade secrets being stolen from U.S. companies every year, costing these companies market share and jobs. That's probably the biggest theft in the history of the world, and yet we still are not able to help government working with business.

You have Secretary Napolitano, the Director of the FBI, you have the Director of the NSA, Alexander, and all three have said one of the biggest fears they have now are these attacks, and that unless we have a sharing opportunity between government and between business, they feel that they cannot protect our country from these cyber attacks the way that they should. It's so important that we need to act now on this bill.

Now, we can pass bills in the House all day long, but if the Senate doesn't pass a bill and the President doesn't sign it, where are we? We were able to pass our bill last year in a bipartisan manner, and yet our bill went to the Senate and it stalled and the bill didn't go anywhere, so Chairman Rogers and I started again.

But, what we said to each other and we discussed was that we need to address the issue of privacy. Even though we felt strongly that our bill does protect privacy, we knew there were groups out there, especially the privacy groups, that felt that there was not enough protection in our bill. So we rolled up our sleeves, we listened to the issues raised by the privacy groups, the administration had issues with respect to privacy, and we changed the bill.

Now, I don't want to repeat what the chairman said, but basically we made some significant changes to our bill to deal with the issue of privacy. We provided that first, there's a privacy and civil liberties oversight board, and now that board must review our program. That's one area of oversight.

In the intelligence community, we have privacy officers in each department, in each area. And these privacy people have to look at the threat information. They must also conduct a classified and unclassified review. That's the second oversight that was changed in the bill.

An annual report must be sent to Congress. We also have what we call the ``inspector general,'' whose job it is to oversee the different agencies they represent. Those are four areas of oversight just in the bill.

Regarding the privacy agreements that we were concerned about, we only have five elements where this bill applies. That means if you're a tax cheat and we pick up some information, that can't be used against you. The privacy agreements were concerned about the issue of national security being one of those elements in this bill. They thought it was too broad. So Chairman Rogers and I got together, and we were able to get the votes from both sides of the aisle, and we were able to take a position that the national security issue is not in the bill anymore. We feel national security is being covered by one of the elements in the bill that says it deals with the issue of protecting people's lives or liberty. So we feel that we have covered national security.

One of the most important issues was the issue of minimization. What is minimization? Most people don't know what it is. Basically, minimization is if private information is passed, there needs to be an entity out there that will take that private information out so that it is not used.

We've now added to the bill that any of the zeroes and ones that are passed--and that's what's happening--if there was some reason why somebody's personal information is passed when those zeroes and ones are coming back and forth, now we have what we call 100 percent minimization, and the government will make sure that every single entity and all the information that is passed will be 100 percent minimized. If there is any personal information in there at all, it will be knocked out. That's very significant, and that gives a lot of coverage.

This is also important: you don't have security if you don't have privacy. That was one of the themes Chairman Rogers and I used in the beginning: if you don't have security, you don't have privacy. Even though we thought our first bill had it, we felt there was a certain perception, we heard what was said and we made these changes.

There is one other issue that is out there that's very important that I think is also extremely relevant. That's the issue of when the information is passed when we're attempting to protect our citizens and our businesses from these attacks and hopefully from a destructive attack like Iran did to Aramco in Saudi Arabia, there was a perception out there which, again, had to deal with perceptions. The perception was that if this information of zeroes and ones that are being passed back and forth, what is the point of entry. We did not want the perception to be that the military in any way would be in charge or would

be the entity that is overseeing this. We felt very strongly that it had to be civil.

So Chairman Rogers and I, along with Chairman McCaul of the Homeland Security Committee and Ranking Member Thompson, have an amendment here today which is very significant. I'm sure it will be very well received by the privacy groups in the White House. What the bill will now say is that when information is passed, it will be the Department of Homeland Security. That is very significant, and we would hope that that would truly deal with the majority of these privacy issues.

We know that we have to move and we have to move quickly. We're here today to debate this bill. And, again, Chairman Rogers--he's not listening, but I'll say it anyhow--has shown tremendous leadership. I say this and I say it sometimes in jest, that I was a former investigative prosecutor and he was a former FBI agent and all good FBI agents must listen to their prosecutors, even if we're in the minority. That was a joke. Not withstanding that, he has shown leadership. We threw partisanship out the window. We knew the stakes were high. We have been concerned that we have not been able to protect our country. I believe that Congress needs to act because we're standing in the way of protecting our country.

This reminds me of a situation. We know how serious Hurricane Sandy was. It's similar to if you are a meteorologist and Sandy is coming up the east coast and you can't warn your constituents that Sandy is coming. That's why we need to pass this bill tomorrow, and we need to do it for the benefit of our country.

And I do want to end with this: you do not have security if you don't have privacy. We feel that this bill, along with the amendments that will be introduced today, will effect that.

With that, I reserve the balance of my time.

Madam Chair, I now yield 2 minutes to a senior member of our committee who worked very hard on this bill, the gentleman from California (Mr. Thompson). He's been with us for the last 3 years attempting to pass a bill that will help our country and protect us.

I yield the gentleman an additional 30 seconds.

Madam Chairwoman, I yield 2 minutes to a great Member from the State of Illinois (Mr. Enyart).

Madam Chair, I yield 2 minutes to my good friend, the gentleman from Rhode Island (Mr. Langevin); and I do want to say that we've been working together for years on this issue of cybersecurity, and I consider him to be one of the experts and one of my closest friends working on this issue.

(Mr. LANGEVIN asked and was given permission to revise and extend his remarks.)

I yield 2 minutes to the gentlewoman from Illinois (Ms. Schakowsky), who is a senior member of our committee and has worked very hard on this issue.

I yield 30 seconds to the gentlewoman.

Madam Chair, how much time do I have remaining?

Madam Chair, I yield 2 minutes to the gentlewoman from Texas (Ms. Jackson Lee), a very active member of our caucus.

Madam Chair, I yield 2 minutes to the gentleman from Colorado (Mr. Polis), a member of the Rules Committee.

I yield 2 minutes to the gentlewoman from Alabama (Ms. Sewell). Is it ``Roll Tide''? She is an outstanding new member of the Intelligence Committee. She's smart. She works hard. She's very dynamic, and she is our closer today.

Madam Chair, I yield myself as much time as I may consume.

First thing, we've heard testimony today about how serious the cyber attacks are to our country. We know what has occurred already. We know that our banks have been attacked, our major banks. We know that our newspapers, New York Times, Washington Post, have been attacked.

We know that news reports have said that Iran attacked Aramco, Saudi Arabia's largest oil company. They took out 30,000 computers, which means we are subjected to those attacks also.

We also know that Cyber Command has said that we, in the United States,

have lost, from the attacks on our businesses, approximately $200 billion. Just think what that equates to in jobs, stealing information about trade secrets, about competing globally with a country like China where they have all of our information, where they're able to shut down banks.

This is a very serious issue, and we need to do a better job to educate the public on how serious it is. And we just hope that we can pass this bill today in the House, a bill in the Senate, and the President signs the bill, so that we can protect our citizens, we can protect our businesses from these attacks.

If we knew that Iran was sending over an airplane with a bomb we would take it out. And yet we have to make sure that we deal with the issue in the United States of America to protect ourselves.

Now, there was a major issue raised, and that issue was privacy. And believe me, I want to say this over and over again. You don't have security if you don't have privacy. And we feel very strongly that this bill provides privacy.

But we also know, Chairman Rogers and I know, that if we pass a bill here, we need to pass a bill in the Senate, and we need the President to sign it. So we got together, and even though we passed our bill in a bipartisan effort last year and it stalled in the Senate, we now have made the bill what we feel is a lot stronger as it deals with the perception of privacy.

And we've added oversight. We have four categories of oversight, privacy. We've made sure that minimization--taking out any privacy information that might pass--we made sure that that is 100 percent minimization so that no one's private information will pass.

But the most important thing is that we have to make sure that we pass a bill because of the fact that 80 percent of our network is controlled by 10 companies in the United States of America. And all of our experts in this area have said that if government and business can't share information about these attacks, zeros and ones, if they can't share information, they cannot protect our country from these ongoing attacks that are occurring as we speak right now.

So let's act. Let's not wait until we have another catastrophic attack like 9/11. Let's deal with this now. Let's pass the bill and make sure that we protect, again, our citizens. And I want to say it one more time. The issue that you can't have security if you don't have privacy.

I do want to also say, I want to thank all those individuals in our government, in the private sector. The privacy groups have all come together. This has been a good debate. It's been a debate about issues that the public needed to know.

And I also want to thank the chairman for his leadership, and the fact that he was willing, even though we had our bill passed a year ago, he was willing to deal with the issue of perception and to make sure we made privacy an element that we could deal with, and that we could change our bill to deal with certain perceptions. I feel that we've done that.

I also want to thank Chairman McCaul from Homeland Security and Ranking Member Bennie Thompson from Homeland Security, who've worked with us to get an amendment that was very important, as you heard from Jan Schakowsky.

That amendment basically says that the point of entry for any communication is on the civil side of our government, Homeland Security, and we hope to pass that amendment.

And I feel very strongly that if we do that, we will have addressed the majority of the issues that are so important to this bill and to our security and to our privacy.

I yield back the balance of my time.

Madam Chair, I rise to claim the time in opposition, even though I am not opposed.

I support Chairman Rogers' amendment to make a technical change to correct our personal records provision and retain the privacy protections that we had in our bill upon the introduction.

I yield back the balance of my time.

I thank the gentleman for yielding.

This amendment increases the privacy and civil liberties protections in our bill; therefore, I urge a ``yes'' on Congressman Connolly's amendment.

Madam Chair, our bill now enables companies and the government to have the option to hire independent contractors to handle cyber threat information. It helps bring talented people into our cybersecurity workforce; it provides jobs; it is good for our economy; and it is good for our national security. Therefore, I urge a ``yes'' vote on this amendment.

I also want to acknowledge Congressman Schneider for his involvement in this issue.

I thank the gentleman for yielding.

Madam Chair, first, I want to agree with our chairman, and I said it before, that you have been one of the key players in developing legislation to protect our country. From the beginning, when those of us started working on this issue, probably 2006, you were there. You have a tremendous amount of expertise. You have been a great adviser to all of us, and also not only the Intelligence Committee, but the Armed Services Committee, and I appreciate all your work.

I also support your amendment to include political subdivisions within the information, use, and protection requirements in our bill. Your amendment ensures that utility districts are not unnecessarily and unintentionally limited from protecting their own information.

Therefore, I urge a ``yes'' vote on your amendment.

Mr. Speaker, by direction of the Committee on Rules, I call up House Resolution 164 and ask for its immediate consideration.

Mr. Speaker, for the purpose of debate only, I yield the customary 30 minutes to my friend, the gentleman from Florida (Mr. Hastings), pending which I yield myself such time as I may consume. During consideration of this resolution, all time yielded is for the purpose of debate only.

General Leave

I ask unanimous consent that all Members may have 5 legislative days to revise and extend their remarks.

Mr. Speaker, I always enjoy the reading of the resolution. There are a lot of readings that you can waive on the floor of this House, but not so with a Rules resolution because this resolution is framing the nature of the debate we are going to have perhaps on the most important issue that we've taken up so far in this Congress.

The underlying bill is H.R. 624. It's the Cyber Intelligence Sharing and Protection Act.

Whenever we start talking about cyber intelligence sharing and protection, folks often think that sharing and protection are oxymorons--you can't have protected sharing, and you can't have shared protection. It's not an easy nut to crack, Mr. Speaker. I don't sit on the Intelligence Committee, but I've been down to the classified briefings where folks are sharing details of the amazing successes that our teams, both domestically and abroad, are having and combating in cyber threats; but it's getting harder and harder every day, and we have to balance the national security implications of failing to address these threats with what we, as all Americans, love, which is our liberty here at home--our liberty here at home, our privacy here at home.

In order to try to crack that, Mr. Speaker, you'll know that we brought this bill to the floor in the last Congress, and it has been changed and improved since that time. Today, this rule makes in order an additional 12 amendments. Now, of course we'll have the traditional 1 hour of debate on the underlying bill, but there will be another 12 amendments, each debated--2 hours of total additional time--so that Members can have their voices heard. Of these additional 12 amendments, four of them were offered by Republican Members; seven of them were offered by Democratic Members; and one of them is a bipartisan amendment. But the rule is designed to allow that further discussion because of the very important nature of the underlying bill.

I rise, of course, in support of the rule to allow for that debate, and I rise in support for the underlying bill. In today's world, you don't have to have a battlefield full of tanks to wage war on your enemy. A nation-state can have a roomful of young computer scientists and a couple of computers and begin to be a threat to the largest, most democratically controlled country in the world.

How do we stop that, Mr. Speaker? Because we don't want to close our borders. We don't want to have Federal control over the Internet. In so many of these nation-states, the government does control the Internet. That's never going to happen here in America. That's not who we are. That's not what we're about. In fact, 10 private sector providers control about 80 percent of the networks here in America--as it should be.

But what can we do to make ourselves safer tomorrow than we are today? Here is what the underlying bill does, Mr. Speaker: it enables, for the very first time, businesses and governments to share information about the threats that they are facing.

If you go up the road to Maryland, where the NSA is operating today, there are some smart, smart folks there, and I'm glad we have every single one of them on the front lines of cyber warfare--protecting America, protecting American enterprise. Yet today, when they are aware of threats that are impending threats to our financial system, threats to our economic system, they can't share that information with the private sector.

Back in my home district, Mr. Speaker, we're home to UPS--the United Parcel Service--Delta, Home Depot. If those companies come under attack today, Delta can't share that information with American Airlines and say, Look at what has just happened to us. Be on the lookout. It might happen to you. Home Depot can't share with Lowe's today, This is what has happened to us. We want you to be on the lookout. Don't let it happen to you.

This bill changes that. This bill, for the first time, says in the name of defending America and American interests against cyber threats around the globe, you can begin to share with one another what your experiences are and opportunities to protect yourself from having that happen to you again in the future.

Now, the real important thing to me about this bill, and I will just hold it up for you, Mr. Speaker, the Cyber Intelligence Sharing and Protection aspect of this bill, it's the important part. It's the meat of this bill. It's what's going to allow us to be safer tomorrow than we are today, but the bulk of the words in this bill don't speak to the sharing in terms of enabling it. It speaks to the sharing in terms of restricting it. Page after page after page after page of this short, 24-page bill talks about how we as citizens must, must, must continue to be safe and secure in the privacy of our own information.

It's a four-step process the bill lays out, Mr. Speaker, in terms of how we can ensure that no personally identifiable information is being shared from Home Depot or Delta or UPS or any of the other folks who are out there on the Internet when they're sharing that with the government or with one another in order to prevent threats to American security or economic prosperity, to ensure that personally identifiable information is not a part of that information that's shared, because privacy is paramount.

I've been tremendously impressed through this process, Mr. Speaker, because I'm one of the folks who is most likely to be suspect when we start talking about sharing information with the government. I'm a big lover of liberty. There's not many things I'm willing to give liberty up for. In fact, I dare say there's not a one that I'm willing to give liberty up for.

But the Intelligence Committee, from which this bill came, has worked with Members month after month after month after month to ensure that privacy is protected, that we as citizens can be secure. At the same time that we're fighting threats that perhaps we're not allowed to talk about on this floor, we're protected from threats that each and every one of us experiences in our day-to-day lives--a threat to privacy.

It's not been easy to craft this bill, and it has been an incredible bipartisan effort throughout, Mr. Speaker, in order to put this language together. Again, we have four Republican amendments made in order by this rule, seven Democratic amendments made in order by this rule, and one bipartisan amendment made in order by this rule. It is my great hope that we can move forward today with this rule, with debate on the underlying bill, and move forward with something that is far, far, far overdue, Mr. Speaker, and that's protecting America--American business and American individuals, American citizens--from the threats posed by nation states through cyber warfare from abroad.

With that, I reserve the balance of my time.

Mr. Speaker, at this time it's my great pleasure to yield 3 minutes to the gentleman from Texas (Mr. Conaway), one of those Members on the Intelligence Committee my friend from Florida spoke of, a gentleman who serves us all.

Mr. Speaker, I yield myself 1 minute to say I know my friend from Colorado's concerns are heartfelt, and he shared those last night in the Rules Committee. The gentleman has a great deal of experience in this industry. And as heartfelt as his concerns are, I know, too, equally heartfelt are his concerns to national security if we fail to come together and address this issue.

I would like to be able to say, Mr. Speaker, that when we pass this bill today, it's going directly to the President's desk for signature. I don't actually believe that to be true. I think it's a long process between now and getting it to the President's desk for signature. And I know the gentleman will be raising these concerns throughout that process.

But I just cannot emphasize enough, Mr. Speaker, the dangers to the liberties of the American people of failing to begin this process today. I'm very proud we're allowing 12 amendments today to work through the concerns that the gentleman has, among others. But the importance of beginning this process today cannot be overstated.

I reserve the balance of my time.

Mr. Speaker, I yield myself 60 seconds to say I agree with my friend, that the private sector is often in the best position to get the work done that we're talking about in this bill.

I would refer my colleague, Mr. Speaker, to the Intelligence Committee's Web site--it's intelligence.house.gov--where you can see the long list of those private sector actors who are supporting this bill here today, that long list of folks in the private sector responsible for the security of their firms, of the information that Americans have entrusted to them, asking this body to move forward with this bill today.

There's no question, Mr. Speaker, when you're dealing with something of the magnitude of the national security threats posed by cyber warfare and the privacy protections that everyone in this body is committed to, that you're going to end up with conscientious men and women on both sides of this issue. But it is important to note that the private sector--which is being bombarded each and every day with threats from nation-state actors overseas--is asking, pleading with this body to move forward with this bill.

I reserve the balance of my time.

Mr. Speaker, I reserve the balance of my time.

Mr. Speaker, I yield myself 60 seconds again to say to my friend from Colorado that I know his concerns are heartfelt; but he knows, as I do, there's nothing that we can do in statute here today that would trump any of our civil liberties that are protected under the Constitution of the United States of America. The Constitution of the United States of America trumps all.

What we're doing here today, Mr. Speaker, is responding to a very serious national security threat, and we're doing so in a way that can give Americans great comfort that their civil liberties are every bit as protected today as they were yesterday. In fact, Mr. Speaker, in that these nation-states are hacking into these accounts and accessing our personal information every single day, I would tell you that we will actually have our privacy more protected in the presence of a secure Internet than we do today, as nation-states are frequently eroding our cybersecurity border here in the United States of America.

With that, I reserve the balance of my time.

I thank my friend. I have one speaker remaining.

Mr. Speaker, at this time it is my great pleasure to yield as much time as he may consume to the chairman of the Rules Committee, the gentleman from Texas (Mr. Sessions).

Mr. Speaker, I yield myself the balance of my time.

I thank my friend from Florida for his service on the Rules Committee and his service on the Intelligence Committee.

The work that goes on in the Intelligence Committee, Mr. Speaker, is work that so many Members of Congress do not involve themselves in. It goes on deep in the bowels of the Capitol Complex. It's under great security, all electronic devices left outside the door, so that they can discuss things within the four walls of that committee that we're not allowed to discuss here on the House floor.

In fact, when they asked me to handle the rule today, Mr. Speaker, I was a little concerned because throughout this process of developing CISPA, I traveled down to that committee room time and time again in order to understand the threats that this Nation is facing, understand the challenges that this community of intelligence professionals is grappling with around the globe, and I don't want to be the one who shares those stories here on the House floor by mistake. I don't envy the gentleman from Florida having to balance being in that committee every single day, trying to protect the security of every single citizen, and not being able to come out of that committee room and share with, not just your colleagues here in the House, but your constituents back home, why it is you're doing the things that you do.

Can you imagine, Mr. Speaker, what would have happened in World War II if we had to keep the bombing of Pearl Harbor a secret? It's a secret. Nobody knows. What do you think the support would have been, Mr. Speaker, for taking affirmative action in World War II? It would have been hard to generate that support. I would have voted ``no.''

There are things going on in this Nation and in this world today, Mr. Speaker, that our Intelligence Committee grapples with, that our intelligence professionals grapple with, things that are frightening, and things that threaten the liberty of this country and the economic security of this country. Now, I don't want to be a fear-monger, Mr. Speaker. What I love about this country is no matter what the challenge is, we are great enough collectively to rise to meet it.

In this case, we happen to need to rise to meet it in a subject matter that is near and dear to the heart of every American, which is my Internet privacy. I care a lot about Internet privacy, Mr. Speaker. I've got a VPN system set up so nobody is listening in on my Wi-Fi. I change my password about every 10 days to make sure nobody is making any progress towards hacking my system. I'll occasionally go on the Internet and use one of those anonymizers to make sure my IP address isn't being tracked when I'm looking at things that perhaps my friends in Congress, I'm trying to get a bill done, I don't want you to know I'm getting that bill done. Who knows what those people down in HIR, House Information Resources, what they're tracking that we do here? We have tools available to us in that way, Mr. Speaker.

But do you know who I can't outsmart? Perhaps I can outsmart my next- door neighbor who wants to piggyback on my Wi-Fi system. Perhaps I can outsmart the guy at the hotel who is trying to piggyback on my information there in the hotel room. Perhaps I can even outsmart the U.S. House of Representatives. But what I can't outsmart is that team of cyber warriors gathered by nation-states around the globe who are hacking my information and your information every single day, stealing our intellectual property, stealing our military technology, threatening the privacies that we've

talked so much about here on the floor today.

I'm very glad, Mr. Speaker, that as you page through this bill, you will find line after line after line aimed at protecting your and my privacy. I think we do a good job of finding that balance. We even will offer amendments today on the floor to do even better. But without security at the Internet border, I have no protection of my privacy because those agents of the state of China, North Korea, and beyond are accessing that information today.

Mr. Speaker, it's been 18 months that we've been working to craft that balance of privacy and security. We'll continue to work on that throughout 12 amendments here today. I urge my colleagues, look through this resolution, look through H.R. 624 to see the efforts that have gone into crafting this bipartisan piece of legislation; and look at those 12 amendments, look at those 12 amendments that we'll have an opportunity to vote on over the next 2 days to make this bill even better. But the time for delay, Mr. Speaker, has passed us, and the cost of delay is most certainly measured in dollars, and I fear it is measured in lives.

Let's move forward with this bill today, Mr. Speaker. I urge strong support for the rule, and I urge strong support after the debate of these 12 amendments on the underlying legislation.

Amendment Offered by Mr. Woodall

Mr. Speaker, at this time, I offer an amendment to the resolution.

Mr. Speaker, I yield back the balance of my time, and I move the previous question on the amendment and on the resolution.

The previous question was ordered.

Mr. Speaker, where to begin?

Let's start with process. This, as has been indicated by everyone who spoke thus far, is a critical issue for our country, getting the balance right between protecting American infrastructure and our way of life, with our civil liberties and confidence in the Internet ecosystem. And yet, this rule only allows 1 hour of debate in the House of Representatives on this bill.

I might add, the amendments that were talked about in the Rules Committee last night, the amendments that actually address some of the deficiencies which I'll be getting into about this bill, are not allowed under this rule. In fact, out of the 12 amendments allowed, two of them are actually the same. The same exact amendment allowed twice. And yet a number of other amendments are not even allowed to be debated or voted on here on the floor of the House.

I hold in my hands many, many amendments that were brought forward by Members of both parties and under this rule were prevented from being debated upon here on the floor of the House, which is why I strongly encourage my colleagues to vote ``no'' on the rule and ``no'' on the underlying bill in its present form.

There's no disagreement that cybersecurity is a very real and important issue. Threats come from criminal enterprises, they come from nation states, they come from corporations, they come from 16-year- olds. There's a variety of threats to both the public and private sector both here and abroad. The question is, What's the solution?

One of the first fallacies with the premise of this bill at the 20,000-foot level is, Who helps who? Frankly, it is the government that needs to learn and the private sector that leads the way. I've talked to a number of technology executives, having been a technology executive before I got here, and they are frequently ahead of the government. Because everyday they're fighting hacking attempts and they're on the front lines of cybersecurity.

Now it's not a doubt whether they want free help. Who wouldn't want free help? Should we in fact as taxpayers subsidize the defense of those who have not invested in their own cybersecurity? Should this be a bailout of companies with poor cybersecurity? But the truth of the matter is most of the learning that needs to occur is from the private sector to the government. And, in fact, we're taking some of those steps. The government and the NSA are using private contractors who are in the forefront of this issue every day, and that's more of the direction we need to go.

The notion that somehow the government would be of assistance to companies is laughable to many of the technology executives that I talk to; nor would they expect to call the government for help when they themselves are so far ahead. But to the extent we want to get the government involved with information and with the private sector here, we need to be very careful how this information is used, not just from a civil liberties perspective, which we'll be talking about, but because this is an economic issue; it's a confidence issue.

The Internet has been a tremendous engine of innovation and economic growth. And we should be concerned for the Internet ecosystem, concerned for the millions of jobs, concerned for the great value that's been created, the benefits to consumers across the country, the way it's touched our lives in so many ways.

What's fundamentally flawed in this approach is it trumps privacy agreements in terms of use that Internet companies enter with their users. So you could sign up for a service on the Internet, it could say explicitly we will not share this information with the government unless required by law, in terms of use--and frequently there are

statements analogous to that in there--and the minute you click send and complete it, if this bill were law, the company you gave that information to could then turn around, in violation of their own terms of use, and provide all that information to the government.

The limitations on what the government would do with that information are completely inadequate. There is a section of the bill on pages 10 and 11 that deals with those limitations. First, it says that information can be used for cybersecurity purposes. Okay, that's the purpose of the bill: investigation and prosecution of cybersecurity crimes. That's okay. Then it goes far afield into pretty much everything. It talks about bodily harm, danger of death. When we look at bodily harm and bodily injury, that includes things under USC section 18, 365: cuts, abrasions, bruises, disfigurement, including mental pain.

So this is anything the government wants to use the information for. Paper that can cause paper cuts. The government can collect who's buying paper, who's buying scissors, who's playing football, who's organizing gun shows, who's a Tea Party enthusiast.

And there are absolutely no protections with regard to what is done with that information.

There are a number of improvements that could make this bill viable, and these are not allowed under this rule. My colleague, Mr. Schiff, has put forward an amendment that would have simply required that reasonable precautions were taken to ensure privacy was protected. That would be a strong step forward. Real limitations about actually tying the use of this information to cybersecurity would be an important step forward with the bill.

What's at danger is, yes, civil liberties; but the danger is the confidence in the Internet ecosystem that has driven our economic growth over the last decade. There will be great harm if that confidence is shaken, great harm if people know that the information that they provide and sign up for can immediately be turned over to a government agency--indeed, a secretive government agency--with no recourse and completely exempt from any liability for the company that's done it.

It's been noted that this program is voluntary. It may be voluntary for the corporations. It's not voluntary for the individual. It's not voluntary for the citizens of the country who provide that information.

Mr. Speaker, I have three documents to submit to the Record: one from former Representative Bob Barr, one Statement of Administration Policy, and a letter from several tech companies and others opposed to the bill.

I quote, in part:

Developments over the last year make CISPA's approach even

more questionable than before.

Former Representative Bob Barr:

Congress must take the civil liberties threats created by

this bill just as seriously as it takes the cyber threats the

legislation purports to address.

Mr. Speaker, we should not hurt the Internet to save the Internet; and this bill, in its current form, leaves the language wide open with potential abuse. Again, when we talk about bodily harm, I have learned that in a California statute that includes dog bites. Essentially, anything is included in this information without limitation with regard to how the government can use it. This is a backdoor attack on the Fourth Amendment against unreasonable search and seizures.

We have criminal procedures and processes around how information can and can't be used. This is the biggest government takeover of personal information that I've seen during my time here in Congress. Again, I believe, on the balance, it harms what it purports to protect.

``Just say no'' to cybersecurity bill

(By Former Rep. Bob Barr (R-Ga.), Apr. 16, 2013)

Anyone who has read or watched any news source over the

past year knows President Obama, numerous Administration

officials, and many leaders in Congress agree that addressing

the threat of cyber attacks is a critical national priority.

Based on this threat analysis, the administration and many

members of Congress continue to push for passage of

cybersecurity legislation that would clarify and expand the

government's powers to receive and process traffic from

American computer networks.

It would, however, be a mistake for Congress to rush to

enact legislation that could militarize our computer

networks, and pave the way for private companies to share

vast quantities of sensitive and highly personal information

with the government, all in the name of ``cybersecurity.''

Although a carefully-crafted ``information sharing'' program

that includes robust protections for civil liberties could be

an effective approach to cybersecurity, the bill about to

come up for a vote in the House clearly fails this test.

The Cyber Intelligence Sharing and Protection Act (CISPA),

H.R. 624, is set to be considered by the full House of

Representatives later this month. Although the bill that

emerged from markup by the House Permanent Select Committee

on Intelligence (HPSCI) includes some improvements in privacy

safeguards over the earlier version, CISPA's proponents have

overstated the protections incorporated into the bill. As a

result, members of Congress should vote against CISPA when it

comes to the House floor.

Last year, The Constitution Project's bipartisan Liberty

and Security Committee, on which I serve, prepared a detailed

report on ways that Congress could protect our nation's

computer networks from cyber threats, while at the same time

preserving the constitutionally-guaranteed rights of

Americans. Unfortunately, the drafters of CISPA failed to

incorporate the robust safeguards we recommended.

Most critical, CISPA's sponsors have resisted all efforts

to ensure that the new cybersecurity program would maintain

civilian control of our nation's computer networks. CISPA

would allow private companies, cloaked with broad immunity

from legal liability, to share sensitive information such as

internet records or the content of emails, with any agency in

the government, including military and intelligence agencies.

Sensitive personal information from private computer networks

should not be shared directly with the military or the

National Security Agency (NSA), the agency that gained

widespread public notoriety seven years ago for its

warrantless wiretapping program--hardly the agency we want to

see tasked with receiving private internet traffic.

Sadly, the members of HPSCI voted down an amendment that

would have ensured civilian control of computer networks, by

specifying that when private companies share information with

the federal government, they should not provide it to the NSA

or any other military agency or department. This amendment

would still have permitted the NSA to share its own expertise

on cyber threats with the private sector, but would have

protected the information flowing into the government.

A second critical flaw with CISPA is that it fails to

include meaningful limits on the extent of private sensitive

information that companies can send into the government. The

HPSCI also voted down an amendment requiring that before

sharing cyber threat information with the government,

companies must ``make reasonable efforts'' to remove ``any

information that can be used to identify a specific person

unrelated to the cyber threat.'' A similar provision was

included in last year's Senate cybersecurity bill, and

witnesses at a hearing before HPSCI earlier this year

testified that companies can easily strip out personally

identifiably information that is not necessary to address

cyber threats. Yet CISPA still lacks any such safeguard.

It is true that from a privacy perspective, this version of

CISPA is an improvement over last year's bill. Most notably,

the bill no longer permits private information to be used for

broad `national security uses'' unrelated to cybersecurity.

But it clearly is not sufficient. Congress must take the

civil liberties threats created by this bill just as

seriously as it takes the cyber threats the legislation

purports to address. CISPA does not meet this test, and

members of the House should just say no.

Mr. Speaker, I thank my friend from Georgia for yielding me the customary 30 minutes, and I yield myself such time as I may consume.

Before I begin, I would like to take a moment, as have almost all of our colleagues that have spoken here today, to offer my sincerest condolences to the people of Boston, Massachusetts, following the deadly explosions at

Monday's marathon. I can't speak for everyone here, but I believe that most of us would say that the thoughts and prayers of the United States Congress are with the victims, their families and friends at this most difficult time. Those responsible for this act of terror will be brought to justice.

Mr. Speaker, while I rise today in support of H.R. 624, the Cyber Intelligence Sharing and Protection Act, better known as CISPA, I do not support the rule. My friend from Georgia spoke about how important it is that we have the reading of the rule, and one of the particular efforts of Congress that allows for there not to be any abridgement of that, but I do believe that we would be better served if this were an open rule.

Last night, during our Rules Committee hearing, the majority blocked several germane Democratic amendments which would have further helped to balance cybersecurity concerns with smart policies that protect our citizens. I spoke to those issues last night, and I raise them again, particularly the two amendments offered by our colleagues, Ms. Schakowsky and Mr. Schiff, and others.

However, the underlying CISPA legislation is, as my friend from Georgia said, a bipartisan bill that aims to safeguard our Nation's computer networks and critical infrastructure by allowing for two-way cyber threat information sharing on an entirely voluntary basis, both between the private sector and the Federal Government, and within the private sector itself.

In his March 12, 2013, testimony before the Senate Intelligence Committee, the Director of National Intelligence, James Clapper, stated for the first time that cyber attacks and cyber espionage have supplanted terrorism as the top security threat facing the United States.

In recent months, media reports have highlighted cyber attacks on several major U.S. companies, including Facebook, Google, and the network security firm RSA, as well as The New York Times, Bloomberg News, and The Washington Post newspapers.

Furthermore, government networks such as those of the Central Intelligence Agency and the United States Senate have also been targeted by hackers. Waves of cyber attacks have sought to disrupt operations at financial institutions and service providers, including American Express, JPMorgan Chase, Citigroup, Wells Fargo, Bank of America, MasterCard, PayPal, and Visa.

The fact of the matter is that state actors, terrorist organizations, criminal groups, individuals, and countless persons that describe themselves as hackers attack our public and private computer networks thousands of times every day. Many foreign hackers seek to steal valuable trade secrets, which results in the loss of countless American jobs. There are estimates that have been quoted of loss from economic espionage that range as high as $400 billion a year.

Unfortunately, the same vulnerabilities used to steal trade secrets can be used to attack the critical infrastructure we depend on every day. Our economy, our power grids, and our defenses are increasingly reliant on computers and network integration. These networks power our homes, provide our clean water, protect our bank accounts, defend our intellectual property, guard our national security information, and manage other critical services. In addition to intellectual property and national security intelligence, personal finance, health care, and other private records are prime targets for hackers to steal.

According to the Information Technology Industry Council, 18 adults become victims to cyber crime--including identity theft and phishing campaigns--every second. This adds up to 1.5 million cyber crime victims each day.

Cyber attacks present a very real and dangerous threat to the United States. However, the government currently does not have the authority to share classified cyber intelligence information with the private sector.

While private companies have taken considerable measures to protect their networks, they often have limited information and can only respond to known threats.

Cyber threats evolve at the speed of technology, and CISPA, this measure, helps the private sector protect against cyber attacks by providing companies with the latest cyber threat information from the intelligence community, which has timely, classified information about destructive malware. This cyber threat intelligence is the information that companies and the government need to protect and defend their networks.

The so-called ``signatures'' are primarily made up of numerical codes consisting of zeros and ones, without any personal information attached.

CISPA is the product of close cooperation between the intelligence community, the private sector companies, and trade groups and, to a certain degree, the White House, as it pertains to many of the measures that are included in this legislation.

During their efforts to improve the bill, they also maintained a dialogue with privacy advocates in an effort to strengthen civil liberties protections and oversight.

I add a personal note here for the reason that, over a period of 10 years, I served 8 of those years on the Intelligence Committee, and the now-chairman of the Intelligence Committee and ranking member were both junior members of the committee that I served on. They have risen to the position that they are in and have acted in an extremely responsible way, over a 2-year period of time, trying to bring a measure as complicated as this one, contemplating all of the factors that I've identified and more, including the members of the committee.

I would urge Members of the House of Representatives--many of them continue to have concerns, not only about this particular legislation, but about other intelligence matters, and rightly so are they concerned. But let me remind them that they are Members of a body that allows, if they wish to go into the spaces of the Intelligence Committee and to be briefed by staff and Members there on classified information, upon appropriate undertakings, they too can gain the information and insight that's needed in order to make an intelligent determination when they are voting, rather than come out here and criticize the people that do that hard work. They get no benefits, no concerns from the Members, and yet, cannot say all of the things that are needed to say or be said to the American public.

The same holds for Adam Schiff and Jan Schakowsky and others that I won't mention that I served on that committee with. These are conscientious people who spend more time than almost any Member of Congress on any matter that he or she is attending to, and I have great respect for them. I don't agree with everything that either or all of them say, but I know they put their heart and time, both in the amendments that are offered, as well as in this bill and the particulars that are being put forward to this body.

As a result of their work, 19 improvements to enhance privacy and protect Americans have been adopted. Chief among them, this CISPA measure that requires the government to eliminate any personal information it receives that is not necessary to understand the cyber threat.

It creates no new authorities for any agency, and I can't say that enough. It creates no new authorities for any agency.

It gives companies the flexibility to choose which agency within the intelligence community they would like to work with to protect the cyber networks. It requires an annual review and report by the intelligence community's inspector general of the government's use of any information shared by the private sector.

And I would urge Members, when we increase the responsibilities of the inspector general that we also give the inspector general the resources in order to be able to do the necessary oversight that is required in this legislation.

It includes something that I very much support, and that is a 5-year sunset provision. I've supported other 5-year sunset provisions in the intelligence community and would have preferred, in this instance, that it be a 3-year provision. But the fact of the matter is, it's 5, and we will learn an awful lot during that period of time, and we will be back here dealing with

this same subject at some point in the future.

Allowing for the appropriate sharing of cyber threat information between the government and private sector is key to protecting our Nation from those who would do us harm. CISPA balances the critical need to strengthen our cyber defenses while protecting Americans' individual privacy.

I reserve the balance of my time.

Mr. Speaker, I'm privileged to yield 5 minutes to the distinguished gentleman from Colorado (Mr. Polis), my colleague on the Rules Committee.

I yield the gentleman 1 additional minute.

Mr. Speaker, I am very pleased at this time to yield 3 minutes to the gentleman from California (Mr. Schiff), my friend and a distinguished member of the Intelligence Committee.

Mr. Speaker, may I inquire about how much time remains on both sides?

With that, Mr. Speaker, in an effort to respond to my colleague and friend from Georgia, I yield 1 additional minute at this time to the gentleman from California (Mr. Schiff).

Mr. Speaker, again, for purposes of clarity, I yield 1 additional minute to my colleague from Colorado (Mr. Polis).

Mr. Speaker, I would advise my friend from Georgia that I'm the last speaker. If he is prepared to close, I am prepared to close.

Mr. Speaker, I yield myself such time as I may consume.

I thank the distinguished chairman of the Rules Committee, my good friend, Mr. Sessions, for his explanation of the measure going forward. I certainly do not anticipate that my side will oppose the measure as offered.

In addition thereto, I would highlight what he did eloquently point out, and that is the bipartisan effort that has been put into this, including all of the negotiations leading up to now what will be the McCaul amendment offered by Mr. Woodall.

CISPA, Mr. Speaker, provides the government and private sector with the tools they need to secure our networks and prevent future cyber attacks, while respecting the privacy of individuals.

In bringing private companies and trade groups to the table, as well as taking into consideration the concerns expressed by civil liberties organizations, CISPA has been improved to better address the growing cybersecurity risks faced by the Federal Government and private sector, provide greater oversight, and protect Americans' privacy. We can take significant steps to reduce our vulnerability to cyber threats today.

I have had the honor and privilege of meeting many of our intelligence professionals when I served as a member of the Intelligence Committee; and since that time, I cannot overstate how much I appreciate, and am humbled by, their service.

Furthermore, I want to take this moment of personal privilege to thank my good friends, Chairman Rogers and Ranking Member Ruppersberger, and to underscore one of the unnoticed and hardworking staffs' efforts, and that would be the House Intelligence Committee staff, for their hard work and dedication in helping to see this and other measures having to do with the intelligence of this committee to the House floor, as well as in cooperation with their colleagues and ours at the United States Senate.

I urge my colleagues to vote ``no'' on the rule and ``yes'' on the underlying bill, and I yield back the balance of my time.

Mr. Speaker, on that I demand the yeas and nays.