Lawmakers push for federal data breach notification law

U.S. lawmakers plan to resurrect national data breach notification legislation that has failed to pass in past sessions of Congress, but some advocates don’t agree on what should be included in a bill.

Six witnesses at a U.S. House of Representatives hearing Thursday called for a national law requiring businesses that lose data in hacker attacks to notify affected customers, but there were differences about whether the bill should preempt 48 existing state laws or should set a minimum standard that state laws can build on.

“Any federal law should not weaken strong state laws,” Representative Jan Schakowsky, an Illinois Democrat, said during a hearing of the Energy and Commerce Committee’s trade subcommittee. “Any federal response should establish a baseline so that every American can be assured some level of data protection, not just notification after the fact.”

Others disagreed, saying a new federal law that doesn’t preempt state laws would create a 49th data breach regulation for businesses to comply with. A national standard would be “particularly helpful to small business, many of whom cannot afford teams of lawyers to navigate 48 breach standards, should something bad actually happen,” said Kevin Richards, senior vice president for federal government affairs at trade group TechAmerica.

The debate over whether a national law should preempt state laws—along with debates over what types of information should be subject to breach notification rules and how long companies have before reporting the breaches—has held up a national breach notification bill in Congress for years, with early bills introduced in the middle of the last debate. But committee members said Thursday they will renew their push for a national law.
Some witnesses and lawmakers also called on Congress to pass comprehensive cybersecurity legislation focused on preventing data breaches along with breach notification. Others suggested that Congress needs a longer debate on comprehensive legislation, while a breach notification bill could be ironed out sooner.
Congress needs to act to prevent the huge number of data breaches happening every year, said Representative Joe Barton, a Texas Republican. In the 1930s, when there was a rash of kidnapping, Congress didn’t just pass a “kidnapping notification law,” but it gave the Federal Bureau of Investigation authority to track kidnappers, he said.

David Thaw, a law professor focused on cybersecurity at the University of Connecticut, agreed, saying comprehensive data security regulation, combined with data breach notification rules, would be more effective in protecting consumers and businesses.

“I analogize the effects of breach notification alone to locking the bank or vault door while leaving a back window wide open,” he said.

Richards called on the committee to move forward on data breach notification, saying there’s some consensus developing around that legislation, but more work to do on a comprehensive bill. 

Lawmakers: NSA phone records collection violated law

The U.S. National Security Agency and Department of Justice exceeded their legal authority to conduct surveillance when collecting the telephone records of millions of U.S. residents, several U.S. lawmakers said Wednesday.

Several members of the U.S. House of Representatives Judiciary Committee, both Republicans and Democrats, ripped into representatives of the DOJ and the U.S. intelligence community for their collection of U.S. phone call records, saying the bulk collection violates Patriot Act restrictions that limit surveillance to information relevant to an antiterrorism investigation.

Representative John Conyers Jr., a Michigan Democrat, called on the agencies to stop the data- collection program.
“We never, at any point in this debate, have approved the type of unchecked, sweeping surveillance of United States citizens employed by our government,” he said during a hearing on the NSA. “If the government cannot provide a clear, public explanation for how its program is consistent with the statute, it must stop collecting this information immediately.”

Other committee members said they will look for ways to amend the Patriot Act to stop the NSA’s collection of U.S. telephone records. Even without more immediate changes in the law, Congress isn’t likely to reauthorize the business-records collection provision in the Patriot Act when it expires in late 2015, unless the NSA scales back its surveillance, said Representative Jim Sensenbrenner, a Wisconsin Republican and author of the original Patriot Act.

“Unless you realize you’ve got a problem, that [provision] is not going to be renewed,” Sensenbrenner told NSA and DOJ officials. “There are not the votes in the House of Representatives ... and then you’re going to lose the business-record access provision of the Patriot Act entirely. It’s got to be changed, and you have to change how you operate .... otherwise in a year-and-a-half, you’re not going to have it anymore.”
The bulk collection of U.S. phone records has made “a mockery” of the Patriot Act’s relevancy limits, Sensenbrenner said.
Several lawmakers questioned how the NSA and DOJ could view all U.S. phone records as relevant to a terrorism investigation.
“The problem, obviously, from what we’re hearing is that everything in the world is relevant,” said Representative Jerrold Nadler, a New York Democrat. “You’re disregarding the statute entirely.”
The bulk collection of U.S. phone records is necessary for later searches, said James Cole, deputy attorney general at the DOJ. The phone records and a related Internet communications surveillance program have helped U.S. authorities in dozens of terrorism cases, officials said.

“If you’re looking for the needle in the haystack, you have to have the entire haystack to look through, but we’re not allowed to look through that haystack willy-nilly,” Cole said.

DOJ and NSA officials defended the phone records collection program, saying the bulk collection of phone records is allowed in the Patriot Act. The collection does not violate the U.S. Constitution’s Fourth Amendment, protecting U.S. residents against unreasonable searches and seizures, because, in 1979, the U.S. Supreme Court ruled that telephone records aren’t private information that require a court-ordered warrant, Cole said.

The Foreign Intelligence Surveillance Court and Congress both have significant oversight of the NSA surveillance programs, Cole said.

The phone records are protected because analysts never access the vast majority of them, said John Inglis, the NSA’s deputy director. In 2012, NSA analysts ran queries on fewer than 300 telephone numbers, officials have said, and analysts need to show to agency officials that those queries are relevant to a terrorism investigation before accessing the numbers, he said.
During the hearing, lawmakers raised few concerns about the PRISM program, in which the NSA collects the content of email and other Internet communications sent by people not believed to be U.S. citizens. Former NSA contractor Edward Snowden revealed both the phone records collection and the Prism program in news stories published in early June.
“Our primary responsibility at the National Security Agency ... is to defend the nation,” Inglis said. “These programs are a core part of those efforts. We use them to protect Americans and our allies and partners worldwide.”

While officials defended the surveillance court’s review of the collection requests, several lawmakers suggested the court is a rubber stamp. Since the court was established in 1979, U.S. agencies have made nearly 34,000 surveillance requests to the court, and 490 of those were amended at the court’s request, said Representative Hakeem Jeffries, a New York Democrat. In that time, the court rejected just 11 requests, he said.

Those statistics don’t capture significant negotiations in many cases between the court and the NSA and DOJ before the judges grant the orders, said Robert Litt, general counsel for the U.S. Office of the Director of National Intelligence.

Several lawmakers called on the agencies to release more information about the surveillance programs and better explain to the public why the programs are necessary.

“We try very hard to keep in mind both the protection of national security and the privacy and constitutional rights of Americans,” Litt said. “We think we’ve struck that balance in the right place, but if the people in the Congress determine we’ve struck that balance in the wrong place, that’s a discussion we need to have.” 

Texas Lawmaker's 11-Hour Filibuster Ended On A Technicality

Sen. Wendy Davis, D-Fort Worth, donning her pink tennis shoes during a Tuesday filibuster.

By midnight Texas time, it was all over but the parliamentary inquiries. After a nearly 11-hour filibuster attempt by state Sen. Wendy Davis to block sweeping restrictions on abortion, the Republican-dominated Texas Senate successfully shut down the filibuster on points of order. (See update at the bottom of this post.
)
"This is probably the worst night that I've experienced since I've been in the Senate, maybe since I've been in public life," said state Sen. Kirk Watson, a Democrat from Austin.

Davis stood and spoke continuously for nearly 11 hours in an attempt to block passage of SB 5, a bill that would ban all abortions after 20 weeks and could effectively close all but five abortion clinics in the state. Supporters, in a largely pro-life state of 26 million, say the new, stringent standards raise the level of care for Texas women.

The dramatic restrictions in the bill had already drawn national attention for their reach. But her riveting, one-woman attempt to stop it put Wendy Davis' name on the national map. A single mother at 19 who raised her children while putting herself through Harvard Law School, Davis has represented a Fort Worth swing district in the Texas Senate since 2008. To catch a glimpse of her, the line outside the Texas Senate gallery wound down three floors of the Texas Capitol for hours. President Barack Obama tweeted a link to the livestream, saying, "Something special is happening in Austin tonight." Fueled by a popular Twitter hashtag, #standwithwendy, more than 100,000 people were still watching a parliamentary debate over Roberts Rules of Order on the livestream at midnight.

Davis' chair was removed before she began speaking at 11:18 a.m. CT Tuesday. Donning pink tennis shoes, she started by saying, "I'm rising on the floor today to humbly give voice to thousands of Texans who have been ignored. These voices have been silenced by a governor who made blind partisanship and personal political ambition the official business of our great state."

Had the filibuster continued until midnight, Davis would have blocked the controversial abortion bill from passage because the legislature's special session was constitutionally-required to come to a close by then. A successful filibuster would have prevented the Senate getting a chance to take a final vote on the bill.

The quirky filibuster rules in Texas made Davis' attempt both fascinating and perilous. In Texas, lawmakers aren't allowed to lean on a desk or chair during a filibuster and everything discussed while speaking continuously must be germane — you can't talk about topics unrelated to the bill. Anything deemed not germane is subject to a point of order, and Davis went up against a three-strikes-you're-out-rule on those points. In the seventh hour of her filibuster, Davis donned a back brace, but state Sen. Tommy Williams, a Republican, called a point of order on it. She had to lose the brace and take a strike. And the third strike was for speaking about a sonogram bill, which sounds related but the chair sustained the point of order on germaneness, and it ended her filibuster attempt.

Wildly outnumbered in the Texas Legislature, Democrats didn't have the votes to beat back the bill earlier in the special session. Republican Gov. Rick Perry added abortion bills to the special session's allowed bill topics late in the game, which created the opportunity for Democrats to try to run out the clock and stop the bill from final passage before the session ended at midnight Tuesday night.

Republicans in Texas hailed the bill's earlier passages in the legislative process as wins for women's health. But Texas Monthly
's longtime political scribe Paul Burka wonders whether the national attention on the legislation — and the very public fight to stop it — could be a victory for Democrats in the long run. He writes, "The more Republicans take actions that are anathema to younger women, the more we will hear from Democrats about the Republican War against Women. In the age of the Internet and the social media, it is impossible to build a wall around Texas."
The line to enter the Senate Chamber spills into multiple levels of the Texas Capitol rotunda as Sen. Wendy Davis, D-Fort Worth, filibustered an abortion bill in Texas.