Sheldon Whitehouse Freaks Out, Blames 'Pro-Botnet Lobby' For Rejecting His Terrible CFAA Amendment

from the the-pro-botnet-lobby-is-here dept

As we mentioned yesterday, one of the (many) bad things involved in the new Senate attempt to push the CISA "cybersecurity" bill forward was that they were including a bad amendment added by Senator Sheldon Whitehouse that would expand the terrible Computer Fraud and Abuse Act, a law that should actually be significantly cut back. Senator Ron Wyden protested this amendment specifically in his speech against CISA. And, for whatever reason, Whitehouse's amendment has been pulled from consideration and Whitehouse is seriously pissed off about it.

He went on the Senate floor to directly whine about it, even sarcastically calling out the "hidden pro-botnet, pro-foreign cyber criminal caucus" that somehow fought against the bill. Except it wasn't a "pro-botnet" anyone who killed the amendment. It was a lot of people who were quite reasonably concerned about what the amendment would do to the CFAA. And while it's true that Whitehouse improved the amendment from its originally really terrible state, it still was a bad amendment. Whitehouse goes on and on in has rant about who could possibly be "against" shutting down botnets or raising penalties for hacking into critical infrastructure, citing that "law enforcement" supports the bill. But, of course, that leaves out the other side entirely. And that's not the "pro-botnet, pro-foreign cyber criminal" caucus, but rather people who are well aware of how the CFAA has regularly been abused by law enforcement to bring charges against non-criminals, or to pile on charges on those committing minor offenses. Expanding all of that without stopping the potential for abuse only means the bill will be abused further.

Whitehouse continues to make a name for himself as one of the most technologically illiterate members of the Senate. Late last year he went on a rant about a totally made up Google search (the results did not show what he claimed they showed) and an equally made up Pirate Bay whose actual site did not show what Whitehouse pretended it showed. He also was strongly in favor of backdooring encryption, arguing that if Apple doesn't backdoor encryption, perhaps it will be opening itself up to a lawsuit when the FBI can't track down a kidnapper (ignoring all the times that such encryption would actually protect people). This push to expand the CFAA and then whining about pushback on the Senate floor is only adding to his reputation as one of the most anti-tech industry Senators out there.

And, of course, for all the show on the floor, it's not like the Amendment is dead anyway. As Marcey Wheeler notes in her post (linked above), there's still a good chance that his CFAA amendment will be brought back into the bill when the House and Senate conference to resolve differences in the bills across houses.

Filed Under: botnet caucus, botnets, cfaa, cisa, cybersecurity, hacking, sheldon whitehouse

Senate Pushes Forward With CISA As Internet Industry Pulls Its Support

from the what-are-they-thinking? dept

Despite the fact that most of the internet industry has recently come out against the ridiculous faux-cybersecurity bill CISA, the Senate today began the process of moving the bill forward with a debate. The arguments were pretty much what you'd expect. The supporters of the bill, such as Senators Dianne Feinstein and Richard Burr, went on and on about how the bill is "voluntary" and about various online hacks (none of which would have been stopped by CISA -- but apparently those details don't matter). Senator Ron Wyden responded by pointing to all the internet companies coming out against the bill, and saying (accurately) that they're doing so because they know the public no longer trusts many of those companies, and they don't want a bill that will almost certainly be used for further surveillance efforts.

Amazingly, Burr shot back with a really dishonest and misleading claim that companies that don't agree to "share" information with the government are the ones harming their users by somehow not protecting their info. That's fairly incredible. The reason that companies don't want to share info is because no one -- the companies or the public -- trust the government to not abuse the information. To turn that around and pretend that sharing the info with the government is likely to better protect user information is laughable.

The fact that the internet companies have finally come out against CISA is a really big deal. For the past few years, they've remained pretty quiet on it and related bills, because it would have granted them immunity from liability for participating in the program. So, for the tech companies, it was tough to argue against the bill, since it just protected them from legal liability. Yet, in the last few weeks, many internet companies and industry associations have (finally) spoken out against the bill, noting that it actually puts their users' privacy at risk. This also helps highlight how the claim that this is all "voluntary" is a myth, and the companies recognize that they will likely be pressured into sharing information.

Meanwhile, a bunch of amendments have been introduced along with CISA... including an absolutely terrible amendment introduced by Senator Sheldon Whitehouse that would revamp an unrelated bill, the infamous CFAA, which needs to be reformed. Except that the Whitehouse amendment makes the CFAA worse, not better.

There's still plenty of process to occur, but the ball is now rolling. There will likely be some fights and votes in the next few days, but if you don't think CISA (or this horrible CFAA amendment) should pass, now would be a good time to call your two Senators and let them know to oppose this.

Filed Under: cfaa, cisa, cybersecurity, dianne feinstein, information sharing, richard burr, ron wyden, sheldon whitehouse

Why Do Senators Keep Lying About What CISA Would Be Used For?

from the liar-liar dept

We keep asking if the politicians supporting CISA -- the "Cybersecurity Information Sharing Act" can explain just what security breaches it would have stopped -- and they can't. Because the answer is that it wouldn't have stopped any of them. And yet, the politicians pushing CISA never seem to waste an opportunity to pretend that each new big computer hack would have been stopped if only CISA had been in place. A few months ago it was the OPM hack and, now, apparently it's the T-Mobile/Experian hack.

Both Senators Richard Burr and Dianne Feinstein (the two leading members of the Senate Intelligence Committee from each party) have been taking swings at anyone who won't support the bill, and have cited the T-Mobile customer breach as a reason to support it:

“If these special interest groups are successful in mischaracterizing this bill, which authorizes purely voluntary sharing, they will only succeed in allowing more personal information to be compromised to criminals and foreign countries.”

The Intelligence panel leaders urged action on the bill following a breach that might have exposed private data for 15 million current and prospective T-Mobile customers.

Of course, the reason that the customer data was exposed has nothing to do with CISA, which would not have stopped that breach. It had to do with Experian screwing up their encryption. If Feinstein and Burr really wanted to encourage better cybersecurity, they'd be encouraging greater encryption.

And they're not being truthful in the rest of their statement. As far as I've seen, most of the people opposing CISA are happy to admit that it's about "voluntary" sharing of information -- but they note that by taking away all liability from companies for sharing info, companies have greatly decreased incentives to protect user privacy.

And, also, all of this totally leaves out the real reason behind CISA. As was revealed this past summer, the NSA uses "cybersignatures" as selectors in searching through all of the upstream (backbone) traffic that it sniffs. Given that, what the NSA is really looking for are more "cybersignatures" in order to be able to sniff out many more things.

And guess what CISA would do? That's right, create incentives for companies to give "cybersignatures" to the NSA.

This is almost certainly why Senator Ron Wyden made it clear that CISA is a surveillance bill in disguise, because it would play right into the hands of the NSA, by giving it a way to snoop on even more communications after convincing companies to hand over "cybersignatures" that it can then use to sniff through everyone's internet traffic.

Yes, CISA is "voluntary." But it's totally about surveillance, not cybersecurity, and nothing in CISA would have prevented the T-Mobile hack or the OPM hack or any other hack. For Feinstein and Burr to suggest otherwise is totally disingenuous fluff, designed to mislead the American public and to support the NSA.

Filed Under: cisa, cybersecurity, cybersignatures, dianne feinstein, nsa, richard burr, ron wyden, surveillance, t-mobile hack
Companies: experian, t-mobile

SalesForce Says It Doesn't Support CISA After Signing Letter That Suggested It Did

from the welcome-to-politics dept

One of the issues with various "cybersecurity information sharing" bills like CISPA from last year and CISA from this year, is that some tech companies have been (quietly) supportive of these bills. The whole focus of these bills is to encourage "cybersecurity information sharing" between private companies and the government. And, in theory, that may sound like a good thing. In reality, all the bills really do is focus on protecting companies from liability should they share private information they shouldn't have shared. And, of course, there's the fact that people who understand these things recognize that there's a hidden meaning behind CISA, in that it's really designed to give the NSA more "signatures" to use in its surveillance dragnet.

But, of course, for many companies, the bill just looks like a "get out of court free" bill -- because the entire focus is on protecting those companies from liability. Some companies take a more long-term, customer- or public-centric view of things and recognize all this, and have not supported CISA. Others, however, have been more supportive. A few weeks ago, the BSA -- which is really the Business Software Alliance, but refers to itself as The Software Alliance -- sent a letter to Congress outlining some of the issues that its members were supporting. This included a bunch of reasonable and good things, like much needed ECPA reform. However, it also included this:

Cyber Threat Information Sharing Legislation will promote cybersecurity and protect sensitive information by enabling private actors in possession of information about vulnerability and intrusions to more easily share that information voluntarily with others under threat, thus enabling the development of better solutions faster.

Now, it's notable that this line does not directly endorse CISA. And it's pretty clear that's on purpose. Of the bullet points in the letter three of the other four all name specific bills that the letter is supporting. Leaving out specific support of CISA is an interesting choice and at least indicates some hesitancy among some of the companies signing onto the letter to actually support CISA in its current form.

Of course, the problem is that, right now, there are no real alternatives being offered, and politicians who support CISA can and will point to this letter to argue that "the tech industry supports CISA." And, with that in hand, the good folks at Fight for the Future kicked off a campaign called YouBetrayedUs.org, calling on the companies who signed the letter -- including Apple, Microsoft, Adobe, Symantec, Salesforce.com, Oracle and more to renounce the letter itself.

It appears that they've claimed their first scalp, as Salesforce.com has issued a press release saying they do not support CISA and have never supported CISA. The quote is from the company's chief legal officer, Burke Norton, who is the same representative who signed the letter:

“At Salesforce, trust is our number one value and nothing is more important to our company than the privacy of our customers' data,” said Burke Norton, chief legal officer, Salesforce. “Contrary to reports, Salesforce does not support CISA and has never supported CISA.”

And here he is on the letter: Again, it's absolutely true that the letter did not directly support CISA. And it could have. As mentioned, most of the other bulletpoints list out bills by name and/or number. But the one on cybersecurity did not. Of course, one might argue that the BSA did this on purpose, knowing that if it cited CISA by name, all hell would rain down on them from the public.

Either way, perhaps this should act as a clear warning to tech companies that do want to support CISA. The public isn't going to like it very much. Similarly, this should provide further notice to companies in signing these kinds of letters that they should understand what it appears they're supporting as well.

Filed Under: cisa, cybersecurity, information sharing, liability
Companies: bsa, microsoft, oracle, salesforce

Before We Pass CISA As A Response To OPM Hack, Shouldn't We Look At What The Feds' Cybersecurity Practices Were?

from the just-saying... dept

As we've been discussing, some surveillance hawks in Congress have been trying very hard to push CISA through into law, often using the disastrous OPM hack as evidence for why it's needed. Yet, as we've pointed out multiple times, there's nothing in CISA that would have prevented OPM from being hacked. Instead, the Senators pushing CISA and using the OPM hack as the reason seem to be blindly flailing around assuming that because both are tangentially related to "cybersecurity," people will believe that it all "works."

The reality, of course, is that CISA has nothing to do with the OPM hack, but is really a backdoor surveillance bill, designed to give immunity to companies sharing info with the NSA, that it can feed into its system that it uses to monitor all "upstream" traffic. Senator Ron Wyden has been warning about this for months, without too many people paying attention -- because fear! cybersecurity! hack!

So, Wyden's latest strategy is to look a little more deeply at the OPM hack itself and what the government's National Counterintelligence and Security Center (NCSC) did (if anything) to prevent the hack. In a letter to NCSC, Wyden asks for details of what steps it had taken to protect OPM.

The National Counterintelligence and Security Center (NCSC) is tasked with a very important mission, which includes defending the nation's classified information and assets from exploitation by foreign adversaries. The importance of this mission has recently been underscored by compromises of sensitive US government personnel data.

And thus, the following questions:

1. Did the NCSC identify OPM's security clearance database as a counterintelligence vulnerability prior to these security incidents?
2. Did the NCSC provide OPM with any recommendations about how to secure this information?
3. At least one official has said that the background investigation information compromised in the second OPM hack included information on individuals as far back as 1985. Has the NCSC evaluated whether the retention requirements for background investigation information should be reduced to mitigate the vulnerability of maintaining personal information for a significant period of time? If not, please explain why the existing retention periods are necessary?

There may be a variety of reasons for sending this letter -- but one clear one is to send the following message: before Congress rushes around demanding CISA as a response to the OPM hack, shouldn't we look at how our own processes failed to prevent that attack? And that's especially true given that the point of CISA is to trust the very same government to help private companies with cybersecurity. If the government can't even do the most basic things to protect its own data, why are we rushing to pass a law that is entirely premised on the idea that the government can help others protect their data?

Filed Under: cisa, congress, cybersecurity, ncsc, opm, opm hack, ron wyden

Senate Punts CISA Vote Into September

from the didn't-have-the-votes dept

Well, that's interesting. Based on all of the talk this week, it was expected that there would be a vote today in the Senate on the faux cybersecurity CISA bill -- but it didn't happen. Business concluded and everyone went home for the month without a vote, meaning it won't be taken up until September, at the earliest. According to Kaveh Waddell at the National Journal:

Senators are heading home for the August recess without voting on the cybersecurity bill.

Lawmakers worked for days on an agreement about which amendments to include on the cyber bill, but Senate leaders pulled the plug at the last minute on a vote scheduled first for 10:30 a.m, then for 2 p.m. Then they decided to skip town.

Under the deal senators struck Wednesday afternoon, the cyber bill will come up again in September after recess, and 21 Democratic and Republican amendments will receive votes.

It's not entirely clear why the delay happened. Some have suggested it had to do with concern over some of those 21 amendments, but it might also mean that there really aren't the votes that CISA supporters were hoping for. After all, the hope had been to try to "sneak" CISA through when people weren't paying attention, but civil liberties and privacy advocates have been quite active again (and, I'm sure, will continue to be). Either way, the fight to block such a bad piece of legislation goes on, but it's good to see that the actual vote has been delayed for now...

Filed Under: cisa, cybersecurity, senate

Question To Ask Anyone Who Supports CISA: What Breach Would It Have Stopped?

from the simple-questions dept

We've asked this before and no one answered. But with the faux "cybersecurity" CISA bill back on track for another vote, it's time to ask the question again: Can defenders of CISA explain what data breach it would have stopped? This is important, because many of the defenders of CISA keep pointing to things like the OPM hack as an example of why we need "cybersecurity regulations." Just yesterday, Senator John McCain used various recent high profile hacks as proof of why we need such a bill:

The chairman of the joint chiefs of staff is uncomfortable about the cyberthreats to this nation -- which just took place where millions -- MILLIONS! -- of Americans had their privacy hacked into. God only knows what the consequences of that are. And the other side has decided to object to proceeding with a bill that passed through the Intelligence Committee by a vote of 14 to 1. This is disgraceful.

But as policy counsel at the Open Technology Institute, Robyn Greene, recently noted on Twitter, none of the recent hacks would have been stopped if CISA was law.

When will Senators realize that NONE of the breaches (OPM, Sony, Anthem, Home Depot, etc.) would have been stopped is #CISA was law?

— Robyn Greene (@Robyn_Greene) August 4, 2015

It seems like a fairly important question, especially when politicians are pointing to those and similar hacks or data breaches as examples of why we must pass CISA. Yet they can't explain how the law would have stopped those breaches (because they can't, because it wouldn't have).

John McCain wants to talk about "disgraceful"? Isn't it more disgraceful to point to an attack that this bill would not have helped with as a key argument for why this bill needs to pass?

This is some pretty serious hand-waving on the part of the politicians. Of course, the truth is that they simply don't understand the details enough to know what they're doing. They just hear from surveillance/law enforcement types saying that we "need cybersecurity legislation" and then they hear about these breaches and they immediately connect the two. Yet, they don't know what the law really does or why it's needed, and certainly don't understand how breaches happen or what it would take to prevent them (if that were even possible). So they just say "well, cybersecurity!" as if that's good enough.

It's not.

The changes brought about by CISA could have a pretty serious impact on our privacy and security and if Congress is going to pass it by pointing to these breaches, they should first be required to explain how the law would have helped to stop any of those breaches. We'll wait.

Filed Under: breach, cisa, cybersecurity, hack, john mccain

Want To Know Why DHS Is Opposing CISA? Because It's All A Surveillance Turf War

from the it's-not-what-you-think dept

As it appears that the fake "cybersecurity" bill CISA is heading to a vote in the Senate, some were surprised this week to see the Department of Homeland come out against the bill with a letter expressing concerns that the bill "could sweep away important privacy protections" with its open ended definitions and provisions:

The authorization to share cyber threat indicators and defensive measures with “any other entity or the Federal Government,” “notwithstanding any other provision of law” could sweep away important privacy protections, particularly the provisions in the Stored Communications Act limiting the disclosure of the content of electronic communications to the government by certain providers. (This concern is heightened by the expansive definitions of cyber threat indicators and defensive measures in the bill. Unlike the President’s proposal, the Senate bill includes “any other attribute of a cybersecurity threat” within its definition of cyber threat indicator and authorizes entities to employ defensive measures.)

This has led to some surprise among people who don't follow this that closely, that "even Homeland Security" doesn't like the bill. But that's really ignoring history and what this fight has always been about. Going back many, many years we've been highlighting that the truth behind all of these "cybersecurity" bills is that it's little more than a bureaucratic turf war over who gets to control the purse strings for the massive, multi-billion dollar budget that will be lavished on government contractors for "cybersecurity solutions." That the bill might also boost surveillance capabilities is little more than a nice side benefit.

The key players in this turf war? The NSA and Homeland Security (with the Justice Department occasionally waving its hand frantically in the corner shouting "don't forget us!"). From the beginning, one of the key questions people have asked is "who gets the data?" Obviously, "none of the above" is probably the best answer, but of the remaining options, Homeland Security tends to be the least worst option out of a list of three really bad options. And, so far, the White House has repeatedly pushed to put DHS in charge, giving it more power over the budget. However, CISA does not put DHS in charge.

So that is why DHS is complaining. Yes, the "privacy" concerns are there, but DHS's true concern is that it's not DHS running the show (and controlling the budget). Reread the DHS letter with this as background, and it appears a lot more understandable:

The Administration has consistently maintained that a civilian entity, rather than a military or intelligence agency, should lead the sharing of cyber threat indicators and defensive measures with the private sector. The National Cybersecurity Protection Act of 2014 recognized the NCCIC to be responsible for coordinating the sharing of information related to cybersecurity risks and to be the federal civilian interface for multi-directional and cross-sector sharing of information about cybersecurity risks and warnings. The NCCIC has representatives from the private sector and other federal entities involved in cyber information sharing, from those with whom we have an agreement and share consistently, to those that passively receive information from the center.

Equally important, if cyber threat indicators are distributed amongst multiple agencies rather than initially provided through one entity, the complexity–for both government and businesses–and inefficiency of any information sharing program will markedly increase; developing a single, comprehensive picture of the range of cyber threats faced daily will become more difficult. This will limit the ability of DHS to connect the dots and proactively recognize emerging risks and help private and public organizations implement effective mitigations to reduce the likelihood of damaging incidents. DHS recommends limiting the provision in the Cybersecurity Information Sharing Act regarding authorization to share information, notwithstanding any other provision of law, to sharing through the DHS capability housed in the NCCIC. This would not preclude sharing with any federal entity (indeed, DHS maintains an obligation to share rapidly with federal partners independent of any legislation), and it would further incentivize sharing through the NCCIC.

There's a lot more like that in the letter as well.

Don't get me wrong. Having DHS come out against CISA and speaking out about the privacy concerns the bill raises is great. But don't think that DHS is against these kinds of "information sharing" bills at all. It is not. It just wants to make sure that it's the queen bee when it comes to who's in charge of cybersecurity information... and, with it, who gets to control the budget.

Filed Under: cisa, cybersecurity, dhs, dod, doj, homeland security, nsa, privacy, turf war

Reminder: When Ron Wyden Says There's A Secret Interpretation Of A Law, Everyone Should Pay Attention

from the how-many-times-do-we-need-to-do-this dept

Years before Ed Snowden revealed how the NSA and DOJ had reinterpreted the PATRIOT Act and the FISA Amendments Act to allow the intelligence community to spy on Americans, Senator Ron Wyden tried to warn the public that this had happened:

We're getting to a gap between what the public thinks the law says and what the American government secretly thinks the law says.

For a couple of years after he said that, privacy and civil liberties advocates were forced into something of a guessing game to figure out what that secret law actually said. Eventually, the details were spilled by Ed Snowden who is, of course, now being threatened with a lifetime in prison for blowing the whistle.

This is not the only time that Wyden has made these kinds of warnings, and he's doing it again right now -- this time over CISA, the faux-"cybersecurity" bill that Wyden has made clear is really about surveillance. Recently released papers from the Snowden archives have made it clear why he's saying this, because it showed that, contrary to what's been said in the past, the NSA is using "cyber signatures" to sniff through upstream collections (their taps into the fiber backbone) under Section 702 of the FISA Amendments Act. And this opens up the information collected to so-called "back door" or "incidental" searches by the NSA. The whole point of CISA is to actually encourage companies to give the government more such "cyber signatures" which they can use to monitor the internet.

However, there's likely more going on as well, and in particular, Senator Wyden has been strongly hinting about an important Justice Department memo that remains classified, but which he implies would change the debate.

Wyden... claims that a classified Justice Department legal opinion written during the early years of the George W. Bush administration is pertinent to the upper chamber's consideration of cyberlegislation—a warning that reminds close observers of his allusions to the National Security Agency's surveillance powers years before they were exposed publicly by Edward Snowden.

[....] "I remain very concerned that a secret Justice Department opinion that is of clear relevance to this debate continues to be withheld from the public," Wyden said in his written dissent against CISA, which cleared the Senate Intelligence Committee 14-1 in March. "This opinion, which interprets common commercial service agreements, is inconsistent with the public's understanding of the law, and I believe it will be difficult for Congress to have a fully informed debate on cybersecurity legislation if it does not understand how these agreements have been interpreted by the Executive Branch."

Last year, based on some breadcrumbs that Wyden dropped during the confirmation hearings for Caroline Krass as the CIA's new top lawyer, Marcey Wheeler dug into some more details about this document, and notes that it comes from the same period of time when the Bush administration was twisting itself into knots to justify warrantless wiretapping and torture. In other words, this document seems ridiculously relevant to the debate.

And while it appears that the vote on CISA has likely been delayed yet again, it seems like this is a fairly important detail.

In short, haven't we, as a country, learned enough to note that, when Senator Wyden points out that there's a secret interpretation of the law that is at odds with a plain reading of it, we should all be demanding answers?

Filed Under: cisa, cybersecurity, doj, information sharing, ron wyden, secret law, surveillance

Senate, Once Again, Looks To Bring Back CISA: Surveillance Expansion Bill Pretending It's A Cybersecurity Bill

from the information-sharing-with-whom dept

We've discussed the "cybersecurity" bill, CISA, that's been making its way through Congress a few times, noting that it is nothing more than a surveillance expansion bill hidden in "cybersecurity" clothing. As recent revelations concerning NSA's surveillance authorities have made quite clear, CISA would really serve to massively expand the ability of the NSA (and other intelligence agencies) to do "backdoor searches" on its "upstream" collection. In short, rather than protecting any sort of security threat, this bill would actually serve to give the NSA more details on the kind of "cyber signatures" it wants to sniff through pretty much all internet traffic (that it taps into at the backbone) to collect anything it deems suspicious. It then keeps the results of this, considering it "incidental" collections of information.

In an incredibly cynical move, supporters of the surveillance state have seen OPM hacks as a ridiculous excuse to push to pass this bill. Senator Mitch McConnell tried to include it in the defense appropriations bill by pointing to the OPM hack. That gambit, thankfully, failed.

But that's not stopping the supporters of the surveillance state. During recent Congressional hearings, surveillance state supporter Senator John Cornyn claimed that CISA would be back for a vote before the end of the month, despite having failed multiple times in previous attempts. And, earlier this week, McConnell similarly announced plans to bring it up for a vote soon -- and, again in the context of the OPM hack. Here's McConnell being interviewed on Fox News by Bret Baier:

BAIER: Senator, you mentioned cybersecurity. Hackers broke into the U.S. Office of Personnel Management, stealing background investigation forms, fingerprint records, Social Security numbers for more than 22 million people....

[....]

MCCONNELL: This is a total mess. It's no wonder they had a hard time with the Web site which they launched Obamacare. These cybersecurity issues are enormously significant. What we're going to do is before August, take a step in the direction of dealing with the problem with information sharing bill that I think will be broadly supported. This is an administrative disaster that the president needs to get a hold of and get straightened out soon.

What no one asks McConnell (of course) is how CISA would have had any impact on the OPM hack. Or, hell, how it would help stop a single online attack anywhere. Because that's a question no one seems willing to answer. Because the answer was already made abundantly clear by Senator Ron Wyden in opposing this bill. It's not about cybersecurity at all. It's about surveillance.

Filed Under: cisa, cybersecurity, information sharing, john cornyn, mitch mcconnell, opm, opm hack, surveillance