White House demands changes to cybersecurity bill to strengthen privacy

CISPA currently grants immunity to corporations for potential data breaches

The White House wants more protection for the privacy of citizens in the latest redraft of the controversial Cyber Information Sharing and Protection Act (CISPA).

CISPA, which has been pushed forward by the House Permanent Select Committee on Intelligence (HPSCI), allows intelligence organisations to collect US citizens' personal data from private firms.

The committee has already made several amendments to its legislation, which was passed by the House but not yet by Senate.

In a statement, the White House said it recognised and appreciated the HPSCI's amendments to the act in an effort to incorporate the government's important substantive concerns, but said it would need more changes before passing the act.

"The administration still seeks additional improvements and if the bill, as currently crafted, was presented to the President, his senior advisers would recommend that he veto the bill," it said.

It went on to say that while the committee had removed the broad national security exemption, which significantly weakened the restrictions on how cybersecurity information could be used by the government, it has not yet made clear that private entities should remove unnecessary personal data when sharing cybersecurity information with other organisations.

"The administration remains concerned that the bill does not require private entities to take reasonable steps to remove irrelevant personal information when sending cybersecurity data to the government or other private sector entities. Citizens have a right to know that corporations will be held accountable - and not granted immunity - for failing to safeguard personal information adequately," the White House said.

"The administration is concerned about the broad scope of liability limitations in [the act]. Specifically, even if there is no clear intent to do harm, the law should not immunise a failure to take reasonable measures, such as the sharing of information, to prevent harm when and if the entity knows that such inaction will cause damage or otherwise injure or endanger other entities or individuals," it added.

The HPCSI chairman, Mike Rogers, said that the veto threat from the White House was "flabbergasting".

"I do not believe the administration knows how to work with a legislative body. We have come a long way on some of their points," CNET reported Rogers saying.

CISPA has a number of big name supporters including Intel, Oracle and McAfee, but Facebook and Microsoft have backed away from the act, while Google has not verified its position publicly.