Category: Law

Categories
Law

Kentucky clerk’s appeal of same-sex marriage ruling highlights the reach of Hobby Lobby

The signature of Barbara Fiala appears on my driver’s license. But I have no idea what she thinks of my fitness to operate a motor vehicle in New York State. And who is Barbara Fiala anyway?

As it happens, Ms. Fiala is the former state commissioner of motor vehicles. I Googled her upon reading about an application filed Saturday by Kim Davis with the U.S. Supreme Court. Davis is asking the justices to stay a court order that directs her to issue licenses sought by four couples, including two of the same sex, to marry in Rowan County, Kentucky, where Davis holds the office of clerk, an elected post.

The litigation has its origins in the events of June 26, when, within hours of a ruling by the court that upheld the right of same-sex couples to marry, Governor Steve Beshear directed clerks of counties throughout the Bluegrass State to license the marriages of same-sex couples.

The directive did not sit well with Davis, an Apostolic Christian who believes that marriage represents a union between one man and one woman. Kentucky requires that marriage licenses be signed by a county clerk, an act that Davis charges would violate her faith in applications by same-sex couples.

Davis improvised a way around the directive: She would refrain from issuing any marriage licenses. The betrothed sued, citing the governor’s decree. Judge David Bunning of the U.S. district court in Ashland sided with the couples but postponed the effective data of his ruling until this Monday to give Davis time to appeal. On Wednesday, the U.S. Court of Appeals for the 6th Circuit denied Davis’ request for a stay.

The requirement that clerks affix their names to marriage licenses would constitute a “searing act of personal validation [that] would forever, and irreversibly, echo in her conscience—and, if it happened, there is no absolution or correction that any earthly court can provide to rectify it,” Davis charged in papers filed with Justice Kagan, who oversees emergency appeals from Kentucky.

“A stay of the injunction will halt the irreversible implications on Davis’ conscience while this case undergoes appellate review, especially since multiple less restrictive alternatives are available that do not substantially burden Davis (or the Plaintiffs),” Davis added.

The application characterizes the need for relief as arising from a conflict between the constitutional right of same-sex couples to marry and the free exercise of religion enshrined in the First Amendment. Davis has two choices, she says: affix her name to marriage licenses for same-sex couples, or resign.

Of course, it’s unlikely the governor’s directive or the requirement that clerks in Kentucky affix their names to marriage licenses aim to interfere with religion. A law that punishes conduct just because it is religious is invalid. For example, a municipal ordinance may not prohibit ritual slaughter of chickens while otherwise allowing the slaughter of chickens.

The problem for Davis may be that it’s hard to find such intent behind the implementation of same-sex marriage in Kentucky. State law requires, among other things, that a marriage license bear the name of the county clerk pursuant to whose authority the license was issued. But by its terms the requirement seems to reflect simply that Kentucky has authorized the marriage rather than the beliefs of the clerk whose name happens to appear on the license.

In support of her application, Davis cites the Court’s ruling last year in Burwell v. Hobby Lobby Stores, which found the Affordable Care Act’s mandate that employer-sponsored health plans include coverage for contraceptives to be unlawful because it burdened the exercise of religion by a closely held corporation.

Davis leans on the Hobby Lobby majority’s finding that the health care law’s requirement that employers cover the cost of birth control did not constitute the least restrictive means of serving a compelling government interest, which is a test the court applies to claims the government has engaged in religious discrimination.

As Davis sees it, the state could assure the issuance of marriage licenses to same-sex couples in Rowan County by, among other things, allowing county officials to recuse themselves from issuing licenses based on a sincerely held religious objection, deputizing a clerk from a nearby county to issue marriage licenses to same-sex couples, or revising the form the state uses for marriage licenses to remove the clerk’s name.

“All of the foregoing options, and others, are available to avoid substantially burdening Davis’ personal religious freedom in the wake of the redefinition of marriage in Obergefell,” she writes.

No matter which way the Court rules—the justices can choose not to act and allow Davis to appeal in the normal course, or they can invite a response from the couples who sued—the application highlights one way Hobby Lobby reverberates.

In addition, by framing the problem as an issue of religious conscience rather than one of equal protection of the laws for same-sex couples, Davis advances a line of argument that, as Professor Wendy Brown of UC Berkeley observed in a lecture in July at the London School of Economics, finds its endorsement in the Hobby Lobby ruling.

Categories
Law Privacy

Wyndham ruling reinforces FTC authority to regulate privacy practices

A hotel chain’s repeated failure to protect customers from hackers constitutes an unfair practice that subjects the company to a lawsuit by the Federal Trade Commission, a federal appeals court in Philadelphia has ruled in a decision that reinforces the agency’s authority to protect consumers from companies that backtrack on promises about privacy.

Wyndham Worldwide Corporation, which licenses its brand to roughly 90 independently owned hotels that use the company’s computerized property management system, cannot contend that federal law or the FTC’s interpretations of it failed to put the company on notice that lapses in cybersecurity on its part could lead to legal liability, according to the court.

The FTC sued Wyndham, which also franchises more than 7,600 hotels worldwide, in June 2012, charging the company with failing to protect consumers in violation of Section 5 the Federal Trade Commission Act, a century-old law that authorizes the FTC to proscribe “unfair or deceptive acts or practices” in commerce.

Three breaches of Wyndham’s property management system over two years starting in 2008 resulted in hackers obtaining payment-card information from more than 619,000 consumers and at least $10.6 million in losses from fraud, the FTC charged.

According to the FTC, Wyndham failed to use encryption, firewalls and other procedures to safeguard customers’ names, payment card account numbers, expiration dates and security codes stored in the system, notwithstanding the company’s privacy notice, which advised customers that Wyndham safeguards their personally identifiable information using industry-standard practices.

Before trial, Wyndham sought to dismiss the FTC’s claims, charging the agency with failing to support a finding of unfairness. Congress reshaped Section 5 to exclude cybersecurity, according to Wyndham, which also charged the FTC with failing to notify companies what standards to follow. U.S. District Judge Esther Salas denied Wyndham’s motion but allowed the company to appeal the ruling.

The appeals court sided with Salas. “A company does not act equitably when it publishes a privacy policy to attract customers who are concerned about data privacy, fails to make good on that promise by investing inadequate resources in cybersecurity, exposes its unsuspecting customers to substantial financial injury, and retains the profits of their business,” wrote Judge Thomas Ambro for a three-judge panel of the U.S. Court of Appeals for the 3rd Circuit.

The government’s charges, which ranged from Wyndham’s allowing company-branded hotels to store payment card information in clear readable text, to permitting the use of easily guessed passwords to protect the property management system, to failing to restrict access to the system by third parties, embody unfairness as defined by both the FTC and Congress, the court noted.

In 1994, Congress codified a definition of unfairness adopted by the FTC 14 years earlier that defines the term as an act or practice that “causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or to competition.”

Apart from the term’s plain meaning as defined by the FTC, Congress specifically declined to enumerate specific unfair practices in the law, choosing instead to leave its development to the FTC as technology and the marketplace evolve, Ambro explained.

The approach makes sense, according to Omer Tene, a professor at the College of Management School of Law in Rishon Le Zion, Israel and a visiting scholar at the Center for Internet and Society at Stanford Law School, who wrote following the ruling:

“In what could serve as a valuable lesson for European lawmakers as they mull over the details of the voluminous General Data Protection Regulation, Congress had the foresight back then to understand the futility of exhaustively listing every unreasonable practice that might arise. Firewalls, passwords and secure cloud transactions were hardly foreseeable in 1914.”

The court also rejected a claim by Wyndham that a business does not treat its customers unfairly when the business itself is victimized by hackers, a situation the company argued would be akin to allowing the government to sue a supermarket that was “sloppy about sweeping up banana peels.”

“The argument is alarmist to say the least,” wrote Ambro. “And it invites the tart retort that, were Wyndham a supermarket, leaving so many banana peels all over the place that 619,000 customers fall hardly suggests it should be immune from liability under [Section 5.]”

The court further rejected Wyndham’s contention that it lacked notice of what specific security procedures a business must take to avoid liability. According to the court, the FTC has published enforcement actions and consent decrees that have the effect of notifying companies whether their practices treat consumers fairly. The FTC says it has settled 53 cases against companies related to data security, including Snapchat, Reed Elsevier and Credit Karma.

Ambro noted that in Wyndham’s case the facts failed to create a close call:

“As the FTC points out in its brief, the complaint does not allege that Wyndham used weak firewalls, IP address restrictions, encryption software, and passwords. Rather, it alleges that Wyndham failed to use any firewall at critical network points, did not restrict specific IP addresses at all, did not use any encryption for certain customer files, and did not require some users to change their default or factory-setting passwords at all. Wyndham did not respond to this argument in its reply brief.” (citations omitted, emphasis in original)

Whether Wyndham realized the risks to security it faced when the first breach occurred, the company had notice by the second and third cyberattacks, Ambro noted. By now Wyndham knows, too. In its latest annual securities filing, the company described risks it faces in the realm of privacy and security:

“The legal, regulatory and contractual environment surrounding information security and privacy is constantly evolving and the hospitality industry is under increasing attack by cyber-criminals operating on a global basis. Our information technology infrastructure and information systems may also be vulnerable to system failures, computer hacking, cyber-terrorism, computer viruses, and other intentional or unintentional interference, negligence, fraud, misuse and other unauthorized attempts to access or interfere with these systems and our personal and proprietary information.”

According to experts, the ruling is significant in part because it represents the first time a company has challenged the FTC’s authority to hold companies accountable for unfair practices pursuant to Section 5.

“It’s the first Court of Appeals decision on the issue and should be viewed and taken by companies that this is a potential area of exposure,” Eric Hochstadt, a partner at Weil, Gotshal & Manges in New York, told Bloomberg. “This is definitely an area of growing concern as the underlying misconduct, data breaches, is growing in scope.”

For its part, Wyndham vows to continue the fight. “Once the discovery process resumes, we believe the facts will show the FTC’s allegations are unfounded,” spokesman Michael Valentino said in a statement.

The FTC welcomed the ruling. “Today’s Third Circuit Court of Appeals decision reaffirms the FTC’s authority to hold companies accountable for failing to safeguard consumer data,” said Chairwoman Edith Ramirez. “It is not only appropriate, but critical, that the FTC has the ability to take action on behalf of consumers when companies fail to take reasonable steps to secure sensitive consumer information.”

Categories
Law Privacy

For AT&T customers, opting out of online ads more hassle than necessary: LA Times

Writing in Tuesday’s Los Angeles Times, David Lazarus, the paper’s consumer columnist, chronicles the difficulty that customers of AT&T can encounter when they elect to opt-out of advertising from the company and its partners.

As one who switched my mobile service recently to AT&T, I decided to sample the process Lazarus describes. I went to an online site where AT&T customers can decline ads delivered by the Network Advertising Initiative, a self-regulatory organization whose members serve up ads based on predictions about users’ interests “generated from your visits over time and across different websites.”

According to Lazarus, AT&T customers have to opt out of ads delivered by as many as 21 digital advertising companies. In my case the number totaled 79. NAI counts 93 members in all, which leaves 14 companies that have yet to place a cookie in my browser. (To those companies: It’s fine, really.)

NAI members include a mix of household names such as Google and AOL, as wells as firms such as MediaMath, NetSeer, LiveRail and TubeMogul.

The companies tailor ads by embedding a fragment of code in your browser that tracks your comings and goings on the Internet. That means to avoid such advertising completely you have to opt out for each browser on each device you use. As Lazarus notes, opting out of ads delivered via your smartphone or satellite TV requires going to discrete links for each platform.

Though technology exists that allows customers to register their preference for all their devices, the phone companies have yet to adopt it. A spokeswoman for AT&T tells Lazarus that the company’s procedures are “consistent with industry practice.” Still, opt outs “should be as streamlined as possible,” he argues.

“The letter of the law may allow them to do things as they are now,” Jill Bronfman, director of the Privacy and Technology Project at UC Hastings College of the Law, told Lazarus, referring to the phone companies. “But the spirit of the law is that they need to offer consumer-friendly privacy options.”

Categories
Law Privacy

NIST publishes guidance for securing health records on mobile devices

How can health care providers secure mobile devices that physicians and other professionals use to send information about patients?

That’s the question at the center of a so-called practice guide published recently in draft form by the National Institute for Standards and Technology (NIST). Between now and Sept. 25, NIST seeks public comment on the guide, which illustrates how providers can assess cyber threats and secure electronic health records on smartphones, tablets and laptops, as well as the servers to which such equipment connects.

The effort reflects the reality that electronic health records, which the federal Health Information Technology for Economic and Clinical Health Act (HITECH Act) aims to spur adoption and use of, can be accessed in ways that compromise both privacy and patient care. According to NIST:

“Cost and care efficiencies, as well as incentives from the HITECH Act, have prompted health care groups to rapidly adopt electronic health record systems. Unfortunately, organizations have not adopted security measures at the same pace. Attackers are aware of these vulnerabilities and are deploying increasingly sophisticated means to exploit information systems and devices.”

At issue is the susceptibility of electronic health information to intrusion. NIST cites a report published in May by the Ponemon Institute that found malicious hacks on health care organizations now outnumber accidental breaches, and that the number of criminal attacks grew 125% in the last five years.

As the law firm King & Spalding notes, so far this summer the U.S. Department of Health and Human Services has logged 34 breaches of protected health information that each affected 500 or more people. Incidents include an attack on a server that held records for roughly 390,000 people at Medical Informatics Engineering, a software company in Indiana; the theft of a desktop computer containing health records for more than 12,500 people at Montefiore Medical Center in New York; and a cyberattack in June on UCLA Health System, where intruders made off with information for as many as 4.5 million people.

The practice guide proposed by NIST addresses such scenarios as the theft or loss of devices that had access to electronic health records; attacks on the networks of health care organizations, whether by hackers or intruders who gain access to the premises; installation of malware; or users who walk away while logged in to devices.

The guide, which is voluntary for stakeholders, mirrors a framework that NIST is developing pursuant to an order for reducing cyber risks to infrastructure that President Obama issued in February 2013. Federal law requires providers to assess risks to electronic health information regularly.

Categories
Law Privacy

Lawsuit over hacking of Facebook account timely, appeals court rules

A woman whose former boyfriend allegedly hacked into her email and Facebook accounts then sent and posted messages disparaging her sex life had two years from the discovery of each incident to sue for damages, an appeals court in New York City has ruled.

Chantay Sewell sued Phil Bernardin, with whom she had a romantic relationship for nine years starting in 2002, in January 2014, charging Bernardin with gaining access to her AOL email and Facebook accounts without her permission in violation of federal law.

Sewell alleged she discovered the intrusion into her AOL account after being unable to log in to her email on Aug. 1, 2011. The following February, Sewell discovered she could no longer log in to her Facebook account because her password had been changed.

A federal trial court in Brooklyn dismissed Sewell’s lawsuit against Bernardin after concluding she failed to file it within the two-year limitations periods set forth in both the Computer Fraud and Abuse Act and the Stored Communications Act, the laws that Sewell charged Bernardin with violating.

But the U.S. Court of Appeals for the 2nd Circuit disagreed with respect to Sewell’s Facebook-related claim. Writing for a three-judge panel in a ruling released Aug. 4, Judge Robert Sack noted that Sewell’s discovery of the trespass on her AOL account did not mean she should have discovered the alleged tampering with her Facebook account then, too.

“At least on the facts as alleged by the plaintiff, it does not follow from the fact that the plaintiff discovered that one such account—AOL e-mail—had been compromised that she thereby had a reasonable opportunity to discover, or should be expected to have discovered, that another of her accounts—Facebook—might similarly have become compromised,” Sack wrote.

That means Sewell’s lawsuit with respect to the breach of her Facebook account was timely, noted the court, which reversed the trial court’s dismissal of Sewell’s Facebook-related claim.

The laws under which Sewell sued differ slightly in their formulation of when the limitations period begins, Sack explained. The limitations period under the Computer Fraud and Abuse Act, which authorizes someone whose computer as been accessed without authorization to file a civil lawsuit against the intruder, began to run when Sewell learned that her account had been impaired.

The limitations period under the Stored Communications Act, which authorizes a person whose email, postings or other stored messages have been accessed without authorization to sue, starts when the victim discovers, or has a reasonable opportunity to discover, the intrusion.

The limitations periods under both laws may be insufficient in some situations, the court noted. “Even after a prospective plaintiff discovers that an account has been hacked, the investigation necessary to uncover the hacker’s identity may be substantial,” wrote Sack. “In many cases, we suspect that it might take more than two years.”

Categories
Law Privacy

Sony must face breach lawsuit, court rules

Sony Pictures must continue to defend a lawsuit filed by nine former employees whose personal information was stolen from the studio during a cyberattack last fall, a federal court has ruled.

The former employees sued Sony in March, charging the company with negligence, breach of contract and violation of confidentiality laws in failing to safeguard medical, financial and other personally identifiable information that the attackers later posted online and traded via the Internet. The plaintiffs charge they’ve have had to subscribe to identity-protection and credit-monitoring services, obtain credit reports and incur costs resulting from freezes to their credit.

Sony asked the U.S. District Court in Los Angeles to dismiss the suit, alleging that the former employees failed to show injury sufficiently concrete to establish standing.

The court disagreed. “Here, plaintiffs have alleged that PII was stolen and posted on file-sharing websites for identity thieves to download,” wrote Judge Gary Klausner in a ruling released June 15. “Plaintiffs also allege that the information has been used to send emails threatening physical harm to employees and their families. These allegations alone are sufficient to establish a credible threat of real and immediate harm, or certainly impending injury.”

According to the court, the costs incurred by the former employees also satisfy the requirement for injury on which a claim of negligence depends, although Klausner sided with Sony and dismissed part of the lawsuit that charged the company with failing to notify the former employees of the breach in a timely fashion.

The plaintiffs also established that a so-called special relationship exists between a company and its employees that allows the employees to later hold the employer responsible for negligence and breach of contract. According to the plaintiffs, Sony failed to shore up systems that stored records for human resources despite experiencing data breaches in the past.

Klausner agreed, noting that “to receive such compensation and other benefits, Sony required plaintiffs to provide their PII, including names, addresses, Social Security number, medical information, and other personal information.”

Sony’s alleged failure to defend its systems against a cyberattack also allows the former employees to charge the company with violating a California law that obligates employers to safeguard employees’ medical information, the court ruled.

Categories
cybersecurity Law

EU readies rules to bolster cybersecurity, require notice of data breaches

The European Union is readying an approach to cybersecurity that may subject services as Google and Facebook to breach notification requirements that mirror those for banks and health-care providers.

The Network and Information Security Directive, a proposal under consideration by the European Commission, would require companies in industries deemed critical to strengthen digital safeguards and report breaches to national authorities.

The directive represents one of the first attempts to legislate a rule for security breaches that crosses borders. That stands in contrast to the U.S., which has yet to adopt a national notification law and leaves companies to comply with a series of notification requirements set by states.

Members of the European Parliament who have been negotiating the rules have agreed to extend the reach of the directive to social networks, cloud computing platforms, commerce sites and other digital platforms, according to a report Friday by Reuters.

Under the terms of the directive, which was proposed in 2013, companies that operate so-called critical infrastructure in any of the 28 countries that constitute the EU will be required to report “significant security incidents” as well adopt measures to lessen the risk of cyber threats.

In addition to Internet companies, the directive would require companies in the financial, energy, health and transportation industries to report incidents “having a significant impact on the security of core services.” The EU currently requires telecommunications companies to report such incidents.

Members of the commission are expected to start work this September on a final version of the rule.

Ninety percent of large corporations and 74% of small businesses in the U.K. experienced a security breach in the past year, according to survey published recently by PwC.

Categories
Law Privacy

Phone companies should not be required to store call data, privacy advocates say

A federal rule that orders phone companies to retain records of calls for a year-and-a-half disregards the privacy of millions of Americans, according to a coalition of civil liberties groups that is asking the Federal Communications Commission to rescind the requirement.

As currently configured, the mandate that carriers hold for 18 months the name, address and telephone number of callers, along with numbers called and the dates, times and length of each call exposes consumers to data breaches, thwarts innovation and does little to aid law enforcement, according to a petition filed Tuesday with the FCC by the Electronic Privacy Information Center (EPIC) on behalf of itself and 28 organizations.

The retention requirement makes little sense in an age when phone companies bill customers for unlimited or non-measured calling, compared with a time when companies itemized calls, according to EPIC, which contends that requiring companies to keep such records in bulk results in retention of information about nearly all American adults regardless of whether the government suspects them of wrongdoing.

“These telephone records not only show who consumers call and when, but can also reveal intimate details about consumers’ daily lives,” wrote Marc Rotenberg, EPIC’s president. “These records reveal close contacts and associates, and confidential relationships between individuals and their attorneys, doctors, or elected representatives.”

According to EPIC, the FCC proposed 30 years ago to eliminate the record keeping entirely before the Department of Justice asked the FCC to extend the retention period to 18 from six months, contending that retaining phone records aided investigation and prosecution of criminal conspiracies. But the value of the records has eroded as billing has changed, charges EPIC, which notes that DOJ conceded as much in comments filed with the FCC in 2006. Further, law enforcement agencies still could request that records be retained in connection with investigations, said EPIC.

Retaining calling records also amplifies the risk of data breaches, such as the one recently at the Office of Personnel Management, according to EPIC. “The best strategy to reduce the risk of an attack and to minimize the harm when such attacks do occur is to collect less sensitive information at the outset,” the petition notes.

Discontinuing the requirement that carriers retain call records for 18 months would lower the cost of record keeping and allow phone companies to compete for customers on basis of privacy, “which many believe is the market-based solution to the enormous privacy challenge confronting the nation today,” Rotenberg added.

The FCC declined to comment on the petition.

Revisions last spring to post-9/11 surveillance laws ended bulk collection of phone call metadata by the government. Under the terms of the USA Freedom Act, the National Security Agency can obtain such information from phone companies if authorized by the Foreign Intelligence Surveillance Court. But the act does not require phone companies to collect or store metadata.

Categories
Law Privacy

Senate pushes cybersecurity bill to September

The U.S. Senate Wednesday agreed to postpone until September debate on a bill to bolster cybersecurity.

The legislation, known as the Cybersecurity Information Sharing Act, would direct the federal government to share cyber threats with businesses and shield companies that exchange information and best practices about cybersecurity from antitrust liability.

The deal addresses concerns expressed by senators who charged that the measure as it stands will fail to prevent cyberattacks or protect privacy sufficiently.

The agreement means that Democratic Senators Ron Wyden (Ore.), Patrick Leahy (Vt.) and Al Franken (Minn.), along with Republican Senators Rand Paul (Ky.) and Dean Heller (Nev.), all will be able to offer amendments they say strengthen civil liberties and improve the bill.

“We’ve got to debate some real things like cybersecurity, and have real amendments, not pretend amendments,” Leahy told National Journal.

Categories
Law Privacy

Senate to take up cybersecurity bill as concerns about privacy continue

The U.S. Senate is slated this week to take up legislation that aims to bolster cybersecurity by spurring businesses and the federal government to share information about digital threats and best practices with one another.

The measure, known as the Cybersecurity Information Sharing Act, would direct the federal government to develop ways to share information with the private sector while taking steps to protect privacy and civil liberties. The bill also aims to address antitrust concerns by shielding businesses that share information from enforcement of laws that otherwise might dissuade those businesses from cooperating. The House passed a similar measure in April.

The push represents the third time in as many years that Congress has tried to pass legislation that would encourage sharing of cyber threats. Recent cyberattacks on the Office of Personnel Management, Sony Pictures Entertainment and other targets have prompted legislators to try again. Cybercrime costs the global economy more than $400 billion annually, according to a study released jointly last summer by McAfee and the Center for Strategic and International Studies

Though the measure passed the Senate Intelligence Committee in March, maneuvering underway since then has centered on a tension between defending digital networks and protecting the privacy of Americans whose information is stored in those systems.

Among the concerns: the measure could result in companies handing over personally identifiable information to the National Security Agency. Such information might include, for example, the browsing history of someone who happens to have visited a website that becomes the subject of a cyberattack.

On Monday, Senator Al Franken, Democrat of Minnesota, released a letter from the Department of Homeland Security (DHS), which cautioned against allowing companies to share information with intelligence agencies without first channeling the information through DHS. “The Administration has consistently maintained that a civilian entity, rather than a military or intelligence agency, should lead the sharing of cyber threat indicators and defensive measures with the private sector,” wrote Alejandro Mayorkas, the deputy secretary of homeland security.

“The authorization to share cyber threat indicators and defensive measures with ‘any other entity or the Federal Government,’ ‘notwithstanding any other provision of law’ could sweep away important privacy protections, particularly the provisions in the Stored Communications Act limiting the disclosure of the content of electronic communications to the government by certain providers,” Mayorkas added.

Though Senators Richard Burr, Republican of North Carolina and chairman of the intelligence panel, and Dianne Feinstein, the committee’s top Democrat, have circulated an amendment that aims to address concerns over the legislation’s impact on privacy, some civil liberties groups say the fixes don’t go far enough. According to the Center for Democracy and Technology, the bill as modified still would authorize the government to use information about cyber threats to investigate and prosecute crimes of espionage, identity theft and trade secrets violations, regardless whether those infractions tie to cybersecurity.

The White House backs passage of cybersecurity legislation but has called on Congress to strengthen protections for privacy and to narrow an exemption from liability for companies that fail to secure their networks after receiving information they receive.

That leaves the question whether the measures actually may cause businesses and the government to exchange more information about cyber threats. While the measure aims to ease companies’ fears of legal liability, the Department of Justice and the Federal Trade Commission already have advised companies “that properly designed sharing of cyber threat information should not raise antitrust concerns.”

And as N. Eric Weiss of the Congressional Research Service observed in June, sharing of cyber threats happens currently. Industries ranging from retail to financial services participate in so-called information sharing and analysis centers (ISACs) that serve as clearinghouses for information about cyber threats.

“The ‘bottom line’ is how likely nonfederal entities—particularly businesses—value the benefits from sharing information against the cost of sharing,” wrote Weiss, who notes that neither bill would address the cost of membership in ISACs, which can cost anywhere from $10,000 to $100,000 to join and thus might exceed the ability of small and medium-sized businesses to afford.

Still, the wave of cyberattacks—and the fallout from them—might cause businesses to think anew about the advantages of sharing. “Although most data breaches have not been expensive compared with the revenues and profits earned,” noted Weiss, “recent events may change the attitude of boards of directors and senior management: the chief executive officers at Target and Sony Entertainment were forced to resign.”