Richard Burr

Mr. BURR

Mr. BURR. Mr. President, I appreciate the opportunity to say that I totally agree. The vice chairman and I have worked aggressively for the entirety of the year where we had differences, and we found ways to bridge those differences, where we heard from Members, where we heard from associations, where we heard from businesses. We worked with them to try to accommodate their wishes, as long as it stayed within the spirit of what we were trying to accomplish, which is information sharing in a voluntary capacity. The vice chair and I came to the floor yesterday and said if an amendment--if an initiative falls outside of that, then we will stand up and oppose it because we understand the role this legislation should play in the process. The vice chairman said this is the first step. I don't want to scare Members, but there are some other steps. We are not sure what they are today or we would be on the floor suggesting those, but if we can't take the first step, then it is hard to figure out what the next and the next and the next are. So I am committed to continuing to work with the vice chairman and, more importantly, with all Members to incorporate their great suggestions as long as we all stay headed in the same direction, and I know the vice chairman and I are doing that.

Mr. BURR. Mr. President, I call for the regular order with respect to the Cotton amendment No. 2581.

Mr. BURR. Mr. President, I ask unanimous consent that the order for the quorum call be rescinded.

Mr. BURR. Mr. President, I am here to briefly talk on S. 754, the cyber security bill. Yesterday Vice Chairman Dianne Feinstein and I came to the floor and encouraged our Members who had amendments or who had an interest in debating the bill to come to the floor. It was my hope that we could finish in a couple of days with the cooperation of Members. We have not gotten that level of cooperation. Therefore, this will take several more days to finish. But it doesn't lessen the importance for those Members who have amendments in the queue--meaning they are pending--to come to the floor and talk about their amendments if they would like to. At some point, we will culminate this process, and those amendments that have yet to be disposed of will have votes with a very limited amount of debate time included. It is my hope that we will have a wholesome debate and that people will have an opportunity to know what is in this bill if they don't today. But more importantly, through that debate we are able to share with the American people why a cyber security bill is so important and, more importantly, why we have done it in a way that we think it will be embraced and endorsed by not just corporate America but by individuals throughout the country. Let me announce today that this bill will be done either Monday evening or Tuesday morning based upon what the leadership on both sides can agree to as it relates to the debate. The Vice Chair and I also came to the floor and we made this statement: We have worked aggressively in a bipartisan way to incorporate in the managers' package, which is currently pending, 14 amendments, and 8 of those amendments were included in the unanimous consent agreement made earlier this year when we delayed consideration of the bill until the day when we moved forward. There were several amendments on which we weren't able to reach an agreement or that we believed changed the policy significantly enough that this was not just an information sharing bill that was voluntary for corporations throughout this country. In the absence of being able to keep this bill intact in a way that we thought we needed to, the Vice Chairman and I have agreed to lock arms and to be opposed to those additional amendments. Having said that, the debate to date has focused on the fact that there are technology companies across this country that are opposed to this bill. Yesterday the Vice Chairman and I repeatedly reminded our colleagues and the American people that this is a voluntary bill. There is nothing mandatory in it. The reality is that if you don't like what is in this, if for some reason you don't want to participate in what I would refer to as a community watch program--it is real simple; it is voluntary--do not participate. Choose not to inform the Federal Government when hackers have penetrated your system and stolen personal data out of it. Just choose not to tell us. But do not ruin it for everybody else. In a minute I am going to go through again why I think the cyber security bill should become law, why I think this is the first step of how we protect the personal data of the American people, and why hundreds, if not thousands, of businesses support this information sharing bill. But I can't stress that enough for those who oppose this. Most of them are, in fact, companies that hold the most private data in the world. Let me say that again. Those who are expressing opposition to this bill hold the largest banks of personal data in the world. The decision as to whether they are for the bill or against the bill is their decision. The decision whether they utilize this voluntary program to further protect the personal data that is in their system is between them and their customers. But I have to say that it defies reason as to why a company that holds that much personal data wouldn't at least like to have the option of being able to partner with the Federal Government in an effort to minimize data loss, whether it is at their company or whether it is in their industry sector or whether it is in the global economy as a whole. The last time I checked, the health of U.S. businesses was reliant on the health of the U.S. economy, and the health of the U.S. economy is affected by the health of the global economy. I know the Presiding Officer understands that because he was in business like I was for 17 years. It really does concern me that one could be opposed to something that insulates the U.S. economy from having an adverse impact by the cyber security act and believes that they are OK even though it might tank the U.S. economy. At the end of the day, I want to try to put this in 101 terms, the simplest terms of what the information sharing bill does. I am going to break it into three baskets. It is about business to business. This bill allows a company that has been hacked--where somebody has penetrated their computer system and has access to their data--to immediately pick up the phone and call their competitor and ask their competitor whether they have had a similar penetration of their system. It is only reasonable to expect that the first person you would go to is a company that has a business that looks exactly like yours. In that particular case, this legislation provides that company with protection under the anti-trust laws. Anti-trust forbids companies from collaborating together. What we say is that if it has do with minimizing the loss of data, we want to allow the collaboration of competitors for the specific reason of discussing a cyber attack. The Senate recognizes I have designed something in this that doesn't require a corporate lawyer to sit in the room when the decision is made. I have no personal dislike for lawyers other than the fact that they slow things down. To minimize the loss of data means you have to have a process that goes in real time from the bottom of the chain all the way to the decisionmaking and the communication back down, not only to that business, but to the entire economy. Having a lawyer that has to think whether we can legally do this defeats the purpose of trying to minimize data loss. So we give them a blanket exemption under the anti-trust laws so they know up front that they can pick up the phone and call their competitor, and there is no Justice Department that will come down on them as long as they confine it to the discussion of cyber attack. At the same time we initiate what I call business to government, which means that when the IT department is talking to their competitor, the IT department can put out a notification through the Federal portal that they have been attacked, and that initiates the exchange of a limited amount of information that has been predetermined by everybody in the Federal Government who needs to do the forensics of who attacked, what tool they used, and what defensive mechanism could be put up in the way of software that would eliminate the breach. In the statute we have said, one, you can't transmit personal data unless it is absolutely crucial to understanding the forensics of the attack. We have also said in statutory language to the government agencies: If for some reason personal data makes it through your filters, you cannot transmit that personal data anywhere else within the Federal Government or to the public. We have gone to great lengths to make sure that personal data is not disclosed through the notification process of a hack. I understand that the personal data has already been accessed by the individual who committed the act, but we want to make sure that the government doesn't contribute to the distribution of that data. In order to create an incentive in a voluntary program for a business to initiate that notification to the Federal Government, we provide liability protection. Anytime a company allows personal data or data on their business to get out, there could potentially be a shareholder's suit. What we do is provide a blanket liability protection to make sure that a company can't be sued for the government notification of a security breach where data has been removed and it is in the best interest of the government to know it, to react to it, and for the general population of businesses in America to understand it. So we have business-to-business collaboration with your competitor, anti-trust protection, business-to-government liability protection, no personal data transmitted, and the last piece is government to business. It is hard for me to believe that the government didn't have the statutory authority to convey to businesses across America when a cyber attack is in progress. The Federal Government has to be asked to come in and typically will be asked by the company that has been attacked, but how about their competitors? How about the industry sector? How about the whole U.S. economy? There is no authority to do that. This bill creates the authority in the Federal Government to receive that information from a company that has been penetrated, to process it, to understand who did it, to understand the attack tool they used, to determine the defensive mechanism of software that it can be put on, and then to notify American businesses that there is an attack happening now, and here is the attack tool and software you can buy off the shelf and put on your computer system to protect you. That is it. That is the entire information sharing bill, and it is voluntary. I will touch on eight items very briefly. Why is there a need for cyber legislation? I don't want to state the obvious, but we have already seen that individuals and nation states penetrate the private sector and steal personal data, and the Federal Government can steal personal data. I thought it would hit home with my colleagues when the Office of Personnel Management was breached, and now we are up to 22 to 24 million individuals who were compromised. More importantly, the personal data at OPM extended to every individual who had ever applied for a security clearance, who had ever been granted security clearance, and who had security clearances and are now retired, but for some reason that application remained in the database. That application, which consists of 18 pages, has the most personal information one can find. It lists your parents and their Social Security numbers, your brothers, your sisters, where you lived since you graduated from college. It even has a page that asks you to share the most obvious way that someone might blackmail you. It has probably some of the most damaging personal information that one can have breached. Cyber attacks have harmed multiple U.S. companies. If this weren't serious, would the President of China and the President of the United States, when they met several weeks ago, have come to an agreement about how they would intercede if one country or the other commits a cyber attack against each other? Probably not. Our bill is completely voluntary, and I think it is safe to say that those who want to share data can, in fact, share data on this. I mentioned the words ``real time.'' What we want to do is create a real-time system because we want a partnership. We want a partnership with other private companies and we want a partnership with the private and public sector, and you can't get a partnership by mandating it. All you can get is an adversarial relationship. We maintain that voluntary status in the hope that the sharing of that information is, in fact, real time. We can control--once you transmit to the Federal Government--how to define ``real time.'' I have no control over a private company's decision once they know they have been breached to the point that they actually make a notification to the Federal Government, but with the liability protection and anti-trust coverage, we are convinced that we are structured from the beginning to create an incentive for real time to take place. We protect personal privacy. Many have come to the floor and have suggested that this is a surveillance bill. Let me say to my colleagues and to the American people: There is no capability for this to become a surveillance bill. The managers' amendment took those items that people were concerned with and eliminated it. We can be accused of a lot of things, but to accuse this of being a surveillance bill is either a sign of ignorance or a sign that one is being disingenuous. It is not a surveillance bill. Be critical of what we are attempting to do, be critical of what we do, but don't use the latitude to suggest that this is something that it is not. We require private companies and the government to eliminate any irrelevant personal, identifiable information before sharing the cyber threat indicators or putting up defensive mechanisms. This bill does not allow the government to monitor private networks or computers. It does not let government shut down Web sites or require companies to turn over personal information. This bill does not permit the government to retain or use cyber threat information for anything other than cyber security purposes, identifying a cyber security threat, protecting individuals from death or serious bodily or economic harm, protecting minors, or investigating limited cyber crime offenses. This bill provides rigorous oversight and requires a periodic interagency inspector general's report to assess whether the government has violated any of the requirements in this bill. The report also will assess any impact this bill may have on privacy and civil liberties. In the report, we require the IG to report to us whether anybody does anything outside what the statute allows them to do, but we also ask the IG to make a gut call on whether we have protected privacy and civil liberties. Finally, our managers' amendment has incorporated an additional provision to enhance privacy protections first. Our managers' amendment omitted the government's ability to use cyber information to investigate and prosecute serious and violent felonies. Let me raise my hand and say I am guilty. I felt very strongly that that should have been in the bill. If we find during an investigation that an individual has committed a felony that is not related to a cyber attack, I thought we should turn that information over to law enforcement but, no, we dropped it. I don't want there to be any question as to whether this is an effective cyber information sharing bill. Our managers' amendment limited cyber threat information sharing authorities to those items that are shared for cyber security purposes. Both of these changes ensure that nothing in our bill reaches beyond the focus of cyber security threats that are intended to prevent and deter an attack, and nothing in this bill creates any potential for surveillance authorities. Now, as I said, despite rumors to the contrary, this bill is voluntary. It is a voluntary threat indicator to share with authorities and does not provide in any way for the government to spy on or use library and book records, gun sales, tax records, educational records, or medical records. There is something in that for every member of every State. I can honestly look at my librarians and say we haven't breached the public libraries' protection of personal data. I will say librarians are not fans of this legislation. I don't think they have read the managers' amendment that spells out the concerns we heard and then said: This can't go there. I am not sure we can statutorily state it any clearer than what we have done. Given that cyber attackers have hacked into, stolen, and publicly disclosed so much private, personal information, it is astounding to me that privacy groups would oppose this bill. It has nothing to do with surveillance, and it seeks to protect private information from being stolen. There are no offensive measures. This bill ensures that the government cannot install, employ or otherwise use cyber security systems on private sector networks. In other words, no one can hack back into another computer, even if the purpose is to protect against or squash a cyber attack. It can't be done. It is illegal. The government cannot retain or use cyber threat information for anything other than cyber security purposes, including preventing, investigating, disrupting, and prosecuting limited cyber crimes, protecting minors, and protecting individuals from death or serious bodily harm, or economic harm. The government cannot use cyber threat information in regulatory proceedings. Let me state that again. The government cannot use cyber threat information in regulatory proceedings. If somebody believes this is not voluntary and that there is some attempt to try to get a mandatory hook in here where regulators can turn around and bypass the legislative responsibility of the Congress of the United States, let me just say, we are explicit. It cannot be done. But we are also explicit that the government cannot retain this information for anything other than the list of items I discussed. This provides focused liability protection to private companies that monitor their own systems and share cyber threat indicators and defensive mechanisms in accordance with the act, but the liability protection is not open-ended. This doesn't provide liability protection for a company that engages in gross negligence or willful misconduct. I am not a lawyer, but I have been told that ties it up pretty tightly; that it makes a very small, narrow lane that companies can achieve liability protection, and that lane means they are transferring that information to the Federal Government. Last, independent oversight. This bill provides rigorous oversight. It requires a periodic interagency inspector general's report to assess whether the government has violated any of the requirements of this act. The report also will assess any impact that this bill may have on privacy and civil liberties as well as an assessment of what the government has done to reduce any impact. This bill further requires an independent privacy and civil liberties oversight board to assess any impact this bill may have on privacy and civil liberties and is, in fact, reviewed internally by an inspector general. The inspector general checks to make sure they live by the letter of the law. The inspector general makes an assessment on the privacy and civil liberties, and we set up an independent board to look at whether, in fact, privacy and civil liberties have been protected. I say to my colleagues, if there is more that they need in here, tell us what it is. The amendment process is open. Here is where we are. Privacy folks don't want a bill, period. Some Members don't want a bill, period. I get it. I am willing to adapt to that. I only need 60 votes for this to pass, and then I have to conference it with the House that has two different versions. Then I have to go to the other end of Pennsylvania Avenue, and I have to convince the President and his whole administration to support this bill. Let me quote the Secretary of the Department of Homeland Security. They support this bill. The National Security Council tomorrow is going to come out in support of this bill. Why? Because most people recognize the fact that we need this, that this is the responsible thing to do. This is why Congress was created. If, in fact, there are those who object, don't participate. I say to those businesses around the country, I am not going to get into your decisionmaking, although I think it is flawed. You hold most of the personal data of any companies out there. Yet you don't want to see any coordinated effort to minimize data loss in the U.S. economy. I think that is extremely shortsighted. I think your customers would disagree with you, but the legislation was written in a way that allows you to opt out and to say: I don't want to play in this sandbox. I say to my colleagues and to the American people: Is that a reason for us not to allow the thousands of companies that want to do it, representing hundreds of thousands and millions of customers who want to protect their credit card number, their health records, all the personal data that is out there on them--if they want to see that protected, should they not have that done because some companies say they don't want to play? No. We make it voluntary, and we allow them to opt out. They can explain to their customers why. If I am with another tech company and they are participating in this, they must be more interested in protecting my data. I think it is a tough sell myself as a guy in business for 17 years. I know what is up here. Some are looking at this as a marketing tool. They are going to go out and say: We don't participate in transferring data to the Federal Government. Oh, really. Wait until the day you get penetrated. Wait until the day they download all of that personal information on all of your customers. You are going to be begging for a partnership with the Federal Government. Then we are going to extend it to you, whether you liked it or not, whether you voted for the bill or supported the bill or spoke in favor of the bill or ever participated in it. If we pass this bill, which I think we will, they will have an opportunity to partner with the Federal Government and to do it in an effective way. In the meantime, I think there will be just as many businesses using a marketing tool that says: We like the cyber information sharing bill, and if we ever need to use it, we are looking forward to partnering with the Department of Homeland Security, the FBI, and the National Security Agency because we want to minimize the exposure of the loss of data our customers could have. Mark my words. There is a real battle getting ready to brew here. Again, putting on my business hat, I like the idea of being able to go out and sell the fact that I am going to partner if something happens much better than selling the pitch that I am going to do this alone. Think about it. A high school student last week hacked the personal email account of the Secretary of the Department of Homeland Security and the Director of the CIA. This is almost ``Star Trek.'' ``Beam me up, Scotty.'' There are people who believe that this is just going to go away. It is not going away. Every day there is an attempt to try to penetrate a U.S. company, an agency of the Federal Government for one reason: to access personal data. The intent is there from individuals and from nation states. For companies that think this is going to go away or think they are smart enough that it is not going to happen to them, I have seen some of the best and they are one click away from somebody downloading and entering their system and that click may not be protected by technology. It may be the lack of ability of an employee to make the right decision on whether they open an email, and, boom, they have just exposed everybody in their system. So I will wrap up because I see my good friend and colleague Senator Wyden is here. We will have several days, based upon the process we have in front of us, to talk about the good, and some will talk about the bad, which I don't think exists, but let me assure my colleagues that the ugly part of this--the ugly part of this--is that cyber theft is real. It doesn't discriminate. It goes to where the richest pool of data is. In the case of the few companies that are not supportive of this bill, they are the richest depositories of personal data in the world. I hope they wake up and smell the roses. I yield the floor.

Mr. BURR. Reserving the right to object.

Mr. BURR. Mr. President, let me say to the authors, I have deep respect for both of you, and you have done an incredible job with this bill. It is one of the reasons I am a cosponsor, because it is good legislation. It is no surprise to the Senate that I have had a deep desire to add the Land and Water Conservation Fund reauthorization, which has expired, as an amendment to this bill. I seek no time. I only seek the vehicle for an up-or-down vote and a ride--a ride that I can't seem to get by itself. As a matter of fact, I think the authors of this bill know that I have said if somebody can offer me a stand-alone opportunity to debate and vote on the Land and Water Conservation Fund, we can unanimous consent TSCA. We can't achieve that. I certainly don't want to take anything away from what I think is a great bill, and I wouldn't even require time, I would only require a vote. So I would ask the authors to modify their unanimous consent request to include a vote on the Burr-Ayotte-Bennet amendment in relation to the Land and Water Conservation Fund.

Mr. BURR. I ask unanimous consent that the consent be modified to include a vote on the Burr-Ayotte-Bennet amendment in relation to the Land and Water Conservation Fund.

Mr. BURR

Mr. BURR. Mr. President, I thank Senator Udall. He is a cosponsor of the permanent reauthorization of the Land and Water Conservation Fund. I came to the Senate prior to the expiration of the Land and Water Conservation Fund with the hope that my colleagues would give it a 60- day extension. It has now expired. The 60-day extension on an expired act isn't even an offer that is on the table. For my colleagues, let me just remind you that the Land and Water Conservation Fund has been around a long time--50 years. Some say: They have $20 billion in funds; why don't they just draw on it? It is because they receive about $900 million a year in royalties off of offshore exploration of energy. Congress in its infinite wisdom said if we are going to tap our natural resources we are going to put part of the royalties of that back into conservation. The unfortunate thing is they never got the $900 million a year. Our appropriators in the Congress have seen fit to give them on average over the life of this fund about $390 million a year. Some of my colleagues suggest that there is a fund over there, the Land and Water Conservation Fund, and you could just tap it. Well, no, there isn't. The appropriators spent that money long ago. As a matter of fact, this year it was just over $350 billion for the Land and Water Conservation Fund. So as delighted as I am that he has sponsored the permanent reauthorization, most Members believe that we should reauthorize this permanently. So I would ask the Senator to modify his unanimous consent request to make the amendment read that we would take up the Murkowski- Cantwell permanent extension language.

Mr. BURR. I object to the last unanimous consent request.

Mr. BURR. And on the current unanimous consent request, if I can address that, reserving the right to object, again, without being repetitive, this is a 1-year extension. The beauty of the effort by Senator Cantwell and Senator Murkowski, a bipartisan approach to the Land and Water Conservation Fund, addresses exactly what Senator Lee asked for, a reformed bill. This is a package that has been negotiated by Republicans and Democrats--the chairman of the energy committee and an individual who is extremely invested in the Land and Water Conservation Fund. So I would once again ask the Senator to modify his unanimous consent request to make that amendment read that we move to the Murkowski- Cantwell permanent extension language.

Mr. BURR. Mr. President, I thank Senator Udall for his work on TSCA. His description is pretty accurate. I am doing what the Senate historically has always done, allowing any Member of the Senate to exercise their authority as a Member of this austere body to amend any piece of legislation, and the Senate has functioned for a long time based upon that. It is just recently that we have not allowed that to be exercised. In other words, one Senator can't come to the floor and offer an amendment. He can't come to the floor and propound a unanimous consent request without objection. It has to change. I dare say that TSCA has overwhelming support and so does the Land and Water Conservation Fund. For us to get functional we have to return to where we expect Members to come. I have nongermane amendments on the cyber security bill, and they would all receive a vote if somebody hadn't objected, and we would actually see the Senate process exactly like it is supposed to, where if a nongermane amendment has 60 votes in favor of it, then it is added. I am not scared to have nongermane amendments on my bill. I have them, and because of somebody's fear, they will get knocked off and two Members of the Senate, a Republican and a Democrat, will not get their day to have a vote on their bill. I don't object to the Land and Water Conservation Fund being a part of it, as I just expressed. What I object to and what I am disappointed about is that there would be an offer to do a 60-day extension or a 1- year extension from a Member that I know supports permanent reauthorization, because this whole deal on TSCA is to make me look bad. Well, you know what; so be it. I am willing to accept it. I have had the hounds sicced on me. We are at a point now where there is no damage you can do, and what we saw was a nice orchestrated process that was supposed to make me back down. It is not going to happen. I believe in the Land and Water Conservation Fund. The Senate will take it up, whether it is on this bill or another bill or as stand-alone bill. And let me just say to my good friend that what we are doing has not been a surprise. I shared with all the authors of this bill that I am going to amend it. I am going to amend it with this. So I hope he agrees that I am not trying to pull a swift one. I have been straight up on this since the beginning, and I will continue to press for it. Here is the solution. Allow us to have a debate on the Land and Water Conservation Fund permanent reauthorization on the floor of the Senate with an up-or-down vote. If we don't get 60 votes, it doesn't pass. That is the way the Senate is. If Members want this bill or any other bill passed, it is very simple. Let's get the process back like it is supposed to be, and with one assurance: that we will get an opportunity to debate the Land and Water Conservation Fund and have a vote. I am a cosponsor of your bill. I will lift my objection, my attempt to try to amend it, and we will pass it by unanimous consent. It is that simple, and there is described the history of how the Senate has always worked. Let's get back to it. I yield the floor. I suggest the absence of a quorum.

Mr. BURR

Mr. BURR. Mr. President, we are quickly moving to a point where I think the majority leader will come to the floor and will call up the cyber security bill. Let me remind my colleagues that we have been on the floor briefly before, and the conclusion then was that we agreed to a unanimous consent request that made in order 22 amendments. It was not a limiting UC. So there is the opportunity for additional amendments to come to the floor. As we start, I say to my colleagues that if we have a level of cooperation by the Members--if in fact they come, debate, and vote on amendments-- we can resolve this in literally a matter of a couple of days. If people want to try to obstruct, then it is going to be a lengthy process procedurally. I don't think there is a lot new that we are going to learn. What is the fact? The fact is that actors around the world continue to attack U.S. systems and, in many cases, penetrate them: Sony Films, Anthem Health, OPM. The Presiding Officer, as a member of our committee, knows that the amount of personal data that is being accumulated out there somewhere provides almost a roadmap to everything about anybody. What we are attempting to do with this cyber bill I want the American people to understand: This is not to prevent cyber attacks. I would love to figure out technologically how we do it. Nobody has been able to do it. What this is designed to do is to minimize the data that is lost, to minimize the personal information that an individual gleans out of going into a database and pulling out that information. The vice chairman and I have worked with other members of the committee to report a bill out of the committee on a 14-to-1 vote. We are now almost 3 months behind the House of Representatives, which has passed two bills that we desperately need to get out of the Senate in a piece of legislation that we could conference with the House of Representatives. In a conversation just this morning that I had with the White House, they are supportive of this bill getting out of the Senate and having the bill on the President's desk so that he could sign it into law and we could have this in place. Let me make some overall points on the cyber bill. One, most importantly, it is voluntary. Any business in America can choose to participate or not to participate. They can tell the Federal Government that they have been penetrated. They can provide the appropriate data for us to begin the forensics and to tell them in real time: Here is a defensive software package you can put on your system that will make it immune from that tool again. But more importantly, it might minimize the amount of data that is lost and certainly would allow the government to then broadcast to business more widely: Here is the tool that is being used today and here is the defensive mechanism to keep other businesses from having the same penetration and data loss. Now, it is important that I say that when we started there were 22 amendments that were placed in order. I am proud to tell my colleagues that we have worked out eight of those amendments. They will be incorporated in a managers' amendment that will also have an additional six amendments that we think strengthen the concerns that have been expressed about privacy. They also address certain areas of cross- jurisdiction, such as the Department of Homeland Security. We now have those chairmen and those ranking members fully on board in support of this legislation. Now we have to go through the process. At the root of this is moving forward a piece of legislation on cyber that is a voluntary piece of legislation by companies. I mentioned real time. I know the Presiding Officer has heard this in committee. If we can't promise real time, we can't promise to anybody who is willing to provide the data that we can actually stop or minimize data loss. So it is absolutely crucial that this all function in real time. To have a voluntary program that involves real time transfer of information means that there have to be incentives for that to be done. Let me just point out two things. For a company to talk to a competitor after they have been attacked and penetrated, we provide antitrust protection to them to talk directly to that competitor as fast as they possibly can to find out whether we have multiple systems that are at risk. For the company to report to the Federal Government we provide liability protection just for the transfer of that information. As Members read the bill, they will see that statutorily we don't allow personal data that is unrelated to the forensics--needed to identify who did the attack, with what type of a tool, and what the defensive mechanism is--that statutorily cannot be transferred from a private company to the government. Additionally, we say to every Federal agency that might receive in real time this data that if there is personal data that is transmitted from a company to the Federal Government, you cannot distribute personal data. I am not sure how it gets stronger than where we are, but I have come to this conclusion after working on this legislation for this entire year--and the vice chairman has worked on it for multiple years: There are some people who don't want legislation. We have met with every person who had a good thought--legislation that would send us in a positive direction but still embrace the policy found in this legislation. It is limited, but there are some who we can't in fact satisfy. So let me say this to those companies that have expressed opposition to this piece of legislation. It is really clear. Choose not to participate. It is voluntary. To those companies that find no value in it, if you have an aversion to what we have written, don't participate--even though a majority of businesses in America are actually calling my office and the vice chairman's office saying: When are we going to get this done? We need this. We need it. It is that simple. That is the beauty of it being voluntary. Voluntary also means that the U.S. Chamber of Commerce is 100 percent supportive of this legislation. Now we never have full agreement from a membership of an association, but it takes a majority--in fact, it takes well over a majority--for an organization such as that to come out publicly supporting it. So I say very boldly, if you don't like the piece of legislation, it is real easy: You just don't participate in it. Some have called this a surveillance bill. Let me just knock that down real quick. First, this bill requires private companies and the government to eliminate any irrelevant personal, identifiable information before sharing cyber threat indicators or defensive measures. Second, this bill does not allow the government to monitor private networks or computers. Third, this bill does not allow the government to shut down Web sites or require companies to turn over personal information. Fourth, this bill does not permit the government to retain or use cyber threat information for anything other than cyber security purposes, identifying the cyber security threat, protecting individuals from death or serious bodily or economic harm, and protecting minors or investigating limited cyber crime offenses. Fifth, it provides rigorous oversight and requires a periodic interagency inspector general report to assess whether the government has violated any of the requirements found in this act. The report would also assess any impact this bill may have on privacy and civil liberties. Finally, our managers' amendment has incorporated additional provisions that enhance privacy protection. First, our managers' amendment omitted the government's ability to use cyber information to investigate or prosecute serious violent felonies. Personally, I thought that was a pretty good thing. I can understand where it is outside of the scope of a cyber bill, but information about a felony that you learned in this I thought was something the American people would want us to act on. Individuals raised issues on it. We dropped it out of the bill. Secondly, our managers' amendment limited cyber threat information sharing authorities to those that are shared for cyber security purposes. In other words, it is only for cyber security purposes. Both of these changes ensure that nothing in our bill reaches beyond the focused cyber security threats that it intends to prevent and deter. Nothing in this bill creates any potential for surveillance authorities. Despite rumors to the contrary, CISA's voluntary cyber threat indicator sharing authorities do not provide in any way for the government to spy on or use library and book records, gun sales, tax records, educational records or medical records. Given that cyber hackers have hacked into and stolen so much publicly disclosed private, personal information, it is astounding that privacy groups would oppose a bill that has nothing to do with surveillance and seeks to protect their private information from being stolen. I guess that has been the most troubling aspect of the road we have traveled--that we are trying to protect personal data, and yet the groups that say they are the stewards of personal data are the ones that, in fact, are the most vocal on this. CISA ensures the government cannot install, employ or otherwise use cyber security systems on private sector networks. No one can hack back into a company computer system even if their purpose is to protest against or quash cyber attacks. The government cannot retain or use cyber threat information for anything other than cyber security purposes; preventing, investigating, disrupting or prosecuting limited cyber crimes; protecting minors; and protecting individuals from death or serious bodily or economic harm. The government cannot use cyber threat information in regulatory proceedings. That is what we are here talking about. This is voluntary and it is targeted at minimizing data loss. It is targeted at trying to protect the personal data of the American people found in every database in every company around the world. Mr. President, I am going to turn to my vice chairman as we get ready for Senator Wyden to make remarks and for leader McConnell to come to the floor. I would put Members on notice once again. It is our intent to have some opening comments, to actually make the managers' amendment pending, to make those amendments that were part of the unanimous consent agreement but not worked out as part of the managers' package pending. I encourage those Members who have authorship of those pending amendments to come and debate them, and we will schedule a vote for them. If you have additional amendments, come and offer those amendments and we will start debate on it. It is our goal, with the cooperation of Members, to work expeditiously through all of the amendments one wants to consider and to dispose of them and to finalize cyber security legislation in the Senate so we can move to the House and conference a bill. I yield the floor.

Mr. BURR. Mr. President, I ask unanimous consent that the order for the quorum call be rescinded.

Mr. BURR. Mr. President, I listened patiently to my friend and colleague, and we are on the committee together, so this is not the first time we have had a frank discussion. But let me say to those companies that have reached out to him, and he listed them--I am not going to bother going through 53 associations and the number of companies that are represented because there are hundreds and hundreds. They are sectors of our economy. It is the financial industry. It is automotive. It is practically everybody in retail. There are a couple of things that still shock me because I really can't make the connection. A technology company has a tremendous amount of users, and those users put their personal data on that--pick one-- and the company says there is nothing more important than protecting the data of their users. It strikes me, because I was in business for 17 years before I came to this insane place, that any business in the world would say: I don't have a problem with putting this in place as long as I don't have to use it. I can make a decision whether I use it or whether I don't. It may be that when they get an opportunity to see the final product and it is in place, they may say: Well, you know what, this isn't so bad. This actually took care of some of the concerns we have. But to make a blanket statement for a company whose No. 1 concern is the protection of its customers' data--to ignore the threat today that is real and will be felt by everybody, if it hasn't been felt by them, and not have something in place is irresponsible by those companies. Again, I point to the fact that if this were a mandatory program, I could understand why they might, for market share reasons or marketing reasons, go out and say: We are not covered by this. But this is voluntary for everybody. There is not a soul in the world who has to participate. But the ones that are really concerned about their customers' data, the ones that really understand there are companies, individuals, and countries trying to hack their systems will succumb to the fact that something is better than nothing. It is sort of like going home to North Carolina--and I see the leader is coming--where this year we have had a rash of sharks. It is one thing to know there are sharks out there and swim and say: How could one bite me? Well, you know you have hackers out there. It seems as if you take precautions when you go swimming, and it seems as if you should take precautions to keep from being hacked. With that, I yield the floor.

Mr. BURR

Mr. BURR. Mr. President, as under the previous order, I call up the Burr-Feinstein amendment, which is at the desk, and I ask unanimous consent that it be reported by number.

Mr. BURR. Mr. President, for the information of all Senators, this substitute includes agreed-upon language on the following amendments: Carper, No. 2615; Carper, No. 2627; Coats, No. 2604; Flake, No. 2580; Gardner, No. 2631; Kirk, No. 2603; Tester, No. 2632; Wyden, No. 2622, and, I might add, a handful of amendments that have been worked out in addition to those which were part of that unanimous consent agreement by both the vice chair and myself. The vice chair and I have a number of amendments to be made pending under the previous consent order, and I ask unanimous consent that they be called up and reported by number.

Mr. BURR. Mr. President, I call up the Cotton amendment No. 2581, as modified, to correct the instruction line.

Mr. BURR. Mr. President, let me add at this time that the vice chairman and I have worked aggressively, as have our staffs, to incorporate the suggestions and the concerns Members and companies have raised with us. If we believed they made the legislation stronger-- stronger from the standpoint of minimizing data loss and stronger from the standpoint of the privacy concerns--let me assure my colleagues we have accepted those and we have incorporated them in the managers' amendment. If, in fact, we couldn't agree or felt that it in any way was detrimental to the legislation, the vice chair and I have agreed to oppose those amendments. I think it is important that this bill represent exactly what we have sold: an information sharing bill, a bill that is voluntary. So I would suggest to those who hear this debate and say ``I don't really understand all this cyber stuff. I hear about it and don't really understand it,'' let me put it in these terms. What this legislation does is it creates a community watch program, and like any neighborhood watch program, the spirit of what we are trying to do is to protect the neighborhood. It doesn't mean that every resident on every street in that community in that neighborhood is going to be a participant, but it means that neighborhood is committed to making sure that if crimes are happening, they are out there to stop them, to report them, and maybe through reporting them, the number of crimes over time will continue to decrease. Well, I would share with you that is what we are doing with the cyber security bill. We are out now trying to set up the framework for a community watch program, one that is voluntary, that doesn't require every person to participate, but it says: For those of you who can embrace this and can report the crimes, it is not only beneficial to you, it is beneficial to everybody. So I respect the fact there are a few companies out there saying: This is no good; we shouldn't have this. Really? Do you want to deny this to everybody? There are a heck of a lot of businesses that have made the determination that this is beneficial to their business, that it is beneficial to their sector. This is beneficial to the overall U.S. economy. That is what the Senate is here to do. We are not here to pick winners and losers; we are here to create a framework everybody can operate in that advances the United States in the right direction. Shortly we will have an opportunity to make pending some additional amendments, and I encourage all Members, if your amendment is pending, to come down and debate it. If you have additional amendments, please come down and offer them and debate them. With the cooperation of Members, we can process these in a matter of days and we can then send this out of the Senate and be at a point where we could conference with the House. With that, I suggest the absence of a quorum.

Mr. BURR. Madam President, I call up the Flake amendment No. 2582.

Mr. BURR. Madam President, I call up the Paul amendment No. 2564, as modified, to correct the instruction line.

Mr. BURR. Madam President, I call up the Heller amendment No. 2548, as modified, to correct the instruction line.

Mr. BURR. Madam President, as the vice chair and I have said numerous times this afternoon, nothing would make us happier than for Members to come to the floor. We have amendments pending. We have a managers' amendment. Everybody knows exactly what is in this bill. Let's start the debate. Let's vote on amendments. Let's end this process in a matter of days. We are prepared to vote on every amendment. So at this time, I ask unanimous consent that on Thursday, October 22, at 11 a.m., the Senate vote on the pending amendments to the Burr- Feinstein substitute to S. 754, with a 60-vote threshold for those amendments that are not germane; and that following the disposition of the amendments, the substitute, as amended, if amended, be agreed to, the bill, as amended, be read a third time, and the Senate vote on passage with a 60-vote threshold for passage.

Mr. BURR. Madam President, the Senate functions best when Members are free to come to the floor and offer amendments, debate the amendments, and have a vote on the amendments. I might even share Senator Wyden's concerns about that particular piece of legislation. I am not sure. It is a judiciary issue. The vice chair is on the Judiciary Committee. It is an amendment that we were not able to pass in the managers' amendment. But as the vice chair and I said at the beginning of this process, we would like the Senate to function like it is designed, where every Member feels invested, and if they have a great idea, come down, introduce it as an amendment, debate it, and let your colleagues vote up or down against it. If we can't move forward with a process like that, then it is difficult to see how in a reasonable amount of time we are going to complete this agenda. So I would only urge my colleague from Oregon that there is nothing to be scared about. This is a process we will go through, and a nongermane amendment, which I think this would be listed as--I look for my staff. It would be a nongermane amendment--requiring 60 votes, a threshold that the Senate designed to pass practically anything. So I urge him to reconsider at some point, and I will make a similar unanimous consent request once he has had an opportunity to think about it. But also, we will work to see if in fact that amendment might be modified in a way that might make it a little more acceptable for the debate and for colleagues to vote on it. With that, I yield the floor.

Mr. BURR. Madam President, moving back to cyber security, we now have S. 754 before the Senate, and we have a managers' package that is pending. We have a number of amendments that have been accepted and incorporated in the managers' package. We have several amendments that we could not reach agreement on, but those Members have the opportunity to come to the Senate floor. The amendments are already pending. They can debate those amendments, and they can have a vote on their amendment. For Members who might just now be engaging or who have had an opportunity to further read the bill, there are still present opportunities to offer perfecting amendments. Let me suggest to my colleagues that when the vice chairman and I started down this road, we knew we couldn't reach unanimous consent of every company in the country and every Member of Congress. It was our goal, and I think we are pretty close to it when we look at the numbers. But there will be companies that object to this bill for some reason that I might not recognize. The vice chairman has said this and I have said it and I want to reiterate it another time: This bill is voluntary. It does not require any company in America to participate in this. It does not require any entity to turn over information to the Federal Government for purposes of the Federal Government partnering with that company to determine who hacked their system, who penetrated, and who exfiltrated personal data. If a company has made the determination that they don't want to support this bill for whatever reason, I am resigned to the fact that that is a debate between their customers and themselves. It is, in fact, their customers that have to question the actions of the company. I can confidently tell my colleagues that Senator Feinstein and I have done everything to make sure there is wholesome participation by companies on a voluntary basis. We see tremendous value in those parts of our government that are experts at processing attacks like this to be able to identify who did it and what tools were used but, more importantly, what software defensive mechanism we can put on our systems to limit any additional exfiltration of data and, more broadly, to the rest of the business community say: Here is an attack that is in progress. Here is the tool they are using. Here is how you defend your data. Now, we leave open, if we pass it, that there may be a company that decides they don't support this legislation. They can still participate in this program. Do we think if they get a call from the Department of Homeland Security or from the National Security Agency saying ``Here is an attack that is happening; here is the tool they are using,'' they are going to look at their system and say ``Is it in our system?'' They get the benefit of still participating and partnering with the Federal Government, even though they didn't support the legislation. I know over the next day or so the vice chairman and I will concentrate on sharing with Members what is actually in the managers' package. We don't leave it up to staff just to cover it. Let me just briefly share 15 points that I would make about the managers' package. No. 1, it eliminates the government's uses for noncyber crimes; in other words, a removal of the serious violent felonies. No. 2, it limits the authorizations to share cyber threat information for cyber security purposes, period. No. 3, it eliminates new FOIA exemptions. In other words, everybody is under the same FOIA regulations that existed prior to this legislation being enacted. No. 4, it ensures defensive measures are properly limited. We can't get wild and put these things in places that government shouldn't be, regardless of what the threat is. No. 5, it includes the Secretary of Homeland Security as coauthor-- coauthor--of government-sharing guidelines. I think this is an incredibly important part. The individual who is in charge of Homeland Security, that Secretary, is actively involved in the guidelines that are written. No. 6, it clarifies exceptions to the DHS portal entry point for the transfer of information. No. 7, it adds a requirement that the procedures for government sharing include procedures for notifying U.S. persons whose personal information is known to have been shared in violation--in violation--of this act. In other words, if a company mistakenly transmits information, the government is required to notify that individual. But, additionally, the government is statutorily required not to disseminate that information to any other Federal agency once it comes in and is identified. No. 8, it clarifies the real-time automated process for sharing through that DHS portal. No. 9, it clarifies that private entities are not required to share information with the Federal Government or another private entity. No. 10, it adds a Federal cyber security enhancement title. No. 11, it adds a study on mobile device security. No. 12, it adds a requirement for the Secretary of State to produce an international cyber space policy strategy. No. 13, it adds a reporting provision concerning the apprehension and prosecution of international cyber criminals. No. 14, it improves the contents of the biannual report on CISA's implementation. My colleagues might remember, as some have raised issues on this, they have said: Why are there not more reports? There are biannual reports on the implementation and how it is done. No. 15, and last, is additional technical and conforming edits. Now, we didn't get into detail. We will get into detail later, but I say that because if that has in any way triggered with somebody who felt they were opposed to the bill because of something they were told was in it, maybe it was covered by one of those 15 things that I just talked about. They are things that were brought to the attention of the vice chairman and me, and we sat down and looked at it. If we didn't feel as though it changed the intent of the bill--and we have always erred on the side of protecting personal data, of not letting this legislation extend outside of what it was intended to do. Where we have drawn the line is when we believed that the effort was to thwart the effectiveness of this legislation. I will remind my colleagues one last time: This legislation does not prevent cyber attacks. This legislation is designed to minimize the loss of the personal data of the customers of the companies that are penetrated by these cyber actors. As we stand here today, we have had some rather significant breaches within the United States. I remind my colleagues that just today it was proposed that a high school student has hacked the unclassified accounts, the personal email, of the Secretary of the Department of Homeland Security and the Director of the CIA. Is there anybody who really thinks that this is going to go away because we are having a debate in the Senate and in the Congress of the United States, that the people who commit these acts and go without any identification are going to quit? No. It is going to become more rampant and more rampant and more rampant. From the standpoint of 2 of 15 Members who are designated by the U.S. Senate and its leadership to, on behalf of the other 85, look at the most sensitive information that our country can accumulate about threats, as many threads of threats as we look at today on the security of the American people, I think I can speak for the vice chairman: We are just as concerned about the economic security of the United States based upon the threat that we are faced with from cyber actors here at home and, more importantly, around the world. I urge my colleagues, if you have something to contribute, come to the floor and contribute it. If you have an amendment already pending, come to the floor and debate it and vote on it. Give us the ability to work through the great thoughts of all 100 Members, but recognize the fact that those individuals whom you have entrusted to represent you with the most sensitive information that exists in our country came to a 14-to-1 vote when they passed this originally out of the Intelligence Committee. That is because of how grave we see the threat and how real the attackers are. I thank the vice chairman. She has been absolutely wonderful to work with through this process. We are going to have a long couple of days if we process all of this, but I am willing to be here as long as it takes so that we can move on to conference with the House. I yield the floor.

Mr. BURR. I suggest the absence of a quorum.