Dianne Feinstein

Mrs. FEINSTEIN

Mrs. FEINSTEIN. Mr. President, I ask unanimous consent that the following Senators on the Democratic side be permitted to speak for 5 minutes each on our time: Feinstein 5 minutes, Wyden 5 minutes, and Carper 5 minutes.

Mrs. FEINSTEIN. Mr. President, after many years of effort, the Senate is about to take its first vote to move forward on important cyber security legislation. As I stated in my remarks yesterday, this substitute makes 20 changes to the underlying bill. It includes 14 amendments offered by other Senators to improve privacy protections and ensure better cyber security for emergency services, the health care industry, and the Federal Government. As the chairman just said, we have been listening and we have tried to incorporate a substantial number of amendments in the managers' package. This is a good bill. It is a first step. It is not going to prevent all cyber attacks or penetrations, but it will allow companies and the government to share information about the cyber threats they see and the defensive measures to implement in order to protect their networks. Right now--and this is important--the same cyber intrusions are used again and again to penetrate different targets. That shouldn't happen. If someone sees a particular virus or harmful signature, they should be able to tell others so they can protect themselves. That is what this bill does--it clears away the uncertainty and concern that keep companies from sharing this information. It says that two competitors in a market can share information on cyber threats with each other without facing antitrust lawsuits. It says that companies sharing cyber threat information with the government for cyber security purposes have liability protection. The bill is completely voluntary. I don't know how to say that over and over more times than I have. If you don't want to participate, don't. If a company wants to take the position that it can defend itself and doesn't want to participate in real-time sharing with the Department of Homeland Security, that is its right. I thank my colleagues who came to the floor in support of this bill and this managers' amendment yesterday: Senators McConnell, Reid, Grassley, Nelson, McCain, King, Thune, Flake, Senator Carper in particular, Senator Blunt, and others. They have all described the need for this bill, and I so appreciate their support. I urge my colleagues to support cloture on this substitute managers' package so that we can start moving on to other amendments that are pending. I also thank Senator Burr and his staff. Over the past couple of days, they have been going through comments, proposing technical changes, and perfecting changes to the substitute. It is my understanding that Chairman Burr will ask a unanimous consent agreement on that perfecting amendment shortly. I also thank Senator Collins for agreeing to changes in her provision, section 407, to start to address concerns that were raised by its inclusion. I also want to thank Senators Whitehouse, Leahy, and Wyden for reaching an agreement on text that Senator Whitehouse very much wanted to include, and I am pleased we were able to include it in this unanimous consent package. So I appreciate the support of my colleagues. I urge a strong ``yes'' vote on the cloture vote to allow us to proceed to this bill.

Mrs. FEINSTEIN. I withdraw my request for my 5 minutes, Mr. President.

Mrs. FEINSTEIN. Mr. President, I believe I have a couple of minutes left after the chairman speaks that I would like to use.

Mrs. FEINSTEIN. Mr. President, just so the record is clear, I was told I did not utilize my entire 5 minutes, and I want to make a very brief closing statement on my 5 minutes.

Mrs. FEINSTEIN. Mr. President, thank you very much. I just want to urge people to vote yes on cloture. We have been at this for 6 years. This is the third bill. We have been bipartisan. The bill is considered. This is a complicated and difficult arena. The bill is all voluntary. The moaning and groaning of companies, I say, if you don't want to participate, don't participate, but I can give you hundreds and thousands of companies that are desperate to participate to be able to protect themselves without a lawsuit, and this enables that. It is a first-step bill. I particularly wish to thank the chair and ranking on the Homeland Security Committee. I very much appreciate this support and know that Senator Burr, I, and others will continue to work as we recognize this most serious threat on our economy and the privacy of individuals. To do nothing now is to admit that we cannot come up with a bill, and, in fact, we can. Please vote yes.

Mrs. FEINSTEIN. Mr. President, I ask the Senate to vote no on this amendment, and I would like to explain why. This amendment would create an exemption to the bill's narrowly tailored liability protections for companies that take responsible actions to look for cyber threats and share information about them if a company ``breaks a user or privacy agreement with a customer, regardless of how trivial it may be.'' The underlying cyber bill has been carefully drafted to ensure that it is totally voluntary and that activities can only be conducted on a customer's behalf with express authorization. Let me read the language in the bill. The bill reads: Nothing in this title shall be construed-- (1) to amend, repeal, or supersede any current or future contractual agreement, terms of service agreement, or other contractual relationship between any entities, or between any entity and a Federal entity. There is tremendous objection to the Paul amendment that is coming in from the chamber of commerce, various companies, and the health industry. They understand what is in our bill. This amendment would actually fatally disturb what is in the bill, which is clear and concise. I urge a ``no'' vote.

Mrs. FEINSTEIN

Mrs. FEINSTEIN. I can try to. I remember that in 2008 there were two significant cyber bank robberies: the Royal Bank of Scotland, I think for $8 million, and Citibank for $10 million. This was not public right away because nobody wanted it known. Then you see the more recent attacks of Aramco being taken down, Sony, and it goes on and on. The information is not often shared publicly by companies who should be asking: This happened to our company; can you share anything that might help us handle this? That kind of thing doesn't happen because everybody is afraid of liability, and so it is very concerning. I remember when Joe Lieberman was chairman of the homeland security committee, which had a bill. As the Senator will remember, we had the information sharing part of that bill, and we sat down with the U.S. Chamber of Commerce, I believe on three occasions, to try to work out differences, and we couldn't. The U.S. Chamber of Commerce is massive and all over the United States. It includes small businesses, medium- sized businesses, and some big businesses, and there was deep concern among its members. That took years to work out. Finally, the Senate may be ready to take a first step, and this first step is to permit the voluntary sharing of cyber information, which, if it is stripped of private data, will be protected with liability immunity and protected because it goes through a single DHS portal and doesn't go directly to the intelligence community, which was a big concern to the private community. All of this has been worked out in order to try to come up with a basis for taking this first step. I am sorry the Senator is no longer on our committee because my friend was really a great asset, and Florida is lucky to have my friend and colleague as their Senator. This is just the beginning. All of the iterations on this cyber legislation have been bipartisan, so that has to say something to people. We have learned as we have done the drafting on this, and we have very good staff who are technically proficient. So they know what can work and what can't work. I hope I have answered that question from the Senator from Florida. If I can, I will go on and make some remarks on the managers' amendment. Yesterday Senator Burr and I spoke on this floor to describe the Cybersecurity Information Sharing Act of 2015, which is now the pending business. Senator Burr filed a managers' package on behalf of both of us, and I will quickly run through that package. This amendment is the product of bipartisan negotiations over the past several weeks within the Intelligence Committee and with sponsors of other amendments to the bill. The managers' amendment makes several key changes to the bill to clarify authorization language, improve privacy protections, and make technical changes. It also--and I think this is of note--includes the text of 14 separate amendments. Those amendments were offered by our colleagues and I am pleased that we are able to add them to this legislation. In sum, this amendment has two main components. It makes important changes to the bill that we announced in August to address privacy concerns about the legislation. Second, it includes several amendments authored by our colleagues that had agreement on both sides of the aisle. I will run through these amendments that will be part of the managers' package, and I do so hopefully to reassure Members that these are positive amendments. First, it eliminates a provision on government use of cyber information on noncyber crime. The managers' amendment eliminates a provision in the committee-passed bill that would have allowed the government to use cyber information to investigate and prosecute ``serious violent felonies.'' Eliminating this provision is a very significant privacy change. We made this change because it has been a top bipartisan concern and the provision had been used by privacy groups to claim that this is a surveillance bill. As the chairman made clear on the floor yesterday, it is not. One of the reasons it is not is because it prohibits the government from using information for crimes unrelated to cyber security. Let me be clear. The chairman said it, and I will say it today. This is not a surveillance bill. We have eliminated this provision and helped, I believe, to eliminate these concerns. So, please, let us not speak of this bill as something that it isn't. Second, it limits the authorization to share cyber threat information to cyber security purposes. The managers' amendment limits the authorization for sharing cyber threat information provided in the bill to sharing for cyber security purposes only. This is another significant privacy change, and it has been another top bipartisan and privacy group concern. Third, it eliminates a new FOIA exemption. The managers' amendment eliminated the creation of a new exemption in the Freedom of Information Act specific to cyber information that was in the committee-passed bill. Cyber threat indicators and defensive measures shared in accordance with the bill's procedures would still be eligible for existing FOIA exemptions, but it doesn't add new ones. Four, it ensures that defensive measures are properly limited. The bill allows a company to take measures to defend itself, as one might expect, and the managers' amendment clarifies that the authorization to employ defensive measures does not allow an entity to gain unauthorized access to a computer network. Five, it includes the Secretary of Homeland Security as coauthor of the government-sharing guidelines. The managers' amendment directs both the Attorney General and the Secretary of Homeland Security, rather than solely just the Attorney General, to develop policies and procedures to govern how the government quickly and appropriately shares information about cyber threats. That should be a no-brainer. Six, it clarifies exceptions to the Department of Homeland Security's so-called portal. The managers' amendment clarifies the types of cyber information sharing that are permitted to occur outside the DHS portal created by the bill. Specifically, the bill narrows communications outside of the Department of Homeland Security portal regarding previously shared cyber threat information. Seven, it requires procedures for notifying U.S. persons whose personal information has been shared by a Federal entity in violation of the bill. The managers' amendment adds a modified version of Wyden amendment No. 2622, which requires the government to write procedures for notifying U.S. persons whose personal information is known or determined to have been shared by the Federal Government in a manner inconsistent with this act. Eight, it clarifies the real-time automated process for sharing through the DHS portal. Here the managers' amendment adds a modified version of the Carper amendment No. 2615, which clarifies that there may be situations under which the automated real-time process of the DHS portal may result in very limited instances of delay, modification or other action due to the controls established for the process. The clarification requires that all appropriate Federal entities agree in advance to the filters, fields or other aspects of the automated sharing system before such delays, modifications or other actions are permitted. Senator Carper has played a very positive role on this issue. He is the ranking member on the homeland security committee. He sat down with both Senator Burr and me earlier this year. He has proposed some very good changes, and this is one of them, which is in the managers' package. Also, the clarification ensures that such agreed-upon delays will apply across the board uniformly to all appropriate Federal entities, including the Department of Homeland Security. This was an important change for both Senator Carper and Senator Coons and for the Department of Homeland Security. I am pleased we were able to reach agreement on it. Essentially, it will allow a fast real- time filter--and I understand this can be done--that will do an additional scrub of information going through that portal before the cyber information goes to other departments to take out anything that might be related to personal information, such as a driver's license number, an account, a Social Security number or whatever it may be. DHS believes they can put together the technology to be able to do that scrub in as close to real time as possible. This should be very meaningful to the privacy community, and I really hope it is meaningful because I want to believe that their actions are not just to try to defeat this bill, but that their actions really are to make the bill better. If I am right, this is a very important addition. Again, I thank Senator Carper and Senator Coons, and I also thank the chairman for agreeing to put this in. Nine, it clarifies that private entities are not required to share information with the Federal Government or another private entity. This is clear now. This amendment adds the Flake amendment No. 2580, which reinforces this bill's core voluntary nature by clarifying that private entities are not required to share information with the Federal Government or another private entity. In other words, if you don't like the bill, you don't have to do it. So it is hard for me to understand why companies are saying they can't support the bill at this time. There is no reason not to support it because they don't have to do anything. There are companies by the hundreds, if not thousands, that want to participate in this, and this we know. Ten, it adds a Federal cyber security enhancement title. The managers' amendment adds a modified version of another Carper amendment, which is No. 2627, the Federal Cybersecurity Enhancement Act of 2015, as a new title II of the cyber bill. The amendment seeks to improve Federal network security and authorize and enhance an existing intrusion detection and prevention system for civilian Federal networks. Eleventh, we add a study on mobile device security. The managers' amendment adds a modified version of the Coats amendment No. 2604, which requires the Secretary of Homeland Security to carry out a study and report to Congress on the cyber security threats to mobile devices of the Federal Government. I wish to thank Senator Coats, who is a distinguished member of the Intelligence Committee and understands this bill well, for this amendment. Twelfth, it adds a requirement for the Secretary of State to produce an international cyber space policy strategy. The managers' amendment adds Gardner/Cardin amendment No. 2631, which requires the Secretary of State to produce a comprehensive strategy focused on United States international policy with regard to cyber space. It is about time we do something like this. I am personally grateful to both Senators Gardner and Cardin for this amendment. Thirteenth, the managers' amendment adds a reporting provision concerning the apprehension and prosecution of international cyber criminals. The managers' amendment adds a modified version of Kirk- Gillibrand amendment No. 2603, which requires the Secretary of State to engage in consultations with the appropriate government officials of any country in which one or more cyber criminals are physically present and to submit an annual report to appropriate congressional committees on such cyber criminals. It is about time that we get to the point where we can begin to make public more about cyber attacks from abroad because it is venal, it is startling, it is continuing, and in its continuation, it is growing into a real monster. Let there be no doubt about that. Fourteenth, it improves the contents of the biennial report on implementation of the bill. The managers' amendment adds a modified version of the Tester amendment No. 2632, which requires detailed reporting on, No. 1, the number of cyber threat indicators received under the DHS portal process--good, let's know--and, No. 2, the number of times information shared under this bill is used to prosecute certain cyber criminals. If we can catch them, we should. We should know when prosecutions are made. Then, No. 3 is the number of notices that were issued, if any, for a failure to remove personal information in accordance with the requirements of this bill. Mr. President, I am spending a great deal of time on these details because there are rumors beginning to circulate that the bill does this or does that, which are not correct. This managers' package is a major effort to encapsulate what Members on both sides had concerns about. And I think the numbers of Republican and Democratic amendments that are incorporated are about equal. Fifteenth, this managers' amendment improves the periodic sharing of cyber security best practices with a focus on small businesses. The managers' amendment adds the Shaheen amendment No. 2597, which promotes the periodic sharing of cyber security best practices that are developed in order to assist small businesses as they improve their cyber security. I think this is an excellent amendment and Senator Shaheen should be commended. Sixteenth, the managers' amendment adds a Federal cyber security workforce assessment title. The managers' amendment adds Bennet-Portman amendment No. 2558, the Federal Cybersecurity Workforce Assessment Act, as a new title III to this bill. The title addresses the need to recruit a highly qualified cyber workforce across the Federal Government. There are just a few more, but, again, I do this to show--and the chairman is here--that we have listened to the concerns from our colleagues and we have tried to address them, so nobody should feel we are ramming through a bill and that we haven't considered the views from others. The managers' amendment is, in fact, a major change to the bill that reflects this collegial--sometimes a little more exercised, but collegial--discussion. Does the chairman agree?

Mrs. FEINSTEIN. Mr. President, I would like to respond to what the distinguished Senator from Florida said. Senator, you know what a pleasure it was to have you on the intelligence committee. I think you understand the time that we have spent to get this bill done, which is now about 6 years, and to take this first step, not because it is a perfect step but because it is a first step that is voluntary, with new authorities that people and companies can use if they want to, and if they don't want to, they don't have to. If they want to, it can be effective in enabling companies to share cyber security information and therefore protect themselves. I know you understand this. I am so grateful for that understanding and for your help.

Mrs. FEINSTEIN. I will.

Mrs. FEINSTEIN. Mr. President, I thank the chairman very much. If I may, through the Chair, I want the chairman to know how much I appreciate this tack he has taken to be flexible and willing throughout this process, which extends into this managers' package. So I believe-- I truly believe--what we have come up with in this managers' package and what Members have contributed to it makes it a better cyber bill. I know the chairman feels the same way. We can just march on shoulder to shoulder and hopefully get this done. I will finish up the few other items I have to discuss because I want people who have concerns to listen to what is being said because these changes have a major impact on the bill. Next, No. 17 establishes a process by which data on cyber security risks or incidents involving emergency response information systems can be reported. The managers' amendment adds Heitkamp amendment No. 2555, which requires the Secretary of Homeland Security to establish a process by which a statewide interoperability coordinator may report data on any cyber security risk or incident involving emergency response information systems or networks. This is a process for reporting, and certainly we need to know more. Next, No. 18 requires a report on the preparedness of the health care industry to respond to cyber security threats, and the Secretary of Health and Human Services to establish a health care industry cyber security task force. The managers' amendment adds Alexander-Murray amendment No. 2719. This is a reporting requirement to improve the cyber security posture of the health care industry. I don't think anyone wants to have their health care data hacked into. This is deeply personal material and it should be inviolate. The provision requires the Secretary of Health and Human Services to submit a report to Congress on the preparedness of the health care industry to respond to cyber security threats. If we really want to help protect health care information, we have to know what is going on, and that is what this amendment enables. It also requires the Secretary to establish a health care industry cyber security task force. Next is No. 19, which requires new reports by inspectors general. The managers' amendment adds a modified version of the Hatch amendment No. 2712, which requires relevant agency inspectors general to file reports with appropriate committees on the logical access standards and controls within their agencies. Let's know what standards and what controls they have. I think it is a very prudent request of the Senator from Utah, and I am glad we were able to include it. Next is No. 20, which adds a requirement for the DHS Secretary to develop a strategy to protect critical infrastructure at the greatest risk of a cybersecurity attack. The managers' amendment adds the Collins amendment No. 2623, which requires DHS to identify critical infrastructure entities at the greatest risk of a catastrophic cyber security incident. This is where we have had a number of concerns recently. The chairman's staff and my staff are working on this. Remember, this is a voluntary bill, and we do not want any language that might be interpreted to imply that this is not a voluntary bill. I know Senator Collins has a lot of knowledge of this area, and I believe we are going to be able to work this out. This amendment does not convey any new authorities to the Secretary of Homeland Security to require that critical infrastructure owners and operators take action, nor does it mandate reporting to the Federal Government. Its intent, which I applaud, is for the government to have a better understanding of those critical infrastructure companies that, if hacked, could cause extremely significant damage to our Nation. In conclusion, I would like to thank my colleagues for their thoughtful and helpful amendments. I am pleased that we have such a fulsome managers' package. I believe this managers' package strengthens our bill. It adds important clarifications, including meaningful privacy protections, it does not do operational harm, and it further improves the strong bill that the Intelligence Committee passed by a strong vote of 14 to 1 earlier this year. I wanted to do this so that all Members know what is in the managers' package, and both the chairman and I believe that these additions are in the best interests of making a good bill even better. I thank the Presiding Officer, and I yield the floor.

Mrs. FEINSTEIN. Mr. President, I call for the regular order with respect to the Franken amendment No. 2612.

Mrs. FEINSTEIN. Mr. President, I ask that the amendment be further modified to correct the instruction line in the amendment.

Mrs. FEINSTEIN. Thank you.

Mrs. FEINSTEIN

Mrs. FEINSTEIN. Mr. President, I want to begin by saying that I very much agree with what Chairman Burr has just stated. It is factual. It is the truth. For me, I have worked on this issue for 7 years now. And this is actually the third bill that we have tried to move. I want to thank the two leaders for bringing the bill to the floor, and I hope it can be considered quickly. Up front I want to make clear, if it hasn't been made clear, that this legislation is a first step only to improve our Nation's defenses against cyber attack and cyber intrusion. It is not a panacea, and it will not end our vulnerabilities. But it is the most effective first legislative step we believe that we can take. This legislation is about providing legal clarity and legal protection so that companies can share cyber threat information voluntarily with each other and with the government. It provides companies the protections they need and puts strong privacy rules in place. At the beginning of this debate, I think it is important to talk about the depth and breadth of the cyber threat we actually face every day, because rarely does a month go by without the announcement of a significant cyber attack or intrusion on an American company or an agency of the U.S. Government. These attacks compromise sensitive personal information, intellectual property or both. Just in the last year, major banks, health insurers, tech companies, and retailers have seen tens of millions of their customers' sensitive data stolen through cyber means. In 2014 the Internet security company Symantec reported that over 348 million identities were exposed through data breaches. Threats in cyber space do not just risk the personal data of Americans. They are a significant and growing drain on our economy as malicious actors steal our money, rob companies of intellectual property, and threaten our ability to innovate. The cyber security company McAfee and the think tank Center for Strategic and International Studies estimated last year that the cost of cyber crime is more than $400 billion annually. The same study stated that losses from cyber theft could cost the United States as many as 200,000 jobs. These are not theoretical risks; they are happening today and every day. As we know all too well in the wake of cyber intrusions at the Office of Personnel Management, cyber threats are not only aimed against the private sector. They are also aimed against the public sector. Every day, foreign nation-states and cyber criminals scour U.S. Government systems and our defense industrial base for information on government programs and personnel--every single day. More than 22 million government employees and security clearance applicants had massive amounts of personal information stolen from the Office of Personnel Management, reportedly taken by China. These employees now face increased risk of theft and fraud, and also their information could be used for intelligence operations against them and the United States. As bad as this is--and it is bad--we have seen in the last few years an acceleration of an even more concerning trend, that of cyber attack instead of just cyber theft. In 2012 major U.S. financial institutions saw an unprecedented wave of denial-of-service attacks on their systems. Saudi Aramco--reported to be the world's largest oil and gas company--was the victim of a cyber attack that wiped out a reported three-quarters of its corporate computers. In 2013 we saw further escalations of these threats as waves of denial-of-service attacks were aimed at some of our largest banks. In early 2014 Iran launched a cyber attack on the Sands Casino which, according to the public testimony of the Director of National Intelligence, James Clapper, rendered thousands of computer systems inoperable. Last November we saw one of the most publicized cyber attacks when North Korean attacks broke into Sony Pictures Entertainment, stole vast amounts of sensitive and personal data, and destroyed the company's internal network. These breaches of personal information and loss of intellectual property and destructive attacks continue online every day. It is only a matter of time before America's critical infrastructure--major banks, the electric grid, dams, waterways, the air traffic control system, and others--is targeted for a cyber attack that could seriously affect hundreds of thousands of lives. Clearly it is well beyond the time to act. There is no legislative or administrative step we can take that will end cyber crimes and cyber warfare. However, since the Intelligence Committee began looking seriously at this in 2008, we have heard consistently that improving the exchange of information about cyber threats and cyber vulnerabilities can yield a real and significant improvement to U.S. cyber security. That is why this bill is the top cyber legislative priority for the Congress, the Obama administration, and the business community. I have heard directly from dozens of corporate executives about the importance of cyber security legislation, as have the Intelligence Committee staff in hundreds of meetings over the course of years in drafting this legislation. As Chairman Burr has said, not only has the U.S. Chamber of Commerce called for this legislation but so have dozens--specifically 52--of industry groups representing some of the largest sectors of our economy. On the floor in early August, I listed 40 associations that have written in support of the legislation. Today there are 52. I ask unanimous consent that the list of supporters of this bill be printed in the Record.

Mrs. FEINSTEIN. Mr. President, I suggest the absence of a quorum.

Mrs. FEINSTEIN. Mr. President, regrettably this is the third attempt to pass a cyber security information sharing bill in recent years. In 2012 the Lieberman-Collins Cybersecurity Act of 2012 was on the floor. It included a title on information sharing which the Intelligence Committee helped produce. It was an important piece of legislation, but it only received one Republican vote. Last Congress, then-vice chairman of the Intelligence Committee Saxby Chambliss and I set out to draft a narrower bill just on information sharing in the hopes of attracting bipartisan support. The Intelligence Committee approved a bill in 2014 by a strong bipartisan vote of 12 to 3, but it never reached the Senate floor due to privacy concerns. So this is the third try. I am very pleased that Chairman Burr and I now have the opportunity to bring a bill to the floor that both sides can and should support. This bill is bipartisan. It is narrowly focused. It puts in place a number of privacy protections, many of which we will outline shortly. I believe the bipartisan vote of 14 to 1 in the Senate Intelligence Committee in March underscores this fact. I would like to commend Senator Burr's leadership and his willingness to negotiate a bipartisan bill with me that can and should--and I hope will--receive a strong vote in the Senate. Let me take a few minutes to describe the main features of the bill and its privacy protections. In short, it does the following five things: First, the bill recognizes that the Federal Government has information about cyber threats that it can and should share with the private sector and with State, local, and tribal governments. The bill requires the Director of National Intelligence to put in place a process to increase the sharing of information on cyber threats already in the government's hands with the private sector to help protect an individual or a business. So that is the sharing between the government and the private sector. This includes sharing classified data with those with security clearances and an appropriate need to know but also requires the DNI to set up a process to declassify more information to help all companies secure their networks. We have heard over and over again from companies that the information they get from the government today is not sufficient. That needs to change. Second, the bill provides clear authorization for private sector entities to take appropriate actions. That includes an authorization for a company to monitor its networks or information on its networks for cyber security purposes only. No other type of monitoring is permitted, nor is the use of information acquired through such monitoring allowed for purposes other than cyber security. There is also an authorization for a company to implement a defensive measure on its network to detect, prevent, or mitigate a cyber threat. This authorization by definition does not authorize a defensive measure that destroys, renders unusable, or substantially harms a computer system or information on someone else's network. This is an important point. There has been concern that the bill would immunize a company for damage it might cause to other people's networks. The managers' amendment makes clear that the authorization in this bill allows companies to block malicious traffic coming from outside their network and stop threats on their systems but not conduct offensive activities or otherwise have substantial effects off their networks. Finally, there is an authorization for companies to share limited cyber threat information or defensive measures with other companies or with government agencies. It does not authorize sharing anything other than cyber information. In a critical change, the managers' amendment states that sharing is for cyber security purposes only. So this really is a very limited authorization. It is important to note that while these activities are authorized, they are not mandatory. Information sharing, monitoring, and use of defensive measures are all voluntary. The bill makes explicit that there are no requirements for a company to act or not to act. I have heard from technology companies in the past couple of weeks that they are concerned that this bill requires them to share customer information with the government. That is false. Companies can choose to participate or they can choose not to. If they do, they can only share cyber threat information, not their company's personal information or their online activity. The third thing this bill does is it puts in place procedures and limitations for how the government will receive, handle, and use cyber information provided by the private sector. The bill requires two sets of policies and procedures. The first set--to be written by the Attorney General and the Secretary of Homeland Security--requires that cyber information that comes to the Federal Government will be made available to all appropriate Federal departments and agencies without unnecessary delay and that the information sharing system inside the government is auditable and is consistent with privacy safeguards. The second set of required guidelines is designed to limit the privacy impact of the sharing of cyber information and specifically limits the government's receipt, retention, use, and dissemination of personal information. These guidelines are to be written by the Attorney General. They will be made public. The bill specifically limits the use of cyber information by the government. Federal agencies can only use the information received through this bill for a cyber security purpose, for the purpose of identifying a cyber threat, preventing or responding to an imminent threat of death, serious bodily harm, serious economic harm, including an imminent terrorist attack, preventing or responding to a serious threat of harm to a minor, and preventing, investigating, or prosecuting specific cyber-related crimes. Fourth, the bill creates what we call in shorthand a portal at the Department of Homeland Security and requires that cyber information is received by the government through the Homeland Security portal, from which it can be distributed quickly and responsibly to appropriate departments and agencies. This portal was the joint proposal a few years ago by former DHS Secretary Janet Napolitano, FBI Director Bob Mueller, and NSA Director Keith Alexander. The purpose of the portal is to centralize the entry point for cyber information sharing so that the government can effectively and efficiently receive that cyber information, can protect privacy, and can ensure that all the appropriate departments with cyber security responsibility can quickly learn about threats. A key aspect of this centralized portal is to enable information to move where it needs to go automatically. Once cyber threat information enters the portal, it will be shared in real time--meaning without human intervention and at machine speed--to the other appropriate Federal agencies. The belief is that they can put in a filter and do a privacy scrub, if you will, just in case there is any private information, such as a Social Security number, a driver's license number, or something like that, that can be instantly moved out. Such a real-time exchange is necessary because if there are indications that a cyber attack is underway, the response to stop that attack will need to be immediate and not subject to any delay. The bill makes clear that this can and should be done in a way that ensures that privacy is protected, improving both privacy protections and the ability to quickly protect sensitive systems. Fifth and finally, the bill provides liability protection to companies that act in accord with the bill's provisions. Specifically, the bill provides liability protection for companies that properly monitor their computer networks or that share information the way the bill allows. The bill specifically does not protect companies from liability in the case of gross negligence or willful misconduct, nor does it protect those who do not follow its privacy protections. As I mentioned earlier, there are many privacy protections throughout the bill. Because this is a key point of interest for a number of Senators, I wish to list 10 of them. No. 1, it is voluntary. The bill doesn't require companies to do anything they choose not to do. There is no requirement to share information with another company or with the government, and the government cannot compel any sharing by the private sector. So if there is this tech company or that tech company that doesn't want to provide this information, don't do it. Nothing forces you to do it. This is 100 percent voluntary. No. 2, it narrowly defines the term ``cyber threat indicator'' to limit the amount of information that may be shared under the bill. Only information that is necessary to describe or identify cyber threats can be shared. No. 3, the authorizations are clear, but they are limited. Companies are fully authorized to do three things: monitor their networks or provide monitoring services to their customers to identify cyber threats, use limited defensive measures to protect against cyber threats on their networks, and share and receive cyber information with each other and with Federal, State or local governments. No surveillance, no sharing of personal or customer information is allowed. No. 4, there are mandatory steps that companies must take before sharing any cyber threat information with other companies or the government. Companies must review information before it is shared for irrelevant privacy information, and they are required to remove any such information that is found. A bank would not be able to share a customer's name or account information. Social Security numbers, addresses, passwords, and credit information would be unrelated to a cyber threat and would, except in very exceptional circumstances, be removed by the company before sharing. No. 5, the bill requires that the Attorney General establish mandatory guidelines to protect the privacy of any information the government receives. These guidelines will be public. The guidelines will limit how long the government can retain any information and provide notification requirements and a process to destroy mistakenly shared information. It also requires the Attorney General to create sanctions for any government official who does not follow these mandatory privacy guidelines. No. 6, the Department of Homeland Security, not the Department of Defense or the intelligence community, is the primary recipient of the shared cyber information. No. 7, the managers' amendment includes a new provision, which was suggested by Senator Carper, with the backing of a number of privacy groups, to allow the Department of Homeland Security--and I say this again--to scrub the data as it goes through the portal to make sure it does not contain irrelevant personal information. No. 8, the bill restricts the government's use of voluntarily shared information to cyber security efforts, imminent threats to public safety, protection of minors, and cyber crimes. Unlike previous versions, the government cannot use this information for general counterterrorism analysis or to prosecute noncyber crimes. No. 9, the bill limits liability protection to only monitoring for cyber threats and sharing information about them when a company complies with the bill's privacy requirements, and it explicitly excludes protection for gross negligence or willful misconduct. No. 10, above and beyond these mandatory protections, there are a number of oversight mechanisms in the bill which involve Congress, the heads of agencies, the inspectors general, and the Privacy and Civil Liberties Oversight Board. In sum, this bill allows for strictly voluntary sharing of cyber security information with many layers of privacy protections. As I have noted, the managers' amendment that we will consider shortly, I hope, will include several key privacy protections. We will be describing them in more detail when we turn to that amendment. Mr. President, I hope this has made clear that we have tried to very carefully balance the need for improved cyber security with the need to protect privacy and private sector interests. As I said earlier, this is the third bill on information sharing. We have learned from the prior two efforts. It is clear from the headlines and multiple data breach notifications that customers and employees are now receiving that this bill is necessary and we need to act now instead of after a major cyber attack seriously impacts hundreds or thousands of lives or costs us billions or trillions of dollars. We have a good bill. I know there are some cynics. I know there are some tech companies that may be worried about what their customers might do. Then don't participate if you don't want to, but I have talked to enough CEOs who have said to me: Please do this. We need this ability to share, and the only way we can get this ability is with liability protection for sharing cyber threat material, so this is very important. I again thank the chairman for everything he has done to lead this effort. It is my hope that we will have a good, civil debate and that we will be able to pass this bill with a substantial margin. I yield the floor.

Mrs. FEINSTEIN

Mrs. FEINSTEIN. Madam President, I ask unanimous consent that the order for the quorum call be rescinded.

Mrs. FEINSTEIN. Madam President, I call up the Coons amendment No. 2552, as modified.

Mrs. FEINSTEIN. Madam President, I call up the Franken amendment No. 2612, as modified.

Mrs. FEINSTEIN. Madam President, I call up the Mikulski amendment No. 2557.

Mrs. FEINSTEIN. Madam President, I call up the Leahy amendment No. 2587, as modified.

Mrs. FEINSTEIN. Madam President, I call up the Whitehouse amendment No. 2626.

Mrs. FEINSTEIN. Madam President, I call up the Wyden amendment No. 2621, as modified.

Mrs. FEINSTEIN

Mrs. FEINSTEIN. Mr. President, I wish to discuss sanctuary cities. Two women, Kate Steinle and Marilyn Pharis, were killed in California over the summer, both allegedly by undocumented individuals with criminal records. The suspect in each case had recently been released from local custody without notice to Federal immigration officials, which could have resulted in those individuals being removed from the country instead of being released. I believe these murders could have been prevented if there were open channels of communication between local law enforcement and Federal immigration authorities about dangerous individuals. In both cases, those lines of communication broke down, and two women died. In my view, local law enforcement agencies should be required to notify Federal authorities--if such notification is requested--that they plan to release a dangerous individual, such as a convicted felon. This is a reasonable solution that would target those criminals who shouldn't be released back onto the street. While I do support mandatory communication between local, State, and Federal officials, I do not support the bill before us today. The bill we will soon be voting on would target all undocumented immigrants for deportation. It would divert already stretched local law enforcement resources away from dangerous criminals and from policing in their own communities. I do not support such an action. This bill also includes a detention requirement that goes beyond dangerous individuals--it would cover any immigrant sought to be detained. This is a standard that could be abused in another administration, and it is potentially a huge unfunded mandate to impose on States and localities. In addition to being an unfunded mandate, the bill would make drastic cuts to police departments, sheriffs departments, and local community programs. Specifically it would cut the COPS Hiring Program; the State Criminal Alien Assistance Program, known as SCAAP; and the Community Development Block Grant Program. Last year, 21 California jurisdictions received $13.2 million in COPS hiring grants to hire police officers. California also received $57 million in SCAAP funds to help cover costs of holding undocumented immigrants. And California communities received $356.9 million under the Community Development Block Grant Program. As a former mayor, I know how important these funds are to local communities. The bill would also impose lengthy Federal prison sentences on all undocumented immigrants. This would include mothers crossing the border to see their children. It would include agricultural workers who are vital to California's economy. It would include other essentially innocent individuals who simply want to make a better life for themselves and their families. In my view, this goes much too far, and I cannot support it. I would, however, like to talk further about the murders of Kate Steinle and Marilyn Pharis and what I believe should be done to protect public safety. Kate Steinle, a 32-year-old woman, was shot and killed in July while walking along San Francisco's Pier 14 with her father. The suspected shooter, Juan Francisco Lopez-Sanchez, had a long criminal record. He had seven felony convictions, including one for possession of heroin and another for manufacturing narcotics. He had also been removed from the country five times. The chain of events that led to Kate's murder began on March 23, when San Francisco County Sheriff Ross Mirkarimi requested that Lopez- Sanchez be transferred from Federal prison to San Francisco. The sheriff's request was based on a 20-year-old marijuana possession warrant. On March 26, Lopez-Sanchez was booked into San Francisco County jail. However, the 20-year-old marijuana charge was quickly dropped, and Lopez-Sanchez was later released. Immigration and Customs Enforcement had asked Sheriff Mirkarimi to let the agency know when Lopez-Sanchez would be released. That did not happen. A simple phone call would have been enough, but Sheriff Mirkarimi failed to notify Federal officials. In July, only a few months after his release, Lopez-Sanchez shot and killed Kate Steinle. In fact, not only did the sheriff fail to notify, the failure was a consequence of a deliberate policy. Just weeks before his office requested the transfer of Lopez-Sanchez, the sheriff adopted a policy forbidding his own deputies from notifying immigration officials. The policy specifically states that sheriff department staff shall not provide release dates or times to immigration authorities. Let me be clear: this isn't State law or even San Francisco law. This is the sheriff's own policy. I believe this policy is wrong, and I have called on the sheriff to change it. San Francisco Mayor Ed Lee has made the same request. On July 24, Marilyn Pharis was brutally attacked with a hammer and sexually assaulted in her home by two suspects. The 64-year-old Air Force veteran died in the hospital from her injuries a week later. One of the individuals charged with this heinous crime is a 20-year- old U.S. citizen named Jose Fernando Villagomez. The other is a 29-year-old undocumented immigrant named Victor Aureliano Martinez Ramirez. According to ICE, Martinez Ramirez was arrested in May 2014, but he had no prior felony convictions or deportations. He was subject to what is called an ICE detainer request, asking the local jurisdiction to hold him until ICE could pick him up. The local jurisdiction did not hold the suspect, nor did they notify ICE of his release. In the ensuing months, Martinez Ramirez accumulated multiple misdemeanor convictions, including possession of methamphetamine and battery. One of his convictions included a protection order requiring him to stay away from a particular individual. On July 20, he pleaded guilty to additional misdemeanor charges of possessing a dagger and drug paraphernalia. He was sentenced to 30 days, but that wasn't to begin until October 31. He was released from custody and, 4 days later, allegedly attacked, raped, and killed Marilyn Pharis in her own home. I believe these two cases demonstrate the need for better communication between local, State, and Federal authorities before a dangerous individual with a criminal record is released. When our committee was set to markup an earlier bill from Senator Vitter, I prepared a simple amendment to ensure such communication happens. That markup was cancelled. I'd like to describe this approach now. First, it would require notification by a State or local agency of the impending release of certain dangerous individuals, if ICE requests such notification. It would apply to individuals where there is probable cause to believe they are aliens who are removable from the country and who pose a threat to the community. Immigration offenses would be covered only if the individual had actually received more than 1 year in prison, which would happen for a person with a significant criminal history. The amendment I prepared would not include harmful cuts to law enforcement and community programs, which I believe are unnecessary and unwise. The legal precedents from the Supreme Court show that Congress can impose a reporting requirement on a State or local government, without threatening harmful funding cuts. That is the approach I would take--I believe it would protect public safety without harming otherwise law-abiding immigrants or State or local law enforcement. Before I conclude, I'd like to remind my colleagues that this is not a choice between being pro-immigrant or pro-criminal. I am pro-immigrant. Immigrants make a tremendous contribution to this country and to my State. They work some of the most difficult jobs, from agriculture to construction to hospitality. They are part of the fabric of our country. I, myself, am the daughter of an immigrant. I strongly support comprehensive immigration reform, which I think is the only long-term solution to many of these problems. I also support the President's executive actions to eliminate the threat of deportation for young people who have been raised here, as well as the parents of American citizens. And I agree with immigrant advocates who want to prevent families from being separated because of a minor infraction like a broken taillight. The position I support strikes a balance. It would keep dangerous individuals off the street, while protecting otherwise law-abiding immigrants who are just here to work and provide their children with a better future. I believe the deaths of Kate Steinle and Marilyn Pharis could have been prevented. I believe we can and should fix the problems that led to their deaths by requiring that local officials notify Federal officials before they release dangerous criminals, if asked to do so. I oppose Senator Vitter's bill, which would sweep up otherwise law- abiding immigrants and divert resources away from where they are most needed. We should focus our efforts on dangerous criminals, and I hope that when we again take up comprehensive immigration reform, that is what happens. I thank the Chair.