Homeland Security Act and the Power of Disclosure

Civil Libertarians are in a dither again, this time over new disclosure provisions for Internet service providers that are contained within the recently signed Homeland Security Act (HSA).

Before the ink was even dry on President Bush’s signature, Civil Libertarians and legal experts were sounding alarms about Section 225 of the HSA. That section contains the controversial Cyber Security Enhancement Act (CSEA), initially introduced by Rep. Lamar Smith, a Republican from Texas.

Designed to strengthen sentencing guidelines for computer crimes that result in death or physical injury to others, the CSEA includes a number of provisions that loosen disclosure laws for ISPs and other companies that communicate online.

Previously, ISPs and other companies that store electronic communications were required to disclose confidential information only when presented with probable causethe fourth amendment guarantee that the information is connected to a crime and is likely to be found at the search site.

Under the HSA, however, companies can disclose information based on the good faith belief of “an emergency involving danger of death or serious physical injury to any person”a loose requirement that relies in this case on the discretion of the ISP.

Brad Bennett, communications director for Rep. Smith’s Washington office, says that security officers shouldn’t be confused by the vague wording of the CSEA.

“We’re talking about emergency situations,” he says. “The last thing we want is for something untoward to happen because an ISP was afraid to act based on liability.”

But Bennett was less clear on what types of situations should prompt CSOs or other IT staff to report incidents.

“CSOs are probably better qualified to know when a situation isn’t right or when they should be more vigilant. They know systems and danger signs,” Bennett says.

Legal experts and Civil Libertarians worry that the murky language of the law will encourage government abuses. Also unclear is what types of companies are covered by the new disclosure laws.

Bennett said that only ISPs would be affected. But Lee Tien, senior staff attorney at the Electronic Frontier Foundation, says the new laws could be applied to a broad range of companies.

While not compelling companies to divulge information, the CSEA is a testament to the shift in public sentiment about privacy that has occurred since Sept. 11, according to Tien.