With respect to the possibility this could become a “cyber-surveillance” bill, section 4(d)(5) of the PCNA would permit the federal government to use so-called “cyber threat indicators” received from the private sector, which may include sensitive personally identifiable information unrelated to the cyber threat, for a wide variety of law enforcement purposes, including “preventing, investigating, disrupting, or prosecuting” violations of the Espionage Act and a wide variety of other federal crimes.

The authorization to use cyber threat information in Espionage Act cases is particularly worrisome in light of the increasing use of that law as justification for the surveillance of journalists and their sources, and the criminal prosecution of those sources. The Obama administration has pursued more “leak” prosecutions than all other presidencies combined. This provision, when combined with other vague or overbroad definitions in the bill, could be used to justify searches of journalists’ communications with sources and whistleblowers’ communications with Congress.

Unlike CISA, the PCNA would not create an entirely new exemption from FOIA, the first since the mid-1980s. This is a welcome omission. Unfortunately, however, the PCNA would exempt from disclosure, “without discretion,” information provided to the government under section 552(b)(3)(B) of FOIA and under all state sunshine laws. This discretion-less withholding is unnecessary given that the bill already clarifies that information provided to the government will have been shared “voluntarily.” That creates a legal presumption against disclosure under the existing exemption four in FOIA for confidential commercial information. At the very least, the PCNA should delete the term “without discretion.”