What’s on Washington’s Technology Agenda?

Congress and other Washington policy makers have returned to work after the August recess where they face a number of technology policy issues.  The Center for Democracy and Technology has published a top ten list of these issues, including Protect IP, privacy, data retention, cybersecurity, ECPA, and more.  EDUCAUSE has been following many of these issues and reporting on them as developments occur.  We will continue to do so throughout the fall term.

• The Protect IP Act (PIPA)

PIPA presents troubling technical and cybersecurity implications for the Internet's Domain Name System and poses significant risks of collateral damage to the technical workings of the Internet.  If enacted, the bill has the potential to adversely impact college and university network operators.  EDUCAUSE has a Policy Brief on PIPA, has registered concern with members of Congress about the legislation, and co-hosted a press briefing with the authors of the technical paper that was written by top Internet engineers in direct response to the DNS provisions in the bill.

Outlook: Besides higher education, Internet engineers, IP law professors, editorials in the New York Times and the Los Angeles Times, and venture capitalists speaking out against the bill, startup entrepreneurs have sent Congress a letter saying that PIPA will squelch jobs.  The bill did pass the Senate Judiciary Committee unanimously in July.  A House version of the bill is expected this fall. 

• Privacy

With the ubiquity of mobile devices and the increases in data breaches, Congress has responded with bipartisan support for comprehensive privacy legislation.  EDUCAUSE has a Policy Brief on data privacy legislation that analyzes the 18 bills introduced in Congress as of August.  On September 8^th, Sen.  Richard Blumenthal (D-CT) introduced the Personal Data Protection and Breach Accountability Act would require businesses with the personal information of more than 10,000 customers to implement privacy and security programs to ensure the safety of pertinent data.

Outlook: There is significant bi-partisan interest in Congress to pass some sort of privacy legislation.  It is important that higher education is attentive to passage of any legislation that require ISPs to retain more information about users and to ensure that the data that are already retained are adequately protected against disclosure.

• Data Retention

The Protecting Children from Internet Pornographers Act was reported out by the House in July. The bill would require ISPs, hotels, coffee shops, and others (including campus networks) to retain information that could be used to identify customers.  

Outlook: This expansion of government power would impose a costly mandate and could discourage Internet access, but it has not been shown that it is necessary to serve legitimate law enforcement needs.

• Cybersecurity

The White House released its long-awaited cybersecurity legislative proposal.  The proposal includes new oversight, reporting requirements, and annual certification to ensure that cybersecurity technologies are used for their intended purpose and nothing more.  EDUCAUSE has been following and blogging on

Outlook:  It is unclear what effect the Administration’s legislative proposals will have upon the legislation that has already been introduced or is in the process of being crafted to address concerns related to privacy, cybersecurity, identity theft, and a host of related issues.  It is also not clear what the impact will be upon colleges and universities who have been marginalized in the more recent prioritization of critical infrastructures.  There is currently no bill in the Senate, but one may be forthcoming in October.  The Senate does have a bi-partisan working group that is reportedly developing legislative language.  In the House, there is a Republican task force working on legislation.  All sides agree that there needs to be more information sharing, but there are differences as to whether this should be voluntary or mandatory.

• Electronic Communications Privacy Act (ECPA) Reform

Sen. Patrick Leahy (VT-Dem) introduced legislation to amend the Electronic Communications Privacy Act (ECPA), which he authored in 1986 to protect the privacy of electronic communications.  While portions of ECPA have been amended in the intervening years, Congress has not enacted comprehensive reforms since the law was enacted in 1986.  Advancements in communication technologies, including smartphones and social networking sites, have outpaced the privacy protections included in the law.  EDUCAUSE is part of the Digital Due Process Coalition (DDP) that is working to simplify, clarify, and unify the ECPA standards, providing stronger privacy protections for communications and associated data in response to changes in technology and new services and usage patterns, while preserving the legal tools necessary for government agencies to enforce the laws, respond to emergency circumstances and protect the public.

Outlook:  As of September there is some movement on the Leahy bill, but some of this hinges on how geolocation on mobile devices is handled in the various privacy bills.  DDP is working to cultivate bi-partisan support for the legislation.

• Data Breach

There have been a number of data breaches at high-profile companies that has resulted in numerous congressional hearings and legislation introduced.  The EDUCAUSE Policy Brief on privacy outlines the similarities and differences of each bill.

Outlook:  Like the comprehensive privacy bills, there is bi-partisan interest in passing some sort of data breach legislation.  As always, the devil is in the details.

Congress has a number of bills and issues to consider during the fall term.  Opinion differs as to whether any legislation will be finally enacted.  Because institutions of higher education have legitimate concerns as to how many of these bills could potentially affect our operations, EDUCAUSE will continue to monitor and report on the progress of these various pieces legislation.