I think that is due to the bill's critics coming in with preconceived notions that there should basically be no real regulations on the Internet and also of their misunderstanding of what legislation looks like and how it's interpreted. Obviously the Internet needs to stay free, but there is now a major reaction about any little thing that the government tries to do in that sphere. Obviously this is justified in many cases, just not this one.

I think the language of the bill is actually quite clear about cyber security and what that means. There might be some missing context about how this is exclusively national security issues. If you have a virus on your system or are uploading illegal media, that is not national security. The government acquiring that info without your consent would still be illegal and is clearly not the intent here.

In the same light, data shared by ISPs isn't going to be about their users -- it's going to be about keeping ISPs running in the face of a major compromise or overt attack. Keep in mind that many ISPs own and maintain the major Internet backbones that basically keep the country functioning at this point. So again, it's about their relevance to national security, not about citizens' personal activity.