About cookies on this site Our websites require some cookies to function properly (required). In addition, other cookies may be used with your consent to analyze site usage, improve the user experience and for advertising. For more information, please review your options. By visiting our website, you agree to our processing of information as described in IBM’sprivacy statement. To provide a smooth navigation, your cookie preferences will be shared across the IBM web domains listed here.
In a secret, 14–1 vote on March 12, the U.S. Senate Intelligence Committee approved the Cybersecurity Information Sharing Act (CISA), which encourages companies to share cyberthreat data with one another and the federal government. Some call the cyberthreat sharing bill a step in the right direction for national security, while others are worried it doesn’t do enough to protect the privacy of American citizens. What does this share-and-share-alike measure really mean for U.S. companies?
The Aim
There are several cybersecurity bills trying to make inroads with Senate committees this year. Along with CISA, there is also the Cyber Threat Sharing Act, introduced by Sen. Tom Carper, and the Cyber Intelligence Sharing and Protection Act (CISPA). The bills all focus on encouraging companies to share cyberthreat data with each other and the federal government. CISA would also protect companies from consumer lawsuits based on the disclosure or contents of this data. Ideally, information would be shared in as near to real time as possible to encourage prompt and effective security responses. While Carper’s bill hasn’t yet been acted on and CISPA may be stalling, CISA was quietly approved last week.
The Concern
When the first draft of CISA was released, 26 digital rights groups and 22 security experts signed a letter opposing its contents. The biggest bones of contention were that the original draft gave the National Security Agency (NSA) automatic access to personal data companies shared with government agencies and that companies were permitted to engage in “dangerous” countermeasures during cyberattacks.
After taking feedback, the Senate committee agreed to review the bill and make changes. However, these changes were not made public before the secret vote took place. Now, watchdog groups are concerned that any new privacy measures won’t be enough to protect the interests of citizens and companies in the United States.
In fact, the bill’s lone dissenting voter, Sen. Ron Wyden, called CISA “a surveillance bill by another name,” and believes the bill “lacks adequate protections for the privacy rights of American consumers, and that it will have a limited impact on U.S. cybersecurity,” according to The Hill.
The Future?
The Cybersecurity Information Sharing Act isn’t law yet, but the Senate vote puts it one step closer to becoming a reality. The bill holds some merit, since increased cyberthreat data sharing among companies could help slow the spread of malware. Rather than acting as technological islands, businesses could help sink malicious code by making new vulnerabilities common knowledge.
However, any bill that grants the NSA access to private information without oversight and isn’t clear on exactly how companies will be protected from information disclosures is bound to make citizens nervous. President Barack Obama has stated several times that he would veto any version of CISPA that reaches his desk; the same may extend to CISA.
U.S. cybersecurity remains a hot-button topic as new malware emerges and companies across markets and industries find themselves under threat. While information collaboration has the potential to empower the good guys, secret votes and broad federal powers may not be the best way to encourage sharing.