Ride the Lightning

Cybersecurity and Future of Law Practice Blog
by Sharon D. Nelson Esq., President of Sensei Enterprises, Inc.

CISA Goes to Obama Tucked Into Budget Bill

December 22, 2015

As SC Magazine reported last Friday, the U.S. House approved controversial cybersecurity legislation  buried within a $1.1 trillion government spending agreement that was needed to prevent a government shutdown. In fact, apparently all kinds of legislation is buried in that bill. Seems to happen way too often.

The bill passed the House Friday morning with a vote of 316-113, and was approved by the Senate with a 65-33 vote in the afternoon. The Cybersecurity Information Sharing Act (CISA) has been contentious since the beginning of its life . . . 

“Chief information officers are not excited about this,” Matthew Green, a cryptographer and professor at Johns Hopkins University told SCMagazine.com. “They are saying, we don't want anything to do with this.”

While CISA includes providing liability relief for companies sharing data with government agencies, many multinational corporations are concerned about reputational risk, especially as they try to navigate international issues such as Safe Harbor, which was ruled invalid by the European Commission in October.

“How that is all going to be resolved?” asked Green. “I have no idea, but it is the last thing that tech firms want to deal with right now.”

The act creates a voluntary cybersecurity sharing process allowing the public and private sectors to share information on cyber threats and attacks with the federal Department of Homeland Security without legal liability issues and while protecting private information. Companies would be required to review and remove any personally identifiable information unrelated to cyber threats before sharing information with the government.

Some industry groups, such as banking, have groups for sharing information about online threats, but the bill seeks to increase sharing, especially with government agencies, said David Ries, a member at Clark Hill PLC.

The key, he said, is “striking a balance between information the federal government really needs for a coordinating role and security, and not giving them too much that identifies unnecessary private details or business information.” Many readers will recognize Dave as a frequent source of RTL stories – and our regular co-author.

The bill is “dangerous” for giving intelligence agencies too much authority, and it does not go far enough to address existing problems such as unencrypted files, out-of-date software and user errors, said the Electronic Frontier Foundation, a San Francisco nonprofit that advocates for Internet privacy.

“CISA — and its amendments — do not even begin to address these serious problems,” the foundation said in a statement. “Instead, they mandate information sharing with the intelligence community, creating even more cyberspying.”

Like many others, I worry that CISA pretends to be a sheep when it is really a wolf, thinly disguised.

E-mail:    Phone: 703-359-0700
Digital Forensics/Information Security/Information Technology
http://www.senseient.com
http://twitter.com/sharonnelsonesq
www.linkedin.com/in/sharondnelson