Antitrust Law Daily Wrap Up, ANTITRUST NEWS: Cybersecurity sharing bill with antitrust exemption passed by Senate Intelligence Committee, (Mar 13, 2015)

By Edward L. Puzzo, J.D.

The proposed Cybersecurity Information Sharing Act of 2015 (CISA), which includes an antitrust exemption for private entities sharing cybersecurity information, has been passed by the Senate Select Committee on Intelligence (SSCI). The bill, co-sponsored by SSCI Chairman Richard Burr (R, N.C.) and Vice Chairman Dianne Feinstein (D, Calif.), passed through committee on a vote of 14 to 1, Sen. Burr’s office announced. The bill will now advance to the Senate floor.

The stated purpose of CISA is to combat cybersecurity threats by creating incentives for the sharing of threat information between private entities, and between private entities and the government, by offering liability protection to the private sector when sharing such information, in a manner that still protects individual privacy and civil liberties.

"In just the last year, hundreds of millions of Americans have had their data compromised, a number of major American companies have been attacked, intellectual property has been stolen, and there have even been attempts to hack our critical infrastructure,” Sen. Feinstein stated. “This bill would help defend against cyber-attacks by allowing purely voluntary information sharing—limited to specific information about cyber threats—to better help the private sector and government understand and respond to these threats.”

Cyber threat information sharing. CISA would direct increased sharing of classified and unclassified information about cyber threats with the private sector, including declassification of intelligence as appropriate. The legislation would authorize private entities to monitor their networks, or those of their consenting customers, for cybersecurity purposes, and share cyber threat indicators or defensive measures with each other or with the government. It would also require the establishment of a Department of Homeland Security portal as the primary way to notify the government of cyber threat indicators and defensive measures.

Antitrust liability protection. CISA provides liability protection for companies' appropriate use of additional cybersecurity information exchanges. The bill specifies that it would not be considered a violation of any provision of the antitrust laws for two or more private entities to disclose or exchange cyber threat indicators, nor to cooperate in the prevention, investigation, or mitigation of a cybersecurity threat. The antitrust liability protection is limited to information stored or processed on an information system.

Privacy. According to the sponsors, the bill protects privacy by (1) making sharing voluntary and not requiring any private sector entity to share cyber threat information; (2) narrowly defining the term "cyber threat indicator" to limit the amount of information that may be shared; (3) limiting the use of cyber threat indicators to specific purposes, including the prevention of cybersecurity threats and serious crimes; and (4) by requiring the removal of personal information prior to the sharing of cyber threat indicators.

However, a number of civil liberties organizations contend that, despite the cited privacy protections, CISA would actually undermine privacy and civil liberties. In a March 2, 2015 letter to the committee, a number of organizations —including the Center for Democracy & Technology, the American Civil Liberties Union, the Electronic Frontier Foundation, and the American Library Association—objected that CISA would require dissemination of personal data to military and intelligence agencies, including the National Security Agency (NSA). They noted that major technology companies—such as Apple, Google, Facebook and Microsoft—have stated that they would not voluntarily share user information with the NSA. Thus, CISA could disincentivize sharing, undercutting a key goal of the legislation.

Further, the organizations claimed that CISA does not effectively require private entities to strip out indentifying information for individuals known to be unrelated to a cybersecurity threat, prior to sharing threat information with the government. They contend that the “known to be unrelated to a cybersecurity threat” limitation could act to encourage companies to retain identifying information by default.

News: Antitrust Privacy