Antitrust Law Daily Wrap Up, ANTITRUST NEWS: U.S. Senate passes Cybersecurity Information Sharing Act, (Oct 28, 2015)

By Greg Hammond, J.D.

The U.S. Senate passed the Cybersecurity Information Sharing Act (CISA) yesterday by a vote of 74-21. The bill (S.754), which is intended to improve cybersecurity in the United States through enhanced sharing of information about cybersecurity threats, includes an antitrust exemption for those exchanging information for the purposes of preventing, investigating, or mitigating such threats.

As written, S.754 would: (1) give companies the authority and liability protection to voluntarily share information concerning cyber threat indicators and defensive cyber measures with other companies and the federal government; (2) allow companies to monitor their own networks, customers’ networks, and third parties’ networks—upon express authorization and consent—for cybersecurity purposes; and (3) authorize private entities’ use of “defensive measures” on their networks for cybersecurity purposes.

The bill also contains an antitrust exemption, stating that “it shall not be considered a violation of any provision of antitrust laws for 2 or more private entities to exchange or provide a cyber threat indicator, or assistance relating to the prevention, investigation, or mitigation of a cybersecurity threat, for cybersecurity purposes.” The exemption applies to information that is exchanged or assistance provided to assist with facilitating the prevention, investigation, or mitigation of a cybersecurity threat—or communicating or disclosing a cyber threat indicator to help prevent, investigate, or mitigate the effect of a cybersecurity threat—to an information system or information that is stored on, processed by, or transiting an information system.

“This landmark bill finally better secures Americans’ private information from foreign hackers,” stated Senate Intelligence Committee Chairman Richard Burr (R-N.C.), who sponsored the bill. “American businesses and government agencies face cyber-attacks on a daily basis. We cannot sit idle while foreign agents and criminal gangs continue to steal Americans’ personal information as we saw in the Office of Personnel Management, Target, and Sony hacks. This legislation gives the government and U.S. companies new voluntary collaborative tools so that they can work together against hackers that have been all too successful at stealing the personal information of millions of Americans for years. I thank Vice Chairman Feinstein for her tenacity in working to get this bill through the Senate.”

The U.S. House of Representatives passed two similar bills earlier this year: (1) the “National Cybersecurity Protection Advancement Act of 2015” (H.R. 1731), which would amend the Homeland Security Act of 2002 to improve multi-directional sharing of information concerning cybersecurity risks, to strengthen privacy and civil liberties protections, and to provide an antitrust exemption for entities sharing information concerning the prevention, investigation, or mitigation of cybersecurity risk of incident; and (2) the “Protecting Cyber Networks Act” (H.R. 1560), which seeks to amend the Homeland Security Act of 2002 by enhancing the sharing of information concerning cybersecurity threats.

With the passing of S.754, the two chambers of Congress can begin efforts to reconcile differences between the three bills to produce legislation that is acceptable to both Congress and the White House.

“I’d like to thank Chairman Burr for standing shoulder-to-shoulder with me to get this bipartisan bill passed,” said Senate Intelligence Committee Vice Chairman Dianne Feinstein. “I’m very grateful for the work we’ve been able to do together. For a bill as technically difficult as this one, such cooperation was absolutely necessary. This bill will allow companies and the government to voluntarily share information about cyber threats and the defensive measures they can implement to protect their networks. We took every step we could to satisfy privacy concerns. There’s a lot more work ahead, including conferencing the final legislation, but I believe this is a very good bill that reflects consensus on a very complicated issue.”

News: Antitrust Privacy