Sharing Act Passes US Senate

A broad consensus has emerged in the last few years regarding the need to enhance sharing of cybersecurity threat information within the private sector and between the private sector and the government, subject to appropriate privacy safeguards. On Tuesday, October 27, the US Senate passed significant legislation on that topic—the Cybersecurity Information Sharing Act (CISA, S.754)—by a vote of 74-21.

CISA seeks to encourage private-sector companies to voluntarily share information about cybersecurity threats with other private entities and with the federal government, and to take defensive measures against such threats. Tuesday’s vote represents the first time that the Senate—after three-and-a-half years of trying—has passed cybersecurity information sharing legislation. Key stakeholders in the House and Senate now expect the bill to go to conference with similar House legislation, and the prospects of passage of information sharing legislation into law this Congress appear to be strong. Companies engaged in, or contemplating, cybersecurity information sharing should continue to monitor this important legislation as it moves toward enactment into law.

CISA authorizes private entities to monitor their information systems “for cybersecurity purposes,” to take defensive measures on such systems for such purposes and to share information about cybersecurity threats and defensive measures with the federal government. It provides several incentives to private entities in order to encourage them to take these steps. Most notably, the bill would provide private entities certain liability protections for actions taken in monitoring their systems for cybersecurity threats or in sharing cyber threat information. It also would protect private entities from antitrust liability for sharing information about cybersecurity threats with other private entities.

The legislation directs the Director of National Intelligence (DNI), the Department of Homeland Security (DHS), the Department of Defense (DOD) and the Department of Justice (DOJ) to lead the development of procedures to facilitate and promote the federal government’s sharing of information about cybersecurity threats. It requires DHS to build a capability for accepting information about cybersecurity threats from private entities in the first instance and sharing that information with other federal agencies in a timely manner. (In a key concession to address privacy concerns, a private-sector entity must share information with DHS if it wishes to receive the liability protections CISA provides.) The bill would also protect cyber threat indicators and defensive measures provided to the government from disclosure under FOIA.

Read more: US Senate Passes Cybersecurity Information Sharing Act