5 Ways to Clarify and Strengthen US Cybersecurity Law

FBI Director James Comey, CIA Director John Brennan, DNI James Clapper, Director of the NSA Adm. Michael Rodgers, and DISA Director Lt. Gen. Vincent Stewart testify at a Capitol Hill hearing on cyber threats, Sept. 10, 2015.

Pablo Martinez Monsivais/AP

AA Font size + Print

FBI Director James Comey, CIA Director John Brennan, DNI James Clapper, Director of the NSA Adm. Michael Rodgers, and DISA Director Lt. Gen. Vincent Stewart testify at a Capitol Hill hearing on cyber threats, Sept. 10, 2015.

While most corporate counsels are still trying to figure out what the Cybersecurity Act of 2015 does for them, here are a few ways to improve on next year's round of legislation.

Christmas comes but once a year and, for the last two years, Congress has delivered a bag of goodies in cybersecurity legislation. While most corporate counsels are still trying to figure out what the Cybersecurity Act of 2015 (CSA) does for them, I’ll take a cue from my five-year-old and start composing my wish list for next year now.

To be clear, there are a lot of things I like about the CSA. Even with the last minute changes, the drafters avoided a parade of horribles. The law explicitly excludes violations of terms of service agreements from the definition of a cybersecurity threat (win). It defines a defensive measure to exclude anything that should rightly be labeled offensive (win). It has provisions that require the minimization of personal data (win). And it maintains the traditional division between civilian and military roles (huge win).

Still, there is room for improvement even at this early stage and the drafters seem to know it. The law requires the executive branch provide no fewer than twenty-four reports to Congress on various aspects of the act (with unclassified versions to be made public). It even goes so far as to require a report to Congress that requests the administration’s views on whether further changes to the law are necessary. So, in that spirit, here are five things Congress should contemplate over the coming year:​

  1. Antitrust may have gone too far (or not far enough): There can be no more whining about antitrust as a barrier to information sharing. Even before the bill, the Department of Justice had gone out of its way to make clear that antitrust wasn’t a concern. CSA makes clear that two or more parties can exchange cyber threat information without violating antitrust law. Unless, or course, you are doing it for anticompetitive purposes (see Sec. 108(e)). That’s fine for companies in most sectors that don’t compete on cybersecurity but problematic for the cybersecurity industry. Can Symantec and McAfee engage in two way sharing and exclude smaller players? Better to sanction more formal constructs with rules for participation as a group of companies have done with the Cyber Threat Alliance.
  2. Are Internet Service Providers (ISPs) “information systems”? As I have written before, the act provides legal clarity on what owners and operators of information systems can do for cybersecurity purposes. The trouble remains that it’s not clear if an ISPs’ network qualifies as an information system or a telecommunications system. If ISPs decide the act covers them, then they can screen all traffic for cyber threats without consent. Lawsuits await. Better for Congress to clarify what they mean.
  3. Let the Department of Defense (DOD) establish information sharing programs with defense companies: CSA rightly makes the Department of Homeland Security the main portal for information sharing with the private sector. It also gives the president the authority to establish information sharing portals at Commerce, Energy, Justice, and Treasury. It may make sense under a sector-specific model to broaden this list to other departments that have specific sector expertise, like Health and Human Services and Transportation. The act explicitly excludes the Department of Defense, foot stomping the point by parenthetically excluding the National Security Agency (two points for clarity). While the desire to keep NSA out of domestic information sharing is laudable, excluding all of DOD is unwise. The Defense Cyber Crime Center runs the best information sharing program out there for defense companies. While its grandfathered in, DOD should be able to expand this program with the full protection of the new law.
  4. Classified sharing requires a classified network: CSA calls for the timely sharing of “classified threat indicators” with the private sector. In cyberspace, timely does not mean quarterly in person briefings in a government facility. Congress needs to authorize and fund development of a classified network for sharing cyber indicators with private companies. Read more on that here.
  5. It may undermine sharing: For many years, bad lawyers would tell their clients that engaging in information sharing could create liability for them if they received information but failed to act on it. They recommended an ostrich-like strategy. Most CISOs ignored that advice and participated in information sharing anyway. Over time, as more organizations shared information amongst themselves, it began to create a standard of care where organizations that received cyber threat information acted upon it. It’s in the NIST Cybersecurity Framework and NIST has a draft special publication on it. CSA undoes all of that by making explicit that sharing threat information does not create a duty to warn or duty to act. That’s crazy. If we expect information sharing to help our cybersecurity woes, the least we can do is not absolve negligent organizations that didn’t act on the information they received.

This post appears courtesy of CFR.org.

Close [ x ] More from DefenseOne
 
 

Thank you for subscribing to newsletters from DefenseOne.com.
We think these reports might interest you:

  • Federal IT Applications: Assessing Government's Core Drivers

    In order to better understand the current state of external and internal-facing agency workplace applications, Government Business Council (GBC) and Riverbed undertook an in-depth research study of federal employees. Overall, survey findings indicate that federal IT applications still face a gamut of challenges with regard to quality, reliability, and performance management.

    Download
  • PIV- I And Multifactor Authentication: The Best Defense for Federal Government Contractors

    This white paper explores NIST SP 800-171 and why compliance is critical to federal government contractors, especially those that work with the Department of Defense, as well as how leveraging PIV-I credentialing with multifactor authentication can be used as a defense against cyberattacks

    Download
  • GBC Issue Brief: Supply Chain Insecurity

    Federal organizations rely on state-of-the-art IT tools and systems to deliver services efficiently and effectively, and it takes a vast ecosystem of organizations, individuals, information, and resources to successfully deliver these products. This issue brief discusses the current threats to the vulnerable supply chain - and how agencies can prevent these threats to produce a more secure IT supply chain process.

    Download
  • Data-Centric Security vs. Database-Level Security

    Database-level encryption had its origins in the 1990s and early 2000s in response to very basic risks which largely revolved around the theft of servers, backup tapes and other physical-layer assets. As noted in Verizon’s 2014, Data Breach Investigations Report (DBIR)1, threats today are far more advanced and dangerous.

    Download
  • Information Operations: Retaking the High Ground

    Today's threats are fluent in rapidly evolving areas of the Internet, especially social media. Learn how military organizations can secure an advantage in this developing arena.

    Download

When you download a report, your information may be shared with the underwriters of that document.