5 Ways to Clarify and Strengthen US Cybersecurity Law

FBI Director James Comey, CIA Director John Brennan, DNI James Clapper, Director of the NSA Adm. Michael Rodgers, and DISA Director Lt. Gen. Vincent Stewart testify at a Capitol Hill hearing on cyber threats, Sept. 10, 2015.

Pablo Martinez Monsivais/AP

AA Font size + Print

FBI Director James Comey, CIA Director John Brennan, DNI James Clapper, Director of the NSA Adm. Michael Rodgers, and DISA Director Lt. Gen. Vincent Stewart testify at a Capitol Hill hearing on cyber threats, Sept. 10, 2015.

While most corporate counsels are still trying to figure out what the Cybersecurity Act of 2015 does for them, here are a few ways to improve on next year's round of legislation.

Christmas comes but once a year and, for the last two years, Congress has delivered a bag of goodies in cybersecurity legislation. While most corporate counsels are still trying to figure out what the Cybersecurity Act of 2015 (CSA) does for them, I’ll take a cue from my five-year-old and start composing my wish list for next year now.

To be clear, there are a lot of things I like about the CSA. Even with the last minute changes, the drafters avoided a parade of horribles. The law explicitly excludes violations of terms of service agreements from the definition of a cybersecurity threat (win). It defines a defensive measure to exclude anything that should rightly be labeled offensive (win). It has provisions that require the minimization of personal data (win). And it maintains the traditional division between civilian and military roles (huge win).

Still, there is room for improvement even at this early stage and the drafters seem to know it. The law requires the executive branch provide no fewer than twenty-four reports to Congress on various aspects of the act (with unclassified versions to be made public). It even goes so far as to require a report to Congress that requests the administration’s views on whether further changes to the law are necessary. So, in that spirit, here are five things Congress should contemplate over the coming year:​

  1. Antitrust may have gone too far (or not far enough): There can be no more whining about antitrust as a barrier to information sharing. Even before the bill, the Department of Justice had gone out of its way to make clear that antitrust wasn’t a concern. CSA makes clear that two or more parties can exchange cyber threat information without violating antitrust law. Unless, or course, you are doing it for anticompetitive purposes (see Sec. 108(e)). That’s fine for companies in most sectors that don’t compete on cybersecurity but problematic for the cybersecurity industry. Can Symantec and McAfee engage in two way sharing and exclude smaller players? Better to sanction more formal constructs with rules for participation as a group of companies have done with the Cyber Threat Alliance.
  2. Are Internet Service Providers (ISPs) “information systems”? As I have written before, the act provides legal clarity on what owners and operators of information systems can do for cybersecurity purposes. The trouble remains that it’s not clear if an ISPs’ network qualifies as an information system or a telecommunications system. If ISPs decide the act covers them, then they can screen all traffic for cyber threats without consent. Lawsuits await. Better for Congress to clarify what they mean.
  3. Let the Department of Defense (DOD) establish information sharing programs with defense companies: CSA rightly makes the Department of Homeland Security the main portal for information sharing with the private sector. It also gives the president the authority to establish information sharing portals at Commerce, Energy, Justice, and Treasury. It may make sense under a sector-specific model to broaden this list to other departments that have specific sector expertise, like Health and Human Services and Transportation. The act explicitly excludes the Department of Defense, foot stomping the point by parenthetically excluding the National Security Agency (two points for clarity). While the desire to keep NSA out of domestic information sharing is laudable, excluding all of DOD is unwise. The Defense Cyber Crime Center runs the best information sharing program out there for defense companies. While its grandfathered in, DOD should be able to expand this program with the full protection of the new law.
  4. Classified sharing requires a classified network: CSA calls for the timely sharing of “classified threat indicators” with the private sector. In cyberspace, timely does not mean quarterly in person briefings in a government facility. Congress needs to authorize and fund development of a classified network for sharing cyber indicators with private companies. Read more on that here.
  5. It may undermine sharing: For many years, bad lawyers would tell their clients that engaging in information sharing could create liability for them if they received information but failed to act on it. They recommended an ostrich-like strategy. Most CISOs ignored that advice and participated in information sharing anyway. Over time, as more organizations shared information amongst themselves, it began to create a standard of care where organizations that received cyber threat information acted upon it. It’s in the NIST Cybersecurity Framework and NIST has a draft special publication on it. CSA undoes all of that by making explicit that sharing threat information does not create a duty to warn or duty to act. That’s crazy. If we expect information sharing to help our cybersecurity woes, the least we can do is not absolve negligent organizations that didn’t act on the information they received.

This post appears courtesy of CFR.org.

Close [ x ] More from DefenseOne

Thank you for subscribing to newsletters from DefenseOne.com.
We think these reports might interest you:

  • Ongoing Efforts in Veterans Health Care Modernization

    This report discusses the current state of veterans health care

  • Modernizing IT for Mission Success

    Surveying Federal and Defense Leaders on Priorities and Challenges at the Tactical Edge

  • Top 5 Findings: Security of Internet of Things To Be Mission-Critical

    As federal agencies increasingly leverage these capabilities, government security stakeholders now must manage and secure a growing number of devices, including those being used remotely at the “edge” of networks in a variety of locations. With such security concerns in mind, Government Business Council undertook an indepth research study of federal government leaders in January 2017. Here are five of the key takeaways below which, taken together, paint a portrait of a government that is increasingly cognizant and concerned for the future security of IoT.

  • Coordinating Incident Response on Posts, Camps and Stations

    Effective incident response on posts, camps, and stations is an increasingly complex challenge. An effective response calls for seamless conversations between multiple stakeholders on the base and beyond its borders with civilian law enforcement and emergency services personnel. This whitepaper discusses what a modern dispatch solution looks like -- one that brings together diverse channels and media, simplifies the dispatch environment and addresses technical integration challenges to ensure next generation safety and response on Department of Defense posts, camps and stations.

  • Forecasting Cloud's Future

    Conversations with Federal, State, and Local Technology Leaders on Cloud-Driven Digital Transformation


When you download a report, your information may be shared with the underwriters of that document.