5 Ways to Clarify and Strengthen US Cybersecurity Law

FBI Director James Comey, CIA Director John Brennan, DNI James Clapper, Director of the NSA Adm. Michael Rodgers, and DISA Director Lt. Gen. Vincent Stewart testify at a Capitol Hill hearing on cyber threats, Sept. 10, 2015.

Pablo Martinez Monsivais/AP

AA Font size + Print

FBI Director James Comey, CIA Director John Brennan, DNI James Clapper, Director of the NSA Adm. Michael Rodgers, and DISA Director Lt. Gen. Vincent Stewart testify at a Capitol Hill hearing on cyber threats, Sept. 10, 2015.

While most corporate counsels are still trying to figure out what the Cybersecurity Act of 2015 does for them, here are a few ways to improve on next year's round of legislation.

Christmas comes but once a year and, for the last two years, Congress has delivered a bag of goodies in cybersecurity legislation. While most corporate counsels are still trying to figure out what the Cybersecurity Act of 2015 (CSA) does for them, I’ll take a cue from my five-year-old and start composing my wish list for next year now.

To be clear, there are a lot of things I like about the CSA. Even with the last minute changes, the drafters avoided a parade of horribles. The law explicitly excludes violations of terms of service agreements from the definition of a cybersecurity threat (win). It defines a defensive measure to exclude anything that should rightly be labeled offensive (win). It has provisions that require the minimization of personal data (win). And it maintains the traditional division between civilian and military roles (huge win).

Still, there is room for improvement even at this early stage and the drafters seem to know it. The law requires the executive branch provide no fewer than twenty-four reports to Congress on various aspects of the act (with unclassified versions to be made public). It even goes so far as to require a report to Congress that requests the administration’s views on whether further changes to the law are necessary. So, in that spirit, here are five things Congress should contemplate over the coming year:​

  1. Antitrust may have gone too far (or not far enough): There can be no more whining about antitrust as a barrier to information sharing. Even before the bill, the Department of Justice had gone out of its way to make clear that antitrust wasn’t a concern. CSA makes clear that two or more parties can exchange cyber threat information without violating antitrust law. Unless, or course, you are doing it for anticompetitive purposes (see Sec. 108(e)). That’s fine for companies in most sectors that don’t compete on cybersecurity but problematic for the cybersecurity industry. Can Symantec and McAfee engage in two way sharing and exclude smaller players? Better to sanction more formal constructs with rules for participation as a group of companies have done with the Cyber Threat Alliance.
  2. Are Internet Service Providers (ISPs) “information systems”? As I have written before, the act provides legal clarity on what owners and operators of information systems can do for cybersecurity purposes. The trouble remains that it’s not clear if an ISPs’ network qualifies as an information system or a telecommunications system. If ISPs decide the act covers them, then they can screen all traffic for cyber threats without consent. Lawsuits await. Better for Congress to clarify what they mean.
  3. Let the Department of Defense (DOD) establish information sharing programs with defense companies: CSA rightly makes the Department of Homeland Security the main portal for information sharing with the private sector. It also gives the president the authority to establish information sharing portals at Commerce, Energy, Justice, and Treasury. It may make sense under a sector-specific model to broaden this list to other departments that have specific sector expertise, like Health and Human Services and Transportation. The act explicitly excludes the Department of Defense, foot stomping the point by parenthetically excluding the National Security Agency (two points for clarity). While the desire to keep NSA out of domestic information sharing is laudable, excluding all of DOD is unwise. The Defense Cyber Crime Center runs the best information sharing program out there for defense companies. While its grandfathered in, DOD should be able to expand this program with the full protection of the new law.
  4. Classified sharing requires a classified network: CSA calls for the timely sharing of “classified threat indicators” with the private sector. In cyberspace, timely does not mean quarterly in person briefings in a government facility. Congress needs to authorize and fund development of a classified network for sharing cyber indicators with private companies. Read more on that here.
  5. It may undermine sharing: For many years, bad lawyers would tell their clients that engaging in information sharing could create liability for them if they received information but failed to act on it. They recommended an ostrich-like strategy. Most CISOs ignored that advice and participated in information sharing anyway. Over time, as more organizations shared information amongst themselves, it began to create a standard of care where organizations that received cyber threat information acted upon it. It’s in the NIST Cybersecurity Framework and NIST has a draft special publication on it. CSA undoes all of that by making explicit that sharing threat information does not create a duty to warn or duty to act. That’s crazy. If we expect information sharing to help our cybersecurity woes, the least we can do is not absolve negligent organizations that didn’t act on the information they received.

This post appears courtesy of CFR.org.

Close [ x ] More from DefenseOne

Thank you for subscribing to newsletters from DefenseOne.com.
We think these reports might interest you:

  • Software-Defined Networking

    So many demands are being placed on federal information technology networks, which must handle vast amounts of data, accommodate voice and video, and cope with a multitude of highly connected devices while keeping government information secure from cyber threats. This issue brief discusses the state of SDN in the federal government and the path forward.

  • Military Readiness: Ensuring Readiness with Analytic Insight

    To determine military readiness, decision makers in defense organizations must develop an understanding of complex inter-relationships among readiness variables. For example, how will an anticipated change in a readiness input really impact readiness at the unit level and, equally important, how will it impact readiness outside of the unit? Learn how to form a more sophisticated and accurate understanding of readiness and make decisions in a timely and cost-effective manner.

  • Cyber Risk Report: Cybercrime Trends from 2016

    In our first half 2016 cyber trends report, SurfWatch Labs threat intelligence analysts noted one key theme – the interconnected nature of cybercrime – and the second half of the year saw organizations continuing to struggle with that reality. The number of potential cyber threats, the pool of already compromised information, and the ease of finding increasingly sophisticated cybercriminal tools continued to snowball throughout the year.

  • A New Security Architecture for Federal Networks

    Federal government networks are under constant attack, and the number of those attacks is increasing. This issue brief discusses today's threats and a new model for the future.

  • Information Operations: Retaking the High Ground

    Today's threats are fluent in rapidly evolving areas of the Internet, especially social media. Learn how military organizations can secure an advantage in this developing arena.


When you download a report, your information may be shared with the underwriters of that document.