View source for Cybersecurity Information Sharing Act

{{Distinguish|Cybersecurity and Infrastructure Security Agency}}
{{See also |Cyber Intelligence Sharing and Protection Act}}

{{Infobox U.S. legislation
| name       = Cybersecurity Information<br>Sharing Act of 2015
| fullname     = To improve cybersecurity in the United States through enhanced sharing of information about cybersecurity threats, and for other purposes
| acronym     = CISA
| enacted by    = <!--102nd Not enacted yet-->
| title amended  = <!--US code titles changed-->
| sections created = <!--{{USC}} can be used-->
| sections amended = 
| leghisturl    = https://www.congress.gov/bill/114th-congress/senate-bill/754
| introducedin   = [[United States Senate|Senate]]
| introducedbill  = S. 2588
| introducedby   = [[Dianne Feinstein]] ([[Democratic Party (United States)|D]]-[[List of United States senators from California|CA]])
| introduceddate  = July 10, 2014
* '''Reintroduced in the''' [[United States Senate|Senate]] '''as''' S.754 '''by''' [[Richard Burr]] ([[Republican Party (United States)|R]]-[[List of United States senators from North Carolina|NC]]) '''on''' March 17, 2015
| committees    = [[United States Senate Select Committee on Intelligence|Senate Select Committee on Intelligence]]
| passedbody1 = 
| passeddate1 = 
| passedvote1 = 
}}

The '''Cybersecurity Information Sharing Act''' ('''CISA''' {{USBill|113|S|2588}} [[113th Congress]], {{USBill|114|S|754}} [[114th Congress]]) is a [[United States federal law]] designed to "improve [[cybersecurity]] in the United States through enhanced sharing of information about cybersecurity threats, and for other purposes".<ref>[https://www.feinstein.senate.gov%2Fpublic/index.cfm/files/serve/?File_id=08de1c1b-446b-478c-84a8-0c3f35963216 "Discussion Draft of the 'Cybersecurity Information Sharing Act of 2014' (S.2588)"] {{Webarchive|url=https://web.archive.org/web/20140825121127/http://www.feinstein.senate.gov/public/index.cfm/files/serve/?File_id=08de1c1b-446b-478c-84a8-0c3f35963216 |date=2014-08-25 }}, 113th Congress, 2d Session, June 11, 2014.</ref> The law allows the sharing of Internet traffic information between the U.S. government and technology and manufacturing companies. The bill was introduced in the [[United States Senate|U.S. Senate]] on July 10, 2014, and passed in the Senate on October 27, 2015.<ref>[https://www.congress.gov/bill/114th-congress/senate-bill/754 S.754 - Cybersecurity Information Sharing Act of 2015]</ref>  Opponents question CISA's value, believing it will move responsibility from private businesses to the government, thereby increasing vulnerability of [[Personal data|personal private information]], as well as dispersing personal private information across seven government agencies, including the [[National Security Agency|NSA]] and local police.

The text of the bill was incorporated by amendment into a [[Consolidated Appropriations Act, 2016|consolidated spending bill]] in the [[United States House of Representatives|U.S. House]] on December 15, 2015,<ref>[https://www.congress.gov/bill/114th-congress/house-bill/2029 H.R.2029 - Military Construction and Veterans Affairs and Related Agencies Appropriations Act, 2016]</ref> which was signed into law by President [[Barack Obama]] on December 18, 2015.<ref>[https://www.engadget.com/2015/12/18/house-senate-pass-budget-with-cisa/ Budget bill heads to President Obama's desk with CISA intact]</ref>

==History==
The Cybersecurity Information Sharing Act was introduced on July 10, 2014, during the 113th Congress, and passed the [[Senate Intelligence Committee]] by a vote of 12–3.<ref>{{cite web|url=https://www.forbes.com/sites/gregorymcneal/2014/07/09/controversial-cybersecurity-bill-known-as-cisa-advances-out-of-senate-committee/|title=Controversial Cybersecurity Bill Known As CISA Advances Out Of Senate Committee|magazine=Forbes|first=Gregory S.|last=McNeal|date=9 Jul 2014|access-date=31 Jul 2015}}</ref> The bill did not reach a full senate vote before the end of the congressional session.

The bill was reintroduced for the 114th Congress on March 12, 2015, and the bill passed the Senate Intelligence Committee by a vote of 14–1.<ref>
{{cite magazine
|url=https://www.wired.com/2015/03/cisa-cybersecurity-bill-advances-despite-privacy-critiques/
|title=CISA Cybersecurity Bill Advances Despite Privacy Concerns
|magazine=Wired
|first=Andy
|last=Greenberg
|date=12 Mar 2015
|access-date=27 Jul 2015}}</ref> Senate Majority Leader [[Mitch McConnell]] (R-KY) attempted to attach the bill as an amendment to the annual [[National Defense Authorization Act]], but was blocked 56–40, not reaching the necessary 60 votes to include the amendment.<ref>
{{cite web
|url=http://www.washingtonexaminer.com/senate-vote-falls-short-of-approving-defense-act-with-cisa-amendment/article/2566527
|title=Senate vote falls short of approving defense act with CISA amendment
|work=The Washington Examiner
|first=Charlie 
|last=Mitchell 
|date=22 Jun 2015
|access-date=28 Jul 2015}}</ref><ref>
{{cite web
|url=https://www.usatoday.com/story/news/politics/2015/06/11/cybersecurity-information-sharing-bill-senate-cloture-vote/71077022/
|title=Democrats block effort to attach cybersecurity legislation to defense bill
|newspaper=USA Today
|first=Erin
|last=Kelly
|date=11 Jun 2015
|access-date=28 Jul 2015}}</ref> Mitch McConnell hoped to bring the bill to senate-wide vote during the week of August 3–7,<ref>
{{cite web
|url=http://www.washingtonexaminer.com/senate-once-again-looks-to-bring-back-cisa/article/2568396
|title=Senate, once again, looks to bring back CISA
|work=The Washington Examiner
|first=Charlie 
|last=Mitchell 
|date=20 Jul 2015
|access-date=27 Jul 2015}}</ref> but was unable to take up the bill before the summer recess. The Senate tentatively agreed to limit debate to 21 particular amendments and a manager's amendment,<ref>
{{cite web
|url=https://thehill.com/policy/cybersecurity/255599-house-intelligence-chair-cisa-will-pass-senate-overwhelmingly/
|title=House Intel chief says cyber-sharing bill will pass 'overwhelmingly'
|newspaper=The Hill
|first=Katie Bo
|last=Williams
|date=1 Oct 2015
|access-date=4 Oct 2015}}</ref> but did not set time limits on debate. In October 2015, the US Senate took the bill back up following legislation concerning [[Sanctuary city|sanctuary cities]].<ref name=NearsVote />

==Provisions==
The main provisions of the bill make it easier for companies to share personal information with the government, especially in cases of cyber security threats. Without requiring such information sharing, the bill creates a system for federal agencies to receive threat information from private companies.<ref>{{Cite journal|last=Kominsky|first=Mitchell|date=February 2014|title=The Current Landscape of Cybersecurity Policy: Legislative Issues in the 113th Congress|url=http://harvardnsj.org/2014/02/the-current-landscape-of-cybersecurity-policy-legislative-issues-in-the-113th-congress/|journal=Harvard Law School National Security Journal}}</ref>

With respect to [[privacy]], the bill includes provisions for preventing the sharing of personal data that is irrelevant to cyber security.<ref name="Wired" /> Any personal information that does not get removed during the sharing procedure can be used in a variety of ways. These shared cyber threat indicators can be used to prosecute cyber crimes, but may also be used as evidence for crimes involving physical force.<ref name=Wired>{{cite magazine|url=https://www.wired.com/2015/03/cisa-security-bill-gets-f-security-spying/|title=CISA Security Bill: An F for Security But an A+ for Spying|magazine=Wired|first=Andy|last=Greenberg|date=20 Mar 2015|access-date=31 Jul 2015}}</ref>

==Positions==
===Indemnification===
Sharing [[National Intelligence]] threat data among public and private partners is a hard problem, and one that many care about. The National Intelligence Threat Sharing (NITS) project is intended as an innovative solution to this hard problem. Altogether NITS is both innovative and useful. But first, to ensure that NITS is trustworthy, private partners must be indemnified. Indemnification takes an act of Congress, literally.

The underlying impediment to more fulsome cooperation among buyers, sellers, and peers within a supply chain is [[indemnification]]. Indemnification is needed to secure industry partners against legal responsibility for their actions. Unfortunately, congressional refusal to offer indemnification remains an impediment to real collaboration. At least qualified immunity should be accorded. This is immunity of individuals performing tasks as part of the government's actions.

{{Biased-section|date=January 2021}}

===Businesses and trade groups===
The CISA has received some support from advocacy groups, including the [[United States Chamber of Commerce]],<ref>{{cite web|url=http://www.fiercehomelandsecurity.com/story/industry-rep-businesses-get-stronger-liability-protection-sharing-cyber-thr/2015-03-05|title=Industry rep: Businesses get stronger liability protection for sharing cyber threat info under CISA|publisher=Fierce Homeland Security|first=Dibya|last=Sarkar|date=Mar 5, 2015|access-date=July 27, 2015|archive-url=https://web.archive.org/web/20150922083840/http://www.fiercehomelandsecurity.com/story/industry-rep-businesses-get-stronger-liability-protection-sharing-cyber-thr/2015-03-05|archive-date=September 22, 2015|url-status=dead}}</ref> the [[National Cable & Telecommunications Association]], and the [[Financial Services Roundtable]].<ref name=Wired />

A number of business groups have also opposed the bill, including the [[Computer & Communications Industry Association]],<ref>{{cite web|url=http://dcinno.streetwise.co/2015/10/20/cisa-senate-vote-cybersecurity-information-sharing-act-congress/|title=Apple, Google and Friends Join Forces Ahead of Crucial CISA Decision |first=Chris|last=Bing|date=20 Oct 2015|access-date=20 Oct 2015}}</ref> as well as individual companies such as [[Twitter]], [[Yelp]], [[Apple Inc.|Apple]], and [[Reddit]].<ref>{{cite web|url=https://www.foxnews.com/tech/twitter-slams-controversial-cybersecurity-bill|title=Twitter slams controversial cybersecurity bill|publisher=Fox News|first=James |last=Rogers |date=20 Oct 2015|access-date=20 Oct 2015}}</ref>

[[BSA (The Software Alliance)]] appeared initially supportive of CISA, sending a letter on July 21, 2015, urging the senate to bring the bill up for debate.<ref>{{cite web|url=https://thehill.com/policy/cybersecurity/248645-software-industry-urges-action-on-senate-cyber-bill/|title=Software industry urges action on Senate cyber bill|newspaper=The Hill|first=Cory|last=Bennett|date=July 21, 2015|access-date=July 27, 2015}}</ref> On September 14, 2015, the BSA published a letter of support for amongst other things cyber threat information sharing legislation addressed to Congress, signed by board members [[Adobe Systems|Adobe]], [[Apple Inc.]], [[Altium]], [[Autodesk]], [[CA, Inc.|CA Technologies]], [[DataStax]], [[IBM]], [[Microsoft]], [[Minitab]], [[Oracle Corporation|Oracle]], [[Salesforce.com]], [[Siemens]], and [[NortonLifeLock|Symantec]].<ref>{{cite web|url=http://www.bsa.org/~/media/Files/Policy/data/09142015CongLeadershipDataAgendaLetter.pdf |title=Congressional Leadership Data Agenda Letter |date=September 14, 2015 |publisher=BSA}}</ref> This prompted the digital rights advocacy group [[Fight for the Future]] to organize a protest against CISA.<ref>{{cite web|url=https://www.youbetrayedus.org/ |title=Betrayed by Tech |publisher=Fight for the Future}}</ref> Following this opposition campaign, BSA stated that its letter expressed support for cyber threat sharing legislation in general, but did not endorse CISA, or any pending cyber threat sharing bill in particular.<ref>{{cite web|url=http://fortune.com/2015/09/24/tech-vendor-cybersecurity-bill/|title=Apple, Microsoft, others slammed for supporting cybersecurity bill|magazine=Fortune|first=Barb|last=Darrow|date=24 Sep 2015|access-date=4 Oct 2015}}</ref><ref>{{cite web|url=http://www.businessinsider.com/marc-benioff-tweets-against-cisa-2015-9|title=A few tweets from Salesforce's Marc Benioff threaten to squash a cyber-spying law|work=Business Insider|first=Julie|last=Bort|date=28 Sep 2015|access-date=4 Oct 2015}}</ref> BSA later stated that it is opposed to CISA in its current form.<ref>{{cite web|title = Security|url = http://www.bsa.org/policy/security/?sc_lang=en-US|website = www.bsa.org|access-date = 2015-12-18|archive-date = 2015-12-22|archive-url = https://web.archive.org/web/20151222102036/http://www.bsa.org/policy/security/?sc_lang=en-US|url-status = dead}}</ref> The [[Computer & Communications Industry Association]], another major trade group including members such as [[Google]], [[Amazon.com]], [[Cloudflare]], [[Netflix]], [[Facebook]], [[Red Hat]], and [[Yahoo!]], also announced its opposition to the bill.<ref>{{cite web|title = CCIA Urges Senate To Improve Cybersecurity Information Sharing Act|url = https://www.ccianet.org/2015/10/ccia-urges-senate-to-improve-cybersecurity-information-sharing-act/|website = www.ccianet.org/| date=15 October 2015 |access-date = 2015-12-18}}</ref>

===Government officials===
Proponents of CISA include the bill's main cosponsors, senators [[Dianne Feinstein]] (D-CA) and [[Richard Burr]] (R-NC).<ref name=NearsVote>{{cite web|url=http://www.nationaljournal.com/editorial/kaveh-waddell|title=Cybersecurity Bill Nears Crucial Senate Vote |work=National Journal|first=Kaveh|last=Waddell|date=20 Oct 2015|access-date=20 Oct 2015}}</ref>

Some senators have announced opposition to CISA, including [[Ron Wyden]] (D-OR), [[Rand Paul]] (R-KY), and [[Bernie Sanders]] (I-VT).<ref>{{cite web|url=http://www.dailydot.com/politics/bernie-sanders-cisa-senate-2016-presidential-candidates/|title=Bernie Sanders comes out against CISA, a controversial cybersecurity bill|publisher=Daily Dot|first=Eric|last=Geller|date=12 Oct 2015|access-date=20 Oct 2015}}</ref>

Senator Ron Wyden (D-OR) has objected to the bill based on a classified legal opinion from the [[United States Department of Justice|Justice Department]] written during the early [[Presidency of George W. Bush|George W Bush administration]]. The [[Obama administration]] states that it does not rely on the legal justification laid out in the memo.<ref>{{cite web|url=http://www.nationaljournal.com/tech/what-s-inside-the-justice-department-s-secret-cybersecurity-memo-20150727|title=What's Inside the Justice Department's Secret Cybersecurity Memo?|work=National Journal|first=Dustin|last=Volz|date=July 27, 2015|access-date=July 28, 2015}}</ref><ref>{{cite web|url=https://www.theguardian.com/commentisfree/2015/jun/13/cisa-cybersecurity-surveillance-government-data-access|title=A government surveillance bill by any other name is just as dangerous|newspaper=The Guardian|first=Trevor|last=Timm|date=June 13, 2015|access-date=July 28, 2015}}</ref> Wyden has made repeated requests to the [[US Attorney General]] to declassify the memo,<ref>{{cite web|url=https://www.techdirt.com/articles/20150204/05522629903/senator-wyden-follows-up-with-eric-holder-all-requests-doj-has-totally-ignored.shtml|title=Senator Wyden Follows Up With Eric Holder On All Of The Requests The DOJ Has Totally Ignored|publisher=Tech Dirt|first= Mike|last= Masnick|date=4 Feb 2015|access-date=July 31, 2015}}</ref> dating at least as far back as when a 2010 [[Office of Inspector General]] report cited the memo as a legal justification for the FBI's warrantless wire-tapping program.<ref>{{cite web|url=https://www.theatlantic.com/politics/archive/2010/02/obamas-secret-wiretap-memo/35134/|title=Obama's Secret Wiretap Memo|series=DHS/NPPD/PIA-029 Automated Indicator Sharing|publisher=The Atlantic|first=Marc|last=Ambinder|date=February 1, 2010|access-date=July 31, 2015}}</ref>

On August 4, 2015, White House spokesman [[Eric Schultz]] endorsed the legislation, calling for the senate to "take up this bill as soon as possible and pass it".<ref>{{cite web|url=https://thehill.com/policy/cybersecurity/250241-white-house-endorses-senate-cyber-bill/|title=White House endorses Senate cyber bill|newspaper=The Hill|first=Cory|last=Bennett|date=4 Aug 2015|access-date=4 Oct 2015}}</ref>

The [[United States Department of Homeland Security]] initially supported the bill, with [[Jeh Johnson]], the secretary of the DHS, calling for the bill to move forward on September 15.<ref>{{cite web|url=https://thehill.com/policy/cybersecurity/253803-dhs-head-to-senate-move-on-stalled-cybersecurity-bill/|title=Homeland Security chief pushes Senate to move cyber bill|newspaper=The Hill|first=Katie Bo|last=Williams|date=16 Sep 2015|access-date=20 Oct 2015}}</ref> However, in an August 3 letter to senator [[Al Franken]] (D-MN), the deputy secretary of the DHS, [[Alejandro Mayorkas]], expressed a desire to have all connections be brokered by the DHS, given the department's charter to protect the executive branch networks. In the letter, the DHS found issue with the direct sharing of information with all government agencies, advocating instead that the DHS be the sole recipient of cyberthreat information, allowing it to scrub out private information.<ref>{{cite web|url=http://www.dailydot.com/politics/dhs-cisa-letter/|title=Homeland Security joins privacy groups in pushback against CISA|publisher=The Daily Dot|first=Eric|last=Geller|date=3 Aug 2015|access-date=20 Oct 2015}}</ref> In addition, the Department of Homeland Security has published a Privacy Impact Assessment detailing its internal review of the proposed system for handling incoming indicators from Industry.<ref>{{cite web|url=https://www.dhs.gov/publication/dhsnppdpia-029-automated-indicator-sharing|publisher=The Department of Homeland Security|title=DHS/NPPD/PIA-029 Automated Indicator Sharing|date=28 Oct 2015|access-date=18 Dec 2015}}</ref>

===Civil liberties groups===
Privacy advocates opposed a version of the Cybersecurity Information Sharing Act, passed by the Senate in October 2015, that left intact portions of the law they said made it more amenable to surveillance than actual security while quietly stripping out several of its remaining privacy protections.<ref>{{Cite magazine|url=https://www.wired.com/2015/10/cisa-cybersecurity-information-sharing-act-passes-senate-vote-with-privacy-flaws/|title=CISA Security Bill Passes Senate with Privacy Flaws Unfixed|magazine=Wired}}</ref>
CISA has been criticized by advocates of [[Internet privacy]] and [[civil liberties]], such as the [[Electronic Frontier Foundation]] and the [[American Civil Liberties Union]].<ref>[https://www.eff.org/deeplinks/2014/06/zombie-bill-comes-back-look-senates-cybersecurity-information-sharing-act-2014 "A Zombie Bill Comes Back to Life: A Look at The Senate's Cybersecurity Information Sharing Act of 2014"], Mark Jaycox, Electronic Frontier Foundation (EFF), June 29, 2014.</ref><ref>[https://www.aclu.org/blog/national-security-technology-and-liberty/beware-dangers-congress-latest-cybersecurity-bill "Beware the Dangers of Congress’ Latest Cybersecurity Bill"], Sandra Fulton, ACLU (Washington), June 27, 2014.</ref> It has been compared{{by whom|date=January 2019}} to the criticized [[Cyber Intelligence Sharing and Protection Act]] proposals of 2012 and 2013, which passed the United States House of Representatives, but did not pass the Senate.<ref>{{Cite web|title=H.R. 624 (113th): Cyber Intelligence Sharing and Protection Act -- House Vote #117 -- Apr 18, 2013|url=https://www.govtrack.us/congress/votes/113-2013/h117|access-date=2020-11-12|website=GovTrack.us|language=en}}</ref>

===Similar laws in different countries===
[https://www.gov.uk/government/publications/2010-to-2015-government-policy-cyber-security/2010-to-2015-government-policy-cyber-security United Kingdom government policy: cyber security]

[http://www.gov.scot/Topics/People/Young-People/gettingitright/information-sharing The Scottish Government Information Sharing]

==See also==

* [[Anti-Counterfeiting Trade Agreement]]
* [[Chinese intelligence operations in the United States]]
* [[Communications Assistance for Law Enforcement Act]]
* [[Federal Information Security Management Act of 2002]]
* [[Freedom of information laws by country]]
* [[Intellectual Property Attache Act]]
* [[National Security Agency]]
* [[Vulnerabilities Equities Process]]

==References==
{{reflist|colwidth=30em}}

== External links ==
* [https://beta.congress.gov/bill/113th-congress/senate-bill/2588 S.2588 - Cybersecurity Information Sharing Act of 2014], Congress.gov, Library of Congress.
* [http://www.mercurynews.com/opinion/ci_26188154/dianne-feinstein-cybersecurity-information-sharing-act-will-help "Cybersecurity Information Sharing Act will help protect us"], Dianne Feinstein, ''San Jose Mercury News'', July 21, 2014.
* [https://www.forbes.com/sites/gregorymcneal/2014/07/09/controversial-cybersecurity-bill-known-as-cisa-advances-out-of-senate-committee/ Forbes: Controversial Cybersecurity Bill Known As CISA Advances Out Of Senate Committee],  Gregory S. McNeal, July 9, 2014.
* [https://cdt.org/insight/analysis-of-feinstein-chambliss-cybersecurity-information-sharing-act-of-2014/ Center for Democracy and Technology: Analysis of Cybersecurity Information Sharing Act], Gregory T. Nojeim and Jake Laperruque, July 8, 2014.
*[https://www.wired.com/2015/10/cisa-cybersecurity-information-sharing-act-passes-senate-vote-with-privacy-flaws - CISA Security Bill Passes Senate With Privacy Flaws Unfixed]  ANDY GREENBERG AND YAEL GRAUER Oct 27, 2015
*[https://www.gov.uk/government/publications/2010-to-2015-government-policy-cyber-security/2010-to-2015-government-policy-cyber-security/] 2010 to 2015 government policy: cyber security

[[Category:Computer security]]
[[Category:Copyright enforcement]]
[[Category:Internet law in the United States]]
[[Category:Proposed legislation of the 113th United States Congress]]
[[Category:Internet censorship]]