Cyber bill strong on info sharing, light on privacy protections
Connecting state and local government leaders
The Cyber Intelligence Sharing and Protection Act encourages public/private sharing of threat information, but contains few restrictions on the data shared and no protection for individual privacy.
The House Intelligence Committee is scheduled to mark up Dec. 1 the newly introduced cybersecurity bill intended to encourage sharing of threat intelligence between government and industry.
The Cyber Intelligence Sharing and Protection Act of 2011 (HR 3523) was introduced Nov. 30 by committee Chairman Mike Rogers (R-Mich.) and Ranking Member Dutch Ruppersberger (D-Md.) and would require the intelligence community to establish procedures for sharing classified cybersecurity intelligence with the private sector, and would provide incentives for private entities to share information with the government.
But for the moment at least, it contains no privacy safeguards for personal information.
Related story:
Could WikiLeaks set back the cause of information sharing?
The bill builds on the Defense Department’s Defense/Industrial Base pilot in which DOD shares classified threat intelligence with a handful of private companies.
The legislation addresses a long-standing concern in the cybersecurity community that information sharing with government has been a one-way street.
“Historically, the track record has been pretty poor,” said Paul Royal, cybersecurity expert and research scientist for the Georgia Tech Information Security Center. The government has been a “black hole of information,” where data goes in and does not come out.
Andy Purdy, former head of the Homeland Security Department’s National Cyber Security Division and US-CERT, called the bill an “important step forward” that begins the process of establishing a framework for information sharing. The fact that it is only a beginning should not be held against it, he said. “The perfect is the enemy of the good,” said Purdy, who now is chief cybersecurity strategist for CSC Inc.
Bob Dix, vice president of government affairs and critical infrastructure protection at Juniper Networks and former House Government Oversight Committee staffer, said the bill’s limited scope is one of its strengths.
“They haven’t tried to boil the ocean,” he said. “It takes a chewable bite in an effort to change the culture from ‘need to know’ to ‘need to share.’”
Sections of the bill covering data provided by the private sector to government have raised concerns with privacy and civil liberties advocates, however. They allow any organization to share “cyber threat information with any other entity, including the federal government.” The provider can place restrictions on how the information can be used or further shared, but there are no privacy safeguards to protect individuals whose information might be swept up.
This need not be a deal-breaker, Royal and Purdy agreed.
“Privacy is always an important concern, privacy should never be assumed,” Purdy said. But amendments already have been discussed that would give more oversight authority to inspectors general on privacy issues, he said.
“It might be prudent to amend part of the bill to specifically address personally identifiable information,” Royal said. But he did not see the issue as a deal breaker because he is optimistic that providers of information will have business incentives to clean or anonymize any information provided to government.
The bill would require the national intelligence director within 60 days to establish plans for sharing classified data with persons and organizations with appropriate clearance, and gives intelligence agencies authority to grant and expedite that clearance.
Information provided to government would be treated as proprietary and protected from disclosure, and organizations would be shielded from liability for how they use and share that data.
Despite shortcomings, observers generally lauded the bill’s intent.
“Information sharing is an enabler, a tool for building situational awareness,” Dix said.
“If everybody shared, everybody would be a lot better off,” Royal said.