ACA has joined the Protecting America's Cyber Networks Coalition, a group of associations organized to support the Cybersecurity Information Sharing Act. CISA is a proposal to improve cybersecurity in the United States through enhanced sharing of information about cybersecurity threats and for other purposes. The bill would permit the sharing of Internet traffic information between the U.S. government and technology and manufacturing companies.
The bill was introduced in the U.S. Senate on July 10, and is expected to be considered and voted upon later in September.
The coalition has successfully pressed Congress to write legislation in a way that would restrict the government from compelling companies to turn over data of any kind. To this extent, industry and privacy groups agree on the critical point that companies must not be forced to report to the government. The coalition members also believe, as privacy advocates surely do, that foreign governments must not enact cyber threat-sharing laws obliging companies to turn over information.
The coalition contends that mandating the disclosure of cyber threat data and defensive measures would damage trusted relationships among businesses, consumers, and government entities that are needed to guard sensitive commercial and customer information from cyberattacks. Coalition members have productive partnerships with federal agencies and departments to help companies manage cybersecurity incidents. Reporting mandates would severely damage these relationships.
CISA also contains language prohibiting a "new information sharing relationship" between a business and a government agency or department. The bill prevents the government from making a private entity amend or break a contract that it has with a business or government partner. Additionally, CISA also containsan "anti-tasking" provision, which ensures that a business is not obliged to provide information to the federal government. Indeed, the committee report that accompanies the legislation provides another backstop, saying that CISA "creates a completely voluntary information-sharing framework." Both the letter and spirit of CISA show that "voluntary" means voluntary.
The bill was introduced in the U.S. Senate on July 10, and is expected to be considered and voted upon later in September.
The coalition has successfully pressed Congress to write legislation in a way that would restrict the government from compelling companies to turn over data of any kind. To this extent, industry and privacy groups agree on the critical point that companies must not be forced to report to the government. The coalition members also believe, as privacy advocates surely do, that foreign governments must not enact cyber threat-sharing laws obliging companies to turn over information.
The coalition contends that mandating the disclosure of cyber threat data and defensive measures would damage trusted relationships among businesses, consumers, and government entities that are needed to guard sensitive commercial and customer information from cyberattacks. Coalition members have productive partnerships with federal agencies and departments to help companies manage cybersecurity incidents. Reporting mandates would severely damage these relationships.
CISA also contains language prohibiting a "new information sharing relationship" between a business and a government agency or department. The bill prevents the government from making a private entity amend or break a contract that it has with a business or government partner. Additionally, CISA also containsan "anti-tasking" provision, which ensures that a business is not obliged to provide information to the federal government. Indeed, the committee report that accompanies the legislation provides another backstop, saying that CISA "creates a completely voluntary information-sharing framework." Both the letter and spirit of CISA show that "voluntary" means voluntary.