Cyber Intelligence Sharing and Protection Act

Cyber Intelligence Sharing and Protection Act

Long title	To provide for the sharing of certain cyber threat intelligence and cyber threat information between the intelligence community and cybersecurity entities, and for other purposes.
Acronyms (colloquial)	CISPA
Legislative history
Introduced in the House as H.R. 3523 by Mike Rogers (R-MI) on November 30, 2011 Passed the House on April 26, 2012 (248–168) (failed to become law when it did not pass the Senate in the same session) Reintroduced in the House as H.R. 624 by Mike Rogers (R-MI) on February 12, 2013 Passed the House on April 18, 2013 (288–127) Received in the Senate on April 22, 2013 Reintroduced in the House as H.R. 234 by Dutch Ruppersberger (D-MD) on January 8, 2015 and has since been referred to two additional committees as of February 2, 2015. Committee consideration by House Select Committee on Intelligence, Senate Select Committee on Intelligence

The Cyber Intelligence Sharing and Protection Act (CISPA H.R. 3523 (112th Congress), H.R. 624 (113th Congress), H.R. 234 (114th Congress)) is a proposed law in the United States which would allow for the sharing of Internet traffic information between the U.S. government and technology and manufacturing companies. The stated aim of the bill is to help the U.S. government investigate cyber threats and ensure the security of networks against cyberattacks.^[1]

The legislation was introduced on November 30, 2011, by Representative Michael Rogers (R-MI) and 111 co-sponsors.^[2][3] It was passed in the House of Representatives on April 26, 2012, but was not passed by the U.S. Senate.^[4] President Barack Obama's advisers have argued that the bill lacks confidentiality and civil liberties safeguards, and the White House said he would veto it.^[5]

In February 2013, the House reintroduced the bill^[6] and it passed in the United States House of Representatives on April 18, 2013,^[7] but stalled and was not voted upon by the Senate.^[8] On July 10, 2014 a similar bill, the Cybersecurity Information Sharing Act (CISA), was introduced in the Senate.^[9]

In January 2015, the House reintroduced the bill again.^[10] The bill has been referred to the Committee on Intelligence, and as of February 2, 2015 to the Subcommittee on Crime, Terrorism, Homeland Security, and Investigations and Subcommittee on Constitution and Civil Justice to see if it will come to the House for a vote. In December 2015 a version of CISPA was hidden in the total federal budget.

CISPA had garnered favor from corporations and lobbying groups such as Microsoft, Facebook, AT&T, IBM, and the United States Chamber of Commerce, which look on it as a simple and effective means of sharing important cyber threat information with the government.^[11] It has however been criticized by advocates of Internet privacy and civil liberties, such as the Electronic Frontier Foundation, the American Civil Liberties Union, Free Press, Fight for the Future, and Avaaz.org, as well as various conservative and libertarian groups including the Competitive Enterprise Institute, TechFreedom, FreedomWorks, Americans for Limited Government, Liberty Coalition, and the American Conservative Union. Those groups argue CISPA contains too few limits on how and when the government may monitor a private individual’s Internet browsing information. Additionally, they fear that such new powers could be used to spy on the general public rather than to pursue malicious hackers.^[12][13]

Some critics saw wording included in CISPA as a second attempt to protect intellectual property after the Stop Online Piracy Act was taken off the table by Congress after it met opposition.^[14] Intellectual property theft was initially listed in the bill as a possible cause for sharing Web traffic information with the government, though it was removed in subsequent drafts.^[15]

Content

CISPA is an amendment to the National Security Act of 1947, which does not currently contain provisions pertaining to cybercrime. It adds provisions to the Act describing cyber threat intelligence as "information in the possession of an element of the intelligence community directly pertaining to a vulnerability of, or threat to, a system or network of a government or private entity, including information pertaining to the protection of a system or network from either "efforts to degrade, disrupt, or destroy such system or network".^[16] In addition, CISPA requires the Director of National Intelligence to establish procedures to allow intelligence community elements to share cyber threat intelligence with private-sector entities and encourage the sharing of such intelligence.^[17]

In an April 16, 2012, press release, the House of Representatives Permanent Select Committee on Intelligence announced the approval of several amendments to CISPA, including the addition of a new provision "to permit federal lawsuits against the government for any violation of restrictions placed on the government’s use of voluntarily shared information, including the important privacy and civil liberties protections contained in the bill," the inclusion of an anti-tasking provision to "explicitly prohibit the government from conditioning its sharing of cyber threat intelligence on the sharing of private sector information with the government", and the prevention of the government from using the information for "any other lawful purpose unless the government already has a significant cybersecurity or national security purpose in using the information". Relevant provisions were also clarified to "focus on the fact that the bill is designed to protect against unauthorized access to networks or systems, including unauthorized access aimed at stealing private or government information".^[18] In addition, already collected cyberthreat data can also be used to investigate "the imminent threat of bodily harm to an individual" or "the exploitation of a minor," bringing the bill into line with existing law codified by the Patriot Act and the PROTECT Our Children Act^[19] in which these two conditions already allow for protected entities to share data voluntarily with the United States government, law enforcement agencies, and the National Center for Missing and Exploited Children.

Recent developments

Bill sponsors Mike Rogers and Dutch Ruppersberger, the chairman and ranking member of the House Intelligence Committee, respectively, said on April 25, 2012, that the Obama administration's opposition is mostly based on the lack of critical infrastructure regulation, something outside of the jurisdiction of the Intelligence committee; they have also since introduced a package of amendments to the legislation that, "address nearly every single one of the criticisms leveled by the Administration, particularly those regarding privacy and civil liberties of Americans".^[20]

Due to the opposition the bill has experienced, the co-sponsors are planning to amend the bill to address many of the concerns of its opponents—including limiting its scope to a narrower definition of cyber-threats, and stating that the "theft of intellectual property" refers to the theft of research and development. In addition, there will now be penalties if private companies or the government uses data from CISPA for purposes "unrelated to cyberthreats".^[21][22]

However, Sharan Bradford Franklin, of the Constitution Project states, "Although we appreciate the Intelligence Committee's efforts to improve the bill and willingness to engage in a dialogue with privacy advocates, the changes in its most current draft do not come close to addressing the civil liberties threats posed by the bill, and some of the proposals would actually make CISPA worse. Therefore, Congress should not pass CISPA".^[23]

Rainey Reitman, of the Electronic Frontier Foundation states, "To date, the authors of the bill have been unresponsive to these criticisms, offering amendments that are largely cosmetic. Dismissing the grave concerns about how this bill could undermine the core privacy rights of everyday Internet users, Rep. Mike Rogers characterized the growing protests against CISPA as 'turbulence' and vowed to push for a floor vote without radical changes."^[24]

Kendall Burman of the Center for Democracy and Technology states, "The authors of CISPA have made some positive changes recently. Unfortunately, none of the changes gets to the heart of the privacy concerns that Internet users and advocacy groups have expressed."^[25]

In April 2012, the Office of Management and Budget of the Executive Office of the President of the United States released a statement strongly opposing the current bill and recommending to veto it.^[26]

On April 26, 2012, the House of Representatives passed CISPA.

On February 13, 2013, United States Representative Mike Rogers reintroduced the CISPA bill in the 113th Congress as H.R. 624.^[6]

On April 18, 2013, the House of Representatives passed H.R. 624.^[7] The Senate has reportedly refused to vote on the measure and is drafting competing legislation.^[27]

On July 10, 2014 a similar bill, the Cybersecurity Information Sharing Act (CISA), was introduced in the Senate.^[9]

House voting counts

House vote on April 26, 2012 passing CISPA
Affiliation	Yes votes	No votes	Did not vote
Democratic	42	140	8
Republican	206	28	7
Total	248	168	15

A full list can be seen at the house.gov site.^[28]

House vote on April 18, 2013 passing CISPA
Affiliation	Yes votes	No votes	Did not vote
Democratic	92	98	11
Republican	196	29	6
Total	288	127	17

A full list can be seen at the house.gov site.^[29]

Supporters

CISPA is supported by several trade groups containing more than eight hundred private companies, including the Business Software Alliance, CTIA – The Wireless Association, Information Technology Industry Council, Internet Security Alliance, National Cable & Telecommunications Association, National Defense Industrial Association, TechAmerica and United States Chamber of Commerce, in addition to individual major telecommunications and information technology companies like AT&T, IBM, Intel, Oracle Corporation, Symantec, and Verizon.^[30][31] Google has not taken a public position on the bill^[32] but has shown previous support for it, and now says they support the idea but believe the bill needs some work.^[33] Leading Google, Yahoo, and Microsoft executives are also on the executive council of TechNet, a tech trade group which sent a letter supporting CISPA in April 2013.^[34][35]

Opposition

• Former Representative Ron Paul (R-TX) has publicly opposed the bill calling it "Big Brother writ large."^[36][37][38]
• 36 groups currently oppose CISPA^[39] with an addition of 6 groups as of April 21.^[40] The Electronic Frontier Foundation lists a growing list of opposition^[41] as well as a list of security experts, academics, and engineers in opposition of the bill.^[42] They also published the statement Don’t Let Congress Use "Cybersecurity" Fears to Erode Digital Rights.^[43]
• Opposition to CISPA includes more than 840,000 online petitioners who have signed global civic organization Avaaz.org's petition to members of the US Congress entitled "Save the Internet from the US".^[44] Avaaz also has a petition to Facebook, Microsoft, and IBM entitled "The end of Internet privacy", signed by more than 840,000 people.^[45]
• The Center for Democracy and Technology (CDT) published a statement titled "Cybersecurity's 7-Step Plan for Internet Freedom".^[46] The CDT openly opposes the Mike Rogers bill based on these 7-step criteria.^[47] The CDT has also openly supported a competing bill in the house sponsored by Representative Dan Lungren (R-CA)^[48] that has yet to be reported by the committee.^[49]
• The Constitution Project (TCP) "believes cybersecurity legislation currently pending before Congress possess major risks to civil liberties that must be addressed before any bill is enacted into law."^[50]
• The American Civil Liberties Union (ACLU) has also issued a statement opposing the bill stating, "The Cyber Intelligence Sharing and Protection Act would create a cybersecurity exception to all privacy laws and allow companies to share the private and personal data they hold on their American customers with the government for cybersecurity purposes." As the statement continues, "Beyond the potential for massive data collection authorization, the bill would provide no meaningful oversight of, or accountability for, the use of these new information-sharing authorities."^[51]
• The Sunlight Foundation states, "The new cybersecurity bill, CISPA, or HR 3523, is terrible on transparency. The bill proposes broad new information collection and sharing powers (which many other organizations are covering at length). Even as the bill proposes those powers, it proposes to limit public oversight of this work."^[52]
• Cenk Uygur, from Current TV, opposed the bill highlighted one of Mike Rogers' speech about the bill to the business community. He also attempted to summarize the bill to his audience.^[53]
• Demand Progress opposes CISPA, stating "The Cyber Intelligence Sharing and Protection Act, or CISPA, would obliterate any semblance of online privacy in the United States."^[54]
• Competitive Enterprise Institute joins with TechFreedom, FreedomWorks, Americans for Limited Government, Liberty Coalition, Al Cardenas, and American Conservative Union to write a letter to Congress.^[55] Competitive Enterprise Institute states, "Despite the bill's noble intentions, however, it risks unduly expanding federal power, undermining freedom of contract, and harming U.S. competitiveness in the technology sector." The Competitive Enterprise Institute lists 6 problems within the bill itself and how to fix those problems.^[40]
• Reporters Without Borders states, "Reporters Without Borders is deeply concerned with the Cyber Intelligence Sharing and Protection Act of 2011 (CISPA), the cyber security bill now before the US Congress. In the name of the war on cyber crime, it would allow the government and private companies to deploy draconian measures to monitor, even censor, the Web. It might even be used to close down sites that publish classified files or information."^[56]
• testPAC opposes CISPA stating "CISPA would effectively take the door off the hinge of every household in America, but lacks the tools necessary to distinguish whether there is a criminal hiding in the attic. Why surrender the core of our privacy for the sake of corporate and governmental convenience?"^[57]
• Mozilla, the makers of the Firefox Web-Browser, opposes CISPA stating, "While we wholeheartedly support a more secure Internet, CISPA has a broad and alarming reach that goes far beyond Internet security."^[58]
• The Association for Computing Machinery believes that "More effective information sharing in support of cybersecurity is a laudable goal, but CISPA is seriously flawed in its approach to PII. Better approaches to information sharing are certainly possible if privacy goals are also considered."^[59]
• IGDA, the International Game Developers Association is against this bill, urging Congress and the President to reject it saying, in part, "The version of CISPA which just emerged from the House Intelligence Committee does not address the privacy failings in the previous version, which the White House wisely rejected. The bill still retains its dangerously over-broad language, still lacks civilian control, still lacks judicial oversight, and still lacks clear limits on government monitoring of our Internet browsing information. The House should vote against it."^[60]
• The Libertarian Party protested it by blacking out much of their Facebook, and encouraged others to follow suit.^[61]

Week of action

Dubbed the "Stop Cyber Spying Week", starting on April 16, 2012, many civil liberties groups and advocates raised the awareness of CISPA (through a Twitter campaign with the hash-tags #CISPA and #CongressTMI,) including, but not limited to, the Constitution Project, American Civil Liberties Union, Electronic Frontier Foundation, Center for Democracy and Technology, Demand Progress, Fight for the Future, Free Press, Reporters Without Borders, Sunlight Foundation, and TechFreedom.^{[62][63][64][65][66]}

Blackout day

Anonymous, a hacktivist group, has criticized the bill and called for an "Internet blackout day" to protest the bill. The date of the blackout was April 22, 2013.^[67]

Prior attempts for U.S. cybersecurity bills

Since legislation must pass the House and the Senate within the same Congress, anything introduced during the 112th or earlier Congresses has to pass both chambers again.

Senate

• S. 2151 (Secure IT), introduced by Senator John McCain (R-AZ) on March 1, 2012.^[68]
• S. 2105 (Cybersecurity Act), reported by committee on February 15, 2012. Sponsored by Senator Joseph Lieberman (I-CT).^[69] Failing to gain enough support for passage, the bill, entitled "Cybersecurity Act of 2012", was reintroduced on July 19, 2012 in a revised form which omitted federal imposition of security standards on IP providers, as well as including stronger privacy and civil liberties protections.^[70]

House of Representatives

• H.R. 3674 (Precise Act), reported by committee April 18, 2012 by Representative Dan Lungren (R-CA).^[71] The bill changed as "Lungren dropped many of the critical infrastructure and DHS provisions" due to the house.^[72]
• H.R. 4257 (Federal Information Security Amendment Act of 2012), reported by committee April 18, 2012^[73] by Representative Darrell Issa (R-CA).

See also

• Anti-Counterfeiting Trade Agreement
• Chinese intelligence operations in the United States
• Communications Assistance for Law Enforcement Act
• Federal Information Security Management Act of 2002
• Freedom of information laws by country
• Intellectual Property Attache Act
• National Security Agency
• United States Department of Homeland Security

References

External links

Wikimedia Commons has media related to Cyber Intelligence Sharing and Protection Act.

114th Congress

• H.R. 234 at Congress.gov
• H.R. 234 at Congress.gov

113th Congress

• H.R. 624 at Congress.gov
• H.R. 624 at GovTrack
• H.R. 624 at OpenCongress
• Newman, Jared (13 April 2012). "CISPA Monitoring Bill: Just the Facts". PC World/TechHive. IDG. Retrieved 22 June 2013.