New Legislation Strengthens Legal Protections for Cybersecurity Information-Sharing

摘要

Protecting electronic networks and information systems against cyber-intrusions often requires real-time information sharing among private and governmental entities, but some in the cybersecurity community have expressed concerns in recent years that legal uncertainty has hampered information-sharing efforts. The U.S. Congress recently took steps to address these concerns by passing the Cybersecurity Information Sharing Act of 2015 (CISA or the Act) as part of the 2016 Omnibus Spending Bill. The stated intent of the law's sponsors was to encourage voluntary information-sharing among the federal government and private entities in order to better protect against and respond to data breaches and related cybersecurity incidents. CISA has important implications in a world where hackers seem to keep pace with, and even outstrip, best efforts to secure the information systems that store sensitive personally identifiable information such as employment records and credit card numbers, as well as confidential business information and intellectual property. CISA broadens the legal protections for companies who engage in cybersecurity monitoring and information-sharing activities while requiring compliance with certain measures designed to safeguard individual privacy and civil liberties.