News

Congress Preps Internet Security Info-Sharing Bill

• By William Jackson
• 12/02/2011

A newly introduced bill that aims to encourage the sharing of Internet security threat intelligence information between government and industry has gone to the House Intelligence Committee for markup.

The Cyber Intelligence Sharing and Protection Act of 2011 (HR 3523) was introduced Nov. 30 by committee Chairman Mike Rogers (R-Mich.) and Ranking Member Dutch Ruppersberger (D-Md.) and would require the intelligence community to establish procedures for sharing classified cybersecurity intelligence with the private sector, and would provide incentives for private entities to share information with the government.

But for the moment at least, it contains no privacy safeguards for personal information.

The bill builds on the Defense Department's Defense/Industrial Base pilot in which DOD shares classified threat intelligence with a handful of private companies.

The legislation addresses a long-standing concern in the cybersecurity community that information sharing with government has been a one-way street.

"Historically, the track record has been pretty poor," said Paul Royal, cybersecurity expert and research scientist for the Georgia Tech Information Security Center. The government has been a "black hole of information," where data goes in and does not come out.

Andy Purdy, former head of the Homeland Security Department's National Cyber Security Division and US-CERT, called the bill an "important step forward" that begins the process of establishing a framework for information sharing. The fact that it is only a beginning should not be held against it, he said. "The perfect is the enemy of the good," said Purdy, who now is chief cybersecurity strategist for CSC Inc.

Bob Dix, vice president of government affairs and critical infrastructure protection at Juniper Networks and former House Government Oversight Committee staffer, said the bill's limited scope is one of its strengths.

"They haven't tried to boil the ocean," he said. "It takes a chewable bite in an effort to change the culture from 'need to know' to 'need to share.'"

Sections of the bill covering data provided by the private sector to government have raised concerns with privacy and civil liberties advocates, however. They allow any organization to share "cyber threat information with any other entity, including the federal government." The provider can place restrictions on how the information can be used or further shared, but there are no privacy safeguards to protect individuals whose information might be swept up.

This need not be a deal-breaker, Royal and Purdy agreed.

"Privacy is always an important concern, privacy should never be assumed," Purdy said. But amendments already have been discussed that would give more oversight authority to inspectors general on privacy issues, he said.

"It might be prudent to amend part of the bill to specifically address personally identifiable information," Royal said. But he did not see the issue as a deal breaker because he is optimistic that providers of information will have business incentives to clean or anonymize any information provided to government.

The bill would require the national intelligence director within 60 days to establish plans for sharing classified data with persons and organizations with appropriate clearance, and gives intelligence agencies authority to grant and expedite that clearance.

Information provided to government would be treated as proprietary and protected from disclosure, and organizations would be shielded from liability for how they use and share that data.

Despite shortcomings, observers generally lauded the bill's intent.

"Information sharing is an enabler, a tool for building situational awareness," Dix said.

"If everybody shared, everybody would be a lot better off," Royal said.