| 3.23.22

Should Private Companies Have More Incentives to Share Information With the Gov't? (H.R. 1731)

Do you support or oppose this bill?

What is H.R. 1731?

(Updated November 21, 2017)

This bill hopes to incentivize private sector organizations to share cyber threat information with the government with the promise of expanded liability protections — basically a big security blanket against lawsuits.

Information exchanges would go through the National Cybersecurity and Communications Integration Center (NCCIC) — a center that organizes and shares cyber threat information provided voluntarily by private, federal, state and local entities under the Department of Homeland Security (DHS). This bill would officially designate NCCIC as the lead interface for civilian organizations, and require it to only use information to prevent and respond to cyber attacks.

Under this bill, the NCCIC would be authorized to offer liability protections to private businesses that voluntarily share cyber threat information and defensive measures. These private businesses would also be given liability protections to conduct network awareness of their information systems, and operate defensive measures to guard against cyber threats that might steal sensitive information from their business and customers.

Privacy protections would also be enhanced in this bill, as all personal information would be removed by public and private entities before cyber threat information is initially shared, then the NCCIC would re-check what is shared and delete any remaining personal information. Annual reports of the effectiveness of these civil liberties protections would be provided to Congress.

All existing public-private partnerships would be preserved so that ongoing cybersecurity elaborations can continue under these new requirements.

Argument in favor

This bill would bolster U.S. cybersecurity by making companies more willing to share cyber threat information, while also increasing privacy safeguards that prevent the sharing of personal information.

Argument opposed

After the revelations about the NSA’s domestic spying, can citizens genuinely trust that their personal information is safe when ‘big brother’ has access to it — even if its voluntary?

Impact

People and businesses that use digital media to store and manage information; federal, state, local, and private entities; cyber threats and U.S. cyber security, the NCCIC, DHS, and related federal agencies.

Cost of H.R. 1731

The CBO analyzed this legislation and found that the reporting and administrative requirements would cause the National Cybersecurity and Communications Integration Center to hire about 20 additional personnel — costing about $20 million over the 2016-2020 period, or $4 million per year.

Additional Info

In-Depth:

Using DHS and NCCIC as the main portals through which public-private cybersecurity data is shared is the preferred tactic of the White House, and passed the House Committee on Homeland Security on a unanimous, bipartisan vote.

Sponsoring Rep. Michael McCaul (R-TX) has said in the past that:

“DHS has some of the strongest privacy mechanisms in the federal government. Such built-in privacy oversight is an important reason why DHS is the leading civilian interface for these exchanges.”

That strategy runs against proposals made by intelligence committees in both chambers of Congress — which would prefer that such information is shared directly with intelligence agencies like the NSA.

Of Note:

The Center for Strategic and International Studies published a study in June 2014 finding that cybercrime cost the U.S. economy about $100 billion, while the global cost falls between $400 billion and $575 billion.