Today we sent a letter to lawmakers expressing security experts' opposition to the Cybersecurity Information Sharing Act (CISA) as well as two other pending bills that purport to be about security information sharing, the Protecting Cyber Networks Act (PCNA), and the National Cybersecurity Protection Advancement Act of 2015. These experts agree that the information sharing bills unnecessarily waive privacy rights because they focus on sharing information beyond that needed for cybersecurity. The letter seeks to educate law makers about the kind of information that experts need to secure systems, and that, because it generally does not contain private data, privacy law is not a serious obstacle to sharing. The letter includes an example threat signature to illustrate that point. We can share cybersecurity information without waiving privacy law. Otherwise, what Congress will be doing is weakening privacy law and increasing government surveillance at time when the public agrees that stronger privacy and civil liberties protections are needed.
The letter is attached.