1560 , the Protecting Cyber Networks Act (PCNA), as passed by the House on April 22; and H.R. 1731 , the National Cybersecurity Protection Advancement Act of 2015 (NCPAA), as passed by the House on April 23. Both bills focus on information sharing among private entities and between them and the federal government. They address the structure of the information-sharing process, issues associated with privacy and civil liberties, and liability risks for private-sector sharing, and both address some other topics in common. In addition to other provisions, the NCPAA would explicitly amend portions of the Homeland Security Act of 2002 (6 U.S.C. ), and the PCNA would amend parts of the National Security Act of 1947 (50 U.S.C. 1560 and H.R. 1731 and more than 20 for H.R. 1560 , and H.R. 1560 combined the bills by making the PCNA Title I and the NCPAA Title II. Current Legislative Proposals

Five bills on information sharing have been introduced in the 114 th Congress, three in the House and two in the Senate. The White House has also submitted a legislative proposal (WHP) and issued an executive order on the topic. S. 754 , the Cybersecurity Information Sharing Act of 2015 (CISA), from the Senate Intelligence Committee, has many similarities to a bill with the same name introduced in the 113 th Congress and shares many provisions with the PCNA, although there are also significant differences between S. 754 and the PCNA. All the bills would address concerns that are commonly raised about barriers to sharing of information on threats, attacks, vulnerabilities, and other aspects of cybersecurity—both within and across sectors. It is generally recognized that effective sharing of information is an important tool in the protection of information systems and their contents from unauthorized access by cybercriminals and other adversaries. Barriers to sharing have long been considered by many to be a significant hindrance to effective protection of information systems, especially those associated with critical infrastructure. Private-sector entities often claim that they are reluctant to share such information among themselves because of concerns about legal liability, antitrust violations, and protection of intellectual property and other proprietary business information. Institutional and cultural factors have also been cited—traditional approaches to security tend to emphasize secrecy and confidentiality, which would necessarily impede sharing of information. While reduction or removal of such barriers may provide benefits in cybersecurity, concerns have also been raised about potential adverse impacts, especially with respect to privacy and civil liberties, and potential misuse of shared information. The NCPAA, S. 456 , and the WHP address roles of information sharing and analysis organizations (ISAOs). All of the proposals have provisions aimed at facilitating sharing of information among private-sector entities and providing protections from liability that might arise from such sharing. In general, the proposals limit the use of shared information to purposes of cybersecurity and law enforcement, and they limit government use, especially for regulatory purposes. All the proposals require reports to Congress on impacts of their provisions. All also include provisions to shield information shared with the federal government from public disclosure, including exemption from disclosure under the Freedom of Information Act (FOIA). H.R. While most observers appear to believe that legislation on information sharing is either necessary or at least potentially beneficial—provided that appropriate protections are included—two additional factors in particular may be worthy of consideration as the legislative proposals are developed. First, resistance to sharing of information among private-sector entities might not be substantially reduced by the actions contemplated in the legislation. The second point is that information sharing is only one of many facets of cybersecurity. 1560 and H.R.
Effective sharing of information in cybersecurity is generally considered an important tool for protecting information systems and their contents from unauthorized access by cybercriminals and other adversaries. Five bills on such sharing have been introduced in the 114th Congress—H.R. 234, H.R. 1560, H.R. 1731, S. 456, and S. 754. The White House has also submitted a legislative proposal and issued an executive order on the topic.
In the House, H.R. 1560, the Protecting Cyber Networks Act (PCNA), was reported out of the Intelligence Committee. H.R. 1731, the National Cybersecurity Protection Advancement Act of 2015 (NCPAA), was reported by the Homeland Security Committee. Both bills passed the House, amended, the week of April 20, and were combined, with the PCNA becoming Title I and the NCPAA Title II of H.R. 1560.
The PCNA and the NCPAA have many similarities but also significant differences. Both focus on information sharing among private entities and between them and the federal government. They address the structure of the information-sharing process, issues associated with privacy and civil liberties, and liability risks for private-sector sharing, and both address some other topics in common.
The NCPAA would amend portions of the Homeland Security Act of 2002, and the PCNA would amend parts of the National Security Act of 1947. They differ in how they define some terms in common such as cyber threat indicator, the roles they provide for federal agencies (especially, the Department of Homeland Security and the intelligence community), processes for nonfederal entities to share information with the federal government, processes for protecting privacy and civil liberties, uses permitted for shared information, and reporting requirements.
S. 754 has been reported by the Senate Intelligence Committee. Presumably, if the Senate passes a bill on information sharing, any inconsistencies between the PCNA and the NCPAA could be reconciled during the process for resolving differences between the House and Senate bills.
All of the bills would address commonly raised concerns about barriers to sharing information about threats, attacks, vulnerabilities, and other aspects of cybersecurity—both within and across sectors. Such barriers are considered by many to hinder protection of information systems, especially those associated with critical infrastructure. Private-sector entities often claim that they are reluctant to share such information among themselves because of concerns about legal liability, antitrust violations, and protection of intellectual property and other proprietary business information. Institutional and cultural factors have also been cited—traditional approaches to security tend to emphasize secrecy and confidentiality, which would necessarily impede sharing of information.
All the bills have provisions aimed at facilitating information sharing among private-sector entities and providing protections from liability that might arise from such sharing. While reduction or removal of such barriers may provide benefits, concerns have also been raised about potential adverse impacts, especially on privacy and civil liberties, and potential misuse of shared information. The legislative proposals all address many of the concerns. In general, the proposals limit the use of shared information to purposes of cybersecurity and law enforcement, and they limit government use, especially for regulatory purposes. All include provisions to shield information shared with the federal government from public disclosure and to protect privacy and civil liberties with respect to shared information that is not needed for cybersecurity purposes. All the proposals require reports to Congress on impacts of their provisions.
Most observers appear to believe that legislation on information sharing is either necessary or at least potentially beneficial—provided that appropriate protections are included—but two additional factors in particular may be worthy of consideration as the various legislative proposals are debated. First, resistance to sharing of information among private-sector entities might not be substantially reduced by the actions contemplated in the legislation. Second, information sharing is only one of many facets of cybersecurity that organizations need to address to secure their systems and information.