ACLU Sues Over Cybersecurity Information Sharing Act
The Cybersecurity Information Sharing Act isn't even law yet, but it's already causing lawsuits. CISA, recently passed in the Senate and one of a trio of proposed cybersecurity laws, encourages companies to share cybersecurity information with the government. The law has been decried as a cybersurveillance measure, not a cybersecurity act, by groups like the Electronic Frontier Foundation.
But the actual text of CISA "may pale in comparison to what the bill allows" when read in conjunction with a classified Justice Department opinion on "common commercial service agreements," according to the ACLU. Now the group is suing to force the release of that classified opinion, so that the full implications of CISA can be public.
CISA 101
There are three cybersecurity laws making their way, slowly, through Congress: the National Cybersecurity Protection Advancement Act, the Protecting Cyber Networks Act, and CISA. So far, CISA is in the lead, having been passed by the Senate in late October. But all of the acts are relatively similar. Each would encourage information sharing between the government and private sector, authorizing companies to collect private information and send it on over to, in CISA's case, the Department of Homeland Security. The laws also protect companies against liability stemming from that sharing.
It's a great example of private-public cooperation against a common threat or a massive violation of consumer privacy and extension of government surveillance powers, depending on who you ask.
The Secret DOJ Opinion
All of the text could be meaningless, however, if the public doesn't know how the executive will interpret and apply the law. That, at least, is the ACLU's argument. Their new suit hones in on a 2003 opinion from the Department of Justice's Office of Legal Counsel which interprets "common commercial service agreements."
What does the DOJ opinion say? No one knows -- not even members of Congress. It's an opinion which is, allegedly, "inconsistent with the public's understanding of the law" according to Senator Ron Wyden. As the ACLU notes, the 2003 opinion was created at the onset of President Bush's War on Terror, when the Department of Justice was also pumping out secret interpretations of the law to authorize warrantless wiretapping, deny habeas corpus, and sanction torture. So it's possibly not the most progressive legal opinion, but it is one that is de facto binding on the Executive branch.
The ACLU is seeking the opinion under the Freedom of Information Act, which allows the public to petition for the disclosure of government documents. FOIA, however, contains a host of exceptions to the disclosure rules, including exceptions for classified and national security information. If the ACLU is successful, however, the release of the document could greatly change the implications of an already somewhat controversial bill.
Related Resources:
- Privacy Groups Fight to Expose Secret Cyber Ruling (The Hill)
- Legal Industry Gets a Forum for Cybersecurity Info Sharing (FindLaw's Technologist)
- The Internet of Things: It's Not Just Data Collection, It's Evidence (FindLaw's Technologist)
- Wikimedia Sues NSA, DOJ Over Internet Surveillance (FindLaw's Technologist)