Cybersecurity and Information Sharing: Comparison of H.R. 1560 and H.R. 1731 as Passed by the House
Released: 2015-06-18T00:00:00

This report compares provisions in two bills in the House of Representatives that address information sharing and related activities in cybersecurity:

H.R. 1560 , the Protecting Cyber Networks Act (PCNA), as passed by the House on April 22; and H.R. 1731 , the National Cybersecurity Protection Advancement Act of 2015 (NCPAA), as passed by the House on April 23.

Both bills focus on information sharing among private entities and between them and the federal government. They address the structure of the information-sharing process, issues associated with privacy and civil liberties, and liability risks for private-sector sharing, and both address some other topics in common. In addition to other provisions, the NCPAA would explicitly amend portions of the Homeland Security Act of 2002 (6 U.S.C. 101 et seq.), and the PCNA would amend parts of the National Security Act of 1947 (50 U.S.C. 3021 et seq.).

This report consists of an overview of those and other legislative proposals on information sharing, along with selected associated issues, followed by a side-by-side analysis of the two House bills as passed. For information on economic aspects of information sharing, see CRS Report R43821, Legislation to Facilitate Cybersecurity Information Sharing: Economic Analysis , by [author name scrubbed]. For discussion of legal issues, see CRS Report R43941, Cybersecurity and Information Sharing: Legal Challenges and Solutions , by [author name scrubbed]. For an overview of cybersecurity issues, see CRS Report R43831, Cybersecurity Issues and Challenges: In Brief , by [author name scrubbed].

House Consideration of the Two Bills

The House Committee on Rules held a hearing on proposed amendments to both H.R. 1560 and H.R. 1731 on April 21. More than 30 amendments were submitted for H.R. 1731 and more than 20 for H.R. 1560 . The committee reported H.Res. 212 ( H.Rept. 114-88 ) on the two bills on April 21, with a structured rule allowing consideration of five amendments to H.R. 1560 and 11 for H.R. 1731 . For each bill, a manager's amendment would serve as the base bill for floor consideration, with debate on H.R. 1560 held on April 22 and on H.R. 1731 on April 23. The rule further stated that upon passage of both bills, the text of H.R. 1731 would be appended to H.R. 1560 , and H.R. 1731 would be tabled.

On April 22, all five amendments to H.R. 1560 were adopted and the bill passed the House by a vote of 307 to 116. The amendments were all agreed to by voice vote except a sunset amendment terminating the bill's provisions seven years after enactment, which passed by recorded vote of 313 to 110. Similarly, on April 23, the 11 amendments to H.R. 1731 were all adopted and the bill was passed by a vote of 355 to 63. A sunset amendment similar to that approved for H.R. 1560 , and all but one other amendment were adopted by voice vote. The exception, requiring a GAO study on privacy and civil liberties impacts, was agreed to by recorded vote, 405 to 8. The engrossed version of H.R. 1560 combined the bills by making the PCNA Title I and the NCPAA Title II.

Current Legislative Proposals

Five bills on information sharing have been introduced in the 114 th Congress, three in the House and two in the Senate. The White House has also submitted a legislative proposal (WHP) and issued an executive order on the topic. Other proposals include the following:

The Cyber Intelligence Sharing and Protection Act (CISPA), which passed the House in the 113 th Congress, has been reintroduced as H.R. 234 . S. 456 is an amended version of the White House proposal. S. 754 , the Cybersecurity Information Sharing Act of 2015 (CISA), from the Senate Intelligence Committee, has many similarities to a bill with the same name introduced in the 113 th Congress and shares many provisions with the PCNA, although there are also significant differences between S. 754 and the PCNA.

All the bills would address concerns that are commonly raised about barriers to sharing of information on threats, attacks, vulnerabilities, and other aspects of cybersecurity—both within and across sectors. It is generally recognized that effective sharing of information is an important tool in the protection of information systems and their contents from unauthorized access by cybercriminals and other adversaries.

Barriers to sharing have long been considered by many to be a significant hindrance to effective protection of information systems, especially those associated with critical infrastructure. Private-sector entities often claim that they are reluctant to share such information among themselves because of concerns about legal liability, antitrust violations, and protection of intellectual property and other proprietary business information. Institutional and cultural factors have also been cited—traditional approaches to security tend to emphasize secrecy and confidentiality, which would necessarily impede sharing of information. While reduction or removal of such barriers may provide benefits in cybersecurity, concerns have also been raised about potential adverse impacts, especially with respect to privacy and civil liberties, and potential misuse of shared information.

The legislative proposals all address many of those concerns, but they vary somewhat in emphasis and method. The NCPAA focuses on the role of the Department of Homeland Security (DHS), and in particular the National Cybersecurity and Communications Integration Center (NCCIC). The PCNA, in contrast, focuses on the role of the intelligence community (IC), including authorization of the recently announced Cyber Threat Intelligence Integration Center (CTIIC). Both CISPA and CISA address roles of both DHS and the IC. The NCPAA, S. 456 , and the WHP address roles of information sharing and analysis organizations (ISAOs). ISAOs were defined in the Homeland Security Act (6 U.S.C. §131(5)) as entities that gather and analyze information relating to the security of critical infrastructure, communicate such information to help with defense against and recovery from incidents, and disseminate such information to any entities that might assist in carrying out those goals. Information Sharing and Analysis Centers (ISACs) are more familiar to most observers. They may also be ISAOs but are not the same, having been originally formed pursuant to a 1998 presidential directive.

On February 20, 2015, President Obama signed Executive Order 13691, which requires the Secretary of Homeland Security to encourage and facilitate the formation of ISAOs, and to choose and work with a nongovernmental standards organization to identify standards and guidelines for the ISAOs. It also requires the NCCIC to coordinate with ISAOs on information sharing, and includes some provisions to facilitate sharing of classified cybersecurity information with appropriate entities.

On April 21, the White House announced support for passage of both the NCPAA and the PCNA by the House, while calling for a narrowing of sweep for the liability protections and additional safeguards relating to use of defensive measures in both bills. It also called for clarifying provisions in the NCPAA on use of shared information in federal law enforcement and ensuring that provisions in the PCNA do not interfere with privacy and civil liberties protections.

All of the proposals have provisions aimed at facilitating sharing of information among private-sector entities and providing protections from liability that might arise from such sharing. They vary somewhat in the kinds of private-sector entities and information covered, but almost all of them address information on both cybersecurity threats and defensive measures, the exception being S. 456 and the WHP, which cover only cyber threat indicators. In general, the proposals limit the use of shared information to purposes of cybersecurity and law enforcement, and they limit government use, especially for regulatory purposes.

All address concerns about privacy and civil liberties, although the mechanisms proposed vary to some extent, in particular the roles played by the Attorney General, the DHS Secretary, Chief Privacy Officers, the Privacy and Civil Liberties Oversight Board (PCLOB), and the Inspectors General of DHS and other agencies. All the proposals require reports to Congress on impacts of their provisions. All also include provisions to shield information shared with the federal government from public disclosure, including exemption from disclosure under the Freedom of Information Act (FOIA).

H.R. 1735 , the National Defense Authorization Act of 2016, as passed by the House on May 15, would provide liability protections similar to those in H.R. 1560 to "operationally critical" defense contractors who are required to report incidents to DOD (10 U.S.C. 391) and cleared contractors required to report network or system penetrations (10 U.S.C. 2224 note).

While most observers appear to believe that legislation on information sharing is either necessary or at least potentially beneficial—provided that appropriate protections are included—two additional factors in particular may be worthy of consideration as the legislative proposals are developed. First, resistance to sharing of information among private-sector entities might not be substantially reduced by the actions contemplated in the legislation. Information received can help an entity prevent or mitigate an attack. However, there is no clear direct benefit associated with providing information, except in the case of providers of cybersecurity services and their clients. More indirect benefits might occur, for example, if a pattern of reciprocity develops among sharing entities, such as through ISACs or ISAOs. While the legislative proposals may reduce the risks to private-sector entities associated with providing information, none include explicit incentives to stimulate such provision. In the absence of mechanisms to balance that asymmetry, the degree to which information sharing will increase under the provisions of the various legislative proposals may be uncertain.

The second point is that information sharing is only one of many facets of cybersecurity. Entities must have the resources and processes in place that are necessary for effective cybersecurity risk management. Sharing may be relatively unimportant for many organizations, especially in comparison with other cybersecurity needs. In addition, most information sharing relates to imminent or near-term threats. It is not directly relevant to broader issues in cybersecurity such as education and training, workforce, acquisition, or cybercrime law, or major long-term challenges such as building security into the design of hardware and software, changing the incentive structure for cybersecurity, developing a broad consensus about cybersecurity needs and requirements, and adapting to the rapid evolution of cyberspace.

Comparison of the NCPAA and the PCNA

The remainder of the report consists of a side-by-side comparison of provisions in H.R. 1560 and H.R. 1731 as passed by the House and combined as separate titles into a single bill, H.R. 1560 . The PCNA became Title I and the NCPAA became Title II.

Glossary of Abbreviations in the Table

Notes on the Table

Entries describing provisions in a bill are summaries or paraphrases, with direct quotes enclosed in double quotation marks. The table uses the following formatting conventions to aid in the comparison:

Related provisions in the two titles are adjacent to each other, with the NCPAA serving as the basis for comparison. As a result, many provisions of the PCNA appear out of sequence in the table. Bold formatting denotes that the identified provision is the subject of the subsequent text (e.g., (d) or Sec. 10 2 (a) ). Numbers and names of sections, subsections, and paragraphs (except definitions) added to existing laws by the bills are enclosed in single quotation marks (e.g., 'Sec. 111(a)' ). Underlined text (visible only in the pdf version) is used in selected cases as a visual aid to highlight differences with a corresponding provision in the other bill that might otherwise be difficult to discern. The names of titles, sections, and some paragraphs are stated the first time a provision from them is discussed in the table—for example, Sec. 10 3. Authorizations for Preventing, Detecting, Analyzing, and Mitigating Cybersecurity Threats — but only the number, to the paragraph level or higher, is used thereafter. In cases where a provision of the PCNA is out of sequence from that immediately above it, as much of the provision number is repeated as is needed to make its origin clear. For example, on p. 14 , a provision from Sec. 103 is described immediately after an entry for Sec. 109 and is therefore labelled Sec. 103(c)(3) . That is followed immediately by an entry labelled (a) , which is a subsection of Sec. 103 and therefore is not preceded by the section number. Page numbers cited within the table are hyperlinked to the provisions they reference in the table; the page numbers themselves refer to pages in the pdf version of the report. Explanatory notes on provisions are enclosed in square brackets. Also, the entry "[Similar to NCPAA]" means that the text in that provision in the PCNA is closely similar in text, with no significant difference in meaning, to the corresponding provision in the NCPAA. "[Identical to NCPAA]" means that there are no differences in language in the two provisions.

See the " Glossary of Abbreviations in the Table " for meanings of abbreviations used therein.