Careful now.

>An opt-in measure that can't be forced on a private company by the government

Allowing companies to "opt-in" to sharing data currently prohibited from being shared by privacy laws could still be something we shouldn't like. Especially if it doesn't restrict what they can do with it after they've shared it.

>Restricted to "cyber threat information", a term carefully (relative to any other online legislation) defined to apply only to attacks on the confidentiality/integrity/availability of systems and applications

This the actual definition from the bill FWIW:

‘(A) IN GENERAL- The term ‘cyber threat information’ means information directly pertaining to--

‘(i) a vulnerability of a system or network of a government or private entity;

‘(ii) a threat to the integrity, confidentiality, or availability of a system or network of a government or private entity or any information stored on, processed on, or transiting such a system or network;

‘(iii) efforts to deny access to or degrade, disrupt, or destroy a system or network of a government or private entity; or

‘(iv) efforts to gain unauthorized access to a system or network of a government or private entity, including to gain such unauthorized access for the purpose of exfiltrating information stored on, processed on, or transiting a system or network of a government or private entity.

Full text here: http://www.govtrack.us/congress/bills/113/hr624/text

>* Specifically restricted from applying to Aaron Swartz-style ToS violations, or, for that matter, to intellectual property misappropriation

This is the remainder of the definition:

‘(B) EXCLUSION- Such term does not include information pertaining to efforts to gain unauthorized access to a system or network of a government or private entity that solely involve violations of consumer terms of service or consumer licensing agreements and do not otherwise constitute unauthorized access.

I don't see anything about intellectual property. I think what you're referring to is that intellectual property in the early drafts was explicitly included and was removed. But I don't see anywhere it's explicitly excluded and EFF seems to think the replacement wording could still be read to cover it in various cases. [1]

[1] https://www.eff.org/cybersecurity-bill-faq

>* Written to exclude "individuals" from "protected entities" to avoid any reading that would permit ISPs to use it to hand over records for individual targeted customers

If that was the intention then they did a pretty crappy job, because if you're a "protected entity" then sharing requires your "express consent" and qualifies you for the immunity provision if you share information or make "decisions" based on it, and I don't see anything prohibiting the sharing of information on individuals who aren't protected entities.

There is a list of categories of information in (c)(4) that can't be used, but it's ridiculously inadequate and in any event only applies to the federal government.

>As Declan McCullagh pointed out in another thread here recently, private companies operate under a bewildering stack of regulations that make it legally dicey to share even innocuous data during attacks.

I think this is probably true, and perhaps warrants some kind of a response. But this bill as written looks to me like a minefield of unintended consequences.