Protecting Cyber Networks Act
The Protecting Cyber Networks Act (H.R. 1560) is a bill introduced in the 114th Congress by Rep. Devin Nunes (R-CA), chairman of the House Permanent Select Committee on Intelligence. The legislation would allow companies and the government to share information concerning cyber threats. To overcome privacy concerns, the bill expressly forbids companies from sharing information with the National Security Agency (NSA) or Department of Defense (DOD). Background. A number of major hacking events occurred in 2014 and 2015: Additionally, major U.S. businesses including Target and JPMorganChase have been victims of large-scale cyberattacks resulting in  the theft of customer identity information. The legislation was introduced as response to threats posed by these and other cyberattacks. On April 22, 2015, "The Hill" newspaper wrote, "Congress has contemplated some form of this law for nearly five years. But catastrophic data breaches within the last year have laid bare hundreds of millions of Americans' credit card data and Social Security numbers, raising public awareness and putting the onus on Capitol Hill to act." Legislative history. On March 19, 2015, the House Permanent Select Committee on Intelligence held a hearing called "Growing Cyber Threat and its Impact on American  Business." In his opening remarks as the committee's chairman, Nunes stated that U.S. companies and American consumers must feel confident that their confidential information stored on IT systems is secure. He said that in light of the major cyber attacks in 2014 and 2015, there is little assurance that personal and corporate information is safe. He said that because of those reasons, Congress needs to strengthen the security of the country's digital infrastructure by creating better methods for businesses and the government to share information on cyber threats. Five days later, Nunes introduced H.R. 1560: Protecting Cyber Networks  Act. On April 13, the House Permanent Select Committee on Intelligence passed an amended version of the bill. On April 22, the House passed the bill by a vote of 307-116. Before final passage of the bill, the House passed an amendment from Rep. Andre Carson (D-Ind.) that would require the inspector general to report on how agencies remove personal information with information they receive. The amendment was proposed in response to concerns from privacy advocates including many Democratic House members. After passage in the House, the bill was sent to the Senate. As of June 28, 2016 , the Senate had not taken action on the bill. However, a companion bill exists in the Senate: the Cybersecurity Information Sharing Act (CISA, S. 754). On October 27, 2015, the Senate approved S. 754 by a vote of 74-21. Major provisions. Information sharing. The Protecting Cyber Networks Act (PCNA) would allow companies to share certain information with other companies and the government. They would be allowed to share only cybersecurity information; that is, information concerning the protection of their own systems. PCNA would require the Director of National Intelligence to create regulations that would allow sharing the following types  of information: The bill requires the President to submit to Congress policies and procedures on how the government should receive threat indicators when submitted by the private sector, as well as how to develop defensive measures within the federal government. It would require that agencies that receive threat information share it in real time with other relevant agencies. Defensive protection. The legislation gives private companies the authority to go on the counter-offensive against hackers, meaning a company that was hacked could perform more assertive defensive measures than are currently allowed under the law. However, companies would not be allowed  to hack back into other systems or manipulate systems for which they do not have consent to control. According to the official legislative summary of the bill, the bill "Permits private entities to monitor or operate defensive measures to prevent or mitigate cybersecurity threats or security vulnerabilities, or to identify the source of a threat, on: (1) their own information systems; and (2) with written authorization, the information systems of other private or government entities." Privacy. PCNA includes safeguards that support privacy. For example, the bill includes requires that companies scrub "unrelated" data of personally identifying information they send the  information to the government. Once government agencies receive the information, the agencies must examine the information to ensure that no personally identifiable information is included. Liability. The bill offers protection from liability for companies who share cybersecurity information and do so lawfully under the bill's provisions. Support. The White House supports the legislation. The legislation also received public support from the following organizations: Opposition. Fifty-five civil liberties groups and security experts publicly opposed the legislation in a signed letter to Congress. "PCNA would significantly increase the National Security Agency's (NSA's) access to personal information, and authorize  the federal government to use that information for a myriad of purposes unrelated to cybersecurity," the letter stated. According to the House Permanent Select Committee on Intelligence, the PCNA expressly forbids companies from sharing information with the National Security Agency (NSA) or Department of Defense (DOD). A group called Access along with the ACLU and several other groups launched a website called StopCyberspying.com. The site has a petition to the President to reconsider a veto of PCNA or the Senate version of the bill. The civil liberties groups that oppose the bill are: