<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin-top:0in;
margin-right:0in;
margin-bottom:8.0pt;
margin-left:0in;
line-height:106%;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<span style="font-size:10.0pt;font-family:"Courier New"">Security Information Sharing Working Group:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<span style="font-size:10.0pt;font-family:"Courier New""><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<span style="font-size:10.0pt;font-family:"Courier New"">Good news. On December 18, 2015, President Obama signed into law the Cybersecurity Act of 2015. Sections 104, 105 and 106 of the Act are the ones most relevant to our work. They are titled as follows:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<span style="font-size:10.0pt;font-family:"Courier New""><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<span style="font-size:10.0pt;font-family:"Courier New"">Sec. 104. Authorizations for preventing, detecting, analyzing, and mitigating cybersecurity threats.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<span style="font-size:10.0pt;font-family:"Courier New"">Sec. 105. Sharing of cyber threat indicators and defensive measures with the Federal Government.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<span style="font-size:10.0pt;font-family:"Courier New"">Sec. 106. Protection from liability.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<span style="font-size:10.0pt;font-family:"Courier New""><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<span style="font-size:10.0pt;font-family:"Courier New"">Subsection 104(c)(1) of the Cybersecurity Act of 2015 recognizes the right of private entities to share cyber threat indicators and defensive measures for a cybersecurity purpose. [Section 102(4) defines
“cybersecurity purpose” as “the purpose of protecting an information system or information that is stored on, processed by, or transiting an “information system from a cybersecurity threat or security vulnerability.”]<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<span style="font-size:10.0pt;font-family:"Courier New""><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<span style="font-size:10.0pt;font-family:"Courier New""> Subsection 104(d)(1) requires that the information be adequately protected, and more specifically, subsection 104(d)(2) requires that prior to sharing, the entity must (A) “review such cyber threat
indicator to assess whether such cyber threat indicator contains any information not directly related to a cybersecurity threat that the non-Federal entity knows at the time of sharing to be personal information of a specific individual or information that
identifies a specific individual and remove such information” and (B) “implement and utilize a technical capability configured to remove any information not directly related to a cybersecurity threat that the non-Federal entity knows at the time of sharing
to be personal information of a specific individual or information that identifies a specific individual.”<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<span style="font-size:10.0pt;font-family:"Courier New""><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<span style="font-size:10.0pt;font-family:"Courier New"">If shared with a governmental entity, exemptions within section 104 of the Cybersecurity Act are found in: subsection (d)(4)(B)(ii) – exempt from local freedom of information law, open government law,
open meetings law, open records law, sunshine law, or similar law requiring disclosure of information or records); subsection (d)(4)(C)(i) – exempt from action when following “mandatory standards, including an activity relating to monitoring, operating a defensive
measure, or sharing of a cyber threat indicator”; and subsection (e) – not a violation of any provision of antitrust laws “for 2 or more private entities to exchange or provide a cyber threat indicator or defensive measure, or assistance relating to the prevention,
investigation, or mitigation of a cybersecurity threat, for cybersecurity purposes.”<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<span style="font-size:10.0pt;font-family:"Courier New""><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<span style="font-size:10.0pt;font-family:"Courier New"">Section 106(a) protects entities from liability when “monitoring” a system. Section 106(b) protects entities from liability when sharing or receiving information, and if it is shared with the federal
government, then if such sharing complies with section 105.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<span style="font-size:10.0pt;font-family:"Courier New""><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<span style="font-size:10.0pt;font-family:"Courier New"">I’m not addressing section 105 (sharing with the federal government) here, that can be addressed separately if/when it arises.<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>