Critics say CISA won't boost security, will allow private companies to share more user data with government
Andy Greenberg / Wired :
Context & Ripple Effects
Two weeks after the Senate Intelligence Committee approved the Cybersecurity Information Sharing Act 14-1, Wired's Andy Greenberg lays out the privacy case against it: that the bill's voluntary threat-sharing channel functions less as a security measure than as a new legal pipe for user data from private companies into federal hands.
The critique lands mid-legislative arc — by October the Senate passes CISA 74-21, with House-Senate differences still unresolved. It echoes the same fight then playing out over FISA Section 702, where privacy advocates argued Congress was reforming warrantless surveillance without understanding how it actually works.
First-order effects
- Companies that join the program gain legal cover to hand cyberattack indicators — and, critics argue, user content swept up with them — directly to the federal government, shifting the default posture of corporate data handling toward disclosure.
- Privacy advocates and skeptical senators become the immediate opposition, pressing the same surveillance-not-security argument through the House-Senate reconciliation process.
Second-order effects
- If the sharing pipeline matures, it converges with existing intelligence collection like Section 702, forcing Congress to legislate on two data-surveillance fronts at once and giving advocates a unified 'backdoor by another name' argument.
- Companies face a split incentive: security teams want the threat intelligence and liability protection, while their own users' trust depends on how narrowly the shared data is scoped.
Third-order effects
- CISA would normalize voluntary corporate-to-government data flow as standing infrastructure rather than emergency measure — the precedent later debates about the agency's remit and oversight inherit.
- The structural question the bill leaves open — who audits what the government does with privately shared data — becomes a recurring fault line in every subsequent cybersecurity and surveillance fight.
The trend: US cybersecurity policy is institutionalizing corporate-to-government data sharing faster than the safeguards governing what happens to that data once it arrives.