How the Cybersecurity Act of 2015 broadens the powers of network operators to conduct surveillance for the government
Orin Kerr / Washington Post :
Context & Ripple Effects
This is the analytical follow-through to a year-long legislative arc: Obama proposed protecting firms that share cyberthreat data with the government back in January (the White House's January 2015 proposal), and by late December the Cybersecurity Information Sharing Act had been enacted into law as part of the omnibus spending bill (signed by Obama after riding through in the omnibus) — with little standalone debate.
Orin Kerr's read matters because it reframes what was sold as threat-sharing: the statute also broadens the authority of private network operators themselves to monitor user traffic on the government's behalf, converting companies into surveillance intermediaries.
First-order effects
- Network operators gain legal cover to monitor their own users' communications for the government, shifting surveillance work from agency-run interception to privately conducted monitoring with statutory authorization.
- Privacy advocates and legal scholars lose the clean distinction between 'cybersecurity data sharing' and general-purpose surveillance that opponents of the bill had relied on.
Second-order effects
- Intelligence leadership consolidates the gain: James Clapper subsequently described broader access to data and providers as a direct product of post-Snowden legislative changes (Clapper tied wider provider access to the new legal framework).
- Civil-liberties pushback escalates from policy objection to constitutional argument — law experts warned the government was working to loosen Constitutional protections against arbitrary surveillance, citing bulk email scanning as the test case (experts flagged the erosion of Constitutional safeguards).
Third-order effects
- The template compounds rather than expires: seven years later a presidential memorandum expanded the NSA's defensive role over government networks and mandated security practices across DoD and spy agencies (Biden's 2022 memorandum widened the NSA's mandate), showing each statute becoming the baseline for the next expansion.
- The same pattern is going international — the UK's Investigatory Powers (Amendment) Bill drew parallel warnings from critics and tech companies that fast-tracked cyber legislation undermines privacy — suggesting surveillance powers will keep traveling inside cybersecurity vehicles across jurisdictions.
The trend: Cybersecurity legislation has become the preferred vehicle for expanding state surveillance authority, with each statute normalizing broader monitoring than the last.