CBO Scores Cyber Information Sharing Act

The Cyber Information Sharing Act of 2014 (S. 2588) would require the Director of National Intelligence, in conjunction with the Secretary of Defense, the Secretary of Homeland Security, and the Attorney General, to establish procedures to promote the sharing of information regarding cyber threats.

CBO estimates that implementing the bill would have a discretionary cost of about $20 million over the 2015-2019 period, assuming appropriation of the necessary amounts. Enacting S. 2588 would not affect direct spending or revenues. CBO expects that additional personnel would be needed to administer the program and to manage the exchange of information between federal agencies and the private sector. Based on information from the Office of the Director of National Intelligence and the Office of Personnel Management, CBO estimates that those activities would cost approximately $4 million annually over the 2015-2019 period, assuming appropriation of the necessary amounts. The bill would impose intergovernmental and private-sector mandates, as defined in the Unfunded Mandates Reform Act (UMRA), by extending civil and criminal liability protection to entities and cybersecurity providers that share or use information about cyber threats.

The bill also would impose additional intergovernmental mandates on state governments by preempting state disclosure and liability laws and any laws that restrict monitoring, sharing, and countermeasures authorized by the bill. Because of uncertainty about the number of cases that would be limited and any forgone compensation that would result from compensatory damages, CBO cannot determine whether the costs of the mandate would exceed the annual threshold established in UMRA for private-sector mandates ($152 million in 2014, adjusted annually for inflation). However, CBO expects few, if any, public entities would bring such suits, and consequently the aggregate costs of the mandates on those entities would fall below the threshold for intergovernmental mandates ($74 million in 2014, adjusted annually for inflation).

[Nov 20]