Bill introduced to encourage public-private information sharing

A bill introduced Monday by Sens. Bob Bennett (R-Utah) and Jon Kyl (R-Ariz.) would give limited exemption from the Freedom of Information Act and antitrust laws for security information voluntarily shared by companies.The Critical Infrastructure Information Security Act of 2001 would correct what Bennett called a national security blind spot that discourages companies from sharing information with the government and with other companies. The FOIA exemption would ensure that information about possible threats and risks given to federal agencies remains private. The antitrust exemption would let companies cooperate through industry information sharing and analysis organizations.The protections are intended to promote analysis of threats to the nation’s critical infrastructure—both physical and electronic—so that timely warnings can be given and effective defenses developed. Poor cooperation between the public and private sectors has limited this kind of analysis, the General Accounting Office said today during a House hearing on cybersecurity.“Federal agencies have serious and widespread computer security weaknesses,” Joel C. Willemssen, GAO’s managing director of IT issues, told the Government Reform subcommittee on government efficiency, financial management and intergovernmental relations.Willemssen said a 1997 presidential directive calling for public-private cooperation in protecting critical infrastructure has had limited success. Eight agencies have established liaisons with corresponding industrial sectors and six information sharing and analysis centers have been established. But concerns about antitrust restrictions and public disclosure of proprietary information have hampered data sharing, Willemssen said.