> The core problem is it lets major industry players like MS / Google / Apple give the fed access to all the personal info they record without investigators nee

> The core problem is it lets major industry players like MS / Google / Apple give the fed access to all the personal info they record without investigators needing a warrant and with no liability on the companies part (ie, you cannot sue them for state disclosure of your personal info that then resulted in harm against you). As far as I know, they can already do that. And a lot of tech companies did. What CISA does is explicitly formalize a voluntary arrangement for sharing 'cybersecurity indicators' and 'defensive measures' among government agencies and private companies. There are, actually, explicit provisions for removing personal information and making sure that any indicators that do contain personal information anyway are deleted in a timely manner. It's hard to gauge the accuracy of those links, because both of those are from 2014 and the bill has changed since then. I think the strongest argument against the law is the potential for abuse, not anything actually in the law. Actually if you removed provisions 3, 4, and 5 on page 1766 I think it'd be a good idea, other than the fact it creates a system that potentially government agencies and corporations could abuse (in violation of the law, but who is going to call them on it?)