Proposed law to protect civilian cybersphere seen as extreme

Israel’s newly proposed cyber law authorizes appointed officials to enter organizations, demand information and confiscate equipment without a court order, to foil or deal with a cyberattack.

A first draft of the proposed law was published on Wednesday, and is likely to be amended numerous times before being submitted to a vote. The proposal formalizes the processes in place today and sets up a framework of what Israel’s civilian and government sphere should be doing for cybersecurity.

The document has already raised warnings from democracy watchdogs. Dr. Tehilla Shwartz Altshuler, a senior fellow at the Israel Democracy Institute who studies the impact of technology on democracy, said in an initial emailed comment to the proposed law that it could lead to a “significant damage to privacy.” Doron Ofek, a digital rights watchdog, told the Calcalist website that “the basis of a thought dictatorship is being laid out.”

The proposal says that authorities will be able to instruct organizations how to act if there are suspicions of a hack or data breach, and that those organizations that receive instructions cannot reveal the instructions they were given.

In some cases the permission of a judge is required, for example when entry into a site is done without the owner’s permission. But that requirement could be rescinded if there is perceived to be immediate and real danger to the public.

The proposed law defines a “cyber event” and a “cyber attack” in very wide terms, and these include “malicious actions intended to compromise the use, security or information stored in a computer system,” Shwartz Altshuler wrote. The term “information with security value” is also very wide, she said.

The legislation aims to protect and prepare organizations for cybersecurity events, the proposal says.

Regulation proposed by the law emphasizes the need to balance between many public interests, the document states. On one hand, the nation must guard against dangers emanating from the cyber-sphere; on the other, regulations should avoid unduly burdening the economy and stifling innovation.

“The regulatory model that has been proposed is combined, aiming to balance between concentration and diversification, and adapts the intensity of the response to the different levels of risk,” the document says. “We believe that the benefit to the public interest will be significantly higher than the costs derived from this law.”

The law will apply to government offices, critical infrastructures, and civilian entities. The document is available for comments until July 11, TheMarker website reported.