&gt; The core problem is it lets major industry players like MS &#x2F; Google &#x2F; Apple give the fed access to all the personal info they record without investigators needing a warrant and with no liability on the companies part (ie, you cannot sue them for state disclosure of your personal info that then resulted in harm against you).<p>As far as I know, they can already do that. And a lot of tech companies did.<p>What CISA does is explicitly formalize a voluntary arrangement for sharing &#x27;cybersecurity indicators&#x27; and &#x27;defensive measures&#x27; among government agencies and private companies.<p>There are, actually, explicit provisions for removing personal information and making sure that any indicators that do contain personal information anyway are deleted in a timely manner.<p>It&#x27;s hard to gauge the accuracy of those links, because both of those are from 2014 and the bill has changed since then.<p>I think the strongest argument against the law is the potential for abuse, not anything actually in the law. Actually if you removed provisions 3, 4, and 5 on page 1766 I think it&#x27;d be a good idea, other than the fact it creates a system that potentially government agencies and corporations could abuse (in violation of the law, but who is going to call them on it?)