You are reading it correctly. CISA explicitly establishes by statute that private entities are never required to share data, but that the government is required to share with private entities.
Specific details of how to do this must be decided in the next 90 (or was it 180)days and compliance oversight reports are required regularly.
I'm a little embarrassed, but I must have missed the part where this makes things worse. I'm being honest here: If I should be upset about this I need to know why, please.
Unlike CISPA, CISA allows shared information to be used for law enforcement purposes. Ideally, threat information shared with the government should be used solely to improve defenses and prevent breaches; instead, anyone who shares data now needs to be cognizant of the other uses to which it will be put.
(PCNA had broader language that enabled prosecutions of a variety of crimes with indicator data).
Again, CISPA, the bill FFTF takes credit for killing, had none of this language.
Where does it state that private cos get access to this data?
103(a)(3) also requires them to share, when possible, with the general public.
In the Senate CISA draft, the language about "entities" is a little confusing. "Entities", unqualified, are private companies; government agencies are "Federal entities".
One the few changes in the budget bill CISA is to have the law now refer to "Federal entities" and "Non-federal entities".
I'm sure Techdirt found a way to spin that into a conspiracy to chopper away the Open Whisper System developers in black helicopters.