Israel’s Version of Moving Fast and Breaking Things: The New Cybersecurity Bill

The Prime Minister’s Office (PMO) of Israel published a new bill in February entitled “Cybersecurity and the National Cyber Directorate.” If passed by government committee and the Knesset, this law will redefine cybersecurity governance in Israel. The PMO officially tabled an earlier version of the bill in June 2018, but that bill did not advance through the legislative process given the strong objections it raised both in the professional cybersecurity community and among other government authorities. In particular, stakeholders raised concerns about the broad scope of authority sought by the Israel National Cyber Directorate (INCD) under the 2018 bill. Other concerns included the lack of proper safeguards over the nature and scope of invasive “computer protection actions” taken by the INCD in response to cyberattacks, the potential for privacy infringements in the name of national security, and the interface between the activities of the INCD and other law enforcement agencies. The process of affording the INCD—which is currently a policy-setting body—with operative powers has been controversial even within Israel’s security establishment. One publicized example of this controversy was a 2017 leaked memo to the prime minister from the Mossad, the Israel Security Agency (Shin Bet), Israel Defense Forces and the Defense Ministry declaring their opposition to the expanding authorities of the INCD.

The new bill is an abbreviated formulation of the 2018 version and is framed as temporary legislation with a two-year sunset clause—perhaps to avoid some of the opposition that emerged in response to its earlier iteration. The PMO wants to move fast—somewhat insincerely in our view—because of increased cybersecurity risk while teleworking during the coronavirus pandemic and the associated digitization of workplaces in both the public and private sectors. A string of recent attacks on Israeli companies, which two of the authors discussed in a previous Lawfare post, also generated a sense of urgency for providing the INCD with unprecedented and controversial legal tools to respond to the new risk environment. These steps, however, come at the risk of compromising…