Imagine that at any given moment, the State can enter your business, demand any document and information you have, instruct you on how to operate your IT system, seize computers,  communication systems and drives containing data, or even help itself to your workstations and operate them by itself. Imagine that your most guarded information – your bookkeeping system, Excel files with financial data, Word documents describing inventions and business plans and your customer database – all these can be viewed and taken from you by a unit that directly reports to the Prime Minister, without any Knesset oversight.

An Orwellian nightmare? No. This will become reality if the Cyber Defense and National Cyber Organization Bill, 5778-2018 is enacted.

The Cyber bill subjects every organization in Israel to unprecedented powers of an “operational security entity” directly subordinated only to the Prime Minister: the National Cyber Organization. The powers proposed in the bill are so far-reaching that the General Security Service, (colloquially known as the Shin Bet), has long coveted them for itself. Indeed, a provision in the bill also grants all these powers to the GSS.

By virtue of these powers, the National Cyber Organization and the GSS can approach any organization in Israel – from a small insurance agency to a global social network; from a startup business to a company traded on NASDAQ; from a car shop to a giant chemical conglomerate – and carry out all that was described above in order to handle, locate and prevent a so-called “cyber attack”, which is defined in the broadest possible terms. Any port scan on a computer system, a routine action that is probably performed tens of thousands or hundreds of thousands times daily on computers in Israel will be a pretext for invoking such powers. It does not distinguish between an action by, say, a 12-year old idealist from the Netherlands, a member of a crime syndicate in Russia, a terrorist group such as Hezbollah or states such as Iran and China. According to the bill, any such action provides sufficient grounds to exercise the cyber organization’s powers.

So far, no Israeli legislation has granted such sweeping powers, and they are also unprecedented in cyber law worldwide. In an extreme case, they can cripple an organization and even bring-about its collapse (if, for example, its computers are seized and taken). In less extreme cases, they can strip an organization of its most treasured information and transfer it to the State. Although the use is limited to the purpose of preventing cyber attacks, once the information is out of the organization’s hands, no one knows what might be done with it.

Worse yet, according to the bill, the Cyber Organization can also disclose the information it gleaned from companies and businesses to similar state organizations abroad. No one can seriously ensure that information of one industrial company does not end up with another company, its competitor, overseas, or that an Israeli citizen’s intimate details are not exposed to a foreign government.

Indeed, there are some attempts at checks and balances and the bill attempts to mitigate the broad powers sought by the Cyber Organization and the GSS. Use of the information is generally limited to preventing cyber attacks. There is a supervisor of privacy protection and also a committee, chaired by judge, to oversee the supervisor. Another provision deals with designing the Cyber Organization’s IT systems in a way that protects information. These are indeed proposed, but they are clearly insufficient, becuase this proposed State organization is free of any governmental or parliamentary oversight and its activity is kept secret.

This bill, therefore, has implications on every organization in Israel, and it is quite stunning that its publication did not cause a stir. From the outset, the State allotted an unreasonable period of time to raise objections to a bill that has been years in the works – the three weeks allotted for objections ended on July 11, 2018. The industrial sector in Israel must get itself together and quickly and seriously respond to the bill, or else the opening paragraph of this article will describe reality, not fantasy.

This article was translated courtesy of Tomedes Legal Translation