Cyber Bill Would Give Netanyahu Unsupervised Powers, Experts Warn

A proposed law that would give broad power to the National Cyber Directorate is expected to advance in the Knesset, and experts in the field are raising the alarm over its vague wording and lack of oversight mechanism, saying it would give Prime Minister Benjamin Netanyahu unprecedented power over Israel's cyber operations.

The law, initiated by the prime minister, aims to provide the directorate with a legal foundation for its operations. The bill, experts say, would allow National Cyber Security Authority, and the prime minister in particular, to act without any oversight. 

A group of researchers from the Cyber Security Center at the Hebrew University of Jerusalem heavily criticized the bill, saying certain clauses and the powers it would grant could violate human rights – without any judicial review.

>> From cybersecurity to privacy-protection: Israeli technology's growing sector ■ Iranian hacking of Gantz's phone could open door to blackmail - and impact Israel's election | Analysis ■  Israeli cyber chief cautioned of election interference

The bill returned to the headlines this week after reports that Iran had possibly hacked Kahol Lavan Chairman Benny Gantz’s cellphone.

In the past, the researchers, including attorneys Deborah Housen-Couriel, Dan Efroni, Amir Cahane and Dr. Amit Sheniak, warned about the power it would provide the Cyber Directorate as a security body with offensive capabilities.

Civilian and defense bodies have warned against the broad powers the law grants in its present version without any real oversight or requirement to consult with other bodies.

• How Israel's Iran hacking scandal could ensure Netanyahu's reelection
• What went wrong with Israel's cybersecurity agency
• Israeli security agencies: New cyber authority could 'seriously harm' our activities

The draft version of the law was distributed in June 2018 after disagreements with the Shin Bet security service. The bill would give the Cyber Directorate responsibility to establish a “national technological infrastructure for the discovery, identification, warning and information sharing” to discover and identify cyber-attacks against Israel. The Cyber Directorate would operate this infrastructure under the proposed law.

 “This is a critical institution,” said a senior legal official. “But a major security institution has risen here that has almost no structures for oversight. The prime minister has the ability to do whatever he wants with this tool without real supervision.” He added that the prime minster would be able to appoint whoever he wants and ask the head of the directorate to look into any subject matter. The law would give the prime minister the authority to ask the security body to look into his political rivals, if a security justification is provided.

The researchers also raised concern about the concentration of power in the prime minister’s hands, lack of restrictions on what information the cyber authority could collect and who would be authorized to have such information. The group recommended adding the requirement of the approval of the justice minister or Knesset Foreign Affairs and Defense Committee in some cases, or even the security cabinet in exceptional circumstances.

Another recommendation was to establish an official oversight committee on the institution, as exists in other countries. The current proposal does not establish procedures, or requirements, for sharing information with the Israel Defense Forces or the Shin Bet, which by law is now responsible for cyber-defense.

The bill would further give the head of the directorate the power in urgent cases to take action without a warrant.