A recent appeals court ruling partially overturned a district court injunction that limited communication between federal agencies and social media platforms for the purpose of countering misinformation and disinformation. The ruling eases restrictions for some agencies, including the Cybersecurity and Infrastructure Security Agency, but not for others, such as the FBI. The FBI and some officials are still subject to a modified injunction that prohibits efforts to coerce or significantly encourage social media companies to remove, delete, suppress, or reduce posted content containing protected free speech.
CISA gets a pass on their communication with social media companies. That’s an important detail that should boost the security community. Why? ‘Attempts to convince,’ not ‘attempts to coerce,’ per the ruling.
The importance of the distinction between ‘convincing’ and ‘coercing’ cannot be overstated. It emphasizes the agency’s advisory role rather than an authoritative one. CISA’s efforts are aimed at collaborating with businesses to bolster security measures voluntarily rather than imposing them. This approach reflects a more consultative stance, where the goal is to educate and guide rather than mandate.
CISA is both less limited and less able to enforce. They have to convince businesses to take their recommendations too, rather than have a true ability to enforce. That’s meant as a statement of fact, not a judgment.