חוק התמודדות עם תקיפות סייבר חמורות במגזר השירותים הדיגיטליים ושירותי האחסון (הוראת שעה - חרבות ברזל), התשפ"ד-2023Law on Coping with Serious Cyber Attacks in the Digital Services Sector and Storage Services (temporary provision - Operation Iron Swords), 2023 · automatic translation · suggest a correction

Official summary of the law (Knesset)

The Law authorizes an authorized manager from the Israel Security Agency, the Cyber Directorate, or the Military Intelligence Directorate's Malmab unit to determine that a cyberattack occurring or about to occur against a person whose business is the provision of storage services or digital services constitutes a severe cyberattack, if he believes there is a real concern that it will harm state security, public security, or the continuity of essential supplies and services. This determination will be made subject to the following conditions: the attack occurred during the Iron Swords War; the attack has a real impact that is not limited to the attacked supplier; and the attack is a severe cyberattack in light of its characteristics. In addition, it was determined that the authority to determine that a cyberattack is severe is also granted to the Head of the Cyber Defense Division in the IDF, if he finds that the attack is liable to harm the continuity of the IDF's operational functioning due to the aforementioned conditions. In a case where a cyberattack is determined to be severe, the Law establishes a graduated course of action: first, the authorized employee will detail to the supplier the factual basis for his determination that the cyberattack is severe, and will allow the supplier an opportunity to act to detect, prevent, or contain the attack as soon as possible. Following this, the supplier will be required to update the authorized employee on the actions taken, or to submit an affidavit regarding the implementation of security guidelines in accordance with the standard. If the supplier did not submit an affidavit, or the authorized employee finds that the supplier did not act appropriately to detect, prevent, or contain the attack, the authorized employee may issue instructions for carrying out cyber defense actions. In addition, the Law establishes provisions regarding the duty of confidentiality and restriction on the use of information. The Law further establishes a duty to report to the Attorney General and to the Knesset Foreign Affairs and Defense Committee regarding cases in which instructions were given under the Law. The Law is established as a temporary provision for a period of seven months.

automatic translation · suggest a correction