CISPA permits, but does not require, entities that have been attacked to voluntarily share their knowledge of a cyber threat with each other and with government.