> Given that IBM can probably show a court order, if necessary a retroactive one from the NSA.

This is precisely why many tech companies weakly supported CISPA. The NSA currently does this, but it's on a case by case basis. CISPA was blanket immunity as long as the company said "security".