Cybersecurity and Information Sharing: Legal Challenges and Solutions
Released: 2015-03-16T00:00:00

Introduction

Over the course of the last year, a host of cyberattacks have been perpetrated on a number of high profile American companies. In January 2014, Target announced that hackers, using malware, had digitally impersonated one of the retail giant's contractors, stealing vast amounts of data—including the names, mailing addresses, phone numbers or email addresses for up to 70 million individuals and the credit card information of 40 million shoppers. Cyberattacks in February and March of 2014 potentially exposed contact and log-in information of eBay's customers, prompting the online retailer to ask its more than 200 million users to change their passwords. In September, it was revealed that over the course of five months cyber-criminals tried to steal the credit card information of more than fifty million shoppers of the world's largest home improvement retailer, Home Depot. One month later, J.P. Morgan Chase, the largest U.S. bank by assets, disclosed that contact information for about 76 million households was captured in a cyberattack earlier in the year. In perhaps the most infamous cyberattack of 2014, in late November, Sony Pictures Entertainment suffered a "significant system disruption" as a result of a "brazen cyber attack" that resulted in the leaking of the personal details of thousands of Sony employees. And in February of 2015, the health care provider Anthem Blue Cross Blue Shield disclosed that a "very sophisticated attack" obtained personal information relating to the company's customers and employees.

The high profile cyberattacks of 2014 and early 2015 appear to be indicative of a broader trend: the frequency and ferocity of cyberattacks are increasing, posing grave threats to the national interests of the United States. Indeed, the attacks on Target, eBay, Home Depot, J.P. Morgan-Chase, Sony Pictures, and Anthem were only a few of the many publicly disclosed cyberattacks perpetrated in 2014 and 2105. Experts suggest that hundreds of thousands of other entities may have suffered similar incidents during the same period, with one survey indicating that 43% of firms in the United States had experienced a data breach in the past year. Moreover, just as the cyberattacks of 2013—which included incidents involving companies like the New York Times, Facebook, Twitter, Apple, and Microsoft —were eclipsed by those that occurred in 2014, the consensus view is that 2015 and beyond will witness more frequent and more sophisticated cyber incidents. To the extent that its expected rise outpaces any corresponding rise in the ability to defend against such attacks, the result could be troubling news for countless businesses that rely more and more on computers in all aspects of their operations, as the economic losses resulting from a single cyberattack can be extremely costly. And the resulting effects of a cyberattack can have effects beyond a single company's bottom line. As "nations are becoming ever more dependent on information and information technology," the threat posed by any one cyberattack can have "devastating collateral and cascading effects across a wide range of physical, economic and social systems." With reports that foreign nations—such as Russia, China, Iran, and North Korea –may be using cyberspace as a new front to wage war, fears abound that a cyberattack could be used to shut down the nation's electrical grid, hijack a commercial airliner, or even launch a nuclear weapon with a single keystroke. In short, the potential exists that the United States could suffer a "cyber Pearl Harbor," an attack that would "cause physical destruction and loss of life" and expose—in the words of one prominent cybersecurity expert–"vulnerabilities of staggering proportions."

Given the growing and potentially grave threat posed by cyberattacks, one of the stated priorities of the President and congressional leadership is to enact laws that ensure that both the public and private sector are prepared to meet the cyber-challenges of the future. While considerable debate exists with regard to the best strategies and methods for protecting America's various cyber-systems, one point of "general agreement" amongst cyber-analysts is the perceived need for enhanced and timely exchange of cyber-threat intelligence both within the private sector and between the private sector and the government. The argument for the real time sharing of cyber-intelligence—which could include the sharing of vulnerability data (the vulnerabilities an intruder might exploit to gain access to a computer system), threat data (the types of malware circulating the Internet and the nature of the threats a given entity has faced), and countermeasure data (the steps an entity has taken to prevent or mitigate the effects of a cyberattack) —is grounded in the idea that effective cybersecurity depends upon robust knowledge about potential threats and wide dissemination of the best practices and strategies to combat such threats.

Despite widespread agreement about the need for enhanced cyber-information sharing, there is similar agreement among cyber-experts that current public and private sector information sharing efforts are simply inadequate. While there may be many reasons why entities may opt to not participate in a cyber-information sharing scheme, a primary rationale for such a decision concerns the potential liability that could result from sharing internal cyber-threat information with other private companies or the government. Indeed, in a recent survey of over 700 information technology security practitioners, half of the respondents listed worries about "potential liability [from] sharing" as the main reason for not participating in an initiative for exchanging threat information. More broadly, the legal issues surrounding cybersecurity information sharing—whether it be with regard to sharing between two private companies or the dissemination of cyber-intelligence within the federal government—are complex and have few certain resolutions. In this vein, this report analyzes the major legal issues regarding cyber-threat information sharing by beginning with a discussion of the current legal authorities respecting the exchange of cyber-intelligence. Included in this discussion will be an examination of the various sources of liability that could result from information sharing. The report concludes by discussing several of the major legislative proposals aimed at reforming federal cyber-information sharing laws and potential legal issues that such laws could prompt.

Conceptualizing the Legal Issues Regarding Cyber Information Sharing

While often the concept of "cyber-information sharing" is thought of as a monolith, the sharing of cyber-intelligence touches on three related, but distinct concepts. First, cyber-information sharing is often used in the context of describing efforts to promote the dissemination of cyber-intelligence from the federal government to other government entities or the private sector. This sort of cyber information sharing would occur, for example, when the Federal Bureau of Investigation (FBI) provides the Department of Homeland Security (DHS) or privately owned banks with the IP addresses of computers known to have launched distributed denial of service (DDoS) attacks against other entities within the financial sector. Second, cyber-threat information sharing also embraces the concept of private entities sharing cyber-intelligence with each other, such as when several companies in a particular sector establish a formal exchange or formal agreements to share relevant cyber-information with each other. Finally, cyber-information sharing also describes when private entities share cyber-threat information in their possession with the government. Such information sharing could occur, for example, when private security firms report to DHS details about potential cyber-vulnerabilities unearthed in research. While collectively these three variants on the concept of cyber-information sharing have some commonalities, each also raises separate legal challenges that may impede cyber-intelligence dissemination more generally.

Sharing Cyber-Information in the Possession of the Government

Perhaps the area in which there is the most legal clarity with respect to cyber-information sharing pertains to the authority of the federal government –and its subcomponents—to disseminate cyber threat information within the government and with the private sector. Two central components of DHS lead efforts to distribute cyber-intelligence to others in the government and the private sector.

First, the Office of Intelligence and Analysis (I&A), an entity established under Section 201 of the Homeland Security Act of 2002 (Homeland Security Act or the Act), is generally authorized to "access and receive" information and intelligence from "agencies of the Federal Government, State and local government agencies (including law enforcement agencies), and private sector entities" in order to "identify and assess" "terrorist threats to the homeland" and "actual and potential vulnerabilities to the homeland." In addition, the I&A is responsible for "integrat[ing] relevant information, analysis, and vulnerability assessments" and disseminating such information in "both classified and unclassified formats, as appropriate" to "other agencies of the Federal Government, State, and local government agencies and authorities, the private sector, and other entities." In turn, pursuant to 6 U.S.C. Section 143, DHS, through I&A, is required to provide to state and localities "analysis and warnings related to threats to, and vulnerabilities of," "critical information systems," a term of art presumably controlled by the Homeland Security Act's definition for the term "critical infrastructure":

[S]ystems ... so vital to the United States that the incapacity or destruction of such systems ... would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.

Moreover, DHS is authorized "upon request" to provide the same "analysis and warnings" to "private entities that own or operate critical information systems." In practice, the I&A has primarily exercised its authority by focusing its efforts on analyses of cyber-threat information and the distribution of those analyses to various public and private entities.

In addition to the I&A, DHS's National Protection and Programs Directorate (NPPD) and its subcomponents play perhaps an even more important role with respect to the sharing of cyber-threat information with other government and private entities. Within the NPPD exists the Office of Cybersecurity and Communications (CS&C), an office Congress created in 2006 that is tasked with overseeing the "security, resiliency, and reliability of the nation's cyber and communications infrastructure." To execute this mission, CS&C, supports "24x7 information sharing, analysis, and incident response" through the National Cybersecurity and Communication Integration Center (NCCIC or Center). Established in 2009, the NCCIC is a "24-hour, DHS-led coordinated watch and warning center" monitoring "threats and incidents affecting the nation's critical information technology and cyber infrastructure." NCCIC, through the United States Computer Emergency Readiness Team (US-CERT), helps operate "key aspects" of several information sharing programs, including the Cyber Information Sharing and Collaboration Program (CISCP) and Enhanced Cybersecurity Services (ECS). CISCP allows for often unclassified "cyber threat, incident, and vulnerability information" to be disclosed "in near real-time" with private information sharing organizations and select owners and operators of so-called critical infrastructure and key resources. ECS entails a "voluntary information sharing program" that, in part, "shares sensitive and classified government ... cyber threat information" with certain private actors.

In late 2014, Congress enacted the National Cybersecurity Protection Act of 2014 (NCPA), which formally codified NCCIC's authority, allowing the "Center to carry out certain responsibilities of the Under Secretary" for the NPPD. Specifically, the NCPA confirmed that the NCCIC's functions include serving as an "interface" for the "real-time" "sharing of information related to cybersecurity risks, incidents, analysis, and warnings between Federal and non-Federal entities." Furthermore, the NCPA directs the Center to provide a number of additional services, such as technical assistance, risk management support, and incident response capabilities to both public and private entities. The NCPA requires NCCIC to include representatives of federal agencies, state and local governments, and private sector owners and operators of critical information systems, while still providing the Under Secretary for the NPPD with discretion with respect to the precise makeup of the Center. In February of 2015, in keeping with NCCIC's statutory role, President Obama, in an Executive Order, mandated that the Center "engage in continuous, collaborative, and inclusive coordination with" Information Sharing and Analysis Organizations (ISAOs), a formal or informal entity or collaboration created or employed by public or private sector organizations that gather, analyze, and disseminate cyber-threat information.

The Homeland Security Act, as amended by the NCPA, provides significant authority for DHS to disseminate a wide range of cyber-threat intelligence within the possession of the federal government to other government agencies and to the private sector. Earlier iterations of the Homeland Security Act seemingly cabined DHS's authority to collect and share cyber-intelligence only to the extent such information respected a "terrorist threat" or would pertain to "critical information systems." In contrast, the NCPA provides NCCIC the authority to share cyber-information to the extent that such information relates to "cybersecurity risks," a term of art that encompasses any "threats" and "vulnerabilities" to information systems and "any related consequences caused by or resulting" from a host of actions that could compromise an information system or the information stored on an information system. In other words, given DHS's discretion in designating various entities to participate in the NCCIC, it appears DHS has fairly broad authority to disseminate federal cyber threat information throughout the private sector, regardless of whether the information pertains to an industry that is "so vital to the United States that the incapacity or destruction" of that industry's assets or information systems would be "debilitating" to the country. In fact, one issue that has been raised by commentators is whether the statutory authority allotted to the various entities within DHS—such as I&A and NPPD—to engage in cyber-information sharing is so broad and ill-defined that confusion could result internally within the Department as to who the central actor should be with respect to the sharing of federal cyber-intelligence. The same argument could plausibly be made with respect to the authority to disseminate cyber-intelligence amongst the various entities of the federal government, as entities like the I&A and NPPD within DHS and new entities outside of DHS, like the newly formed Cyber Threat Intelligence Integration Center (CTICC) appear to possess overlapping legal authorities with respect to the internal sharing of cyber-information within the federal government.

Nonetheless, DHS's ability to share federal cyber-intelligence is not limitless. First, cyber-threat information the government provides to the private sector generally must occur on a voluntary basis. The plain language of Section 223 of the Homeland Security Act limits DHS's ability to share cyber-intelligence with "private entities that own or operate critical information systems," such that information sharing can only occur "upon [those entities'] request." And indeed, the NCPA contains an even more explicit provision disclaiming the Act from being "construed to require any private entity" to request any assistance from the Secretary of DHS. In other words, under current law, DHS generally does not have the authority to "mandate private sector participation" in federal cyber information sharing efforts, leading some to question the value of the current voluntary information sharing scheme.

Second, other laws outside of the context of cybersecurity may limit the ability of the government to disseminate cyber-threat information. The Homeland Security Act itself requires DHS to ensure that any intelligence in its possession "is protected from unauthorized disclosure and handled and used only for the performance of official duties." More specifically, the Act mandates that DHS adhere to (1) the requirements of the National Security Act of 1947 to the extent any information pertains to intelligence sources and methods and (2) any authorities of the Attorney General "concerning sensitive law enforcement information." In other words, to the extent any federal cyber-intelligence contains sensitive information, such as the sources or methods that are the heart of an ongoing cybercrime investigation, the government may be limited in its ability to disclose such information.

Beyond laws aimed at limiting disclosures that may inhibit core governmental functions, laws aimed at preserving privacy and civil liberties may also restrict DHS's ability to share certain cyber-information. The Homeland Security Act requires DHS to "ensure ... that any information databases and analytical tools developed and utilized by the Department"—which would presumably include programs like CISCP and ECS—"treat information in such databases in a manner that complies with applicable Federal law on privacy." Moreover, the NCPA requires that the NCCIC "comply with all policies, regulations, and laws that protect the privacy and civil liberties of United States persons." As such, if DHS's cyber intelligence included, for example, individually identifiable information—like a name or a social security number—laws like the Privacy Act of 1974 may restrict the manner in which the government may disclose such information in a cyber-information sharing program.

Collectively, the legal effect of the various federal disclosure and privacy laws may limit the efficacy of any cyber-information DHS provides private entities. As one commentator recently noted, the resulting "sanitation" of cyber-intelligence has a dual effect. First, the host of federal agencies that "own classified or law enforcement information germane to a particular warning" "must be coordinated with as part of the review process," resulting in significant delays before DHS can release any information to a private entity, by which time the information may be irrelevant. Second, even if DHS releases government cyber threat information in a timely manner, the cyber intelligence resulting after agency review of the underlying material may omit critical information that is "actually useful to industry."

Sharing Cyber-Information in the Possession of Private Entities

Whereas the law governing the dissemination of cyber-threat information in the possession of the federal government is relatively straightforward, the legal landscape surrounding the sharing of cyber-intelligence that is in the possession of private parties stands in stark contrast. Indeed, there is an array of legal concerns—some more theoretical than actual—that shroud the law governing the sharing of privately-held cyber-threat information in a cloud of uncertainty and create disincentives against the sharing of such information by private parties. The legal issues can be divided between those that arise when private companies share cyber-information with each other and those that occur when private companies share cyber-intelligence with the government.

Sharing Cyber-Information with Another Private Entity

Information security professionals within the private sector have "long relied" on information from other private entities to "gain insight into cybersecurity threats and vulnerabilities." And often the most valuable cyber-intelligence comes from peers in other companies, including direct competitors that may be subject to similar cybercrimes. Private cyber-information sharing can take many forms, from informal arrangements, such as peer discussions via phone, email, or in person, to formal sharing arrangements, such as cyber-intelligence sharing through an Information Sharing and Analysis Center (ISAC), a private sector nonprofit corporation formed to facilitate the sharing of information on cyber-threats, incidents and vulnerabilities among members within a particular sector. At times, the federal government has been quite supportive of such private efforts to share cyber-intelligence. Indeed, the impetus for ISACs was Presidential Decision Directive-63, issued by President Clinton in 1998, which initially called for the creation of industry-specific ISACs . Nonetheless, there are several bodies of law whose basic norms run counter to the concept of a private business sharing cyber-threat information with an industry peer, raising potential liability issues for those in the private sector that wish to exchange cyber-intelligence. Without any overarching federal law governing private exchanges of cyber-threat information, the potential remains for various laws facially unrelated to cyber-information sharing to discourage such activity within the private sector.

Privacy Laws

A variety of state and federal privacy laws govern the collection, storage, use, and dissemination of electronic information, potentially leaving limited room for cyber-intelligence sharing amongst private actors or between private actors and the government.

The most pertinent federal privacy law is the Electronic Communications Privacy Act of 1986 (ECPA), which contains three titles: (1) Title I, the Wiretap Act, which regulates the interception of communications content in transit; (2) Title II, the Stored Wire and Electronic Communications and Transactional Records Access Act (Stored Communications Act or SCA), which governs electronic communications already transmitted and currently in storage; and (3) Title III, the Pen Register and Trap and Traces Devices Act (Pen/Trap Act), which regulates the interception of noncontent communications, such as phone numbers or IP addresses. Each section of ECPA is potentially relevant to those private entities considering sharing cyber-intelligence information.

The Wiretap Act

The Wiretap Act generally provides for criminal and civil damages against anyone who "intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept" any covered communication, which includes electronic communication. To "intercept" an electronic communication is to use "any electronic, mechanical, or other device" to acquire the "contents" or the "substance, purport, or meaning" of the communication, contemporaneously with the transmission. Relatedly, the statute also generally prohibits a "person or entity providing electronic communication service to the public" from intentionally divulging the contents of any electronic communication while in transmission other than to the "addressee or intended recipient of such communication." Perhaps most relevant to cyber-information sharing , the Wiretap Act also prohibits the disclosure or use of the contents of any electronic communication that was obtained in violation of the statute, such an illegal interception of electronic communications.

Putting to the side the several exceptions contained in the Wiretap Act, on its face, ECPA's general prohibition on the interception of electronic communications would appear to encompass any strategy for detecting cyber-threats that involved scanning the conten ts of an electronic communication while in transmission, and ECPA's general prohibition on an electronic service provider divulging the contents of any communication while in transmission may bar the real time transmission of certain cyber-intelligence. While cyber-intelligence may often not include the contents of an electronic communication and may merely contain, for example, the IP address of the origin of malware, as one commentator has suggested, many common cyber-threat detection methods require using the contents of electronic communications—such as text within the body of an email—to determine whether a particular communication is malicious. Moreover, to be effective, cyber-information sharing often necessitates the use of real time sharing of cyber-threat information. Nonetheless, the Wiretap Act contains two key exceptions to its general prohibition that may limit the scope of the law as it pertains to cyber-information collection and sharing.

First, the Wiretap Act includes an exception to its general prohibitions when there is the presence of consent to the otherwise illicit interception or disclosure ("consent exception"). A private actor can only rely on the consent exception where one of the parties to the communication has given prior consent to the interception or divulgence. Courts reviewing the question of whether a party to the communication consented to an interception or disclosure will look into the "dimensions of the consent" and then ascertain whether the act in question "exceeded those boundaries."

With respect to a private entity's efforts to collect content-based cyber-threat information and disseminate such information, the Wiretap Act's consent exception, while often a viable route to avoid liability, raises several difficult legal questions. For example, determining who is a "party to the communication" when someone is launching a cyberattack can be very difficult, as the cybercriminal may be using multiple computers and the ultimate destination of the hacker's communication may be unclear. While an entity attempting to monitor its system for cyber-intruders could argue that it is a party to the underlying electronic communication being monitored because the data is flowing on its network and is being directed toward its computers and employees, such an interpretation of what it means to be a party to a communication may eliminate any privacy protections for the individuals who are directly participating in the electronic communication. Instead, a court may likely interpret that a party to a communication must be the individuals who actually take part in the electronic conversation.

Moreover, assuming that the private entity acquiring cyber-threat information is not a party to the communication, consent must be obtained from one of the individuals taking part in the communication, which, in turn, depends on the dimensions of the consent and whether the interception or divulgence of the contents of electronic communication exceeded the boundaries of the consent. Such an inquiry can be quite context specific, inviting litigation and creating legal uncertainty for entities wishing to engage in cyber-information sharing. For example, courts have come to differing conclusions as to whether an electronic communications service provider's customer has consented to having the provider intercept certain communications, largely because of the specific nature of the interception in question and the precise terms of service to which the customer agreed. Importantly, consent cannot be "casually" inferred, and absent actual notice of the nature of the interception or divulgence, consent can only be implied if the "surrounding circumstances convincingly show that the party knew about and consented to the interception." Courts, interpreting the consent exception narrowly to ensure the exemption does not swallow the rule, have held that merely providing a person notice that an entity has the capability of intercepting communications cannot be considered implied consent. And deficient notice will "almost always defeat a claim of consent." As a consequence, for a private entity that wishes to employ and share the results of a cyber-threat detector, which often is created with the goal of invisibly tracking communications without alerting either internal or external users of its operation, notice to a party of an electronic communication that is sufficient to create consent may, at times, defeat the entire purpose of monitoring and sharing the contents of electronic communications.

Second, the Wiretap Act also includes a "provider exception" which allows the provider of electronic communications to "intercept, disclose, or use" the contents of communications when the activity is a "necessary incident to ... the protection of the rights or property of the provider of that service." On its face, the provider exception is limited to protecting the "rights or property of the provider," as opposed to any third party. While at least one court has read the provider exception broadly to allow a service provider to intercept or disclose covered communications for purposes of aiding third parties, several courts have cabined the provider exception in terms of whether the interception was done for the purpose of protecting the provider's own "equipment and rights." And the Department of Justice's (DOJ's) Office of Legal Counsel has likewise concluded that the provider exception "must protect the provider's own rights or property, and not those of any third party.... " As a consequence, there is a strong argument that while ECPA may authorize private entities to monitor their own system and to share cyber-intelligence necessary to protect their own system, the law likely does not authorize service providers to disclose or divulge in real time to other private entities or the government the contents of electronic communications for the purpose of protecting a third party's property or rights. In other words, a more narrow reading of the provider exception may cast doubt on the legality of certain cyber-information sharing methods.

The Stored Communications Act

In contrast to the Wiretap Act, which focuses on the interception and disclosure of the contents of communications in transmission, Title II of ECPA—the SCA—is centrally concerned with access to and the disclosure of both content and non-content based electronic communications that are kept in storage . In relevant part, the SCA in Section 2702 generally prohibits service providers engaged in either "electronic communications service" (ECS) or remote computing service (RCS) to the public from divulging the contents of communications in their possessions and subjects those that violate the SCA to civil liability. Notwithstanding that general statement about Section 2702, the SCA is a notoriously complicated statute, and, accordingly, Section 2702(a)'s central prohibition regarding the disclosure of the contents of communications requires some clarification and several caveats.

First, to run afoul of Section 2702(a)(1)-(2)'s prohibition, the entity in question must provide either ECS or RCS. ECS, as defined under the SCA, includes any service which provides users the means to "send or receive ... electronic communication," such as businesses that provide text messaging or email services. An RCS, as defined by the SCA , entails "the provisions to the public of computer storage or processing services by means of an electronic communications system." Courts have interpreted an RCS to refer to the long-term processing or storage of data by an off-site third party. Second, not all disclosures by an ECS or RCS are prohibited by the SCA; only disclosures of the contents of communications —as opposed to address information, like an email address —would fall within the prohibition. Third, for an ECS provider , only disclosures made while the underlying communication is in electronic storage amount to a violation of the statute —a status defined by the act as either (1) temporary, intermediate storage of an electronic communication incidental to the transmission of that communication; or (2) any storage of an electronic communication for backup protection. The definition of "electronic storage" has been the source of considerable disagreement, with one prominent judicial opinion interpreting "electronic storage" to encompass both electronic messages that have yet to be delivered to their intended recipient, as well as electronic messages in backup storage by the provider until "the underlying message has expired in the normal course," while others have criticized the notion of "electronic storage" encompassing opened emails serviced by an ECS. Fourth, for an RCS provider to violate 18 U.S.C. Section 2702(a)(2), the provider must disclose the contents of communications that are (1) "on behalf of, and received by" a subscriber or customer of the service; and (2) "solely for the purpose of providing storage or computer processing services to ... [that] subscriber or customer." The statutory prohibition necessarily excludes providers of RCS to the public who are authorized to access the contents of communication for purposes other than for storage and computer processing, such as for advertising purposes.

Putting to the side the exceptions to SCA's prohibition found in 18 U.S.C. Section 2702(a)(1)-(2), unlike the Wiretap Act, the SCA's prohibition on disclosing communications in storage will be unlikely to prohibit many forms of cyber-information sharing. After all, to violate the statute, a company must not only disclose the contents of communications to another private entity, but the company doing the disclosure must provide ECS or RCS to the public . In other words, if, for example, an email provider to the public shares the IP address that was the source of a malicious email to a ISAO, that email provider did not share content information and therefore likely did not violate the SCA. Moreover, if a private entity provides email services to its employees and shares the text of an email that is the source of a computer virus with another company, that private entity likely did not violate the SCA because that entity does not provide ECS or RCS to the public .

Nonetheless, many Internet Service Providers (ISPs) or email providers ostensibly provide ECS or RCS to the public, and those companies may be interested in sharing the contents of information with outsiders for cybersecurity purposes. If so, it is uncontroversial to say that because of disputes over key terms like "electronic storage" and "RCS" and "ECS," the SCA, as currently written and interpreted, is hardly a model of clarity. The resulting ambiguity about the legality of information sharing within the SCA's general ambit may deter providers of ECS or RCS to the public from sharing cyber-threat information with other private entities. After all, ambiguity in the law often breeds litigation, and the costs of litigation may be significant enough to deter companies from engaging in cyber-information sharing.

The hesitancy to participate in information sharing schemes may exist notwithstanding several exceptions to the SCA's general prohibition on the disclosure of certain types of electronic communication held in storage. For example, while the SCA excludes from its prohibition on the disclosure of communications disclosures made to a "person employed or authorized ... to forward such communication to its destination," that exception only eliminates liability for those entities wishing to gather and share cyber-threat information within that organization and does not sanction the sharing of the contents of a communication with an outsider. Moreover, the SCA also contains a consent exception, allowing an ECS or RCS provider to divulge the contents of a communication if the sender or recipient of that communication consents or, in the case of an RCS, if the subscriber of the communication consents to the disclosure. Like the Wiretap Act's consent exception, the SCA's consent exception is largely fact dependent, arguably providing little assurance to a communications services provider that wishes to wholly eliminate litigation risk. More specifically, the scope of the SCA's consent exception is directly linked to a service provider's status as providing ECS or RCS, which may make the viability of the consent defense contingent on the murky distinction between when a provider is acting in either role. Finally, similar to the Wiretap Act, the SCA also contains a provider exception, and, much like its counterpart in the Wiretap Act, the SCA's provider exception is limited to allowing disclosures that are necessary for the "protection of the rights or property of the provider " and arguably does not extend to the protection of third parties that the provider may wish to share cyber-intelligence.

The Pen/Trap Act

The final major federal privacy law potentially relevant to cyber-information sharing amongst private parties is found in Title III of ECPA, Pen/Trap Act. The Pen/Trap Act has been referred to as the "non-content counterpart" to the Wiretap Act, in that the Pen/Trap Act is concerned with the real time capturing of non-content information, such as IP addresses and the "to" and "from" fields in an email. Specifically, in 18 U.S.C. Section 3121, the Pen/Trap Act generally prohibits any person from installing or using a "pen register or a trap and trace device," devices used outside of the ordinary course of business that capture either incoming or outgoing non-content electronic information about the source of a communication, without first receiving permission from a court. Violations of the Pen/Trap Act can result in criminal penalties, including not more than one year in prison. Like its counterpart the Wiretap Act, the Pen/Trap Act, also contains several exceptions to its general prohibition, including a (1) "provider exception," which permits service providers to use pen/trap devices for the "operation, maintenance, and testing of [an] ... electronic communication service" or to protect the "rights and property" of the provider or the "users of that service from abuse of service or unlawful use of service," (2) "consent exception," which allows the use of pen/trap devices where the user of the service has provided consent. Nonetheless, in sharp contrast to the Wiretap Act and the SCA, the Pen/Trap Act contains no provisions barring the disclosure or divulgence of non-content information derived from a pen/trap device.

For a private entity wishing to share non-content cyber-threat information with a third party, the Pen/Trap Act likely does not raise serious legal concerns. First, the Pen/Trap statute's provider exception likely eliminates any potential criminal liability that could arise from a company monitoring and capturing non-content information for cybersecurity purposes. After all, the Pen/Trap Act's provider exception sweeps more broadly than the provider exceptions in the Wiretap Act or the SCA, in that Title III of ECPA allows providers to use a pen/trap device "relating to the operation, maintenance, and testing of [an] ... electronic communication system.... " Given that nearly any electronic communication system, such as email or Internet communication, necessarily depends on routing information from one source to another, it is arguable that most private entities with genuine cybersecurity concerns may likely be capturing non-content information as a natural product of the operating of an electronic communication system anyway.

Moreover, even if an entity's decision to capture non-content address information is not related to the "operation, maintenance, and testing of [an] ... electronic communication system," the second clause of the Pen/Trap Act's provider exception allows the use of a pen/trap device to protect the rights or property of the provider or the users of the service from "abuse of service or unlawful use of service," which would appear to encompass the circumstance where a private entity collects non-content information to identify the source of a potential cyber-threat. In addition, even if the provider exception does not allow the use of a pen/trap device, the consent exception would allow a provider to capture non-content cyber-threat information with the agreement of the provider's user. Importantly, because the Pen/Trap Act only criminalizes the illegal use of pen/trap devices and does not regulate the disclosures of non-content information culled from a pen/trap device, once a provider has legally used a pen/trap device, there appears to be no reason why a private entity should fear liability under the Pen/Trap Act if a company were, for example, to share the IP address that was the source of malware with another private company.

Other Federal and State Privacy Laws

While ECPA is the most prominently mentioned federal privacy law that could implicate cyber-threat information sharing efforts, other federal privacy laws could also plausibly deter the exchange of cyber-intelligence amongst private entities. As noted above, ECPA's privacy protections are tied to (1) the age of the underlying communication, with communications in storage generally getting less protection than communications that are being transferred in real time, and (2) whether the underlying communication reveals substantive content, with non-content information, such as IP addresses and email addresses, receiving fewer protections under the statute. In contrast to ECPA, a host of various federal privacy laws target specific industries that tend to control personally identifying information (PII), such as names, addresses, phone numbers, or Social Security numbers. For example, the Cable Communications Policy Act of 1984 (CCPA) generally prohibits "cable operators" from collecting and disclosing PII, subjecting entities that violate the CCPA's privacy protections to civil liability. Some courts, interpreting the CCPA, have concluded that cable providers when providing Internet services can be subject to the Act's privacy provisions, raising the specter of civil liability if a cable ISP were to disclose PII—like a name or an email address—while sharing cyber-threat information with another private entity.

Much as the CCPA could raise liability concerns for cable ISPs wishing to share cyber-information with other private entities, so too could a variety of federal privacy laws raise legal questions for the entities that are regulated by such laws. Indeed, several discrete federal privacy laws regulate how PII is collected and disseminated. These laws target a variety of distinct entities, including

consumer reporting agencies operators of websites or online services directed to children financial institutions videotape service providers educational agencies or institutions health plans, health care clearinghouses, and health care providers telecommunications carriers

To the extent any one of these entities wishes to share cyber-intelligence within its possession with others in the private sector, legal questions may abound if any of the information to be shared contains material that is potentially protected under federal privacy law. None of the aforementioned federal privacy laws specifically contemplate any exceptions for the sharing of cyber-information for cybersecurity purposes. And, there is very little, if any, case law examining how a given law applies to the specific context of the collection and dissemination of information for cybersecurity purposes, leaving a legal lacuna for those regulated entities that may wish to engage in cyber-information sharing.

Beyond federal privacy laws, states and localities have enacted countless laws that may prevent or deter private entities from sharing cyber-intelligence with others. All but one of the fifty states has an eavesdropping law that is generally modeled off the Wiretap Act, and a majority of states regulate the collection and dissemination of electronic communications. While many of the state communications privacy laws mirror federal law, state laws are often more restrictive or may simply regulate different aspects of communications privacy than federal law, multiplying the legal questions facing those entities wishing to engage in cyber-information sharing. For example, eight states currently generally require both parties to an electronic communication to consent to its interception and/or further dissemination, allowing, in the words of one commentator, cyber "attackers a veto on whether their packets are inspected for malicious code" and potentially deterring some entities from collecting and divulging cyber-threat information to others.

Moreover, much like the federal government, some states have laws that target the collection and divulgence of PII within the possession of entities that may wish to engage in cyber-information sharing. Although an examination of the various state privacy laws is beyond the scope of this report, these laws may raise liability concerns for entities that do business in multiple states and wish to disseminate cyber-threat information outside of the company.

Antitrust Laws

In addition to federal and state privacy laws, antitrust laws also have generated liability concerns for private entities that wish to collaborate over cybersecurity. Indeed, in a recent survey, more than a quarter of IT professionals identified "anti-competitive concerns" as one of the central reasons for not participating in information sharing programs. Deterring anticompetitive conduct by businesses, such as coordinated action that undermines competition, is at the heart of federal antitrust law. Specifically, the Supreme Court in interpreting the Sherman Antitrust Act—the " primary federal antitrust enforcement mechanism" —has recognized that the law's facial prohibition in Section 1 on all contracts, combinations, or conspiracies that result in a restraint of trade or commerce should be read to prohibit only those agreements that unreasonably restrain trade. While courts interpreting the reach of the Sherman Act generally view any concerted activity with some degree of skepticism, certain agreements, such as price fixing and market allocation among competitors, are viewed as being so "inherently anticompetitive that each is illegal per se without inquiry into the harm it has actually caused." Other agreements, such as mergers or joint ventures that may facilitate more effective competition, are adjudged under the "rule of reason," in which a court will weigh the legitimate justifications for a restraint against any anticompetitive effects. In other words, determining whether a given agreement between two private businesses violates the Sherman Act largely depends upon the specifics of that particular agreement. Businesses that are alleged to violate federal antitrust laws face potential criminal prosecutions, as well as civil actions that could be initiated by the federal government, state governments, or even aggrieved private litigants. Civil litigation risks treble damages—damages three times the amount of actual damage—being paid to successful plaintiffs.

While fears abound that any coordination on cyber-defense could give rise to antitrust liability, the likelihood of such liability will likely depend on the nature and purpose of the underlying agreement to share cyber-threat information. Exchanges of information among competitors do not constitute per se violations of the Sherman Act, as the Supreme Court has found that such practices can "increase economic efficiency and render markets more ... competitive." Moreover, the Court has been reluctant "to condemn rules adopted by professional associations as unreasonable per se.... " As a consequence, perhaps a few agreements to coordinate on cyber-defense—such as an agreement amongst competitors to "implement a uniform set of cyber-security practices" by either agreeing to "pass on" certain associated costs to customers or adopt cybersecurity practices that provide inferior products to end users —may "amount to a 'naked' restraint that results in reflexive condemnation under the per se rule." Nonetheless, most efforts to share cybersecurity information amongst private entities, particularly within a formal organization like an ISAC, will likely be adjudged under the rule of reason. A rule of reason analysis would weigh the legitimate justifications for engaging in concerted efforts to share cyber-information against any anticompetitive effects. As such, a rule of reason analysis regarding cyber-information sharing may weigh the interest in combatting fraudulent cyber-activity versus the potentiality of certain actors being excluded from the cyber information forum for anticompetitive reasons. Nonetheless, there is no case law that squarely addresses how antitrust laws apply to coordinated efforts to combat cyber-threats, and given the central role of common law in defining the limits of federal antitrust law, the net result may be considerable legal uncertainty for those private entities that may wish to engage in such activities.

Recognizing the legal uncertainty that exists with respect to antitrust law and cybersecurity information sharing, in April of 2014, DOJ and the Federal Trade Commission (FTC) issued a joint policy statement that attempted to clarify the extent to which the exchange of cyber-threat information amongst private parties could raise antitrust issues. The joint policy statement confirmed that information sharing agreements are typically examined under a rule of reason analysis, and the statement continued by recognizing that the exchange of cyber-threat information has numerous positive effects that will weigh in favor of its legality, including helping "secure our nation's networks of information and resources." Moreover, the joint policy statement emphasized that the typical nature of cyber-threat information—described as being "very technical in nature"—is often unlikely to contain "competitively sensitive information" that would allow participants to "raise prices or reduce output, quality, service, or innovation." Instead, the two agencies underscored that the primary antitrust concern in the context of cyber information sharing is the sharing competitively sensitive information, such as "current, and future prices, cost data, or output levels" that could allow for "competitive coordination among competitors."

Notwithstanding the value of the joint guidance, as the guidance concedes, any analysis of the legality of a cyber-information sharing agreement is "intensely fact-driven," and, given the predominant role of the rule of reason with respect to examining the legality of any cyber-threat sharing agreements, definitive conclusions by the government about the legality of cybersecurity information sharing arrangements vis-à-vis antitrust law may simply be impossible. Moreover, given the role of private parties in enforcing federal antitrust law through civil lawsuits, even if government entities like the FTC and the DOJ generally agreed that antitrust laws should not be enforced with respect to concerted actions over cybersecurity, nothing prevents an aggrieved private party from initiating an antitrust lawsuit to prevent collaboration over cyber-information sharing, meaning that without a change in the current law liability risks from antitrust suits may remain for any private entity interested in sharing cybersecurity information.

Tort Law

Another often-cited source of liability that may dissuade private entities from participating in cyber-information sharing schemes is tort law, specifically torts founded upon negligence– that is, the fear that by sharing and obtaining cyber-information a private entity may be liable for negligently failing to act upon certain threat information. Generally under tort law, to establish that a defendant has acted negligently, a plaintiff must show: (1) a duty of care owed to the plaintiff by the defendant; (2) a breach of that duty by the defendant; (3) causation (i.e., the resulting injury was both the "but for" and "proximate cause or foreseeable consequence of the risk created by the defendant's act or omission"); and (4) a cognizable injury or harm to the plaintiff. In the context of a lawsuit following a cyberattack, an injured party may seek compensation from a company whose network was breached, arguing that the company owed its customers a duty of reasonable security to protect against cybercriminals stealing their data. However, while courts have generally recognized that "cyber attacks are [a] foreseeable" risk for which a service provider must account, courts have been fairly reluctant to find that a particular cyberattack should have been anticipated by a service provider. After all, just as a business has no duty to protect its customers against unforeseeable crimes from third parties, so too must the "duty to implement security thwarting third-party cybercrimes ... turn on whether the crime was foreseeable." In other words, under tort law, a business likely does not have a duty to guard against "innovative [cyber-]breaches that have no known or effective defense at the time of the attack."

Because tort liability for a cyberattack will likely turn on the amount of knowledge a given party may have about a cyberattack, cyber-information sharing schemes have the potential to change the tort liability calculus for those entities that participate. For example, if a company opts to share information about the origins of a recent cyberattack perpetrated on that company with a public information sharing group, like an ISAC, the company may be admitting that it could have foreseen the attack or mitigated its effects in some way, providing potential plaintiffs with credible evidence to support a potential tort lawsuit. Likewise, entities that receive information about a potential cyberattack, fail to act, and then subsequently are targeted by the attack, can no longer credibly claim that the harm from the cyberattack was unforeseeable. In this sense, tort law can have the perverse effect of incentivizing private entities to "simply stay[] in the dark" about potential cyberattacks and to not participate in cyber-information sharing programs.

Nonetheless, even if participation in a cyber-information sharing agreement increases tort liability risks, it remains very difficult for a plaintiff to succeed on the theory that a private entity failed to prevent a cyberattack. First, in order for cyber-threat sharing to increase tort liability risks, an entity would have to have some considerable bad luck. The company in question would not only have to suffer a cyberattack, but that cyberattack would have to be linked to a cyberattack in which information was shared about, and the cyberattack would have to result in actual damages for a plaintiff. Notwithstanding popular media accounts regarding potential losses created by a cyberattack, most of the cost of a cyberattack will be borne by the company attacked and will not result in actual losses for potential plaintiffs in a tort lawsuit, like a customer. And courts have been loath to allow a lawsuit to proceed based on the potential for future injury resulting from a cyberattack. Second, and perhaps most importantly, the economic loss doctrine—which prohibits parties from recovering financial losses, absent injury to person or property, under tort law —often prevents recovery in a lawsuit respecting a cyberattack because "[m]any of the harms that would result from a cyber-attack on, say, the power grid or the financial sector would be purely economic in nature." And indeed, in recent tort lawsuits regarding cyberattacks, courts have dismissed tort claims at early stages of the litigation because of the economic loss doctrine. In short, the litigation risks posed by tort lawsuits respecting a cyberattack may be fairly minimal regardless of whether an entity is involved in cybersecurity sharing.

Other Sources of Liability

Beyond privacy, antitrust, and negligent tort law, several other laws could be the source of liability concerns for private entities that choose to share cyber-information with each other. For example, the 2013 Target data breach incident led to a shareholder derivative suit against Target's officers and board of directors, that alleged that those actors violated fiduciary obligations of trust, loyalty, good faith, and due care by failing to take adequate steps to prevent the cyberattack and by making inaccurate disclosures to their shareholders about the extent of the damage from the attack. Shared cyber-information could be critical evidence in a similar suit. If, for example, a company that suffered a data breach like Target shared cyber-threat information with an ISAC prior to the attack, one could imagine such evidence being used in a similar shareholder lawsuit to establish that the company's officers had specific knowledge about the company's cyber-vulnerabilities or the extent of a cyber-attack on a given day.

And a shareholder derivative lawsuit is only one genre of litigation that could both result from a cyberattack and be aided by shared cyber-information. For example, institutional customers who sue a bank in the wake of a cyberattack that has resulted in fraudulent wire transfers could be helped by evidence that a bank knew about particular risks posed by a cyberattack. The general framework governing the rights and obligations between a bank and customers respecting fraudulent wire transfers is found in Article 4A of the Uniform Commercial Code (UCC). Article 4A generally requires banks to bear the risk if a third party steals a customer's identity, resulting in a fraudulent wire transfer. Nonetheless, the UCC contains an exception whereby a customer will bear the risk of a fraudulent payment order if: (1) a bank and its customer agree to implement a security procedure designed to protect against fraud; (2) the security procedure that is implemented is a "commercially reasonable" method of providing security against unauthorized payment orders; and (3) the bank demonstrates that it accepted the payment order in good faith and in compliance with the security procedure. While the question of whether a particular security procedure can be deemed "commercially reasonable" will likely depend on the specific facts surrounding a cyberattack and the procedures a bank had in place to prevent such a fraudulent transfer, one critical factor may be a bank's prior awareness of the risks posed by a cyberattack. In this vein, knowledge that a bank knew about a cybersecurity risk because of shared cyber intelligence could implicate that bank's liability with regard to a suit under the UCC. More broadly, there are "a myriad of legal theories, including ... breach of express or implied contract, state deceptive trade practices act violations or state data breach notification violations" that could be the basis for a lawsuit against an entity that suffered a data breach. Shared cyber-information could be critical evidence that helps prove, for example, the timing of when a cyberattack occurred or the company's knowledge of the attack and the sufficiency of the company's cyber-defenses at the time of the breach, which could result in private entities being less likely to share cyber-intelligence with any other entity or organization.

Sharing Cyber -Information with the Government

Just as private entities are increasingly recognizing the need to access cyber-intelligence gathered by their peers, the federal government may need access to cyber-threat information in the possession of the private sector in order to make informed decisions about the government's and the nation's cybersecurity needs. As Lisa Monaco, the President's Homeland Security Advisor, recently noted, the "private sector has vital information we don't always see unless they share it with us." Nonetheless, obtaining cyber-intelligence from the private sector can be difficult for the federal government. Putting aside the difficult issues that may arise when a private party affirmatively refuses to divulge cyber-intelligence within its possession to the federal government and the government is forced to obtain, for example, a warrant or a subpoena to access such information, the federal government may not know that a private entity possesses certain cyber-intelligence, and the only way the government can learn about a potential cyber-threat is by having the private party voluntarily share that information with the government. The voluntary disclosure of cyber-intelligence to the government may, however, be something private parties are reluctant to do because of various legal concerns.

Before discussing those legal concerns, it is important to note from the onset that the government, and specifically DHS, has ample legal authority to receive voluntarily shared cyber-information. For example, under Section 201 of the Homeland Security Act, the I&A is authorized to "receive ... information ... [from] private sector entities ... in support of the mission responsibilities of" DHS. Moreover, the NCPA provided explicit statutory authority for the NCCIC to serve as an "interface for the multi-directional ... sharing of information related to cybersecurity risks, incidents, analysis, and warnings.... " More broadly, the Critical Infrastructure Information Act (CIIA), a subtitle within the Homeland Security Act, has extensive provisions regarding the treatment of "critical infrastructure information" that is "voluntarily submitted to a ... federal agency", reflecting an assumption that the federal government is not precluded from receiving from a private entity voluntarily shared information pertaining to critical infrastructure.

Freedom of Information Act Disclosures

One central concern for those private entities that may wish to share cyber-intelligence with the government is that the information shared, which may include proprietary information or even simply embarrassing material, could be disclosed through the Freedom of Information Act (FOIA), whether through an affirmative agency disclosure or through a public request. FOIA generally provides that government agencies "shall make available to the public" certain agency records, except insofar as the records are protected from disclosure under several exemptions to the Act. Congress, in the CIIA, provided an exemption to FOIA for any "critical infrastructure information" (CII) that is "voluntarily submitted" to DHS for use by that agency regarding the "security of critical infrastructure" and related purposes. In turn, DHS, through administrative regulations, has created the Protected Critical Infrastructure Information (PCII) Program to ensure that information that is voluntarily shared with the agency receives the protections created by the CIIA.

For those private entities concerned that cyber-intelligence shared with the government will be indiscriminately disseminated through a FOIA request, there are three central concerns with the state of the current law with respect to FOIA and cyber-information sharing. First, the FOIA exemption contained in the CIIA is limited to information that relates to "critical infrastructure," a term that is confined to only those "systems and assets" that are "vital" to the United States and whose "incapacity or destruction" would have some sort of "debilitating impact" on the country. In other words, unless a private entity is involved with the "backbone of our nation's economy, security and health," any cyber-information a private entity shares with the federal government would not fall under the FOIA exemption provided in the CIIA.

Second, even if an entity sharing information with DHS is involved with "critical infrastructure," the potential exists that not all cyber-information falls within the CIIA's protections. Instead, only "critical infrastructure information" is exempt from FOIA, a phrase that, while fairly broad in scope, is not limitless. For example, the Homeland Security Act facially limits CII to "information related to the security of critical infrastructure," which could arguably exclude information pertaining to a cyberattack that is not intended to disable or destroy a critical infrastructure system, such as an attack aiming to commit economic espionage. Accordingly, private actors may question whether particular threat information falls within the CIIA's definition for CII, arguably creating legal uncertainty to those who wish to share cyber-information with the federal government.

Finally, the PCII program created by DHS has a host of various procedural rules that a private entity must follow to ensure that the information provided to DHS receives protections under the CIIA. For example, any CII, to avoid being disclosed under FOIA, will need to be submitted to DHS's PCII Program Manager and will need to contain several certifications and disclaimers, even if the information has been already submitted to another DHS entity, like the NCCIC. As one commentator has noted, the PCII Program's procedural restrictions "necessarily add an extra layer of process that may be sufficient to ultimately defeat the purpose of near real-time information sharing," if the restrictions do not defeat cyber-information sharing efforts entirely.

It should be noted, however, that just because cyber-intelligence that is provided to DHS may be excluded from the CIAA's FOIA exemption that does not necessarily mean that the information will necessarily be disclosed to the public. Indeed, FOIA contains several broad exemptions that may prevent the release of shared cyber-intelligence even if the information does not fall within DHS's definition of PCII. For example, FOIA does not apply to material that involves "trade secrets" or otherwise "privileged or confidential" "commercial or financial information." Nonetheless, without a broader exemption for cyber-information shared with the government, an argument can be made that private cyber-threat information that could contain sensitive material may be disclosed more broadly through FOIA.

Intellectual Property Concerns

Related to the concern about cyber-information sharing and FOIA is the more general concern that cyber-intelligence, once shared with the government, could waive all intellectual property rights associated with such information. The primary body of intellectual property law that could be implicated by cyber-intelligence sharing is trade secret law. The law of trade secrets, which aims to encourage companies and individuals to invest in collecting information that could help secure competitive advantages in the marketplace, protects against the disclosures of "any formula, pattern, device, or compilation of information which is used in one's business and which gives [that business] an opportunity to obtain an advantage over competitors who do not know or use it." Put another way, information is protected as a trade secret to the extent that information (1) has independent value because the information is not generally known and (2) is the subject of efforts to maintain its secrecy. If any person or entity attempts to misappropriate a trade secret, a court can issue injunctive relief or monetary damages against such a defendant.

A private entity, by sharing cyber-intelligence with the government, could risk losing trade secret protection for any valued information that is associated with the cyber-intelligence. For example, when a company shares information about a particular cyber-incident with the government, that entity may be divulging information about internal business operations or disclosing details about the underlying proprietary data that may have been stolen during the course of a cyberattack. The failure to take reasonable steps to prevent gratuitous disclosures of trade secret information forfeits any protection afforded under the law, and the voluntary disclosure of information to a third party generally erodes any trade secret protection for that information.

While the disclosure of cyber-threat information in an unprotected forum—whether public or private—likely risks trade secret protections for that information, in the context of a private entity sharing cyber-intelligence with another party, contractual terms can be negotiated between the parties to provide protections for the intellectual property rights associated with shared cyber-intelligence. With respect to sharing cyber-intelligence with the federal government, some have raised concerns about how well the agreements between the government and private entities protect trade secret information that is disclosed in the course of exchanging cyber-intelligence. Specifically, according to DHS, in order to gain access to NCCIC's cyber-intelligence information, a private entity must sign a Cooperative Research and Development Agreement (CRADA) with the agency, and the text of the information-sharing CRADA reportedly includes language that potentially forfeits intellectual property rights in the shared material. Regardless of whether a CRADA could be altered to avoid using such language or whether such language is just the natural result of sharing cyber-information among several public and private actors, as Gregory Garcia, former Assistant Secretary of DHS for Cybersecurity, noted, the CRADAs governing cyber-information sharing "cause[] some companies a lot of heartburn and ... will prevent them from participating or if they do participate they might not do so as robustly if that intellectual property provision did not exist."

Regulatory Enforcement Concerns

Perhaps the primary concern amongst private actors interested in sharing cyber-intelligence with the government is that government regulators will either be "tipped off" because of the shared information and begin an investigation or will "use shared information" as evidence in a regulatory "action against a company." The fear that the government will use information that a private entity shared for cybersecurity purposes against that entity may be particularly pronounced if the underlying information pertains to a cyber-breach that resulted in the loss of personal or regulated data.

For example, over the past decade, the FTC, which generally is tasked under the Federal Trade Commission Act with promoting economic competition and consumer protection by eliminating acts or practices that are "unfair or deceptive," has been at the forefront of federal cybersecurity efforts. In particular, the independent agency has initiated several enforcement actions under Section 5 of the FTC Act that have resulted in tens of millions of dollars in civil penalties, more than fifty private settlements, and expensive compliance obligations for the companies investigated. Some have suggested that the FTC could learn from cyber-intelligence that was shared with DHS that a company has failed to take proper cybersecurity measures, resulting in an FTC investigation of the company. And, perhaps such a scenario is not purely theoretical. In 2010, a cyber-intelligence company shared information with the government that a Georgia-based medical laboratory called LabMD had allowed the billing information for nearly 9,000 patients to be accessed on a peer-to-peer network service, and, in turn, the FTC used the shared information to commence an investigation against LabMD.

In addition to the FTC, the other primary federal agency often mentioned as having an interest in taking regulatory actions as a result of shared cyber-intelligence is the Securities and Exchange Commission (SEC), an independent regulatory agency authorized to administer the Securities Act of 1933 and the Securities Exchange Act of 1934. The two laws are generally aimed at ensuring that investors receive adequate information about the securities being offered to the public for sale and preventing deceit, misrepresentations, and other fraud in the sale of securities. In this vein, the two laws contain detailed disclosure requirements for the sale of securities to the public, including the need for companies to file initial registration statements and periodic reports with the SEC.

Under SEC guidelines, corporations and attorneys are advised to report material cyber-risks and incidents to the SEC. Material cyber-risks and incidents might include new expenditures on corporate cybersecurity, loss of intellectual property, or incidents that have adverse impacts on customers or clients or even that cause "reputational damage adversely affecting customer or investor confidence." Because the failure to disclose material information to the SEC could prompt investigations led by the Commission, risking civil liability and even criminal penalties for the companies involved, a fear exists that information disclosed by a company to the government as part of a cyber-information sharing arrangement, such as details about a cyber-breach, could be used as evidence to show that the company withheld material information from the SEC.

Current law provides fairly limited assurances that shared cyber-intelligence will not be subsequently used by the FTC, SEC, or any other government entity that could use such disclosures in the course of a regulatory enforcement action. Under the CIIA, CII disclosed to DHS cannot be used by "any other Federal, State, or local authority, or any third person, in any civil action arising under Federal or State law" if the information was submitted in "good faith." Moreover, the CIIA prohibits CII from being used or disclosed by "any officer or employee of the United States for purposes other" than (1) for the "purposes [of the CIIA]"; (2) in furtherance of an investigation or the prosecution of a criminal act; or (3) when the information is disclosed to Congress, or its representatives, or the Comptroller General, or its representatives. The latter provision, if violated by an officer or employee of the United States could result in criminal penalties or loss of employment. Nonetheless, the CIIA's prohibitions on the collateral use of certain cyber-information suffer from many of the shortcomings of the CIIA's FOIA exemption—namely, the limited scope of the term "CII" and the potential obstacles posed by DHS's requirements under the PCII Program. Moreover, phrases like "good faith" and "purposes [of the CIIA]" are not defined by the Act, and there is no case law interpreting the collateral use restrictions of the CIIA, leaving considerable ambiguity as to the scope of those provisions.

Privacy Concerns

Related to the concerns from those in the private sector that the government may use (or misuse) information obtained from cyber-information sharing for a regulatory purpose are broader worries about divulging large volumes of often-sensitive cyber-intelligence to the government. These concerns may be particularly worrisome in the wake the 2013 unauthorized disclosures of classified information by Edward Snowden, a former National Security Agency (NSA) contractor, regarding the size and scope of American foreign intelligence efforts. Many of these disclosures revealed that the government had access to wide swaths of information about the customers of several technology giants, harming those firms' relationships with their customers and reportedly harming the firms' bottom lines. As a result, in the words of one commentator, the "big consequence of Edward Snowden's NSA leaks" may be that companies that would have otherwise been interested in sharing cyber-intelligence with the government "will be extremely wary of anything that has the words 'government' and ' information sharing ' so close together."

While most of privacy concerns from the private sector regarding sharing cyber-information with the government are non-legal in nature—that is, the debates center on whether information sharing should occur given the concerns for personal privacy, not on whether information sharing with the government can occur as a result of current federal privacy laws—some have voiced concerns over whether the Stored Communications Act allows for private entities to voluntarily share certain cyber-information with the government. The SCA was discussed earlier in this report in the context of a service provider disclosing the contents of electronic communications to another private entity for cybersecurity purposes. While the content based restrictions contained in Section 2702(a)(1)-(2) apply equally to electronic communications that are shared with the government and, therefore, raise similar legal issues to those discussed above, the SCA also contains a provision explicitly regulating the dissemination of non-content information to governmental entities.

Specifically, under 18 U.S.C. Section 2702(a)(3), providers of a RCS or an ECS to the public are generally prohibited from "knowingly divulging a record or other information pertaining to a subscriber or customer of such service ... to any governmental entity." The SCA provides no definition for what "record[s] or other information pertaining to a subscriber or customer" entail, leading to some dispute about the scope of the SCA's prohibition on non-content information. Courts have interpreted "record information" to have a broad import that at the very least includes information like a subscriber's name, identity, address, and communication records, and may include broader information that merely relates to a customer or subscriber. The DOJ has issued a White Paper that attempts to cabin the type of "record information" falling within Section 2702(a)(3)'s prohibition to information that "can identify or otherwise provide information about any particular subscriber or customer." In other words, in the view of the Justice Department, private entities can divulge to the government information like the "characteristics of a computer virus or malicious cyber tool" or aggregate information about Internet traffic patterns without running afoul of 18 U.S.C. Section 2702(a)(3). Putting aside the merits of DOJ's position —one commentator has suggested that the SCA's prohibitions on the disclosure of electronic communications to the government "could be and is being construed by many to include the coding of viruses and malware and the IP addresses from which cyber attacks are originating" —the fact that a dispute remains over the scope of the SCA's prohibition on disclosures to the government arguably indicates there is considerable uncertainty as to whether federal privacy law generally prohibits many forms of cyber-intelligence sharing with the government.

Like its general prohibitions pertaining to the disclosures made by providers of ECS or RCS to other private entities, the SCA's prohibition respecting disclosures made by service providers to the government has several exceptions, which arguably do little to clarify the legal landscape for those interested in sharing cyber-information with the government. For example, the SCA contains a provider exception and a consent exception for disclosures made by a service provider to the government. As noted above, the SCA's provider exception may only extend to allow for the disclosure of information that is directly related to protecting the rights or property of the provider , as opposed to third parties' interests. And the scope of the consent exception will often be tied to the specific facts respecting a particular customer's agreement to allow the service provider to submit cyber-intelligence to the government.

The SCA does contain a third exception specific to disclosures to the government: the Act allows disclosures of content and non-content information to be made by a provider if the provider believes in "good faith" that an "emergency involving danger of death or serious physical injury to any person requires disclosure without delay" of the communications or information "relating to the emergency." The SCA's "exigent circumstances" exception, however, is an exception that has been read narrowly to allow the government to access information necessary to "prevent or minimize" a true, active emergency and extends no further. It is unclear whether many types of cyber-information in the hands of the private sector would reveal information that would help alleviate an active emergency situation so that the intelligence could be disclosed to the government under the SCA's exigent circumstances exception. More broadly, given the ambiguities associated with the SCA's general prohibition on voluntary disclosures to the government with regard to electronic communications and the exceptions to that prohibition, much like other areas of law regarding cyber-information sharing, federal privacy law as it pertains to the dissemination of cyber-intelligence from the private sector to the federal government raises many questions and has few clear answers. http://www.lexis.com/research/xlink?app=00075&view=full&searchtype=get&search=750+F.3d+1098%2520at%25201104

Legislative Options for Cyber-Information Sharing

Given the two major categories of cyber-information sharing—sharing of information in the possession of the government and sharing of information in the possession of the private sector—and the myriad of legal issues arising with respect to each category, legislative changes to federal law that aims to encourage the dissemination of cybersecurity information among the public and private sectors could take countless forms. Indeed, during the 113 th and 114 th Congresses, several legislative proposals have been introduced that aim to remove the current legal obstacles that may be preventing more robust cyber-intelligence sharing, whether by removing discrete legal barriers to information sharing or by effectuating more wholesale change with regard to the distribution of cyber-intelligence within the public and private sectors. While any one of the various legislative proposals on cybersecurity information sharing could merit a lengthy discussion, six themes permeate the various proposals aimed at promoting cybersecurity information sharing—one overarching theme, two that pertain to cyber-information possessed by the government, and three that pertain to cyber-information in the control of the private sector.

Creating a Broader Legal Framework for the Sharing of Cyber-Information

A central difficulty with the current law on cyber-security information is simply that there is very little federal law on the subject. The only federal law that directly contemplates the concept of the federal government and private entities sharing cyber-intelligence with each other is the Homeland Security Act, and that law, by its very terms, is generally limited to the sharing of cybersecurity information as it pertains to critical infrastructure systems. As a result of the lack of any federal framework to guide public and private entities interested in sharing cyber-intelligence, the law must be guided by several disparate areas of law whose guiding principles may be antithetical to the widespread dissemination of cyber-intelligence.

To provide clarity to an area of law much in need of clarification, several proposals begin by squarely authorizing some degree of sharing of cyber-intelligence between the public sector and the private sector and between private entities. For example, the Cyber Intelligence Sharing and Protection Act (CISPA), a bill that has passed the House of Representatives the past two Congresses, would explicitly authorize (1) the federal government to "facilitate information sharing, interaction, and collaboration" between the federal government and the private sector, and (2) private sector cybersecurity providers and entities that protect their own information networks to "share cyber threat information with any other entity" of their choosing, including certain entities within the federal government. Similarly, the Cyber Threat Sharing Act of 2015 (CTSA) would allow (1) the NCCIC to "receive and disclose cyber threat indicators" to the rest of the federal government and the private sector, and (2) private entities to share "cyber threat indicators" with certain private sector organizations and the NCCIC.

Having created a general framework that contemplates broader cybersecurity information sharing, the legislative proposals on cybersecurity information sharing begin to diverge on three central issues: (1) the types of cybersecurity information that is authorized for dissemination within the private sector and between the private and public sectors; (2) the entities that can receive such information; and (3) the purposes for which such information can be used.

Types of Cybersecurity Information: The broadest approach is epitomized by bills like the Cybersecurity Information Sharing Act of 2014 (CISA), which would allow entities to share information about (1) cyber-vulnerabilities, (2) cyber-threats, and (3) broader efforts and strategies that have been used to prevent or mitigate cyberattacks, encompassing nearly any type of information within an entity's possession that merely pertains to cybersecurity. A more narrow approach would be that of proposals like the (CTSA), which allows public and private entities to share only limited types of cyber-threat information and does not contemplate entities sharing cybersecurity strategies with each other. Who Can Receive Covered Cybersecurity Information: Bills like CISPA, which generally authorizes a private entity to share cyber-intelligence with "any other entity" it so chooses, contrast sharply with proposals like the CTSA, which limits sharing by private parties to ISAOs and the NCCIC and does not contemplate sharing of cyber-information between, for example, two private entities outside of an ISAO. Purposes For Which Shared Covered Cyber-Information Can Be Used: CISPA, for example, allows the disclosing entity to place "any restrictions" on the use of shared information and generally limits shared intelligence so that such material can only be used for a "cybersecurity purpose," a term of art that broadly encompasses nearly any effort that is aimed at protecting a system or network from a range of different cyberattacks. In contrast, the CTSA more closely circumscribes the uses for which shared information can be put. The CTSA, in addition to having provisions analogous to CISPA that limit the use of covered cyber-information based on the restrictions imposed by the sharing entity and general cybersecurity purposes, would affirmatively require those that share and use "cyber threat indicators" to make "reasonable efforts" to minimize information unrelated to a cyber-threat that may be used to identify specific persons and to "safeguard information" that may be used to identify specific persons from unintended or unauthorized disclosures.

The issues of what can be shared, with whom covered information can be shared, and the purposes for which that information can be used once shared will necessarily define the scope and overall goals of any cybersecurity information sharing legislation. Proposals that sharply circumscribe the types of information that can be shared, the parties that can receive such information, and the uses for that information once it is received will necessarily discourage the dissemination and utilization of cyber-intelligence when compared to bills that take a different approach. On the other hand, proposals that generally authorize vast amounts of cyber-information to be disseminated to a wide range of public and private entities to be used for any number of purposes may be open to criticism that such proposals go too far and undermine other interests, like individual privacy rights. Nonetheless, the three central issues animating the legal frameworks for cybersecurity information reform proposals are only the starting points for the legal discussions on cyber-information reforms. Generally the major proposals on cyber-intelligence sharing begin by establishing fairly broad authorizations for the dissemination of cyber-intelligence and then regulate such activities accordingly, creating several other avenues for legal debate.

Clarifying Which Government Agency Leads the Efforts on Cyber-Information Sharing

Once a legislative proposal has generally authorized broader cybersecurity information sharing between the public and private sectors, the legislation may need to resolve what entity in the government needs to be the liaison between the public and private sector with regard to such sharing of information. As noted above, while ample legal authority currently exists for DHS to serve as the central repository and distributor of cyber-intelligence for the federal government, the legal authorities that do exist often overlap, perhaps resulting in confusion as to which of the multiple sub-agencies within DHS or even outside of DHS, like the newly formed CTICC, should be leading efforts on cybersecurity information sharing.

While earlier versions of cybersecurity legislation contemplated placing the Office of the Director of National Intelligence (DNI) or the Department of Defense (DOD) at the forefront of federal cyber-information sharing efforts, more recent legislation has tasked DHS with the role of coordinating cyber-information sharing. For example, the CTSA designates the NCCIC as the entity charged with receiving and disclosing all "cyber threat indicators" to federal and non-federal entities. Less specific, CISPA allows the President to designate an "entity within [DHS] as the civilian Federal entity to receive cyber threat information" and share that information with other governmental entities, while allowing the President to designate an entity within DOJ to serve as the entity that receives information related to cybercrimes and disseminates such information throughout the federal government. Other legislation may attempt to task several federal agencies with the job of promulgating regulations with respect to the receipt and distribution of cyber-intelligence. CISA, for example, would require the DNI, DHS, DOD, and DOJ to consult and jointly develop procedures that facilitate the timely sharing of federal "cyber threat indicators." The bill would also require the Attorney General to promulgate "policies and procedures" with regard to the receipt of cyber-threat indicators form the private sector. Nonetheless, CISA does contemplate a central role for DHS with regard to the receipt and disclosure of cyber-information, requiring the agency to "develop and implement a capability and process" for accepting cyber threat indicators and countermeasures and ensuring all appropriate federal entities "receive such cyber threat indicators.... "

Few proposals, however, would attempt to resolve the issue of overlapping legal authorities that currently exist with respect to cyber-information sharing. While an argument could be made that the CTSA's naming of the NCCIC as the entity charged with receiving and distributing cyber threat indicators clarifies internal divisions of authority as to what agencies must take the lead on cyber-information sharing efforts, nothing in the legislation explicitly repeals similar authority provided to other federal entities in earlier laws, implying that such authorities remain. Other proposals, such as CISPA, go so far as to disclaim "limit[ing] or modify[ing]" "existing" information sharing relationships, indicating that such proposals would do little to modify the existing division of authority within the federal government with respect to cybersecurity information sharing.

Increasing the Amount and Quality of Government Cyber-Information Disclosed to the Private Sector

Beyond clarifying who in the government is tasked with receiving and disseminating cyber-information, another central theme for cybersecurity proposals is ensuring that the underlying information that is disseminated from the government is both voluminous and helpful. As discussed above, while the government has wide authority to disclose cyber-intelligence within its possession, that authority is not limitless and is necessarily tied to laws that restrict the government's ability to release sensitive information within its possession. More broadly, delays in the dissemination and sanitation of cyber-intelligence arguably may severely diminish the effectiveness of such information.

To increase the speed at which cyber-threat information is distributed and the volume of cyber-intelligence that is disclosed, two main strategies are contemplated by various cybersecurity proposals. First, several pieces of cybersecurity legislation would require DHS to create the capabilities to distribute cyber-intelligence in "real time" to other federal agencies and even the private sector. CISA, for example, contemplates real time or instantaneous, "automated" distribution of cyber-information being facilitated through the creation of a universal electronic format for cyber-information. Second, several bills contemplate authorizing additional access to classified cyber-intelligence within the possession of the government by those in the private sector. For example, CISPA mandates that the DNI establish procedures to allow the intelligence community to share classified cyber-threat intelligence with the private sector, including requiring the expedited issuance of security clearances for those who may need access to cyber-intelligence.

Nonetheless, most of the proposals encouraging faster and more robust dissemination of cyber-information speak only in the most general terms and delegate the authority to accomplish, for example, real time dissemination of cyber-information to an agency like DHS or the DNI. There is an inherent tension between (1) allowing for the rapid disclosure of a large volume of sensitive cyber-intelligence and (2) preserving the privacy and national security interests that currently limit the disclosure of such information. What remains to be seen is whether legislation or subsequent agency action can effectively accomplish the competing goals that underlie the debate over recent cybersecurity information sharing efforts.

Minimizing Liability Related to Distributing Privately Held Cyber-Intelligence

Perhaps the most heavily debated legal issue respecting cyber-information sharing legislation is how to adequately minimize the host of liability issues that may arise for those in the private sector that may wish to disclose cyber-intelligence to outsiders. As noted above, those in the private sector that wish to engage in cyber-information sharing may be exposed to civil and even criminal liability from a host of different federal and state laws. Moreover, because of the uncertainty that pervades the interplay between laws of general applicability—like federal antitrust or privacy law—and their specific application to cyber-intelligence sharing, it may be very difficult for any private entity to accurately assess potential liability that could arise by participating in a sharing scheme. Without some assurances with regard to liability, the potential exists that a private entity may simply refuse to participate in information sharing, reasoning that any amorphous benefits that could be realized would simply not cover the cost of liability. As a consequence, several cybersecurity proposals have attempted to minimize potential exposure for and rationalize any costs associated with sharing privately held cyber-intelligence, initiating a legal debate of its very own on how to properly scope such liability protections.

"Tailored" Approach to Minimizing Liability

There are two central legal approaches to crafting liability immunity provisions in the context of cybersecurity information sharing legislation. First, some have argued for including more narrowly tailored immunity provisions, such that a provision is tied to a particular law that could be the source of civil or criminal liability for private entities that engage in cyber-information sharing. For example, Gregory Nojeim of the Center for Democracy and Technology has argued for passing legislation that creates an additional exemption to ECPA, authorizing service providers to "make disclosures to other service providers or to the government to help protect the systems of other service providers." Likewise, others have advocated for a "cyber-security exception to the antitrust laws," by creating an explicit "legislative carve-out" allowing for the exchange of "vulnerability, threat, and countermeasure information and the development of common security protocols." The upside of the "tailored" approach to liability protection is that by crafting narrow immunity provisions there is less of a risk that any new cybersecurity legislation will disrupt or undermine the goals of previously existing legislative schemes by, for example, immunizing anticompetitive behavior or actions that erode third-party privacy interests.

Nonetheless, the tailored immunity approach has a significant drawback, as well, in that crafting an immunity provision for each and every source of liability that a private entity could face with regard to the sharing of cyber-intelligence may simply be impossible. After all, those entities that collect or disclose cybersecurity information could potentially face countless lawsuits arising under (1) any of the three titles of ECPA, (2) any of a number of other federal privacy laws, (3) federal antitrust law, (4) state common law tort, fiduciary duty, or implied contract claims, or (5) a variety of state privacy or antitrust laws. An argument can be made many of these legal claims are simply meritless or inapplicable with respect to the most benign forms of a cyber-intelligence sharing. Nonetheless, the fact remains that at least in the view of many information technology experts significant gray areas exist in various places in the law deterring more aggressive forms of cyber-intelligence sharing, perhaps warranting more broad-based liability protections. Moreover, because of the potential bases for civil liability, like antitrust and tort law, are based in part on evolving common law standards, enacting cybersecurity information sharing legislation that includes a narrowly tailored immunity provision may not deter the lawsuits of tomorrow that are unanticipated by lawmakers. Finally, even if many of the legal claims levied against entities that share cyber-threat information may be meritless, a determination of the legal merits will often require factual development by the litigants, as federal litigants, for example, need only plead a plausible theory as to liability in order to avoid the initial dismissal of a federal complaint. As a result, liability carve-outs that are limited to only the most meritorious legal claims may not prevent private entities from being subject to potentially expensive factual discovery that may deter cybersecurity information sharing efforts.

"Broad" Approach to Minimizing Liability

Perhaps as a result of the drawbacks of the tailored approach, most of the recent legislation on cybersecurity information sharing has taken the opposite approach: proposing more sweeping language that broadly immunizes private entities involved in collecting and disclosing cyber-intelligence and then drafting tailored exceptions to curb the scope of the immunity. The "broad" approach to civil liability protections for those that wish to collect and share cybersecurity information commonly has four foundations:

Notwithstanding Clauses: Several cybersecurity bills, in authorizing the collection or sharing of cyber-information, will preface any such language with a "notwithstanding" clause. For example, Section 3 of CISA states "Notwithstanding any other provision of law, an entity may ... share with, or receive from, any other entity or the Federal Government cyber threat indicators and countermeasures." Courts generally interpret notwithstanding clauses as signifying that any phrases following the clause "supplant" and "supersede" any conflicting law, which in the context of cybersecurity legislation would imply that any authorizing language to collect and disseminate covered cyber-information that followed a notwithstanding clause would supersede any laws of general applicability that may deter or prohibit such behavior. Limitation of Liability Clauses: Beyond the use of notwithstanding clauses, recent cybersecurity legislation has additionally contained explicit provisions that pertain to liability and contemplate dismissal of lawsuits at early stages of litigation generally pertaining to cyber-information collection and/or sharing. Good Faith Safe Harbors: In addition to explicit liability limitations, CISPA and CISA both contain provisions that would allow defendants whose conduct otherwise would not fall within the scope of the limitation of liability clause to seek dismissal on the ground that the defendant relied in good faith that the conduct complained of was "permitted" under the law. Preemption Clauses: Finally, to ensure that no state or local laws interfere with cybersecurity information sharing, recent cybersecurity proposals have contained explicit preemption clauses that functionally displace any non-federal laws that could be the source of liability for or otherwise interfere with any activities permitted under a given cyber-information sharing proposal.

The broad approach to liability protections for private entities that collect and disseminate cyber-intelligence should not be conflated with a "limitless" approach. Rather the scope of the immunity provisions under the broad approach is necessarily a product of language contained within the four key clauses. As a consequence, cybersecurity bills vary considerably with respect to the scope of liability protections for information sharing. For example, CTSA only prohibits civil or criminal causes of action from being maintained against entities for receiving or disclosing "lawfully obtained cyber threat indicators" from the NCCIC or a self-certified ISAO. The plain language of the CTSA would not immunize an entity with regard to (1) activities taken to acquire cyber-threat information; (2) the sharing of information outside of the NCCIC or a self-certified ISAO; or (3) if the underlying information were not "lawfully obtained cyber threat indicators," which presumably would exclude from the provision "cyber threat indicators" for which "reasonable efforts" had not been made to eliminate personal information from such information. In contrast, bills like CISA more broadly prohibit causes of action based on the collection, sharing, or receipt of information with any other entity or the federal government. Moreover, beyond the general language respecting the four key clauses pertaining to immunity, legislative proposals may have specific carve-outs that pertain to a given cause of action, such as provisions in CISA that maintain antitrust claims based on "price-fixing" or "monopolization" or tort claims based on "gross negligence" or "willful misconduct."

The question that remains to be answered with respect to the broad approach toward liability protection is whether such an approach will truly accomplish the goals of minimizing exposure and creating more legal certainty for those private parties that may wish to share cyber-intelligence. Given the host of limits and caveats that have been placed on the general immunity provisions in the various cybersecurity bills, one might ask whether the resulting language creates a host of new legal questions and produces an equally uncertain legal landscape as to the liability risks posed by information sharing. More broadly, phrases like "good faith" and "notwithstanding" are arguably not legal silver bullets that will necessarily eliminate all litigation associated with cyber-information collection and sharing. Nonetheless, given that legal certainty may simply be impossible with respect to an activity at the epicenter of so many areas of law, the ultimate questions for lawmakers with respect to information sharing immunity provisions will be how much legal uncertainty can be tolerated by the private sector and how much of a role should other laws—like federal privacy and antitrust laws—play with regard to cyber-intelligence collection and dissemination.

Increasing the Participation of Private Sector Cyber-Information Sharing

Questions respecting liability protections in cybersecurity legislation take place in a broader debate over how to increase the participation of private sector entities that currently may be reluctant to share cyber-intelligence within their possession. One solution that has been suggested is to amend current law on cybersecurity information sharing, which contemplates private entities voluntarily sharing and receiving information, and impose a mandate on entities to collect cyber-intelligence from their own computer networks and share it with other private entities and the government or else risk civil liability for refusal to comply with the mandate.

Mandatory information sharing could raise several difficult legal questions, however. First, a mandate that companies collect and share cyber-information could be in tension with the Fourth Amendment to the Constitution, which generally prohibits the government from conducting unreasonable searches. While the Fourth Amendment facially only applies to government searches, courts have recognized that searches conducted by ostensibly private parties can constitute government action when the government knew of and acquiesced in the intrusive conduct and the party performing the search intended the search to occur for the benefit of the government. Arguably, a government mandate to collect cyber-intelligence would transform those in the private sector who are now required under federal law to share information with the government into government actors, raising the question of whether such a law would violate the Fourth Amendment.

The resolution of that question will likely depend on a number of factors. For example, the Fourth Amendment inquiry will likely depend on the nature of cyber-information being collected in the private sector, as acquisitions of non-content information have generally been found to fall outside of Fourth Amendment protection. Moreover, any Fourth Amendment challenge may fail if the plaintiff consented to the underlying search by, for example, agreeing to a computer-use policy or clicking through a banner on a website that warns of the potential invasion of privacy. Finally, the propriety of a mandatory cyber-information program under the Fourth Amendment may depend on the specifics of a mandatory information sharing program, as the Supreme Court has recognized a "special needs" exception to the Fourth Amendment, whereby when a "special need" beyond the "normal need for law enforcement, make[s] the warrant and probable-cause requirement impracticable" —such as preventing a cyberattack—require balancing the gravity of the public interests, the degree to which an intrusion advances the public interests, and the severity of the interference with individual liberty.

Mandated disclosures of cyber-intelligence may conflict with other provisions in the Constitution. For example, the Supreme Court has recognized that the First Amendment not only protects the "right to speak freely," but also includes "the right to refrain from speaking at all." While much of the Court's compelled speech jurisprudence arises in the context of a speaker being forced to endorse a particular ideological message, the Court has recognized that "compelled statements of fact ... like compelled statements of opinion, are subject to First Amendment scrutiny." In the context of requiring a private entity to disclose cyber-information, an argument could be made that a private entity has a First Amendment interest in not being required to divulge factual information the entity "would rather avoid." While the Court has upheld compelled disclosure requirements in context of commercial speech cases, it is unclear whether commercial speech case law is relevant to the compelled disclosure of cyber-intelligence. Instead, content-based speech compelled by the government is generally subject to strict scrutiny, requiring the underlying policy to be narrowly tailored to promote a compelling government interest. Given the serious threat potentially posed by cyberattacks and the supposed ability of robust cyber-intelligence to deter such attacks, a narrowly tailored mandate for the disclosure of cyber-threats arguably may be able to survive a First Amendment challenge. Nonetheless, the law on compelled speech is far from clear and may be one of several other constitutional challenges to a mandatory cyber-threat collection and disclosure law.

Beyond the constitutional issues respecting mandatory cyber-information sharing, there may be practical problems with such a proposal. For example, imposing some sort of penalty or liability on a company that did not participate in a mandatory information sharing scheme only induces an entity to share information if the penalties for not participating outweigh costs associated with participation, such as liability risks or risks to a firm's reputation for disclosing the details about a cyberattack. Moreover, as one commentator has argued, because of the prevalence of consumer and privacy groups closely watching those that possess cybersecurity information, voluntary cyber-information sharing programs can be better tailored than heavy-handed mandates to ensure that information is shared in a manner that is effective, but not so robust as to allow for "forms of sharing that the public believes are especially intrusive."

Recent cybersecurity legislation has eschewed any mandatory information sharing schemes. For example, CISPA contains an "anti-tasking restriction" that explicitly prevents the bill from being construed to "require a private-sector entity or utility to share information with the Federal Government." Similar provisions exist in the CTSA and CISA. The issue that remains for lawmakers who prefer a voluntary scheme for cyber-information sharing is how to create sufficient incentives that overcome the legal and non-legal disincentives that are currently deterring more robust dissemination of cyber-intelligence. Proposals like CISPA provide two related incentives—liability protections and access to government cyber-intelligence—but other incentives for information sharing could include subsidies, such as "direct payments from the government, tax credits, or deductions" for entities that engage in cyber-information sharing, or other benefits like intellectual property protections. At least one bill has been introduced in Congress that would amend the Internal Revenue Code to create incentives for information sharing. Whether any or all of these incentives would be effective in increasing participation in cyber-intelligence sharing schemes, an issue beyond the scope of this report, will be a critical question for lawmakers to resolve when considering any cybersecurity legislation that aims to increase the amount of cyber-threat information that is available within the private sector.

Preventing Government Misuse of Acquired Cyber-Intelligence

Finally, the last major issue for cybersecurity information sharing legislation is to assuage public fears associated with the government collecting privately held cyber-intelligence, including concerns that the information disclosed to the government could (1) be released through a FOIA request; (2) result in the forfeiting of certain intellectual property rights; (3) be used against a private entity in a subsequent regulatory action; or (4) risk the privacy rights of individuals whose information may be encompassed in disclosed cyber-intelligence. While each of the major legislative proposals on cyber-information sharing may differ in substance, there is considerable consensus on the approach congressional bills have taken with respect to each of the four major concerns over government control of voluntarily disclosed cyber-intelligence:

Public Records Disclosures: Recent cybersecurity legislation has opted to create a broad FOIA exemption, exempting any covered cyber-information that is shared with the federal government from public disclosure. CISPA, for example, states that "[c]yber threat information shared" in line with the requirements of the bill, if shared with the federal government, "shall be exempt from disclosure" under FOIA, whereas CISA exempts from disclosure "[c]yber threat indicators and countermeasures provided to the" federal government under the bill. In other words, the scope of the FOIA exemptions provided under recent proposals necessarily are a product of what sort of information a particular cyber-information sharing bill covers as an initial matter. Intellectual Property Rights Protection: To prevent intellectual property rights—such as trade secrets rights—in any shared cyber-intelligence from being forfeited upon disclosure to the government, several proposals contain specific provisions disclaiming any loss of rights as a result of information sharing. CISPA declares that cyber-threat information shared in accordance with the bill must "be considered proprietary information" and restricts disclosure of such material to outsiders unless allowed by the disclosing entity, potentially providing those that share cyber-intelligence with the ability to preserve any trade secret rights in such information. CISA may have the most explicit provisions respecting preservation of intellectual property rights for shared cyber-intelligence, stating that the "provision of cyber threat indicators and countermeasures" to the government "shall not constitute a waiver of any applicable privilege or protection provided by law, including trade secret protection." Regulatory Enforcement Concerns: To temper fears that cyber-information that is disclosed to the government will be used in later regulatory enforcement actions, two main strategies have been employed in recent cybersecurity legislation. First, several bills have blanket statements that declare that any covered information that is shared with the government will not be used for "regulatory purposes" or a "regulatory enforcement action," terms of art that are left undefined by the bills. Second, the various legislative proposals will affirmatively limit the federal government from utilizing the shared information for any purpose other than (1) a "cybersecurity purpose;" (2) to prevent or mitigate an imminent threat of death or serious bodily harm; (3) to respond, prevent or mitigate a serious threat to a minor; or (4) prevent, investigate, or prosecute certain cybercrimes. Privacy Concerns: In order to assuage more general privacy-based concerns about the implications of the government collecting cyber-information, recent cybersecurity legislation has generally avoided crafting precise rules respecting privacy within the legislation itself in favor of requiring DHS, in conjunction with other federal agencies, to promulgate procedures, policies, and regulations on the federal handling of disclosed information. The guidance the various legislative proposals provide to DHS for the promulgation of privacy rules is general in nature and is centered on the concern that disclosed cyber-intelligence may contain PII. Nonetheless, some proposals do contain specific rules aimed at restricting what types of cyber-information the government can collect and use. CISPA, for example, prevents the government from "us[ing]" particular sensitive documents that contain PII, such as library circulation records or firearm sales records, and prohibits the government from "affirmatively searching" any collected cyber-threat information. CISA affirmatively requires the federal government to protect shared "cyber threat indicators" from unauthorized use or disclosure that may contain PII.

Given the various restrictions imposed or contemplated in recent cybersecurity information sharing proposals, the issue that remains is how to ensure that such restrictions are complied with by the government. The central enforcement mechanism for any affirmative restrictions on the government's use of shared cyber-information is congressional oversight, in that many of the cyber-information sharing bills require federal agencies to submit regular reports to Congress respecting the government's use of shared cyber-intelligence, including compliance with privacy regulations. Nonetheless, there could be other legal mechanisms available to ensure government compliance with a law's restrictions on the use of shared cyber-intelligence. For example, the CTSA contemplates that any privacy rules promulgated under the proposal would provide for "appropriate penalties for" any government officer, employee, or agent that violates a rule regarding the "receipt, retention, or disclosure of a cyber threat indicator." CISPA perhaps has the most aggressive enforcement mechanism with respect to those government entities that violate the proposal's use restrictions, in that the bill includes a provision that would impose liability on the United States for an intentional or willful violation of any of CISPA's restrictions on how the government can utilize any voluntarily shared cyber-intelligence. Nonetheless, no legislative proposals go as far as current law does with respect to CII, criminalizing misconduct with respect to information shared regarding critical infrastructure.

Regardless of the enforceability of a particular restriction on the use of cyber-intelligence by the government, a fundamental question lawmakers may need to contemplate is how restrictions that require close government scrutiny and control over shared cyber-information can be squared with other goals of cyber-information sharing legislation, like requirements that received information be disseminated in an almost instantaneous fashion. Ultimately, because the goals of cyber-information legislation are often diametrically opposed, it may simply be impossible for information sharing legislation to simultaneously promote the rapid and robust collection and dissemination of cyber-intelligence by the federal government, while also ensuring that the government respects the property and privacy interests implicated by such information sharing.

Conclusion

The current legal framework surrounding cyber-information sharing exists at the crossroads of several bodies of law and raises complicated questions respecting how cyber-intelligence can be collected and shared within the private sector and with the public sector. Moreover, as demonstrated by the host of discrepancies and complications raised by various legislative proposals on information sharing, if Congress chooses to alter the current legal framework governing cybersecurity and intelligence sharing, the law will not necessarily be devoid of uncertainty. Instead, new legal questions may arise, likely out of the context of the balance Congress attempts to strike between lowering disincentives for information sharing and ensuring that other interests embodied in privacy, antitrust, tort, or other laws are sufficiently protected under new cybersecurity information sharing legislation. While cybersecurity information sharing is, at most, only one piece of a much larger puzzle regarding how to best protect the United States against potentially debilitating cyberattacks, resolution of the difficult legal questions posed by the regulation of cyber-intelligence sharing may be an important task for the 114 th Congress.