Legislation to Facilitate Cybersecurity Information Sharing: Economic Analysis
Released: 2015-06-03T00:00:00

Introduction

Cybercrime continues to increase. The media reports data breaches exposing tens of millions of personal financial records at retailers, such as Target, Home Depot, and TJ Maxx. The Ponemon Institute, an independent research institute, estimates that in 2013 the number of attacks on 59 companies based in the United States increased over that of 2012 and the average cost per attack also increased. The Ponemon study found the average cost of a cybercrime incident in FY2014 was $12.7 million compared with $11.6 million in FY2013.

The Center for Strategic and International Studies estimates that cybercrime costs the global economy about $445 billion in a typical year. The risks to critical infrastructure and national security from cyberattacks are harder to quantify, but the Bipartisan Policy Center recently concluded that the United States has a "September 10 th ability to guard against cyberattacks." President Obama and some Members of Congress have identified increasing cybersecurity as a priority.

It would seem that companies could increase their cybersecurity at relatively little cost by sharing information about cyberattacks. The costs of a data breach can include detection, containment, repair, incident response, investigation, fraud losses, and lost sales. The cost of sharing information, including joining a specialized sharing organization, is likely to be less than $100,000.

One obstacle to reducing cybercrime is misaligned incentives, which reduce information sharing about cyberattacks. In the aftermath of a cyberattack, at least four groups could be notified: law enforcement, other companies, customers, and (for public companies) stockholders. In addition, certain regulated companies, such as banks and electrical utilities, could be required to notify their regulators of cyberattacks.

If companies notify law enforcement—typically either the Federal Bureau of Investigation (FBI) or the Secret Service—they do so in the hope that those responsible will be brought to justice and that some sort of recovery can be made. They notify other companies in the hope that greater information sharing will improve security. Customers are notified so that they can monitor their financial information to prevent financial fraud. The Securities and Exchange Commission (SEC) requires publicly traded companies to announce information that could affect investors' decisions to invest in a company.

This report analyzes information sharing by government with private companies, by private companies with the government, and among private companies. Sharing information with consumers is mentioned but is not the central focus of this report.

A Cybersecurity Problem: Misaligned Incentives

Understanding the economic incentives involved in cybersecurity and information sharing can improve the analysis of cybersecurity.

Companies that suffer a cybersecurity breach such as the theft of credit card information do not pay the full cost of the breach. Retailers honoring stolen credit cards have charges reversed (so-called chargebacks) and end up without merchandise or payment. Credit card issuers say that they are not fully compensated for replacing stolen cards. Consumers must monitor their financial accounts and update automated bill payment accounts to guard against cyberattacks.

Meanwhile, software companies frequently weigh the benefits of delays to improve security against the costs of late releases. According to some industry observers, software developers can be under pressure to "ship early, ship often" and fix security and other bugs in a later iteration. Similarly, companies may act in ways that they believe will preserve or increase their market share or profitability even at the expense of cybersecurity.

The Problem of Underused Information

Many in the cybersecurity field have suggested increasing cybersecurity information sharing between individuals, companies, nongovernmental organizations, and governments as a way to increase security.

Many kinds of information can be shared to improve cybersecurity. This can include sharing ways to detect specific attacks and more general information about hardware, software, and procedures. It can include specific and general information about recovering from a data breach. The cost of sharing is relatively small, but the benefits can be large. Michael Daniel, the White House cybersecurity coordinator, described information sharing as "critical to effective cybersecurity," and legislation was introduced in 112 th and 113 th Congresses to promote information sharing.

One kind of information sharing occurs when organizations learn from third parties (such as law enforcement) that information has been compromised. For example, the Secret Service reportedly notified Target and Home Depot that their data systems had been breached.

Information sharing can also flow in the other direction: According to media reports, JPMorgan discovered that it had cybersecurity problems and asked the FBI for assistance.

Sharing information has benefits. If a firm reports a cyberattack, law enforcement can begin searching for those responsible and possibly alert other organizations, which can review their cybersecurity arrangements to prevent similar attacks.

In some cases, broader sharing of information would benefit the attacked firm; if it does not have the resources for defense or other countermeasures, sharing information might allow another entity, such as a security consultant or the software developer, to develop a countermeasure. But sharing cybersecurity information with a competitor can give away security lessons that were learned at great expense. Moreover, some may fear that publicly revealing a cyber breach can scare customers away to competitors leading to reduced revenue and possibly stock price declines. In other words, the hacked company's competitors might benefit from the information or its revenue or stock price might decline.

In 47 states and the District of Columbia, Guam, Puerto Rico, and the Virgin Islands, companies can be required to notify consumers if personally identifiable information (PII) is breached. Typically, consumers are notified of the breach, advised to monitor financial accounts closely, and sometimes offered free credit monitoring or other assistance. Some, including the chief information officer of the retailer Urban Outfitters, have argued that public disclosure can tip off attackers or waste time if information is breached but not stolen.

Industry participants and outside observers appear to generally agree that there is less than optimal information sharing about attacks. Although the amount of harm caused by inadequate information sharing is hard to measure, and increasing information sharing can be difficult, it has at times increased security. By contrast, while the broad outline of the Target credit card hack had been widely discussed, Home Depot was the victim of a similar attack through a vendor whose security had been compromised.

Information sharing would appear to be a relatively inexpensive way for a group of companies to improve their cybersecurity, but a review of recent data breaches shows that most of the details about breaches are released by third party experts, not the firms involved. The next section analyzes some of the reasons for this apparent reticence by firms.

Perceived Legal Barriers to Information Sharing

Firms and industry groups have expressed reluctance to share information in part because doing so might violate privacy or antitrust laws. Another concern is exposing proprietary business information.

To help assuage these fears, the Department of Justice (DOJ) has provided guidance that it will not consider generally accepted cybersecurity information sharing to be anticompetitive behavior. Some cybersecurity experts, industry participants, and several Members of Congress remain concerned that firms are holding back information that could make cyberspace more secure.

Economic Incentives to Not Share Information

In theory, sharing information about cybersecurity attacks and defenses has many benefits:

Everyone would appear to benefit from eliminating duplication of costs and efforts. Sharing efforts could detect breaches faster and reduce damage caused by breaches. Sharing breach information and joint research efforts could lead to new ways to protect information.

In practice, there are also other considerations:

Some argue that, despite official pronouncements, there are unresolved legal questions concerning privacy and antitrust issues surrounding sharing cybersecurity information. Some organizations may be reluctant to help competitors and, in extreme cases, might listen to what others share but offer nothing in return (free-riding in economic terms). If the shared information itself is breached by hackers, the organizations could be worse off than if they had not shared the information. Public disclosure of a breach may cost an organization customers and sales and affect its stock price.

Although there is some evidence that such fears have been exaggerated, evidence also suggests that they may be the primary factors preventing firms from sharing cybersecurity information.

Comparing Target's stock price to those of three competitors—Walmart, Best Buy, and Costco—from the day before Target's data breach was first revealed on December 18, 2013, to three months afterwards, its stock price increased 19%. In the same time period, Costco's stock price increased 9%, while Walmart's declined 3% and Best Buy's declined 22%.

The Information Sharing and Analysis Center (ISAC) Council emphasized to the Government Accountability Office (GAO) that "the benefits of sharing information are often difficult to discern, while the risks and costs of sharing are direct and foreseeable." A survey of information technology executives found that their chief worry about data breaches was the loss in consumer confidence and resultant decline in revenue, not the losses directly caused by the breach.

Analysis of Firms' Incentives to Share

To understand why companies may not share cybersecurity information, some theoretical scenarios applying basic game theory are examined.

New Threats

Consider a firm that recognizes a new threat or a new (to it, at least) instance of a known threat, one to which its competitors are also potentially vulnerable. There are several possible outcomes depending on the characteristics of the threat and the firms.

If the threat to its profits is small, the firm may or may not choose to develop a countermeasure or share information about the threat, depending on its evaluation of potential reputational benefits for altruistically sharing the information. Some cyberattacks can be viewed as a cost of doing business, much like shoplifting is.

If the threat is significant, the firm may try to develop a custom countermeasure (for instance, hiring a security consultant to create a defense involving new procedures, software, or hardware). If the firm is unable to obtain a countermeasure, it may or may not have financial incentives to share information about the threat, depending on the possibility of another organization developing a countermeasure. Even if the firm believes that developing a countermeasure is unlikely or impossible, there might not be sufficient incentives to share the information compared with the advantages of not sharing with competitors.

Industries making similar products and using similar technologies can benefit more from information sharing, but as they are also more likely to be competitive, they may be less likely to share information. Stronger industry associations could arguably counteract this effect.

Developing and Sharing Countermeasures

If the threat is more general, a firm that develops a countermeasure must decide whether it is better off with the competitive advantage that it now has against selling or giving away the countermeasure. Some firms, such as many in the defense industrial base, also sell cybersecurity services and could decide to sell it, while others, such as those in water treatment, might not be in a position to.

So Why Do Some Firms Share Information?

In most of the scenarios above, organizations might decide not to share information lest they diminish their competitive advantage. So why do organizations sometimes choose to share information?

One reason, as discussed above, may be that the threat is small and the firm wants to cultivate a reputation as a good corporate citizen. The legal requirement to maximize shareholder value does not translate into employing any means necessary to increase the stock price. Cybersecurity is arguably integral to national security and economic growth, and people may choose to share information even when it goes against the balance of their near-term economic incentive to foster a more secure nation and a more productive economy.

Role of Consultants and Insurance Companies in Information Sharing

When an organization calls in outside experts to help after a data breach, these consultants use their accumulated knowledge to investigate, document, and remediate the breach. The contract terms are negotiated between the two parties and generally not disclosed to the public. Following general practices, it is likely that the outside experts agree not to disclose proprietary information. Nevertheless, the consultants leave with knowledge about the data breach, and this information can be used in consulting with other companies.

Following existing practices for property and casualty insurance, companies writing cyberinsurance are likely to assess the cybersecurity practices of a (potential) client. Following a data breach claim, a cyberinsurance company would be likely to conduct or monitor a third-party investigation of the breach. Thus, cyberinsurance companies could gather detailed, technical information on breaches and use this knowledge to prevent future breaches at other clients.

How Can Organizations Share Information?

This section analyzes how organizations share information and legislation that was introduced in the 113 th Congress to encourage information sharing.

Categories of Information

Organizations primarily share information about new types of threats, new instances of known threats, and best practices. Information about the effects of an attack can also be shared, even if the method of attack is unknown—for example, by notifying other firms that information has been stolen or that a resource is not operational.

Methods of Information Sharing

Certain types of information can be shared automatically to maximize its value. For instance, when some antivirus software detects malware, it automatically notifies the software vendor, which can analyze the information and update the antivirus software.

Prior to Target's 2013 data breach, which led to the theft of more than 40 million payment card details, Target had recently installed a security system to isolate new malware before it could damage the real system. This software reportedly includes the option to delete malware automatically, but according to a media investigation, "Target's security team turned that function off." The report quoted a chief information security officer of another company who described the choice as normal, because "typically, as a security team, you want to have that last decision point of 'what do I do.'"

Machine autonomy has its issues. Machines generally are not as skilled as individuals in identifying proprietary or PII that should not be shared. Attackers could subvert autonomous information sharing software to further spread their reach or put their attacks on a list of approved programs (a "whitelist"). For effective machine-to-machine sharing to occur, firms need to have high levels of trust with each other and share technical expertise.

Public and Private Sector Information Sharing

Information can be shared within the private sector, within the public sector, and between the two. Government contractors may be subject to more stringent information sharing and disclosure requirements depending on the nature of the work and what department they are working with: the Department of Defense (DOD), for example, requires contractors to report potential exfiltration of classified information. A subset of the private sector, the critical infrastructure industries, operates slightly differently than the rest by relying heavily on Information Sharing and Analysis Centers (ISACs).

ISACs

In 1998, Presidential Decision Directive 63, on critical infrastructure protection, authorized the creation of ISACs and critical infrastructure sector coordinators to assist in their creation.

ISACs are private-sector, nonprofit entities that collect, analyze, and share information on cybersecurity threats and best practices. Some, such as the Defense Industrial Base ISAC and the Oil and Natural Gas ISAC, have mechanisms to share information anonymously between members and with the government. The government also uses ISACs as a tool to communicate with sectors rapidly, particularly in emergency situations. The government also runs some ISAC-like entities, such as the Financial Sector Cyber Intelligence Group.

Sectors outside of critical infrastructure have also created ISACs, such as the Retail ISAC. Additionally, the Food ISAC, though classified as a critical infrastructure sector by the DHS, ceased operating due to a lack of information sharing.

The Multi-State ISAC includes all 50 states, four U.S. territories, the District of Columbia, and many local governments. The electricity sector ISAC, run by the North American Electric Reliability Corporation, counts virtually all registered electricity providers as members.

Although the ISACs are sector specific, the multifaceted nature of modern corporations means that these boundaries are not always clear. For example, because the retailer Target owns a bank, the company became the first retailer to join the Financial Services ISAC (FS-ISAC).

Membership in ISACs is voluntary, and levels of participation in ISACs vary. As shown in Figure 1 and Figure 2 , the FS-ISAC offers membership tiers ranging from free (with limited benefits) to platinum (with full benefits) and costing $49,950 annually.

This has not equalized the participation rates among firms with varying levels of resources. New York State found that 60% of large banking organizations and 25% of small organizations were members of the FS-ISAC. Nonetheless, the FS-ISAC has helped its members combat cybersecurity issues such as denial-of-service attacks.

Although cybersecurity is important to the information technology industry, the IT-ISAC has 33 members. Many large cybersecurity vendors—such as Symantec, FireEye, and DocuSign—are members but many of the biggest companies in IT, including Google, Mozilla, Adobe, Apple, and Facebook, are not. However, IT-ISAC shares information with other organizations, such as the IT Sector Coordinating Council, which has a broader membership to include, through other alliances, companies, such as Google and Facebook.

Generally, ISACs cannot prevent free-riding. If a company joins, there is usually no mechanism preventing it from receiving information even if it does not contribute information of its own. Free-riding has the potential to discourage information sharing. If a sharer consistently contributes without receiving information in return, it may decide that it is helping its competitors more than it is benefitting from sharing.

Mandatory, Voluntary, and Incentivized Sharing

The SEC requires publicly traded companies to disclose "material information," including with regard to cybersecurity risks and cyber incidents. The Supreme Court has ruled that information is material if there is "a substantial likelihood that the disclosure of the omitted fact would have been viewed by the reasonable investor as having significantly altered the 'total mix' of information made available." One open issue is how quickly information must be announced. Cybersecurity breaches can require weeks or months of investigation and remediation. Law enforcement may be concerned that a public announcement will alert those responsible and allow them to take countermeasures.

As discussed above, DOD is reported to require that its contractors share information on potential security breaches.

Some, such as Dan Geer, chief information security officer of In-Q-Tel (a nonprofit venture capital firm that serves the U.S. intelligence community) have called for mandatory sharing of some information. He has noted that multiple sources have estimated that third parties discover 75% of data breaches. Geer bases his proposed model on the systems used by the aviation industry, which voluntarily reports incidents that had a significant chance of causing damage, and the Center for Disease Control, which mandates reporting incidents above a certain threshold of harm. Other experts advocate a strictly voluntary approach, because they believe it could impose fewer regulatory costs on businesses and cost less for taxpayers.

Consequences of Inadequate Information Sharing

Direct Effects on Security

Inadequate cybersecurity information sharing is thought to result in suboptimal security. By not sharing, organizations might duplicate the same work. If the information is shared—with or without cost—the savings could, in theory, be applied to increasing cybersecurity or some other purpose.

Indirect Security Effects through the Market for Cybersecurity Products

Information differences between buyers and sellers of cybersecurity products could lower the size and quality of the market for cybersecurity products. Cybersecurity can be thought of as an example of a "market for lemons," a concept developed by George Akerlof, which he applied to the used car market.

In a "lemon market," buyers cannot accurately assess a product's value before purchasing it, and sellers cannot credibly disclose the product's value because they have incentives to overstate the quality of their products. If the buyer cannot determine whether the product is better or worse than average, the buyer will be unwilling to pay more than the average price of all the products in the market. This means sellers of better than average quality products have difficulty selling their products for what they are worth, so they underinvest in product development, driving down the overall quality and size of the market.

Security products in general are prone to this problem. It is difficult or impossible to know whether a security product is working because it is good or because the attacks have been weak or few in number. The overall effect is that there are fewer products and relatively fewer good products to choose from, and buyers cannot be confident that they are getting a good value. One result could be less cybersecurity investment than would be optimal.

Effects of Greater Information Sharing

Sharing more information could reduce the information asymmetries and increase the size and quality of the market for cybersecurity products and make cyberspace more secure, allowing firms to better estimate the probability and costs of data breaches, for example. Sharing more information could also reduce duplication of effort, making dollars spent on cybersecurity more effective. Clear metrics of effectiveness and objective, trusted, third-party evaluation services do not appear to currently exist in the cybersecurity market.

The advantages of information sharing are likely to be greatest when organizations are using similar technologies. For example, learning about a weakness in an operating system or application software has the most value to an organization using that operating system or application. It might provide a lesson to those using other software, but it is less likely to be directly applicable.

Another concern is that erroneous information could lead to new security holes. The reputation of those providing information can provide assurance that experts have reviewed and passed on the information.

Currently, a main enforcement mechanism for cybersecurity is the Federal Trade Commission's (FTC's) authority to sue companies for deceptive practices—for example, claiming that their products are "secure" when they do not employ common security practices. Thus, a de facto standard exists for what constitutes acceptable cybersecurity, but it is based on a series of actions taken by organizations that do not need to publicize their security practices. Greater information sharing could make it easier for companies to implement uniform security practices.

Greater information sharing may, in some instances, effectively weaken cybersecurity by creating an overwhelming amount of information, eliminating the capacity to pay attention to truly important alerts. ISACs can help to mitigate this problem by analyzing information and sorting out what information is relevant to subsets of their members.

Some have argued that greater information sharing could encourage the growth of the $1.3 billion cyberinsurance market by allowing for more accurate assessment of risk and security products' effectiveness. A more mature cyberinsurance market would itself make cyberspace more secure: Insurers promote practices that make the insured safer, which would decrease insurers' payouts. Insurers verify and inspect the systems they are insuring. However, some analysts believe that cyberinsurance will have limited utility as many of the losses, such as damage to one's reputation, are intangible and difficult to put a value on.

Selected Legislation in the 114th Congress to Encourage Information Sharing

This section provides brief summaries of two bills that have been introduced in the 114 th Congress that might affect the willingness of organizations to share cybersecurity information. The bills contain many other provisions, such as which agency would have the lead in analyzing information shared, but considerations such as these are outside the scope of this report. For more details, see CRS Report R43996, Cybersecurity and Information Sharing: Comparison of H.R. 1560 and H.R. 1731 as Passed by the House , by [author name scrubbed] and CRS Report R43317, Cybersecurity: Legislation, Hearings, and Executive Branch Documents , by [author name scrubbed].

H.R. 1560: Protecting Cyber Networks Act (Title I) and National Cybersecurity Protection Advancement Act (Title II, formerly H.R. 1731)

On April 22, 2015, the House passed H.R. 1560 , Protecting Cyber Networks Act (PCNA), and on April 23, 2015, it passed H.R. 1731 , National Cybersecurity Protection Advancement Act of 2015 (NCPA). Pursuant to H.Res. 212 , the text of H.R. 1731 , as passed by the House, was added as new matter at the end of H.R. 1560 . House-passed H.R. 1560 became Title I of the bill sent to the Senate, and House-passed H.R. 1731 became Title II. This report briefly discusses a possible conflict in the various provisions of H.R. 1560 and H.R. 1731 .

H.R. 1560 would authorize voluntary, two-way sharing of cybersecurity information between the federal government and certain other groups, such as nonfederal entities (i.e., other levels of government, information sharing and analysis centers [ISACs], and information sharing and analysis organizations [ISAOs]). The federal government would not be able to condition sharing on receiving information from nonfederal entities. The federal government would develop ways to share its information without compromising security, privacy, and civil liberties. H.R. 1560 would preempt any federal, tribal, state, or local laws that could be used to require a government to disclose information received under the proposed legislation.

H.R. 1560 contains a provision that would require the Administrator of the Small Business Administration to provide assistance to small businesses and small financial institutions to participate in cybersecurity information sharing.

H.R. 1560 would declare that there be no cause of action against a nonfederal entity for sharing or receiving the specified cybersecurity information, except under certain circumstances, including willful misconduct.

H.R. 1560 would, in general, allow two or more nonfederal entities sharing cybersecurity information as outlined in the bill without violating antitrust laws.

Title I of the bill would amend parts of the National Security Act of 1947, and Title II amends parts of the Homeland Security Act of 2002. There are many differences in the assignment of responsibilities and definitions between the two titles. For example, Title I would give the lead role in collecting and sharing government information with nonfederal entities to the Director of National Intelligence; Title II assigns this lead role to the Department of Homeland Security.

S. 754: Cybersecurity Information Sharing Act of 2015

On March 17, 2015, the Senate Select Committee on Intelligence reported out S. 754 , Cybersecurity Information Sharing Act of 2015 (CISA). On April 15, 2015, Senator Richard Burr filed S.Rept. 114-32 .

S. 754 , like H.R. 1560 , would authorize voluntary, two-way sharing of information between the federal government and nonfederal entities, including ISACs. The legislation would prohibit the federal government from making sending cybersecurity information to it a condition for receiving information from the federal government. The federal government would have to develop ways to share its information without compromising security, privacy, and civil liberties. S. 754 would preempt any federal, tribal, state, or local laws that could be used to require a government to disclose information received under the proposed legislation.

S. 754 , like Title I of H.R. 1560 , would assign the lead responsibility for federal government information sharing to the Director of National Intelligence.

S. 754 states that there would be no cause of action against a nonfederal entity for sharing or receiving the specified cybersecurity information, except under certain circumstances, including gross negligence or willful misconduct.

Under S. 754 , two or more nonfederal entities could, in general, share cybersecurity information without violating antitrust laws.

Analysis

Both H.R. 1560 and S. 754 are designed to encourage information sharing, but they differ in where within the federal government certain responsibilities would fall. Both propose that the federal government share information with nonfederal entities and provide for voluntary sharing of information among nonfederal entities and between nonfederal entities and the federal government. They would protect information shared against disclosure under the Freedom of Information Act (FOIA) and similar tribal, state, and local laws. They would provide some protection against private law suits and would codify current the Federal Trade Commission and the Department of Justice policy that cybersecurity information sharing does not in itself violate antitrust laws. They would limit the use of cybersecurity information to cybersecurity and to specified serious crimes.

This could encourage more cybersecurity information sharing, but some nonfederal entities are likely to be cautious and wait to see how the various provisions are applied. On the one hand, they may wait to see how the federal government shares information with nonfederal entities. On the other hand, the federal government could not limit participation in cybersecurity information sharing programs to those sending such information to the federal government.

Conclusion: How Might Incentives Change?

H.R. 1560 and S. 754 seek to make cyberspace more secure by increasing the amount and impact of information shared while not significantly increasing costs to businesses or taxpayers. Except for codifying current antitrust exemptions for information sharing, the bills do not address the competitive incentives not to share information.

However, both bills could increase the likelihood of informal information sharing networks developing. Although some informal networks might lack the technical capabilities of an ISAC, they can arguably discourage free-riding by cutting "takers" out of the network, which would alter incentives in favor of more information sharing.

Some sharing is already happening. Many cybersecurity companies currently share information with clients. Some of this is being done in real time.

The "bottom line," is likely to be how nonfederal entities—particularly businesses—value the benefits from sharing information against the cost of sharing. Neither bill would address the cost of full membership in ISAOs or ISACs which, at $10,000 to $100,000, are too expensive for small- and medium-size businesses.

Although most data breaches have not been expensive compared with the revenues and profits earned, recent events may change the attitude of boards of directors and senior management: the chief executive officers at Target and Sony Entertainment were forced to resign.