Cybercrime continues to increase. The media reports data breaches exposing tens of millions of personal financial records at retailers, such as Target, Home Depot, and TJ Maxx. The Ponemon Institute, an independent research institute, estimates that in 2013 the number of attacks on 59 companies based in the United States increased over that of 2012 and the average cost per attack also increased. The Ponemon study found the average cost of a cybercrime incident in FY2014 was $12.7 million compared with $11.6 million in FY2013. The Center for Strategic and International Studies estimates that cybercrime costs the global economy about $445 billion in a typical year. The risks to critical infrastructure and national security from cyberattacks are harder to quantify, but the Bipartisan Policy Center recently concluded that the United States has a "September 10 th ability to guard against cyberattacks." President Obama and some Members of Congress have identified increasing cybersecurity as a priority. It would seem that companies could increase their cybersecurity at relatively little cost by sharing information about cyberattacks. The costs of a data breach can include detection, containment, repair, incident response, investigation, fraud losses, and lost sales. The cost of sharing information, including joining a specialized sharing organization, is likely to be less than $100,000. One obstacle to reducing cybercrime is misaligned incentives, which reduce information sharing about cyberattacks. In the aftermath of a cyberattack, at least four groups could be notified: law enforcement, other companies, customers, and (for public companies) stockholders. In addition, certain regulated companies, such as banks and electrical utilities, could be required to notify their regulators of cyberattacks. If companies notify law enforcement—typically either the Federal Bureau of Investigation (FBI) or the Secret Service—they do so in the hope that those responsible will be brought to justice and that some sort of recovery can be made. They notify other companies in the hope that greater information sharing will improve security. Customers are notified so that they can monitor their financial information to prevent financial fraud. The Securities and Exchange Commission (SEC) requires publicly traded companies to announce information that could affect investors' decisions to invest in a company. This report analyzes information sharing by government with private companies, by private companies with the government, and among private companies. Sharing information with consumers is mentioned but is not the central focus of this report. Understanding the economic incentives involved in cybersecurity and information sharing can improve the analysis of cybersecurity. Companies that suffer a cybersecurity breach such as the theft of credit card information do not pay the full cost of the breach. Retailers honoring stolen credit cards have charges reversed (so-called chargebacks) and end up without merchandise or payment. Credit card issuers say that they are not fully compensated for replacing stolen cards. Consumers must monitor their financial accounts and update automated bill payment accounts to guard against cyberattacks. Meanwhile, software companies frequently weigh the benefits of delays to improve security against the costs of late releases. According to some industry observers, software developers can be under pressure to "ship early, ship often" and fix security and other bugs in a later iteration. Similarly, companies may act in ways that they believe will preserve or increase their market share or profitability even at the expense of cybersecurity. Many in the cybersecurity field have suggested increasing cybersecurity information sharing between individuals, companies, nongovernmental organizations, and governments as a way to increase security. Many kinds of information can be shared to improve cybersecurity. This can include sharing ways to detect specific attacks and more general information about hardware, software, and procedures. It can include specific and general information about recovering from a data breach. The cost of sharing is relatively small, but the benefits can be large. Michael Daniel, the White House cybersecurity coordinator, described information sharing as "critical to effective cybersecurity," and legislation was introduced in 112 th and 113 th Congresses to promote information sharing. One kind of information sharing occurs when organizations learn from third parties (such as law enforcement) that information has been compromised. For example, the Secret Service reportedly notified Target and Home Depot that their data systems had been breached. Information sharing can also flow in the other direction: According to media reports, JPMorgan discovered that it had cybersecurity problems and asked the FBI for assistance. Sharing information has benefits. If a firm reports a cyberattack, law enforcement can begin searching for those responsible and possibly alert other organizations, which can review their cybersecurity arrangements to prevent similar attacks. In some cases, broader sharing of information would benefit the attacked firm; if it does not have the resources for defense or other countermeasures, sharing information might allow another entity, such as a security consultant or the software developer, to develop a countermeasure. But sharing cybersecurity information with a competitor can give away security lessons that were learned at great expense. Moreover, some may fear that publicly revealing a cyber breach can scare customers away to competitors leading to reduced revenue and possibly stock price declines. In other words, the hacked company's competitors might benefit from the information or its revenue or stock price might decline. In 47 states and the District of Columbia, Guam, Puerto Rico, and the Virgin Islands, companies can be required to notify consumers if personally identifiable information (PII) is breached. Typically, consumers are notified of the breach, advised to monitor financial accounts closely, and sometimes offered free credit monitoring or other assistance. Some, including the chief information officer of the retailer Urban Outfitters, have argued that public disclosure can tip off attackers or waste time if information is breached but not stolen. Industry participants and outside observers appear to generally agree that there is less than optimal information sharing about attacks. Although the amount of harm caused by inadequate information sharing is hard to measure, and increasing information sharing can be difficult, it has at times increased security. By contrast, while the broad outline of the Target credit card hack had been widely discussed, Home Depot was the victim of a similar attack through a vendor whose security had been compromised. Information sharing would appear to be a relatively inexpensive way for a group of companies to improve their cybersecurity, but a review of recent data breaches shows that most of the details about breaches are released by third party experts, not the firms involved. The next section analyzes some of the reasons for this apparent reticence by firms. Firms and industry groups have expressed reluctance to share information in part because doing so might violate privacy or antitrust laws. Another concern is exposing proprietary business information. To help assuage these fears, the Department of Justice (DOJ) has provided guidance that it will not consider generally accepted cybersecurity information sharing to be anticompetitive behavior. Some cybersecurity experts, industry participants, and several Members of Congress remain concerned that firms are holding back information that could make cyberspace more secure. In theory, sharing information about cybersecurity attacks and defenses has many benefits: Everyone would appear to benefit from eliminating duplication of costs and efforts. Sharing efforts could detect breaches faster and reduce damage caused by breaches. Sharing breach information and joint research efforts could lead to new ways to protect information. In practice, there are also other considerations: Some argue that, despite official pronouncements, there are unresolved legal questions concerning privacy and antitrust issues surrounding sharing cybersecurity information. Some organizations may be reluctant to help competitors and, in extreme cases, might listen to what others share but offer nothing in return (free-riding in economic terms). If the shared information itself is breached by hackers, the organizations could be worse off than if they had not shared the information. Public disclosure of a breach may cost an organization customers and sales and affect its stock price. Although there is some evidence that such fears have been exaggerated, evidence also suggests that they may be the primary factors preventing firms from sharing cybersecurity information. Comparing Target's stock price to those of three competitors—Walmart, Best Buy, and Costco—from the day before Target's data breach was first revealed on December 18, 2013, to three months afterwards, its stock price increased 19%. In the same time period, Costco's stock price increased 9%, while Walmart's declined 3% and Best Buy's declined 22%. The Information Sharing and Analysis Center (ISAC) Council emphasized to the Government Accountability Office (GAO) that "the benefits of sharing information are often difficult to discern, while the risks and costs of sharing are direct and foreseeable." A survey of information technology executives found that their chief worry about data breaches was the loss in consumer confidence and resultant decline in revenue, not the losses directly caused by the breach. To understand why companies may not share cybersecurity information, some theoretical scenarios applying basic game theory are examined. Consider a firm that recognizes a new threat or a new (to it, at least) instance of a known threat, one to which its competitors are also potentially vulnerable. There are several possible outcomes depending on the characteristics of the threat and the firms. If the threat to its profits is small, the firm may or may not choose to develop a countermeasure or share information about the threat, depending on its evaluation of potential reputational benefits for altruistically sharing the information. Some cyberattacks can be viewed as a cost of doing business, much like shoplifting is. If the threat is significant, the firm may try to develop a custom countermeasure (for instance, hiring a security consultant to create a defense involving new procedures, software, or hardware). If the firm is unable to obtain a countermeasure, it may or may not have financial incentives to share information about the threat, depending on the possibility of another organization developing a countermeasure. Even if the firm believes that developing a countermeasure is unlikely or impossible, there might not be sufficient incentives to share the information compared with the advantages of not sharing with competitors.