Over the course of the last year, a host of cyberattacks have been perpetrated on a number of high profile American companies. In January 2014, Target announced that hackers, using malware, had digitally impersonated one of the retail giant's contractors, stealing vast amounts of data—including the names, mailing addresses, phone numbers or email addresses for up to 70 million individuals and the credit card information of 40 million shoppers. Cyberattacks in February and March of 2014 potentially exposed contact and log-in information of eBay's customers, prompting the online retailer to ask its more than 200 million users to change their passwords. In September, it was revealed that over the course of five months cyber-criminals tried to steal the credit card information of more than fifty million shoppers of the world's largest home improvement retailer, Home Depot. One month later, J.P. Morgan Chase, the largest U.S. bank by assets, disclosed that contact information for about 76 million households was captured in a cyberattack earlier in the year. In perhaps the most infamous cyberattack of 2014, in late November, Sony Pictures Entertainment suffered a "significant system disruption" as a result of a "brazen cyber attack" that resulted in the leaking of the personal details of thousands of Sony employees. And in February of 2015, the health care provider Anthem Blue Cross Blue Shield disclosed that a "very sophisticated attack" obtained personal information relating to the company's customers and employees. The high profile cyberattacks of 2014 and early 2015 appear to be indicative of a broader trend: the frequency and ferocity of cyberattacks are increasing, posing grave threats to the national interests of the United States. Indeed, the attacks on Target, eBay, Home Depot, J.P. Morgan-Chase, Sony Pictures, and Anthem were only a few of the many publicly disclosed cyberattacks perpetrated in 2014 and 2105. Experts suggest that hundreds of thousands of other entities may have suffered similar incidents during the same period, with one survey indicating that 43% of firms in the United States had experienced a data breach in the past year. Moreover, just as the cyberattacks of 2013—which included incidents involving companies like the New York Times, Facebook, Twitter, Apple, and Microsoft —were eclipsed by those that occurred in 2014, the consensus view is that 2015 and beyond will witness more frequent and more sophisticated cyber incidents. To the extent that its expected rise outpaces any corresponding rise in the ability to defend against such attacks, the result could be troubling news for countless businesses that rely more and more on computers in all aspects of their operations, as the economic losses resulting from a single cyberattack can be extremely costly. And the resulting effects of a cyberattack can have effects beyond a single company's bottom line. As "nations are becoming ever more dependent on information and information technology," the threat posed by any one cyberattack can have "devastating collateral and cascading effects across a wide range of physical, economic and social systems." With reports that foreign nations—such as Russia, China, Iran, and North Korea –may be using cyberspace as a new front to wage war, fears abound that a cyberattack could be used to shut down the nation's electrical grid, hijack a commercial airliner, or even launch a nuclear weapon with a single keystroke. In short, the potential exists that the United States could suffer a "cyber Pearl Harbor," an attack that would "cause physical destruction and loss of life" and expose—in the words of one prominent cybersecurity expert–"vulnerabilities of staggering proportions." Given the growing and potentially grave threat posed by cyberattacks, one of the stated priorities of the President and congressional leadership is to enact laws that ensure that both the public and private sector are prepared to meet the cyber-challenges of the future. While considerable debate exists with regard to the best strategies and methods for protecting America's various cyber-systems, one point of "general agreement" amongst cyber-analysts is the perceived need for enhanced and timely exchange of cyber-threat intelligence both within the private sector and between the private sector and the government. The argument for the real time sharing of cyber-intelligence—which could include the sharing of vulnerability data (the vulnerabilities an intruder might exploit to gain access to a computer system), threat data (the types of malware circulating the Internet and the nature of the threats a given entity has faced), and countermeasure data (the steps an entity has taken to prevent or mitigate the effects of a cyberattack) —is grounded in the idea that effective cybersecurity depends upon robust knowledge about potential threats and wide dissemination of the best practices and strategies to combat such threats. Despite widespread agreement about the need for enhanced cyber-information sharing, there is similar agreement among cyber-experts that current public and private sector information sharing efforts are simply inadequate. While there may be many reasons why entities may opt to not participate in a cyber-information sharing scheme, a primary rationale for such a decision concerns the potential liability that could result from sharing internal cyber-threat information with other private companies or the government. Indeed, in a recent survey of over 700 information technology security practitioners, half of the respondents listed worries about "potential liability [from] sharing" as the main reason for not participating in an initiative for exchanging threat information. More broadly, the legal issues surrounding cybersecurity information sharing—whether it be with regard to sharing between two private companies or the dissemination of cyber-intelligence within the federal government—are complex and have few certain resolutions. In this vein, this report analyzes the major legal issues regarding cyber-threat information sharing by beginning with a discussion of the current legal authorities respecting the exchange of cyber-intelligence. Included in this discussion will be an examination of the various sources of liability that could result from information sharing. The report concludes by discussing several of the major legislative proposals aimed at reforming federal cyber-information sharing laws and potential legal issues that such laws could prompt. While often the concept of "cyber-information sharing" is thought of as a monolith, the sharing of cyber-intelligence touches on three related, but distinct concepts. First, cyber-information sharing is often used in the context of describing efforts to promote the dissemination of cyber-intelligence from the federal government to other government entities or the private sector. This sort of cyber information sharing would occur, for example, when the Federal Bureau of Investigation (FBI) provides the Department of Homeland Security (DHS) or privately owned banks with the IP addresses of computers known to have launched distributed denial of service (DDoS) attacks against other entities within the financial sector. Second, cyber-threat information sharing also embraces the concept of private entities sharing cyber-intelligence with each other, such as when several companies in a particular sector establish a formal exchange or formal agreements to share relevant cyber-information with each other. Finally, cyber-information sharing also describes when private entities share cyber-threat information in their possession with the government. Such information sharing could occur, for example, when private security firms report to DHS details about potential cyber-vulnerabilities unearthed in research. While collectively these three variants on the concept of cyber-information sharing have some commonalities, each also raises separate legal challenges that may impede cyber-intelligence dissemination more generally. Perhaps the area in which there is the most legal clarity with respect to cyber-information sharing pertains to the authority of the federal government –and its subcomponents—to disseminate cyber threat information within the government and with the private sector. Two central components of DHS lead efforts to distribute cyber-intelligence to others in the government and the private sector. First, the Office of Intelligence and Analysis (I&A), an entity established under Section 201 of the Homeland Security Act of 2002 (Homeland Security Act or the Act), is generally authorized to "access and receive" information and intelligence from "agencies of the Federal Government, State and local government agencies (including law enforcement agencies), and private sector entities" in order to "identify and assess" "terrorist threats to the homeland" and "actual and potential vulnerabilities to the homeland." In addition, the I&A is responsible for "integrat[ing] relevant information, analysis, and vulnerability assessments" and disseminating such information in "both classified and unclassified formats, as appropriate" to "other agencies of the Federal Government, State, and local government agencies and authorities, the private sector, and other entities." In turn, pursuant to 6 U.S.C. Section 143, DHS, through I&A, is required to provide to state and localities "analysis and warnings related to threats to, and vulnerabilities of," "critical information systems," a term of art presumably controlled by the Homeland Security Act's definition for the term "critical infrastructure": [S]ystems ... so vital to the United States that the incapacity or destruction of such systems ... would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters. Moreover, DHS is authorized "upon request" to provide the same "analysis and warnings" to "private entities that own or operate critical information systems." In practice, the I&A has primarily exercised its authority by focusing its efforts on analyses of cyber-threat information and the distribution of those analyses to various public and private entities. In addition to the I&A, DHS's National Protection and Programs Directorate (NPPD) and its subcomponents play perhaps an even more important role with respect to the sharing of cyber-threat information with other government and private entities. Within the NPPD exists the Office of Cybersecurity and Communications (CS&C), an office Congress created in 2006 that is tasked with overseeing the "security, resiliency, and reliability of the nation's cyber and communications infrastructure."