Cybersecurity and Information Sharing: Legal Challenges and Solutions

Congressional research reportMar 16, 2015

Ask Donna

What actually matters in this document.

Text

Cybersecurity and Information Sharing:

Legal Challenges and Solutions

-name redactedLegislative Attorney

March 16, 2015

Congressional Research Service

7-....

www.crs.gov

R43941

Cybersecurity and Information Sharing: Legal Challenges and Solutions

Summary

Over the course of the last year, a host of cyberattacks has been perpetrated on a number of high

profile American companies. The high profile cyberattacks of 2014 and early 2015 appear to be

indicative of a broader trend: the frequency and ferocity of cyberattacks are increasing, posing

grave threats to the national interests of the United States. While considerable debate exists with

regard to the best strategies for protecting America’s various cyber-systems and promoting

cybersecurity, one point of general agreement amongst cyber-analysts is the perceived need for

enhanced and timely exchange of cyber-threat intelligence both within the private sector and

between the private sector and the government. Nonetheless, there are many reasons why entities

may opt to not participate in a cyber-information sharing scheme, including the potential liability

that could result from sharing internal cyber-threat information with other private companies or

the government. More broadly, the legal issues surrounding cybersecurity information sharing—

whether it be with regard to sharing between two private companies or the dissemination of

cyber-intelligence within the federal government—are complex and have few certain resolutions.

In this vein, this report examines the various legal issues that arise with respect to the sharing of

cybersecurity intelligence, with a special focus on two distinct concepts: (1) sharing of cyberinformation within the government’s possession and (2) sharing of cyber-information within the

possession of the private sector.

With regard to cyber-intelligence that is possessed by the federal government, the legal landscape

is relatively clear: ample legal authority exists for the Department of Homeland Security (DHS)

to serve as the central repository and distributor of cyber-intelligence for the federal government.

Nonetheless, the legal authorities that do exist often overlap, perhaps resulting in confusion as to

which of the multiple sub-agencies within DHS or even outside of DHS should be leading efforts

on the distribution of cyber-information within the government and with the public. Moreover,

while the government has wide authority to disclose cyber-intelligence within its possession, that

authority is not limitless and is necessarily tied to laws that restrict the government’s ability to

release sensitive information within its possession.

With regard to cyber-intelligence that is possessed by the private sector, legal issues are clouded

with uncertainty. A private entity that wishes to share cyber-intelligence with another company, an

information sharing organization like an Information Sharing and Analysis Organization (ISAO)

or an Information Sharing and Analysis Centers (ISAC), or the federal government may be

exposed to civil or even criminal liability from a variety of different federal and state laws.

Moreover, because of the uncertainty that pervades the interplay between laws of general

applicability—like federal antitrust or privacy law—and their specific application to cyberintelligence sharing, it may be very difficult for any private entity to accurately assess potential

liability that could arise by participating in a sharing scheme. In addition, concerns may arise with

regard to how the government collects and maintains privately held cyber-intelligence, including

fears that the information disclosed to the government could (1) be released through a public

records request; (2) result in the forfeit of certain intellectual property rights; (3) be used against a

private entity in a subsequent regulatory action; or (4) risk the privacy rights of individuals whose

information may be encompassed in disclosed cyber-intelligence.

The report concludes by examining the major legislative proposal—including the Cyber

Intelligence Sharing and Protection Act (CISPA), Cybersecurity Information Sharing Act (CISA),

and the Cyber Threat Sharing Act (CTSA)—and the potential legal issues that such laws could

prompt.

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

Contents

Introduction...................................................................................................................................... 1

Conceptualizing the Legal Issues Regarding Cyber Information Sharing ....................................... 5

Sharing Cyber-Information in the Possession of the Government .................................................. 6

Sharing Cyber-Information in the Possession of Private Entities .................................................. 12

Sharing Cyber-Information with Another Private Entity......................................................... 13

Privacy Laws ..................................................................................................................... 13

Antitrust Laws ................................................................................................................... 26

Tort Law ............................................................................................................................ 29

Other Sources of Liability ................................................................................................. 32

Sharing Cyber -Information with the Government.................................................................. 33

Freedom of Information Act Disclosures .......................................................................... 34

Intellectual Property Concerns .......................................................................................... 36

Regulatory Enforcement Concerns ................................................................................... 37

Privacy Concerns............................................................................................................... 39

Legislative Options for Cyber-Information Sharing ...................................................................... 43

Creating a Broader Legal Framework for the Sharing of Cyber-Information ......................... 43

Clarifying Which Government Agency Leads the Efforts on Cyber-Information

Sharing ................................................................................................................................. 46

Increasing the Amount and Quality of Government Cyber-Information Disclosed to

the Private Sector.................................................................................................................. 47

Minimizing Liability Related to Distributing Privately Held Cyber-Intelligence ................... 48

“Tailored” Approach to Minimizing Liability ................................................................... 49

“Broad” Approach to Minimizing Liability ...................................................................... 50

Increasing the Participation of Private Sector Cyber-Information Sharing ............................. 52

Preventing Government Misuse of Acquired Cyber-Intelligence............................................ 55

Conclusion ..................................................................................................................................... 59

Contacts

Author Contact Information........................................................................................................... 59

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

Introduction

Over the course of the last year, a host of cyberattacks1 have been perpetrated on a number of

high profile American companies. In January 2014, Target announced that hackers, using

malware,2 had digitally impersonated one of the retail giant’s contractors,3 stealing vast amounts

of data—including the names, mailing addresses, phone numbers or email addresses for up to 70

million individuals and the credit card information of 40 million shoppers.4 Cyberattacks in

February and March of 2014 potentially exposed contact and log-in information of eBay’s

customers, prompting the online retailer to ask its more than 200 million users to change their

passwords.5 In September, it was revealed that over the course of five months cyber-criminals

tried to steal the credit card information of more than fifty million shoppers of the world’s largest

home improvement retailer, Home Depot.6 One month later, J.P. Morgan Chase, the largest U.S.

bank by assets, disclosed that contact information for about 76 million households was captured

in a cyberattack earlier in the year.7 In perhaps the most infamous cyberattack of 2014, in late

November, Sony Pictures Entertainment suffered a “significant system disruption” as a result of a

“brazen cyber attack”8 that resulted in the leaking of the personal details of thousands of Sony

employees.9 And in February of 2015, the health care provider Anthem Blue Cross Blue Shield

For purposes of this report, the term “cyberattack” refers to a deliberate infiltration of a computer system or network

with the intent to either extract or destroy confidential information or to destroy the functioning of the system or

network. See Jay P. Kesan and Carol M. Hayes, Mitigative Counterstriking: Self-Defense and Deterrence in

Cyberspace, 25 HARV. J.L. & TECH. 429, 439-446 (2012). It should be noted however the exact contours of what the

term “cyberattack” entails is subject to much debate. See id. at 439 (“The modern lexicon considers all types of online

intrusions to be cyberattacks, even though many commentators would assert that such indiscriminate use of the term

‘cyberattack’ is incorrect.”); see also William A. Owens, Kenneth W. Dam, and Herbert S. Lin, et al., Overview,

Findings, and Recommendations, in TECHNOLOGY, POLICY, LAW, AND ETHICS REGARDING U.S. ACQUISITION AND USE

OF CYBERATTACK CAPABILITIES 10-11(2009) (distinguishing between the terms “cyberattack” and “cyber

exploitation”); Oona A. Hathaway et al., The Law of Cyber-Attack, 100 CALIF. L. REV. 817, 823 (2012). (“The absence

of a shared definition has made it difficult for analysts from different countries to develop coordinated policy

recommendations and for governments to engage in coordinated actions.”)

Malware is the diminutive for malicious software and can come in a wide variety of forms. See generally Rick

Lehtinen, Deborah Russell, and G.T. Gangemi Sr., COMPUTER SECURITY BASICS 80 (2d ed. 2006); see also Matthew J.

Skelrov, Solving the Dilemma of State Responses to Cyberattacks: A Justification for the Use of Active Defenses

Against States Who Neglect Their Duty to Prevent, 201 ML. L. REV. 1, 15 n.78. (2009).

See Dan Goodin, Epic Target hack reportedly began with malware-based phishing email, ARS TECHNICA, (February

12, 2014), http://arstechnica.com/security/2014/02/epic-target-hack-reportedly-began-with-malware-based-phishing-email/.

See Press Release, Target Provides Update on Data Breach and Financial Performance, (January 10, 2014),

available at http://pressroom.target.com/news/target-provides-update-on-data-breach-and-financial-performance.

See Press Release, eBay Inc. To Ask eBay Users To Change Passwords, (May 21, 2014), available at

http://www.ebayinc.com/in_the_news/story/ebay-inc-ask-ebay-users-change-passwords.

See Press Release, The Home Depot Completes Malware Elimination and Enhanced Encryption of Payment Data in

All U.S. Stores, (September 18, 2014), available at http://www.prnewswire.com/news-releases/the-home-depotcompletes-malware-elimination-and-enhanced-encryption-of-payment-data-in-all-us-stores-275649511.html.

See Emily Glazer and Daniel Yadron, J.P. Morgan Says About 76 Million Households Affected By Cyber Breach,

WALL STREET JOURNAL (October 2, 2014), available at http://www.wsj.com/articles/j-p-morgan-says-about-76-millionhouseholds-affected-by-cyber-breach-1412283372.

See Press Release, Message for current and former Sony Pictures employees and dependents, and for production

employees, (December 15, 2014), available at http://www.sonypictures.net/SPE_Cyber_Notification.pdf?.

See Amelia Smith, Sony Cyber Attack One of Worst in Corporate History, NEWSWEEK, (December 4, 2014), available

at http://www.newsweek.com/sony-cyber-attack-worst-corporate-history-thousands-files-are-leaked-289230.

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

disclosed that a “very sophisticated attack” obtained personal information relating to the

company’s customers and employees.10

The high profile cyberattacks of 2014 and early 2015 appear to be indicative of a broader trend:

the frequency and ferocity of cyberattacks are increasing,11 posing grave threats to the national

interests of the United States. Indeed, the attacks on Target, eBay, Home Depot, J.P. MorganChase, Sony Pictures, and Anthem were only a few of the many publicly disclosed cyberattacks

perpetrated in 2014 and 2105.12 Experts suggest that hundreds of thousands of other entities may

have suffered similar incidents during the same period,13 with one survey indicating that 43% of

firms in the United States had experienced a data breach in the past year.14 Moreover, just as the

cyberattacks of 2013—which included incidents involving companies like the New York Times,

Facebook, Twitter, Apple, and Microsoft15—were eclipsed by those that occurred in 2014,16 the

consensus view is that 2015 and beyond will witness more frequent and more sophisticated cyber

incidents.17 To the extent that its expected rise outpaces any corresponding rise in the ability to

defend against such attacks, the result could be troubling news for countless businesses that rely

more and more on computers in all aspects of their operations, as the economic losses resulting

from a single cyberattack can be extremely costly.18 And the resulting effects of a cyberattack can

have effects beyond a single company’s bottom line. As “nations are becoming ever more

dependent on information and information technology,”19 the threat posed by any one cyberattack

See Press Release, Statement regarding cyberattack against Anthem, (February 11, 2015), available at

https://www.anthem.com/health-insurance/about-us/pressreleasedetails/WI/2015/1813/statement-regarding-cyberattack-against-anthem.

See generally Managing cyber risks in an interconnected world, PRICEWATERHOUSECOOPERS, 5, (September 30,

2014) available at http://www.pwc.com/gx/en/consulting-services/information-security-survey/index.jhtml (noting that

in a survey of 9,700 security, IT, and business executives in 154 countries, cybersecurity incidents have risen 66%

since 2009).

See 2014: A Year of Mega Breaches, PONEMON INSTITUTE, 1, (January 2015) available at http://www.ponemon.org/

local/upload/file/2014%20The%20Year%20of%20the%20Mega%20Breach%20FINAL3.pdf (hereinafter “Ponemon

Institute- 2014”) (noting breaches at CHS community Health Systems, Michaels Stores, Nieman Marcus, and Staples).

See PRICEWATERHOUSE COOPERS, supra note 11, at 7 (estimating that globally 117,339 attacks occur each day).

See Is Your Company Ready for a Big Data Breach?, PONEMON INSTITUTE, 1, (September 2014), available at

http://www.experian.com/assets/data-breach/brochures/2014-ponemon-2nd-annual-preparedness.pdf (hereinafter

“Ponemon Institute- Big Data Breach”). This study, of course, only accounts for cyberattacks are actually discovered

by a given business. One cybersecurity expert estimates that 85% of cyberattacks go unnoticed for two or more weeks.

See Joshua R. McCloud, Cisco’s Internal Approach to Cyber Security, (February 2013), available at

http://www.cisco.com/web/AP/asiapac/academy/Archive/News_Feb.shtml.

Chenda Ngak, Are Facebook, Twitter, Apple, New York Times, NBC hacks a sign of things to come?, CBS NEWS,

February 22, 2013, http://www.cbsnews.com/8301-205_162-57570805/are-facebook-twitter-apple-new-york-timesnbc-hacks-a-sign-of-things-to-come/.

See Sharone Tobias, 2014: The Year in Cyberattacks, NEWSWEEK (December 31, 2014), available at

http://www.newsweek.com/2014-year-cyber-attacks-295876.

See Lee Raine, Janna Anderson, and Jennifer Connolly, Cyber Attacks Likely to Increase, PEW RESEARCH CENTER, 67 (October 29, 2014), available at http://www.pewinternet.org/files/2014/10/

PI_FutureofCyberattacks_102914_pdf.pdf/ (reporting that from a canvass of “thousands of experts and Internet

builders,” 61% predicted that by 2025 “a major cyber attack [will] cause[] widespread harm to a nation’s security and

capacity to defend itself and its people”); see also Threats Report, MCAFEE LABS, 6-14, (November 2014), available at

http://www.mcafee.com/us/resources/reports/rp-quarterly-threat-q3-2014.pdf (concluding that cyber threats will

increase in the year 2015); see also Arjun Khrarpal, Think 2014 was bad for hacking? Worse is to come, CNBC

(January 15, 2015), available at http://www.cnbc.com/id/102362835# (quoting Cisco CEO John Chambers).

See PRICEWATERHOUSE COOPERS, supra note 11, at 10 (noting that the “annual estimated reported average financial

loss attributed to cybersecurity incidents was $2.7 million, a jump of 34% over 2013”).

See Owens, supra note 1, at 9.

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

can have “devastating collateral and cascading effects across a wide range of physical, economic

and social systems.”20 With reports that foreign nations—such as Russia, China, Iran, and North

Korea –may be using cyberspace as a new front to wage war,21 fears abound that a cyberattack

could be used to shut down the nation’s electrical grid,22 hijack a commercial airliner,23 or even

launch a nuclear weapon with a single keystroke.24 In short, the potential exists that the United

States could suffer a “cyber Pearl Harbor,” an attack that would “cause physical destruction and

loss of life”25 and expose—in the words of one prominent cybersecurity expert–“vulnerabilities of

staggering proportions.”26

Given the growing and potentially grave threat posed by cyberattacks, one of the stated priorities

of the President and congressional leadership is to enact laws that ensure that both the public and

private sector are prepared to meet the cyber-challenges of the future.27 While considerable debate

exists with regard to the best strategies and methods for protecting America’s various cybersystems,28 one point of “general agreement” amongst cyber-analysts is the perceived need for

enhanced and timely exchange of cyber-threat intelligence29 both within the private sector and

See Securing America’s Future: The Cyber Security Act of 2012: Hearing on S. 2105 Before the S. Comm. on

Homeland Sec. and Gov’t Affairs, 112th Cong. (2012) (statement of Michael Chertoff, former Sec’y of the Dep’t of

Homeland Sec.), available at http://www.hsgac.senate.gov/download/cybersecurity-support-statement-former-dhssecretary-michael-chertoff.

See Joel Brenner, How Obama Fell Short on Cyber Security, POLITICO MAGAZINE (January 21, 2015), available at

http://www.politico.com/magazine/story/2015/01/state-of-the-union-cybersecurity-obama114411.html#.VMlUeXtq3VY (noting the sources for various cyberattacks).

See Michael Hayden, Curt Hebert, and Susan Tierney, Cybersecurity and the North American Electric Grid: New

Policy Approaches to Address an Evolving Threat, BIPARTISAN POLICY CENTER, (February 28, 2014), available at

http://bipartisanpolicy.org/library/cybersecurity-electric-grid/ (“Cyber threats to North America’s electric grid are

growing, making electric grid cybersecurity an increasingly important national and international issue.”).

See Pierluigi Paganini, Cyber Threats against the Aviation Industry, INFOSEC INSTITUTE, (April 8, 2014), available at

http://resources.infosecinstitute.com/cyber-threats-aviation-industry/. (“Security is fundamental for the aviation

industry. Considering the availability of numerous tools on the market that could be exploited in a hypothetical attack

against a plane, cyber security is becoming even more crucial.”)

See Jason Koebler, U.S Nukes Face Up to 10 Million Cyber Attacks Daily, U.S. NEWS & WORLD REPORT, (March 20,

2014) (“The computer systems of the agency in charge of America’s nuclear weapons stockpile are “under constant

attack” and face millions of hacking attempts daily”).

See Leon E. Panetta, Sec’y, U.S. Dep’t of Def., Remarks on Cybersecurity to the Business Executives for National

Security, (October 11, 2012), available at http://www.defense.gov/transcripts/transcript.aspx?transcriptid=5136.

See Joel Brenner, AMERICA THE VULNERABLE 24 (2011). While there appears to be general agreement about United

States’ vulnerabilities to a cyberattack, see Nathan Sales, Regulating Cyber-Security, 107 NW. U. L. REV. 1503, 1505

(2013) (“There are some naysayers but the consensus that we stand on the brink of cyber-calamity is both broad

deep.”), this viewpoint is not unanimous. See, e.g., Jerry Brito and Tate Watkins, Loving the Cyber Bomb? The

Dangers of Threat Inflation in Cybersecurity Policy¸ 3 HARV. NAT. SEC. J. 39 (2011); Vida M. Antolin-Jenkins,

Defining the Parameters of Cyberwar Operations: Looking for Law in All the Wrong Places?, 51 NAVAL L. REV. 132,

144-45 (2005).

See, e.g., Steven Dennis, Obama Pushes for Deals on Cybersecurity, Trade, Taxes, ROLL CALL (January 13, 2015),

available at http://blogs.rollcall.com/white-house/obama-meeting-with-top-congressional-leaders-without-harry-reid/?

pos=adpb (“Obama says he’s spoken to Speaker John A. Boehner, R-Ohio, and Senate Majority Leader Mitch

McConnell, R-Ky., on cybersecurity and ‘I think we agreed that this is an area where we can work hard together, get

some legislation done and make sure that we are much more effective in protecting the American people from these

kinds of cyberattacks’”).

See generally Henry Farrell, The political science of cybersecurity I—why people fight so hard over cybersecurity,

WASHINGTON POST (January 13, 2014), available at http://www.washingtonpost.com/blogs/monkey-cage/wp/2014/01/

23/the-political-science-of-cybersecurity-i-why-people-fight-so-hard-over-cybersecurity/.

Throughout this report, use of terms “cyber-intelligence,” “cyber-information,” “cyber-threat information,” and

“cybersecurity information” are used to holistically capture the entire range of possible information that could help

(continued...)

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

between the private sector and the government.30 The argument for the real time sharing of cyberintelligence—which could include the sharing of vulnerability data (the vulnerabilities an intruder

might exploit to gain access to a computer system), threat data (the types of malware circulating

the Internet and the nature of the threats a given entity has faced), and countermeasure data (the

steps an entity has taken to prevent or mitigate the effects of a cyberattack)31—is grounded in the

idea that effective cybersecurity depends upon robust knowledge about potential threats and wide

dissemination of the best practices and strategies to combat such threats.32

Despite widespread agreement about the need for enhanced cyber-information sharing, there is

similar agreement among cyber-experts that current public and private sector information sharing

efforts are simply inadequate.33 While there may be many reasons why entities may opt to not

(...continued)

deter or mitigate a cyber-attack, including vulnerability, threat, and countermeasure data. See infra note 31 and

accompanying text.

See Bipartisan Policy Center, Cyber Security Task Force: Public-Private Information Sharing, July 2012, at p. 5,

available at http://bipartisanpolicy.org/wp-content/uploads/sites/default/files/PublicPrivate%20Information%20Sharing.pdf. This is not to say that there is agreement as to the particulars of how

information sharing should be facilitated, such as the need for privacy and civil liberty protections for information

shared amongst private and public entities. See, e.g., Erin Kelly, Obama, Congress may find cybersecurity consensus,

USA TODAY (January 25, 2015), available at http://www.usatoday.com/story/news/politics/2015/01/25/cybersecurityinformation-sharing-bill/22229049/ (“That doesn't mean that there are no conflicts between the White House and

Congress on the issue. House Republican leaders are still angry that the president threatened to veto an informationsharing bill they passed in the last Congress. Obama said the bill did not do enough to protect the privacy of

Americans’ personal data in the information-sharing process.”).

See Sales, supra note 26, at 1546. Threat data may consist of “signatures,” patterns of network traffic deployed to

detect and mitigate malicious cyber-activity, which in turn are comprised of cyber threat “indicators”—a combination

of data such as IP addresses, domain names, email headers, files, and internal strings that identify the malicious

activity. See Jeremy J. Broggi, Building on Executive Order 13,636 to Encourage Information Sharing for

Cybersecurity Purposes, 37 HARV. J.L. & PUB. POL’Y 653, 657 (2014); see generally Lehtinen, supra note 1, at 80.

See Sales, supra note 26, at 1546; see also Bipartisan Policy Center, supra note 30, at 7 (“With more robust

information sharing, there can be greater situational awareness about the health of the nation’s information technology

architecture. A real-time understanding of threats and vulnerabilities is necessary for government officials and industry

leaders to make decisions about tactical protective and response measures.”); Kimberly Peretti, Cyber Threat

Intelligence: To Share or Not to Share—What Are the Real Concerns?, 13 PVLR 1476 (2014) (“[T]he receipt of

critical threat data can and has been shown to prevent potential cyberattacks and mitigate ongoing attacks.”); Denise E.

Zheng and James A. Lewis, Cyber Threat Information Sharing: Recommendations for Congress and the

Administration, CTR. FOR STRATEGIC AND INT’L STUDIES 1 (March 2015), available online https://csis.org/files/

publication/150310_cyberthreatinfosharing.pdf (“Cyber threat information sharing.... is a critical step toward

improving cyber defenses.”). For arguments against the value of cyber-information sharing, see Paul Rosenzweig, The

Administration’s Cyber Proposals—Information Sharing, LAWFARE, (January 16, 2015), available at

http://www.lawfareblog.com/2015/01/the-administrations-cyber-proposals-information-sharing/ (“Given all the strum

and drang, the worst part about all of this is that it seems to me to be portending a big debate over something that won’t

matter that much. Most of the analysts I know are in pretty wide agreement that the most significant types of threats

come from sophisticated actors who are creating and deploying novel cyber threats. For those sorts of new threats, no

amount of information sharing is useful.”).

See Gregory T. Nojeim, Cybersecurity and Freedom on the Internet, 4 NAT’L SECURITY L. & POL’Y 119, 126 (2010)

(“Although laws authorize such sharing of information, actual practice has been inadequate.”) (hereinafter “NojeimCybersecurity”); see also Peretti, supra note 32, at 4 (“While an increasing number of companies are recognizing the

benefits of sharing information regarding cyber threats, many remain wary.... ”); Exchanging Cyber Threat

Intelligence: There Has to Be a Better Way, PONEMON INSTITUTE, (April 2014), available at

http://content.internetidentity.com/acton/attachment/8504/f-001b/1/-/-/-/-/Ponemon%20Study.pdf (hereinafter

“Ponemon Institute—Threat Intelligence”) (“71 percent of respondents say there has to be a better way to exchange

threat information than what exists today.”).

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

participate in a cyber-information sharing scheme,34 a primary rationale for such a decision

concerns the potential liability that could result from sharing internal cyber-threat information

with other private companies or the government. Indeed, in a recent survey of over 700

information technology security practitioners, half of the respondents listed worries about

“potential liability [from] sharing” as the main reason for not participating in an initiative for

exchanging threat information.35 More broadly, the legal issues surrounding cybersecurity

information sharing—whether it be with regard to sharing between two private companies or the

dissemination of cyber-intelligence within the federal government—are complex and have few

certain resolutions. In this vein, this report analyzes the major legal issues regarding cyber-threat

information sharing by beginning with a discussion of the current legal authorities respecting the

exchange of cyber-intelligence. Included in this discussion will be an examination of the various

sources of liability that could result from information sharing. The report concludes by discussing

several of the major legislative proposals aimed at reforming federal cyber-information sharing

laws and potential legal issues that such laws could prompt.

Conceptualizing the Legal Issues Regarding Cyber

Information Sharing

While often the concept of “cyber-information sharing” is thought of as a monolith, the sharing of

cyber-intelligence touches on three related, but distinct concepts. First, cyber-information sharing

is often used in the context of describing efforts to promote the dissemination of cyberintelligence from the federal government to other government entities or the private sector. This

sort of cyber information sharing would occur, for example, when the Federal Bureau of

Investigation (FBI) provides the Department of Homeland Security (DHS) or privately owned

banks with the IP addresses of computers known to have launched distributed denial of service

(DDoS) attacks against other entities within the financial sector.36 Second, cyber-threat

information sharing also embraces the concept of private entities sharing cyber-intelligence with

each other, such as when several companies in a particular sector establish a formal exchange or

Among these concerns include worries about compromising proprietary information, a desire to not aid competitors,

losing customer goodwill, and reputational harms that may occur if an entity discloses details about a prior cyberattack.

See Sales, supra note 26, at 1549; see also Derek E. Bambauer, Ghost in the Network, 162 U. PA. L. REV. 1011, 1046

(2014) (“Firms have significant incentives not to disclose breaches or attacks. Revealing lapses could have reputationrelated market effects. Publicly traded companies ... suffer drops in share price immediately after revealing security

breaches. Disclosing vulnerability information risks further dissemination (even if inadvertent) that could lead to

additional attacks ... firms may not want to aid competitors either by reducing their information security costs or by

protecting them from the same attack.”).

See Ponemon Institute—Threat Intelligence, supra note 33, at 3.

See, e.g., Cybersecurity: Enhancing Coordination to Protect the Financial Sector, Hearing Before Senate Committee

on Banking, Housing, and Urban Affairs, 113th Cong. (2013) (statement of Joseph M. Demarest, Assistant Director,

Cyber Division, Federal Bureau of Investigation, available at http://www.fbi.gov/news/testimony/cyber-securityenhancing-coordination-to-protect-the-financial-sector (“The FBI worked closely with Department of Homeland

Security (DHS) to issue Joint Indicator Bulletins (JIBs) to the U.S. banks, which included thousands of IP addresses

that participated in the attacks. The U.S. banks used the IP addresses to better mitigate future incidents, thus helping to

ensure their business operations could proceed with less interruption of service to their customers.”); see generally

Sales, supra note 26, at 1547 (“[T]he government’s highly resourceful intelligence agencies are simply better than the

private sector at detecting intrusions by sophisticated adversaries like foreign militaries and developing

countermeasures. The government can provide these firms with the signatures of malware used in previous attacks, and

firms can use the signature files to detect future intrusions.”).

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

formal agreements to share relevant cyber-information with each other.37 Finally, cyberinformation sharing also describes when private entities share cyber-threat information in their

possession with the government. Such information sharing could occur, for example, when

private security firms report to DHS details about potential cyber-vulnerabilities unearthed in

research.38 While collectively these three variants on the concept of cyber-information sharing

have some commonalities, each also raises separate legal challenges that may impede cyberintelligence dissemination more generally.

Sharing Cyber-Information in the Possession of the

Government

Perhaps the area in which there is the most legal clarity with respect to cyber-information sharing

pertains to the authority of the federal government –and its subcomponents—to disseminate cyber

threat information within the government and with the private sector. Two central components of

DHS lead efforts to distribute cyber-intelligence to others in the government39 and the private

sector.40

First, the Office of Intelligence and Analysis (I&A), an entity established under Section 201 of

the Homeland Security Act of 2002 (Homeland Security Act or the Act),41 is generally authorized

to “access and receive” information and intelligence from “agencies of the Federal Government,

State and local government agencies (including law enforcement agencies), and private sector

entities”42 in order to “identify and assess” “terrorist threats to the homeland” and “actual and

potential vulnerabilities to the homeland.”43 In addition, the I&A is responsible for “integrat[ing]

relevant information, analysis, and vulnerability assessments” and disseminating such

information in “both classified and unclassified formats, as appropriate” to “other agencies of the

See, e.g., About Us: Information Sharing and Analysis Centers (ISACs), NATIONAL COUNCIL OF ISACS, (no date

provided), available at http://www.isaccouncil.org/aboutus.html.

See, e.g., Rachael King, Cyber Attackers Target Building Management Systems, WALL STREET JOURNAL, (April 5,

2013), available at http://blogs.wsj.com/cio/2013/04/05/cyber-attackers-target-building-management-systems/.

The White House recently announced the creation of the Cyber Threat Intelligence Integration Center (CTIIC), an

agency housed within the Office of the Director of National Intelligence (DNI) and will be modelled off of the National

Counterterroism Center (NCTC) to share cyber-intelligence across various entities within the federal government. See

The White House, Presidential Memorandum—Establishment of the Cyber Threat Intelligence Integration Center,

(February 25, 2015), http://www.whitehouse.gov/the-press-office/2015/02/25/presidential-memorandumestablishment-cyber-threat-intelligence-integrat.

See Stakeholder Priorities for the Quadrennial Homeland Security Review Hearing Before the Subcomm. on

Oversight and Managment Efficiency of the H. Comm. on Homeland Security, 113th Cong. (2014) (statement of Frank

J. Cilluffo, Director Homeland Security Policy Institute and Cybersecurity Initiative The George Washington

University) (“Currently responsibility for cyber analysis is split between the DHS Office of Intelligence and Analysis

(I&A), and the National Protection and Programs Directorate.”).

See P.L. 107-296, Title II, Subtitle A, §201, codified at 6 U.S.C. §121(a). Under the Homeland Security Act of 2002,

the term “terrorism” encompasses an act that is (1) “dangerous to human life or potentially destructive of critical

infrastructure or key resources;” (2) a violation of federal or state or local criminal law; and (3) appears to be intended

to either (a) intimidate or coerce a civilian population, (b) influence the policy of a government by intimidation or

coercion, or (c) affect the conduct of a government by mass destruction, assassination, or kidnapping. See 6 U.S.C.

§101(16).

6 U.S.C. §121(d)(1).

Id. §121(d)(1)(A)-(C).

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

Federal Government, State, and local government agencies and authorities, the private sector, and

other entities.”44 In turn, pursuant to 6 U.S.C. Section 143, DHS, through I&A, is required to

provide to state and localities “analysis and warnings related to threats to, and vulnerabilities of,”

“critical information systems,”45 a term of art presumably46 controlled by the Homeland Security

Act’s definition for the term “critical infrastructure”:

[S]ystems ... so vital to the United States that the incapacity or destruction of such systems ...

would have a debilitating impact on security, national economic security, national public

health or safety, or any combination of those matters.47

Moreover, DHS is authorized “upon request” to provide the same “analysis and warnings” to

“private entities that own or operate critical information systems.”48 In practice, the I&A has

primarily exercised its authority by focusing its efforts on analyses of cyber-threat information

and the distribution of those analyses to various public and private entities.49

In addition to the I&A, DHS’s National Protection and Programs Directorate (NPPD) and its

subcomponents play perhaps an even more important role with respect to the sharing of cyberthreat information with other government and private entities.50 Within the NPPD exists the

Office of Cybersecurity and Communications (CS&C), an office Congress created in 200651 that

is tasked with overseeing the “security, resiliency, and reliability of the nation’s cyber and

communications infrastructure.”52 To execute this mission, CS&C, supports “24x7 information

sharing, analysis, and incident response” through the National Cybersecurity and Communication

Integration Center (NCCIC or Center).53 Established in 2009, the NCCIC is a “24-hour, DHS-led

6 U.S.C. §121(d)(3), (8), (13), (21).

Id. §143(1)(A).

See Perales v. Sullivan, 948 F.2d 1348, 1355 (2d Cir. 1991) (“Similar language in two different sections of the same

law should be given a similar interpretation.”) (citing Northcross v. Board of Education, 412 U.S. 427, 428 (1973) (per

curiam))

See id. §101(4) (citing 42 U.S.C. §5195c(e)) (defining “critical infrastructure,” which includes both critical assets

and systems).

See id. §143(1)(A).

See Office of Intelligence and Analysis’ Vision and Goals, Hearing Before the H. Comm. on Homeland Security,

111th Cong. (2010) (statement of Under Secretary and Chief Intelligence Officer Caryn Wagner), available at

http://www.dhs.gov/news/2010/05/12/testimony-under-secretary-and-chief-intelligence-officer-caryn-wagner-andprincipal (“ I&A also possesses a cyber intelligence analytic program. This team provides a national intelligence

analytical framework in support of key cybersecurity customers, such as the DHS National Cybersecurity and

Communications Integration Center (NCCIC), the DHS United States Computer Emergency Readiness Team (USCERT), and the Industrial Control Systems CERT. We are working with partners in the community to collaborate on

strategic cyber analysis, and we continue to determine the amount of analytic support necessary to the Department’s

cybersecurity mission.”).

See About the National Protection and Programs Directorate, Dep’t of Homeland Security, (July 9, 2014), available

at http://www.dhs.gov/about-national-protection-and-programs-directorate.

See Dep’t of Homeland Sec. Appropriations Act, 2007, P.L. 109-295, Title VI, Subtitle A, §611(13), 120 Stat. 1409,

codified at 6 U.S.C. §321c.

See About the National Protection and Programs Directorate, Dep’t of Homeland Security, (July 9, 2014), available

at http://www.dhs.gov/about-national-protection-and-programs-directorate (describing the “mission” of CS&C).

See Facilitating Cyber Threat Information Sharing and Partnering with the Private Sector to Protect Critical

Infrastructure: An Assessment of DHS Capabilities, Hearing Before Subcomm. on Cybersecurity, Infrastructure

Protection and Security Technologies H. Comm. on Homeland Security, 113th Cong. (2013) (statement of NPPD Office

of CS&C Acting Assistant Secretary Roberta Stempfley and NCCIC Director Larry Zelvin) (hereinafter “Stempfley

and Zelvin”).

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

coordinated watch and warning center” monitoring “threats and incidents affecting the nation’s

critical information technology and cyber infrastructure.”54 NCCIC, through the United States

Computer Emergency Readiness Team (US-CERT), helps operate “key aspects” of several

information sharing programs, including the Cyber Information Sharing and Collaboration

Program (CISCP) and Enhanced Cybersecurity Services (ECS).55 CISCP allows for often

unclassified56 “cyber threat, incident, and vulnerability information” to be disclosed “in near realtime” with private information sharing organizations and select owners and operators of so-called

critical infrastructure and key resources.57 ECS entails a “voluntary information sharing program”

that, in part, “shares sensitive and classified government ... cyber threat information” with certain

private actors.58

In late 2014, Congress enacted the National Cybersecurity Protection Act of 2014 (NCPA), which

formally codified NCCIC’s authority, allowing the “Center to carry out certain responsibilities of

See Press Release, Secretary Napolitano Opens New National Cybersecurity and Communications Integration

Center, (October 30, 2009), available at http://www.dhs.gov/news/2009/10/30/new-national-cybersecurity-centeropened.

See Stempfley and Zelvin, supra note 53.

See Jason Miller, DHS finds classified cyber sharing program slow to take off, FEDERAL NEWS RADIO, (June 13,

2013), available at http://www.federalnewsradio.com/473/3356694/DHS-finds-classified-cyber-sharing-program-slowto-take-off (distinguishing between ECS and CISCP based on the types of information shared with the private sector);

see also Robert Gyenes, A Voluntary Cybersecurity Framework Is Unworkable—Government Must Crack the Whip, 14

PGH. J. Tech. L. & Pol’y 293, 305-06 (2014) (noting that CISCP, because of its focus on sharing unclassified

information, has a higher participation rate than ECS). President Obama’s 2013 Executive Order on cybersecurity

expanded efforts to disclose unclassified cybersecurity information, requiring the “timely production of unclassified

reports of cyber threats to the U.S. homeland that identify a specific targeted entity.” See Improving Critical

Infrastructure Cybersecurity, Exec. Order No. 13,636, §4(a), 78 Federal Register 11,739, 11,740-41 (February 12,

2013).

See Dep’t of Homeland Sec., Critical Infrastructure and Key Resources Cyber Information Sharing and

Collaboration Program 1, (no date provided), available at https://www.us-cert.gov/sites/default/files/c3vp/

CISCP_20140523.pdf. According to DHS, to join CISCP and gain access to NCCIC’s cyber intelligence, a private

entity must sign a Cooperative Research and Development Agreement (CRADA) with the agency. Id. Pursuant to the

Stevenson-Wydler Technology Innovation Act of 1980, agencies are authorized to enter into CRDAs with private

parties “under which the Government ... provides personnel, services, facilities, equipment, intellectual property, or

other resources with or without reimbursement ... and the non-Federal parties provide funds, personnel, services,

facilities, equipment, intellectual property, or other resources toward the conduct of specified research or development

efforts which are consistent with the mission [of the agency].” See 15 U.S.C. §3710a(d)(1).

See Dep’t of Homeland Sec., Enhanced Cybersecurity Services 1, available at http://www.dhs.gov/sites/default/files/

publications/ECS-Fact-Sheet.pdf (emphasis added). The private entities that participate in ECS and receive government

furnished threat indicators are either Commercial Service Providers (CSP) or Operational Implementers (OIs) who have

been vetted by the government and entered into a Memorandum of Understanding with DHS. See id. at 2. CSPs, such

as AT&T, provide information services to private entities, while an OI is a private entity who provides information

services for its own network. See Defense Cyber Crime Center, DIB Enhanced Cybersecurity Services (DECS),

(February 26, 2013), available at http://www.dc3.mil/data/uploads/dcise-pdf-dib-enhanced-cybersecurity-servicesprocedures_updated-feb-26-2013.pdf (describing the Department of Defense’s precursor to ECS). Regardless, either a

OI or CSP must be capable of implementing government furnished information, comply with applicable security

requirements, and have appropriately cleared personnel and facilities in order to participate in ECS. Id. ECS was

expanded pursuant to President Obama’s 2013 Executive Order on cybersecurity. See Improving Critical Infrastructure

Cybersecurity, Exec. Order No. 13,636, §4(c), 78 Federal Register 11,739, 11,740-41 (February 12, 2013) (“To assist

the owners and operators of critical infrastructure in protecting their systems from unauthorized access, exploitation, or

harm, the Secretary ... in collaboration with the Secretary of Defense, shall, within 120 days of the date of this order,

establish procedures to expand the [ECS] program to all critical infrastructure sectors.”) For more on the origins of

ECS and the President’s Executive Order, see CRS Report R42984, The 2013 Cybersecurity Executive Order:

Overview and Considerations for Congress, by (name redacted) et al., at pp. 10-11.

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

the Under Secretary” for the NPPD.59 Specifically, the NCPA confirmed that the NCCIC’s

functions include serving as an “interface” for the “real-time” “sharing of information related to

cybersecurity risks, incidents, analysis, and warnings between Federal and non-Federal

entities.”60 Furthermore, the NCPA directs the Center to provide a number of additional services,

such as technical assistance, risk management support, and incident response capabilities to both

public and private entities.61 The NCPA requires NCCIC to include representatives of federal

agencies, state and local governments, and private sector owners and operators of critical

information systems,62 while still providing the Under Secretary for the NPPD with discretion

with respect to the precise makeup of the Center.63 In February of 2015, in keeping with NCCIC’s

statutory role, President Obama, in an Executive Order, mandated that the Center “engage in

continuous, collaborative, and inclusive coordination with” Information Sharing and Analysis

Organizations (ISAOs),64 a formal or informal entity or collaboration created or employed by

public or private sector organizations that gather, analyze, and disseminate cyber-threat

information.65

The Homeland Security Act, as amended by the NCPA, provides significant authority for DHS to

disseminate a wide range of cyber-threat intelligence within the possession of the federal

government to other government agencies and to the private sector. Earlier iterations of the

Homeland Security Act seemingly cabined DHS’s authority to collect and share cyberintelligence only to the extent such information respected a “terrorist threat”66 or would pertain to

“critical information systems.”67 In contrast, the NCPA provides NCCIC the authority to share

cyber-information to the extent that such information relates to “cybersecurity risks,”68 a term of

art that encompasses any “threats” and “vulnerabilities” to information systems and “any related

consequences caused by or resulting” from a host of actions that could compromise an

information system or the information stored on an information system.69 In other words, given

P.L. 113-282, 128 Stat. 3066.

6 U.S.C. §148(c)(1). The Center is composed of various federal entities, such as sector-specific agencies, law

enforcement agencies, and members of the intelligence community, and non-federal entities, such as state and local

governments, information sharing and analysis organizations, and owners and operators of critical information systems.

Id. §148(d).

Id. §148(c).

Id. §148(d)(1)(A)-(B).

Id. §148(d)(1)(E).

See Executive Order, Promoting Private Sector Cybersecurity Information Sharing, THE WHITE HOUSE, (February

13, 2015), §2(c), available at http://www.whitehouse.gov/the-press-office/2015/02/13/executive-order-promotingprivate-sector-cybersecurity-information-shari.

6 U.S.C. §131(5).

See, e.g., P.L. 107-296, Title II, Subtitle A, §201(d)(1) (“[T]he responsibilities of the Under Secretary for

Information Analysis and Infrastructure Protection shall be ... to access, receive, and analyze law enforcement

information, intelligence information, and other information from agencies of the Federal Government, State and local

government agencies ... and private sector entities, and to integrate such information in order to ... identify and assess

the nature and scope of terrorist threats to the homeland ... ”).

Id. §223 (“In carrying out the responsibilities under section 201, the Under Secretary for Information Analysis and

Infrastructure Protection shall ... as appropriate, provide to State and local government entities, and upon request to

private entities that own or operate critical information systems ... analysis and warnings related to threats to, and

vulnerabilities of, critical information systems.”).

See 6 U.S.C. §148(c).

Id.§148(a)(1) (defining “cybersecurity risk” to mean “threats to and vulnerabilities of information or information

systems and any related consequences caused by or resulting from unauthorized access, use, disclosure, degradation,

disruption, modification, or destruction of information or information systems, including such related consequences

(continued...)

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

DHS’s discretion in designating various entities to participate in the NCCIC,70 it appears DHS has

fairly broad authority to disseminate federal cyber threat information throughout the private

sector, regardless of whether the information pertains to an industry that is “so vital to the United

States that the incapacity or destruction” of that industry’s assets or information systems would be

“debilitating” to the country.71 In fact, one issue that has been raised by commentators is whether

the statutory authority allotted to the various entities within DHS—such as I&A and NPPD—to

engage in cyber-information sharing is so broad and ill-defined that confusion could result

internally within the Department as to who the central actor should be with respect to the sharing

of federal cyber-intelligence.72 The same argument could plausibly be made with respect to the

authority to disseminate cyber-intelligence amongst the various entities of the federal

government, as entities like the I&A73 and NPPD74 within DHS and new entities outside of DHS,

like the newly formed Cyber Threat Intelligence Integration Center (CTICC)75 appear to possess

overlapping legal authorities with respect to the internal sharing of cyber-information within the

federal government.76

(...continued)

caused by an act of terrorism”); see also id. §148(a)(4) (citing 44 U.S.C. §3502(8) (defining “information system” to

mean “a discrete set of information resources organized for the collection, processing, maintenance, use, sharing,

dissemination, or disposition of information”).

6 U.S.C. §148(d)(1)(E).

See 42 U.S.C. §5195c(e) (defining “critical infrastructure,” which includes both critical assets and systems).

See, e.g., Sean Lyngaas, Can DHS get it together?, FEDERAL COMPUTER WEEK, (October 31, 2014), available at

http://fcw.com/articles/2014/10/31/cybersecurity-can-dhs-get-it-together.aspx (noting difficulty integrating threat

analyses done by I&A with the work of NPPD); see generally, Paul Rosenzweig, Cyber Security: A Complex ‘Web’ of

Problems, HERITAGE Foundation, (August 26, 2010), available at http://www.heritage.org/research/reports/2010/08/

cyber-security-a-complex-web-of-problems#_ftnref2 (“Today, as it pertains to cyber security, America still needs

clearer lines of authority within the federal government and a more coherent structure of public–private interaction to

allow for effective action.”) (hereinafter “Rosenzweig-Heritage”); Robert Kenneth Palmer, Critical Infrastructure:

Legislative Factors for Preventing a “Cyber Pearl Harbor,” 18 VA. J.L. & TECH. 289, 329 (2014) (“There are too

many government agencies with different cyber-missions working independently, with project duplication to the point

that it is not uncommon for several different groups to be working on the same thing, unaware of each other’s

efforts.”); but see Cybersecurity, Terrorism, and Beyond: Addressing Evolving Threats to the Homeland, Hearing

Before S. Comm. on Homeland Security and Gov’t Affairs, 113th Cong (2014) (testimony of Under Secretary Francis

Taylor and NPPD Under Secretary Suzanne Spaulding), available at http://www.dhs.gov/news/2014/09/10/writtentestimony-ia-and-nppd-senate-committee-homeland-security-and-governmental (“I&A and NPPD work closely

together every day to recognize and reduce risks posed by cyber threats.”). In this vein, some have lamented the fact

that the disperse authorities respecting cyber-intelligence sharing have resulted in key entities, like US-CERT, lacking

any specific authority to request cooperation from other agencies within DHS or the rest of the government on cyberintelligence efforts. See Examining the Cyber Threat to Critical Infrastructure and the American Economy: Hearing

before the H. Comm. of Homeland Security, Subcomm. on Cybersecurity, Infrastructure Protection, and Security

Technologies, 112th Cong. 50 (2011) (testimony of Mischel Kwon, President, Mischel Kwon & Associates, LLC),

available at http://www.gpo.gov/fdsys/pkg/CHRG-112hhrg72221/pdf/CHRG-112hhrg72221.pdf (“US–CERT does not

have the authority to require the departments or agencies to share detailed information, or follow any specific

instructions”); see also Palmer, supra note 72, at 327 (“A significant part of the US-CERT’s mission is to ‘coordinate

and collaborate’ with critical infrastructure owners and operators, but this is rarely accomplished because the USCERT

is buried within the DHS and has no authority to compel sector-specific federal agencies or law enforcement to

coordinate and cooperate with the US-CERT’s activities.”).

See 6 U.S.C. §121(d)(3)-(4).

See id.§148(c)(2).

See supra note 39.

See, e.g., Richard Bejtlich, What are the prospects for the Cyber Threat Intelligence Integration Center?, BROOKINGS

INSTITUTION, (February 19, 2015), available at http://www.brookings.edu/blogs/techtank/posts/2015/02/19-cybersecurity-center-bejlich (“Some may view CTIIC as just the latest in a long line of cyber agencies created by the

government ... The concern with CTIIC, however, is the perception that it duplicates the mission of NCCIC and older

(continued...)

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

Nonetheless, DHS’s ability to share federal cyber-intelligence is not limitless. First, cyber-threat

information the government provides to the private sector generally must occur on a voluntary

basis.77 The plain language of Section 223 of the Homeland Security Act limits DHS’s ability to

share cyber-intelligence with “private entities that own or operate critical information systems,”

such that information sharing can only occur “upon [those entities’] request.”78 And indeed, the

NCPA contains an even more explicit provision disclaiming the Act from being “construed to

require any private entity” to request any assistance from the Secretary of DHS.79 In other words,

under current law, DHS generally does not have the authority to “mandate private sector

participation” in federal cyber information sharing efforts,80 leading some to question the value of

the current voluntary information sharing scheme.81

Second, other laws outside of the context of cybersecurity may limit the ability of the government

to disseminate cyber-threat information. The Homeland Security Act itself requires DHS to

ensure that any intelligence in its possession “is protected from unauthorized disclosure and

handled and used only for the performance of official duties.”82 More specifically, the Act

mandates that DHS adhere to (1) the requirements of the National Security Act of 1947 to the

extent any information pertains to intelligence sources and methods and (2) any authorities of the

Attorney General “concerning sensitive law enforcement information.”83 In other words, to the

extent any federal cyber-intelligence contains sensitive information, such as the sources or

methods that are the heart of an ongoing cybercrime investigation,84 the government may be

limited in its ability to disclose such information.

Beyond laws aimed at limiting disclosures that may inhibit core governmental functions, laws

aimed at preserving privacy and civil liberties may also restrict DHS’s ability to share certain

cyber-information. The Homeland Security Act requires DHS to “ensure ... that any information

databases and analytical tools developed and utilized by the Department”—which would

presumably include programs like CISCP and ECS—“treat information in such databases in a

manner that complies with applicable Federal law on privacy.”85 Moreover, the NCPA requires

(...continued)

units.”).

The federal government is authorized to provide, without request, “analysis and warnings related to threats to, and

vulnerabilities of, critical information systems” to state and local government entities. See 6 U.S.C. §143(1). Moreover,

the Homeland Security Act authorizes DHS to make general recommendations and disseminate information analyzed

by the Department as “appropriate” or “necessary.” See id. §121(d)(6)-(8).

See id. §143(1).

See P.L. 113-282, §8, 128 Stat. 3072.

See Broggi, supra note 31, at 658 (“On the contrary, the phrase ‘upon request’ suggests any such mandate is

forbidden.”).

See Palmer, supra note 72, at 358 (“Even after two decades, voluntary information sharing has failed to create an

effective information sharing environment.... ”).

6 U.S.C. §121(d)(11)(A); see also 6 U.S.C. §141(2) (authorizing the Secretary of DHS to “establish procedures on

the use of information shared under this title that ... ensure the security and confidentiality of such information.... ”).

Id. §121(d)(11)(B). For more information on the laws governing the protection of classified information, see CRS

Report RS21900, The Protection of Classified Information: The Legal Framework, by (name redacted).

See Gus P. Coldebella and Brian M. White, Foundational Questions Regarding the Federal Role in Cybersecurity, 4

J. NAT’L SEC. L. & POL’Y 233, 240-41 (2010) (“While the government has information about malicious code and the

behavior of criminal networks gained through its intelligence and law enforcement functions, fears of botching

investigations or compromising sources and methods make sharing with the private sector (or even with other

government agencies) difficult.”).

See 6 U.S.C. §121(d)(14)(b); see also 6 U.S.C. §141(3) (authorizing the Secretary of DHS to “establish procedures

(continued...)

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

that the NCCIC “comply with all policies, regulations, and laws that protect the privacy and civil

liberties of United States persons.”86 As such, if DHS’s cyber intelligence included, for example,

individually identifiable information—like a name or a social security number—laws like the

Privacy Act of 1974 may restrict the manner in which the government may disclose such

information in a cyber-information sharing program.87

Collectively, the legal effect of the various federal disclosure and privacy laws may limit the

efficacy of any cyber-information DHS provides private entities. As one commentator recently

noted, the resulting “sanitation” of cyber-intelligence has a dual effect.88 First, the host of federal

agencies that “own classified or law enforcement information germane to a particular warning”

“must be coordinated with as part of the review process,” resulting in significant delays before

DHS can release any information to a private entity, by which time the information may be

irrelevant.89 Second, even if DHS releases government cyber threat information in a timely

manner, the cyber intelligence resulting after agency review of the underlying material may omit

critical information that is “actually useful to industry.”90

Sharing Cyber-Information in the Possession of

Private Entities

Whereas the law governing the dissemination of cyber-threat information in the possession of the

federal government is relatively straightforward, the legal landscape surrounding the sharing of

cyber-intelligence that is in the possession of private parties stands in stark contrast. Indeed, there

is an array of legal concerns—some more theoretical than actual—that shroud the law governing

the sharing of privately-held cyber-threat information in a cloud of uncertainty and create

disincentives against the sharing of such information by private parties.91 The legal issues can be

(...continued)

on the use of information shared under this title that ... protect the constitutional and statutory rights of any individuals

who are subjects of such information.... ”).

See 6 U.S.C. §148(e)(3).

See 5 U.S.C. §552a(b) (generally prohibiting an agency from disclosing “any record which is contained in a system

of records by any means of communication to any person, or to another agency.... ”). Pursuant to the Privacy Act and

the Homeland Security Act, DHS has promulgated Fair Information Practice Principles (FIPPs), which generally

amount to framework for how the Department uses and disseminates information containing personal identifying

information. See Hugo Teufel III, DHS Privacy Policy Guidance, DEP’T OF HOMELAND SEC., (December 29, 2008),

available at http://www.dhs.gov/xlibrary/assets/privacy/privacy_policyguide_2008-01.pdf. However, it should be noted

that the Privacy Act does contains exemptions for some inter-agency data sharing for national security and law

enforcement purposes, as well as routine uses described by the agency in the Federal Register. See 5 U.S.C.

§§552a(a)(8)(B)(vi), (b)(3), (b)(7), (e)(4)(D), & (j). There are numerous other more narrowly applicable laws on

privacy and data protection that protect specific types of information in the possession of the government that could

implicate the sharing of federal cyber-intelligence. See, e.g., 42 U.S.C. §1320(d) & 45 C.F.R. §§160, 164 (Health

Insurance Portability and Accountability Act of 1996); 18 U.S.C. §1905 (Trade Secrets Act).

See Palmer, supra note 72, at 326.

Id.

Id. at 327.

See Peretti, supra note 32, at 4 (noting concerns with current legal incentives governing private cyber-information

sharing); see also Palmer, supra note 72, at 317-18 (“Although many of these limitations may be less limiting than they

are perceived to be, the result of these perceptions and, at the very least, the uncertainty about the state of the law as

they pertain to information sharing, have created collective inaction where individual companies often simply feel safer

(continued...)

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

divided between those that arise when private companies share cyber-information with each other

and those that occur when private companies share cyber-intelligence with the government.

Sharing Cyber-Information with Another Private Entity

Information security professionals within the private sector have “long relied” on information

from other private entities to “gain insight into cybersecurity threats and vulnerabilities.”92 And

often the most valuable cyber-intelligence comes from peers in other companies, including direct

competitors that may be subject to similar cybercrimes.93 Private cyber-information sharing can

take many forms, from informal arrangements, such as peer discussions via phone, email, or in

person, to formal sharing arrangements, such as cyber-intelligence sharing through an

Information Sharing and Analysis Center (ISAC), a private sector nonprofit corporation formed to

facilitate the sharing of information on cyber-threats, incidents and vulnerabilities among

members within a particular sector.94 At times, the federal government has been quite supportive

of such private efforts to share cyber-intelligence. Indeed, the impetus for ISACs was Presidential

Decision Directive-63, issued by President Clinton in 1998, which initially called for the creation

of industry-specific ISACs.95 Nonetheless, there are several bodies of law whose basic norms run

counter to the concept of a private business sharing cyber-threat information with an industry

peer, raising potential liability issues for those in the private sector that wish to exchange cyberintelligence.96 Without any overarching federal law governing private exchanges of cyber-threat

information, the potential remains for various laws facially unrelated to cyber-information sharing

to discourage such activity within the private sector.

Privacy Laws

A variety of state and federal privacy laws govern the collection, storage, use, and dissemination

of electronic information, potentially leaving limited room for cyber-intelligence sharing amongst

private actors or between private actors and the government.

The most pertinent federal privacy law is the Electronic Communications Privacy Act of 1986

(ECPA), which contains three titles: (1) Title I, the Wiretap Act,97 which regulates the interception

of communications content in transit; (2) Title II, the Stored Wire and Electronic Communications

and Transactional Records Access Act98 (Stored Communications Act or SCA), which governs

electronic communications already transmitted and currently in storage; and (3) Title III, the Pen

(...continued)

by keeping threat information to themselves rather than sharing it for mutual benefit.”); CRS Report R43821,

Legislation to Facilitate Cybersecurity Information Sharing: Economic Analysis, by (name redacted).

See Peretti, supra note 32, at 2.

See Ponemon Institute—Threat Intelligence, supra note 33, at 5 (noting that 58% of a survey’s respondents rely on

“peers in other companies” as their main source of threat intelligence).

See Peretti, supra note 32, at 2.

See Memorandum from President William Clinton on Critical Infrastructure Protection (Presidential Decision

Directive/NSC-63) (May 22, 1998), available at http://www.fas.org/irp/offdocs/pdd/pdd-63.htm.

See Peretti, supra note 32, at 4.

18 U.S.C. §§2510-2522.

Id. §§2701-2711.

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

noncontent communications, such as phone numbers or IP addresses. Each section of ECPA is

potentially relevant to those private entities considering sharing cyber-intelligence information.

The Wiretap Act

The Wiretap Act generally provides for criminal100 and civil damages101 against anyone who

“intentionally intercepts, endeavors to intercept, or procures any other person to intercept or

endeavor to intercept” any covered communication,102 which includes electronic

communication.103 To “intercept” an electronic communication is to use “any electronic,

mechanical, or other device” to acquire the “contents” or the “substance, purport, or meaning” of

the communication,104 contemporaneously with the transmission.105 Relatedly, the statute also

generally prohibits a “person or entity providing electronic communication service to the public”

from intentionally divulging the contents of any electronic communication while in transmission

other than to the “addressee or intended recipient of such communication.”106 Perhaps most

relevant to cyber-information sharing, the Wiretap Act also prohibits the disclosure or use of the

contents of any electronic communication that was obtained in violation of the statute, such an

illegal interception of electronic communications.107

Putting to the side the several exceptions contained in the Wiretap Act, on its face, ECPA’s

general prohibition on the interception of electronic communications would appear to encompass

any strategy for detecting cyber-threats that involved scanning the contents of an electronic

communication while in transmission,108 and ECPA’s general prohibition on an electronic service

Id. §§3121-3127.

The Wiretap Act imposes significant criminal penalties on those who violate its terms, with a minimum of a ten

thousand dollar fine per violation and up to five years of imprisonment. See id. §§2511, 2520.

101

Id. §2520(a).

102

Id. §2511(1)(a). Put another way, to show a violation of Title I of ECPA, five elements must be shown: the person

or entity (1) intentionally (2) intercepted, endeavored to intercept or procured another person to intercept or endeavor to

intercept (3) the contents of (4) an electronic communication (5) using a device. See In re Phramatrak Privacy Litig.,

329 F.3d 9, 18 (1st Cir. 2003).

103

An electronic communication includes any “transfer of signs, signals, writing, images, sounds, data, or intelligence

of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic or photoptical system.”

See 18 U.S.C. §2510(12).

104

18 U.S.C. §2510(4) & (8). The statute also generally prohibits conduct related to or taken as a consequence of an

illegal interception of covered communication, such as the use of a device to intercept a covered communication, the

disclosure of illegally intercepted communications, or the use of illegally intercepted communications. See 18 U.S.C.

§2511 (b)-(e).

105

See Fraser v. Nationwide Mut. Ins. Co., 352 F.3d 107, 114 (3d Cir. 2003); Steve Jackson Games, Inc. v. U.S. Secret

Serv., 36 F.3d 457, 462 (5th Cir. 1994); Konop v. Hawaiian Airlines, Inc., 302 F.3d 868, 878 (9th Cir. 2002); United

States v. Steiger, 318 F.3d 1039, 1048-49 (11th Cir. 2003); but see United States v. Councilman 418 F.3d 67, 80 (1st

Cir. 2005) (en banc) (suggesting that ECPA may not require “contemporaneity or real-time” transmission of electronic

communications).

106

See 18 U.S.C. §2511(3)(a).

107

See id. §2511(1)(c)-(d).

108

See generally Noel v. Hall, 568 F.3d 743, 749 (9th Cir. 2009) (holding that an interception of a covered

communication “occurs ‘when the contents of a ... communication are captured or redirected in any way.’”) (quoting

United States v. Rodriguez, 968 F.2d 130, 136 (2d Cir. 1992)); see, e.g. Campbell v. Facebook, Inc.,—F.Supp.3d—-,

2014 WL 7336475, at *3 (N.D.Cal. December 23, 2014) (holding the use of a software application to scan the content

of private messages for marketing purposes amounts to “redirection” of the contents of the users’ messages); In re

(continued...)

100

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

provider divulging the contents of any communication while in transmission may bar the real

time transmission of certain cyber-intelligence.109 While cyber-intelligence may often not include

the contents of an electronic communication and may merely contain, for example, the IP address

of the origin of malware, as one commentator has suggested, many common cyber-threat

detection methods require using the contents of electronic communications—such as text within

the body of an email—to determine whether a particular communication is malicious.110

Moreover, to be effective, cyber-information sharing often necessitates the use of real time

sharing of cyber-threat information.111 Nonetheless, the Wiretap Act contains two key exceptions

to its general prohibition that may limit the scope of the law as it pertains to cyber-information

collection and sharing.112

First, the Wiretap Act includes an exception to its general prohibitions when there is the presence

of consent to the otherwise illicit interception or disclosure (“consent exception”).113 A private

actor can only rely on the consent exception where one of the parties to the communication has

given prior consent to the interception or divulgence.114 Courts reviewing the question of whether

a party to the communication consented to an interception or disclosure will look into the

(...continued)

Yahoo Mail Litig., 7 F. Supp. 3d 1016, 1027 (N.D. Cal. 2014) (holding that accessing the content of emails in transit

constitutes an interception for purposes of ECPA).

109

See generally Shubert v. Metrophone, Inc., 898 F.2d 401, 405 (3d Cir. 1990) (holding that §2511(3)(a) “prohibits a

communication service provider from intentionally divulging the contents of a communication while in the

transmission of that service.”).

110

See Broggi, supra note 31, at 661-62 (“[S]ignatures are comprised of indicators, and ... indicators may include text

strings. If these strings are located in the body or subject line of an email, courts will consider them contents.”).

111

See, e.g., Palmer, supra note 72, at 368 (“The nation needs real-time situational awareness and innovative

cybersecurity standards to keep up with the technological curve of cyber-threats that confront critical infrastructure.”).

112

The Wiretap Act’s prohibition on the use of a “device” to intercept any oral communication, see 18 U.S.C.

§2511(b), contains another exception that may be relevant for those engaged in cyber-threat detection. Specifically,

ECPA’s definition of a “device” necessarily excludes “any device or apparatus” used by “any ... equipment or facility

... furnished to the subscriber or user ... in the ordinary course of business.” See id. §2510(5)(a). However, the “ordinary

course of business” exception may not apply to a private entity that is scanning electronic communication for potential

cyber-threats. Courts have generally interpreted the ordinary course of business exemption to apply to devices that

further an underlying communications system, such as routers or switchboards, which arguably is unrelated to

determining whether particular communications within such a system pose a cyber-threat. See In re Google Inc. Gmail

Litigation, No. 13–MD–02430, 2013 WL 5423918, at *8 (N.D. Cal. September 26, 2013) (holding the “ordinary course

of business exception” “offers protection from liability only where an electronic communication service provider’s

interception facilitates the transmission of the communication at issue or is incidental to the transmission of such

communication. Specifically, the exception would apply here only if the alleged interceptions were an instrumental part

of the transmission of email.”); see also Campbell, 2014 WL 7336475, at *7 (holding the ordinary course of business

exception requires some nexus between interception and the subscriber’s “ultimate business, that is, the ability to

provide the underlying service or good”); see generally Sanders v. Robert Bosch Corp., 38 F.3d 736, 740 (4th Cir.

1994) (refusing to apply the ordinary course of business exemption to a voice logger); Hall v. EarthLink Network, Inc.,

396 F.3d 500, 504-5 (2d Cir. 2005); Williams v. Poulos, 11 F.3d 271, 280 (1st Cir. 1993); Deal v. Spears, 980 F.2d

1153, 1158 (8th Cir. 1992); but see Kirch v. Embarq Mgmt. Co., 702 F.3d 1245, 1250 (10th Cir. 2012) (holding that an

Internet Service Provider was operating in the ordinary course of business by allowing an online advertising company

to conduct technology tests for directing online advertising on electronic communications that the provider ordinary

accessed). More broadly, courts have been reluctant to find that indiscriminate recording of communications is within

the ordinary course of most businesses. See, e.g., United States v. Murdock, 63 F.3d 1391, 1397 (6th Cir. 1995).

113

See 18 U.S.C. §2511(2)(d); id. §2511(3)(b)(ii).

114

See 18 U.S.C. §2511(2)(d); id. §2511(3)(b)(ii). In addition, under the consent exception to the Wiretap Act’ s

interception prohibition, the exception does not apply when the underlying communication is “intercepted for the

purposes of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of

any State.” Id. §2511(2)(d).

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

“dimensions of the consent” and then ascertain whether the act in question “exceeded those

boundaries.”115

With respect to a private entity’s efforts to collect content-based cyber-threat information and

disseminate such information, the Wiretap Act’s consent exception, while often a viable route to

avoid liability, raises several difficult legal questions. For example, determining who is a “party to

the communication” when someone is launching a cyberattack can be very difficult, as the

cybercriminal may be using multiple computers and the ultimate destination of the hacker’s

communication may be unclear.116 While an entity attempting to monitor its system for cyberintruders could argue that it is a party to the underlying electronic communication being

monitored because the data is flowing on its network and is being directed toward its computers

and employees,117 such an interpretation of what it means to be a party to a communication may

eliminate any privacy protections for the individuals who are directly participating in the

electronic communication.118 Instead, a court may likely interpret that a party to a communication

must be the individuals who actually take part in the electronic conversation.119

Moreover, assuming that the private entity acquiring cyber-threat information is not a party to the

communication, consent must be obtained from one of the individuals taking part in the

communication, which, in turn, depends on the dimensions of the consent and whether the

interception or divulgence of the contents of electronic communication exceeded the boundaries

of the consent.120 Such an inquiry can be quite context specific,121 inviting litigation and creating

legal uncertainty for entities wishing to engage in cyber-information sharing. For example, courts

have come to differing conclusions as to whether an electronic communications service

provider’s customer has consented to having the provider intercept certain communications,

largely because of the specific nature of the interception in question and the precise terms of

service to which the customer agreed.122 Importantly, consent cannot be “casually” inferred,123

115

See Gilday v. Dubois, 124 F.3d 277, 297 (1st Cir. 1997) (citing Griggs-Ryan v. Smith, 904 F.2d 112, 116 (1st Cir.

1990).

116

See Dep’t of Justice, Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal

Investigations, 172 (2009), available at http://www.justice.gov/criminal/cybercrime/docs/ssmanual2009.pdf.

117

See Pitts Sales, Inc. v. King World Prods., 383 F. Supp. 2d 1354, 1361 (S.D. Fla. 2005) (holding that a “party to the

communication” under §2511(2)(d) is a party “who is present when the ... communication is uttered and need not

directly participate in the conversation”); see also United States v. Mullins, 992 F.2d 1472, 1478 (9th Cir. 1993) (stating

that the consent exception of §2511(2)(d) authorizes monitoring of computer system misuse because the owner of the

computer system is a party to the communication).

118

See generally Brown v. Waddell, 50 F.3d 285, 289 (4th Cir. 1995); see also Orin Kerr, Internet Surveillance Law

After the USA PATRIOT Act: The Big Brother That Wasn’t, 97 NW. U. L. REV. 607, 620 (2003) 664-665 (“[L]abeling

the [provider] a party to the communication may sound logical ... but ultimately would eviscerate the privacy

protections of the Wiretap Act.”).

119

See Caro v. Weintraub, 618 F.3d 94, 97 (2d Cir. 2010) (holding that a “a party to the conversation is one who takes

part in the conversation.”).

120

See In re Pharmatrak Privacy Litig., 329 F.3d at 19 (citing Griggs-Ryan v. Smith, 904 F.2d 112, 119 (1st Cir.

1990)). Moreover, consent may be explicit or implied, but it must be actual consent rather than constructive consent. Id.

121

United States v. Footman, 215 F.3d 145, 155 (1st Cir. 2000) (“The question of consent, either express or implied,

may vary with the circumstances of the parties.”).

122

See, e.g., Backhuat v. Apple, Inc.,—F.Supp.3d—-, 2014 WL 6601776, at *8 (N.D. Cal. November 19, 2014) (“In

light of the specific language of the license agreement, the Court concludes that a reasonable iMessage user would not

be adequately notified that Apple would intercept his or her messages when doing so would not ‘facilitate delivery’ of

the messages.”); In re Yahoo Mail Litig., 7 F.Supp.3d at 1029 (“The Court concludes that the [Yahoo Global

Communications Additional Terms of Service for Yahoo Mail and Yahoo Messenger] establishes explicit consent by

Yahoo Mail users to Yahoo’s conduct.”); In re Google Inc. Gmail Litig., 2013 WL 5423918, at *11–14 (“[A]

(continued...)

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

and absent actual notice of the nature of the interception or divulgence, consent can only be

implied if the “surrounding circumstances convincingly show that the party knew about and

consented to the interception.”124 Courts, interpreting the consent exception narrowly to ensure

the exemption does not swallow the rule, have held that merely providing a person notice that an

entity has the capability of intercepting communications cannot be considered implied consent.125

And deficient notice will “almost always defeat a claim of consent.”126 As a consequence, for a

private entity that wishes to employ and share the results of a cyber-threat detector, which often is

created with the goal of invisibly tracking communications without alerting either internal or

external users of its operation, notice to a party of an electronic communication that is sufficient

to create consent may, at times, defeat the entire purpose of monitoring and sharing the contents

of electronic communications.

Second, the Wiretap Act also includes a “provider exception” which allows the provider of

electronic communications to “intercept, disclose, or use” the contents of communications when

the activity is a “necessary incident to ... the protection of the rights or property of the provider of

that service.”127 On its face, the provider exception is limited to protecting the “rights or property

of the provider,” as opposed to any third party.128 While at least one court has read the provider

exception broadly to allow a service provider to intercept or disclose covered communications for

purposes of aiding third parties,129 several courts have cabined the provider exception in terms of

whether the interception was done for the purpose of protecting the provider’s own “equipment

and rights.”130 And the Department of Justice’s (DOJ’s) Office of Legal Counsel has likewise

concluded that the provider exception “must protect the provider’s own rights or property, and not

(...continued)

reasonable Gmail user who read the Privacy Policies would not have necessarily understood that her emails were being

intercepted to create user profiles or to provide targeted advertisements. Accordingly, the Court finds that it cannot

conclude at this phase that the new policies demonstrate that Gmail user Plaintiffs consented to the interceptions.”).

123

See Griggs-Ryan, 904 F.2d at 117-18.

124

See Berry v. Funk, 146 F.3d 1003, 1011 (D.C. Cir. 1998).

125

See Watkins v. L.M. Berry & Co., 704 F.2d 577, 581 (11th Cir. 1983).

126

See In re Pharmatrak Inc., 329 F.3d at 20.

127

See 18 U.S.C. §2511(2)(a)(i). The provider exception also contains a provision that allows the service provider to

intercept, disclose, or use cover communications when the activity is a necessary incident to the rendition of a service.

Id. This exception generally allows interception that is “unavoidable” and a part and parcel of modern

telecommunications. U.S. Dep’t of Justice, supra note 116, at 177 (citing United States v. New York Tel. Co., 434 U.S.

159, 168 n.13 (1977)).

128

See 18 U.S.C. §2511(2)(a)(i).

129

See, e.g., United States v. Pervaz, 118 F.3d 1, 5 (1st Cir. 1997) (holding that a company had the right to intercept

covered communications where there was evidence that its customers were being defrauded); see generally United

States v. Harvey, 540 F.2d 1345, 1352 (8th Cir. 1976) (“18 U.S.C. §2511(2)(a)(i) ... was designed to allow the

disclosure of justified wire monitoring” in order to provide evidence for “wire fraud prosecution”); New York Tel. Co.,

434 U.S. at 168 n.13 (stating in dicta that the provider exception “excludes all normal telephone company business

practices from the prohibitions of the [Wiretap] Act.”).

130

See United States v. Mullins, 992 F.2d 1472, 1478 (9th Cir. 1993) (holding that an employee of an electronic

communication service can act to “protect the rights and property of her employer by monitoring ... apparent misuse of

[the] electronic communication service.”); Campiti v. Walonis, 611 F.2d 387, 393 (1st Cir. 1979) (“The section is

obviously intended to allow the telephone company to intercept and disclose calls as a necessary protection of its

equipment and rights”) (emphasis added); United States v. Auler, 539 F.2d 642, 646 (7th Cir. 1976) (holding that

telephone companies which intercept calls pursuant to §2511(2)(a)(i) may forward to the police no more of the content

of those calls than “necessary to protect company rights and property.”); Hodge v. Mountain States Tel. & Tel. Co.,

555 F.2d 254, 260 (9th Cir. 1977) (“Congress enacted §2511(2)(a)(i) ‘to reflect existing law’ which allowed telephone

companies to intercept communications in order to protect the integrity of their property.”) (emphasis added).

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

those of any third party.... ”131 As a consequence, there is a strong argument that while ECPA may

authorize private entities to monitor their own system and to share cyber-intelligence necessary to

protect their own system,132 the law likely does not authorize service providers to disclose or

divulge in real time to other private entities or the government133 the contents of electronic

communications for the purpose of protecting a third party’s property or rights.134 In other words,

a more narrow reading of the provider exception may cast doubt on the legality of certain cyberinformation sharing methods.

The Stored Communications Act

In contrast to the Wiretap Act, which focuses on the interception and disclosure of the contents of

communications in transmission, Title II of ECPA—the SCA—is centrally concerned with access

to and the disclosure of both content and non-content based electronic communications that are

kept in storage.135 In relevant part,136 the SCA in Section 2702 generally prohibits service

131

See Legal Issues Relating to the Testing, Use, & Deployment of an Intrusion-Detection Sys. (Einstein 2.0) to Protect

Unclassified Computer Networks in the Exec. Branch, 33 OP. O.L.C. 1 (2009).

132

See Broggi, supra note 31, at 669-70; see also Protecting America From Cyber Attacks: the Importance of

Information Sharing, Hearing Before the Senate Homeland Security and Gov’t Affairs Committee, (January 28, 2015),

statement of Gregory T. Nojeim, Senior Counsel and Director of the Freedom, Security and Technology Project, at pg.

5, available at https://d1ovv0c9tw0h0c.cloudfront.net/files/2015/01/HSGAC-Cybersec-tes-1-28-15-final-TEH.pdf

(hereinafter “Nojeim Testimony”).

133

The Wiretap Act does have other means for the government to intercept or receive electronic communications. See,

e.g., 18 U.S.C. §§2516-2518 (authorizing government access to covered communications pursuant to or in anticipation

of a court order); id. §2511(2)(i) (permitting “a person acting under color of law” to “intercept” the contents of “wire or

electronic communications of a computer trespasser transmitted to, through, or from [a] protected computer” under

limited circumstances).

134

See Aaron J. Burstein, Amending the ECPA to Enable a Culture of Cybersecurity Research, 22 HARV. J.L. & TECH.

167, 188 (2008) (“Even if a researcher intercepts electronic communications contents under the provider exception,

disclosing the contents to outside researchers might stretch the requirement of protecting the original service provider’s

rights or property.”) (emphasis added). Moreover, even if a provider, in collecting and sharing cyber-threat information,

is ostensibly acting out of self-interest, courts have been clear that ECPA, by permitting interceptions to “protect the

rights or property” of the provider, does not allow “unlimited” interceptions. See Auler, 539 F.2d at 646 (holding that

the authority of a service provider to intercept and disclose covered communications is “not unlimited”); Councilman,

418 F.3d at 82 (holding that it was “indisputable” that the “narrow[]” provider exception did not exempt a provider who

intercepted and copy all incoming communications to gain a commercial advantage). Instead, there must be a

“substantial nexus” between the monitoring and the threat to the provider’s rights or property. See United States v.

McLaren, 957 F. Supp. 215, 219 (M.D. Fla. 1997). The Department of Justice has interpreted the provider exception to

permit “providers and their agents to conduct reasonable monitoring that balances the providers’ needs to protect their

rights and property with their subscribers’ right to privacy.” See U.S. Dep’t of Justice, supra note 116, at 173. At least

one commentator has suggested that the substantial nexus test may limit the scope of what types of information can be

gathered to combat cyber-threats. See Burstein, supra note 134, at 187 (“Although cybersecurity researchers might ...

provide information that allows their employers to protect their networks, this connection is likely to be highly

attenuated ... since researchers usually develop methods of detecting malicious traffic, their results might not be

immediately applicable to that purpose.”).

135

See 18 U.S.C. §§2701-2702. What sorts of “storage” that the SCA regulates will depend several statutory terms that

will be explained in more detail infra.

136

The SCA also prohibits unauthorized access to an ECS facility and “thereby obtains, alters, or prevents authorized

access to [an] ... electronic communication while it is in electronic storage.... ” See 18 U.S.C. §2701(a). However,

Section 2701 exempts from that general prohibition “conduct authorized ... by the person or entity providing [an] ...

electronic communications service,” see id. §2701(c)(1), meaning that service providers that “obtain” electronic

communication while in storage for the purpose of determining cyber-threats are likely immune from liability under the

first prohibition in the SCA. See Fraser v. Nationwide Mut. Ins. Co., 352 F.3d 107, 115 (3d Cir. 2003) (“[W]e read

§2701(c) literally to except from Title II’s protection all searches by communications service providers ... because

Fraser’s email was stored on Nationwide’s system (which Nationwide administered), its search of that email falls

(continued...)

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

providers engaged in either “electronic communications service” (ECS) or remote computing

service (RCS) to the public from divulging the contents137 of communications in their

possessions138 and subjects those that violate the SCA to civil liability.139 Notwithstanding that

general statement about Section 2702, the SCA is a notoriously complicated statute,140 and,

accordingly, Section 2702(a)’s central prohibition regarding the disclosure of the contents of

communications requires some clarification and several caveats.

First, to run afoul of Section 2702(a)(1)-(2)’s prohibition, the entity in question must provide

either ECS or RCS. ECS, as defined under the SCA, includes any service which provides users

the means to “send or receive ... electronic communication,”141 such as businesses that provide

text messaging142 or email143 services. An RCS, as defined by the SCA , entails “the provisions to

the public of computer storage or processing services by means of an electronic communications

system.”144 Courts have interpreted an RCS to refer to the long-term processing or storage of data

by an off-site third party.145 Second, not all disclosures by an ECS or RCS are prohibited by the

SCA; only disclosures of the contents of communications146—as opposed to address information,

like an email address147—would fall within the prohibition. Third, for an ECS provider, only

disclosures made while the underlying communication is in electronic storage amount to a

violation of the statute148—a status defined by the act as either (1) temporary, intermediate storage

of an electronic communication incidental to the transmission of that communication; or (2) any

storage of an electronic communication for backup protection.149 The definition of “electronic

storage” has been the source of considerable disagreement, with one prominent judicial opinion

(...continued)

within §2701(c)’s exception to Title II.”); see also In re Yahoo Mail Litig., 7 F. Supp. 3d at 1026-27 (“The SCA grants

immunity to 18 U.S.C. §2701(a) claims to [ECS providers] for accessing content on their own servers.”); Crowley v.

Cybersource Corp., 166 F. Supp. 2d 1263, 1272 (N.D. Cal. 2001) (holding that ECS “could not have limited access to

its own facilities.”); see generally Councilman, 418 F.3d at 82 (noting the “breadth” of §2701(c)(1)’s provider

exception).

137

18 U.S.C. §2702 prohibits what service providers can divulge with respect to non-content information only as it

relates to disclosures made to the government. See id. §2702(a)(3). For a discussion of §2702(a)(3), see infra “Privacy

Concerns.”

138

See 18 U.S.C. §2702(a)(1)-(2).

139

See 18 U.S.C. §2702(b)-(c) (including in the civil relief for a violation of the SCA (1) equitable relief; (2) actual

damages or at least $1,000; (3) punitive damages for willful or intentional conduct; (4) attorney fees).

140

United States v. Smith, 155 F.3d 1051, 1055 (9th Cir. 1998) (describing the SCA as a “complex, often convoluted,

area of the law.”).

141

18 U.S.C. §2510(15).

142

See, e.g., Quon v. Arch Wireless Operating Co., Inc., 529 F.3d 892, 902 (9th Cir. 2008), rev’d on other grounds by

City of Ontario v. Quon, 560 U.S. 746 (2010).

143

See, e.g., Theofel v. Farey-Jones, 359 F.3d 1066, 1075 (9th Cir. 2004).

144

Id. §2711(2). In turn, an electronic communication system is “any wire, radio, electromagnetic, photoptical or photo

electronic facilities for the transmission of wire or electronic communications, and any comput facilities or rleated

electronic equipment for the electronic storage of such communications.” Id. §2510(14).

145

See Quon, 529 F.3d at 901.

146

18 U.S.C. §2702(a)(1).

147

See, e.g., In re Zynga Privacy Litig., 750 F.3d 1098, 1108 (9th Cir. 2014) (noting that “email and IP addresses

‘constitute addressing information and do not necessarily reveal any more about the underlying contents of

communication than do phone numbers.’”) (internal citations omitted).

148

18 U.S.C. §2702(a)(1).

149

18 U.S.C. §2710(17)(A)-(B).

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

interpreting “electronic storage” to encompass both electronic messages that have yet to be

delivered to their intended recipient, as well as electronic messages in backup storage by the

provider until “the underlying message has expired in the normal course,”150 while others have

criticized the notion of “electronic storage” encompassing opened emails serviced by an ECS.151

Fourth, for an RCS provider to violate 18 U.S.C. Section 2702(a)(2), the provider must disclose

the contents of communications that are (1) “on behalf of, and received by” a subscriber or

customer of the service; and (2) “solely for the purpose of providing storage or computer

processing services to ... [that] subscriber or customer.”152 The statutory prohibition necessarily

excludes providers of RCS to the public who are authorized to access the contents of

communication for purposes other than for storage and computer processing, such as for

advertising purposes.153

Putting to the side the exceptions to SCA’s prohibition found in 18 U.S.C. Section 2702(a)(1)-(2),

unlike the Wiretap Act, the SCA’s prohibition on disclosing communications in storage will be

unlikely to prohibit many forms of cyber-information sharing. After all, to violate the statute, a

company must not only disclose the contents of communications to another private entity, but the

company doing the disclosure must provide ECS or RCS to the public.154 In other words, if, for

example, an email provider to the public shares the IP address that was the source of a malicious

email to a ISAO, that email provider did not share content information and therefore likely did

not violate the SCA. Moreover, if a private entity provides email services to its employees and

shares the text of an email that is the source of a computer virus with another company, that

private entity likely did not violate the SCA because that entity does not provide ECS or RCS to

the public.

Nonetheless, many Internet Service Providers (ISPs) or email providers ostensibly provide ECS

or RCS to the public,155 and those companies may be interested in sharing the contents of

information with outsiders for cybersecurity purposes. If so, it is uncontroversial to say that

because of disputes over key terms like “electronic storage” and “RCS” and “ECS,” the SCA, as

currently written and interpreted, is hardly a model of clarity.156 The resulting ambiguity about the

legality of information sharing within the SCA’s general ambit may deter providers of ECS or

RCS to the public from sharing cyber-threat information with other private entities.157 After all,

150

See Theofel, 359 F.3d at 1076.

See Crispin v. Christian Audigier, Inc., 717 F. Supp. 2d 965, 987 (C.D. Cal. 2010); United States v. Weaver, 636 F.

Supp. 2d 769, 771-73 (C.D. Ill. 2009); see generally Orin S. Kerr, A User’s Guide to the Stored Communications Act,

and a Legislator’s Guide to Amending It, 72 GEO. WASH. L. REV. 1208, 1216-18 (2004) (explaining that emails that are

in transit or have been delivered but are unopened are in electronic storage by an ECS, while emails that have been

opened and saved exclusively on a server are stored in RCS) (hereinafter “Kerr-Guide”).

152

18 U.S.C. §2702(a)(2)(A)-(B).

153

Id. §2702(a)(2)(B); see also Viacom Int’l Inc. v. YouTube Inc., 253 F.R.D. 256, 264 n.8 (S.D.N.Y. 2008); Juror

Number One v. Superior Court, 206 Cal. App. 4th 854, 862 (“Thus, if the service is authorized to access the customer’s

information for other purposes, such as to provide targeted advertising, SCA protection may be lost.”).

154

18 U.S.C. §2702(a)(1)-(2).

155

See Kerr-Guide, supra note 151, at 1229-33; see also In re Application of the United States of America for a Search

Warrant for Contents of Electronic Mail and for an Order Directing a Provider of Electronic Communication Services

to not Disclose the Existence of the Search Warrant, 665 F. Supp. 2d 1210, 1214 (D. Or. 2009) (“Today, most ISPs

provide both ECS and RCS; thus, the distinction serves to define the service that is being provided at a particular time

(or as to a particular piece of electronic communication at a particular time), rather than to define the service provider

itself.”).

156

See Smith, 155 F.3d at 1055.

157

See Burstein, supra note 134, at 189; see also infra note 401 (discussing potential litigation costs).

151

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

ambiguity in the law often breeds litigation, and the costs of litigation may be significant enough

to deter companies from engaging in cyber-information sharing.158

The hesitancy to participate in information sharing schemes may exist notwithstanding several

exceptions159 to the SCA’s general prohibition on the disclosure of certain types of electronic

communication held in storage.160 For example, while the SCA excludes from its prohibition on

the disclosure of communications disclosures made to a “person employed or authorized ... to

forward such communication to its destination,”161 that exception only eliminates liability for

those entities wishing to gather and share cyber-threat information within that organization162 and

does not sanction the sharing of the contents of a communication with an outsider. Moreover, the

SCA also contains a consent exception, allowing an ECS or RCS provider to divulge the contents

of a communication if the sender or recipient of that communication consents or, in the case of an

RCS, if the subscriber of the communication consents to the disclosure.163 Like the Wiretap Act’s

consent exception, the SCA’s consent exception is largely fact dependent, arguably providing

little assurance to a communications services provider that wishes to wholly eliminate litigation

risk.164 More specifically, the scope of the SCA’s consent exception is directly linked to a service

provider’s status as providing ECS or RCS, which may make the viability of the consent defense

contingent on the murky distinction between when a provider is acting in either role.165 Finally,

similar to the Wiretap Act, the SCA also contains a provider exception, and, much like its

counterpart in the Wiretap Act, the SCA’s provider exception is limited to allowing disclosures

that are necessary for the “protection of the rights or property of the provider”166 and arguably

does not extend to the protection of third parties that the provider may wish to share cyberintelligence.167

158

Id.

Besides the other exceptions mentioned in this paragraph, under the SCA’s exceptions to the prohibition in 18

U.S.C. §2702(a)(1)-(2), providers may divulge the contents of a communication to another private party to the extent

the disclosure is made: (1) to the addressee or intended recipient of such communication, id §2702(b)(1), or (2) to the

National Center for Missing and Exploited Children as required by federal statutes intended to prevent sexual

exploitation or trafficking of children or criminalize the possession, creation, or transportation of child pornography, id.

§§2702(b)(6), 2252A.

160

See 18 U.S.C. §2702(b).

161

Id. §2702(b)(4)

162

See Burstein, supra note 134, at 189.

163

See 18 U.S.C. §2702(b)(3) (“A provider ... may divulge the contents of a communication ... with the lawful consent

of the originator or an address or intended recipient of such communication, or the subscriber in the case of [RCS].”)

164

Compare Bower v. Mirvat El-Nady Bower, 808 F. Supp. 2d 348, 351 (D. Mass. 2011) (finding no consent); with

Flagg v. City of Detroit, 252 F.R.D. 346, 364 ( E.D. Mich. 2008) (finding consent).

165

See Theofel, 359 F.3d at 1076; Quon, 529 F.3d at 901-02; see generally Kerr-Guide, supra note 151, at 1215-16

(“The classifications of ECS and RCS are context sensitive: the key is the provider’s role with respect to a particular

copy of a particular communication, rather than the provider’s status in the abstract. A provider can act as an RCS with

respect to some communications, an ECS with respect to other communications, and neither an RCS nor an ECS with

respect to other communications.”).

166

See 18 U.S.C. §2702(b)(5) (“A provider ... may divulge the contents of a communication ... as may be necessarily

incident to the rendition of the service or to the protection of the rights or property of the provider of that service.”)

(emphasis added).

167

See Burstein, supra note 134, at 190; see also supra note 133 (discussing the “substantial nexus” test).

159

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

The Pen/Trap Act

The final major federal privacy law potentially relevant to cyber-information sharing amongst

private parties is found in Title III of ECPA, Pen/Trap Act.168 The Pen/Trap Act has been referred

to as the “non-content counterpart” to the Wiretap Act, in that the Pen/Trap Act is concerned with

the real time capturing of non-content information,169 such as IP addresses and the “to” and

“from” fields in an email.170 Specifically, in 18 U.S.C. Section 3121, the Pen/Trap Act generally

prohibits any person from installing or using a “pen register or a trap and trace device,” devices

used outside of the ordinary course of business that capture either incoming or outgoing noncontent electronic information about the source of a communication, without first receiving

permission from a court.171 Violations of the Pen/Trap Act can result in criminal penalties,

including not more than one year in prison.172 Like its counterpart the Wiretap Act, the Pen/Trap

Act, also contains several exceptions to its general prohibition, including a (1) “provider

exception,” which permits service providers to use pen/trap devices for the “operation,

maintenance, and testing of [an] ... electronic communication service” or to protect the “rights

and property” of the provider or the “users of that service from abuse of service or unlawful use

of service,”173 (2) “consent exception,” which allows the use of pen/trap devices where the user of

the service has provided consent.174 Nonetheless, in sharp contrast to the Wiretap Act and the

SCA, the Pen/Trap Act contains no provisions barring the disclosure or divulgence of non-content

information derived from a pen/trap device.175

For a private entity wishing to share non-content cyber-threat information with a third party, the

Pen/Trap Act likely does not raise serious legal concerns. First, the Pen/Trap statute’s provider

exception likely eliminates any potential criminal liability that could arise from a company

168

18 U.S.C. §§3121-3127.

See Burstein, supra note 134, at 191.

170

See Daniel J. Solove, Reconstructing Electronic Surveillance Law, 72 GEO. WASH. L. REV. 1264, 1287 (2004)

(contending that “e-mail headers (the addressing information on e-mail messages), IP addresses, and Uniform Resource

Locators ... fall under [the] definition [of information captured by a pen/trap device].”); see also Dep’t of Justice, supra

note 116, at 154 (“Because Internet headers contain both ‘to’ and ‘from’ information, a device that reads the entire

header ... is both a pen register and trap and trace device.... ”).

171

18 U.S.C. §3121(a). Specifically, in relevant part, the Pen/Trap statute defines a “pen register” as a device that

records or captures information that is “reasonably likely to identify the source of [an] ... electronic communication,”

see id. §3127(3), whereas a “trap and trace device” is defined as one that captures incoming electronic or other

impulses that “identify the originating number or other dialing, routing, addressing, and signaling information

reasonably likely to identify the source of [an] ... electronic communication,” id. §3127(4). Both definitions exclude

devices that capture content information, id.§3127(3)-(4), and the definition for a pen register excludes “any device ...

used by a provider or customer of [an] ... electronic communication service for billing, or recording as an incident to

billing ... or any device ... used ... for cost accounting or other like purposes in the ordinary course of business,”

id.§3127(4).

172

See id.§3121(d).

173

18 U.S.C. §3121(b)(1).

174

Id. §3121(b)(3). The government can obtain authority to install a pen/trap device by certifying to a court “that the

information likely to be obtained [from a pen register] is relevant to an ongoing criminal investigation” being

conducted by a law enforcement agency. See 18 U.S.C. §3122(b).

175

Cf. United States v. Reed, 575 F.3d 900, 914 (9th Cir. 2009) (concluding that the Pen/Trap Act contains no

requirement that non-content information form a pen/trap device be sealed from public disclosure); see Burstein, supra

note 134, at 192 (“The Pen/Trap statute’s exception, however, si concerned only with the condition for allowing a

service provider to install a pen register; the statute lacks a corresponding disclosure provision.”); see also Broggi,

supra note 31, at 672 (“Unlike the Wiretap Act however, the statute is silent regarding voluntary disclosure of

information obtained under these exceptions.”).

169

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

monitoring and capturing non-content information for cybersecurity purposes. After all, the

Pen/Trap Act’s provider exception sweeps more broadly than the provider exceptions in the

Wiretap Act or the SCA, in that Title III of ECPA allows providers to use a pen/trap device

“relating to the operation, maintenance, and testing of [an] ... electronic communication system....

”176 Given that nearly any electronic communication system, such as email or Internet

communication, necessarily depends on routing information from one source to another,177 it is

arguable that most private entities with genuine cybersecurity concerns may likely be capturing

non-content information as a natural product of the operating of an electronic communication

system anyway.178

Moreover, even if an entity’s decision to capture non-content address information is not related to

the “operation, maintenance, and testing of [an] ... electronic communication system,” the second

clause of the Pen/Trap Act’s provider exception allows the use of a pen/trap device to protect the

rights or property of the provider or the users of the service from “abuse of service or unlawful

use of service,”179 which would appear to encompass the circumstance where a private entity

collects non-content information to identify the source of a potential cyber-threat.180 In addition,

even if the provider exception does not allow the use of a pen/trap device, the consent exception

would allow a provider to capture non-content cyber-threat information with the agreement of the

provider’s user.181 Importantly, because the Pen/Trap Act only criminalizes the illegal use of

pen/trap devices and does not regulate the disclosures of non-content information culled from a

pen/trap device, once a provider has legally used a pen/trap device, there appears to be no reason

why a private entity should fear liability under the Pen/Trap Act if a company were, for example,

to share the IP address that was the source of malware with another private company.182

Other Federal and State Privacy Laws

While ECPA is the most prominently mentioned federal privacy law that could implicate cyberthreat information sharing efforts, other federal privacy laws could also plausibly deter the

exchange of cyber-intelligence amongst private entities. As noted above, ECPA’s privacy

protections are tied to (1) the age of the underlying communication, with communications in

storage generally getting less protection than communications that are being transferred in real

time, and (2) whether the underlying communication reveals substantive content, with noncontent information, such as IP addresses and email addresses, receiving fewer protections under

the statute.183 In contrast to ECPA, a host of various federal privacy laws target specific industries

176

18 U.S.C. §3121(b)(1).

See David D. Clark and Susan Landau, Untangling Attribution, 2 HARV. NAT’L SEC. J. 531, 534-35 (2011)

(describing all “data transport service of the Internet” as being based on packets, “small units of data prefixed with

delivery instructions.”).

178

See Columbia Pictures Industries v. Bunnell, No. 06-1093FMCJCX, 2007 WL 2080419, at *11 (C.D. Cal. May, 29,

2007 (holding that the capturing of an IP address necessary to “operate [a] website” falls within the Pen/Trap Act’s

provider exception).

179

18 U.S.C. §3121(b)(1).

180

See Broggi, supra note 31, at 672 (“The purpose of using signatures to scan network traffic is to protect the network

and its users from malicious activity.”).

181

18 U.S.C. §3121(b)(3).

182

There could be an argument that sharing non-content information with the government raises liability issues under

the SCA. See infra “Privacy Concerns.” Nonetheless, neither the SCA nor the Pen/Trap Act provide for criminal or

civil liability when a private entity discloses non-content information to another private entity.

183

See generally Omer Tenne, Quantifying Harm Structure: A New Harm Matrix for Cybersecurity Surveillance, 12 J.

(continued...)

177

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

that tend to control personally identifying information (PII), such as names, addresses, phone

numbers, or Social Security numbers. For example, the Cable Communications Policy Act of

1984 (CCPA) generally prohibits “cable operators”184 from collecting and disclosing PII,185

subjecting entities that violate the CCPA’s privacy protections to civil liability.186 Some courts,

interpreting the CCPA, have concluded that cable providers when providing Internet services can

be subject to the Act’s privacy provisions,187 raising the specter of civil liability if a cable ISP

were to disclose PII—like a name or an email address—while sharing cyber-threat information

with another private entity.

Much as the CCPA could raise liability concerns for cable ISPs wishing to share cyberinformation with other private entities, so too could a variety of federal privacy laws raise legal

questions for the entities that are regulated by such laws. Indeed, several discrete federal privacy

laws regulate how PII is collected and disseminated. These laws target a variety of distinct

entities, including

•

consumer reporting agencies188

(...continued)

ON TELECOMM. & HIGH TECH. L. 391, 393-95 (2014) (discussing the key “legal distinctions that serve as proxies for the

measurement of privacy and civil liberties harms.”).

184

The CCPA defines cable operators as:

any person or group of persons (A) who provides cable service over a cable system and directly or

through one or more affiliates owns a significant interest in such cable system, or (B) who

otherwise controls or is responsible for, through any arrangement, the management and operation

of such a cable system.

47 U.S.C. §522(5).

185

47 U.S.C. §551(b)(1) & (c)(1). The statute does not define the term of art “personally identifiable information,” but

does exclude from the term “any record of aggregate data which does not identify particular persons.” Id.

§551(a)(2)(A). Nonetheless, courts have recognized the term to include “specific information about the subscriber, or a

list of names and addresses on which the subscriber is included.... ” See Scofield v. Telecable of Overland Park, Inc.,

973 F.2d 874, 876 n. 2 (10th Cir.1992). Another court has held that a person’s name, address, and telephone are

included in term “personal identifiable information.” See Warner v. Am. Cablevision of Kansas City, Inc. ., 699

F.Supp. 851, 855 (D.Kan.1988); see also Pruitt v. Comcast Cable Holdings, LLC, 100 Fed. App’x. 713, 716 (10th

Cir.2004) (holding that a cable box did not contain PII where, inter alia, it did not contain the name, address, or “any

other information regarding the customer.”). There are several exceptions to the CCPA’s general prohibition on

collecting or disclosing PII, including a consent exception, see 47 U.S.C. §551(b)(1) & (c)(1), an exception based on

the need to conduct a “legitimate business activity,” id. §551(b)(2) & (c)(2), and an exception for disclosure to the

government based on a court order, id.§551(c)(2)(B).

186

Id. §551(f) (allowing for liquidated damages calculated at a rate $100 for each day of a violation and punitive

damages).

187

See Digital Sin, Inc. v. Does 1-176, 279 F.R.D. 239, 241 (S.D.N.Y. 2012) (finding that “many ... ISPs ... qualify as

‘cable operators’ under the CPPA and subject to the restrictions found in 47 U.S.C. §551); see also Warner Bros.

Record Inc. v. Doe, 555 F. Supp. 2d 1, 2 (D.D.C. 2008) (ordering a subpoena to be issued upon a cable ISP under 47

U.S.C. §551(c)(2)); TCYK, Inc. v. Does 1-20, No. 3:13–cv–3927–L, 2013 WL 6475040, at *2 (N.D. Tex. December

10, 2014) (“The Cable Privacy Act prohibits cable operators, which includes the ISPs identified here, from disclosing

subscribers’ personal information without their consent or a court order.”); AF Holdings LLC v. Doe, No. 12cv1519–

BTM, 2012 WL 3238023, at *1-3 (S.D. Cal. January 29, 2013) (issuing an order under the CCPA for Cox

Communications to produce “produce documents and information sufficient to identify the user of the specified IP

address.”); see generally United States v. Kennedy, 81 F. Supp. 2d 1103, 1111 (D. Kan. 2000) (assuming without

holding that the CCPA applies to a “provider of high speed Internet services over cable wires”); but see Klimas v.

Comcast Cable Communs., Inc., 465 F.3d 271, 273 (6th Cir. 2006) (holding that the CCPA’s prohibition on the

collection and dissemination of PII did not extend cable providers that also functioned as ISPs).

188

See 15 U.S.C. §§1681, et seq. (Fair Credit Reporting Act).

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

•

operators of websites or online services directed to children189

•

financial institutions190

•

videotape service providers191

•

educational agencies or institutions192

•

health plans, health care clearinghouses, and health care providers193

•

telecommunications carriers194

To the extent any one of these entities wishes to share cyber-intelligence within its possession

with others in the private sector, legal questions may abound if any of the information to be

shared contains material that is potentially protected under federal privacy law. None of the

aforementioned federal privacy laws specifically contemplate any exceptions for the sharing of

cyber-information for cybersecurity purposes. And, there is very little, if any, case law examining

how a given law applies to the specific context of the collection and dissemination of information

for cybersecurity purposes, leaving a legal lacuna for those regulated entities that may wish to

engage in cyber-information sharing.

Beyond federal privacy laws, states and localities have enacted countless laws that may prevent

or deter private entities from sharing cyber-intelligence with others. All but one of the fifty states

has an eavesdropping law that is generally modeled off the Wiretap Act,195 and a majority of

states regulate the collection and dissemination of electronic communications.196 While many of

the state communications privacy laws mirror federal law, state laws are often more restrictive or

may simply regulate different aspects of communications privacy than federal law,197 multiplying

189

See id. §§6501-6506 (Children’s Online Privacy Protection Act).

See id. §§6801-6809 (Gramm-Leach-Bliley Act (GLBA)).

191

See 18 U.S.C. §2710 (The Video Privacy Protection Act).

192

See 20 U.S.C. §1232g (Family Educational Rights and Privacy Act).

193

See 42 U.S.C. §300gg, 29 U.S.C §§1181 et seq., 42 U.S.C. §§1320d et seq., 45 C.F.R. Part 160 and Part 164,

Subparts A and E (Health Insurance Portability and Accountability Act (HIPAA)).

194

See 47 U.S.C. §222 (Federal Communications Act). Section 222 could take on an important role with respect to

ISPs, who may be the primary entities interested in engaging in cyber-information sharing, depending on whether such

entities are considered a “common carrier” for purposes of Title II of the Communications Act and on whether the

Federal Communications Commission promulgates new rules regarding how ISPs should protect customer proprietary

network information under Section 222. See Press Release, FCC Adopts Strong, Sustainable Rules to Protect Open

Internet, Federal Communications Commission, (February 26, 2015), at pg. 4, available at http://transition.fcc.gov/

Daily_Releases/Daily_Business/2015/db0226/DOC-332260A1.pdf (noting that, under newly proposed net-neutrality

rules, Section 222 of the Communications Act will apply to ISP); see also In the Matter of Protecting and Promoting

the Open Internet, GN Docket No. 14-28, ¶¶ 53-54, 462-467 (F.C.C. February 26, 2015), available at

http://transition.fcc.gov/Daily_Releases/Daily_Business/2015/db0312/FCC-15-24A1.pdf (contemplating a “separate

rulemaking procedure” for imposing customer privacy rules respecting ISPs).

195

See CRS Report R41734, Privacy: An Abridged Overview of the Electronic Communications Privacy Act, by

(name redacted), at p. 81 (“Appendix A”). Vermont is the only state that has not adopted its own state wiretapping

statute. Id.

196

Id.

197

See Elisabeth Pride, Down the Rabbit’s Hole: Baby Monitors, Family Movies and Wiretap Law, 23 J. AM. ACAD.

MATRIMONIAL LAW. 131, 149 (2010) (“Generally speaking, the state wiretap laws are modeled on the federal Act and

substantially mirror its language, but may be more restrictive in many respects.... ”); see also Daniel R. Dinger, Should

Parents Be Allowed to Record a Child’s Telephone Conversations When They Believe the Child Is in Danger?: An

Examination of the Federal Wiretap Statute and the Doctrine of Vicarious Consent in the Context of a Criminal

(continued...)

190

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

the legal questions facing those entities wishing to engage in cyber-information sharing. For

example, eight states currently generally require both parties to an electronic communication to

consent to its interception and/or further dissemination,198 allowing, in the words of one

commentator, cyber “attackers a veto on whether their packets are inspected for malicious

code”199 and potentially deterring some entities from collecting and divulging cyber-threat

information to others.

Moreover, much like the federal government, some states have laws that target the collection and

divulgence of PII within the possession of entities that may wish to engage in cyber-information

sharing.200 Although an examination of the various state privacy laws is beyond the scope of this

report, these laws may raise liability concerns for entities that do business in multiple states and

wish to disseminate cyber-threat information outside of the company.

Antitrust Laws

In addition to federal and state privacy laws, antitrust laws also have generated liability concerns

for private entities that wish to collaborate over cybersecurity.201 Indeed, in a recent survey, more

than a quarter of IT professionals identified “anti-competitive concerns” as one of the central

reasons for not participating in information sharing programs.202 Deterring anticompetitive

conduct by businesses, such as coordinated action that undermines competition, is at the heart of

federal antitrust law.203 Specifically, the Supreme Court in interpreting the Sherman Antitrust

Act—the “primary federal antitrust enforcement mechanism”204—has recognized that the law’s

facial prohibition in Section 1 on all contracts, combinations, or conspiracies that result in a

restraint of trade or commerce205 should be read to prohibit only those agreements that

unreasonably restrain trade.206 While courts interpreting the reach of the Sherman Act generally

view any concerted activity with some degree of skepticism,207 certain agreements, such as price

fixing and market allocation among competitors, are viewed as being so “inherently

(...continued)

Prosecution, 28 Seattle U.L. Rev. 955, 965-67 & n.58 (2005) (discussing the differing state wiretap laws).

198

See Cal. Penal Code §632.7; Fla. Stat. Ann. §934.03; Ill. Comp. Stat. Ann. ch. 720 §§5/14-2—5/14-3; Md. Cts.

§Jud. Pro. Code. Ann. §10-402(c)(3); Mich. Comp. Laws. Ann. §750.539c; Mont. Code. Ann. §§45-8-213; Ore. Rev.

Stat. §165.540(c); Pa. Stat. Ann. tit. 13 §1504.

199

See Bipartisan Policy Center, supra note 28, at 11.

200

See, e.g., Minn. Stat. §325M.02.(Minnesota’s Internet Privacy Act) (generally prohibiting ISPs from “knowingly

disclose a consumer’s ‘personally identifiable information.’”).

201

See Palmer, supra note 72, at 318; see also Peretti, supra note 32, at 5.

202

See Ponemon Institute—Threat Intelligence, supra note 33, at 4; see generally Sales, supra note 26, at 1530 (finding

that antitrust “liability fears appear to be fairly widespread” amongst firms that may wish “to share information or to

adopt common security standards.”).

203

See id. at 1528-29. Several federal laws have prohibitions on anticompetitive behavior, including the Sherman Act,

see 15 U.S.C. §§1-7, the Wilson Tariff Act, id. §§8-11, the Clayton Act, id. §§12-27, and the Federal Trade

Commission Act, id. §45.

204

In re Flonase Antitrust Litig., 692 F. Supp. 2d 524, 539 (E.D. Pa. 2010).

205

See 15 U.S.C. §1.

206

Board of Trade of Chicago v. United States, 246 U.S. 231, 238, 38 S. Ct. 242, 62 L. Ed. 683 (1918) (reasoning that

the term “restraint of trade” in §1 cannot possibly refer to any restraint on competition because “[e]very agreement

concerning trade, every regulation of trade, restrains. To bind, to restrain, is of their very essence”).

207

Copperweld Corp. v. Independence Tube Corp., 467 U.S. 752, 768 (1984).

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

anticompetitive that each is illegal per se without inquiry into the harm it has actually caused.”208

Other agreements, such as mergers or joint ventures that may facilitate more effective

competition, are adjudged under the “rule of reason,” in which a court will weigh the legitimate

justifications for a restraint against any anticompetitive effects.209 In other words, determining

whether a given agreement between two private businesses violates the Sherman Act largely

depends upon the specifics of that particular agreement.210 Businesses that are alleged to violate

federal antitrust laws face potential criminal prosecutions,211 as well as civil actions that could be

initiated by the federal government,212 state governments,213 or even aggrieved private litigants.214

Civil litigation risks treble damages—damages three times the amount of actual damage—being

paid to successful plaintiffs.215

While fears abound that any coordination on cyber-defense could give rise to antitrust liability,216

the likelihood of such liability will likely depend on the nature and purpose of the underlying

agreement to share cyber-threat information.217 Exchanges of information among competitors do

not constitute per se violations of the Sherman Act, as the Supreme Court has found that such

practices can “increase economic efficiency and render markets more ... competitive.”218

Moreover, the Court has been reluctant “to condemn rules adopted by professional associations as

unreasonable per se.... ”219 As a consequence, perhaps a few agreements to coordinate on cyberdefense—such as an agreement amongst competitors to “implement a uniform set of cyber-

208

Id.; see also Nat’l Collegiate Athletic Ass'n v. Bd. of Regents of Univ. of Okla., 468 U.S. 85, 103-04 (1984) (“Per

se rules are invoked when surrounding circumstances make the likelihood of anticompetitive conduct so great as to

render unjustified further examination of the challenged conduct.”); United States v. Socony-Vacuum Oil Co., 310 U.S.

150, 223 (1940) (“[C]ombination[s] formed for the purpose and with the effect of raising, depressing, fixing, pegging,

or stabilizing the price of a commodity in interstate or foreign commerce is illegal per se.”).

209

See Copperweld Corp., 467 U.S. at 768; see generally Board of Trade, 246 U.S. at 238 (“[T]he court must

ordinarily consider the facts peculiar to the business to which the restraint is applied; its condition before and after the

restraint was imposed; the nature of the restraint and its effect, actual or probable. The history of the restraint, the evil

believed to exist, the reason for adopting the particular remedy, the purpose or end sought to be attained, are all

relevant facts.”).

210

See Ken Heyer, A World of Uncertainty: Economics and Globalization of Antitrust, 72 ANTITRUST L.J. 375, 378

(2005) (arguing that “antitrust analysis and decisionmaking” entails “considerable uncertainty and imprecision

surrounding particular case decisions.”).

211

See 15 U.S.C. §1 (subjecting those guilty of violating §1 to fines “not exceeding $ 100,000,000 if a corporation, or,

if any other person, $ 1,000,000,” and “imprisonment not exceeding 10 years.... ”).

212

Id.§15a.

213

Id.§15c.

214

Id. §15.

215

Id. §15(a) (“[A]ny person who shall be injured in his business or property by reason of anything forbidden in the

antitrust laws ... shall recover threefold the damages by him sustained.... ”).

216

See, e.g., Info. Tech Industry Council, ITI Recommendation: Addressing Liability Concerns Impeding More

Effective Cybersecurity Information Sharing 3 (2012), available at http://www.itic.org/dotAsset/fae2feab-7b0e-45f49e74-64e4c9ece132.pdf (suggesting that the if a company “voluntarily reports what may be a cybersecurity threat or

incident in an information sharing entity, such as an ISAC,” that includes competitors of the company, a “[p]otential

result” would be for a “plaintiff [to] claim[] that the information shared is an effort to harm competition,” resulting in a

lawsuit under federal antitrust laws).

217

See Dep’t of Justice and Fed. Trade Comm’n, Antitrust Policy Statement on Sharing of Cybersecurity Information 8

(April 10, 2014), available at http://www.justice.gov/atr/public/guidelines/305027.pdf (hereinafter “DOJ-FTC Joint

Statement”) (noting that any antitrust analysis of a given cyber information sharing scheme is “intensely fact-driven.”).

218

See United States v. United States Gypsum Co., 438 U.S. 422, 443 n.16 (1978).

219

See FTC v. Indiana Federation of Dentists, 476 U.S. 447, 458 (1986).

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

security practices”220 by either agreeing to “pass on” certain associated costs to customers221 or

adopt cybersecurity practices that provide inferior products to end users222—may “amount to a

‘naked’ restraint that results in reflexive condemnation under the per se rule.”223 Nonetheless,

most efforts to share cybersecurity information amongst private entities, particularly within a

formal organization like an ISAC, will likely be adjudged under the rule of reason.224 A rule of

reason analysis would weigh the legitimate justifications for engaging in concerted efforts to

share cyber-information against any anticompetitive effects.225 As such, a rule of reason analysis

regarding cyber-information sharing may weigh the interest in combatting fraudulent cyberactivity226 versus the potentiality of certain actors being excluded from the cyber information

forum for anticompetitive reasons.227 Nonetheless, there is no case law that squarely addresses

how antitrust laws apply to coordinated efforts to combat cyber-threats, and given the central role

of common law in defining the limits of federal antitrust law, the net result may be considerable

legal uncertainty for those private entities that may wish to engage in such activities.

Recognizing the legal uncertainty that exists with respect to antitrust law and cybersecurity

information sharing, in April of 2014, DOJ and the Federal Trade Commission (FTC) issued a

joint policy statement that attempted to clarify the extent to which the exchange of cyber-threat

information amongst private parties could raise antitrust issues.228 The joint policy statement

confirmed that information sharing agreements are typically examined under a rule of reason

analysis,229 and the statement continued by recognizing that the exchange of cyber-threat

information has numerous positive effects that will weigh in favor of its legality, including

helping “secure our nation’s networks of information and resources.”230 Moreover, the joint

policy statement emphasized that the typical nature of cyber-threat information—described as

being “very technical in nature”—is often unlikely to contain “competitively sensitive

information” that would allow participants to “raise prices or reduce output, quality, service, or

220

See Sales, note 26, at 1531.

See id. (“Whether the companies have agreed to purchase and install new firewall software ... industry members ...

might decide to pass on these costs to consumer, either in the form of a general price hike or as free standing

surcharge.”); see generally United States v. Container Corp. of Am., 393 U.S. 333, 338 n.4 (1969) (“[A]ll forms of

price-fixing are per se violations of the Sherman Act.”).

222

Sales, note 26, at 1531-32 (“Suppose firms in a particular industry agree to install intrusion-detection or –prevention

capabilities to scan for malware ... [t]he effect [of which] is often to slow down the network’s performance ... [T]he

shared security standards still plausibly could be described as an unlawful price-fixing agreement ... [because] the firms

have agree to require consumers to pay the same price for a lesser product.... ”).

223

Id. at 1531.

224

See United States Gypsum Co., 438 U.S. at 443 n.16; see also Augusta News Co. v. Hudson News Co., 269 F.3d 41,

47 (1st Cir. 2001) (“[T]he legality of most kinds of agreements (e.g., R&D projects, information sharing, distribution

contracts) is tested by the rule of reason.”).

225

Paladin Assocs. v. Montana Power Co., 328 F.3d 1145, 1156 (9th Cir. 2003).

226

Cf. Michelman v. Clark-Schwebel Fiber Glass Corp., 534 F.2d 1036, 1048 (2d Cir. 1976) (holding that the

concerted exchange of credit information was “necessary to protect ... against” fraud and, therefore, did not amount to

“violation of §1 ... provided that any action taken in reliance upon [such information was] the result of each firm’s

independent judgment.... ”).

227

Cf. Reg'l Multiple Listing Serv. of Minn., Inc. v. Am. Home Realty Network, Inc., 9 F. Supp. 3d 1032, 1039 (D.

Minn. 2014) (holding that an allegation that several real estate agents colluded in creating an information sharing

network to exclude another broker sufficed to satisfy a Sherman Act §1 claim).

228

See DOJ-FTC Joint Statement, supra note 217.

229

Id. at 5.

230

Id. at 6.

221

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

innovation.”231 Instead, the two agencies underscored that the primary antitrust concern in the

context of cyber information sharing is the sharing competitively sensitive information, such as

“current, and future prices, cost data, or output levels” that could allow for “competitive

coordination among competitors.”232

Notwithstanding the value of the joint guidance, as the guidance concedes, any analysis of the

legality of a cyber-information sharing agreement is “intensely fact-driven,”233 and, given the

predominant role of the rule of reason with respect to examining the legality of any cyber-threat

sharing agreements,234 definitive conclusions by the government about the legality of

cybersecurity information sharing arrangements vis-à-vis antitrust law may simply be

impossible.235 Moreover, given the role of private parties in enforcing federal antitrust law

through civil lawsuits,236 even if government entities like the FTC and the DOJ generally agreed

that antitrust laws should not be enforced with respect to concerted actions over cybersecurity,

nothing prevents an aggrieved private party from initiating an antitrust lawsuit to prevent

collaboration over cyber-information sharing,237 meaning that without a change in the current law

liability risks from antitrust suits may remain for any private entity interested in sharing

cybersecurity information.

Tort Law

Another often-cited source of liability that may dissuade private entities from participating in

cyber-information sharing schemes is tort law, specifically torts founded upon negligence– that is,

the fear that by sharing and obtaining cyber-information a private entity may be liable for

negligently failing to act upon certain threat information.238 Generally under tort law, to establish

that a defendant has acted negligently, a plaintiff must show: (1) a duty of care owed to the

plaintiff by the defendant; (2) a breach of that duty by the defendant; (3) causation (i.e., the

resulting injury was both the “but for” and “proximate cause or foreseeable consequence of the

risk created by the defendant’s act or omission”); and (4) a cognizable injury or harm to the

plaintiff.239 In the context of a lawsuit following a cyberattack, an injured party may seek

231

Id. at 7-8.

Id. at 4.

233

Id. at 8.

234

Cf. FTC v. Acavis, Inc. 133 S. Ct. 2223, 2245 (Roberts, C.J., dissenting) (describing the rule of reason as “unruly”).

235

The DOJ has developed a business review procedure, whereby groups can submit a specific plan to collaborate on

cybersecurity efforts to the Justice Department for a determination by the agency of whether the proposed collaboration

would raise antitrust concerns. See 28 C.F.R. §50.6; see, e.g., Letter from Joel I. Klein, Assistant Attorney General,

Dep’t of Justice, Antitrust Div., to Barbara Greenspan, Assoc. Gen. Counsel, Elec. Power Research Inst., Inc. (October

2, 2000), available at http://justice.gov/atr/public/busreview/6614.htm.

236

15 U.S.C. §15(a).

237

In order to succeed on such a claim, in addition to demonstrating a violation of federal antitrust law, a private party

would have demonstrate an “antitrust injury”—i.e., that it possesses “antitrust standing”—which requires a showing

that the plaintiff was harmed by the defendant’s anticompetitive contract combination, or conspiracy, and that harm

flowed from an “anti-competitive aspect of the practice under scrutiny.” Atl. Richfield Co. v. USA Petroleum Co., 495

U.S. 328, 334 (1990).

238

See, e.g., Eric Engleman, Companies Want Lawsuit Shield to Share Cyber Threat Data, BLOOMBERG BUS. WK.

(March 7, 2013), http://www.businessweek.com/news/2013-03-07/companies-want-lawsuit-shield-to-share-cyberthreat-data (“Companies are concerned about ... negligence lawsuits for failing to act on information they receive.... ”).

239

See Nat’l Research Council, CRITICAL INFORMATION INFRASTRUCTURE PROTECTION AND THE LAW: AN OVERVIEW OF

KEY ISSUES 45-46 (Stewart D. Personick & Cynthia A. Patterson eds., 2003).

232

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

compensation from a company whose network was breached, arguing that the company owed its

customers a duty of reasonable security to protect against cybercriminals stealing their data.240

However, while courts have generally recognized that “cyber attacks are [a] foreseeable” risk for

which a service provider must account,241 courts have been fairly reluctant to find that a

particular cyberattack should have been anticipated by a service provider.242 After all, just as a

business has no duty to protect its customers against unforeseeable crimes from third parties,243 so

too must the “duty to implement security thwarting third-party cybercrimes ... turn on whether the

crime was foreseeable.”244 In other words, under tort law, a business likely does not have a duty to

guard against “innovative [cyber-]breaches that have no known or effective defense at the time of

the attack.”245

Because tort liability for a cyberattack will likely turn on the amount of knowledge a given party

may have about a cyberattack, cyber-information sharing schemes have the potential to change

the tort liability calculus for those entities that participate. For example, if a company opts to

share information about the origins of a recent cyberattack perpetrated on that company with a

public information sharing group, like an ISAC, the company may be admitting that it could have

foreseen the attack or mitigated its effects in some way, providing potential plaintiffs with

credible evidence to support a potential tort lawsuit. Likewise, entities that receive information

about a potential cyberattack, fail to act, and then subsequently are targeted by the attack, can no

longer credibly claim that the harm from the cyberattack was unforeseeable. In this sense, tort law

can have the perverse effect of incentivizing private entities to “simply stay[] in the dark” about

potential cyberattacks and to not participate in cyber-information sharing programs.246

Nonetheless, even if participation in a cyber-information sharing agreement increases tort liability

risks, it remains very difficult for a plaintiff to succeed on the theory that a private entity failed to

prevent a cyberattack. First, in order for cyber-threat sharing to increase tort liability risks, an

entity would have to have some considerable bad luck. The company in question would not only

have to suffer a cyberattack, but that cyberattack would have to be linked to a cyberattack in

which information was shared about, and the cyberattack would have to result in actual damages

for a plaintiff. Notwithstanding popular media accounts regarding potential losses created by a

240

Id. at 45.

See Baidu, Inc. v. Register.com, Inc., 760 F. Supp. 2d 312, 320 (S.D.N.Y. 2010).

242

See, e.g., Citizens Bank of Pa. v. Reimbursement Techs., Inc., No. 12–1169, 2014 WL 2738220, at *3-4 (E.D. Pa.

June 17, 2014) (finding that a defendant “could not have foreseen” the particular circumstances that led to a data

breach); but see In re Target Corp. Customer Data Sec. Breach Litigation,—F. Supp. 3d—, MDL No. 14–2522, 2014

WL 6775314, at *3-4 (D. Minn. December 2, 2014) (finding that the cyberattack against Target was foreseeable

because Target had allegedly affirmatively disabled a security feature that would have prevented the attack).

243

See RESTATEMENT (SECOND) OF TORTS §448 (“The act of a third person in committing an intentional tort or crime is

a superseding cause of harm ... unless the actor at the time of his negligent conduct realized or should have realized the

likelihood that such a situation might be created, and that a third person might avail himself of the opportunity to

commit such a tort or crime.”).

244

See Michael L. Rustad & Thomas H. Koenig, Extending Learned Hand’s Negligence Formula to Information

Security Breaches, 3 ISJLP 237, 251 (2007); see also Michael L. Rustad & Thomas H. Koenig, The Tort of Negligent

Enablement of Cybercrime, 20 BERKELEY TECH. L.J. 1553, 1553 (2005) (“Any duty to protect computer users from the

cybercrimes of third persons must be predicated on a preventable risk.”).

245

See John A. Fisher, Secure My Data or Pay the Price: Consumer Remedy for Negligent Enablement of Data Breach,

4 WM. & MARY BUS. L. REV. 215, 230 (2013).

246

See Palmer, supra note 72, at 323 (arguing that tort law creates an “incentive to not meaningfully participate in

information sharing by simply staying in the dark and not expose itself to potential liability.”).

241

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

cyberattack,247 most of the cost of a cyberattack will be borne by the company attacked and will

not result in actual losses for potential plaintiffs in a tort lawsuit, like a customer.248 And courts

have been loath to allow a lawsuit to proceed based on the potential for future injury resulting

from a cyberattack.249 Second, and perhaps most importantly, the economic loss doctrine—which

prohibits parties from recovering financial losses, absent injury to person or property, under tort

law250—often prevents recovery in a lawsuit respecting a cyberattack because “[m]any of the

harms that would result from a cyber-attack on, say, the power grid or the financial sector would

be purely economic in nature.”251 And indeed, in recent tort lawsuits regarding cyberattacks,

courts have dismissed tort claims at early stages of the litigation because of the economic loss

doctrine.252 In short, the litigation risks posed by tort lawsuits respecting a cyberattack may be

fairly minimal regardless of whether an entity is involved in cybersecurity sharing.253

247

See, e.g., PRICEWATERHOUSE COOPERS, supra note 13, at 10 (noting that the “annual estimated reported average

financial loss attributed to cybersecurity incidents was $2.7 million, a jump of 34% over 2013.”).

248

See Jacob W. Schneider, Note, Preventing Data Breaches: Alternative Approaches to Deter Negligent Handling of

Consumer Data, 15 B.U. J. SCI. & TECH. L. 279, 281-82 (2009) (“When an individual’s personal information is stolen,

there is no guarantee that it will be used fraudulently. In fact, only 2% of stolen credit card information from data

breaches is subject to misuse. Of all identity theft reports, only 1.5 to 4% are the result of stolen credit card

information. This probability goes down even further when the volume of personal information is large—since identity

thieves can only make use of a small number of accounts.”).

249

See Randolph v. ING Life Ins. & Annuity Co., 973 A.2d 702, 708 n.9 (D.C. 2009) (collecting cases where courts

“have dismissed similar negligence actions for failure to state a claim, or have entered summary judgment for

defendants, in the absence of allegations of present injury to plaintiffs.”).

250

See Nat’l Research Council, supra note 239, at 50.

251

See Sales, supra note 26, at 1535.

252

See, e.g., In re Target Corp. Data Sec. Breach Litigation,—F. Supp. 3d.—, MDL No. 14–2522, 2014 WL 7192478,

at * 20 (dismissing several tort claims related to Target’s 2013 data breach under the economic loss doctrine); see also

In re TJX Cos. Retail Sec. Breach Litig., 564 F.3d 489, 498 (1st Cir. 2009) (“AmeriFirst says that it did suffer property

damage because it had a property interest in the payment card information, which the security breach rendered

worthless. Electronic data can have value and the value can be lost, but the loss here is not a result of physical

destruction of property.”); Cumis Ins. Soc’y, Inc. v. BJ’s Wholesale Club, Inc., 918 N.E. 2d 36, 39, 49-51 (Mass. 2009)

(“[T]he plaintiffs suffered only economic harm due to the theft of the credit card account information ... the economic

loss doctrine barred recovery on their negligence claims.”).

253

The Bipartisan Policy Center has hypothesized that “domain names and companies who host websites” that may be

the subject of cyber-threat information may sue “entities that collect and aggregate cyber-threat information,” like

ISACs, regarding the “accuracy of their data,” potentially chilling cyber-information sharing. See Bipartisan Policy

Center, supra note 30, at 9-10. Presumably such a lawsuit would be based on a defamation claim—that is, an allegation

that a defendant negligently published an unprivileged, false, and defamatory statement to a third party. See

RESTATEMENT (SECOND) OF TORTS §558. The study from the Bipartisan Policy Center does not cite to any lawsuits that

have been filed against a cyber-information sharing organization or any other accounts of such an organization being

threatened with a lawsuit for the publication of cyber-threat information, making it difficult to assess whether such

lawsuits have actually chilled information sharing efforts. See Bipartisan Policy Center, supra note 30, at 9-10.

Nonetheless, Congress, in the Communications Decency Act (CDA), has already provided immunity to defamation

lawsuits directed at services that provide information to multiple users by giving them access to a computer server. See

47 U.S.C. §230(c)(1). Courts interpreting the CDA have generally agreed that the Act immunizes online information

hosts from liability for defamatory material posted through their services by third parties. See, e.g., Zeran v. Am.

Online, Inc., 129 F.3d 327, 330 (4th Cir. 1997); Green v. America Online, 318 F.3d 465, 471 (3d Cir. 2003); Universal

Communications Systems, Inc. v. Lycos, Inc., 478 F.3d 413, 422 (1st Cir. 2007); Doe v. MySpace, Inc., 528 F.3d 413,

420 (5th Cir. 2008); Fair Hous. Council v. Roommates.com, LLC, 521 F.3d 1157, 1170-71 (9th Cir. 2008); Klayman v.

Zuckerberg, 753 F.3d 1354, 1359 (D.C. Cir. 2014). So long as a cyber-information sharing service is not “creating or

developing” cyber-threat information and sharing it with other entities, see Fair Hous. Council of San Fernando Valley,

489 F.3d at 925, it appears the CDA likely shields such entities from any defamation lawsuits that could potentially

chill broader cyber-information sharing efforts.

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

Other Sources of Liability

Beyond privacy, antitrust, and negligent tort law, several other laws could be the source of

liability concerns for private entities that choose to share cyber-information with each other. For

example, the 2013 Target data breach incident led to a shareholder derivative suit against Target’s

officers and board of directors, that alleged that those actors violated fiduciary obligations of

trust, loyalty, good faith, and due care by failing to take adequate steps to prevent the cyberattack

and by making inaccurate disclosures to their shareholders about the extent of the damage from

the attack.254 Shared cyber-information could be critical evidence in a similar suit. If, for example,

a company that suffered a data breach like Target shared cyber-threat information with an ISAC

prior to the attack, one could imagine such evidence being used in a similar shareholder lawsuit to

establish that the company’s officers had specific knowledge about the company’s cybervulnerabilities or the extent of a cyber-attack on a given day.

And a shareholder derivative lawsuit is only one genre of litigation that could both result from a

cyberattack and be aided by shared cyber-information.255 For example, institutional customers

who sue a bank in the wake of a cyberattack that has resulted in fraudulent wire transfers could be

helped by evidence that a bank knew about particular risks posed by a cyberattack. The general

framework governing the rights and obligations between a bank and customers respecting

fraudulent wire transfers is found in Article 4A of the Uniform Commercial Code (UCC).256

Article 4A generally requires banks to bear the risk if a third party steals a customer’s identity,

resulting in a fraudulent wire transfer.257 Nonetheless, the UCC contains an exception whereby a

customer will bear the risk of a fraudulent payment order if: (1) a bank and its customer agree to

implement a security procedure designed to protect against fraud; (2) the security procedure that

is implemented is a “commercially reasonable” method of providing security against

unauthorized payment orders; and (3) the bank demonstrates that it accepted the payment order in

good faith and in compliance with the security procedure.258 While the question of whether a

particular security procedure can be deemed “commercially reasonable” will likely depend on the

specific facts surrounding a cyberattack and the procedures a bank had in place to prevent such a

fraudulent transfer,259 one critical factor may be a bank’s prior awareness of the risks posed by a

cyberattack.260 In this vein, knowledge that a bank knew about a cybersecurity risk because of

shared cyber intelligence could implicate that bank’s liability with regard to a suit under the UCC.

254

See Collier v. Steinhafel, No. 14-cv-266, Docket #1, Compl. (D. Minn. January 29, 2014).

Even in the context of securities litigation, in addition to state common law breach of fiduciary duty claims, federal

law allows a private actor to sue as a result of a material misstatement or omission in connection with the purchase or

sale of any security, see Halliburton Co. v. Erica P. John Fund, Inc., 134 S. Ct. 2398, 2407 (2014), which could

plausibly include a claim for failing to disclose cybersecurity risks to investors or federal regulators, see infra notes

310-314 and accompanying text.

256

See U.C.C. §4A et seq.

257

Choice Escrow & Land Title, LLC v. BancorpSouth Bank, 754 F.3d 611, 616 (8th Cir. 2014).

258

Id.

259

Compare id. at 622 (concluding that a bank’s security procedures, which included password protection, daily

transfer limits, device authentication, and dual control, were “commercially reasonable”) with Patco Constr. Co. v.

People’s United Bank, 684 F.3d 197, 212 (1st Cir. 2012) (concluding that a “one-size-fits-all” security procedure that

provided the same security to all wire transfers regardless of size was commercially reasonable).

260

Compare Choice Escrow, 754 F.3d at 620 (holding that where a bank was aware of a new cyber-threat, offered its

customer an updated security procedure to combat the new cyber-threat, and the customer declined to utilize the new

security procedure, the bank acted in a commercially reasonable way) with Patco Constr. Co., 684 F.3d at 213

(concluding that a bank’s failure to implement additional security procedures was “especially unreasonable in light of

the bank’s knowledge of ongoing fraud.”).

255

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

More broadly, there are “a myriad of legal theories, including ... breach of express or implied

contract, state deceptive trade practices act violations or state data breach notification violations”

that could be the basis for a lawsuit against an entity that suffered a data breach.261 Shared cyberinformation could be critical evidence that helps prove, for example, the timing of when a

cyberattack occurred or the company’s knowledge of the attack and the sufficiency of the

company’s cyber-defenses at the time of the breach,262 which could result in private entities being

less likely to share cyber-intelligence with any other entity or organization.

Sharing Cyber -Information with the Government

Just as private entities are increasingly recognizing the need to access cyber-intelligence gathered

by their peers,263 the federal government may need access to cyber-threat information in the

possession of the private sector in order to make informed decisions about the government’s and

the nation’s cybersecurity needs. As Lisa Monaco, the President’s Homeland Security Advisor,

recently noted, the “private sector has vital information we don’t always see unless they share it

with us.”264 Nonetheless, obtaining cyber-intelligence from the private sector can be difficult for

the federal government. Putting aside the difficult issues that may arise when a private party

affirmatively refuses to divulge cyber-intelligence within its possession to the federal government

and the government is forced to obtain, for example, a warrant or a subpoena to access such

information,265 the federal government may not know that a private entity possesses certain cyberintelligence, and the only way the government can learn about a potential cyber-threat is by

having the private party voluntarily share that information with the government. The voluntary

disclosure of cyber-intelligence to the government may, however, be something private parties are

reluctant to do because of various legal concerns.

Before discussing those legal concerns, it is important to note from the onset that the government,

and specifically DHS, has ample legal authority to receive voluntarily266 shared cyberinformation. For example, under Section 201 of the Homeland Security Act, the I&A is

authorized to “receive ... information ... [from] private sector entities ... in support of the mission

responsibilities of” DHS.267 Moreover, the NCPA provided explicit statutory authority for the

NCCIC to serve as an “interface for the multi-directional ... sharing of information related to

cybersecurity risks, incidents, analysis, and warnings.... ”268 More broadly, the Critical

261

See Peretti, supra note 32, at 6.

Id.

263

See supra note 93 and accompanying text.

264

See Lisa O. Monaco, Remarks as Prepared for Delivery by Assistant to the President for Homeland Security and

Counterterrorism Lisa O. Monaco Strengthening our Nation’s Cyber Defenses, (February 11, 2015), available at

http://www.whitehouse.gov/the-press-office/2015/02/11/remarks-prepared-delivery-assistant-president-homelandsecurity-and-coun.

265

These legal issues related to compelled disclosures of cyber-intelligence are beyond the scope of this report. For

background on the various methods the government could use to compel a private actor to disclose cyber-intelligence,

see CRS Report 95-1135, The Federal Grand Jury, by (name redacted);see also CRS Report R41733, Privacy: An

Overview of the Electronic Communications Privacy Act, by (name redacted); CRS Report RL33320,National Security

Letters in Foreign Intelligence Investigations: Legal Background, by (name redacted).

266

The Critical Infrastructure Information Act of 2002 defines the term “voluntary”—in the context of cyber

information sharing—as the “submittal of critical infrastructure information to a covered Federal agency

267

See 6 U.S.C. §121(d)(1).

268

See 6 U.S.C. §148(c)(1).

262

Congressional Research Service

Cybersecurity and Information Sharing: Legal Challenges and Solutions

Infrastructure Information Act (CIIA), a subtitle within the Homeland Security Act, has extensive

provisions regarding the treatment of “critical infrastructure information” that is “voluntarily

submitted to a ... federal agency”,269 reflecting an assumption that the federal government is not

precluded from receiving from a private entity voluntarily shared information pertaining to

critical infrastructure.270

Freedom of Information Act Disclosures

One central concern for those private entities that may wish to share cyber-intelligence with the

government is that the information shared, which may include proprietary information or even

simply embarrassing material,271 could be disclosed through the Freedom of Information Act

(FOIA), whether through an affirmative agency disclosure or through a public request.272 FOIA

generally provides that government agencies “shall make available to the public” certain agency

records, except insofar as the records are protected from disclosure under several exemptions to

the Act.273 Congress, in the CIIA, provided an exemption to FOIA for any “critical infrastructure

information” (CII)274 that is “voluntarily submitted” to DHS275 for us

This text is long and has been trimmed here. Open the source document for the complete record.

This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.