The media reports data breaches exposing tens of millions of personal financial records at retailers, such as Target, Home Depot, and TJ Maxx. It would seem that companies could increase their cybersecurity at relatively little cost by sharing information about cyberattacks. Perceived Legal Barriers to Information Sharing

Firms and industry groups have expressed reluctance to share information in part because doing so might violate privacy or antitrust laws. Public disclosure of a breach may cost an organization customers and sales and affect its stock price. The Information Sharing and Analysis Center (ISAC) Council emphasized to the Government Accountability Office (GAO) that "the benefits of sharing information are often difficult to discern, while the risks and costs of sharing are direct and foreseeable." So Why Do Some Firms Share Information? Information about the effects of an attack can also be shared, even if the method of attack is unknown—for example, by notifying other firms that information has been stolen or that a resource is not operational. ISACs are private-sector, nonprofit entities that collect, analyze, and share information on cybersecurity threats and best practices. Other experts advocate a strictly voluntary approach, because they believe it could impose fewer regulatory costs on businesses and cost less for taxpayers. Effects of Greater Information Sharing

Sharing more information could reduce the information asymmetries and increase the size and quality of the market for cybersecurity products and make cyberspace more secure, allowing firms to better estimate the probability and costs of data breaches, for example. It might provide a lesson to those using other software, but it is less likely to be directly applicable. Selected Legislation in the 114th Congress to Encourage Information Sharing

This section provides brief summaries of two bills that have been introduced in the 114 th Congress that might affect the willingness of organizations to share cybersecurity information. 1560 and H.R. 1560: Protecting Cyber Networks Act (Title I) and National Cybersecurity Protection Advancement Act (Title II, formerly H.R. 1731)

On April 22, 2015, the House passed H.R. 1560 . 1560 and H.R. 1731 . H.R. S. 754: Cybersecurity Information Sharing Act of 2015

On March 17, 2015, the Senate Select Committee on Intelligence reported out S. 754 , Cybersecurity Information Sharing Act of 2015 (CISA). Analysis

Both H.R. H.R.
Data breaches, such as those at Target, Home Depot, Neiman Marcus, JPMorgan Chase, and Anthem, have affected financial records of tens of millions of households and seem to occur regularly. Companies typically respond by trying to increase their cybersecurity, hiring consultants, and purchasing new hardware and software. Policy analysts have suggested that sharing information about these breaches could be an effective and inexpensive part of improving cybersecurity. Firms share information directly on an ad hoc basis and through private-sector, nonprofit organizations, such as Information Sharing and Analysis Centers (ISACs) that can analyze and disseminate information.
Firms sometimes do not share information because of perceived legal risks, such as violating privacy or antitrust laws, and economic incentives, such as giving information that will benefit their competitors. A firm that has been attacked might prefer to keep such information private out of a worry that its sales or stock price will fall. Further, there are no existing mechanisms to reward firms for sharing information. Their competitors can take advantage of the information, but not contribute in turn. This lack of reciprocity, called "free riding" by economists, may discourage firms from sharing. Information that is shared may not be applicable to those receiving it, or it might be difficult to apply.
Because firms are reluctant to share information, other firms suffer from vulnerabilities that could be corrected. Further, by not sharing information about effective cybersecurity products and techniques, the size and quality of the market for cybersecurity products suffer.
Some industry leaders call for mandatory sharing of information concerning attacks. Other experts advocate a strictly voluntary approach, because they believe it could impose fewer regulatory costs on businesses and cost less for taxpayers.
A number of bills designed to encourage cybersecurity information sharing have been introduced in the 114th Congress, including H.R. 1560, Protecting Cyber Networks Act; H.R. 1731, National Cybersecurity Protection Advancement Act of 2015; and S. 754, Cybersecurity Information Sharing Act of 2015 (CISA). In April 2015, the House passed both H.R. 1560 and H.R. 1731, and it combined them into H.R. 1560 with the original H.R. 1560 as Title I and H.R. 1731 as Title II. On March 17, 2015, the Senate Select Committee on Intelligence reported out S. 754.