Antitrust Law Daily Wrap Up, ANTITRUST NEWS: Agencies attempt to encourage cyber threat information sharing with policy statement, (Apr 10, 2014)

By Jeffrey May, J.D.

In what Assistant Attorney General Bill Baer calls “an antitrust no-brainer,” the Department of Justice Antitrust Division and the FTC today issued a joint antitrust policy statement explaining that companies who engage in properly designed cyber threat information sharing will not run afoul of the antitrust laws. Essentially, companies can share technical cyber threat information—such as threat signatures, indicators, and alerts—as long as they do not discuss competitive information, such as pricing and output.

“Some private entities may be hesitant to share cyber threat information with each other, especially competitors, because they have been counseled that sharing of information among competitors may raise antitrust concerns,” the policy statement notes. “The Agencies do not believe that antitrust is—or should be—a roadblock to legitimate cybersecurity information sharing.”

The policy statement explains the agencies’ analytical framework for information sharing and the competition issues that may arise with information exchanges generally. Typically, the agencies examine information sharing agreements under a rule of reason analysis, which considers the overall competitive effect of an agreement. The agencies recognize that the sharing of cyber threat information can be beneficial. It can improve efficiency and help secure the county’s networks of information and resources.

As part of the antitrust analysis, the agencies consider the nature of the cyber threat information to be shared among the private parties. It was noted that the sharing of technical information, such as a signature for a previously unknown malware threat, is very different from the sharing of competitively sensitive information, such as current or future prices and output or business plans, which can raise antitrust concerns.

Finally, cyber threat information covers a limited category of information and disseminating information of this nature appears unlikely to harm competition. Because the agencies will consider the likelihood that the proposed information exchange will harm competition, companies should limit the information exchanged to cybersecurity issues.

In prepared remarks, Baer reminded businesses about the Antitrust Division’s business review process. Under that procedure, an organization can talk to the division about a proposed action and its potential antitrust implications and receive a written statement as to whether the division intends to challenge the action under the antitrust laws.

Baer noted that the Antitrust Division reviewed a cybersecurity information sharing arrangement under the business review procedure in 2000 and concluded that it had no intention of taking enforcement action against a research institute’s proposal. The legal analysis in the letter remains very current, according to the policy statement.

“Private parties play a key role in mitigating and responding to cyber threats,” Attorney General James M. Cole said at a pen and pad briefing. He noted that he has been meeting with companies around the country, talking “about the importance of sharing information among all relevant parties, [including] the need for companies to share with the government, the need for the government to share with companies, and the need for companies to share with each other.”

FTC Chairwoman’s comments.

“Because of the FTC’s long experience promoting data security, we understand the serious threat posed by cyberattacks,” said FTC Chairwoman Ramirez. “This statement should help private businesses by making it clear that antitrust laws do not stand in the way of legitimate sharing of cybersecurity threat information.”

News: Antitrust AntitrustDivisionNews FederalTradeCommissionNews