Antitrust Law Daily Wrap Up, ANTITRUST NEWS: U.S. House passes second cybersecurity bill, providing antitrust exemption, (Apr 23, 2015)

By Greg Hammond, J.D.

The U.S. House of Representatives passed a bill (H.R. 1731) today that would amend the Homeland Security Act of 2002 to improve multi-directional sharing of information concerning cybersecurity risks, to strengthen privacy and civil liberties protections, and to provide an antitrust exemption for entities sharing information relating to the prevention, investigation, or mitigation of a cybersecurity risk or incident. The bill, entitled “National Cybersecurity Protection Advancement Act of 2015,” was approved one day after companion bill H.R. 1560 was passed, which seeks to amend the Homeland Security Act of 2002 by enhancing the sharing of information concerning cybersecurity threats.

Among other changes, H.R. 1731 would allow non-federal entities to share their information systems or the information systems of other federal or non-federal entities—with written consent—with other non-federal entities or the national cybersecurity and communications integration center. Prior to sharing, however, federal and non-federal entities would be required to take reasonable efforts to remove information that can be used to identify specific individuals and is unrelated to cybersecurity risks or incidents, and safeguard information that can be used to identify specific individuals from unintended disclosure or unauthorized access or acquisition.

The bill also provides for an antitrust exemption, stating that “it shall not be considered a violation of any provision of antitrust laws for two or more non-Federal entities to share a cyber threat indicator or defensive measure, or assistance relating to the prevention, investigation, or mitigation of a cybersecurity risk or incident, for cybersecurity purposes under this Act.” However, “Nothing in this section may be construed to permit price-fixing, allocating a market between competitors, monopolizing or attempting to monopolize a market, or exchanges of price or cost information, customer lists, or information regarding future competitive planning.”

The bill also creates a private cause of action that individuals can bring against the federal government in the event a federal agency intentionally or willfully violates restrictions on the use and protection of voluntarily shared indicators or defensive measures.

Similarly, H.R. 1560 allows non-federal entities to share and receive indicators or defensive measures with other non-federal entities or certain federal entities. Further, non-federal entities may share indicators of defensive measures with the Department of Defense or the national Security Administration only if authorized by applicable law or regulation other than the proposed Protecting Cyber Networks Act. Non-federal entities, however, must take measures to implement security controls in order to protect against unauthorized access or acquisitions and take reasonable efforts, prior to sharing an indicator, to remove information that the non-federal entity reasonably believes to be personal information of, or information identifying, a specific individual not directly related to a cybersecurity threat.

A similar bill was introduced in the U.S. Senate in March 2015. The purpose of S.754, entitled the “Cybersecurity Information Sharing Act of 2015,” is to combat cybersecurity threats by creating incentives for the sharing of threat information between private entities, and between private entities and the government, by offering liability protection to the private sector when sharing such information, in a manner that still protects individual privacy and civil liberties.

Similar to H.R. 1731, S.754 specifies that it would not be considered a violation of any provision of the antitrust laws for two or more private entities to disclose or exchange cyber threat indicators, nor to cooperate in the prevention, investigation, or mitigation of a cybersecurity threat. The antitrust liability protection would be limited to information stored or processed on an information system.

News: Antitrust ConsumerProtection Privacy