Echoing guidance previously given to a nonprofit organization looking to exchange certain cybersecurity information, including exchanging actual real-time cyber threat and attack information, and others planning to exchange information concerning remediating the Y2K problems, the Department of Justice (“DOJ”) and Federal Trade Commission (“FTC”) recently released a joint “Antitrust Policy Statement on Sharing of Cybersecurity Information” (“Statement”).
In his prepared remarks announcing the release of the Statement, Assistant Attorney General Bill Baer rightly stated: “This is an antitrust no-brainer: Companies who engage in properly designed cyber threat information sharing will not run afoul of the antitrust laws. This means that as long as companies don’t discuss competitive information such as pricing and output when sharing cybersecurity information, they’re okay.”
So, what do you need to do if you want to share your technical cyber threat information with your neighbors? According to the Statement, the first thing you need to do is make sure the information sharing arrangement is not “being used as a cover to fix prices, allocate markets, or otherwise limit competition.” If it is, you have a big problem. That said, you should be in the clear if the sharing arrangement is limited to technical cyber threat information, e.g., threat signatures and IP address or target ports of a Denial of Service attack. “The sharing of this type of information” the Statement says, “is very different from the sharing of competitively sensitive information such as current or future prices and output or business plans which can raise antitrust concerns.”
As one of the nation’s largest and most comprehensive practices in the area of data privacy and information security, we partner with clients to mitigate reputational and financial risks. If you have any questions regarding this topic, or our data privacy and information security practice more generally, please contact Gerald J. Ferguson, gferguson@bakerlaw.com or 212.589.4238, Theodore J. Kobus III, tkobus@bakerlaw.com or 212.271.1504, or Pamela Jones Harbour, pharbour@bakerlaw.com or 202.861.1558; or if you would like to learn more about our antitrust capabilities, please contact Ms. Jones Harbour or Jonathan L. Lewis, jllewis@bakerlaw.com or 202.861.1557.