Yesterday, the Federal Trade Commission ("FTC") and the Department of Justice ("DOJ") – the two federal antitrust enforcement agencies – issued a joint antitrust Policy Statement regarding arrangements through which industry participants, including competitors, share cybersecurity information. The statement outlines the agencies' enforcement policy and analytical approach to information exchanges focused on cybersecurity issues. The Policy Statement makes clear that the antitrust laws do not stand as "a roadblock to legitimate cybersecurity information sharing." In fact, the Assistant Attorney General for DOJ's Antitrust Division, Bill Baer, called the Policy, which gives industry a great deal of leeway to share cybersecurity information, an "antitrust no-brainer."
The antitrust laws have traditionally treated exchanges of information between and among competitors with a fair amount of suspicion. This Policy Statement is intended to give companies, even if they compete, the green light to share much needed information to protect against cyber-attacks. And it serves as yet another indicator that the agencies consider cybersecurity as a major threat to the nation's economy and security. From an antitrust perspective, the ability for industries to collaborate to prevent attacks is particularly relevant, given the FTC's recent spate of aggressive investigations and enforcement actions for data breaches that expose consumers' sensitive information, both personal and financial data, to either unintentional disclosure or theft by cybercriminals.
The agencies and the Obama administration have recognized the complexities associated with addressing these rapidly evolving threats, which require both companies and government agencies constantly to adapt to defend against new types of attacks. Given both the economic and national security concerns raised by cybersecurity, the Obama administration issued a February 2013 Executive Order on the importance of government/business collaboration on cybersecurity. That order in turn led the National Institute of Standards and Technology ("NIST"), in February 2014, to issue a voluntary cybersecurity framework.
As the FTC and DOJ note in their Policy Statement, public/private collaboration alone cannot solve the cybersecurity issues that U.S. companies face. Companies must also collaborate to share information about emerging threats, as well as to share potential solutions. In fact, the most useful information-sharing is often not from government or from other areas of the economy, but among companies in the same industry–whether energy, financial services, retail, healthcare or hospitality—which tend to be targeted by similar malware and/or the same groups of attackers. The agencies note that some formal and informal private-to-private information sharing mechanisms (like Information Sharing and Analysis Centers ("ISACs")) do exist in certain industries, but note that some companies have expressed a reluctance to share information with their competitors due to antitrust concerns.
To allay these concerns, the Policy Statement outlines the agencies' general policy on information exchange, as well as the specific analysis they apply to exchanges of cybersecurity information. The agencies' approach to information sharing is spelled out in the 2000 Competitor Collaboration Guidelines and the 1996 Health Care Guidelines. Generally speaking, the agencies are primarily concerned with exchanges involving competitively sensitive information – e.g., recent, current and future pricing, cost information, and output information – because such exchanges might facilitate market allocation or price fixing among competitors.
Generally, information exchanges, without more, are not illegal per se. Instead, the antitrust agencies apply a balancing test known as the "rule of reason," which weighs the potential procompetitive benefits associated with an exchange against the anticompetitive harm that might result. In performing this analysis, the agencies focus on the context in which the information is exchanged, the parties exchanging the information, the nature of the information exchanged, and whether the exchange generates any procompetitive benefits, like increased efficiency, lower costs, or increased output.
In the Policy Statement, the agencies walk through how the general information exchange analysis would apply to exchanges of cybersecurity information. First, the agencies note that such exchanges increase efficiency and improve information security, both of which are procompetitive. Second, the agencies address the nature of the information, explaining that cybersecurity information tends to involve highly technical information. For example, the agencies note that companies might exchange a known source IP address for a denial of service attack or a threat signature for a new type of attack. Information such as this is not the type of competitively sensitive information relating to price, cost, or output that generally concerns the agencies. Accordingly, if companies confine their sharing to technical information that does not reveal information traditionally treated as competitively sensitive, the antitrust risks should be minimal, at best.
Finally, the agencies consider any potential harm to competition caused by an exchange of cybersecurity information. Due to the fact-specific nature of this inquiry, the agencies reference DOJ's October 2000 business review letter to the Electric Power Research Institute, Inc. ("EPRI"), in which it analyzed a proposed cybersecurity information exchange program.
EPRI is a nonprofit organization focusing on technological solutions to issues in the energy industry. It proposed exchanging information concerning best practices and information relating to vulnerabilities. In time, EPRI anticipated its members engaging in discussion or analysis of real-time cybersecurity threats. In evaluating the exchange, the DOJ noted that the information exchanged would focus on cyber and physical security, and that EPRI had said it would not allow participants to exchange either price or cost information, or vendor recommendations. Ultimately, the DOJ concluded that:
[a]s long as the information exchanged is limited...to physical and cybersecurity issues, the proposed interdictions on price, purchasing and future product innovation discussions should be sufficient to avoid any threats to competition. Indeed, to the extent that the proposed information exchanges result in more efficient means of reducing cybersecurity costs, and such savings redound to the benefit of consumers, the information exchanges could be procompetitive in effect.
Both the new Policy Statement and the underlying EPRI business review letter should give companies comfort that collaborating on cybersecurity issues with competitors will not lead to scrutiny from the agencies. Nonetheless, counsel should be careful to remind participants in such exchanges to keep them focused on technical issues, as broadening the scope of the discussion to include vendor recommendations, pricing, or cost will create antitrust risk.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
