FROM: U.S. JUSTICE DEPARTMENT
Friday, October 3, 2014
Department of Justice Will Not Challenge Proposed Cyber Intelligence Data-Sharing Platform
The department’s position was stated in a business review letter to counsel for CyberPoint, from Bill Baer, Assistant Attorney General in charge of the Department of Justice’s Antitrust Division.
CyberPoint’s proposed information sharing system is designed to address shortfalls in conventional, legacy information sharing services, while operating within the framework set forth in the Department of Justice and Federal Trade Commission’s Antitrust Policy Statement on Sharing of Cybersecurity Information.[1] Assistant Attorney General Baer cited to the department’s April policy statement with the Federal Trade Commission to underscore that “the federal antitrust agencies recognize the important role that information sharing plays in securing the nation’s IT infrastructure.” He further said that “[t]he antitrust laws are not an impediment to legitimate private-sector initiatives to share specific information about cyber incidents and mitigation techniques in order to defend against cyber attacks.” In approving the proposed TruSTAR platform, he concluded that the operation of the TruSTAR platform, as proposed, would be unlikely to facilitate price or other competitive coordination.
CyberPoint is a privately held company that provides security products, services and solutions to commercial and government customers. The TruSTAR platform is designed to collect incident reports that include specific and highly technical cyber-threat information, including current attack actors, targets of attack, contextual information regarding threats, and remediation solutions. An important component of the TruSTAR platform is that members are able to submit incident reports with complete anonymity. The TruSTAR platform also provides a community forum for members to anonymously collaborate with their peers on cyber threats and techniques for responding to them. Before they are permitted to use the system, all members who participate in any aspect of information sharing on the TruSTAR platform must agree not to share competitively sensitive information.
Under the department’s business review procedure, an organization may submit a proposed action to the Antitrust Division and receive a statement as to whether the division currently intends to challenge the action under the antitrust laws based on the information provided. The department reserves the right to challenge the proposed action under the antitrust laws if it produces anticompetitive effects.
A file containing the business review request and the department’s response may be examined in the Antitrust Documents Group of the Antitrust Division, U.S. Department of Justice, 450 Fifth Street, N.W., Suite 1010, Washington, D.C. 20530. After a 30-day waiting period, the documents supporting the business review will be added to the file, unless a basis for their exclusion for reasons of confidentiality has been established under the business review procedure.
[1] See Department of Justice and Federal Trade Commission: Antitrust Policy Statement on Sharing of Cyber Security Information (April 10, 2014) (“DOJ and FTC Antitrust Policy Statement”).
