Problem
In 2015, Congress was considering legislative proposals that would seek to increase the amount of cyber threat information that is shared with the government. A number of important stakeholders thought that sounded like a terrible idea. They were concerned that if more and more information is shared with the government, our privacy and civil liberties will be slowly eroded.
Congress, therefore, wrote into the legislation that the Departments of Justice and Homeland Security would be required to issue detailed guidance on how this information sharing would work. So in this case, Congress passed a broad statute that required the Executive Branch to issue more specific and tailored guidance. Notice that a statute reads differently than a guidance document. A statute is precise, specific, very technical writing. A guidance document is much easier to understand, although it is quite technical as well. You will see that the guidance starts with definitions, includes some graphics that hopefully allow the reader to better understand the guidance, and also gives examples of how to apply the guidance.
One of the most important sections of the guidance is where it lists the various protections that companies can experience if they share information with the government. You will also read a law review article that explains how the Automated Indicator Sharing program - the machine-to-machine capability that DHS created - protects privacy and civil liberties.
Read the materials and discuss as follows: Today, in 2022, with this law still in effect, what are the incentives and disincentives for companies to share information about the cyber attacks they are facing? What are the incentives and disincentives for companies to share among themselves? With the U.S. government? Why would a company share or not share?