The Economic Consequences of Sharing Security Information 1

Information technology (IT) security has emerged as an important issue in the last decade. To promote the disclosure and sharing of cyber-security information amongst firms, the US federal government has encouraged the establishment of many industry based Information Sharing & Analysis Centers(ISACs) under Presidential Decision Directive/NSC-63. We develop an analytical framework to investigate the competitive implications of sharing information about security breaches and investments in technologies which promote security. Using a game-theoretic model, we point out how firm and industry characteristics affect the incentives for information sharing amongst competing firms and their impact on firms ’ profits. We find that security technologies and information sharing act as “strategic complements in equilibrium”. Our paper points out that by joining such alliances, firms can benefit from a “direct effect ” which increases demand and a “strategic effect ” which alleviates price competition. Our results suggest that information sharing is more valuable when product substitutability is higher, suggesting that information is of greater value in more competitive industries. We also highlight that sharing security information is more valuable for larger firms and in larger industries. Our model points out that “demand-side spillover ” effects boosts sharing levels and lead to higher prices. Conversely, “cost-based spillovers ” lead to lower sharing and lower technology investments. Finally we show that optimal levels of technology invested and information shared are higher in a sequential mode than in a Bertrand-Nash mode