The Information-Sharing Cooperative That Shares Too Much
A cross-sector information sharing and analysis organization (ISAO) with 240 members runs a threat-intelligence platform. Members upload indicators of compromise, incident narratives, and sometimes raw packet captures. An analyst at a member utility uploads a packet capture that inadvertently contains employee credentials and a customer's account number. The ISAO's sharing agreement says members grant a broad license to redistribute 'shared threat data' to all members and to government partners. A government partner requests the full dataset, including the packet capture. One member's counsel objects that redistribution could expose the member to liability and violate its own privacy commitments. The ISAO's board must decide how to respond to the government request and whether to change the platform's design.
1. Should the ISAO fulfill the government request as-is, and what legal and policy factors drive the answer?
Read the worked answer
Not as-is. The request should be scoped and sanitized first.
Factors:
- The sharing agreement's broad license is not a privacy shield. A license to redistribute threat data does not cure the member's separate obligations to its employees and customers. The ISAO inherits that exposure when it redistributes.
- Accidental personal data: credentials and an account number are not threat intelligence. Redistributing them widens a privacy incident.
- Government sharing protections vary: many frameworks provide liability protections for good-faith sharing of cyber threat indicators but condition them on removing personal information not directly related to a cybersecurity threat. The sanitization step is what preserves the protection.
- Member trust is the platform's core asset. One careless redistribution can collapse participation.
Recommended action: sanitize the dataset (strip credentials and the account number), provide the threat indicators and narrative to the government partner, notify the affected member, and document the sanitization. Then fix the agreement.
2. What design changes should the board make to the platform and sharing agreement?
Read the worked answer
- Automated pre-sharing scrubbing for credential patterns and account-number formats before anything enters the shared pool, with a human review step for raw captures.
- Tiered sharing: a sanitized indicator tier open to all members and government partners; a restricted tier requiring explicit member consent per share.
- Revised agreement that (a) narrows the redistribution license to sanitized threat data, (b) requires members to warrant they have scrubbed personal data, and (c) defines a process for handling accidental disclosures.
- Government-request handling procedure with legal review, scoping, and a log.
The governing principle: information sharing works on trust and on the legal protections that come from disciplined handling. Breadth of sharing is not the goal; lawful, sanitized, repeatable sharing is.