Three Models for Sharing Cybersecurity Incident Information: A Legal and Political Analysis

Though the international laws are applicable not only to the real world but also to cyberspace, the Internet is vulnerable against cyberattack, because it is fairly difficult to identify the real actor, when the attack is made by ‘bots’ or through anonymization methods(attribution problem). As the early Internet took for granted that the research community can maintain self-governance easily, concept of security-by-design is lacking. Hence the offenders have advantages over defenders, and the only effective measure for the defenders is the sharing of cybersecurity incident information, in order to analyze the characteristics of attack, and prepare for the next one. There are three types of sharing mechanism in the world; USA, EU, and UK models. This paper compares these models, and tries to extract some lessons for the future as well as for the other countries or areas. The most important factors for choosing the proper model are aggregated comparative advantages of defense, police, intelligence, and IT-related industry powers of the State concerned.