Sharing is caring

ON JANUARY 12th hackers calling themselves the “CyberCaliphate” briefly took over the Twitter and YouTube accounts of US Central Command (Centcom), which oversees America’s military operations in the Middle East and south Asia. The intruders posted a series of messages in support of Islamic State before they were booted off the social-media feeds.

The episode was an embarrassment rather than a grave threat to America’s security. But it was yet another reminder, after the humiliating attack on Sony Pictures Entertainment, that hacking has become a huge headache (see chart). This week Barack Obama unveiled proposals to counter the threat.

Among them is a national data-breach law, requiring companies that have been hacked to reveal it within 30 days if personal data may have gone. Fans hope this will pre-empt the patchwork quilt of state laws governing breach reporting, which Scott Vernick of Fox Rothschild, a law firm, calls a “costly legislative soup” (see article).

Another proposal would make it easier for companies to share intelligence about digital threats with the government. Speeding up this flow matters. Hackers often use the same methods on many targets. So if knowledge of their techniques travels swiftly and counter-measures are developed fast, their efforts can be frustrated.

Many industries have set up bodies that help companies alert each other to new threats. But experts say firms are still wary of sharing, in case it leads to lawsuits from customers and antitrust watchdogs. A previous congressional attempt to give them greater legislative protection failed because it did not do enough to protect people’s data. Privacy activists worry that data shared as part of threat intelligence will be scooped up by the National Security Agency (NSA), whose appetite for information was highlighted by Edward Snowden’s blockbuster revelations.

Mr Obama wants companies to give their data to the Department of Homeland Security, not the NSA. Chris Finan, a former cyber-security aide in the White House, says this shows that the president wants information to flow into an agency whose job is to protect America’s critical infrastructure, rather than a spy agency.

That may reassure some folk, but there needs to be clarity about how this information is shared within government. The proposal sensibly tries to protect privacy by recommending that unneeded personal information is stripped out of threat intelligence before it is shared and demanding strict controls on the use of what remains. But the devil will be in the details.

This initiative and the mooted federal data-breach law may be partly aimed at heading off a dispute with Europe over privacy rules that could hamper trade. Current EU data-protection laws prohibit the transfer of personal data to countries with weak privacy regimes, and European officials are hinting that America’s is not up to snuff. New legislation later this year could well create an EU-wide system for threat-intelligence sharing and require breach notifications for a broad swathe of industries, too. If Mr Obama’s proposals survive the congressional sausage machine, America and Europe could end up with similar approaches to the hacking plague.