Interaction between the U.S. intelligence community and the private sector in sharing cyber threat intelligence

This research investigates cyber threat intelligence sharing between the U.S. Intelligence Community and the private sector in response to the question, “How important is cyber threat intelligence-sharing among the factors in determining the successful defense against an attempted cyber incident?” The approach to the problem employs two methods: (1) A qualitative analysis of cyber threat intelligence sharing policies and practices; and (2) the comparative case study and process-tracing methods, which illustrate the flow of cyber threat intelligence sharing—or its absence. Documentary sources used in this analysis have been collected from declassified government documents and publicly available reports, policy statements, and media reporting. There is also a small, but relevant, academic literature that traces the patterns and problems of intelligence sharing. Threat actors jeopardize the security of the public-private entities and U.S. national security by using cyber elements. Therefore, the research claims that intelligence sharing between the IC and PS is a crucial component of how successful a cyber defense against threat actors will be before the attack as protection, during the attack as response, and after the attack as recovery. The chance of successful defense which includes prevention, detection or timely response in a cyber incident will significantly increase as the amount and quality of timely, accurate, and actionable intelligence shared through appropriate means increases.