  As cybercriminals scale up their operations to increase their profits or
inflict greater harm, we argue that there is an equal need to respond to their
threats by scaling up cybersecurity. To achieve this goal, we have to develop a
co-productive approach towards data collection and sharing by overcoming the
cybersecurity data sharing paradox. This is where we all agree on the
definition of the problem and end goal (improving cybersecurity and getting rid
of cybercrime), but we disagree about how to achieve it and fail to work
together efficiently. At the core of this paradox is the observation that
public interests differ from private interests. As a result, industry and law
enforcement take different approaches to the cybersecurity problem as they seek
to resolve incidents in their own interests, which manifests in different data
sharing practices between both and also other interested parties, such as
cybersecurity researchers. The big question we ask is can these interests be
reconciled to develop an interdisciplinary approach towards co-operation and
sharing data. In essence, all three will have to co-own the problem in order to
co-produce a solution. We argue that a few operational models with good
practices exist that provide guides to a possible solution, especially multiple
third-party ownership organisations which consolidate, anonymise and analyse
data. To take this forward, we suggest the practical solution of organising
co-productive data collection on a sectoral basis, but acknowledge that common
standards for data collection will also have to be developed and agreed upon.
We propose an initial set of best practices for building collaborations and
sharing data and argue that these best practices need to be developed and
standardised in order to mitigate the paradox.
