Cybersecurity Finger-Pointing

Full Document Available in PDF

We face unprecedented information security vulnerabilities in our hyper-networked, global economy. Leaving the path clear for private, technical, market, and contractual solutions, and avoiding governmental mandates that impede contractual liability and insurance markets, should take priority. Embracing legislation or mandates can mean locking in collective “solutions” that may be hard to correct, undermining information security rather than enhancing it. Policymakers, along with the computing and infrastructure industries, should think carefully before implementing further federal regulation over risk allocation.

The principle for cyber-risk allocation, as much as one can be defined, is that government’s protection function should not overburden the ability of markets to self-insure or self-protect via technology, contractual liability and insurance instruments. Although there is not always a bright line, government must better distinguish between proper public and private responsibilities in information security, and avoid dictates that interfere with these private alternatives as  technologies or other conditions change. Interventionist approaches will create jealousies among players, and lead to a politically driven hodgepodge of liabilities and immunities. Uncritical government assumption of responsibility for network and critical infrastructure risks can roll back progress without contributing to information security, cybersecurity or even national security.