The Protection Paradox

The everyday American expects certain basic services from her government. She expects her roads to be maintained, her mail to be delivered, and her communities to be kept reasonably safe and orderly. Beyond these core services, she also expects something more fundamental: that the government will respect (and ideally protect) her rights to life, liberty, and property. And if the government falls short of fully protecting those rights, it should at least refrain from undermining them.

Federal executive agencies should be created with these principles in mind. Congress delegates authority to these agencies to carry out specific missions such as protecting workers, ensuring fair markets, safeguarding investors, and promoting public welfare. In theory, these regulatory bodies exist to reinforce a system in which individuals are free to work, innovate, and build businesses within a fair and stable framework.

But in practice, a paradox often emerges. Regulations designed to protect the public can end up restricting opportunity, suppressing innovation, and hindering the very individuals they are meant to serve. This is the Protection Paradox: well-intentioned government interventions create structural barriers that entrench incumbents and hurt the public by squeezing out smaller competitors.

This report advances a single claim: certain modern regulatory frameworks can, under identifiable structural conditions, invert their protective purpose by embedding private gatekeeping authority or asymmetric enforcement power. These structures suppress innovation, entrench incumbents, and erode due process. Case studies from the Occupational Safety and Health Administration (OSHA) and the Securities and Exchange Commission (SEC) illustrate two distinct mechanisms through which this inversion occurs. They highlight how regulatory frameworks can unintentionally operate as barriers to competition rather than guardians of public health and safety. OSHA Standards 29 C.F.R. §§ 1926.453 and 1910.67 demonstrate how private delegation can function as market gatekeeping, while the SEC enforcement proceedings show how enforcement asymmetries and settlement pressures can coerce outcomes and suppress dissent.

By shedding light on these dynamics, this report calls for a closer examination of how regulatory systems function in practice. Understanding the Protection Paradox can help determine whether those systems truly serve the individuals they are meant to protect. Moreover, the Paradox is a framework for evaluating whether regulatory systems continue to serve their stated protective purposes or whether their institutional design has unintentionally shifted costs onto the very individuals they were intended to protect.

This report will look first at OSHA Standards 29 C.F.R. §§ 1926.453 and 1910.67 and their requirements for safety innovations to mobile elevating work platforms (MEWPs), and then at the SEC’s administrative proceedings that enforce securities regulations.

OSHA’s unsafe safety regulations

The safety certification framework

OSHA was established under the Occupational Safety and Health Act of 1970 to reduce workplace injuries, illnesses, and fatalities by developing and enforcing nationwide safety standards.[1] In carrying out this mission, OSHA frequently relies on private technical standards, particularly those developed by the American National Standards Institute (ANSI). It often incorporates those standards by reference into its regulations. This public-private approach serves an important function. It allows OSHA to leverage industry expertise, reduce regulatory drafting costs, and promote uniform safety practices across sectors.

One such regulatory framework, OSHA Standards 29 C.F.R. §§ 1926.453 and 1910.67, governs modifications to aerial lifts and MEWPs. MEWPs are widely used in construction, maintenance, and industrial operations. Industry workers and experts are often best positioned to develop solutions or equipment modifications to address MEWP safety shortfalls. Most safety-enhancing attachments or design improvements are developed by small-business innovators. Because these machines operate at height and under varying load conditions, modifications can introduce significant safety risks, including instability, structural failure, and electrocution.

To address these risks, OSHA requires that any “field modification” be certified in writing as safe and compliant by either the original equipment manufacturer (OEM) or an “equivalent entity.”[2] The agency defines an “equivalent entity” as a qualified organization or individual capable of performing the same technical evaluation as the manufacturer, such as a nationally recognized testing laboratory or qualified engineer.[3] Presumably, the “equivalent entity” option prevents OEMs from monopolizing the certification process.

The equivalent-entity option serves an important regulatory purpose. Rather than making OEM approval the exclusive means of certification, the regulation theoretically allows independent engineers or qualified testing organizations to evaluate whether a modification can be safely used. In principle, this alternative is designed to reduce reliance on manufacturers alone while preserving OSHA’s safety objectives.

In practice, however, the availability of an equivalent entity does not necessarily provide a comparable alternative for many small innovators. Independent engineering review often requires extensive testing, structural analysis, and model-specific evaluations, all of which can impose substantial costs. Because certifications frequently cannot be transferred across equipment models, these expenses multiply rapidly as innovators seek broader commercialization. As a result, although the equivalent-entity pathway serves a legitimate safety function, it may be economically unrealistic for many small businesses.

From safety mechanism to market gatekeeper

On their face, OSHA Standards 29 C.F.R. §§ 1926.453 and 1910.67 reflect a sound and fair safety policy that ensures field modifications are certified safe by engineers before workers use them. In practice, however, the certification requirement operates as a form of private market control by OEMs that deprives workers of useful field modifications.

OEMs may decline certification requests, delay responding, or fail to respond altogether. When any of these occur, the regulatory framework provides innovators with little practical recourse or administrative process for obtaining a timely determination. The regulations do not provide small or independent innovators with any legal remedy or process to check OEM obstruction. The only option is to obtain certification by an “equivalent entity.”[4] However, the “equivalent entity” option for certifications is rarely economically feasible for small or independent innovators.

“Equivalent entity” certification costs can be substantial because the process involves structural calculations, load testing, stability analysis, and extensive documentation to demonstrate compliance with applicable standards. Lifts vary by manufacturer, model, and configuration. Engineering analysis must therefore be conducted on a model-by-model basis. This makes safety certifications rarely transferable across different makes and models of aerial lifts, even when the designs are identical.

Certification costs often reach thousands or tens of thousands of dollars per model. For an invention intended to be used across different lift models, these costs multiply quickly. The high cost can make the “equivalent entity” pathway an unrealistic alternative to OEM approval for small-business innovators. As a result, small businesses with standard products often turn to OEMs for certification to keep costs down. Certification by original manufacturers requires less rigorous testing, which lowers costs.

This dynamic creates a structural vulnerability. When OEMs decline to certify a modification, delay their response indefinitely, or fail to respond at all, innovators cannot bring their product to market because no one would use or buy it without it meeting OSHA’s safety standards.

These OSHA regulations impose no deadline for manufacturer response, no obligation to provide justification for denial, and no formal mechanism for appeal. The result is an administrative vacuum, a regulatory gap in which inaction effectively operates as a veto. The regulatory framework allows an OEM to block from the market products intended to keep workers safe without issuing a formal denial, leaving innovators without recourse.

This outcome reflects the core of the Protection Paradox.

Case study: Forrest Hester

Forrest Hester, an electrician and small-business inventor, developed a safety enhancement for mobile elevating work platforms (MEWPs) after witnessing numerous workplace injuries caused by tools and materials falling from elevated work areas. His invention consisted of a mesh netting system that lined the boom of a lift, preventing objects from falling and striking workers below. The product was designed as a simple, practical, and cost-effective way to reduce a well-known workplace hazard. Through his small manufacturing company, Hester brought the product to market and quickly attracted interest from equipment owners and rental companies. Several customers expressed a willingness to purchase the system, recognizing its potential to improve workplace safety.

That interest, however, was dependent on the product receiving certification from the original equipment manufacturers whose lifts would be modified by the netting system. Seeking the most practical path to compliance under 29 C.F.R. §§ 1926.453 and 1910.67, Hester approached the relevant manufacturer for certification. The manufacturer requested product samples, negotiated reduced pricing, and required design modifications and additional testing, while indicating that certification would follow. After months of communication and compliance efforts, however, the manufacturer stopped responding and never issued a certification. Because the product lacked OSHA-compliant approval, prospective customers withdrew from their agreements, and the product never reached widespread commercial use.

The question of whether the manufacturer declined certification for legitimate engineering concerns, business considerations, or simply failed to complete the review is ultimately beside the point. The central issue is not the manufacturer’s motive, but the regulatory structure itself. Once the certification process stalled, the regulatory framework provided no deadline for action, no requirement to explain, and no meaningful administrative mechanism through which Hester could obtain review or challenge the lack of a decision. In that sense, the absence of a decision operated as a practical veto over market access.

Safety, competition, and structural consequences

While OSHA’s certification requirement was designed to ensure that modifications are safe, it effectively put control of market access in the hands of incumbent manufacturers that may have little incentive to facilitate third-party innovations.

This system affects more than market dynamics. It directly affects workers’ safety.

Many third-party innovations are designed to address real and persistent hazards of MEWPs, including falls, dropped objects, and lift instability. When regulatory structures prevent these innovations from reaching the market, workers may be denied access to safety improvements that could reduce injury or death.

This is the Protection Paradox in its gatekeeping form: safety regulation functioning as a barrier to safer innovation.

When investor protection becomes institutional protection

The SEC enforcement framework

Congress created the Securities and Exchange Commission to protect investors, maintain fair and orderly markets, and facilitate capital formation. At its core, the agency’s mission reflects a foundational premise of securities regulation: markets function effectively only when participants have access to reliable information and are protected from fraud and deception.

To carry out this mission, the SEC is vested with broad enforcement authority. It may bring civil actions in federal court or pursue enforcement through administrative proceedings conducted within the agency itself.[5] In both forums, the SEC operates with substantial institutional advantages compared to defendants. These advantages include specialized expertise, dedicated enforcement personnel, and expansive investigatory tools.

As with many regulatory frameworks, this structure serves legitimate purposes. Centralized enforcement promotes consistency, expertise enhances accuracy, and robust investigative authority allows the agency to detect and deter misconduct that might otherwise go unchecked.

Yet the effectiveness of this framework depends not only on its formal authority but also on how it operates in practice, particularly for those subject to enforcement.

Structural asymmetry and the cost of defense

A defining feature of the SEC’s enforcement regime is the asymmetry between the agency and the individuals or entities it regulates.

Unlike criminal proceedings, there is no right to appointed counsel in SEC enforcement actions. Defendants must either retain private legal representation (often at significant cost) or attempt to navigate a highly technical regulatory system on their own. Securities law is complex, fact-intensive, and procedurally demanding, making self-representation exceptionally difficult.[6]

At the same time, the SEC benefits from continuity of expertise, institutional knowledge, and the ability to spread enforcement costs across a large portfolio of cases. The agency operates with a stable budget, a salaried staff of attorneys and investigators, and established litigation infrastructure. The agency spreads these costs across hundreds of enforcement matters simultaneously. Defendants, by contrast, must individually bear the costs of attorneys’ fees, expert witness fees, and document production expenses. Such costs accrue rapidly, often at the precise moment when the defendant’s assets or business operations may already be under stress from the investigation itself.

This imbalance has practical consequences. Even when defendants have viable legal defenses, the expected cost of litigating against the government, combined with the uncertainty and duration of the proceedings, can outweigh the expected benefit of prevailing. As a result, outcomes are often shaped less by the merits of the case than by the economics of defending it.

Recent Supreme Court jurisprudence has reinforced the importance of procedural protections in this context. In SEC v. Jarkesy, the Court held that certain enforcement actions seeking civil penalties implicate the right to a jury trial.[7] While this decision restores defendants’ constitutional rights, it does not eliminate the underlying structural pressures that influence whether defendants can realistically exercise those rights.

Case study: The Renfroe family business

Paul Renfroe’s experience illustrates how these dynamics operate in practice. Renfroe, a small-business entrepreneur, raised approximately $1.2 million to develop a family-run video game business. The fundraising effort relied largely on personal networks rather than complex or large-scale public offerings.

The SEC initiated an investigation and ultimately brought enforcement actions alleging violations of federal securities laws. The process spanned several years and imposed substantial legal costs, reportedly exceeding $250,000.[8] The business could not bear the substantial legal costs of long-term engagement with the investigation, and therefore ultimately failed. Renfroe personally declared bankruptcy.[9] All of his investors lost their investments due to a business failure that may have been avoidable if not for the lengthy and costly SEC investigation.

The significance of this case lies not only in the alleged violations but also in the structure of the enforcement process itself. For a small business, the cost of defending against an SEC action can exceed the enterprise’s value. For many small businesses, the economics of defending against an SEC enforcement action may effectively determine the outcome regardless of the ultimate merits of the agency’s claims.

This dynamic reframes enforcement risk. It is not limited to potential liability. It includes the cost of engaging with the regulatory process. When that cost becomes prohibitive, enforcement costs may themselves become a significant barrier to market participation, particularly for small firms with limited resources.

Settlement pressure and the “no deny” rule

Given these structural pressures, it is unsurprising that a majority of SEC enforcement actions are resolved through settlement rather than adjudication.[10] Settlement offers reduced legal costs, faster resolution, and greater predictability. But it also introduces a distinct set of constraints.

For more than 50 years, SEC Rule 202.5(e),[11] commonly referred to as the SEC’s “no admit/no deny” provision, required settling defendants to agree not to publicly deny the allegations against them or suggest that the SEC’s claims lack a factual basis.[12]

Although defendants were generally permitted to settle without admitting wrongdoing, they were prohibited from publicly contesting the SEC’s narrative after settlement. Critics argued that this arrangement allowed the agency to obtain the practical benefits of an adjudicated victory without proving its case in court.

In May 2026, the SEC rescinded Rule 202.5(e), concluding that the policy was unnecessary and may have created the impression that the agency was attempting to shield itself from criticism.[13] The commission also announced that it would not enforce existing no-deny provisions contained in prior settlements.

The rescission represents a significant win for free expression and transparency. However, because the rule existed for decades as agency policy rather than congressional mandate, its elimination does not permanently resolve the underlying concern. A future commission could adopt a similar policy through rulemaking or settlement practice.

Constitutional and administrative law implications

The SEC’s enforcement structure raises broader constitutional and institutional questions beyond the outcome of any particular case. Historically, the agency has exercised substantial investigative, prosecutorial, and adjudicative authority within a single regulatory framework. While this structure may promote efficiency and specialized expertise, it also concentrates governmental power in a manner that has increasingly attracted judicial scrutiny.

Recent decisions such as SEC v. Jarkesy reflect the Supreme Court’s concerns about the extent to which agency enforcement proceedings provide the procedural safeguards traditionally associated with judicial adjudication.[14] The Court’s recognition of defendants’ right to a jury trial in certain SEC enforcement actions suggests that constitutional limits continue to play an important role in defining the scope of administrative power.

The SEC’s former no-deny rule raises related concerns about freedom of expression and governmental control over public narratives. Although the commission rescinded the rule in 2026, its existence for more than five decades illustrates how enforcement structures can evolve beyond their original protective purposes. More broadly, these developments demonstrate that the Protection Paradox is not limited to economic consequences. Regulatory systems designed to protect investors can also generate tensions involving constitutional rights, institutional accountability, and the concentration of governmental authority.

Structural consequences for market participation

The effects of the SEC’s enforcement structure extend beyond individual cases. They shape participation in the broader market.

For large, well-resourced firms, enforcement risk is often manageable because costs can be absorbed, litigated, or strategically resolved. For smaller actors, the same risks can be existential. The prospect of prolonged investigation, substantial legal expenses, and reputational constraints can deter entrepreneurs from raising capital, entering regulated markets, or pursuing innovative business models.

When participation is conditioned not only on compliance with the law but also on the ability to bear the costs of enforcement, markets may become less competitive and less dynamic. Barriers to entry rise, and established players who are better equipped to navigate regulatory complexity gain further advantage.

These outcomes are not the product of deliberate policy choices. The SEC’s mission remains focused on investor protection and market integrity. But, as with the OSHA framework, the structure of enforcement can produce unintended effects.

The Protection Paradox in the securities context creates a system that, though designed to protect investors and promote fair markets, can, in practice, discourage participation, constrain smaller actors, and reinforce structural inequalities within the market itself. Ultimately, investors pay the price.

The five elements of the protection paradox

Although OSHA and the SEC are two independent agencies with little to no overlap in function, these case studies illustrate a pattern that can emerge within the federal regulatory system. The Protection Paradox consists of five elements:

1. A legitimate government objective

The paradox begins with a genuine public purpose. Agencies seek to improve worker safety, protect investors, safeguard consumers, or promote competition. These objectives are not themselves problematic. In fact, they are often widely supported.

2. Discretionary authority becomes concentrated

To accomplish these goals, agencies or agency-created processes concentrate significant discretionary enforcement authority. Sometimes that authority is delegated to private actors, as with OSHA’s reliance on OEM certification. At other times it remains within the agency itself, as with the SEC. Regardless of where it resides, meaningful checks on that discretion are often limited.

3. Structural barriers to participation emerge

As discretionary authority expands, market participation becomes increasingly dependent on obtaining approvals, absorbing compliance costs, or navigating complex procedures. These requirements disproportionately burden smaller firms and new entrants.

4. Competition and innovation decline

When participation becomes more expensive or uncertain, fewer innovators enter the market. Existing firms gain structural advantages, and products, services, and ideas that might otherwise improve consumer welfare never emerge.

5. The intended beneficiaries bear the costs

Ultimately, diminished competition leaves consumers, investors, and workers with fewer choices and quality improvements, higher costs, greater risks, and weaker protections.

OSHA and the SEC both generate this process, but they do so through different regulatory mechanisms. OSHA demonstrates how private gatekeeping can prevent safety innovations from reaching workers. The SEC illustrates how enforcement asymmetries and procedural burdens can discourage market participation and suppress competition. Although the mechanisms differ, the underlying pattern is the same. Once discretionary authority creates barriers that disproportionately burden smaller competitors, regulations intended to protect the public can instead entrench incumbents and diminish the very welfare they were designed to promote.

Recognizing these recurring characteristics transforms the Protection Paradox from a description of isolated regulatory failures into a repeatable analytical framework. The same framework can be applied across a wide range of agencies, such as the EPA, FTC, and FCC, to evaluate whether regulatory structures are advancing their stated objectives or unintentionally undermining them.

The paradox persists—why emerging regulation is destined to follow the same path

The case studies examined in this report are not historical curiosities. They are not artifacts of a particular era of regulatory thinking or the product of uniquely bad actors within OSHA and the SEC. They are, instead, symptoms of a structural condition—a condition that reasserts itself predictably whenever government authority expands into new markets. Understanding why requires moving beyond the specifics of aerial lifts and securities enforcement to examine the underlying logic of the Protection Paradox itself.

At its core, the paradox emerges from a single, recurring mistake: the assumption that regulatory complexity can substitute for market discipline. When a functioning market operates freely, bad actors are punished by consequences such as lost customers, business failure, and damaged reputations. Regulation, by contrast, centralizes accountability into formal processes that require navigation, compliance infrastructure, and legal expertise. Large incumbents are better positioned to shoulder these costs, while small innovators are unlikely to have comparable resources. The result is a playing field tilted toward those who can most afford to play the game.

Other discussions related to the regulatory state point to similar conclusions. Economists have long recognized the phenomenon of regulatory capture: the tendency of agencies to become more responsive to the interests of the industries they regulate than to those of the broader public.[15] But the Protection Paradox is something subtler and, in some ways, more insidious. It does not require corruption or explicit capture and is oftentimes driven by a noble purpose. Yet the Protection Paradox favors established players at the expense of new and smaller competitors, as well as the public.

The free market alternative

The free market offers a fundamentally different model of protection. It is a model grounded in competition, transparency, and the dispersed judgment of countless individuals rather than the centralized judgment of a regulatory body.

In a competitive market, safety and quality are not mandated into existence through certification and enforcement regimes. They are demanded into existence by customers and stakeholders who can choose alternatives. A product or business fails because buyers, informed by reputation, liability, and competitive comparison, reject it. This mechanism is not perfect, but it is self-correcting in a way that regulatory systems rarely are. Markets respond to new information organically and dynamically. Regulatory frameworks implement corrective action through rulemaking—a rigid and inadequately accountable administrative process. Administratively created rules can take years to develop, even more years to tailor, and are vulnerable to capture at every stage.

The OSHA certification case illustrates this contrast directly. The regulatory framework increased incumbent control by making OEM approval the practical prerequisite for market entry. That deprived the market of innovations that could have enhanced worker safety. A market-based approach that relied on performance standards, liability exposure, and reputational accountability would have created incentives for safety without creating structural gatekeeping. Manufacturers whose products failed would bear the consequences. Innovators whose products worked would be free to compete.

The superiority of market-based regulation is not hypothetical. Performance-based regulatory models already exist and have demonstrated their advantages in contexts as demanding as aviation and pharmaceuticals. The question is not whether markets can discipline safety (they can and do), but whether regulators are willing to trust distributed accountability over centralized control.

The deeper principle: Skepticism as a civic obligation

The Protection Paradox ultimately teaches something broader than regulatory design. It teaches that the stated purpose of a government intervention and its functional effect are not the same thing, and that the gap between them tends to grow, not shrink, over time.

These case studies should inspire a principled, durable skepticism toward any regulatory expansion that lacks clear accountability mechanisms, meaningful procedural constraints on agency discretion, and honest assessment of who bears the cost.

Ensuring regulations protect the public

The Protection Paradox provides a framework for identifying when regulations work against their intended purposes. Recognizing the Protection Paradox allows lawmakers and the public to identify necessary reforms or repeals of regulations that fail to protect the public.

If recognition is the first step, action is the second. Ideally, lawmakers will fix the problem by changing law. But litigation provides another path to checking the Protection Paradox. Existing doctrines such as the Administrative Procedure Act, the Due Process Clause, the nondelegation doctrine, and recent separation-of-powers decisions may provide avenues for legal challenges to agency actions. Litigation cannot eliminate every regulatory distortion, but it can help restore the accountability mechanisms that prevent regulations from excluding competitors. That alone can help to expand opportunity, preserve competition, and protect individual liberty.

About the authors

Soriya Chhe is Senior Counsel to the Competitive Enterprise Institute. She also directs the organization’s litigation on constitutional and regulatory issues, such as free speech and financial regulation.

Marin Murdock is Associate Counsel at the Competitive Enterprise Institute, where she focuses on legal and policy issues through a law-and-economics lens.

Notes

---

[1] “OSHA’s 30th Anniversary,” Occupational Safety and Health Administration, accessed April 29, 2026, https://www.osha.gov/aboutosha/30-years.

[2] 29 C.F.R. § 1926.453(a)(2).

[3] 29 C.F.R. § 1926.453(a)(2).

[4] 29 C.F.R. §§ 1926.453(a)(2), 1910.67(b)(2).

[5] Axon Enter., Inc. v. FTC, 598 U.S. 175, 180 (2023) (describing the Securities Exchange Act of 1934 as authorizing the SEC “to address statutory violations either by bringing civil suits in federal district court or by instituting [its] own administrative proceedings”); 15 U.S.C. §§ 78u(d), 78u-2, 78u-3.

[6] “Information for Respondents in Administrative Proceedings,” Securities and Exchange Commission, accessed May 4, 2026, https://www.sec.gov/enforcement-litigation/administrative-proceedings/information-respondents-administrative-proceedings; Joseph A. Grundfest, “Fair or Foul?: SEC Administrative Proceedings and Prospects for Reform Following Lucia v. SEC,” Fordham Law Review 85, no. 3 (2016), pp. 1143–1186.

[7] SEC v. Jarkesy, 603 U.S. 109 (2024).

[8] Paul Renfroe, personal interview by the author, February 12, 2026.

[9] Renfroe, interview.

[10] See Securities and Exchange Commission, “SEC Announces Enforcement Results for Fiscal Year 2023,” press release, November 14, 2023, https://www.sec.gov/newsroom/press-releases/2023-234 (acknowledging that, while the majority of the commission’s enforcement actions are filed as settled matters, only “more than 40 percent” of the standalone matters brought in fiscal year 2023 were litigated in whole or in part); see also Cornerstone Research & NYU Pollack Center for Law and Business, SEC Enforcement Activity: Public Companies and Subsidiaries—Fiscal Year 2023 Update (2023), p. 4, https://www.cornerstone.com/report/sec-enforcement-activity-fy2023-update (finding that 92 percent of all enforcement actions against public companies and subsidiaries in FY 2023 were brought as administrative proceedings—the highest percentage since FY 2019—and that 69 percent of defendants that settled did so after cooperating with the SEC).

[11] 17 C.F.R. § 202.5(e).

[12] “SEC Rejects Call to Alter ‘No Admit/No Deny’ Settlement Rule,” Jones Day, Insights, February 2024, https://www.jonesday.com/en/insights/2024/02/sec-rejects-call-to-alter-its-no-admitno-deny-settlement-rule.

[13] Securities and Exchange Commission, “SEC Rescinds Policy Regarding Denials of Settlements in Enforcement Actions,” press release, May 18, 2026, https://www.sec.gov/newsroom/press-releases/2026-45-sec-rescinds-policy-regarding-denials-settlements-enforcement-actions.

[14] SEC v. Jarkesy, 603 U.S. 109 (2024).

[15] See, for example, George J. Stigler, “The Theory of Economic Regulation,” Bell Journal of Economics and Management Science 2, no. 1 (1971), pp. 3–21.