#
 

CSAW'16 Policy Prompt

This prompt was given to all Policy entrants, who were tasked with writing a paper based on the prompt.

Some of the problems of cybersecurity may be thought of as symptoms of market failure, a situation in which inefficiencies exist in the allocation of goods and services. The inability to correct a market failure can lead to negative externalities; for example, in a consumer data breach the consumers are potentially exposed to harm that they could not prevent, while the company responsible for the exposed data might not have had enough of an incentive or ability to provide better security. In another example of a negative externality, privacy often receives limited value in the cost-benefit analysis a private firm must make about investing in information security, and firms have more incentives to over-collect personal data than they do to safeguard it. Conversely, society seems to be relying on positive externalities with respect to critical infrastructure, because the security of critical infrastructure is a public good shared by all, while the costs of securing those systems are borne by the (mostly) private firms who own them.

There is a new President who has said on the campaign trail, "I believe the best case for government intervention is in the case of market failure." Now the White House wants to know how governments can correct the market failure leading to insufficient protections afforded by companies to personal data held by consumers. This market failure has led to some of the biggest consumer data breaches in recent years--Target, Home Depot, J.P. Morgan, and others. The tools that governments have to correct market failures include legislation, regulation, taxation, and the provision of other economic incentives (loan guarantees, support for insurance and reinsurance markets, etc.). The U.S. government may also offer incentives unique to cybersecurity, such as licensing behavior against cyber intruders that would otherwise violate the Computer Fraud and Abuse Act if companies take effective defensive measures.

In 3,000 words or fewer, develop a policy proposal designed to correct this market failure.

You need not confine yourself to the examples discussed, but you are bound by the President's campaign promise.