With respect to the first type of failure I have described failures resulting from simple human imperfection government s role should be narrowly confined. It may be desirable, as the Commission has suggested, to sponsor research in computer security, to assist the private sector in establishing benchmarks and codifying best practices, and to promote the dissemination of information about computer security. I have some reservations about the Commission s suggestion that this research effort be led in part by the National Security Agency. While NSA is, no doubt, a repository of considerable expertise in this area, it also has other missions that may not be entirely congruent with the promotion of the growth and security of the Internet. The National Institute of Standards and Technology, the other agency mentioned by the Commission, might be a better place in which to house the principal efforts.
Regulation also has a place in assuring that private entities follow sound security practices.
The government should certainly use its regulatory power over banks and other financial institutions to assure that their safety and soundness is not threatened by inadequate computer security practices. But the government should confine the use of its regulatory power in this area to that narrow class of institutions whose safety and soundness it has undertaken to protect. Regulation is ill suited, and not necessary, for other types of business, for which simple self-preservation should be a sufficient incentive to adopt and maintain appropriate security measures. With respect to the second type of failure flaws in the design or operation of the system as a whole that are beyond the ability of any single actor to correct, there may be a place for government to take a more active role. What that role might be depends on the nature of the flaw and the steps necessary to remedy it.