The Efficacy of Cybersecurity Regulation

Cybersecurity regulation presents an interesting quandary where, because private entities possess the best information about threats and defenses, legislatures do—and should—deliberately encode regulatory capture into the rulemaking process. This relatively uncommon approach to administrative law, which I describe as Management-Based Regulatory Delegation, involves the combination of two legislative approaches to engaging private entities’ expertise. This Article explores the wisdom of those choices by comparing the efficacy of such private sector engaged regulation with that of a more traditional, directive mode of regulating cybersecurity adopted by the * Visiting Assistant Professor of Law, University of Connecticut; Affiliated Fellow, Information Society Project, Yale Law School. Funding for this project was provided by the U.S. Department of Homeland Security through the Institute for Information Infrastructure Protection (I3P), the Team for Research in Ubiquitous Secure Computing (TRUST), and the Rose Foundation. I owe special thanks to Deirdre K. Mulligan, Pam Samuelson, and Todd LaPorte, for their many years of advice and support in the development of my Ph.D. dissertation research, upon which this Article is in large part based. I also express thanks for the substantial assistance of Jennifer King and Aaron Burstein in the development and conduct of the Chief Information Security Officer interviews. This Article additionally benefited from the thoughtful comments of Ashok Agrawala, Jack Balkin, Derek Bambauer, Nicholas Bramble, Yale Braunstein, Brian Carver, John Chuang, Chris Hoofnagle, Leslie Levin, Peter Lindseth, Margot Kaminski, Elizabeth Khalil, Andrea Matwyshyn, Paul Mazzucco, Christina Mulligan, Mark Paulding, Gerry Stegmaier, the participants of the 2010 and 2012 Privacy Law Scholars Conference, the members of the Yale Law School Information Society Project, the participants in the Harvard-Yale-MITColumbia Cyberscholars Workshop Series, and my former fellow Ph.D. students at UC Berkeley’s School of Information. The editors and staff of the Georgia State University Law Review, especially including Ashley Worrell and Andrea Iglesias, provided invaluable assistance and input in the finalization and production of this piece. Lastly, I express thanks to my father, the original Professor Thaw, for encouraging and supporting me in the long processes both of completing the training necessary to undertake this research and of completing a doctoral dissertation. ** This material is based in part upon work supported by the U.S. Department of Homeland Security under Grant Award Number 2006 CS 001-000001, under the auspices of the Institute for Information Infrastructure Protection (I3P) research program. The I3P is managed by Dartmouth College. The views and conclusions contained in this document are those of the authors and should not be interpreted as necessarily representing the official policies, either expressed or implied, of the U.S. Department of Homeland Security, the I3P, or Dartmouth College. 1 Thaw: The Efficacy of Cybersecurity Regulation Published by Reading Room, 2014 288 GEORGIA STATE UNIVERSITY LAW REVIEW [Vol. 30:2 state legislatures. My analysis suggests that a blend of these two modes of regulating is superior to either method alone. Federal regulation of cybersecurity through HIPAA, GrammLeach-Bliley, and the Federal Trade Commission’s enforcement heavily involves private organizations subject to the regulation in the establishment of the actual practices and standards to which those organizations are held. By contrast, the state cybersecurity laws—a form of disclosure-based regulation that de facto achieves directive regulation—detail specific standards developed without industry input. This Article compares the efficacy of those two modes of regulating using a mixed-methods empirical approach. Qualitative data based on interviews with Chief Information Security Officers (CISOs) at leading multinational corporations details the practical effects of how regulation drives cybersecurity practices. Analysis of quantitative data describing security breach incidents reveals that a blend of the two types of regulation is substantially more effective at preventing such incidents than is either method alone. These results provide insight into ways to mitigate the risks of deliberate regulatory capture while still leveraging the unique knowledge private entities have about what are the most salient cybersecurity threats and defenses.