Cybersecurity is an increasing problem for which the market may fail to produce a solution. The ultimate source is that computer owners lack adequate incentives to invest in security because they bear fully the costs of their security precautions but share the benefits with their network partners. In a world of positive transaction costs, individuals often select less than optimal security levels. The problem is compounded because the insecure networks extend far beyond the regulatory jurisdiction of any one nation or even coalition of nations. This book brings together the views of leading law and economics scholars on the nature of the cybersecurity problem and possible solutions to it. Many of these solutions are market based, but they need some help, either from government or industry groups or both. Indeed, the cybersecurity problem prefigures a host of 21st century problems created by information technology and the globalization of markets.
What we can learn from the aftermath of cybersecurity breaches and how we can do a better job protecting online data. Cybersecurity incidents make the news with startling regularity. Each breach—the theft of 145.5 million Americans' information from Equifax, for example, or the Russian government's theft of National Security Agency documents, or the Sony Pictures data dump—makes headlines, inspires panic, instigates lawsuits, and is then forgotten. The cycle of alarm and amnesia continues with the next attack, and the one after that. In this book, cybersecurity expert Josephine Wolff argues that we shouldn't forget about these incidents, we should investigate their trajectory, from technology flaws to reparations for harm done to their impact on future security measures. We can learn valuable lessons in the aftermath of cybersecurity breaches. Wolff describes a series of significant cybersecurity incidents between 2005 and 2015, mapping the entire life cycle of each breach in order to identify opportunities for defensive intervention. She outlines three types of motives underlying these attacks—financial gain, espionage, and public humiliation of the victims—that have remained consistent through a decade of cyberattacks, offers examples of each, and analyzes the emergence of different attack patterns. The enormous TJX breach in 2006, for instance, set the pattern for a series of payment card fraud incidents that led to identity fraud and extortion; the Chinese army conducted cyberespionage campaigns directed at U.S.-based companies from 2006 to 2014, sparking debate about the distinction between economic and political espionage; and the 2014 breach of the Ashley Madison website was aimed at reputations rather than bank accounts.
This book presents a novel framework to reconceptualize Internet governance and better manage cyber attacks. Specifically, it makes an original contribution by examining the potential of polycentric regulation to increase accountability through bottom-up action. It also provides a synthesis of the current state of cybersecurity research, bringing features of the cloak and dagger world of cyber attacks to light and comparing and contrasting the cyber threat to all relevant stakeholders. Throughout the book, cybersecurity is treated holistically, covering outstanding issues in law, science, economics, and politics. This interdisciplinary approach is an exemplar of how strategies from different disciplines as well as the private and public sectors may cross-pollinate to enhance cybersecurity. Case studies and examples illustrate what is at stake and identify best practices. The book discusses technical issues of Internet governance and cybersecurity while presenting the material in an informal, straightforward manner. The book is designed to inform readers about the interplay of Internet governance and cybersecurity and the potential of polycentric regulation to help foster cyber peace.
We depend on information and information technology (IT) to make many of our day-to-day tasks easier and more convenient. Computers play key roles in transportation, health care, banking, and energy. Businesses use IT for payroll and accounting, inventory and sales, and research and development. Modern military forces use weapons that are increasingly coordinated through computer-based networks. Cybersecurity is vital to protecting all of these functions. Cyberspace is vulnerable to a broad spectrum of hackers, criminals, terrorists, and state actors. Working in cyberspace, these malevolent actors can steal money, intellectual property, or classified information; impersonate law-abiding parties for their own purposes; damage important data; or deny the availability of normally accessible services. Cybersecurity issues arise because of three factors taken together - the presence of malevolent actors in cyberspace, societal reliance on IT for many important functions, and the presence of vulnerabilities in IT systems. What steps can policy makers take to protect our government, businesses, and the public from those would take advantage of system vulnerabilities? At the Nexus of Cybersecurity and Public Policy offers a wealth of information on practical measures, technical and nontechnical challenges, and potential policy responses. According to this report, cybersecurity is a never-ending battle; threats will evolve as adversaries adopt new tools and techniques to compromise security. Cybersecurity is therefore an ongoing process that needs to evolve as new threats are identified. At the Nexus of Cybersecurity and Public Policy is a call for action to make cybersecurity a public safety priority. For a number of years, the cybersecurity issue has received increasing public attention; however, most policy focus has been on the short-term costs of improving systems. In its explanation of the fundamentals of cybersecurity and the discussion of potential policy responses, this book will be a resource for policy makers, cybersecurity and IT professionals, and anyone who wants to understand threats to cyberspace.
This book examines the intersection between cybersecurity and the law and economy of India and offers a course of action in designing efficacious policies against emerging cybercrimes in the country. It reviews the boom in infrastructure growth in India and the security challenges this presents to the domestic economy and legal system. The contributors conducted a risk assessment of the potential economic impacts and security vulnerabilities, as well as identified the current regulatory and legal gaps regarding cryptocurrency, ecommerce, and digital banking. The book also considers the subject of data localization and sovereignty, and the challenges of establishing an indigenous data architecture. By discussing the economic impact of cybersecurity and incorporating recommendations from scholars, activists, academics, young legal intellectuals, and professionals in the field, the chapters propose new measures and protections for lawmakers and policymakers to adopt. This book will interest researchers and students of cybersecurity, law and economics, international relations, and Indian policymakers.
Designed for managers struggling to understand the risks in organizations dependent on secure networks, this book applies economics not to generate breakthroughs in theoretical economics, but rather breakthroughs in understanding the problems of security.
CYBERSECURITY LAW Learn to protect your clients with this definitive guide to cybersecurity law in this fully-updated third edition Cybersecurity is an essential facet of modern society, and as a result, the application of security measures that ensure the confidentiality, integrity, and availability of data is crucial. Cybersecurity can be used to protect assets of all kinds, including data, desktops, servers, buildings, and most importantly, humans. Understanding the ins and outs of the legal rules governing this important field is vital for any lawyer or other professionals looking to protect these interests. The thoroughly revised and updated Cybersecurity Law offers an authoritative guide to the key statutes, regulations, and court rulings that pertain to cybersecurity, reflecting the latest legal developments on the subject. This comprehensive text deals with all aspects of cybersecurity law, from data security and enforcement actions to anti-hacking laws, from surveillance and privacy laws to national and international cybersecurity law. New material in this latest edition includes many expanded sections, such as the addition of more recent FTC data security consent decrees, including Zoom, SkyMed, and InfoTrax. Readers of the third edition of Cybersecurity Law will also find: An all-new chapter focused on laws related to ransomware and the latest attacks that compromise the availability of data and systems New and updated sections on new data security laws in New York and Alabama, President Biden’s cybersecurity executive order, the Supreme Court’s first opinion interpreting the Computer Fraud and Abuse Act, American Bar Association guidance on law firm cybersecurity, Internet of Things cybersecurity laws and guidance, the Cybersecurity Maturity Model Certification, the NIST Privacy Framework, and more New cases that feature the latest findings in the constantly evolving cybersecurity law space An article by the author of this textbook, assessing the major gaps in U.S. cybersecurity law A companion website for instructors that features expanded case studies, discussion questions by chapter, and exam questions by chapter Cybersecurity Law is an ideal textbook for undergraduate and graduate level courses in cybersecurity, cyber operations, management-oriented information technology (IT), and computer science. It is also a useful reference for IT professionals, government personnel, business managers, auditors, cybersecurity insurance agents, and academics in these fields, as well as academic and corporate libraries that support these professions.
In a world of increasing dependence on information technology, the prevention of cyberattacks on a nation's important computer and communications systems and networks is a problem that looms large. Given the demonstrated limitations of passive cybersecurity defense measures, it is natural to consider the possibility that deterrence might play a useful role in preventing cyberattacks against the United States and its vital interests. At the request of the Office of the Director of National Intelligence, the National Research Council undertook a two-phase project aimed to foster a broad, multidisciplinary examination of strategies for deterring cyberattacks on the United States and of the possible utility of these strategies for the U.S. government. The first phase produced a letter report providing basic information needed to understand the nature of the problem and to articulate important questions that can drive research regarding ways of more effectively preventing, discouraging, and inhibiting hostile activity against important U.S. information systems and networks. The second phase of the project entailed selecting appropriate experts to write papers on questions raised in the letter report. A number of experts, identified by the committee, were commissioned to write these papers under contract with the National Academy of Sciences. Commissioned papers were discussed at a public workshop held June 10-11, 2010, in Washington, D.C., and authors revised their papers after the workshop. Although the authors were selected and the papers reviewed and discussed by the committee, the individually authored papers do not reflect consensus views of the committee, and the reader should view these papers as offering points of departure that can stimulate further work on the topics discussed. The papers presented in this volume are published essentially as received from the authors, with some proofreading corrections made as limited time allowed.
On a global scale, the central tool for responding to complex security challenges is public international law. This handbook provides a comprehensive and systematic overview of the relationship between international law and global security.
Contemporary discussion surrounding the role of the internet in society is dominated by words like: internet freedom, surveillance, cybersecurity, Edward Snowden and, most prolifically, cyber war. Behind the rhetoric of cyber war is an on-going state-centered battle for control of information resources. Shawn Powers and Michael Jablonski conceptualize this real cyber war as the utilization of digital networks for geopolitical purposes, including covert attacks against another state's electronic systems, but also, and more importantly, the variety of ways the internet is used to further a state’s economic and military agendas. Moving beyond debates on the democratic value of new and emerging information technologies, The Real Cyber War focuses on political, economic, and geopolitical factors driving internet freedom policies, in particular the U.S. State Department's emerging doctrine in support of a universal freedom to connect. They argue that efforts to create a universal internet built upon Western legal, political, and social preferences is driven by economic and geopolitical motivations rather than the humanitarian and democratic ideals that typically accompany related policy discourse. In fact, the freedom-to-connect movement is intertwined with broader efforts to structure global society in ways that favor American and Western cultures, economies, and governments. Thought-provoking and far-seeing, The Real Cyber War reveals how internet policies and governance have emerged as critical sites of geopolitical contestation, with results certain to shape statecraft, diplomacy, and conflict in the twenty-first century.
