Creating Laws for Computer Security
In 2016 the website KrebsonSecurity was taken down by a large distributed denial-of-service (DDoS) attack. More recently, many large sites became inaccessible due to a massive DDoS attack (see, e.g., “Hackers Used New Weapons to Disrupt Major Websites Across U.S.” by Nicole Perlroth, Oct. 21, 2016, NY Times).
Sadly, the “Internet of Things” is really the “Internet of painfully insecure things”. This is fundamentally an externalities problem (the buyers and sellers are not actually bearing the full cost of the exchange), and in these cases mechanisms like law and regulation are often used.
So, what laws or regulations should be created to improve computer security? Are there any? Obviously there are risks to creating laws and regulations. These need to be targeted at countering widespread problems, without interfering with experimentation, without hindering free expression or the development of open source software, and so on. It’s easy to create bad laws and regulations - but I believe it is possible to create good laws and regulations that will help.
My article Creating Laws for Computer Security lists some potential items that could be turned into laws that I think could help computer security. No doubt some could be improved, and there are probably things I’ve missed. But I think it’s important that people start discussing how to create narrowly-tailored laws that counter the more serious problems without causing too many negative side-effects. Enjoy!
path: /security | Current Weblog | permanent link to this entry