Week 12 Exercises: Policy for Routers
Today, we continue thinking about how policy gets created, and what some of the general challenges around policy are.
Government policy details:
- Government bans all foreign-produced routers.
- The Full Public Notice from the FCC, including the National Security Determination for the ban in Appendix C.
News articles:
Policy Ananlysis:
- policy analysis about this ban written by Milton Mueller .
- Tech Policy Institute analysis of the ban. Mostly about the process that the FCC did / did not follow.
Case Backgroun:
- background info (just the section on “National Security Case”) to see a one-paragraph description of the attacks that are the justification for the ban.
Past Info
When facing a situation, first we should try to see if any of the social science ideas from class apply to that situation:
- Are defenders working together? If so, is it Best shot vs. weakest link vs. total effort situation
- Are there Externalities – does the wrong person suffers harm (who isn’t making the decision leading to the harm)
- Free riding – letting others be resonsible
- Information asymmetry – who knows what?
Potential Policy Options
- Regulation: Require information sharing in specific situations.
- Challenge: Which situations? How to enforce? Is it enough to solve information asymmetry problem?
- Challenge: Inefficient; everyone has to do a lot of work!
- Lemons Laws: Have a minimum standard of quality, and require companies to compensate people who receive defective products
- Challenge: Raises floor, but still means most/all products are at the floor
- Challenge: Must have clearly defined “quality” measures
- Signalling: People with information can find a way to credibly signal their information
- Example: School signals that you are the kind of person that school is easier for
- Challenge: Only works if people can credibly signal, and if others can understand signals
- Warranties: People with good products can offer a warranty for defects.
- What is the equivalent of a warranty in cybersecurity? How can you define a “defect”?
- Insurance: People with less information can buy insurance to cover losses
- Usually requires protective measures – brings everyone up to a minimum
- Challenge: Doesn’t work with correlated risks
- Liability: People who make decisions are responsible for consequences of those decisions
- Challenge: Who should be liable in complex situations?
Policy Categories
All of these policy solutions can be grouped into two categories:
| Ex Ante | Ex Post | |
|---|---|---|
| When they are enforced | Before attacks occur | After attacks occur |
| Incentive | Regulation (rules) | Liability |
| How they work | Always follow required processes | Only matters when there is an attack |
| Benefits | Easier to tell if followed | Difficult to tell if not working |
| When costs happen | Regular budget (low risk) | Only when attacked (high risk) |
| Challenge | What rules will stop attacks? | Will liability be enough to motivate security? |
| Doesn’t work when | Lack info about harms, protections | Firms can’t be held liable, or can’t pay enough |
Getting Defenders to work together
When there are multiple defenders whose work together determines how secure something is (most real-world situations), then that work can combine in different ways – Best Shot, Weakest Link, or Total Effort being the most common. Different types of policy solutions are needed in these different situations.
| Weakest Link | Best Shot | Total Effort | |
|---|---|---|---|
| How it works | whoever works least | whoever works hardest | everyone combined |
| Who determines? | lowest benefit/cost | highest benefit/cost | highest benefit/cost |
| Who does work? | everyone | only champion | only champion? |
| Works best for | small groups | anyone | big groups |
| How to make it better | Negligence Rule | Liability | Liability |
| Easy to disrupt? | yes | ??? | No |