Closing the gap between technology and public policy

Technology and public policy have always been out of sync, with new technologies often introducing societal issues that require government action. Whether it’s horse and buggies, steam locomotives, automobiles or smartphones, every leap in technology has followed the same pattern: Invention first, public policy later.

A brief history of technology and public policy

In the 1980s, the focus of cybersecurity legislation was almost exclusively on passing criminal statutes -- first at the federal level and later in the states. Congress passed the Computer Fraud and Abuse Act in 1986, and it remains the core federal legislative framework that guides virtually all criminal and civil actions taken by the federal government.

According to the National Conference of State Legislatures, every state has a computer crimes statute, and half of the states also have specific legislation aimed at denial of service attacks.  Two states --  California and Wyoming --  have enacted ransomware statutes.

Beginning in the early 2000s, legislators and regulators began to shift their attention to civil prosecution and consumer protection. Actions reflected the personalities of the individual states --  some laws and regulations continued to focus on punishing attackers while others looked to prevent attacks and encourage organizations to improve cybersecurity.

In 2002 California enacted a mandatory consumer notice law when personal data is breached.  In the intervening 15 years, 48 states and nearly 90 other countries have passed similar regulations.  Despite numerous attempts dating back to 2005, Congress has yet to pass a uniform breach notification law.

The conflict between technology and policy

Today, the burden of rapidly responding to technology-driven policy issues falls primarily on state officials.  However, the modern technology life cycle is fundamentally incompatible with basic state legislative and regulatory processes. State legislatures may not meet on an annual basis, and if they do, they often lack the time in-session, staff resources and expertise to quickly tackle complex issues like cybersecurity.

Technology, on the other hand, measures advances in hours, days and months. This is especially true of cybersecurity technologies where teams must address a non-stop stream of attacks aimed at vulnerable networks and applications -- attacks that often pressure for elected officials and regulators to act quickly.

The rate and severity of breaches continues to increase -- up 40 percent in 2016, according to the Identity Theft Resource Center. At the same time more software solutions are entering the marketplace.  Virtually every organization from the corner drug store to the largest government agency relies on web-enabled applications with one thing in common: software flaws that malicious hackers can exploit.

New York steps to the front

It’s against this background that New York State regulators have enacted new policies, creating a model for addressing cybersecurity issues that other states should consider adapting to their needs. Instead of focusing on the aftermath of a particular breach, the New York Department of Financial Services regulations focus on prevention.  That direction happens to coincide with the changes in the cybersecurity marketplace – more products are available to help IT managers prevent exploits rather than play whack-a-mole with code vulnerabilities after the fact.

The DFS regulations require banks, insurance companies and other financial services institutions regulated by the department to have a cybersecurity program aimed at protecting consumers that includes:

• Written policies and procedures.
• The appointment of a chief security officer.
• Mandatory reporting within 72 hours of any attacks that could harm the firm’s normal operations.

This squarely puts the burden on financial services companies to do more to prevent breaches rather than relying on incentives such as enlightened self-interest or broad federal guidelines (that may not apply to them) to actively address cyber threats.

State-based cybersecurity regulations are also more likely to be enforced uniformly.  State agencies tend to know more about the businesses under their jurisdiction, and regulated businesses have easier access to the state legislators who provide oversight. It’s also less complex and time consuming, generally speaking, to fix flawed legislation or regulation at the state level.

State regulation is not all sweetness and light

While state regulation offers definite advantages to consumers and businesses, there are three obvious downsides

1. Compliance. A patchwork of laws and regulations makes it harder for small, multistate organizations to comply. The cost of compliance is a common complaint from business leaders, and having to meet different standards in different states is more expensive. 

2. Narrow scope. The New York DFS oversees a comprehensive list of financial services firms, many of which may not have previously thought of cybersecurity as a priority. However, DFS does not regulate all New York businesses. 

3. Political climate. State officials may not have the technical resources or political air cover to take action. Congress, led by Sens. Mark Warner (D-Va.) and John Thune (R-S.D.), is trying to address the resource issue in a series of bills filed in early 2017. The political calculation needed to tackle cyber issues as aggressively as New York will vary from state to state.  Just ask the residents of Alabama or South Dakota who still are not protected by a security breach notification law.