At the 2008 Workshop on the Economics of Information Security, three researchers from Carnegie Mellon University presented a paper called "Do Data Breach Disclosure Laws Reduce Identity Theft?" I was surprised by the results presented, which I found counterintuitive and disappointing (not, I hasten to add, through any fault of the authors or of their methodology). My disappointment is due to the fear that if independent study confirms the findings, then we have a serious problem.
At the 2008 Workshop on the Economics of Information Security (WEIS 2008) at Dartmouth College last month (see also my overview in this column), there were many fascinating research papers presented by distinguished scholars. In this short series, I will summarize some of the most striking findings of several researchers whose work I particularly enjoyed (I must quickly add that my not discussing particular articles should in no way be construed as criticism).
Sasha Romanosky, a doctoral student, presented a paper he co-authored with Prof. Rahul Telang and Prof. Alessandro Acquisti. The three researchers are from the Heinz School of Public Policy and Management, at Carnegie Mellon University. Their paper is “Do Data Breach Disclosure Laws Reduce Identity Theft?" Carnegie Mellon’s CyLab summarized their work and pointed to a June 5 article about it by Robert McMillan.The key points of the researchers’ methods and findings were:• The question: do data-breach-disclosure laws reduce the frequency of identity theft?
• The researchers used the Freedom of Information Act to request identity theft data from the FTC over the years 2002 to 2006.
• Their statistical model allowed them to control for many economic and demographic factors.
• In this preliminary paper, they found a negative but not statistically significant relationship between implementation of data-breach-disclosure laws and the rate of identity theft.
• The absence of measurable relationship may indicate an absence in reality (what statisticians call the parametric values) or may indicate problems in the sampling (size or quality of the dataset). However, see the next comment immediately below.
The researchers have since augmented their analysis and data to include 2007 identity thefts and find negative and statistically significant but marginal effect of disclosure laws on identity theft rates (a reduction of 1.2 reported thefts per 100,000 population or about 2% of the crime rate). Sasha Romanosky commented:
“It’s not clear whether that’s a large enough effect to justify the laws. Nor is it clear what is the net social effect (costs relative to benefits). There are likely other benefits of these disclosure laws, and we are studying only one possible outcome. We also recognize that to be most effective, the responsibility lies with both firms and consumers to take appropriate action to prevent identity theft.”
The authors propose the following policy recommendations (quoting exactly):
• Create a single, federal data breach disclosure law that covers all persons, private organizations, data brokers and state and federal agencies. This single law should reduce conflict between states laws and lower the barrier for compliance.
• Standardize the content of notifications to include only pertinent information (no marketing brochures) that includes actionable information for the consumer (e.g. date of breach, type of personal information lost, and customer support contact information).
• Define an oversight committee to be notified of all breaches. This will create an authoritative source of breach data that can be made available to policy makers, researchers and consumers.
* * *
I was surprised by the results presented in this paper, which I found counterintuitive and disappointing (not, I hasten to add, through any fault of the authors or of their methodology). My disappointment is due to the fear that if independent study confirms the findings, then we have a serious problem to confront that will be familiar to anyone who has been following the divergence between propaganda and effective security measures.
The familiar problem is that superficial measures which legislators hope and expect to support improved security – or hope and expect to generate the illusion of concrete action in support of improved security – may, upon examination, be completely ineffective. Superficial measures are typically ineffective because they do not address the underlying causes of the security breaches they are supposedly addressing. The theoretical basis for disclosure laws is a free-market conception of the value of perfect information. Completely informed free agents can choose among competing suppliers to select those with the best record of customer protection and value, thus shifting the performance of the entire field towards better protection and safety. Those firms failing to provide adequate protection can be punished through individual or class-action lawsuits for tort. (Compare Data Leak Protection products)
Pushed to an extreme, this unfettered Invisible Hand approach to economics (a reference to the writings of Adam Smith) eliminates the need for regulatory agencies, legal mandates and standards for performance, or even punitive criminal laws. But enough of this airy persiflage, which will assuredly generate the usual torrent of hostile e-mail from readers who dislike any mention of political issues in this column.
See the extensive work of Bruce Schneier, including his books Beyond Fear and Secrets & Lies, insightful essays and his excellent Crypto-Gram newsletter for many analyses of faulty thinking in security engineering and social policies. See also my brief paper on airport security for a particular example of measures described as supporting security but (in my opinion) primarily used for propaganda purposes.
* * *
For the complete paper by Romanosky et al., see the WEIS2008 Web site.
For more information on interpreting data and statistical analyses, see my overview, “Understanding Computer Crime Studies and Statistics v4.”
The next WEIS 2008 paper I will review in this series is “Security Economics and European Policy” by Ross Anderson, Rainer Böhme, Richard Clayton and Tyler Moore.