Search

In an earlier work entitled Regulating Cybersecurity, I argued that cyber defense should be understood not just as a matter for law enforcement and the armed forces, but as a regulatory problem in need of regulatory solutions. This companion article proposes a series of market-based responses to complement those governmental responses. It argues that hackers and other private actors are an important source of cybersecurity data--especially information about vulnerabilities and how to exploit them. Yet the white market, in which researchers can sell bugs to vendors that will patch them, suffers from high transaction costs, low prices, and other imperfections. Many hackers therefore choose to sell on the gray market to military and intelligence agencies that will exploit the flaws, which means that vulnerabilities persist and users remain exposed to attacks by hostile powers that have found the same flaws. The solution, I argue, is twofold: fostering white market brokers to reduce the transaction costs of legitimate bug sales, and increasing the payouts offered on the white market through a combination of liability protections, tax benefits, and subsidies. [ABSTRACT FROM AUTHOR]

An essay is presented on the role of technology in protecting classified information and preventing security leaks while reviewing legal frameworks concerning adjudicating cases of criminal security leaks. Topics discussed include increase in the number of leak prosecutions in the U.S. since 2005, non-legal ways of preventing such leaks, and adoption of measures like access controls and audit trials.

An essay is presented about the use of big data to detect security threats and how to balance the demands of national security and privacy and civil liberties. Topics discussed include the potential benefits of the U.S. National Security Agency's (NSA) surveillance programs, the constitutional and statutory issues associated with the programs and proposed guiding principles to ensure that surveillance is consistent with basic privacy and civil liberties values.

The conventional wisdom is that this country's privately owned critical infrastructure--banks, telecommunications networks, the power grid, and so on--is vulnerable to catastrophic cyber-attacks. The existing academic literature does not adequately grapple with this problem, however, because it conceives of cyber-security in unduly narrow terms: most scholars understand cyber-attacks as a problem of either the criminal law or the law of armed conflict. Cyber-security scholarship need not run in such established channels. This Article argues that, rather than thinking of private companies merely as potential victims of cyber-crimes or as possible targets in cyber-conflicts, we should think of them in administrative law terms. Many firms that operate critical infrastructure tend to underinvest in cyber-defense because of problems associated with negative externalities, positive externalities, free riding, and public goods-- the same sorts of challenges the modern administrative state faces in fields like environmental law, antitrust law, products liability law, and public health law. These disciplines do not just yield a richer analytical framework for thinking about cyber-security; they also expand the range of possible responses. Understanding the problem in regulatory terms allows us to adapt various regulatory solutions--such as monitoring and surveillance to detect malicious code, hardening vulnerable targets, and building resilient and recoverable systems--for the cyber-security context. In short, an entirely new conceptual approach to cyber-security is needed. [ABSTRACT FROM AUTHOR]

The article focuses on the national security and self restrain in the U.S. It discusses the actions of the terrorist network Al-Qaeda that was founded and leaded by Osama bin Laden. It mentions that self restrains may occur due to asymmetries in military and intelligence officials as well as bureaucratic empire building. It mentions that the national security apparatus is divided into policy makers, operators and reviewers. It presents several examples where the officials aborted the mission despite being lawful.

The article offers a comprehensive analysis of the reason behind the failure of U.S. intelligence agencies to share information and what actions may be taken to address it. It recalls information-sharing failures and describes the initiatives introduced to correct such problems. The tendency of intelligence agencies to hoard information is considered via public-choice principles and insights from other legal disciplines. Emphasis is placed on challenges linked to horizontal information sharing.