Computer security and information privacy has traditionally been viewed as a matter of private right to be protected either through contract, property, or technological measures. We argue in this paper that computer security and information privacy can be more effectively understood as a matter of insurance, similar to the regulation of hazardous activities, workplace accidents, and defective products. Professor Edward Lazowska, of the University of Washington Department of Computer Science, has analogized computer security to auto safety, where a set of government regulations has caused automobiles to become far more safe over the course of 35 years. We do not use the term social in the sense of social welfare programs. Instead, we use it in the sense of social capital, a term that acknowledges the role of non-market and non-governmental institutions as a means to regulate conduct through the creation of norms. Social is preferable to social capital for our purposes because of our concerns with the hazards posed by information security breaches. Instead of framing security and privacy as matters of private harms and private law, our approach highlights the role of regulation in establishing the foundation of trust necessary for cyberspace transactions. In part, our thesis shifts the focus of regulation from contract and property to tort. But our thesis extends beyond a simple tort liability based approach. The insurance perspective integrates contract, property, tort, and technological approaches to information management. The patchwork of regulation, ranging from privacy default rules in contract to criminalization of attacks on data storage devices, can best be understood as mechanisms for allocating and distributing the risk and uncertainty associated with breaches to critical information systems. The insurance perspective provides a template to understand regulatory measures and reform them. Furthermore, the insurance perspective provides the means to assess the use of products liability theories to address computer security and information privacy issues. While the existing legal and economic literature has hinted at the use of products liability theory, there has not been systematic study of the use of the products liability model as a means to regulating security and privacy.
Read full abstract