No Cop on the Beat: Underenforcement in E-Commerce and Cybercrime Peter P. Swire Ohio State University & Center for American Progress Fordham CLIP Information Society Symposium May 30, 2008

Coming This Monday A new report: The ID Divide: Addressing the Challenges of Identification and Authentication in American Society A new report: The ID Divide: Addressing the Challenges of Identification and Authentication in American Society Available on Monday at Available on Monday at How to handle these issues across national/homeland security; immigration; voting; e-health; computer security; privacy; civil liberties. How to handle these issues across national/homeland security; immigration; voting; e-health; computer security; privacy; civil liberties.

Todays Discussion Data breaches, but also broader issues of enforcement across geographic jurisdictions -- law review article in materials Data breaches, but also broader issues of enforcement across geographic jurisdictions -- law review article in materials E.g., consumer protection & crime online E.g., consumer protection & crime online Old paradigm of mostly local enforcement: Old paradigm of mostly local enforcement: Local enforcement, county & state – a cop on the beat Local enforcement, county & state – a cop on the beat Information is local Information is local Punishment & deterrent effects are local Punishment & deterrent effects are local Evidence is local Evidence is local

What Changes on the Internet? Information problem Information problem Commons problem Commons problem Forensic problem Forensic problem Basic answer: non-local answers needed for non-local problems Basic answer: non-local answers needed for non-local problems More federal – FTC More federal – FTC More federated – networks of state AGs More federated – networks of state AGs

The Information Problem Physical world: a cop on the beat Physical world: a cop on the beat A consumer complaint comes in A consumer complaint comes in Honest Amys Used Cars & Shady Sams Used Cars Honest Amys Used Cars & Shady Sams Used Cars Local enforcers have insight/expertise from previous complaints & use discretion Local enforcers have insight/expertise from previous complaints & use discretion

The Information Problem For online commerce or data breach, a complaint comes in to the county consumer protection office or state AG office For online commerce or data breach, a complaint comes in to the county consumer protection office or state AG office Web site typically far away Web site typically far away The county/state has a tiny fraction of all consumer problems with the site The county/state has a tiny fraction of all consumer problems with the site The county/state has weak information for exercising discretion The county/state has weak information for exercising discretion Likely result is underenforcement Likely result is underenforcement Underenforcement means less enforcement than we would expect/prefer if purely local Underenforcement means less enforcement than we would expect/prefer if purely local

The Commons Problem No commons problem where bad action and victim are local No commons problem where bad action and victim are local Enforcers get credit for stopping local bad guys Enforcers get credit for stopping local bad guys Local victims are protected Local victims are protected Deterrent effects are local Deterrent effects are local

The Commons Problem Online, enforcement incentives change Online, enforcement incentives change Why should I spend my scarce prosecutorial resources when most of the protection goes to victims outside of my jurisdiction? Why should I spend my scarce prosecutorial resources when most of the protection goes to victims outside of my jurisdiction? Deterrence – Id rather prosecute where strong deterrence locally Deterrence – Id rather prosecute where strong deterrence locally Public choice – Id rather prosecute where mostly local people are protected Public choice – Id rather prosecute where mostly local people are protected Let someone else go after them – a classic commons problem -- underenforcement Let someone else go after them – a classic commons problem -- underenforcement

Forensics Problem This problem has been recognized in the literature This problem has been recognized in the literature Its harder to enforce where the evidence is outside of the locality Its harder to enforce where the evidence is outside of the locality Harder to get cooperation from distant officials Harder to get cooperation from distant officials Harder to trace where you dont have compulsory process or other sources Harder to trace where you dont have compulsory process or other sources Result is underenforcement Result is underenforcement

Responses to Underenforcement Information problem Information problem Information sharing: Consumer Sentinel Information sharing: Consumer Sentinel Commons problem Commons problem Cross-border task forces Cross-border task forces Organize around subject matter – data breach, ID theft, spam, etc. Organize around subject matter – data breach, ID theft, spam, etc. Forensic problem Forensic problem COE Cybercrime Convention for criminal COE Cybercrime Convention for criminal US SAFE WEB Act for FTC US SAFE WEB Act for FTC

Responses to the Problem More generally, recognize the need to match solutions to the scale of the problems More generally, recognize the need to match solutions to the scale of the problems National (and international), so have national solutions National (and international), so have national solutions FTC role for data breach (Choicepoint), spam, spyware, and other consumer protectionFTC role for data breach (Choicepoint), spam, spyware, and other consumer protection FTC staffing still far below 1980 levelsFTC staffing still far below 1980 levels Federated – NAAG and other efforts to match geography with the problems Federated – NAAG and other efforts to match geography with the problems

Some Objections Law review article addresses these: Law review article addresses these: The Internet hasnt really changed anything The Internet hasnt really changed anything Enforcement works better on the Internet Enforcement works better on the Internet We dont really want to enforce the law We dont really want to enforce the law States need to be laboratories of experimentation States need to be laboratories of experimentation The Feds dont do small potatoes The Feds dont do small potatoes

Conclusion The paper highlights the information and commons problems that exist for local enforcement and non-local fraud & crime The paper highlights the information and commons problems that exist for local enforcement and non-local fraud & crime Likely need to shift to federal or federated enforcement Likely need to shift to federal or federated enforcement For whatever level of enforcement we want for each type of law, the next Administration should design strategies that address these problems For whatever level of enforcement we want for each type of law, the next Administration should design strategies that address these problems