1. Policy Matters: Innovation, Balkanization and the Government’s Role
Privacy Symposium, Harvard 23 August 2007
Adam Golodner, Director Global Security & Technology Policy
Cisco Systems, Inc.

2. Your Privacy Is my Security
WTO Accession – encryption (and my flavor)
Authentication//Anonymous
Techno regulatory arbitrage afoot…
Dare we look back?

3. Nothing New Under the Sun: Same Crimes, New Names
Offline
Online
Commercial Security
Commercial Security
Vandalism, Graffiti,
Worms, Viruses
Theft, Fraud, Deceptive Trade
Hacking, Spam, Phishing, Spyware
Extortion, Piracy, Organized Crime
DDoS, Intercept, ID Theft, Bots
- CIP-
Terrorism, Espionage
Physical Attack, Insider, etc.
National Security
National Security
Techniques Related—But Different Motivations, Legal Principles, Government Roles

4. A Three-Part Test for Policy Making1.
Innovation—Trust 2.
Balkanization
Innovation
Balkanization
Proper Role of Government
Let’s look at each of these … 3.
Proper Role of Government 4 4

5. The Impact on Innovation
Public choice theory
FCC to FTC?
Breach notification
And public choice theory & real harm
FCC to FTC? (or EC, China, etc
Breach Notification

6. The Balkanization of Technology and Business
Use my flavor
WAPI
Data flow
My values
Balkanization
Use my flavor
Standards, data transfer, WTO sec. exception

7. Proper Role of Government
Which aspect of “security” or “privacy”?
What are the costs and benefits of intervention?
Proper Role of Government
What kind of ‘security’ or ‘privacy’?
Costs, benefits, incentives and consequences

8. Policy Truism: Policy = Architecture = Innovation Impact
Network-based security and privacy
From passive to active
Self-defending
Interactive
Interconnected
Managed IP networks
Global
Policies must reflect:
Security and privacy moves fast
Unintended consequences
Protecting innovation
Don’t specify technologies
Or pre-judge biz models
Tying-up innovation makes us less, not more secure
Virtualization
Identity+Trust
Web
Filtering
SMTP
HTTP
Port 80
Worm
Mitigation
Content
Inspection
Anti
Spam
Secure IP

9. We Must Do Something—Anything! It’s a Tragedy of the Commons!
Fact or Fiction?
We Must Do Something—Anything!
It’s a Tragedy of the Commons!

10. How Do we Create a Global Framework?
What historic precedents can we call on?
Emerging frameworks
London Action Plan for consumer protection
MLATs
Council of Europe Treaty on Cyber Crime
OECD Privacy and Culture of Security
ICN—International Competition Network model
What are we missing?
Historical precedents
Nation states with different laws, values
Shared basic principles – like crime
Some differences real, at least for the mid-term
Emerging frameworks
London Action Plan for consumer protection
MLATs
Council of Europe Treaty on Cyber Crime
OECD Privacy & consumer dispute resolution
ICN – International Competition Network model ?
Principles for off-line and on-line the same
What precedent are we missing?

11. Build Upon Enduring Principles Perform Surgery as Needed
What We Must Do
Build Upon Enduring Principles
Continue to Innovate
Perform Surgery as Needed
Do No Harm