1. Sanjay Goel, School of Business/Center for Information Forensics and Assurance University at Albany Proprietary Information 1 Unit Outline General Policy and Law Issues Module 1: Introduction to Policy  Module 2: Evolution of Policy Module 3: Psychology Module 4: Summary

2. Module 3 Evolution of Policy

3. Sanjay Goel, School of Business/Center for Information Forensics and Assurance University at Albany Proprietary Information 3 Students should be able to: –Comprehend the dynamic nature of policies –Understand why policies change –Learn the factors which influence policy change Evolution of Policy Learning Objectives

4. Sanjay Goel, School of Business/Center for Information Forensics and Assurance University at Albany Proprietary Information 4 Policy is not static, but dynamic. This is due to the ever-changing environment that policy exists. However, just as adaptation of species is always slower than the speed of environment changes, policies may also have a tendency to lag behind. Evolution of Policy Changing Environment Environment Policy Time State

5. Sanjay Goel, School of Business/Center for Information Forensics and Assurance University at Albany Proprietary Information 5 Policy usually changes to either prevent something from happening (usually occurs after a disaster/crisis) or to “cure” or make better a situation. –E.g. To prevent a big terrorist attack similar to 9/11, policies have been created which involve information-sharing between law enforcement, stricter security checks in airports, and development of a homeland security department. Evolution of Policy Prevention and Cure –E.g. Policies which focus money on educational programs such as providing computers to schools try to bring learning and growth opportunities to children.

6. Sanjay Goel, School of Business/Center for Information Forensics and Assurance University at Albany Proprietary Information 6 There are various factors which influence the evolution of policy. These are influenced by social and non-social factors. Policy which targets social factors are less likely to be accepted because they affect peoples’ inherent beliefs and attitudes. Evolution of Policy Policy Factors –e.g. While the military is the first to adapt to technological advances in weaponry and mechanics, it has yet to institute a policy which allows for people known to be homosexual to be allowed in the military unlike most other institutions which may not discriminate on the basis of sexuality.

7. Sanjay Goel, School of Business/Center for Information Forensics and Assurance University at Albany Proprietary Information 7 Non-Social Factors –Laws and Regulations –Scientific Discoveries –Technology Advancements –Economics –Organizational Processes Social Factors –Cultural Norms and Assumptions –Human Limitations Evolution of Policy Social and Non-Social Factors

8. Sanjay Goel, School of Business/Center for Information Forensics and Assurance University at Albany Proprietary Information 8 Laws are always policies, but policies are not always laws. Policies can be used to show compliance with outside laws and regulations. –For example, implementation of a security policy and auditing procedures may indicate that an organization is compliant with Sarbanes-Oxley preventing them from facing regulatory fines. Policies can also be otherwise influenced by current laws and regulations. –A policy that violates any laws may result in lawsuits being filed. Evolution of Policy Laws and Regulations

9. Sanjay Goel, School of Business/Center for Information Forensics and Assurance University at Albany Proprietary Information 9 Sometimes policies are changed due to advocates who claim a logical or scientific foundation. However, not any information is enough- the evidence should be: –Valid –Reliable –Convincing Evolution of Policy Scientific Discoveries

10. Sanjay Goel, School of Business/Center for Information Forensics and Assurance University at Albany Proprietary Information 10 Truck Driver Hour of Service Change to Reduce Motor Vehicle Accidents –1935: Interstate Commerce Commission was directed by Congress to establish hours-of service rules for truckers –1938: With no scientific basis, hours-of-service rules limited driving to 10 hours out of 24 and a minimum of 8 consecutive off-duty hours within those 24. –1941: Commissioned study showed decline in battery of psychomotor tests during a period of 10 hours. This was not linked to motor vehicle accidents. –1950s: McFarland and Moseley report decreased performance of a driver during a 4 hour period after 24 hours of sleep deprivation in which they concluded that sleep was “important for driving”. Evolution of Policy Scientific Discoveries: Example Source: Wylie, C.D. (2005). Sleep, Science, and Policy Change. The New England Journal of Medicine, 352(2), 196-197.

11. Sanjay Goel, School of Business/Center for Information Forensics and Assurance University at Albany Proprietary Information 11 –1970s: Department of Transportation sponsored studies found short-term, cumulative, and diurnal effects for work within hours-of-service limits. No quantitative link was made between data and risk of accidents. Changes were proposed but not implemented. –1989: Study of fatigue and alertness among truckers in the U.S. and Canada with round-the-clock monitoring of 80 truck drivers more than 200,000 driver miles. Wanted to study performance on extended shifts, but ruled too dangerous. Found drivers slept less than what was required. –Determined that there is need for enforcement in the policy. Evolution of Policy Scientific Discoveries: Example Source: Wylie, C.D. (2005). Sleep, Science, and Policy Change. The New England Journal of Medicine, 352(2), 196-197.

12. Sanjay Goel, School of Business/Center for Information Forensics and Assurance University at Albany Proprietary Information 12 Policies also may change when implementations or enforcements occur through technology which is updated or due to the presence of new technology. This is especially relevant to the area of information security policy where risks are dependent on the software and hardware vulnerabilities, each of which change in a normal environment. Evolution of Policy Technology Advancements An example is cloning technology, which is currently being used to replicate sheep, cows, dogs, etc. An issue which is being discussed is whether governments should allow human cloning. Policies have been enacted which forbid human cloning.

13. Sanjay Goel, School of Business/Center for Information Forensics and Assurance University at Albany Proprietary Information 13 Even if there is agreement upon the definition of a policy, implementation, and enforcement, sometimes it may not go through or may need to be redefined due to lack of funds. –For example, the Jawahar Rozgar Yojana, a national public works scheme launched in 1989 provides more than 700 million person- work-days per year of employment for people. Evolution of Policy Economics Source: United Nations Development Program. (2000). UNDP Poverty Report. –While this has been beneficial for overall poverty, the program was meant to target women (yet only 15% of beneficiaries are women). Lack of funds for training local authorities responsible for managing the program, for completing the public works, and day care programs were described as a likely cause.

14. Sanjay Goel, School of Business/Center for Information Forensics and Assurance University at Albany Proprietary Information 14 Policy can also change due to unanticipated observed effects on social/organizational processes. This can be evaluated by intermittent surveys. However, it is important to realize that some effects are only temporary and will disappear in the long- term. –e.g. Implementing a data warehouse for information sharing between departments may result in difficulties in terms of employee time, hardware and software cost, initial testing problems, etc. However, when complete, it may prove to be an excellent time-saving and information-sharing tool. Evolution of Policy Organizational Processes

15. Sanjay Goel, School of Business/Center for Information Forensics and Assurance University at Albany Proprietary Information 15 Policies’ toughest opponent may be cultural norms and assumptions. Even though a policy may prohibit an activity, if society does not believe that it is wrong or immoral, that activity is likely to continue despite the policy. –E.g. Although it is illegal to copy and share music files because of the Digital Millennium Copyright Act, millions of people still used P2P services to file share until very recently because they believed that what they were doing wasn’t wrong (due to high CD prices and ability to sample music prior to purchase). Evolution of Policy Cultural Norms and Assumptions

16. Sanjay Goel, School of Business/Center for Information Forensics and Assurance University at Albany Proprietary Information 16 There are many limitations inherent to the body’s physiological capacity and individual attributes. For example, a policy may be too complex to understand completely or not presented in a manner which is understood in the way it was intended. In addition, each person has preferential learning styles and absorb information uniquely. This is all attributable to social and individual cognitive psychology which will be discussed in the next module. Evolution of Policy Human Limitations

17. Sanjay Goel, School of Business/Center for Information Forensics and Assurance University at Albany Proprietary Information 17 Policies continually change due to external and internal influences. They are modified to either prevent or cure a particular situation which a current policy may not impact. There are social and non-social factors which impact policy change. Policy which affects social interests of people is less likely to be accepted/effective. Non-Social Factors –Laws and Regulations –Scientific Discoveries –Technology Advancements –Economics –Organizational Processes Social Factors –Cultural Norms and Assumptions –Human Limitations Evolution of Policy Summary