---
# System prepended metadata

title: Policy Intervention

---

# Policy Intervention
## Three interventions
- Certification schemes
- Information disclosure
- Intermediary liability

## Traditional regulatory intervention
- Ex ante safety regulation
    - for cases that are potentialy catastrophic
    - prevent harm
    - One way of dealing with difficulty of measuring outcomes
- Ex post liability
    - Assign responsibility when something goes wrong

## Certification Schemes
- A government-led approach: Common Criteria certification
    - Sometimes userful, but may be gamed
    - Evaluation is paid for by vendor seeking approval, leading to test-shopping

## Information disclosure
- Cybersecurity incidents are often hidden from public view
- Many breaches came to light to prevent future failures
- **Most cybersecurity risk can be managed if**
    - it can be measured
    - reponsibility for failures clearly assigned
- Also need tranparency in 
    - Financial fraud figures
    - Cyber espoinage incidents
    - Control systems incidents
    - Consistent collection of cybercrime losses

## Indirect intermediary liability
- Liability isn't always placed on the party responsible for harm
    - Also for the parties that could've detected/prevented them
- If bad actors beyond reach of law, and a 3rd party is in good position to detect/prevent bad acts, then indirect intermediary liability attractive

## Summary
- Policies that make measurement easier (e.g., data breach legislation laws) and clarify responsibility for failures (e.g., intermediary liability assignment) could substantially improve security