The perils of cybersecurity regulation

Abstract Cybersecurity is a major U.S. policy issue with a sizable coalition advocating for greater government intervention due to perceived information challenges. Most proposals, however, do not assess whether the prescription actually improves the transmission of relevant knowledge and appropriately channels motivations towards producing socially optimal cybersecurity. In fact, knowledge and incentive problems associated with regulatory regimes may imperil the market’s ability to innovate, which is critical due to the dynamics of cyberspace. I employ Israel Kirzner’s (University of Chicago Press, 1985) market process framework to investigate these regulatory perils, highlighting analogous policies that have resulted in worse information security outcomes. Incorrect policy prescriptions, regime uncertainty, procedural rigidity, increased barriers to entry, and perverse incentives are among the leading threats to cybersecurity market entrepreneurialism from state intervention.