Vol. 25 - Issue 1

To combat bioterrorism and cybercrime in the 2000s, antitrust agencies stepped up where Congress failed repeatedly to pass a cybersecurity bill. Their actions were surprising both in content and method. Substantively, the policy the FTC and DOJ promoted was to encourage plausibly anticompetitive joint ventures to proceed, so long as these collaborations existed for cyber safety purposes. The administrative agencies pursued this policy not via either formal or informal rulemaking, but rather a network of non-binding guidance known as “soft law.” This technique structured industry incentives such that joint ventures would continue developing cyber defense mechanisms to protect the entire country. This analysis forces questions about ongoing debates within antitrust law and theories of agency activity. The Article also muses on why decentralized regulation, typically a polarizing subject, is so universally favored for cyber governance.

Questions over what constitutes “reasonable” cybersecurity reporting and operating practices have long vexed businesses and policymakers. Given a lack of clear guidance from Congress, states have filled the vacuum by passing a series of laws requiring “reasonable” cybersecurity such as for manufacturers of Internet- connected devices. Other states have elected instead to provide safe harbors, like Ohio, which rewards companies for investing in a pre- determined list of recognized cybersecurity standards and frameworks—such as the National Institute for Standards and Technology (NIST) Cybersecurity Framework—by minimizing liability in the aftermath of a data breach. This Article: (1) summarizes the current state of state-level cybersecurity policymaking with a special emphasis on how states are defining “reasonable” cybersecurity; (2) discloses the results of a statewide survey on cybersecurity perceptions and practices among organizations in Indiana done in partnership with the Indiana Attorney General’s Office; and (3) makes a series of suggestions based on these findings about how to better educate and incentivize firms about instituting reasonable cybersecurity best practices.