No Cop on the Beat:No Cop on the Beat:Underenforcement in E-Commerce Underenforcement in E-Commerce

and Cybercrimeand Cybercrime

Peter P. SwirePeter P. SwireOhio State University & Ohio State University &

Center for American ProgressCenter for American ProgressFordham CLIP Information Society SymposiumFordham CLIP Information Society Symposium

May 30, 2008 May 30, 2008

Coming This MondayComing This Monday

A new report: “The ID Divide: Addressing the A new report: “The ID Divide: Addressing the Challenges of Identification and Authentication Challenges of Identification and Authentication in American Society”in American Society”

Available on Monday at Available on Monday at www.americanprogress.org

How to handle these issues across How to handle these issues across national/homeland security; immigration; voting; national/homeland security; immigration; voting; e-health; computer security; privacy; civil e-health; computer security; privacy; civil liberties.liberties.

Today’s DiscussionToday’s Discussion

Data breaches, but also broader issues of Data breaches, but also broader issues of enforcement across geographic jurisdictions -- law enforcement across geographic jurisdictions -- law review article in materialsreview article in materials

E.g., consumer protection & crime onlineE.g., consumer protection & crime online Old paradigm of mostly local enforcement:Old paradigm of mostly local enforcement:

Local enforcement, county & state – a cop on the Local enforcement, county & state – a cop on the beatbeat

Information is localInformation is local Punishment & deterrent effects are localPunishment & deterrent effects are local Evidence is localEvidence is local

What Changes on the Internet?What Changes on the Internet?

Information problemInformation problem Commons problemCommons problem Forensic problemForensic problem Basic answer: non-local answers needed for Basic answer: non-local answers needed for

non-local problemsnon-local problems More federal – FTCMore federal – FTC More federated – networks of state AGsMore federated – networks of state AGs

The Information ProblemThe Information Problem

Physical world: a cop on the beatPhysical world: a cop on the beat A consumer complaint comes inA consumer complaint comes in

Honest Amy’s Used Cars & Shady Sam’s Honest Amy’s Used Cars & Shady Sam’s Used CarsUsed Cars

Local enforcers have insight/expertise from Local enforcers have insight/expertise from previous complaints & use discretionprevious complaints & use discretion

The Information ProblemThe Information Problem

For online commerce or data breach, a complaint For online commerce or data breach, a complaint comes in to the county consumer protection office or comes in to the county consumer protection office or state AG officestate AG office

Web site typically far awayWeb site typically far away The county/state has a tiny fraction of all consumer The county/state has a tiny fraction of all consumer

problems with the siteproblems with the site The county/state has weak information for exercising The county/state has weak information for exercising

discretiondiscretion Likely result is underenforcementLikely result is underenforcement

““Underenforcement” means less enforcement than Underenforcement” means less enforcement than we would expect/prefer if purely localwe would expect/prefer if purely local

The Commons ProblemThe Commons Problem

No commons problem where bad action No commons problem where bad action and victim are localand victim are local Enforcers get credit for stopping local bad Enforcers get credit for stopping local bad

guysguys Local victims are protectedLocal victims are protected Deterrent effects are localDeterrent effects are local

The Commons ProblemThe Commons Problem

Online, enforcement incentives changeOnline, enforcement incentives change ““Why should I spend my scarce prosecutorial Why should I spend my scarce prosecutorial

resources when most of the protection goes to resources when most of the protection goes to victims outside of my jurisdiction?”victims outside of my jurisdiction?”

Deterrence – I’d rather prosecute where strong Deterrence – I’d rather prosecute where strong deterrence locallydeterrence locally

Public choice – I’d rather prosecute where Public choice – I’d rather prosecute where mostly local people are protectedmostly local people are protected

““Let someone else go after them” – a classic Let someone else go after them” – a classic commons problem -- underenforcementcommons problem -- underenforcement

Forensics ProblemForensics Problem

This problem has been recognized in the This problem has been recognized in the literatureliterature

It’s harder to enforce where the evidence is It’s harder to enforce where the evidence is outside of the localityoutside of the locality Harder to get cooperation from distant officialsHarder to get cooperation from distant officials Harder to trace where you don’t have Harder to trace where you don’t have

compulsory process or other sourcescompulsory process or other sources Result is underenforcementResult is underenforcement

Responses to UnderenforcementResponses to Underenforcement

Information problemInformation problem Information sharing: Consumer SentinelInformation sharing: Consumer Sentinel

Commons problemCommons problem Cross-border task forcesCross-border task forces Organize around subject matter – data breach, Organize around subject matter – data breach,

ID theft, spam, etc.ID theft, spam, etc. Forensic problemForensic problem

COE Cybercrime Convention for criminalCOE Cybercrime Convention for criminal US SAFE WEB Act for FTCUS SAFE WEB Act for FTC

Responses to the ProblemResponses to the Problem

More generally, recognize the need to match More generally, recognize the need to match solutions to the scale of the problemssolutions to the scale of the problems National (and international), so have national National (and international), so have national

solutionssolutions• FTC role for data breach (Choicepoint), FTC role for data breach (Choicepoint),

spam, spyware, and other consumer spam, spyware, and other consumer protectionprotection

• FTC staffing still far below 1980 levelsFTC staffing still far below 1980 levels Federated – NAAG and other efforts to match Federated – NAAG and other efforts to match

geography with the problemsgeography with the problems

Some ObjectionsSome Objections Law review article addresses these:Law review article addresses these:

““The Internet hasn’t really changed anything”The Internet hasn’t really changed anything” ““Enforcement works better on the Internet”Enforcement works better on the Internet” ““We don’t really want to enforce the law”We don’t really want to enforce the law” ““States need to be laboratories of States need to be laboratories of

experimentation”experimentation” ““The Feds don’t do small potatoes”The Feds don’t do small potatoes”

ConclusionConclusion

The paper highlights the information and The paper highlights the information and commons problems that exist for local commons problems that exist for local enforcement and non-local fraud & crimeenforcement and non-local fraud & crime

Likely need to shift to federal or federated Likely need to shift to federal or federated enforcement enforcement

For whatever level of enforcement we want for For whatever level of enforcement we want for each type of law, the next Administration should each type of law, the next Administration should design strategies that address these problemsdesign strategies that address these problems