The economics of mandatory security breach reporting to authorities

Legislators in many countries enact security breach notification regulation to address a lack of information security. The laws designate authorities to collect breach reports and advise firms. We devise a principal–agent model to analyze the economic effect of mandatory security breach reporting to...

Authors: Laube, Stefan
Böhme, Rainer
Division/Institute:FB 04: Wirtschaftswissenschaftliche Fakultät
Document types:Article
Media types:Text
Publication date:2016
Date of publication on miami:10.02.2017
Modification date:16.04.2019
Edition statement:[Electronic ed.]
Source:Journal of Cybersecurity 2 (2016) 1, 29-41
DDC Subject:330: Wirtschaft
License:CC BY-NC 4.0
Language:English
Notes:Finanziert durch den Open-Access-Publikationsfonds 2015/2016 der Westfälischen Wilhelms-Universität Münster (WWU Münster).
Format:PDF document
ISSN:2057-2093
URN:urn:nbn:de:hbz:6-53229502051
Permalink:http://nbn-resolving.de/urn:nbn:de:hbz:6-53229502051
Other Identifiers:DOI: 10.1093/cybsec/tyw002
Digital documents:tyw002.pdf

Legislators in many countries enact security breach notification regulation to address a lack of information security. The laws designate authorities to collect breach reports and advise firms. We devise a principal–agent model to analyze the economic effect of mandatory security breach reporting to authorities. The model assumes that firms (agents) have few incentives to unilaterally report breaches. To enforce the law, regulators (principals) can introduce security audits and sanction noncompliance. However, audits cannot differentiate between concealment and nescience of the agents. Even under optimistic assumptions regarding the effectiveness of mandatory security breach reporting to authorities in reducing individual losses, our model predicts that it may be difficult to adjust the sanction level such that breach notification laws generate social benefit.