Stanford – Vienna Transatlantic Technology Law Forum A joint initiative of Stanford Law School and the University of Vienna School of Law TTLF Working Papers No. 9 Information Security Law in the EU and the U.S. – A Risk-Based Assessment of Regulatory Policies Lukas Feiler 2011 TTLF Working Papers About the TTLF Working Papers TTLF’s Working Paper Series presents original research on technology, and business- related law and policy issues of the European Union and the US. The objective of TTLF’s Working Paper Series is to share “work in progress”. The authors of the papers are solely responsible for the content of their contributions. The TTLF Working Papers can be found at http://ttlf.stanford.edu. Please also visit this website to learn more about TTLF’s mission and activities. If you should have any questions regarding the TTLF’s Working Paper Series, please contact Vienna Law Professor Siegfried Fina, Stanford Law Professor Mark Lemley or Stanford LST Executive Director Roland Vogl at the Transatlantic Technology Law Forum http://ttlf.stanford.edu Stanford Law School University of Vienna School of Law Crown Quadrangle Department of Business Law 559 Nathan Abbott Way Schottenbastei 10-16 Stanford, CA 94305-8610 1010 Vienna, Austria Sponsors This project was co-sponsored by the Stanford-Vienna Transatlantic Technology Law Forum (Stanford Law School/University of Vienna School of Law), the Stanford Center for E-Commerce, the Europe Center at the Freeman Spogli Institute for International Studies at Stanford University, as well as supported by the University of Vienna Research Grant 2010. About the Author Lukas Feiler is an associate at Wolf Theiss Attorneys at Law, Vienna. He earned his law degree from the University of Vienna School of Law in 2008 and a Systems Security Certified Practitioner (SSCP) certification from (ISC)² in 2009. He also studied U.S. cyberspace law and intellectual property law at Santa Clara University. Previous activities include a position of Vice Director at the European Center for E- Commerce and Internet Law, Vienna (2005-2011), a traineeship with the European Commission, DG Information Society & Media, Unit A.3 “Internet; Network and Information Security” in Brussels (2009), software developer positions with software companies in Vienna, Leeds, and New York (2000-2011), and a teaching position for TCP/IP networking and web application development at the SAE Institute Vienna (2002-2006). He is the co-author of three books, the author of numerous law review articles published inter alia in the Santa Clara Computer & High Technology Law Journal, the European Journal of Law and Technology, and the Computer Law Review International, and lead developer of the open source project Query2XML, which was accepted for inclusion in the official PHP Extension and Application Repository. He has been a TTLF Fellow since August 2009 and a Europe Center Research Affiliate since November 2009. General Note about the Content The opinions expressed in this paper are those of the author and not necessarily those of the Transatlantic Technology Law Forum or any of its partner institutions, or the sponsors of this research project Suggested Citation This TTLF Working Paper should be cited as: Lukas Feiler, Information Security Law in the EU and the U.S. – A Risk-Based Assessment of Regulatory Policies, TTLF Working Paper No. 9, http://www.law.stanford.edu/program/centers/ttlf/papers/feiler_wp9.pdf. Copyright © 2011 Lukas Feiler Abstract The advancement and proliferation of information technology has led to a drastic increase of the amount of personal and non-personal information that is being stored, processed, or transmitted by individuals, businesses, and governments. These developments have increased the need for effective information security—i.e. the preservation of confidentiality, integrity, and availability of information. Since private as well as governmental actors continue to fail to provide an adequate level of information security, policy makers (legislators, judges, and regulators) were prompted to formulate regulatory policies that explicitly address the issue of information security. This paper identifies, analyses, and comparatively assesses regulatory policies in EU and U.S. law which address information security. As regards U.S. law, the paper discusses federal law as well as the law of the States of California and New York. The assessed policies typically take one of the following forms: First, they may require the implementation safeguards, whether for publicly traded companies, service providers, government authorities, software manufacturers, or organizations which handle personal information. Second, they may impose or limit liability in particular as regards software manufacturers, service providers, payment service providers, payment service users, or entities that are responsible for the processing of personal information. Third, policies addressing information security may mandate transparency, in particular by requiring the notification of breaches of information security or breaches of network security, mandating the disclosure of vulnerabilities by publicly traded companies, or prohibiting deceptive security claims about products and services. Fourth, such policies may attempt to deter malicious actors from mounting any threats against the security of information, in particular by providing criminal sanctions. To aid this comparative assessment, a risk-based assessment methodology is developed which is based on different risk treatment options. The paper also contains a concluding comparative assessment that summarizes the current state of information security regulation in the EU and the U.S. This concluding assessment highlights the extent to which current regulatory policies make use of the available risk treatment options, which actors of the information security landscape receive the most regulatory attention and which are more or less ignored, as well as whether the current regulatory policies are suitable to address the fundamental challenges of information security. Building on this concluding assessment, policy recommendations equally applicable to the EU and the U.S. are presented. The paper does not propose the adoption of a single radical measure but rather a holistic web of balanced measures that in concert may have the potential to fundamentally improve information security. Contents—Summary 1. Introduction ..................................................................................................................... 8 2. The Foundations and Challenges of Information Security............................................ 12 2.1. Information Security Defined.................................................................................. 12 2.2. Related Policy Areas ............................................................................................... 19 2.3. Actors in the Information Security Landscape........................................................ 29 2.4. Fundamental Challenges in the Field of Information Security ............................... 57 3. A Methodology for Assessing Regulatory Policies ...................................................... 73 3.1. Information Security Risk Defined ......................................................................... 73 3.2. Risk Treatment Options .......................................................................................... 82 4. Regulating Information Security by Mandating Security Controls .............................. 89 4.1. Mandatory Security Controls for Personal Information Controllers....................... 89 4.2. Mandatory Security Controls for Publicly Traded Companies............................. 179 4.3. Mandatory Security Controls for Service Providers ............................................. 187 4.4. Mandatory Security Controls for Government Authorities................................... 224 4.5. Mandatory Security Controls for Software Manufacturers................................... 235 5. Regulating Information Security by Imposing or Limiting Liability.......................... 257 5.1. Liability of Personal Information Controllers for Breaches of the Security of Personal Information............................................................................................. 258 5.2. Liability of Service Providers ............................................................................... 297 5.3. Liability of Software Manufacturers..................................................................... 322 5.4. Limiting the Liability of Payment Service Users.................................................. 379 6. Regulating Information Security by Mandating Transparency................................... 387 6.1. Mandatory Vulnerability Disclosure for Publicly Traded Companies.................. 387 6.2. Mandatory Data Security Breach Notification...................................................... 402 6.3. Mandatory Network Security Breach Notification ............................................... 474 6.4. Prohibiting Deceptive Security Claims About Products and Services.................. 495 7. Regulating Information Security by Deterring Malicious Threat Agents................... 506 7.1. Federal Computer Crime Law............................................................................... 506 7.2. State Computer Crime Law................................................................................... 515 7.3. EU Framework Decision on Attacks