No%20Cop%20on%20the%20Beat:%20Underenforcement%20in%20E-Commerce%20and%20Cybercrime

1
No Cop on the BeatUnderenforcement in
E-Commerce and Cybercrime

• Peter P. Swire
• Ohio State University
• Center for American Progress
• Fordham CLIP Information Society Symposium
• May 30, 2008

2
Coming This Monday

• A new report The ID Divide Addressing the
  Challenges of Identification and Authentication
  in American Society
• Available on Monday at www.americanprogress.org
• How to handle these issues across
  national/homeland security immigration voting
  e-health computer security privacy civil
  liberties.

3
Todays Discussion

• Data breaches, but also broader issues of
  enforcement across geographic jurisdictions --
  law review article in materials
• E.g., consumer protection crime online
• Old paradigm of mostly local enforcement
• Local enforcement, county state a cop on the
  beat
• Information is local
• Punishment deterrent effects are local
• Evidence is local

4
What Changes on the Internet?

• Information problem
• Commons problem
• Forensic problem
• Basic answer non-local answers needed for
  non-local problems
• More federal FTC
• More federated networks of state AGs

5
The Information Problem

• Physical world a cop on the beat
• A consumer complaint comes in
• Honest Amys Used Cars Shady Sams Used Cars
• Local enforcers have insight/expertise from
  previous complaints use discretion

6
The Information Problem

• For online commerce or data breach, a complaint
  comes in to the county consumer protection office
  or state AG office
• Web site typically far away
• The county/state has a tiny fraction of all
  consumer problems with the site
• The county/state has weak information for
  exercising discretion
• Likely result is underenforcement
• Underenforcement means less enforcement than we
  would expect/prefer if purely local

7
The Commons Problem

• No commons problem where bad action and victim
  are local
• Enforcers get credit for stopping local bad guys
• Local victims are protected
• Deterrent effects are local

8
The Commons Problem

• Online, enforcement incentives change
• Why should I spend my scarce prosecutorial
  resources when most of the protection goes to
  victims outside of my jurisdiction?
• Deterrence Id rather prosecute where strong
  deterrence locally
• Public choice Id rather prosecute where mostly
  local people are protected
• Let someone else go after them a classic
  commons problem -- underenforcement

9
Forensics Problem

• This problem has been recognized in the
  literature
• Its harder to enforce where the evidence is
  outside of the locality
• Harder to get cooperation from distant officials
• Harder to trace where you dont have compulsory
  process or other sources
• Result is underenforcement

10
Responses to Underenforcement

• Information problem
• Information sharing Consumer Sentinel
• Commons problem
• Cross-border task forces
• Organize around subject matter data breach, ID
  theft, spam, etc.
• Forensic problem
• COE Cybercrime Convention for criminal
• US SAFE WEB Act for FTC

11
Responses to the Problem

• More generally, recognize the need to match
  solutions to the scale of the problems
• National (and international), so have national
  solutions
• FTC role for data breach (Choicepoint), spam,
  spyware, and other consumer protection
• FTC staffing still far below 1980 levels
• Federated NAAG and other efforts to match
  geography with the problems

12
Some Objections

• Law review article addresses these
• The Internet hasnt really changed anything
• Enforcement works better on the Internet
• We dont really want to enforce the law
• States need to be laboratories of
  experimentation
• The Feds dont do small potatoes

13
Conclusion

• The paper highlights the information and commons
  problems that exist for local enforcement and
  non-local fraud crime
• Likely need to shift to federal or federated
  enforcement
• For whatever level of enforcement we want for
  each type of law, the next Administration should
  design strategies that address these problems