Critical Infrastructure, Cybersecurity, and Market Failure
111 See Paul Rosenzweig, The Unpersuasiveness of the Case for Cybersecurity Regulation–An Introduction, LAWFARE BLOG (May 17, 2012, 12:35 PM), https://www.lawfareblog.com/unpersuasiveness-case-cybersecurity-regulation-%E2%80%93-introduction. In his opposition to regulation, Mr. Rosenzweig argues: (1) More regulation is not necessary because cyber vulnerabilities of CI are not an existential threat; (2) Regulation is not the only way that governments deal with externalities. They can also be addressed through other means like subsidies, taxes, and the imposition of liability; (3) Regulation is an especially poor choice for use in a dynamic and changing environment where existing performance standards will almost certainly be irrelevant within a few years; (4) No Federal…
