Protecting the Security of Information

The first and best line of defense against unwarranted intrusions into personal privacy is for individuals to employ e-commerce technology to protect themselves. Industry-developed and supplied encryption technologies and firewalls, for example, provide individuals with substantial tools to guard against unwarranted intrusions.

Encryption is technology, in either hardware or software form, which scrambles e-mail, database information, and other computer data to keep them private. Using a sophisticated mathematical formula, modern encryption technology makes it possible to protect sensitive information with an electronic lock that bars thieves, hackers, and industrial spies.

In light of the recent tragic events of 9-11, security in all its forms (including security against cyber intrusion and attack) is more important than ever. Strong encryption technology plays a key role in such security, helping individuals, businesses, and governments protect sensitive or personal information against willful or malicious theft. Not surprisingly, then, nations have increasingly adopted policies that encourage the widespread availability of encryption tools for consumers. At the same time, they have successfully worked to permit law enforcement to access encrypted communications in certain critical instances, while rejecting calls for encryption products to be undermined through the building of “back-door” government keys.

A firewall is essentially a filter that controls access from the Internet into a computer network, blocking the entry of communications or files that are unauthorized or potentially harmful. By controlling Internet “traffic” in a network, firewalls protect individuals and organizations against unwanted intrusions, without slowing down the efficiency of the computer or network’s operations. They also limit intrusions to one part of a network from causing damage to other parts, thereby helping to prevent large-scale system shutdowns brought on by cyber attacks. Not surprisingly, then, firewalls have become a key component of computer systems today, and their architecture comprises some of the most state-of-the-art e-commerce technology available in today’s marketplace.

But, computer security, or cyber security, is more than encryption, and it requires more than a onetime fix. It is an ongoing process requiring the adoption of strong security policies, the deployment of proven cyber security software and appliances-such as antivirus, firewalls, intrusion detection, public key infrastructure (PKI), and vulnerability management, as well as encryption-and, in the case of larger organizations, the existence of trained security professionals. These professionals, in turn, must be continually retrained in order to ensure that they are able to address and combat the evolving nature of cyber threats.

Strong security tools alone, however, cannot protect users against threats in each and every instance. Dedicated hackers and criminals will always seek new ways of circumventing even the most effective security technologies. That is why it is critical that strong laws be put in place to deter such activities. In particular, where needed, laws should make it illegal to defeat, hack, or interfere with computer security measures, and penalties for these crimes should be substantial.

As is the case with copyright laws, however, strong words in a statute are not enough. Effective antihacking and computer security laws must:

• Provide deterrent civil and criminal penalties.

• Be backed by vigorous enforcement by governments (including through adequate funding of such enforcement).

• Allow private parties to pursue fast and inexpensive remedies when their cyber security has been illegally breached.

Although the government should create a strong legal framework against cyber crime, it should not intervene in the marketplace and pick e-commerce technology “winners” by prescribing arbitrary standards in the security field. Such intervention would do little more than freeze technological development and limit consumer choice. Instead, the development and deployment of security tools should be determined by technological advances, marketplace forces, and individual needs, and should be free of regulation.