their analysis results show that both facilitating end-user precautions and increasing the enforcement rate decreases the attackers’ efforts, so a higher enforcement level can lead to reduced user precautions in equilibrium. thus, when there are sufficient corporate or government deterrents in place, enforcing laws will only have a positive effect if Internet users continue to take a reasonable level of precaution with information privacy. the authors offer useful managerial and policy contributions through additional analyses of how Internet user precautions and deterrence policies are differentially attractive for fending off hackers when the costs of attacks and precautions vary, and when users place different valuations on data security.