An important related problem for consumers and firms that operate their businesses
on the Internet is information security [16, 17, 23]. In “Information Security:
Facilitating User Precautions Vis‑à‑Vis Enforcement Against Attackers,” Ivan P.L.
Png and Qiu‑hong Wang investigate information security policies that encourage
Internet users to take appropriate precautions and that result in enforcement against
hackers. The authors focus on large-scale mass attacks and more narrowly targeted
attacks on the Internet. Their core perspective is to recognize how Internet users and
data privacy attackers strategically interact. Their analysis results show that both
facilitating end-user precautions and increasing the enforcement rate decreases the
attackers’ efforts, so a higher enforcement level can lead to reduced user precautions
in equilibrium. Thus, when there are sufficient corporate or government deterrents
in place, enforcing laws will only have a positive effect if Internet users continue to
take a reasonable level of precaution with information privacy. The authors offer useful
managerial and policy contributions through additional analyses of how Internet
user precautions and deterrence policies are differentially attractive for fending off
hackers when the costs of attacks and precautions vary, and when users place different
valuations on data security.