Information security for electronic commerce on the Internet: The need for a new policy and new research

A flurry of events in 1995 demonstrated that issues related to electronic commerce and information security are of deep concern to the public, businesses, government, researchers, and users of the rapidly expanding Internet. The sometimes heated and wide ranging debate concerning cryptographic policy, content controls, commerce, and interoperability on the Internet tends to divert attention away from the need for a reasoned assessment and understanding of the true dynamics of nurturing a diverse global marketplace on the Internet. Lost in the contentious debate is a principle we feel is particularly important given the nature of information technology: that a policy consistent with user requirements and market acceptance provides economic benefits. In some cases, the 'economic pie' can be expanded-or shrunk-by corporate or government actions, inevitably affecting all. We argue that information security is compromised if federal policies and corporate initiatives ignore user requirements and the basic principles of Internet economics. This in turn may limit market acceptance of new research, services, applications, and technologies. For example, unintended results from ill-formed federal laws may severely limit economic benefits gained from billions of dollars of federally sponsored research that created and sustained the Internet. Furthermore, in the guise of enhanced security and advanced features, proprietary systems and partitioned markets lead to a lack of interoperability that further compromises prospects for society to realize the aforementioned benefits. Many of these problems can be avoided by an open policymaking process that is informed by collaborative research and development activities. It would be ironic indeed if the set of federal policies that founded and sustained the precursors of the evolving electronic marketplace centered on the Internet forced those new opportunities offshore. Aside from affecting the balance of trade, jobs and opportunities for further innovation will possibly be lost to overseas competitors. Specifically, the information security policies of the Cold War era, which provided much of the motivation for the critical federal research and development support of the Internet and its predecessors, the NSFnet and ARPANET, threaten to cripple the development of commercially acceptable levels of security for electronic marketplace transactions. These issues are discussed in this paper, by drawing on recent events and the Commerce and Information Security session of March 9-10, 1995; part of an NSF and ARPA- sponsored workshop on Internet Economics held at MIT. An intensified dialog among industry, academia, government, and the public on information security and electronic commerce issues is clearly needed. Our research shows that these issues are critical to establishing and maintaining U.S. leadership in the Age of Information.