At the 2008 Workshop on the Economics of Information Security (WEIS 2008) at Dartmouth College last month (see also my overview in this column), there were many fascinating research papers presented by distinguished scholars. In this short series, I will summarize some of the most striking findings of several researchers whose work I particularly enjoyed (I must quickly add that my not discussing particular articles should in no way be construed as criticism).

Sasha Romanosky, a doctoral student, presented a paper he co-authored with Prof. Rahul Telang and Prof. Alessandro Acquisti. The three researchers are from the Heinz School of Public Policy and Management, at Carnegie Mellon University. Their paper is “Do Data Breach Disclosure Laws Reduce Identity Theft?" Carnegie Mellon’s CyLab summarized their work and pointed to a June 5 article about it by Robert McMillan.

The key points of the researchers’ methods and findings were:

• The question: do data-breach-disclosure laws reduce the frequency of identity theft?
• The researchers used the Freedom of Information Act to request identity theft data from the FTC over the years 2002 to 2006.
• Their statistical model allowed them to control for many economic and demographic factors.
• In this preliminary paper, they found a negative but not statistically significant relationship between implementation of data-breach-disclosure laws and the rate of identity theft.
• The absence of measurable relationship may indicate an absence in reality (what statisticians call the parametric values) or may indicate problems in the sampling (size or quality of the dataset). However, see the next comment immediately below.

The researchers have since augmented their analysis and data to include 2007 identity thefts and find negative and statistically significant but marginal effect of disclosure laws on identity theft rates (a reduction of 1.2 reported thefts per 100,000 population or about 2% of the crime rate). Sasha Romanosky commented:

“It’s not clear whether that’s a large enough effect to justify the laws. Nor is it clear what is the net social effect (costs relative to benefits). There are likely other benefits of these disclosure laws, and we are studying only one possible outcome. We also recognize that to be most effective, the responsibility lies with both firms and consumers to take appropriate action to prevent identity theft.”

M. E. Kabay, PhD, CISSP-ISSMP, is Program Director of the Master of Science in Information Assurance program at Norwich University.