Last week, I had the opportunity to testify before the House Science Committee’s Subcommittee on Technology and Innovation on the topic of “cybersecurity.” I have been reluctant to opine on it because of its complexity, but I did issue a short piece a few months ago arguing against government-run cybersecurity. That piece was cited prominently in the White House’s “Cyberspace Policy Review” and – blamo! – I’m a cybersecurity expert.

Not really – but I have been forming some opinions at a high level of generality that are worth making available. They can be found in my testimony, but I’ll summarize them briefly here.

First, “cybersecurity” is a term so broad as to be meaningless. Yes, we are constructing a new “space” analogous to physical space using computers, networks, sensors, and data, but we can no more secure “cyberspace” in its entirety than we can secure planet Earth and the galaxy. Instead, we secure the discrete things that are important to us – houses, cars, buildings, power lines, roads, private information, money, and so on. And we secure these things in thousands of different ways. We should secure “cyberspace” the same way – thousands of different ways.

By “we,” of course, I don’t mean the collective. I mean that each owner or controller of a prized thing should look out for its security. It’s the responsibility of designers, builders, and owners of houses, for exmple, to ensure that they properly secure the goods kept inside. It’s the responsibility of individuals to secure the information they wish to keep private and the money they wish to keep. It is the responsibility of network operators to secure their networks, data holders to secure their data, and so on.

Second, “cyber” threats are being over-hyped by a variety of players in the public policy area. Invoking “cyberterrorism” or “cyberwar” is near-boilerplate in white papers addressing government cybersecurity policy, but there is very limited strategic logic to “cyberwarfare” (aside from attacking networks during actual war-time), and “cyberterrorism” is a near-impossibility. You’re not going to panic people – and that’s rather integral to terrorism – by knocking out the ATM network or some part of the power grid for a period of time.

(We weren’t short of careless discussions about defending against “cyber attack,” but L. Gordon Crovitz provided yet another example in yesterday’s Wall Street Journal. As Ben Friedman pointed out, Evgeny Morozov has the better of it in the most recent Boston Review.)

This is not to deny the importance of securing digital infrastructure; it’s to say that it’s serious, not scary. Precipitous government cybersecurity policies – especially to address threats that don’t even have a strategic logic – would waste our wealth, confound innovation, and threaten civil liberties and privacy.

In the cacophony over cybersecurity, an important policy seems to be getting lost: keeping true critical infrastructure offline. I noted Senator Jay Rockefeller’s (D-WV) awesomely silly comments about cybersecurity a few months ago. They were animated by the premise that all the good things in our society should be connected to the Internet or managed via the Internet. This is not true. Removing true critical infrastructure from the Internet takes care of the lion’s share of the cybersecurity problem.

Since 9/11, the country has suffered significant “critical-infrastructure inflation” as companies gravitate to the special treatments and emoluments government gives owners of “critical” stuff. If “criticality” is to be a dividing line for how assets are treated, it should be tightly construed: If the loss of an asset would immediately and proximately threaten life or health, that makes it critical. If danger would materialize over time, that’s not critical infrastructure – the owners need to get good at promptly repairing their stuff. And proximity is an important limitation, too: The loss of electric power could kill people in hospitals, for example, but ensuring backup power at hospitals can intervene and relieve us of treating the entire power grid as “critical infrastructure,” with all the expense and governmental bloat that would entail.

So how do we improve the state of cybersecurity? It’s widely believed that we are behind on it. Rather than figuring out how to do cybersecurity – which is impossible – I urged the committee to consider what policies or legal mechanisms might get these problems figured out.

I talked about a hierarchy of sorts. First, contract and contract liability. The government is a substantial purchaser of technology products and services – and highly knowledgeable thanks to entities like the National Institutes of Standards and Technology. Yes, I would like it to be a smaller purchaser of just about everything, but while it is a large market actor, it can drive standards and practices (like secure settings by default) into the marketplace that redound to the benefit of the cybersecurity ecology. The government could also form contracts that rely on contract liability – when products or services fail to serve the purposes for which they’re intended, including security – sellers would lose money. That would focus them as well.

A prominent report by a working group at the Center for Strategic and International Studies – co-chaired by one of my fellow panelists before the Science Committee last week, Scott Charney of Microsoft – argued strenuously for cybersecurity regulation.

But that begs the question of what regulation would say. Regulation is poorly suited to the process of discovering how to solve new problems amid changing technology and business practices.

There is some market failure in the cybersecurity area. Insecure technology can harm networks and users of networks, and these costs don’t accrue to the people selling or buying technology products. To get them to internalize these costs, I suggested tort liability rather than regulation. While courts discover the legal doctrines that unpack the myriad complex problems with litigating about technology products and services, they will force technology sellers and buyers to figure out how to prevent cyber-harms.

Government has a role in preventing people from harming each other, of course, and the common law could develop to meet “cyber” harms if it is left to its own devices. Tort litigation has been abused, and the established corporate sector prefers regulation because it is a stable environment for them, it helps them exclude competition, and they can use it to avoid liability for causing harm, making it easier to lag on security. Litigation isn’t preferable, and we don’t want lots of it – we just want the incentive structure tort liability creates.

As the distended policy issue it is, “cybersecurity” is ripe for shenanigans. Aggressive government agencies are looking to get regulatory authority over the Internet, computers, and software. Some of them wouldn’t mind getting to watch our Internet traffic, of course. Meanwhile, the corporate sector would like to use government to avoid the hot press of market competition, while shielding itself from liability for harms it may cause.

The government must secure its own assets and resources – that’s a given. Beyond that, not much good can come from government cybersecurity policy, except the occassional good, long blog post.

The Eli and Edythe Broad and Bill and Melinda Gates foundations have sponsored a report, “Smart Options: Investing the Recovery Funds for Student Success,” on how to spend $100 billion of “stimulus money” on improving America’s schools, according to Jay Mathews in The Washington Post. Ideas include national standards, better teacher evaluations, special help for struggling students, and more.

But let’s try a thought experiment. Bill Gates made his money in software. Eli Broad made his money building houses. Imagine a slightly different universe, say one in which Henry Wallace and Al Gore had become president, and we had monopoly providers of both software and housing. How good do you think the software and the housing would be? And if the U.S. Department of Technology and the U.S. Department of Housing announced that they would be spending another $100 billion, what would happen?

It seems clear that the way to improve housing and software in that world would be to open the fields up to competition, or even to privatize them. A government monopoly provider of software would be lucky to have given us Minitel by now. And monopoly provision of housing was tried in much of the world during the 20th century, with poor results. So if we were afflicted with these albatrosses, surely we’d recognize that deregulation, competition, and privatization would produce better results by far.

So then why don’t we realize it when we’re afflicted with a virtual government monopoly on the provision of education? Why are zillions of smart people studying and debating how to improve the performance of a sluggish, stagnant, tax-funded government monopoly? Maybe we shouldn’t be so sure that we’d see the failure of the software or housing monopoly either. Whatever enterprise the government chooses to monopolize – and there’s really nothing inherent or inevitable about which enterprises that will be – will most likely become a massive bureaucratic undertaking, and we will find it difficult to imagine how the enterprise could be privately run.

But Bill and Melinda, Eli and Edythe, Jay, Barack – the evidence on monopoly vs. competitive provision of services is out there. To a great extent it’s the history of the 20th century. Check it out.

I wrote here in February about the push and pull over “strip search machines,” also known as “whole-body imaging” and “millimeter wave scanning.”

The question is joined: How do you maintain privacy with a technology that’s fundamentally intrusive? Maybe by using it less. This week, Rep. Jason Chaffetz (R-UT) introduced a bill to limit the use of whole-body imaging.

H.R. 2027, the Aircraft Passenger Whole-Body Imaging Limitations Act of 2009, would place several limits:

• Whole-body imaging could not be the sole or primary method of screening a passenger, and it could only be used as a follow-up to other methods like metal detection.
• Passengers would have the right to opt for a pat-down search instead of whole-body imaging.
• Passengers subject to whole-body imaging would have to be provided information about the technology and the images it generates, on privacy policies, and the right to have the pat-down search instead.
• Images of passengers generated by whole-body imaging technology could not be stored, transferred, shared, or copied in any form after the passenger has passed through the security system.

Most of these protections are already TSA policy, but agency policies are relatively easy to change compared to federal law. Without limitations like this, these machines are on the natural, mission-creepy path to becoming mandatory.

Rules, of course, were made to be broken, and it’s only a matter of time — federal law or not — before TSA agents without proper supervision find a way to capture images contrary to policy. (Agent in secure area guides Hollywood starlet to strip search machine, sends SMS message to image reviewer, who takes camera-phone snap. TMZ devotes a week to the story, and the ensuing investigation reveals that this has been happening at airports throughout the country to hundreds of women travelers.)

So this bill is a step forward, but from a very backwards position. Ultimately, as I wrote before, the solution is to return responsibility for security to the airlines and airports, who are most interested in and capable of balancing all the factors that go into safe travel, including passengers’ privacy, comfort, and peace of mind.