I discuss here two illustrative cases of paradoxical puzzles in cybersecurity:

1) To reduce failures, aim at having some failures;

2) To get better international cybersecurity, have fewer rules and limit prosecutorial-type enforcement.

First, to reduce failures, don't aim at a state where there are no failures. More sophisticated approaches to cybersecurity embrace paradox (or, if you will, irony). One salient example is the concept of “zero trust,” where, in effect, cybersecurity never sleeps. Additionally, a state of perfect security would breed complacency. Preferable to have imperfect security, where skirmishes lead to vigilance, and modest occurrences of failure cultivate determination.

Second, while rules and enforcement are important parts of any cybersecurity program, in dealing with nation-state actors who may not be subject to U.S. domestic law enforcement (akin to dealing with quantum particles that do not observe Newtonian laws of physics), it's often preferable to aim at somewhat ambiguous principles which enjoy broad consensus than to aim at rules and enforcement. Read more about Tool Without A Handle: Cybersecurity Paradoxes

The Law Commission in the United Kingdom recently completed its massive study on domestic legal reform for automated driving. As the UK government works to implement the study’s thoughtful recommendations, the Commission’s experts are now turning to the topic of remote driving. I’m happy to offer a few thoughts.

First, “remote driving” encompasses a range of scenarios.

The remote human might be: Read more about On Remote Driving

This week I participated in an unusually collegial and productive Senate hearing about approaches to platform transparency, presided over by Senator Coons. My detailed written testimony, including appendices listing other resources and attempting to identify platforms potentially covered by proposed laws, is here. It captures a lot of detailed questions and concerns that I have been thinking about for a while, but not had time to write about anywhere else, including about surveillance issues. Read more about My Senate Testimony About Platform Transparency

People keep asking me what the EU’s new Digital Services Act (DSA) says. So far, I have not found overview materials that seem like the right match for people unfamiliar with the EU legal and policy landscape. So here is my own very quick and dirty rundown.

Read more about What Does the DSA Say?