What Works? Measuring the Efficacy of Cyber Policy Interventions with Quasi-Experiments

What works? How would we know? As states pass new cybersecurity and privacy legislation, natural experiments present themselves that allow us to start measuring policy efficacy. One measure of this efficacy is the number of reported state data breaches. More and more states have modified their data breach notification legislation to publicly report this data. Yet, datasets like the Data Breach Clearinghouse don't retain state level dummy variables. Without these variables, researchers cannot identify non-equivalent control groups for interrupted time series experiments. To this end, this research presents the data and a methodology to integrate 21 state level datasets of breach reports into a national dataset that retains state level metadata. Supplementing those states which publicly report breach incidents are state level data sources acquired from open records requests. This methodological progress is necessary to begin to address the research question, do state level cybersecurity policy interventions reduce the frequency of data breaches in the target population?The data for this kind of analysis has, until now, been limited to private sector firms like Advisen. Consequently, this paper leverages its data source to produce descriptive statistics on the characteristics of data breach incidents similar to findings in industry reports. Further findings include the rate of breach incident frequency and breaches per-capita over time in reporting states. Evidence demonstrates that breaches have historically been rising by ~20% per year, however, incidents plateaued starting in 2016. Annually, breach incidents per-capita are shown to be quite similar in states with shared reporting requirements. This per-capita normalization enables state level rankings of breach likelihood. However, while industry breach reports have historically limited themselves to descriptively characterizing breach activity, this methodology is also intended to enable traditional policy evaluation. Quasi-experiments of state level regulatory interventions, like the Massachusetts Data Security Law, present a case study for further policy evaluation studies. Monthly time series analysis comparing pre and post treatment with a relevant control group, presents the best means for these evaluation studies. This research consequently provides tangible code, data sources, and lessons learned for future researchers to employ to identify which regulatory interventions work. If we can start to learn from this laboratory of democracy, perhaps new regulatory interventions can be designed to protect customer data and reduce incidents of identity theft