Why Germany’s Cybersecurity Law Isn’t Working

This summer, Germany adopted a new law, known in German as the IT-Sicherheitsgesetz, to regulate cybersecurity practices in the country. The law requires a range of critical German industries establish a minimal set of security measures, prove they’ve implemented them by conducting security audits, identify a point of contact for IT-security incidents and measures, and report severe hacking incidents to the federal IT-security agency, the BSI (Bundesamt für Sicherheit in der Informationstechnik). Failure to comply will result in sanctions and penalties. Specific regulations apply to the telecommunications sector, which has to deploy state of the art protection technologies and inform their customers if they have been compromised. Other tailored regulations apply to nuclear energy companies, which have to abide by a higher security standard. Roughly 2000 companies are subject to the new law.

The government sought private sector input early on in the process of conceptualizing the law—adhering to the silly idea of multistakeholderism—but it hasn’t been helpful in heading off conflict. German critical infrastructure operators have been very confrontational and offered little support. Despite some compromises from the Ministry of the Interior, which drafted the law, German industry continues to disagree with most of its contents.

First, there are very few details to clarify what is meant by “minimal set of security measures” and “state of the art security technology.” The vagueness of the text is somewhat understandable. Whenever ministries prescribed concrete technologies and detailed standards in the past, they were mostly outdated when the law was finally enacted (or soon after that), so some form of vagueness prevents this. But vagueness is inherently problematic. Having government set open standards limits market innovation as security companies will develop products to narrowly meet the standards without considering alternatives that could improve cybersecurity. Moreover, the IT security industry is still immature. It is impossible to test and verify a product’s ultimate effectiveness and efficiency, leading to vendors promising a broad variety of silver bullet cybersecurity solutions—a promise that hardly lasts longer than the first two hours of deployment.

The vague language gives significant leeway to the Interior ministry, leaving companies unsure whether they meet the law’s requirements. Will the ministry be happy with a chosen product? Will it be sufficient to meet the standards? Would a lesser product have done the trick? And what exactly is “state of the art in security technology” when everyone promises to be state of the art without any way of verifying claims? The lax formulation of the law creates clear risks for German industry. It’s possible that the ministry will never be sufficiently happy and will use the absence of concrete formulations to continually raise standards, which in turn means continuous costs for the companies. Furthermore, German companies will be forced to buy something in the absence of clarity about the quality of a product, which may drive some of them into costly path dependencies.

(See also: Who Defends the Virtual Countries of Tomorrow?)

Second, the mandatory severe incident reporting requirement is problematic. It has been a major point of contention since the draft law was introduced two years ago. There are three problems:

1. It is not clear what constitutes a “severe” incident. This is especially difficult as many incidents have a certain potential to be severe in some way. Also, verifying severity means additional costs through forensic analysis.
2. The costs of reporting are unclear. The ministry has made some assumptions regarding costs—namely that a company usually has about seven severe incidents per year, with reporting costs of €660 per incident, amounting to total costs of €9.24 million to implement the law across the roughly 2000 companies to whom it would apply. It’s unclear how the ministry came up with those numbers. For its part, the German industry alliance BDI (Bundesverband der deutschen Industrie) estimated the total cost of implementation at €1.1 billion.
3. There are reputational damages that come with reporting incidents. If only German industries have a reporting requirement while competing foreign companies do not, customers may get the impression that German companies and products are particularly careless and vulnerable, hindering Germany’s economy.

Accordingly, industry groups have been seeking a compromise to avoid naming and shaming. They proposed making reporting anonymous and that reports be submitted to a trusted third party, similar to U.S. information sharing and analysis organizations, not to the government. Under existing German law, reporting incidents to government may require law enforcement agencies to open a criminal case, bringing unwanted attention. Not reporting to government would also minimize the risk of having incident reports accidentally leaked to the public.

While the government conceded on making reporting anonymous, they didn’t accede to the third party reporting as it may have been inconsistent with German law.

This solution, however, is somewhat half-baked. The government is not entirely happy with keeping reports anonymous since it is interested in knowing more about incidents and security laggards. Industry is skeptical that the government will be able to keep reports anonymous and fears further regulation following the large number of severe incidents expected to be reported annually.

In the end, the law will probably not be very effective, require a lot of follow-up regulation, and remain controversial. Nevertheless, there’s silver lining. At least there is a law to improve cybersecurity. It will serve as a beachhead for future regulations and incentivize the private sector to be less negligent when it comes to cybersecurity. From this perspective, the law has already changed a lot.

This post appears courtesy of CFR.org.