you still to this day hear lots of cases about people had a laptop unencrypted in the back of a laptop that got stolen is the cause for a lot of them. the key is the lack of incentives, they don't bear the cost of data security in a lot of cases. in some cases data beach notification might be triggered and that's annoying and expensive and you have to hire steve. so there is definitely a cost there, but they aren't the ones who bear -- like when the consumer has credit -- their credit is attacked, when they have identity theft, this he don't bear the cost of that. the ftc maybe has data security authority, they brought a lot of cases, they use an old statute from 100 years ago to say the companies are required to use reasonable data security, but that's being attacked in court right now and even if the ftc can bring an action they can't get penalties. the ftc can say you used unreasonable security and the company signs an order saying yes, i did, i will stop doing that. so the companies can treat poor security as a st could of doing business. it probably should be a cost. they can't us

you hear lots of cases about someone had a laptop unencrypted in the back of the car that got stolen. for me from the policy perspective the key is the lack of incentives. they just don't bear the cost of data security in a lot of cases. in some cases data beach notification might be triggered and that's annoying and it's expensive, you have to hire steve. so there is definitely a cost there, but they aren't the ones who bear -- like when the consumer has credit -- their credit is attacked, when they have identity theft they don't bear the cost of that. the ftc maybe has data security authority, they brought a lot of cases, this he use an old statute from 100 years ago to say that companies are required to use reasonable data security, but that's being attacked in court right now, has been constantly attacked and even if the ftc can bring an action they can't get penalties. they can say you used unreasonable security and the company signs an order saying yes, i did i will stop doing that. the companies can treat poor security as a cost of doing business and it probably should be a cos

, equifax is a critic sample, till, to this day, you hear many cases about people having an unencrypted laptop in the back of the car being the cause of a lot of them. for me and the policy perspective, the key is lack of incentives, they do not bear the cost of data security in many cases. in some cases, data breach notification could be triggered and that is annoying and expensive. there is definitely a cost there, but they are not the ones who bear, when the consumer has the credit attacked or identity threat -- theft, they do not bear the cost. the ftc maybe has that authority, they got a lot of cases and use an old statute that say companies are required to use reasonable data security but that is being attacked in court, even if the ftc can bring an action, they cannot get penalties, they can say you used unreasonable security in the company signs an order saying yes, i did, i was up. the countries can treat this as the cost of his nest, they cannot use 100% security but it should have a greater cost than it does today. michelle, do you have any thoughts >> sure, i think any times we fin