What Are The Ethical Implications That Arise from the Use of Financial Incentives to Influence Businesses to Develop Powerful Cybersecurity Strategies Beneficial to Society?

The use of financial incentives to influence businesses to develop powerful cybersecurity measures has a few ethical implications that arise from its case. The main implications are concerns of fairness, accountability, and misusing funds. Hearing the proposal of businesses receiving financial incentives based on their performance leads you to question.. “How would small businesses hold up?” This ethical concern relates to the fairness implication and is the biggest question that pops up in this topic. There are also concerns of a real commitment to security practices which questions accountability. Lastly we actually have no idea of how a business might actually use the funds they receive which creates a high potential of misusing funds. Researching each of these ethical implications will provide an in-depth analysis of each concern.

How Would Small Businesses Hold up? (Fairness)

In the case of rewarding businesses financial incentives to develop powerful cybersecurity measures, smaller businesses will face serious challenges compared to those larger businesses. This issue arises because larger businesses generally have more resources which allows them to be able to heavily invest in advanced cybersecurity measures. Larger businesses can milk upon these incentives to further enhance their security infrastructure and benefit their personal economy in ways a small business cannot fathom. On the topic of the cost and benefit of this policy, it will be difficult for small businesses to allocate enough money to be able to act on these initiatives. With small businesses having a limited budget, larger firms with more investors and clients can dominate the market making this opportunity unfair for small businesses. However, with programs such as the State and Local Cybersecurity Grant Program (SLCGP) small businesses are able to receive grants that will help them invest in their cybersecurity practices and progress. The push for collaboration between large government organizations and the private sector industry prevents small businesses from being washed away.

Accountability

Accountability is a major concern in the case of businesses receiving financial incentives to develop powerful cybersecurity measures because it raises a concern of having real commitment to security practices. As businesses start to receive these financial incentives they might just start finding ways to implement the bare minimum of security practices and collect their rewards. In this case businesses aren’t challenging themselves to become better and are rather using the same practices which overtime will become a vulnerability. With businesses focusing on financial incentives, their focus will be shifted from implementing new and powerful strategies and this can become dangerous when it comes to protecting data. On the other hand, if businesses are rewarded with financial incentives, there will be laws in place that will limit their involvement in consumer data subjecting these businesses to focus on innovation.

Misuse of Funds

The misuse of funds is highly a possibility if businesses are rewarded with financial incentives in the case of developing powerful cybersecurity measures because spending won’t be monitored. With providing businesses with financial reward the goal is for them to reinvest into their organization and upgrade their security practices, however, this spending cannot be confirmed as businesses might choose to prioritize other necessities over actual cybersecurity needs. With extra money businesses might choose to gamble with data, for example if a business is receiving an offer of $10M for some data, they might sell that data and claim a data breach since they will likely have to pay around a $3-5M fine (hypothetically). Luckily, the Federal Trade Commision Act for cybersecurity protects an individual’s rights by prohibiting companies from using data for acts of commerce and ensuring companies protect a consumer’s data.

Conclusion

In conclusion, while financial incentives can be used to promote and develop better cybersecurity practices, the difference in resources can present a challenge for small businesses when it comes to the costs and benefits which is why grant programs have been developed and the push for collaboration between industries is a must. Even though financial incentives are meant to push for improvements in cybersecurity, they must be carefully put together to ensure that accountability is maintained so businesses can remain genuine to their practices. Lastly, though we cannot track a businesses’ spending we must trust that they are in compliance with federal laws put in place such as the Federal Trade Commision Act for cybersecurity.

References

Meltzer, J. P. (2020, May). Cybersecurity, digital trade, and data flows. Global Economy and Development. https://www.brookings.edu/wp-content/uploads/2019/11/Cybersecurity-digital-trade-data-flows.pdf

Park, T.-Y., Park, S., & Barry, B. (2022, January 26). Incentive Effects on Ethics. Academy of Management . https://journals.aom.org/

State and local cybersecurity grant program: CISA. Cybersecurity and Infrastructure Security Agency CISA. (2024, September 23). https://www.cisa.gov/cybergrants/slcgp

Ward, S., Bridges, K., & Chitty, B. (2005). Do Incentives Matter? An Examination of On‐line Privacy Concerns and Willingness to Provide Personal and Financial Information. Journal of Marketing Communications, 11(1), 21–40. https://doi.org/10.1080/1352726042000263575

AHMED-KARGBO

Policy Paper 3