There's some risk aversion at play in cybersecurity; risk aversion is why a General Counsel will say that if you might have lost data, then you have to act as if you did lose it. Risk aversion is why some firms (and some people) keep no records. We're living in a time when legislatures want to force risk reductions in cyberspace. It's altogether likely that any legislature that acts will do so by setting up some sort of agency to oversee the process of risk reduction in cyberspace. Risk reduction agencies are purposefully risk averse and immortal, which guarantees that their enforcement power inevitably demands diseconomic risk reductions.