Regulating Information Security. Keeping Public and Private Data Safe

虽然信息安全被广泛认为是我们这个时代最紧迫的问题之一，但公众行为者如何为信息技术（it）和信息网络的安全做出贡献还远不清楚。尽管如此，立法者已经开始解决这个问题：2015年，德国、欧盟、美国和许多其他国家通过了法规，旨在提高重要数据和信息基础设施的信息安全。但是，国家或甚至超国家的行为者能够有效地管理这一全球性问题吗？信息安全治理对宪法权利的潜在影响是什么？我想了解为什么现有的法律制度不能提供足够的信息安全水平，以及如何在不损害（超）国家宪法框架的情况下变得更有效。我计划进一步探讨信息安全治理的三个方面，作为我提出的研究的一部分：首先，我确定并分析了信息安全治理面临的四个主要挑战，以及它们对有效规则制定的影响。这些挑战包括互联网的非地域性架构、技术在这一领域的重要作用和动态发展、信息安全和基本权利之间的辩证关系，以及就“数字”事务的监管而言，对公共当局缺乏信任。第二，重构信息安全治理的法律制度。透过最近的法规来看，已经存在大量管理信息安全风险的规则。这种复杂的、部分跨国的体制，以及参与规则制定的一些机构的“混合”性质，使得对信息安全法（ISL）有必要进行全球性和多元化的解释。第三，我试图评估信息安全治理如何处理有效性和合法性之间的紧张关系。在缺乏国际法律框架的情况下，从法律上构建信息安全治理的主要是国家和超国家宪法。我分析宪法义务是否以及如何受到影响，并最终在面对ISL嵌入的多元化和跨国规则制定过程时发生转变。总而言之，该项目使用ISL作为一个透镜来分析信息时代监管的一般问题和挑战。

While information security is widely considered to be one of the most pressing problems of our time, it is far from clear how public actors can contribute to making information technology (IT) and information networks safe. Nevertheless, lawmakers have started to address the issue: in 2015, statutes were passed in Germany, the European Union, the U.S. and many other states, which are supposed to improve information security for essential data and information infrastructures. But can national or even supranational actors effectively regulate this global problem? And what is the potential impact of information security governance on constitutional rights? I want to understand why the existing legal regime fails to provide for an adequate level of information security and how it can become more effective - without compromising the (supra-)national constitutional framework. There are three aspects of information security governance that I plan to explore further as part of my proposed research: First, I identify and analyze the four main challenges faced by information security governance as well as their implications for effective rule making. These challenges are the non-territorial architecture of the Internet, the important role and dynamic development of technology in this field, the dialectical relationship between information security and fundamental rights, and the lack of trust in public authorities as far as the regulation of "digital" matters is concerned. Second, I reconstruct the legal regime of information security governance. A look beyond the recent statutes reveals that there already exists a large body of rules governing information security risks. This complex, partly transnational regime and the "hybrid" nature of some of the institutions involved in rule making make a global and pluralist account of information security law (ISL) necessary. Third, I seek to evaluate how information security governance can manage the tension between effectiveness and legality. In the absence of an international legal framework, it is mainly national and supranational constitutional law that legally structures information security governance. I analyze whether and how constitutional obligations are affected and, eventually, transformed when confronted with the pluralist and transnational rule making processes in which ISL is embedded. All in all, the project uses ISL as a lens to analyze general questions and challenges for regulation in the information age.