📈 economics

Information-Producing Regulation: Certification and Delegated Enforcement

This paper develops a theoretical framework analyzing how information-producing regulations, such as certification and delegated enforcement, shape firms' incentives to invest in private evidence capacity and how the interplay between public and private information influences optimal regulatory design and institutional implementation.

Original authors: Taylor Canann

Published 2026-08-26

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Taylor Canann

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the modern world, many critical decisions rely on information that no single person or organization holds completely. A company might know the intricate details of its own computer systems, while a government agency might possess a broader picture of threats gathered from across the globe. The challenge arises when these two parties must work together to stop a cyberattack or manage a crisis. Traditional rules often focus only on what companies are allowed to do, but a new line of thinking asks a deeper question: who should be responsible for gathering the necessary facts, and who should have the final say in acting on them? This is the core of a field known as information-producing regulation, which studies how rules change not just behavior, but the very incentives people have to learn and share what they know.

Taylor Canann, an economist at Louisiana Tech University, has developed a new theory to map out how these interactions play out. The research focuses on a specific scenario where a firm has the technical skill to respond to a threat, but the government holds vital context—such as whether an attack is linked to a foreign nation or if a response might accidentally harm innocent third parties. The paper explores four different ways a society could organize this relationship: banning all private action, letting firms act freely, creating a licensed system where the government certifies capable firms to act, or having the government take over the response entirely. By building a mathematical model of these choices, the study reveals that the rules governing information and the rules governing action are deeply intertwined; changing one inevitably reshapes the other.

One of the most striking findings is that government information does not always help private experts do their jobs better. Depending on how the rules are written, public information can either encourage firms to invest more in their own expertise or discourage them from doing so. If the government sets a rule that requires both its own data and a firm's data to agree before action is taken, firms are motivated to gather more evidence to ensure they meet that high bar. This is a "crowding-in" effect. However, if the rule is looser—allowing action if either the government or the firm has a positive signal—firms may feel they can rely on the government's data and stop investing in their own. This "crowding-out" effect means that simply providing more public data can sometimes make the private sector less capable, leaving the system weaker overall.

The study also uncovers how certification works as a filter for capability. When the government requires firms to produce auditable evidence before they are allowed to act, it naturally sorts companies based on their ability to produce that evidence. Because more capable firms can generate high-quality proof at a lower cost, a standard requirement effectively selects for the most competent organizations. This happens not because the government is guessing who is good, but because the cost of proving competence is simply cheaper for those who are already skilled. The result is a system where only the most capable firms get licensed, creating a natural barrier that separates the experts from the rest.

Perhaps the most practical insight concerns who should actually pull the trigger when a decision is made. The paper argues that having the government know more does not automatically mean the government should act. Even if the government has superior information, it may still be better to let a certified firm execute the response, provided the firm has a specific operational advantage, such as speed or local knowledge. The decision comes down to a trade-off: if the government takes over, it avoids the risk of the firm acting too aggressively, but it loses the efficiency of the firm's specialized skills. If the firm acts, it retains that efficiency but might be tempted to act too quickly. The optimal choice depends on which of these two losses is smaller.

Finally, the research addresses the issue of trust and transparency. It distinguishes between a regulator's chosen policy of secrecy—such as withholding certain sources to protect intelligence—and an agency secretly hiding information against the rules. The study suggests that a credible institution does not need to be fully transparent to be effective. It can operate with a deliberate, approved level of opacity to protect sensitive methods, as long as there are strong checks to prevent unauthorized hiding of information. The goal is not total disclosure, but faithful adherence to the rules the regulator has set.

In the end, this work provides a roadmap for designing regulatory systems that do more than just punish bad behavior. It shows that effective regulation must account for how rules change the way people learn and share information. Whether in cybersecurity or other complex fields, the best approach is not a one-size-fits-all mandate, but a carefully balanced system where public and private information complement each other, certification rewards genuine capability, and the authority to act is assigned to whoever can execute the decision with the least amount of waste or risk.

Technical Summary: Information-Producing Regulation: Certification and Delegated Enforcement

Problem Statement
This paper addresses a regulatory gap where public institutions possess information critical for socially useful decentralized actions, yet private actors hold the necessary local expertise and implementation capacity. The central problem is not merely how to constrain conduct, but how to design institutions that determine: (1) who acquires information (public vs. private production), (2) whether public and private signals act as complements or substitutes, (3) which actors should be certified to utilize combined information, and (4) whether the final implementation right should remain private or move to the government. The paper uses active cyber defense (e.g., "hack back") as a motivating application, where firms possess local telemetry but lack the cross-victim intelligence required to assess the geopolitical or legal risks of external action.

Methodology
The author develops a game-theoretic model solved by backward induction, featuring a continuum of firms indexed by verifiable capability $h \in [\underline{h}, \bar{h}]$ . The model endogenizes four key elements:

Information Production: Firms choose durable private evidence capacity $e$ ; the government chooses public information capacity $q$ . Signals are conditionally independent and symmetric.
Institutional Regimes: The paper compares four sector-level regimes:
- $B$ (Blanket Prohibition): No external action.
- $M$ (Unrestricted Private Action): Firms produce private info and act.
- $L$ (Licensed Delegation): Government produces public info, certifies firms meeting an auditable evidence floor $\bar{e}$ , and allows certified firms to act.
- $G$ (Direct Government Enforcement): Government procures local evidence and implements action directly.
Certification and Sorting: Certification is based on a minimum auditable evidence standard rather than direct type observation, relying on the primitive assumption that more capable firms produce evidence at lower marginal cost ( $C_{F,eh} < 0$ ).
Implementation Authority: The model compares the efficiency of private implementation (subject to incentive misalignment) versus government implementation (subject to centralization losses $\Delta_G$ ).

Key Contributions and Results

1. Endogenous Information Acquisition and Crowding Effects
The paper demonstrates that public information does not have a unidirectional effect on private expertise. Depending on the regulatory authorization rule, public information can either crowd in or crowd out private investment:

Corroboration (AND rule): If the authorization rule requires both public and private signals to be favorable, the signals are complements. Public information increases the marginal return to private evidence, inducing firms to invest more ( $e_q > 0$ ).
Redundancy (OR rule): If the rule allows action upon either favorable signal, the signals are substitutes. Public information reduces the marginal value of private evidence, causing firms to underinvest ( $e_q < 0$ ).
This interaction is driven by the regulatory use of information (the posterior cutoff) rather than the statistical properties of the signals alone.

2. Capability Sorting via Auditable Evidence
Under primitive monotonicity conditions, a minimum evidence standard $\bar{e}$ generates capability sorting. Because more capable firms produce auditable evidence at lower cost, a uniform standard naturally selects an upper interval of firm types ( $h \in [h^*, \bar{h}]$ ) for certification. This sorting emerges from the cost structure of evidence production, not from assumed single-crossing conditions on types.

3. Allocation of Implementation Authority
The paper derives a condition for when licensed delegation ( $L$ ) is preferred to direct government enforcement ( $G$ ), holding the information set fixed.

Delegation is preferred when the residual incentive loss from private action (due to misaligned incentives, captured by the ratio $r = x_P/x_S$ ) is smaller than the implementation loss from government centralization (captured by $\delta = \Delta_G/a_S$ ).
Specifically, private implementation dominates if $(1-r)^2_+ \leq \delta / (1+\delta)$ . This implies that even if the government has superior information, it may be optimal to delegate implementation if the firm's operational efficiency advantage outweighs the government's ability to internalize incentives.

4. Joint Design of Public Information and Certification
The regulator's optimal choice of public information $q$ must account for its induced effect on private expertise. The marginal social value of public information contains two terms:

Direct Decision Value: The immediate improvement in authorization accuracy.
Induced Private-Expertise Term: The change in private evidence investment ( $e_q$ ) multiplied by the social value of that evidence.
Ignoring the endogenous response of private firms leads to suboptimal public information provision (underinvestment if public info corrects private distortions, overinvestment if it exacerbates them).

5. Institutional Credibility and Policy Fidelity
The paper distinguishes between policy fidelity (faithful implementation of the regulator's chosen information policy) and full disclosure.

A regulator may optimally choose an opaque policy ( $\sigma^* > 0$ ) for legitimate reasons (e.g., source protection).
Viability (keeping the institution operational) and Fidelity (preventing unauthorized agency opacity) require different levels of oversight.
Exact fidelity is not always feasible or necessary; a credible institution may tolerate some opacity if the cost of achieving exact fidelity exceeds the benefit, provided the deviation remains within viability bounds.

Significance and Claims
The paper claims to provide a unified framework for "information-producing regulation" where the design of certification, information provision, and enforcement authority cannot be separated.

Theoretical Contribution: It challenges the view that public information simply substitutes for private effort, showing instead that the regulatory mechanism (corroboration vs. redundancy) determines the direction of the interaction.
Policy Implication: It argues that "government knows more" is an insufficient criterion for centralization; the decision to delegate must weigh the firm's implementation efficiency against the government's incentive alignment.
Application: While motivated by cybersecurity (specifically the debate over active defense and the Active Cyber Defense Certainty Act), the framework is presented as applicable to any domain requiring the combination of public intelligence and private implementation, such as financial fraud response or emergency remediation.

The paper concludes that a successful information-producing regulator must govern both the private actors who acquire expertise and the public agency that controls information, recognizing that moving information into government relocates, rather than eliminates, incentive problems.

Technical Summary: Information-Producing Regulation: Certification and Delegated Enforcement

More like this