Yeah, you&#x27;re confused because I mis-wrote that. Wow, that was indeed a confusing sentence. I meant regs will hurt <i>innovation</i>, not security.<p>The problem is that I think the security gains will also be marginal, and the innovation harm will be significant.<p>In particular, the history of security standards, which you bring up as an example of &quot;good regulation&quot;, is checkered.<p>I agree with you that mandatory insurance could be a &quot;middle way&quot; between intrusive regulation and no regulation. But that&#x27;s essentially the structure the payments industry uses with PCI, and PCI has been a race-to-the-bottom.