I sort of tuned out after about two paragraphs once my "scary-boogie-man-justifications" meter redlined, but I could imagine something along the lines of PCI co

I sort of tuned out after about two paragraphs once my "scary-boogie-man-justifications" meter redlined, but I could imagine something along the lines of PCI compliance being a reasonable first step. The government or whoever would establish a set of baseline security standards, and then private and public agencies that appear to be risk targets are required to meet those standards. If (IF!) it were kept relatively straightforward - this could provide a lot of value with a minimum of additional government. I'm not familiar with HIPPA privacy regulations - those also might be a reasonable place to start.