A very interesting and important paper on the protection of critical information infrastructure. The paper discusses a number of obstacles to protection and emphasizes the need for information sharing to enable risk assessment and the development of insurance markets.