working_paper_security_policy_2016_08.pdf