Whack-A-Mole Security: Bad Policy, Bad Legislation