Three essays on the law and economics of information technology security