Ron Johnson actually said...

Doesn't Yahoo! and Google, don't they have enormous financial incentives to try and police this and prevent malvertising and malware?

So you are actually talking about enforcement; you are talking about going after criminals and enforcing and penalizing the criminals.

I am new to this issue. Are there penalties for noncompliance?

From my standpoint, I would love to see, again, the government contact ISO certification companies.