6th European Conference - Academic Conferences

3. Limits to using game theory
3.1 The economics of cyber insecurity
Merritt Baer
Game theoretical explorations assume perfect rationality, but economically, there are a number of
ways in which the current cybersecurity system lacks the incentives to operate at what might be
termed “rational” full strength. One is the problem of externalities-- like air pollution, most individuals
underinvest in their own security out of a perception that the problem (and its solution) does not target
them directly. (Anderson and Moore 2006). This emerges in many contexts where vulnerabilities are
not clearly attributable to the responsible actor; Daniel Geer, Chief Information Security Officer of the
Central Intelligence Agency‟s venture capital fund In-Q-Tel, (2010) struck a comparison to the
evolution of laws that would enforce responsibility for cleaning up a toxic waste spill and dealing with
those affected by it. Personal underinvestment in security means vulnerability to botnet appropriation
of computers, as well as facilitation of anonymity-inducing programs like Tor, which allow a hacker to
stage a virtually untraceable attack. (See, e.g., Wilson 2008). Computers under remote botnet control
are growing at an average of 378% each year, according to grassroots security monitoring
organization Project Honey Pot; this translates to ease of launching denial-of-service (DDoS) attacks
and decreased likelihood of tracing an attack. The DDoS attacks—both against Wikileaks (Carney
2010) and against its detractors (Reuters 2010) --made use of those who passively or voluntarily
submitted their computers to botnet control.
Internet founder Vint Cerf (in Schofield, 2008) made the Hobbesian observation that “[i]t seems every
machine has to defend itself. The Internet was designed that way. It‟s every man for himself.” The
Internet may require individuals to self-protect, but it wasn‟t “designed” for individuals to take the reins
in security—it was simply not designed for security. It is designed, to the extent that one can say it
was designed, for openness. Security may fall to individuals but the current structure doesn‟t provide
the necessary incentives for them to make that investment. Game theoretical assumptions about
rationality are thrown off by the human tendency to underinvest when there are externalities. As
software engineer Brad Shapcott famously said, “The Internet isn‟t free. It just has an economy that
makes no sense to capitalism.”
Re-aligning incentives to prioritize an optimal level of individual cybersecurity investment is an
economics task, but no one has ownership of the problem or the impetus to even get robust
information about it. As Jonathan Zittrain (Harvard Law 2010) stated, “Because no one owns this
problem, no one is paying for monitoring software to get the picture they need, to be accurate.”
Contrastingly, in the private sector economic objectives often reward security—such as the case study
of the US banking industry compared with the UK banking industry. In US bank security, credit card
fraud has been the responsibility of the bank. UK banks initially refused responsibility for ATM error,
and it created a “moral hazard” incentive for bank employees to act carelessly. (Anderson and Moore
2006: 610-613).
On a higher level of abstraction, there are externalities because of government reliance on private
sector cybersecurity technology. When this reliance couples with any tolerance for inefficiency, such
as those that result from revolving door corruption or transparency concerns, it constricts the
competitiveness of government contract assignment. This produces high-level inefficiencies. (See
Baram 2009). According to a study by the Center for Public Integrity, only about one-third of Pentagon
contracts were awarded following competition between two or more bidders. (Calbreath 2005). The
cost premium of outsourcing defense contracts to private sector providers is only justified by the
innovation push that the private sector is assumed to have; if government-to-company contracts are
instead funneled through sole-source contracts, this innovation advantage assumption may not be
valid, and the price premium may not be justified. (See Arnold, S. A. et al., 2009: 25). Small levels of
distorted investment can produce large results in absolute terms because the numbers are so large--
the total investment in research, development, test and evaluation (RDT&E) and procurement funds
for the DoD major defense acquisitions portfolio is a staggering $1.6 trillion yearly (GAO Report 2009).
3.2 Imperfect competition and the investment-to-security payout
Companies are moved by (and have a legal fiduciary duty to prioritize) their own bottom line; there is
no independent incentive to collaborate toward producing high-quality security products. Thus at the
federal level, great dependency on private contractors in the cyber weapons arena can distort cost
efficiency calculations in game theory. Our investment in security may not lead linearly to a higher-
25