An Economic Analysis of the Private and Social Costs of the Provision of Cybersecurity and Other Public Security Goods
Full Title of Reference
An Economic Analysis of the Private and Social Costs of the Provision of Cybersecurity and Other Public Security Goods
Full Citation
Bruce H. Kobayashi, An Economic Analysis of the Private and Social Costs of the Provision of Cybersecurity and other Public Security Goods. 14 Sup. Ct. Econ. Rev. 261 (2006). Web
Categorization
Issues: Economics of Cybersecurity; Incentives; Deterrence
Key Words
Crimeware, Cybersecurity as a Public Good
Synopsis
This paper examines the incentives of private actors to invest in cybersecurity. Prior analyses have examined investments in security goods, such as locks or safes that have the characteristics of private goods. The analysis in this paper extends this analysis to examine expenditures on security goods, such as information, that have the characteristics of public goods. In contrast to the private goods case, where individual uncoordinated security expenditures can lead to an overproduction of security, the public goods case can result in the underproduction of security expenditures, and incentives to free ride. Thus, the formation of collective organizations may be necessary to facilitate the production of public security goods, and the protection of information produced by the collective organization should be a central feature of such organizations.
While prior analyses have examined the provision of security goods that have the characteristics of private goods, the analysis in this paper examined expenditures on security, such as information, that have the characteristics of public goods.
In contrast to the private goods case, where individual uncoordinated security expenditures can lead to an overproduction of security, the public goods case (a category this paper argues cybersecurity belongs to) can result in the underproduction of security expenditures, and incentives to free ride. Thus, the formation of collective organizations may be necessary to facilitate the production of public security goods, and the protection of information produced by the collective organization should be a central feature of such organizations.