Public Goods and Externalities Aspects of Internet Security: Modeling the Spill-Over Effects of Interrelated Risks and Solutions

Abstract

Is Internet security a public good? How should society handle the spill-over effects arising from the interrelatedness of Internet risks? What role, if any, does police enforcement play? What optimal combination of each of these security measures – police enforcement, and individual investments in both private and non-rivalrous security goods – should be used to effectively combat cybercrimes?

In this paper, I argue that some, but not all, investments in security have the nature of public goods. Thus, I attempt to model the situation where firms invest in both private and public security goods. Furthermore, I include public enforcement of law in my model. Thus, I study a model where crimes are addressed through a combination of private and public measures. By so doing, I hope to capture the substitutability between the private and public responses, and determine the optimal combination of these approaches. Lastly, my model seeks to capture the interrelatedness of risks in the Internet. In sum, in this paper, I study a model that combines all of these elements: private investments in security; investments in security that have the nature of public goods; externalities; and public enforcement of law.

I find that the socially-optimal level of security is achieved by equalizing the marginal-benefit-to-marginal-cost ratios of each of the three alternatives – private security investment, non-rivalrous security investment, and law enforcement measures. Furthermore, the interrelatedness of Internet risks causes individual firms to underinvest in private and public security goods. The government thus decidedly lowers the level of police enforcement expenditures in order to induce firms to invest more in individual precautions. I also find that, under certain conditions, cooperation results in socially-optimal levels of expenditures in private and public security goods expenditures. The Shapley (1953) value can be used as a criterion for allocating the costs and benefits among the members of a security cooperative. Several simulations illustrate the results of the model under several scenarios.