Economy

In previous parts we studied how to build security (cryptography, protocols, access control), this part explains why systems often remain unprotected, despite the availability of technical solutions. It is believed that many security failures are not due to weak mathematics or code, but due to incentives. Security is not a scalar quantity, but a relation of power. Technical measures are powerless if the economic incentives of system participants are directed against them. ## 1. Classical economics and information goods

Let's start with the basics of microeconomics, applying them to the world of IT.

• Monopoly: Software markets tend to be monopoly due to network effects (the more people use Windows, the more profitable it is to write software for it). The monopolist dictates prices and conditions, often ignoring security because users have no choice.
• Public goods: Security is often a public good. If my computer is protected from viruses, it's good for you too (I won't infect you). But since I do not directly benefit from protecting others, I can economize on security by transferring risks to neighbors (externalities).
• Information economy: the marginal cost of copying software is close to zero. This creates pricing problems and leads to the practice of price discrimination (different prices for different groups) and lock-in, where it is expensive for the user to switch to another platform.

2. Game theory

Security is the interaction of rational agents (defenders and attackers, or different participants in the same system).

• Prisoner's dilemma: it is often beneficial for everyone to cooperate (invest in security), but individually it is more profitable to cheat (save) by relying on others. As a result, everyone loses (unsafe environment).
• Evolutionary games (“hawks and doves”): simulate behavior in a population. If there are too many “aggressors” (hackers), the system develops immunity or changes the rules.
• Weak link vs. amount of effort:
  -- Weakest link: The security of the entire system is determined by the most negligent participant (for example, the password of the stupidest employee). It's hard to motivate everyone here to be perfect.
  -- Sum of efforts: security increases as everyone contributes (for example, fighting spam or viruses: the more people update antiviruses, the safer everyone is). This is where incentives work better.

3. Economics of safety and reliability

Why is Windows so insecure? Let's look at this issue through the prism of economics.

• Platform life cycle: at the stage of market capture (as was the case with Windows in the 90s), the vendor sacrifices security for the speed of product release and convenience for application developers (“complementors”). Security slows down the development of the ecosystem.
• Change of priorities: Once a monopoly is already established, the vendor begins to add security, but often does so in a way that strengthens the user's lock-in (DRM, proprietary protocols) rather than protecting their data.
• Moral hazard: if the bank knows that losses from card fraud will be covered by insurance or the client himself (due to complex terms of the contract), the bank has no incentive to invest in expensive protection. On the contrary, in the US (Regulation E), where the bank is responsible for disputed transactions, banks invest in security much more actively.

4. Deep analysis of the “market for lemons” is safe

George Akerlof's concept of a "market for lemons" (where sellers know more about the quality of a product than buyers) is fundamental to understanding cybersecurity failures.

• Asymmetry of information: the software manufacturer knows much more about the bugs and vulnerabilities of its product than the buyer. A user cannot "test" the security of a program before purchasing as easily as he can test the operation of a word processor.
• Race to the bottom: Since the buyer cannot distinguish a safe product from an unsafe one, he is not willing to pay a premium for safety. This creates an incentive for manufacturers to skimp on testing and security by releasing cheap but vulnerable products. The market is filled with lemons.
• An example with antiviruses: users often buy the cheapest antivirus or use a free one, believing that “they are all about the same.” This reduces the income of companies investing in serious threat research, forcing them to either reduce quality or switch to monetization models that violate privacy (selling user data).
• Solution through reputation and standards: the only way to combat this is to create quality signaling mechanisms (certificates, brands, open audits). However, as practice shows with Common Criteria assessments, these mechanisms themselves can be subject to manipulation if the incentives of the assessors are also distorted.

5. Economics of privacy: paradox of behavior

Let us emphasize the gap between people’s declared values and their actual behavior.

• The privacy paradox: surveys show that people claim to value their privacy highly, but in practice they are willing to exchange personal data for minor benefits (a discount in a store, access to a free app, convenient service).
• Reasons:
  -- Misunderstanding of Long-Term Risks: People are poor at weighing the probabilistic risks of future harm (identity theft, insurance discrimination) versus immediate benefit.
  -- Decision fatigue: Constant requests for consent (cookie banners, privacy policies) lead to users mechanically clicking “Accept” without reading.
  -- Free-rider effect: users hope that others will protect the ecosystem, or that regulators will solve the problem for them.
• Price Discrimination: Data collection allows companies to practice perfect price discrimination (first degree) by charging each user the maximum price they are willing to pay. This redistributes consumer surplus to the producer - economically beneficial to companies, but harmful to society as a whole. It has been argued that the desire to avoid such discrimination should motivate privacy protection, but most people do not realize this.
• Externalities: One person's data leak can harm others (for example, through social engineering using stolen information about the victim's friends). The market does not take into account these negative externalities, so the level of data protection is below the socially optimal level.

6. Economics of DRM (Digital Rights Management): who really wins?

History has confirmed the guesses of experts that strengthening DRM is beneficial not to content rights holders (music labels, film studios), but to platform owners.

• Changing the balance of power: DRM was originally promoted as a way to protect authors from pirates. In fact, it has become a tool for controlling the sales market.
  -- Apple iTunes example: AAC format with FairPlay protection allowed music playback only on Apple devices (iPod, iPhone). This created a huge base of loyal users (lock-in), who could not easily switch to competitors without losing their media library. It was Apple who benefited, not the music labels, which were forced to sell tracks at a fixed low price ($0.99).
  -- Game Consoles: Console manufacturers (Sony, Microsoft, Nintendo) use cryptographic code signing to prevent unverified games from running. This allows them to collect royalties on every disc sold, controlling the entire software market for their platform.
• Accessory control: DRM is used to create artificial monopolies on consumables.
  -- Printers: chips in cartridges prevent the use of refilled or third-party cartridges.
  -- Mobile phones: locks batteries or accessories that only work with original devices.
• Economic Bottom Line: DRM turns the sale of content or devices into a lease with limited rights, allowing vendors to extract rents long after the initial sale. This often leads to antitrust litigation, but technological barriers remain high.

7. Patching cycle management: an economic perspective

Conflicts of interest between security researchers, vendors, and users determine the vulnerability disclosure strategy.

• Full disclosure: Researchers are publishing details of the vulnerability immediately.
  -- Pros: Pressure on vendors forces them to release patches faster. Users are made aware of the risk and can take action (for example, disabling the service).
  -- Disadvantages: attackers receive operating instructions before many users have time to update.
• Responsible disclosure: Researchers inform the vendor and wait a fixed period (usually 45–90 days) before publication.
  -- Pros: gives time to develop and test the patch.
  -- Disadvantages: Vendors can delay the process, ignoring the problem if there is no publicity.
• Economic Equilibrium: Security economists argue that full disclosure can be harmful if there are many vulnerabilities and they are independent (attackers simply switch to another). However, it is empirically clear that the threat of disclosure accelerates vendor response. The current consensus favors responsible disclosure with strict deadlines, which creates a balance between vendor incentives and users' right to know.

8. Incentives and system architecture: why security is often “wrong”

Economic incentives determine not only the quality of protection, but also its direction.

• Vendor protection vs. user protection:
  -- In the era of Microsoft dominance (Windows XP and earlier), it was more profitable for the company to make the system convenient for application developers (allowing run as administrator by default) than to make it safe for the user. This has accelerated the growth of the application ecosystem, but created a huge attack surface.
  -- It was only when reputational damage from viruses and worms began to threaten its dominance that Microsoft began investing in security (Trustworthy Computing initiative). But even then, many of the measures (such as UAC in Vista) were aimed more at maintaining compatibility than at radically improving security.
• Liability dumping:
  -- Banks and payment systems often design protocols to shift the risk of fraud to the customer (for example, through complex PIN chip card conditions or Verified by VISA rules). If a bank does not suffer financial losses from fraud, it has less incentive to invest in preventing attacks.
  -- This leads to a situation where technically possible protection is not implemented, because it is more economically beneficial for the client to suffer losses.
• The problem of “tragedy of the commons” on the Internet:
  -- Network security depends on the weakest link (the infected computer in the botnet). An individual user does not bear the full cost of the damage that his infected PC causes to others (spam, DDoS attacks). Therefore, users do not invest enough in protecting their devices.
  -- Solutions require collective action or regulation (for example, mandatory certification of IoT devices), but the manufacturer lobby often resists this.

Main conclusion

Security is not just a technical issue, but an economic and social one.

1. Incentives are king: As long as it is profitable to produce unsafe software or shift risks to users, systems will be vulnerable.
2. Markets are imperfect: information asymmetries and externalities lead to underproduction of security. Regulatory intervention or the creation of new market mechanisms (reputation, cyber risk insurance) are required.
3. Technology Follows the Money: DRM and system architectures evolve toward maximizing profits for platform owners, not necessarily toward security or end-user rights.
4. Human factors are rational (of sorts): Users sacrifice privacy and security not because they are stupid, but because the immediate benefits outweigh the abstract future risks, and the costs of protection are often disproportionately high.

A security engineer must understand these economic drivers in order to provide solutions that are not only technically sound, but also economically viable, aligning the incentives of all participants in the ecosystem.