# Market Failure ## Why markets fail - Market failuer occur when the free-market outcome is inefficient - Monopolies/oligopolies(small number of relatively large companies produce similar, but slightly different goods) - Public goods - Information asymmetries - Externalities - Market failures justify regulatory intervention ## Public goods - Two characteristcs that make them hard to allocate efficiently - Non-rivalrous - Non-excludable ## Markets with asymmetric information - Secure software is a market for lemons(bad products) - Vendors may believe their software is secure, but buyers have no reason to believe them - Buyers refuse to pay a premium for secure software, and vendors refuse to devote resources to do so - Lack of robust cybersecurity incident data - Most firms choose not to disclose when they have suffered cybersecurity incidents - Without accurate loss measurements, defensive resources cannot be allocated properly ## Consequences of asymmetrics information - Adverse selection - In health insurance, adverse selection occus when sick people are more likely to buy coverage than the healty - Difficulty of discriminating between firms with good or bad operational security practices has hampered the development of the cyber-insurance market - Moral hazard - People may drive recklessly if fully insured with $0 deductible - Often claimed that consumers engage in moral hazard due to $0 card fraud liability - Cuts both ways: when regulations favor banks, they can behave recklessly in combating fraud ## Positive externalities - benefit to third parties as a consequence of another's actions - Many technical security solutions become effective only when many people adopt them - **People involved in the transaction don't capture the full benefits, so they undervalue the transaction** ## Negative externalities - harm imposed on third parties as a consequence of another's actions - Botnet-infected computers impose negative externalities - **There's not a strong incentive to patch the vulnerabilities** ## Implications of externalities - Positive externalities: **less of the good** tends to be provisioned than is good for society - Negative externalities: **more of the bad** tends to be provisioned than is good for society - So we often end up with less security investment from the good guys and more harm emanating from the bad guys than we should ## Summary - Markets sometimes fail to ensure the best outcomes for society