---
# System prepended metadata

title: Market Failure

---

# Market Failure
## Why markets fail
- Market failuer occur when the free-market outcome is inefficient
    - Monopolies/oligopolies(small number of relatively large companies produce similar, but slightly different goods)
    - Public goods
    - Information asymmetries
    - Externalities
- Market failures justify regulatory intervention

## Public goods
- Two characteristcs that make them hard to allocate efficiently
    - Non-rivalrous
    - Non-excludable

## Markets with asymmetric information
- Secure software is a market for lemons(bad products)
    - Vendors may believe their software is secure, but buyers have no reason to believe them
    - Buyers refuse to pay a premium for secure software, and vendors refuse to devote resources to do so
- Lack of robust cybersecurity incident data
    - Most firms choose not to disclose when they have suffered cybersecurity incidents
    - Without accurate loss measurements, defensive resources cannot be allocated properly

## Consequences of asymmetrics information
- Adverse selection
    - In health insurance, adverse selection occus when sick people are more likely to buy coverage than the healty
    - Difficulty of discriminating between firms with good or bad operational security practices has hampered the development of the cyber-insurance market
- Moral hazard
    - People may drive recklessly if fully insured with $0 deductible
    - Often claimed that consumers engage in moral hazard due to $0 card fraud liability
    - Cuts both ways: when regulations favor banks, they can behave recklessly in combating fraud

## Positive externalities
- benefit to third parties as a consequence of another's actions
- Many technical security solutions become effective only when many people adopt them
- **People involved in the transaction don't capture the full benefits, so they undervalue the transaction**

## Negative externalities
- harm imposed on third parties as a consequence of another's actions
- Botnet-infected computers impose negative externalities
- **There's not a strong incentive to patch the vulnerabilities**

## Implications of externalities
- Positive externalities: **less of the good** tends to be provisioned than is good for society
- Negative externalities: **more of the bad** tends to be provisioned than is good for society
- So we often end up with less security investment from the good guys and more harm emanating from the bad guys than we should

## Summary
- Markets sometimes fail to ensure the best outcomes for society 