Ransomware and Market Failure

What’s worse: one market failure or two? Most of us impulsively answer, “Two!” with confidence. But that is demonstrably wrong. The correct answer is: “It depends.”

Two market failures can be worse than one. Most obviously, two negative externalities are worse than one. Each such externality leads to inefficiently high production, so the two failures compound.

A monopoly with positive externalities, similarly, is worse than either monopoly or positive externalities alone. Each failure leads to inefficiently low production, so the two failures again compound.

Once you understand these examples, though, you can easily construct cases that go the other way. A positive externality combined with a negative externality implies a more efficient outcome that either externality alone. Why? Positive externalities imply inefficiently low production, and negative externalities imply inefficiently high production. So the two failures tend to offset each other. If you’re lucky, they offset perfectly!

Likewise, a monopoly with negative externalities is less inefficient than monopoly or negative externalities alone. Why? Monopoly implies inefficiently low production, negative externalities imply inefficiently high production, so the two failures once again tend to cancel out.

Too obvious to get excited about? Here’s one that’s more fun.

Remember Akerlof’s “market for lemons” adverse selection model? In case you don’t, let me refresh your memory. Suppose used cars are equally likely to be worth anything from $0 to $100 to their current owners. Yet to buyers, they’re worth 50% more. The gains to trade are plain.

Akerlof asks us to imagine what would happen if sellers know the true value of the car they’re selling, but buyers only know the average value of cars on the market. Then if the market price is $50, sellers withhold all cars worth more than $50 from the market. Hence, the average value to buyers is $25*1.5=$37.50. Not worth it! Raising the price is even worse for buyers: All cars sell at $100, but then the average car is only worth $50*1.5=$75 to buyers.

In Akerlof’s original thought experiment, the only way to win is not to play. When the market price is $0, no one sells, but at least no one has buyer’s remorse. Adverse selection kills the whole market. Disastrous!

What would happen, though, if we superimposed a severe negative externality onto Akerlof’s original model? Perhaps car’s original owners are perfect drivers, but every new owner has a 10% chance of killing a bystander. Descriptively, adding this negative externality leaves equilibrium price and quantity unchanged: Adverse selection still kills the whole market. Normatively, however, adding this negative externality changes everything. Adverse selection kills the whole market, which is - due to the severe negative externality - the optimal outcome.

Before you dismiss this as a contrived case, think again. Ever heard of ransomware? A hacker locks you out of your own computer, then tells you, “Pay me a ransom, and your computer will be good as new.” A negative externality if there ever was a negative externality.

But once you set aside your blind rage, there is an obvious prudential reason not to pay: adverse selection. The very fact that someone would hack your computer is strong evidence that they’re untrustworthy. How do you know the hacker won’t take your money, then fail to restore your access? How do you know the hacker won’t take your money, then say, “I changed my mind, I want more”?

You don’t. And from an efficiency standpoint, that’s a damn good thing. Ideally, in fact:

1. No one would trust the hackers to fulfill their promises.

2. Hence, no one would ever pay ransoms.

3. Therefore, no one would make money from creating ransomware.

4. As a result, ransomware would vanish.

“Given negative externalities, adverse selection may improve market performance” isn’t just idle theory. This scenario is a valuable lesson about how one notorious market works. Thank goodness people don’t know if paying a ransom would work. Otherwise, the problem could easily be ten times worse than it already is.