Opting Out of Incentive Mechanisms: A Study of Security as a Non-Excludable Public Good.

In a network of interdependent users, the expenditure in security measures by an entity affects not only herself, but also other users interacting with her. As a result, users’ efforts toward security can be viewed as a public good; the optimal provision of which in a system of self-interested entities requires the design of appropriate incentives through an external mechanism. In this paper, we propose the notion of exit equilibrium to study users’ voluntary participation in such incentive mechanisms. We show a fundamental result that, due to the non-excludable nature of security, there exists no reliable mechanism, which can incentivize socially optimal investments, while ensuring voluntary participation and maintaining a weakly balanced budget, for all instances of security games. To further illustrate this result, we analyze the performance of two well-known incentive mechanisms, namely the Pivotal (VCG) and Externality mechanisms, in security games. We illustrate how, given a mechanism, stable coalitions of participating users may emerge, leading to an improved, yet sub-optimal security status. We further extend the impossibility result to risk-averse users, and discuss its implications on the viability of using cyber-insurance contracts to improve the state of cyber security.