How To Understand The Implications Of Cybersecurity On A Vertically Integrated Firm

Transcription

1 Cybersecurity, industrial organization, and competition policy Michael Riordan Columbia University 7/5/14 CRESSE

2 7/5/14 CRESSE

3 C Chinese Army Unit Is Seen as Tied to Hacking Against U.S. New York Times February 18, /5/14 CRESSE

4 7/5/14 CRESSE

5 7/5/14 CRESSE

6 7/5/14 CRESSE

7 Trend toward outsourcing Reliance on networks specialized suppliers Motivated by cost reduction Lower labor costs (offshoring) Product and process innovation June 19, 2013 Dusseldorf/DICE workshop 7

8 Why U.S. Manufacturing Is Poised for a Comeback (Maybe), Wall Street Journal, June 1, 2014 the number of factory jobs has started to rise after plunging for decades, edging up by about 600,000 over the past four years to more than 12 million Boston Consulting Group estimates that China's overall manufacturing- cost advantage has shrunk to just 4%. companies' desire to produce goods closer to their customers 7/5/14 CRESSE

9 Will re- shoring of manufacturing emphasize outsourcing or vertical integration? How does cybersecurity matter? 7/5/14 MaCCI

10 Does competition over ideas (as well as prices) encourage vertical integration? Do cybersecurity concerns give new encouragement to vertical integration? Do vertical mergers motivated by cybersecurity raise competition policy concerns? 7/5/14 MaCCI

11 Does competition over ideas (as well as prices) encourage vertical integration? NO Do cybersecurity concerns give new encouragement to vertical integration? YES Does vertical integration motivated by cybersecurity raise competition policy concerns? TO THE CONTRARY 7/5/14 MaCCI

12 Outline I. Security interdependence Riordan (2014) Notes on Partnership Security, preliminary draft II. Vertical integration vs. outsourcing Loertscher and Riordan (2014), Oursourcing, Vertical Integration, and Cost Reduction, preliminary draft. III. Industrial organization and competition policy implications Allain, Chambolle & Rey (2011), Vertical Integration, Information, and Foreclosure, working paper. 7/5/14 CRESSE

13 Part I: Security interdependence Model Elements Firms have heterogeneous incentives to take precautions. Firms face security risks both from direct attacks and from indirect attacks via business partners. More difficult to protect against indirect attacks. There is a positive externality of security investments. 7/5/14 CRESSE

14 Risk is a function of threat, vulnerability, and consequences. α x θ 7/5/14 CRESSE

15 Companies risking larger losses have an incentive for greater precautions. α x 1 θ 2 θ 1 x 2 α 7/5/14 CRESSE

16 Cybersecurity is interdependent. α x 1 y 1 β y 2 θ 2 θ 1 x 2 α 7/5/14 CRESSE

17 Simplifying assumptions: Composite security y i = ϕx i with 0 ϕ 1 Diminishing returns to investments quadratic investment costs θ i not too large Well- behaved social welfare function 7/5/14 CRESSE

18 Results about cybersecurity: Strategic dependence: Best responses curves might slope either upward or downward, depending vulnerability to indirect attacks and the magnitude of expected losses. Equilibrium extenalities: There is a unique equilibrium at the intersection of the best response curves. If investments are strategic complements, then investments providing less than complete security are deficient relative to the social optimum. If investments are strategic substitutes for Firm 1, and expected losses are sufficiently asymmetric, then Firm 1 s investment may be above the socially optimal level. 7/5/14 CRESSE

19 1.0 Strategic Complements Case: Ha=0.9, b=0.6, f=0.4, c=0.1, q 1 =0.5, q 2 =0.6L 0.8 Best Responses Social Best Responses Firm 1 Precautions Firm 2 Precautions 7/5/14 CRESSE

20 Part II: Vertical integration vs. outsourcing Model Elements Vertical integration occurs in a multilateral supply setting, in which potential suppliers invest in cost- reduction and compete on price. Vertical integration creates a preferred supplier. A vertically- integrated firm sources internally whenever it is cost- effective to do so, but cannot control the investment of independent suppliers. By distorting sourcing in favor of internal supply, vertical integration creates a tradeoff between avoiding markups and discouraging the investments of independent suppliers. 7/5/14 MaCCI

21 Timing of decisions Customer v Supplier 1 Supplier 2. Supplier n Ψ(x 1 ) Ψ(x 2 ) Ψ(x n ) c 1 ~ F(c,x 1 ) c 2 ~ F(c,x 2 ) c n ~ F(c,x n ) B(c 1 ) or c 1 B(c 2 ) B(c n ) 7/5/14 CRESSE

22 Simplifying assumptions: Inelastic demand v = Constant marginal cost of design effort Ψ(x) = ½ x 2 Design effort shifts mean of cost distribution G(c+x) Exponential cost distribution G(c) = 1- e - μ(c- β) 7/5/14 CRESSE

23 Results about vertical integration: Efficient symmetric equilibrium investments if cost variance is sufficient. Vertical integration distorts the sourcing decision and reallocates investments in favor of internal supply. Vertical integration is disfavored if there is sufficient upstream competition. Not too much cost variance Sufficient number of potential suppliers 7/5/14 CRESSE

24 Vertical divestiture is profitable if there is enough upstream competition Procurement cost under vertical integration + Investment cost of integrated supplier + Acquisition price of integrated supplier - Procurement cost under outsourcing n = μ n = 10 n = 8 n = /5/14 CRESSE

25 Part III: Industrial organization implications Interdependent cybersecurity encourages vertical integration A vertically integrated firm internalizes the positive externality of improved security. There also may be economies of scope in security. A vertically integrated firm exploiting economies of scope might become more vulnerable to attack. Still, positive net benefits of internalizing the externality should prevail if selective intervention is possible. 7/5/14 CRESSE

26 Competition policy implications Vertically integrated supplier has poor incentive to prevent internal information leakage, which raises rivals costs. U 1 U 2 D 1 D 2 Cf. Allain, Chambolle, and Rey (2011), Vertical integration, Information, and Foreclosure 7/5/14 CRESSE

27 External cyber- espionage threats raise additional security concerns. U 1 U 2 D 1 D 2 D 3 7/5/14 CRESSE

28 Improved cybersecurity as an efficiency defense Better incentives for security against external threats could outweigh concerns about internal information leakage. Economies of scope in the provision of security could improve safeguards against internal breaches: more effective firewalls; better access control; improved monitoring and forensics. 7/5/14 CRESSE

29 Conclusions Suppliers compete on ideas as well as price. Markup avoidance incentives for vertical integration are counterweighed by an investment discouragement effect. Vertical integration internalizes positive externalities in the provision of cybersecurity. Improved cybersecurity is a ready- made efficiency defense against alleged input foreclosure from a vertical merger. 7/5/14 CRESSE

30 Other Competition Policy Issues Collaborations between competitors Horizontal mergers 7/5/14 CRESSE

31 Thank you! 7/5/14 CRESSE