Cybersecurity, industrial organization, and competition policy Michael Riordan Columbia University 7/5/14 CRESSE 2014 1
7/5/14 CRESSE 2014 2
C Chinese Army Unit Is Seen as Tied to Hacking Against U.S. New York Times February 18, 2013 7/5/14 CRESSE 2014 3
7/5/14 CRESSE 2014 4
7/5/14 CRESSE 2014 5
7/5/14 CRESSE 2014 6
Trend toward outsourcing Reliance on networks specialized suppliers Motivated by cost reduction Lower labor costs (offshoring) Product and process innovation June 19, 2013 Dusseldorf/DICE workshop 7
Why U.S. Manufacturing Is Poised for a Comeback (Maybe), Wall Street Journal, June 1, 2014 the number of factory jobs has started to rise after plunging for decades, edging up by about 600,000 over the past four years to more than 12 million Boston Consulting Group estimates that China's overall manufacturing- cost advantage has shrunk to just 4%. companies' desire to produce goods closer to their customers 7/5/14 CRESSE 2014 8
Will re- shoring of manufacturing emphasize outsourcing or vertical integration? How does cybersecurity matter? 7/5/14 MaCCI 2014 9
Does competition over ideas (as well as prices) encourage vertical integration? Do cybersecurity concerns give new encouragement to vertical integration? Do vertical mergers motivated by cybersecurity raise competition policy concerns? 7/5/14 MaCCI 2014 10
Does competition over ideas (as well as prices) encourage vertical integration? NO Do cybersecurity concerns give new encouragement to vertical integration? YES Does vertical integration motivated by cybersecurity raise competition policy concerns? TO THE CONTRARY 7/5/14 MaCCI 2014 11
Outline I. Security interdependence Riordan (2014) Notes on Partnership Security, preliminary draft II. Vertical integration vs. outsourcing Loertscher and Riordan (2014), Oursourcing, Vertical Integration, and Cost Reduction, preliminary draft. III. Industrial organization and competition policy implications Allain, Chambolle & Rey (2011), Vertical Integration, Information, and Foreclosure, working paper. 7/5/14 CRESSE 2014 12
Part I: Security interdependence Model Elements Firms have heterogeneous incentives to take precautions. Firms face security risks both from direct attacks and from indirect attacks via business partners. More difficult to protect against indirect attacks. There is a positive externality of security investments. 7/5/14 CRESSE 2014 13
Risk is a function of threat, vulnerability, and consequences. α x θ 7/5/14 CRESSE 2014 14
Companies risking larger losses have an incentive for greater precautions. α x 1 θ 2 θ 1 x 2 α 7/5/14 CRESSE 2014 15
Cybersecurity is interdependent. α x 1 y 1 β y 2 θ 2 θ 1 x 2 α 7/5/14 CRESSE 2014 16
Simplifying assumptions: Composite security y i = ϕx i with 0 ϕ 1 Diminishing returns to investments quadratic investment costs θ i not too large Well- behaved social welfare function 7/5/14 CRESSE 2014 17
Results about cybersecurity: Strategic dependence: Best responses curves might slope either upward or downward, depending vulnerability to indirect attacks and the magnitude of expected losses. Equilibrium extenalities: There is a unique equilibrium at the intersection of the best response curves. If investments are strategic complements, then investments providing less than complete security are deficient relative to the social optimum. If investments are strategic substitutes for Firm 1, and expected losses are sufficiently asymmetric, then Firm 1 s investment may be above the socially optimal level. 7/5/14 CRESSE 2014 18
1.0 Strategic Complements Case: Ha=0.9, b=0.6, f=0.4, c=0.1, q 1 =0.5, q 2 =0.6L 0.8 Best Responses Social Best Responses Firm 1 Precautions 0.6 0.4 0.2 0.2 0.4 0.6 0.8 1.0 Firm 2 Precautions 7/5/14 CRESSE 2014 19
Part II: Vertical integration vs. outsourcing Model Elements Vertical integration occurs in a multilateral supply setting, in which potential suppliers invest in cost- reduction and compete on price. Vertical integration creates a preferred supplier. A vertically- integrated firm sources internally whenever it is cost- effective to do so, but cannot control the investment of independent suppliers. By distorting sourcing in favor of internal supply, vertical integration creates a tradeoff between avoiding markups and discouraging the investments of independent suppliers. 7/5/14 MaCCI 2014 20
Timing of decisions Customer v Supplier 1 Supplier 2. Supplier n Ψ(x 1 ) Ψ(x 2 ) Ψ(x n ) c 1 ~ F(c,x 1 ) c 2 ~ F(c,x 2 ) c n ~ F(c,x n ) B(c 1 ) or c 1 B(c 2 ) B(c n ) 7/5/14 CRESSE 2014 21
Simplifying assumptions: Inelastic demand v = Constant marginal cost of design effort Ψ(x) = ½ x 2 Design effort shifts mean of cost distribution G(c+x) Exponential cost distribution G(c) = 1- e - μ(c- β) 7/5/14 CRESSE 2014 22
Results about vertical integration: Efficient symmetric equilibrium investments if cost variance is sufficient. Vertical integration distorts the sourcing decision and reallocates investments in favor of internal supply. Vertical integration is disfavored if there is sufficient upstream competition. Not too much cost variance Sufficient number of potential suppliers 7/5/14 CRESSE 2014 23
Vertical divestiture is profitable if there is enough upstream competition. 0.02 Procurement cost under vertical integration + Investment cost of integrated supplier + Acquisition price of integrated supplier - Procurement cost under outsourcing 0.01 0.00 n = 12 0.2 0.4 0.6 0.8 1.0 μ -0.01 n = 10 n = 8 n =6-0.02 7/5/14 CRESSE 2014 24
Part III: Industrial organization implications Interdependent cybersecurity encourages vertical integration A vertically integrated firm internalizes the positive externality of improved security. There also may be economies of scope in security. A vertically integrated firm exploiting economies of scope might become more vulnerable to attack. Still, positive net benefits of internalizing the externality should prevail if selective intervention is possible. 7/5/14 CRESSE 2014 25
Competition policy implications Vertically integrated supplier has poor incentive to prevent internal information leakage, which raises rivals costs. U 1 U 2 D 1 D 2 Cf. Allain, Chambolle, and Rey (2011), Vertical integration, Information, and Foreclosure 7/5/14 CRESSE 2014 26
External cyber- espionage threats raise additional security concerns. U 1 U 2 D 1 D 2 D 3 7/5/14 CRESSE 2014 27
Improved cybersecurity as an efficiency defense Better incentives for security against external threats could outweigh concerns about internal information leakage. Economies of scope in the provision of security could improve safeguards against internal breaches: more effective firewalls; better access control; improved monitoring and forensics. 7/5/14 CRESSE 2014 28
Conclusions Suppliers compete on ideas as well as price. Markup avoidance incentives for vertical integration are counterweighed by an investment discouragement effect. Vertical integration internalizes positive externalities in the provision of cybersecurity. Improved cybersecurity is a ready- made efficiency defense against alleged input foreclosure from a vertical merger. 7/5/14 CRESSE 2014 29
Other Competition Policy Issues Collaborations between competitors Horizontal mergers 7/5/14 CRESSE 2014 30
Thank you! 7/5/14 CRESSE 2014 31