Should ISPs be liable for negative externalities ofbotnets?
Shinya Kinukawa∗
June 24, 2012

Abstract
A botnet, a network of computers under the control of an on-line
attacker, is an important threat to cybersecurity since it is a popularmethod to carry out a wide range of criminal services on the internet.
Several researchers argue that Internet Service Providers (ISPs) should
be liable for damages caused by their customers’ computers consisting of
botnets in order to make ISPs secure their networks. This paper evaluates
ISP liability for violations of cybersecurity based on an economic modelof a monopolistic ISP providing network access. The results of model
analysis show that imposing liability on the ISP can decrease social welfare
if the cost of cleaning up botnet malware from users’ computers is not
suﬃciently low. In that case, the equilibrium access fee becomes so highthat both the ISP’s proﬁts and consumer surplus decrease compared to thecase that the ISP does nothing against botnets. On the other hand, if thecleanup cost is suﬃciently low, the ISP can have an incentive to voluntarily
clean up botnet malware from users’ computers without liability.

Keywords: ISP, liability, botnets∗ Komazawa University

1

Introduction

The internet has been growing as an infrastructure in the global economy. The
rapid growth of cloud-computing services makes the internet further importantfor every type of users from individual consumers to large corporations. However, the internet is not as safe as other important infrastructures such as watersupply. Cybersecurity is continuously threatened by malicious attacks such as
distributed denial of service (DDoS) attacks and theft of proprietary data.1
A current major threats to cybersecurity is the proliferation of botnets, a
popular method of attack impacting nearly all aspects of cybersecurity including
sending spam, committing online-advertising fraud, launching DDoS attacks,
hosting phishing attacks, and anonymizing attack traﬃc (Moore, 2010). A
botnet is a network of computers infected by a type of malware to make thosecomputers under the control of an attacker. Although individual computers
constructing a botnet are controlled by criminals as an attack method, botnet
malware tends not to obviously advertise their presence to the users of thosecomputers (StopBadware Inc, 2011). Therefore, the individual users of botnetinfected computers often do not realize the infection.
Internet service providers (ISPs) are currently exempted from liability for
violations of cybersecurity, and many of them take no action against theircustomers’ infection to malware because of their weak incentive to intervene(Moore, 2010). However, ISPs have been generally considered as a key player
to remove botnets from the internet, and several scholars and security experts
have discussed whether or not ISPs should be responsible to cybersecurity.2
Lichtman and Posner (2006) argue that ISPs should be liable for damages
caused by their customers’ malware-infected computers. The reasons are that
ISPs control the gateways through which malicious codes enter the networkand that imposing liability on ISPs is consistent with conventional tort law
principles. Moore (2010) recommends a less aggressive approach that gives ISPs
1 See, for example, Touré (2011) for recent cases of cyber attacks against information in-

frastructure and private sectors.
2 For a survey of literature on cybersecurity and ISP, see Rowe et.al. (2009). Security
experts’ opinions are fund in an article on CIO.com, “Seeing No Evil: Is It Time To regulate
the ISP industry” (by Matt Villano, 2005/11/1). van Eeten et al. (2010) provides an empiricalevidence that most malware are sent by machines connected to ISPs.

1safe harbor if they clean up customers’ infected machines upon notiﬁcation. In
either approach, assigning ISPs the responsibility for cybersecurity imposes a
costly obligation on ISPs and thus can cause ISPs to overreact. Because ISPs
have only a weak incentive to provide access to customers whose computers arevulnerable to malware, imposing liability on ISPs for the acts of their customers
can lead ISPs to purge those risky customers from the network (Lichtman andPosner, 2006). Such a concern about ISPs’ overreaction may justify government
subsidy for a part of the cost to clean up infected computers, which is suggested
by Clayton (2010) and Moore (2010).
This paper evaluates ISP liability for violations of cybersecurity using an
economic model examining its eﬀects on social welfare. In the model, a monopolistic ISP provides local network access, and a continuum of users are heterogeneous on their incentives to pay the access fee and to take precautions against
malware. There are both positive and negative externalities in the network. All
on-line users create positive externalities, but a part of on-line users who do nottake precautions create negative externalities because their computers are vulnerable to botnet malware infection. Moreover, the ISP can secure its networkby incurring cost to clean up botnet malware from their customers’ computers
or by simply purging users whose computers are vulnerable to botnet malware.
Using this model, we examine the ISP’s incentives to secure the network andevaluate the eﬀects of the ISP’s actions on social welfare.
The model analysis reveals that the low clean-up cost is crucial to achievesafe network maximizing social welfare. If the clean-up cost is suﬃciently low,
securing the network by cleaning up botnet malware can increases the proﬁts
of the monopolistic ISP. In that case, negative externalites are removed fromthe network without a large increase in the access fee and thus total numberof on-line users, which create positive externalities, increase as a result. If theclean-up cost is not suﬃciently low, liability can force the ISP to clean up
botnet malware, but the higher access fee decreases total number of on-line
users. Moreover, for high clean-up cost, the ISP may rather choose to purge apart of users who do not take precautions against malware in order to secure
the network. In the latter cases, the social welfare decreases because positive
externalities decrease due to the loss of a part of on-line users. The results

2

would rationalize government subsidiary or support to ISPs for cleaning up
botnet malware from users’ computers to secure the network.
The rest of the paper is organized as follows. Section 2 presents the model.
Section 3 examines the ISP’s incentive and social welfare where it has only two
options: it cleans up botnet malware from users’ computers or does nothing
against botnet. Section 4 examines the third option for ISP, that is, disconnecting the access of users who does not take precautions, and compare the eﬀects
on social welfare between the three actions of the ISP. Section 5 concludes thepaper.

2

Model

We consider a local Internet access market where a monopolistic Internet service
provider (ISP) provides network access.3 ISP ﬁrst decides whether or not tosecure the network by cleaning up botnets incurring cost c > 0 per an on-line
user, and then determines the access fee pi that maximizes its proﬁt. The index
i = 0, 1 denotes the network’s security status changed by ISP: i = 0 denotesthat ISP takes no action to secure the network and i = 1 denotes that ISP
secures the network by cleaning up botnets.
In the above setting, we assume that the cost of cleaning up botnets fromthe network increases as the total number of on-line users increases, whether or
not a user’s computer is infected. The ﬁrst step of cleaning up botnets malware
from infected computers is the identiﬁcation of such computers, which requires
inventing an eﬀective method.4 . Therefore, the cleanup cost can depend on thenumber of all computers connected to the ISP’s network.
Types of users are continuum indexed by x on the interval [0, 1] with a unit
density.5 Let ni be the number of users who pay the network access fee and thus
be on-line. If ISP takes no action to secure the network, it maximizes π0 = n0 p0 .
If ISP decides to clean up botnet malware, it maximizes π1 = n1 p1 − n1 c.
3 The monopolistic ISP assumption is reasonable when only limited choices of Internet

access are available to consumers or there are signiﬁcant switching costs in changing ISP. See
Economides (2008) and Choi and Kim (2010).
4 See, for example, Cyber Clean Center (2010)
5 Potential users of the network include content providers such as cloud-computing service
providers as well as end-users.

3

Users decide whether or not to pay the access fee pi to be on-line. At thesame time, they also decide whether or not to take precautions against malware
infection such as installing security software, which can imposes diﬀerent costs
for diﬀerent user types. Let nsi be the number of on-line users who take precautions (“secure users”) and nvi be the number of on-line users who do not takeprecautions (“vulnerable users”). The total number of on-line users is given asni = nsi + nvi . The utility of a secure user located at x ∈ [0, 1] under ISP’s
decision i isusi (x) = ni − (1 − δi )nvi + α − βs (1 − x) − pi ,(1)

and the utility of a vulnerable user located at x ∈ [0, 1] under ISP’s decision i isuvi (x) = ni − (1 − δi )nvi − βv x − pi .

(2)

The utility of oﬀ-line users is zero.
In the above equations of the utility, ni denotes the network externalities
determined by the total number of on-line users, while (1 − δi )nvi denotes thenegative externalities determined by the number of vulnerable on-line users,
where δi ∈ [0, 1]. The negative externalities describe a situation where vulnerable users’ computers construct botnets and are controlled by attackers. An
increase in vulnerable users would spread botnets and thus increase the risk ofattacks against all on-line users. ISP can decrease the negative externalities
by making a costly eﬀort to clean up botnet malware from users’ computers(i = 1), and for simplicity we set δ1 = 1, that is, ISP can completely remove
the negative externalities. On the other hand, when ISP take no action against
botnets (i = 0), there exist negative externalities of botnets in the network, andwe set δ0 = 0.
The parameters α, βs , βv > 0 determine beneﬁts and losses of users’ decision
whether or not to take precautions against cybersecurity. The parameter α isthe beneﬁts that are the same for all user types, and βs is the diﬀerence in users’
cost for taking precautions. Since botnets are not the only sources of damages
to users, ISP’s cleaning-up botnets and users’ precautions are not substitutebut rather complement each other.6 For secure users, α − βs (1 − x) denotes the
6 For example, USB ﬂash memory storage devices are major vehicles for computer virus.

4net beneﬁts of taking precautions. User-types x located at close to 1 are those
who receive large beneﬁts from precautions, while user-types x close to 0 receive
only small or negative beneﬁts because of relatively large costs. For vulnerable
users, −βv x denotes the expected losses due to vulnerability to cybersecurity,that is, the cost of not taking precautions. User-types close x to 1 suﬀer large
damages when they do not take precautions, while user-types x close to 0 suﬀer
little damage even without precautions. In the following, we set βs = βv = β.

3Equilibrium prices and demands of the network access

Let x = xvi , xsi be such that uvi (xvi ) = 0 and usi (xsi ) = 0, where xvi < xsi .
Then, nvi = xvi and nsi = 1 − xsi . When ISP takes no action against botnets(i = 0), from the utility (1) and (2),ns0 + α − βns0 − p0 = 0andns0 − βnv0 − p0 = 0.

Similarly, when ISP cleans up botnets from the network (i = 1),
n1 + α − βns1 − p1 = 0

andn1 − βnv1 − p1 = 0.

Secure and vulnerable users’ demands of the network accesses in each i = 0, 1
are given as,
ns0 =α − p0
,
β−1

nv0 =

α − βp0,β(β − 1)ns1 =α(β − 1) − βp1,
β(β − 2)nv1 =α − βp1.
β(β − 2)So that these demand functions are decreasing in the access fee pi , the parameterβ is restricted to β > 2, which implies that costs for users’ precautions are
suﬃciently diﬀerent.
ISP determines the access fee pi maximizing πi , where π0 = (ns0 +nv0 )p0 and
π1 = (ns1 + nv1 )(p1 − c). Both the proﬁt functions π0 and π1 are concave in pi
since β > 2 is assumed. The ﬁrst order condition is given as α(β + 1) − 4βp0 = 0
for i = 0, and α − 4p1 + 2c = 0 for i = 1. The equilibrium access fee and thenumber of on-line users arep0 =α(β + 1)
,
4β

ns0 =

α(3β − 1),4β(β − 1)5

nv0 =α(3 − β),4β(β − 1)for i = 0, andp1 =α + 2c1, ns1 =4β−2{α(3β − 4) c
−
4β
2

}
, nv1 =1β−2{α(4 − β) c
−
4β
2

}

for i = 1, respectively.
In the following, the parameters α, β, and c are restricted so that nsi , nvi > 0
and ni ≤ 1. First, ns0 > 0 is satisﬁed since β > 2, but nv0 > 0 requires β < 3.
If the diﬀerence in users’ costs for precautions is too large, all on-line users willtake precautions because of large cost of not taking them. Then, β is set to
2 < β < 3.
Second, ns1 , nv1 > 0 require α(3β − 4) − 2βc > 0 and α(4 − β) − 2βc > 0, whichgive the upper bound of c as{}α(3β − 4) α(4 − β)α(4 − β)c < min
,
=
≡ c,
2β
2β
2β
since 3β − 4 > 4 − β for β > 2. Third, from ni = nsi + nvi ≤ 1,n0 =α(β + 1)
≤ 1 and2β(β − 1)n1 =α − 2c≤ 1,2(β − 2)

which give the upper bound of α and the lower bound of c asα≤2β(β − 1)
≡ α,
β+1

c≥

α
− β + 2 ≡ c.
2

Finally, since c > 0, the lower bound of α is given as
α > 2(β − 2) ≡ α.7

4

ISP’s incentive to clean up botnet malware

When ISP cleans up botnet malware from the network, users’ demand for network access and thus ISP’s proﬁts can increase because of the elimination ofnegative externalities. At the same time, if the clean-up cost per user largely
raises the access fee, the demand and ISP’s proﬁts can also decrease. In thissection, we examine how the clean-up cost c aﬀects ISP’s proﬁts and social
welfare.
7 α < α is easily conﬁrmed by directly calculating α−α. For c < c, c−c = (β −2)(β −α)/β.

When α takes the largest value α, β − α = β(3 − β)/(β + 1) > 0 since β < 3, which implies
that c < c for α ≤ α.

6

We ﬁrst show that there exits c such that the total numbers of on-line users
under the secured (i = 1) and non-secured (i = 0) network are equal. The
diﬀerence in the number of on-line users between the secured and non-secured
network is given asn1 − n0==

α − 2cα(β + 1)−2(β − 2) 2β(β − 1)
α − β(β − 1)c.
β(β − 1)(β − 2)

Therefore, n1 = n0 whenc=

α≡ c∗ .
β(β − 1)

Lemma 1 c ≤ c∗ < c
Proof. See Appendix.
Thus, if c ∈ [c, c∗ ), the total number of on-line users increases if ISP changes its
decision from taking no action to cleaning up botnets.
ISP’s incentive to clean up botnet malware can be examined by deﬁning
D1 (c) ≡ π1 − π0 , the diﬀerence in the proﬁts under the secured and non-secured
network:n1 (p1 − c) − n0 p01αα2α2 (β + 1)2
=
c2 −
c+
− 2
,
2(β − 2)2(β − 2)8(β − 2) 8β (β − 1)D1 (c) =which takes the minimum value at c = α/2. Since c = (α/2) {(4 − β)/β} < α/2
for β > 2, D1 (c) is decreasing in c ∈ [c, c). It can be shown that if α and c are
suﬃciently small, D1 (c) > 0 and thus π1 > π0 .
Lemma 2 For α ∈ [α, α+ ), where α+ ≡ α

√

β−2
+
∗
β−1 , there exists c ∈ (c, c ) suchthat D(c+ ) = 0 and D1 (c) > 0 for c ∈ [c, c+ ).
Proof. See Appendix.
The parameter α determines users’ beneﬁts of their own precautions against
all types of security risks. Lemma 2 implies that ISP can have an incentive
to clean up botnet malware when users’ own precautions can not adequately
protect their computers. Furthermore, for ISP to have an incentive to clean
up botnet malware, the cost should be smaller than the level that on-line users
increase as a result of ISP’s cleanup.
7Social welfare is deﬁned as the sum of ISP’s proﬁts (πi ) and consumer surplus(CSi ). The latter is given as
∫ 1

∫ xvi
CSi

uvi (x)dx +

=
0

=
=

usi (x)dx
xsi

11
xvi uvi (0) + (1 − xsi )usi (1)2211nvi uvi (0) + nsi usi (1).
2
2

It can be shown that if the number of on-line users under the secured network(i = 1) is larger than that under non-secured network (i = 0), so is the consumer
surplus.
Lemma 3 n1 > n0 ⇐⇒ CS1 > CS0 .
Proof. See Appendix.
From the lemma 1, 2, and 3, ISP’s proﬁts and social welfare under the two
security statuses of the network are summarized as follows.
Proposition 1 Assume α ∈ [α, α+ ). Then,(i) If c ∈ [c, c+ ), then π1 > π0 and CS1 > CS0 .
(ii) If c ∈ [c+ , c∗ ), then π1 ≤ π0 and CS1 > CS0 .
(iii) If c ∈ [c∗ , c), then π1 < π0 and CS1 ≤ CS0 .
If the cleanup cost c is suﬃciently small that c < c+ , there is no need to impose
liability on ISP to secure the network because ISP has an incentive to do sovoluntarily. Social welfare, deﬁned as πi + CSi , is also maximized in this case.
If c ≥ c+ , imposing liability on ISP can improve consumer surplus because ISP
does not have an incentive to voluntarily clean up botnet malware. Nevertheless,the cost should be smaller than c∗ since otherwise the high access fee excludes
marginal on-line users and decreases consumer surplus.

5

ISP’s incentive to disconnect vulnerable users

As mentioned in Introduction, if liability for violations of cybersecurity is imposed on ISP, it may overreact. Because detecting and cleaning up botnet
8

malware in users’ computers are costly, ISP may rather choose to disconnect
users whose computers are vulnerable to malware infection. In this section, we
examine ISP’s incentive to disconnect vulnerable users and its welfare impact.

5.1

Equilibrium and consumer surplus

Let i = 2 denote the case that ISP disconnects users who do not take precautions
against malware. In this case, only secure users are on-line and have utility
u2 (x) = n2 + α − β(1 − x) − p2 .
All other users are oﬀ-line and have zero utility. Let x2 be such that u2 (x2 ) = 0.
Since 1 − x2 = n2 , the demand function is given asn2 =α − p2.
β−1

ISP determines p2 maximizing the proﬁt π2 = n2 p2 , which is concave since
β > 2 is assumed. The ﬁrst order condition gives
p2 =

α
2

and n2 =α,2(β − 1)

where n2 < 1 by the assumption α ≤ α since
n2 ≤

α
β
=
< 1.
2(β − 1)(β + 1)

By lemma 3, consumer surpluses under ISP’s three actions (i = 0, 1, 2) can becompared using the number of on-line users ni . Then, it is shown that consumer
surplus becomes the smallest if ISP disconnects the vulnerable users from the
network.
Lemma 4 CS2 < min (CS0 , CS1 ).

5.2

ISP’s incentive to disconnect vulnerable users

First, the comparison of π2 = n2 p2 with π0 = n0 p0 is as follows.
π0
⋚1
π2

⇐⇒
⇐⇒

√
(β + 1)2⋚ 1 ⇐⇒ β + 1 ⋚ 2β
2
2β
√
1
β⋛√
= 2 + 1 ≈ 2.41.
2−1

9

Since β ∈ (2, 3), ISP can have an incentive to disconnect vulnerable users even
without liability.8√
If β > 2 + 1, disconnecting vulnerable users is more proﬁtable for ISP
compared to letting them connected without taking costly eﬀort to clean up
botnet malware. In this case, the degree of precautions’ cost diﬀerence amongusers is so large that secure users are willing to pay the higher access fee if
the network is secured by disconnecting vulnerable users (p2 > p0 is easily√
conﬁrmed). On the other hand, if β ≤ 2+1, ISP will not disconnect vulnerable
users unless liability is imposed. In this case, the degree of precautions’ costdiﬀerence is not large enough for secure users to pay the higher access fee (p2 ).
Then, charging the lower access fee (p0 ) to as many users as possible including
vulnerable ones is more proﬁtable for ISP.
To compare π2 with π1 , deﬁne D2 (c) ≡ π1 − π2 :D2 (c)

n1 (p1 − c) − n2 p2
1
α
α2
α2
=
c2 −
c+
−
.
2(β − 2)2(β − 2)8(β − 2) 4(β − 1)=

ISP’s incentives to disconnect vulnerable users and to clean up botnet malware
are examined according to the two cases of the parameter β above.
5.2.1

Does ISP disconnect vulnerable users when liability is imposed?

First, we assume β <√(2) + 1. Then, ISP does not disconnect vulnerable users

unless liability is imposed since π2 < π0 . Moreover, if c < c+ , ISP’s optimal
choice is to clean up botnet malware from users’ computers since π0 < π1 .
Suppose c ≥ c+ . Then, if liability is imposed on ISP, it has to secure
the network by choosing whether to clean up botnet malware or to disconnect
vulnerable users. If ISP chooses to clean up botnet malware, it should be
D2 (c) > 0. Both D1 (c) and D2 (c) are convex quadratic functions taking theminimum values at c = α/2, and thus D2 (c) is a vertical shift up of D1 (c) since
8 In fact, there exist cases that ISPs voluntarily disconnected their users whose computers

are the source of cybersecurity violations. For example, in 2008, a US hosting service provider
McColo Corp., which had hosted botnets for years, was unplugged by two ISPs that were
providing Internet connectivity to it. See “Host of Internet Spam Groups Is Cut Oﬀ” byBrian Krebs, washingtonpost.com, November 12, 2008.

10

π2 < π0 . Then, by setting c++ such that D2 (c++ ) = 0, it follows that c+ < c++ .
It can be also shown that D2 (c∗ ) < 0 by calculating D2 (c∗ ) = n0 (p1 − c∗ ) − n2 p2(n1 = n0 when c = c∗ ) and thus c++ < c∗ (see ﬁgure 1).
D1(c)
D2(c)

c++c*
c

c+

c

Figure 1: D1 (c) and D2 (c)Let α ∈ [α, α+ ) so that D1 (c) > 0. Then, if c ∈ [c+ , c++ ) and liability is
imposed on ISP, it chooses to clean up botnet malware rather than to disconnect
vulnerable users by the above arguments. In this case, the proﬁt of cleaning
up botnet malware is smaller than that of taking no action (D1 (c) ≤ 0 forc ≥ c+ ), but consumer surplus increases by imposing liability since c < c∗ .
On the other hand, if c ≥ c++ , ISP chooses to disconnect vulnerable users, andconsumer surplus becomes the smallest. The results are summarized in the next
proposition.
Proposition 2 Assume that β ∈ (2, 1 +√2), α ∈ [α, α+ ), and c < c∗ . Then,

CS2 < CS0 < CS1 and(i) π2 < π1 ≤ π0 if c ∈ [c+ , c++ ).
(ii) π1 ≤ π2 < π0 if c ∈ [c++ , c∗ ).
5.2.2

Does ISP clean up botnet malware when disconnecting vulnerable users is more profitable than taking no action?

Next, if the degree of precautions’ cost diﬀerence is large (β ≥ 1 +√2), ISP

would disconnect vulnerable users even if there is not liability since π2 ≥ π0 .
In this case, imposing liability on ISP dose not aﬀect its action to secure the11network. However, the cleanup cost c can change ISP’s action from disconnecting vulnerable users to cleaning up botnet malware, though depending on theparameter α.
When π2 ≥ π0 , D2 (c) is a vertical shift down of D0 (c) by the same argument
as above, and thus c++ ≤ c+ < c∗ (see ﬁgure 2). Since n1 = 1 for c = c,
D2 (c)

p1 − c − π2
α2
β−2
−
=
2
4(β − 1)√> 0 ⇐⇒ α < 2(β − 1)(β − 2) ≡ α++ .

=Lemma 5 α < α++ ≤ α+ for β ≥ 1 +√2

Proof. See Appendix.
By the lemma 5, if α is small enough, there exists c ∈ [c, c++ ) such that
ISP chooses to clean up botnet malware rather than to disconnect vulnerable
users when π2 ≥ π0 . In this case, however, an incentive for ISP to change its
action to cleaning up botnet malware requires even lower users’ beneﬁt of taking
precautions compared to the case that cleaning up botnet malware is the only
option to secure the network.
D1(c)
D2(c)

c+c*
c

c

c++

Figure 2: D2 (c) and D1 (c)6Conclusion

Several researchers have argued that ISPs should take a more active role to clean
up botnets from the Internet, and have suggested imposing indirect liability on
12

ISPs for damages caused by their customers’ computers infected by botnet malfare, from which they are currently exempted. A concern of imposing liability
on ISPs is that it may result in excluding a part of users of Internet access andreduce positive externalities. ISPs may raise access fee to compensate costly
eﬀort to clean up botnet malware, or they may disconnect connections of users
who do not take precautions against malware to achieve the secured network
without incurring cost.
The model analysis of this paper clariﬁes how the cost of malware clean-up
aﬀects a liable ISP’s behavior and social welfare. If the cost is suﬃciently low,
ISP can have an incentive to voluntarily clean up botnet malware from its users’
computers without disconnecting those users. If the cost is not low enough for
ISP to have an incentive of voluntarily cleaning up botnet malware, imposing
liability on ISP can have the following two eﬀects on consumer surplus. The
ﬁrst eﬀect is an increase in consumer surplus. Imposing liability on ISP removes
negative externalities from the network and makes accessing the network more
attractive, which results in an increase in on-line users and thus positive externalities. The second one is a decrease in consumer surplus. Imposing liability on
ISP raises access fee or purges botnet-infected users, which result in a decreasein on-line users and thus positive externalities. If the clean-up cost is suﬃciently
high, the latter eﬀect dominates the former one, and thus imposing liability on
ISP decreases social welfare because both ISP’s proﬁts and consumer surplus
decrease.
The model analysis also indicates that ISP can have an incentive to disconnect users vulnerable to botnet malware even without liability if users’ preferences for precautions against malware is suﬃciently diﬀerent. In this case,securing the network by disconnecting vulnerable users makes it possible tocharge other users the access fee high enough to increase ISP’s proﬁts. However, if the clean-up cost is suﬃciently low, cleaning up malware from infectedcomputers without disconnecting any users can be more proﬁtable to ISP because letting vulnerable users be on-line makes positive externalities larger than
disconnecting them.
There is an empirical case that can be a support for the results of this paper’s
model analysis. van Eeten et.al (2010) gathered data on the location of botnet

13

infected computers in the period 2005-2009 for the empirical analysis of global
botnet infection. A part of their ﬁndings indicates that ISPs in Japan and
Finland are, on average, among the least infected networks in the wider OECD
area. These two countries are known for the collaboration between governments
and ISPs for cybersecurity. For example, in Japan, ISPs collaborates with thegovernment at the Cyber Clean Center (CCC). CCC detects infected users andpasses the information to ISPs. Then, ISPs notify the aﬀected users of infection
and direct them to CCC’s website, which oﬀer free malware removal softwaredeveloped by CCC. Thus, the Japanese government bears a large part of thecost for cleaning up botnet malware.
An implication of this paper’s results is that making the cost of cleaning up
botnet malware low is the most important to remove botnets from the Internet. Clayton (2010) illustrates how costly it is to detect end-user computers
infected with malware and to eﬀectively clean up those computers. Then, Clayton (2010) recommends subsidies to ISPs for cleaning up malware rather than
imposing liability on ISPs as proposed by Lichtman and Posner (2006). This
paper’s results give theoretical justiﬁcation for subsidies to ISPs by showingthat imposing liability on ISP can worsen social welfare if the clean-up cost is
not suﬃciently low.

Appendix
Proof of Lemma 1(i) c∗ < c
For β ∈ (2, 3),c − c∗==α(4 − β)α−2ββ(β − 1)α(3 − β)(β − 2) > 0.
2β(β − 1)(ii) c ≤ c∗c∗ − cαα − 2β + 4−β(β − 1)2{}
β+1
= (β − 2) 1 − α≥ 0.
2β(β − 1)=14since β > 2 andα≤α=2β(β − 1)
β+1
⇐⇒ α
≤ 1.
β+1
2β(β − 1)

Proof of Lemma 2
Since n1 = n0 when c = c∗ ,D1 (c∗ ) =n1 (p1 − c∗ − p0 ){}α(β + 1)
α + 2c∗− c∗ −
= n1
4
4β
(
)
∗
α
c
= n1 −−< 0.
4β2Therefore, if D1 (c) > 0, there exist c+ ∈ (c, c∗ ) such that D1 (c+ ) = 0 because
D1 (c) is decreasing for c < c. Since n1 = 1 for c = α/2 − β + 2,
D1 (c)

p1 − c − n0 p0
α + 2cα2 (β + 1)2
=
−c− 2
4
8β (β − 1)
β − 2 α2 (β + 1)2
=
− 2
.
2
8β (β − 1)

=

Then,
D1 (c) > 0

⇐⇒
⇐⇒
⇐⇒

α2 (β + 1)2
4β 2 (β − 1){}2
β − 2 2β(β − 1)
β−2 2
α2 <
α
=
β−1
β+1
β−1
√
β−2
α<
α ≡ α+ .
β−1
β−2>α+ < α is apparent. For α+ > α,√α+
β − 2 β(β − 1)=αβ − 1 (β + 1)(β − 2)√β3 − β2=>1
β 3 − 3β − 2since β 3 − β 2 − (β 3 − 3β − 2) = β(3 − β) + 2 > 0 for β ∈ (2, 3). Therefore, forα ∈ [α, α+ ), there exists c+ ∈ (c, c∗ ) such that D1 (c+ ) = 0, which implies that
D1 (c) > 0 for c < c+ .

15

Proof of Lemma 3(i) n1 > n0 ⇐⇒ ns1 > ns0 , nv1 > nv0
The utility of a secure user x = xsi and a vulnerable user x = xvi areusi (xsi ) = ni − (1 − δi )nvi + α − βnsi − pi = 0,

(a1)

uvi (xvi ) = ni − (1 − δi )nvi − βnvi − pi = 0.

(a2)

From equations (a1) and (a2), it follows that α − βnsi + βnvi = 0. Thus,ni = nsi + nvi = 2nsi − α/β = 2nvi + α/β.
Thus, n1 > n0 is equivalent to ns1 > ns0 and nv1 > nv0 .
(ii) ns1 > ns0 ⇐⇒ us1 (1) > us0 (1), nv1 > nv0 ⇐⇒ uv1 (0) > uv0 (0)The utility of a secure user x = 1 and a vulnerable user x = 0 are
usi (1) = ni − (1 − δi )nvi + α − pi ,(a3)uvi (0) = ni − (1 − δi )nvi − pi .

(a4)

Substituting (a3) and (a4) into (a1) and (a2) respectively, we haveusi (1) − βnsi = 0,uvi (0) − βnvi = 0.
Thus, ns1 > ns0 is equivalent to us1 (1) > us0 (1) and nv1 > nv0 is equivalent to
uv1 (0) > uv0 (0).
(iii) n1 > n0 ⇐⇒ CS1 > CS0
Since CSi = 12 nvi uvi (0) + 12 nsi usi (1), by the above (i) and (ii), n1 > n0 is
equivalent to CS1 > CS0 .

Proof of Lemma 4First, n2 < n0 and thus CS2 < CS0 since
n2 =

α
β+1
α
< n0 =.
2(β − 1)2(β − 1) β

16

Second, n2 < n0 and thus CS2 < CS0 is conﬁrmed as follows:n1 − n2 =α − 2cαα − 2(β − 1)c−=>02(β − 2) 2(β − 1)2(β − 2)(β − 1)

for

c<c

since α − 2(β − 1)c = α(β − 2)2 /β > 0. As is examined in section 4, n0 ⋚ n1 isdetermined by the clean-up cost c. Thus, CS2 < min (CS0 , CS1 ).

Proof of Lemma 5(i) α < α++
α++
=
α

√
√
2(β − 1)(β − 2)
β−1=
>12(β − 2)2(β − 2)forβ < 3.

(ii) α++ ≤ α+
√

√

β−2
β−1
√
√
2β √
2β ++
=
2(β − 1)(β − 2) =
α
β+1
β+1
√
√
√
Since it is assumed that β ≥ 1 + 2 = 1/( 2 − 1) and thus 2β ≥ β + 1, it
α+

=

α

β−2
2β(β − 1)
=
β−1
β+1

follows α++ ≤ α+ .

References[1] Choi, J.P., and B. Kim (2010) “Net neutrality and investment incentives,”
Rand Journal of Economics, 41, 446-471.
[2] Clayton, R. (2010) “Might Government Clean-up Malware?” 10th Annual
Workshop on Economics and Information Security (WEIS10), available at
http://weis2010.econinfosec.org/papers/session4/weis2010 clayton.pdf (lastaccessed on 2012/4/27).
[3] Economides, E. (2008) “Net Neutrality, Non-Discrimination and Digital Distribution of Content Through the Internet,” A Journal of Law and Policy
for the Information Society, Vol.4, pp. 209-233.
[4] Lichtman, D. and E. P. Posner (2006), “Holding Internet service providers
accountable,” in The Law and Economics of Cybersecurity, edited by M. F.
Grady and F. Parisi, Cambridge University Press.
17[5] Moore, T. (2010) “Introducing the Economics of Cybersecurity: Principles
and Policy Options,” Proceedings of a Workshop on Deterring CyberAttacks:
Informing Strategies and Developing Options for U.S. Policy, available at
http://www.nap.edu/catalog/12997.html (last accessed on 2012/4/27).
[6] StopBadwareInc.

(2011)

“The

State

of

Badware,”availableat

http://www.stopbadware.org/pdfs/stateofbadwarejune2011.pdf (last accessed on 2012/4/27).
[7] Touré (2011) “Cyberspace and the Threat of Cyberwar,” in The Quest for
Cyber Peace, International Telecommunication Union and World Federationof Scientists, available at http://www.itu.int/pub/SGENWFS.0112011 (lastaccessed on 2012/4/27).
[8] van Eaten, M., J. M. Bauer, H. Asghari, S. Tabatabaie (2010) “TheRole of Internet Service Providers in Botnet Mitigation:

An Em-

pirical Analysis Based on Spam Data,”

Technol-

ogy and Industry Working Papers,

OECE Science,

available at http://www.oecd-

ilibrary.org/scienceandtechnology/theroleofinternetserviceprovidersinbotnetmitigation 5km4k7m9n3vjen (last accessed on 2012/4/27).

18