INTRODUCTION

Individuals and firms make significant investments in private security. These expenditures cover everything from simple door locks on private homes to elaborate security systems and private security guards. They are in addition to and often complement public law enforcement expenditures. They also differ from public law enforcement expenditures in that they are aimed at the direct prevention or reduction of loss and not necessarily at deterring crime through ex post sanctions.

A growing and important subset of private security expenditures are those related to cybersecurity (see Introduction and Chapter 5). Private security expenditures are important given the decentralized nature of the Internet and the difficulties in applying traditional law enforcement techniques to crime and other wealth-transferring activities that take place in cyberspace. These include difficulties in identifying those responsible for cybercrimes, difficulties arising from the large volume and inchoate nature of many of the crimes, and difficulties associated with punishing judgment-proof individuals who are eventually identified as responsible for cyberattacks. As a consequence, those responsible for cyberattacks may perceive both that the probability of punishment is low and that the size of the sanction (when punishment occurs) is small; the final result will be a low expectation of penalty and inadequate deterrence (Becker 1968).

Although individuals and businesses have made significant private investments in cybersecurity, there is a concern that leaving the problem of cybersecurity to the private sector may result in an inadequate level of protection for individuals, firms, and critical networks.