A "ransomware attack" is when a criminal remotely takes control of a person's or company's computer, then threatens to leak confidential information or delete files unless the victim pays a ransom. This type of attack is becoming increasingly common. The average ransom paid is $170,000, but the criminal also incurs the cost of setting up the attack and the victim incurs a bunch of stress, some reputational damage, and doesn't always get all their data back, so let's suppose that each attack gains $150,000 for the attacker and costs $250,000 to the victim When a ransomware attacker is caught they are sent to prison for ten years. In addition to the disutility to the criminal, it costs the rest of society $500,000 to convict a ransomware criminal and imprison them for their ten-year sentence. Suppose there are 150 potential attackers, each of them considering launching one ransomware attack. The attackers are skilled enough that the attacks will be successful 50 of the attackers consider a ten- year prison term to be equivalent to a disutility of $500.000. fifty consider it equivalent to a disutility of $1,000,000, and fifty consider it equivalent to a disutility of $1,500,000 The FBI is considering launching a new unit devoted to catching ransomware criminals, and is thinking about how much money the unit will need. The larger the unit's budget, the greater fraction of attackers they'll be able to catch: Ransomware unit's budget $0 $100 $4,000,000 $12,000,000 Fraction of attackers caught 0% 2% 20% 40% (a) For each level of budget, how many ransomware attacks will there be, and what will be their social cost? (6) For each level of budget, how many ransomware criminals will get caught, and what will be the social cost of imprisoning them (counting the cost to everyone)? () Explain why a ransomware unit that could catch 2% of attackers would actually be worse than no ransomware unit, even if the unit could be run on a $100 budget. (d) What level of budget is efficient? Explain A "ransomware attack" is when a criminal remotely takes control of a person's or company's computer, then threatens to leak confidential information or delete files unless the victim pays a ransom. This type of attack is becoming increasingly common. The average ransom paid is $170,000, but the criminal also incurs the cost of setting up the attack and the victim incurs a bunch of stress, some reputational damage, and doesn't always get all their data back, so let's suppose that each attack gains $150,000 for the attacker and costs $250,000 to the victim When a ransomware attacker is caught they are sent to prison for ten years. In addition to the disutility to the criminal, it costs the rest of society $500,000 to convict a ransomware criminal and imprison them for their ten-year sentence. Suppose there are 150 potential attackers, each of them considering launching one ransomware attack. The attackers are skilled enough that the attacks will be successful 50 of the attackers consider a ten- year prison term to be equivalent to a disutility of $500.000. fifty consider it equivalent to a disutility of $1,000,000, and fifty consider it equivalent to a disutility of $1,500,000 The FBI is considering launching a new unit devoted to catching ransomware criminals, and is thinking about how much money the unit will need. The larger the unit's budget, the greater fraction of attackers they'll be able to catch: Ransomware unit's budget $0 $100 $4,000,000 $12,000,000 Fraction of attackers caught 0% 2% 20% 40% (a) For each level of budget, how many ransomware attacks will there be, and what will be their social cost? (6) For each level of budget, how many ransomware criminals will get caught, and what will be the social cost of imprisoning them (counting the cost to everyone)? () Explain why a ransomware unit that could catch 2% of attackers would actually be worse than no ransomware unit, even if the unit could be run on a $100 budget. (d) What level of budget is efficient? Explain
