A ransomware attack is when a criminal remotely takes control of a persons or companys computer, then threatens to leak confidential information or delete files unless the victim pays a ransom. This type of attack is becoming increasingly common.

The average ransom paid is $170,000, but the criminal also incurs the cost of setting up the attack and the victim incurs a bunch of stress, some reputational damage, and doesnt always get all their data back, so lets suppose that each attack gains $150,000 for the attacker and costs $250,000 to the victim.

When a ransomware attacker is caught, they are sent to prison for ten years. In addition to the disutility to the criminal, it costs the rest of society $500,000 to convict a ransomware criminal and imprison them for their ten-year sentence.

Suppose there are 150 potential attackers, each of them considering launching one ransomware attack. The attackers are skilled enough that the attacks will be successful. 50 of the attackers consider a tenyear prison term to be equivalent to a disutility of $500,000, fifty consider it equivalent to a disutility of $1,000,000, and fifty consider it equivalent to a disutility of $1,500,000.

The FBI is considering launching a new unit devoted to catching ransomware criminals, and is thinking about how much money the unit will need. The larger the units budget, the greater fraction of attackers theyll be able to catch:

Ransomware units budget	Fraction of attackers caught
$0	0%
$100	2%
$4,000,000	20%
$12,000,000	40%

1. For each level of budget, how many ransomware attacks will there be, and what will be their social cost?

2. For each level of budget, how many ransomware criminals will get caught, and what will be the social cost of imprisoning them (counting the cost to everyone)?