Deciphering Bug hunters – A Law and Economics Perspective

This paper analyses the important role played by so-called Bug hunters in promoting cybersecurity. It is argued that, as a result of the intense pressure on these highly dynamic markets, vulnerabilities are, unfortunately, unavoidable, given the tens of millions of lines of code in every program. There is, therefore, a risk that malicious individuals will attempt to discover and exploit vulnerabilities. The paper provides a detailed Economic Analysis of the incentives of bug hunters as a collective group, assuming they make rational choices among the so-called white, grey, and black markets. The paper argues that the choice of the bug hunter depends on a variety of elements, such as the legality of the market transaction, the price offered for the vulnerability and the role of intermediaries. The paper more particularly points to the important role of those intermediaries who could have pervert incentives to prefer the black market. The paper, therefore, argues that regulation and international cooperation are necessary to remedy those market failures.