Deciphering Bug hunters – A Law and Economics Perspective

This paper analyzes the important role played by so-called Bug hunters in promoting cyber security. It is argued that as a result of high pressure on these very dynamic markets vulnerabilities are , unfortunately, unavoidable given the tens of millions of lines that every program code contains. There is therefore a risk that malicious individuals would try to discover the vulnerabilities and seek to gain benefit from them. The paper provides a detailed Economic Analysis of the incentives of the bug hunters as a collective group, assuming that they make a rational choices between the so-called white, gray and black markets. The paper argues that the choice of the bug hunter depends on a variety of elements, such as the legality of the market transaction, the price offered for the vulnerability and the role of intermediaries. The paper more particularly points at the important role of those intermediaries who could have pervert incentives to prefer the black market. The paper therefor argues that regulation is necessary, as well as international cooperation, to remedy those market failures.