You Can Only Die Once Interdependent Security in an Uncertain World

1. You Can Only Die OnceInterdependent Security in an Uncertain World Geoffrey Heal Graduate School of Business Columbia University gmh1@columbia.edu Howard Kunreuther (kunreuther@wharton.upenn.edu) Center for Risk Management and Decision Processes The Wharton School University of Pennsylvania and Visiting Senior Research Scientist Columbia University

2. Characteristics of the Problem • Non Additive Damages (You can only die once) • Risk Faced by One Person Depends on Actions Taken by Others (Negative stochastic externalities)

3. Types of Problems Investing in airline security Making computer systems more secure against terrorist attacks. Protecting against chemical & nuclear accidents Making buildings more secure against attacks Investing in sprinklers to reduce the chances of apartment fires Avoiding divisional gambles that could bring entire firm into bankruptcy . • Nick Leeson, Singapore futures market & collapse of Baring’s • Arthur Andersen brought into bankruptcy by Houston branch.

4. Scenario Illustrating Interdependent Security Be Careful (BC) Airlines considers installing baggage checking system for added protection. Needs to balance the cost of this system with reduction in risk of explosion of luggage not only checked in with BC but also from bags of passengers checked in on other airlines & transferred to BC.

5. What is Interdependent Security? An agent can protect itself against a risk by incurring an upfront investment cost BC Airlines can invest in baggage security system to reduce chance of bomb explosions Investment in computer protection against viruses and hackers An agent can be contaminated by others even if it is protected BC Airlines can be contaminated by bags transferred from other airlines that were not inspected Computer can be attacked by viruses from other computers

6. Interdependent Security Model Assumptions and Notation Consider Two Airlines A1 and A2. Y = income of each airline before any expenditure on security  Probability contaminated bag is accepted and explodes in A i : p (p=.1) Probability that contaminated bag gets accepted by A i and is transferred to another airline where it explodes : q (q=.2 ) Probability non-screened airline loads a checked bag with bomb: p + q Loss if a bag explodes : L. (L=1000) Investment Cost of Baggage Security System c (c=95)

7. Interdependent Security Model Expected Costs and Decisions Expected Costs Associated with Investing (S) and Not Investing (N) in Baggage Security System AIRLINE 2 S N SY -95, Y -95 Y-295, Y -100 AIRLINE 1 NY-100, Y -295 Y -280, Y -280 Decisions If A2 has a security system (S) then it is worth A1 investing in one,   Expected losses reduced by pL= - 100 Cost of baggage security system. = 95 If A2 does not invest in security (N) then A1 will not want to invest in one   Expected losses reduced by p (1-q)L - (280-200) = -80 Cost of baggage security system. = 95

8. Impact of Contamination if there are n Agents Define X(n,0) to be the negative externalities to airline i if it invests in security and no other airline does For investment in security to be dominant strategy you need c < p [L- X(n,0)] When is investment in security a dominant strategy with many agents and all the others have not protected themselves? Airlines: c < p [e-q L] for any airline to invest in baggage security Computers: no cost incentive (i.e. c <0 ) for a computer to protect itself against viruses or hackers

9. Tipping Behavior when there is contamination Suppose the n airlines differ in the costs and/or risks they face. Define Ej(n,0) as the negative externalities imposed by airline j on all other airlines when no other airlines invest and airline j changes from investing to not investing in baggage security Two Results • If by switching from N to S a single airline j can cause all others to switch from N to S it will be the one that with highest Ej(n,0). • If by switching from N to S a group of K airlines can cause all others to follow they will be the ones that have the K highest Ej(n,0).

10. Types of Interventions(Internalizing Negative Externalities) Insurance • Not feasible under current system because insurer of agent i does not pay for damage to agent j j i • Monopolistic insurer provides premium reduction to agent i for reduction in contamination to all other agents Liability---This policy tool only works if contaminating agent is held liable for damage to others if it did not invest in protection Regulations Importance of well-enforced codes and standards to ensure that cost-effective security measures are adopted

11. Types of Interventions(Internalizing Externalities) Taxation—Can levy a tax of t dollars on any agent that did not invest in protection to encourage them to adopt security measures\ Coordinating mechanisms • International Air Transport Association (IATA)---require baggage security on all bags to be transferred to other airlines • Coops in NYC—Require that all buyers of apartments invest in sprinkler system as a condition for purchase • Social norms—role of friends and neighbors

12. Future Research Directions • Differential Costs and Risks Nash equilibrium would be mixture of (S,S…N,N) Prescriptive Questions Do you tax some agents more because they have a greater chance of contaminating others? Role of regulations (e.g. building codes, required baggage check-in) • Multi-Period and Dynamic Models Importance of time horizon and discount rate How do you get process of investing in security started? Importance of developing sequential models of choice

13. Future Research Directions (cont.) Behavioral Considerations Misperceptions of risk Myopia (i.e. short time horizons) Importance of affect (e.g. worry, dread, anxiety) Budget Constraints