Search

We study the efficiency of bilateral liability-based contracts in managed security services (MSSs). We model MSS as a collaborative service with the protection quality shaped by the contribution of both the service provider and the client. We adopt the negligence concept from the legal profession to design two novel contracts: threshold-based liability contract and variable liability contract. We find that they can achieve the first best outcome when postbreach effort verification is feasible. More importantly, they are more efficient than a multilateral contract when the MSS provider assumes limited liability. Our results show that bilateral liability-based contracts can work in the real world. Hence, more research is needed to explore their properties. We discuss the related implications. The online appendix is available at https://doi.org/10.1287/isre.2018.0806 .

Online hacker forums offer a prominent avenue for sharing hacking knowledge. Using a field dataset culled from multiple sources, we find that online discussion of distributed denial of service (DDOS) attacks in hackforums.net decreases the number of DDOS-attack victims. A 1% increase in discussion decreases DDOS attacks by 0.032% to 0.122%. This means that two DDOS-attack posts per day could reduce the number of victims by 700 to 2,600 per day. We find that discussion topics with similar keywords can variously increase or decrease DDOS attacks, meaning we cannot ascertain the impact of the discussion just by the post nature. Mentioning botnets, especially new botnets, increases the attacks, but the follow-up discussion decreases the attacks. Our results suggest that online-hacker-forum discussion may exhibit the dual-use characteristic. That is, it can be used for both good and bad purposes. We draw related managerial implications.

We study a novel privacy concern, i.e., peer disclosure of sensitive personal information in online social communities. We model peer disclosure as the imposition of a negative externality on other people. Our model encompasses the benefits of posting information, positive externalities in the form of recognition and entertainment benefits due to others’ sharing of information, and heterogeneous privacy preferences. We find that regulation of peer disclosure is necessary. We consider two candidate regulations, i.e., nudging and quotas. Nudging reduces user participation and privacy harm and sometimes improves social welfare. By contrast, imposing a quota often improves user participation, privacy protection, and social welfare. Adding a nudge on top of a quota does not bring additional benefits. We show that any regulation that uniformly controls the disclosure of sensitive and nonsensitive information will not serve the triple objectives of reducing privacy harm, increasing social welfare, and increasing information contribution. We derive a necessary condition for solutions that can fulfill these three objectives. We also compare the incentives of the platform owner and social planner and draw related managerial and policy implications. The online appendix is available at https://doi.org/10.1287/isre.2017.0744 .

We investigate whether the discounts offered by online daily deals help attract consumer purchases. By tracking the sales of 19,978 deals on Groupon.com and conducting a battery of identification and falsification tests, we find that deep discounts reduce sales. A 1% increase in a deal’s discount decreases sales by 0.035%–0.256%. If a merchant offers an additional 10% discount from the sample mean of 55.6%, sales could decrease by 0.63%–4.60%, or 0.80–5.24 units and $42–$275 in revenue. This negative effect of discount is more prominent among credence goods and deals with low sales, and when the deals are offered in cities with higher income and better education. Our findings suggest that consumers are concerned about product quality, and excessive discounts may reduce sales immediately. A follow-up lab experiment provides further support to this quality-concern explanation. Furthermore, it suggests the existence of a “threshold” effect: the negative effect on sales is present only when the discount is sufficiently high. Additional empirical analysis shows that deals displaying favorable third-party support, such as Facebook fans and online reviews, are more susceptible to this adverse discount effect. We draw related managerial implications. The online appendix is available at https://doi.org/10.1287/isre.2017.0772 .

We study the strategic benefits of mergers and acquisitions (M&As) when competing information technology vendors sell different generations of the same product with different quality. We assume the new product arrives unexpectedly when an installed base of the old product exists. We show that the combination of consumers’ purchase history and heterogeneity leads to new demand complexity that gives rise to innovative product strategies. We find that shelving the old product is an important motivation for M&A. The acquirer may exercise static or intertemporal price discrimination depending on whether it can exercise upgrade pricing. M&A may speed up or slow down new product consumption, and it can lead to delayed new product introduction in some markets. However, it always increases the acquirer’s profit and can sometimes help maximize social welfare. We discuss relevant managerial and policy implications. The online appendix is available at https://doi.org/10.1287/isre.2016.0659 .

In this paper, we estimate the impact of enforcing the Convention on Cybercrime (COC) on deterring distributed denial of service (DDOS) attacks. Our data set comprises a sample of real, random spoo...

Previous research into consumer choice of service channels studied the impact of online access as an addition to conventional service. Here, we study the impact of a compulsory migration to an online channel. We exploit a natural experiment in the implementation of a new federal government service to identify the causal effect of access channel on consumer choice. The government served western states through the Internet and telephone at all times. However, for the first 10 days, the government served the East through the Internet only. Comparing consumer responses in the East (only Internet service available) and West (both Internet and telephone service available), we find robust evidence that some consumers preferred telephone access. The unavailability of telephone service in the first 10 days resulted in a 4.3% loss of consumers who were otherwise interested in the service.

The rapid growth of computer networks has led to a proliferation of information security standards. To meet these security standards, some organizations outsource security protection to a managed security service provider (MSSP). However, this may give rise to system interdependency risks. This paper analyzes how such system interdependency risks interact with a mandatory security requirement to affect the equilibrium behaviors of an MSSP and its clients. We show that a mandatory security requirement will increase the MSSP's effort and motivate it to serve more clients. Although more clients can benefit from the MSSP's protection, they are also subjected to greater system interdependency risks. Social welfare will decrease if the mandatory security requirement is high, and imposing verifiability may exacerbate social welfare losses. Our results imply that recent initiatives such as issuing certification to enforce computer security protection, or encouraging auditing of managed security services, may not ...

The advent of the Internet has made the transmission of personally identifiable information common and often inadvertent to the user. As a consequence, individuals worry that companies misuse their information. Firms have tried to mitigate this concern in two ways: (1) offering privacy policies regarding the handling and use of personal information, (2) offering benefits such as financial gains or convenience. In this paper, we interpret these actions in the context of the information processing theory of motivation. Information processing theories, in the context of motivated behavior also known as expectancy theories, are built on the premise that people process information about behavior-outcome relationships. We empirically validate predictions that the means to mitigate privacy concerns are associated with positive valences resulting in an increase in motivational score. Further, we investigate these means in trade-off situation, where a firm may only offer partially complete privacy protection and/or some benefits

Digital products are now widely traded over the Internet. Many researchers have started to investigate the optimal competitive strategies and market environments for such products. This paper studies the competitive decisions made about software, a major class of digital products that can be easily sold through computer networks. Instead of focusing on traditional competitive dimensions, such as price or quantity, we study the number of functions that should be incorporated into the software. Using game theoretic analysis, we show that there is no fixed strategy that is optimal for software developers in a duopoly market with one-stage simultaneous moves. This happens because, given one developer's decision, there is always an incentive for the other developer to deviate and achieve higher payoffs. Nevertheless, a unique reactive equilibrium does emerge if we consider the two-stage variation of the model, where the two developers both enjoy substantial profits by serving different segments of the market. Essentially, the first mover commits himself to a certain functionality level that induces a rational follower to target his software to the (previously) unattended segment. We discuss our results in light of scale economies in the software development process and market segmentation.

Despite the important role of vendors in the IT procurement process, very few studies have considered vendor characteristics and their effects on the decision outcome of IT managers. In this paper,we present a discrete choice model to examine the effects of vendor characteristics on the purchase decisions of IT managers. Our intent is to empirically assess the effects of product variety, brand name, average price, and network externalities in the selection of computer vendors. To ensure that the effects are not technology-dependent, we deliberately use long time series data to calibrate the model.Annual data at the vendor level from 1965 to 1993 is used to infer the choice criteria of IT managers in three computer categories: mainframe, minis, and small systems. Our empirical findings indicate that a broader product line and a strong brand can effectively enhance the choice probability of a vendor. Implications of these findings and possible extensions are also discussed.

This paper presents the findings of an empirical study into factors identifying early adopters of new IT products. Drawing two well-researched concepts (opinion leadership and consumer innovativeness) developed in the marketing field, several hypotheses were formulated to test against data collected from 145 microcomputer users who had or had not adopted Windows 95. The findings indicate that early adopters tend to be younger males who are of opinion leadership type, like to seek novel information, and have a lot of computer experience. Implications of the findings, from both a research and a managerial perspective are discussed.

This paper reports the results of an exploratory field experiment in Singapore that assessed the values of two types of privacy assurance: privacy statements and privacy seals. We collaborated with a local firm to host the experiment on its website with its real domain name, and the subjects were not informed of the experiment. Hence, the study provided a field observation of the subjects' behavioral responses toward privacy assurances. We found that (1) the existence of a privacy statement induced more subjects to disclose their personal information but that of a privacy seal did not; (2) monetary incentive had a positive influence on disclosure; and (3) information request had a negative influence on disclosure. These results were robust in other specifications that used alternative measures for some of our model variables. We discuss this study in relation to the extant privacy literature, most of which employs surveys and laboratory experiments for data collection, and draw related managerial implications.

We investigate the incentives of a monopolistic seller to delay the introduction of a new and improved version of his product. By analyzing a three-period model, we show that the seller may prefer to delay introducing a new product, even though the enabling technologies for the product are already available. The underlying motivation is analogous to that found in the durable goods monopolist literature – the seller suffers from a time inconsistency problem that causes his old and new products to cannibalize each other. Without the ability to remove existing stock of the old product from the market, shorten product durability, or pace research and development (R&D), he may respond by selling the new product later. We characterize the equilibria with delayed introduction, and study their changes with respect to market and product parameters. In particular, we show that delayed introduction could occur regardless of whether the seller can offer upgrade discounts to consumers, that instead, it is related to quality improvement brought about by the new product, durabilities, and discount factors. Further, we show that contrary to previous studies, delayed introduction could bring socially efficient outcomes as well. Based on the insights of the model, we provide practical suggestions on pricing and policies.