A Game Theoretical Analysis of Lemonizing Cybercriminal Black Markets

Abstract

It is known that cybercriminal black markets that trade in illicit digital goods and services belong to markets for lemons due to the information asymmetry of quality of goods and services between sellers and buyers. Based on the seminal work of Akerlof [1], Franklin et al. [3] suggests that “Lemonizing the Market” be an effective way to crack down the well-developed cybercriminal underground market. In our work, we provide a game theoretical framework to analyze whether cybercriminal black markets can be effectivitely lemonized. First, we investigate if signaling quality through an extra provision, such as the offer of trial periods or a money-back guarantee, observed in this marketplace (see the Panda security report [6]) provides cybercriminals selling real illicit data (i.e., the peach group) with a solution to address the lemon market problem. We also study the relation between the market lemonization and the cost constraint on seller’s implementation of signaling of quality. We find that, because of the effectiveness of resolving quality uncertainty through perfect signaling of quality, law enforcement cannot clamp down the operation of this underground economy through “Lemonizing the Market” by joining the group of “pure lemons”, that is, joining the group of sellers with no crime products offered to sell (i.e., ripoff sellers). If no information of quality is disclosed, the market demand shrinks increasingly as lemons in the market increases. However, to secure the market demand, cybercriminals with real illicit data for sale always attempt to implement quality signaling to single out their quality products, accepting a higher amount of cost constraints on applying quality signaling as the portion of lemons in the market escalates.

Recognizing that lemonizing the market through magnifying the group of ripoff sellers could not effectively shut down these underground economic activities, we extend our model to consider that law enforcement: (1) joins the “peach group” to add “noisiness” to quality signals, and (2) takes advantage of transactions with buyers of crime products to locate these cybercriminals for arrest. To make quality signaling noisy, law enforcement produces quality fake data with the same extra provision, such as trial periods, offered by cybercriminals selling real illicit data to lure buyers; however, once the deal proceeds further, buyers get nothing. We call law enforcement playing “fake peaches” in this scenario. We find that the presence of “fake peaches” makes quality signaling imperfect, which in turn disincentivizes sellers’ use of quality signaling to secure demand for staying in business. When incorporating the possibility of arresting buyers of crime products, we find that the market demand decreases as a result of buyers’ fear of getting arrested, leading to declines in sellers’ profits. Therefore, playing “fake peaches” coupled with effectively tracing buyers for arrest is the most efficient way for law enforcement to make the signaling strategy ineffective for sellers of crime products, leading the market to resort to markets for lemons.