Wannacry About the Tragedy of the Commons? Game-theory and the Failure of Global Vulnerability Disclosure

Vulnerabilities in Soft- and Hardware have global implications in an interconnected world, since they affect every user who uses an affected system. Since cyberattacks relying on software vulnerabilities produce significant costs for national economies and societies, finding and closing these vulnerabilities is in the rational interest of many countries. Coordinating vulnerability disclosure and timely patching on global scale thus would be a common interest shared by all states. However, states in particular withhold software vulnerabilities for the purpose of foreign espionage, surveillance and law enforcement. Thus, common and particular interests collide, resulting in what game theory calls a tragedy of the commons. Global cyberspace becomes more insecure as more and more states withhold critical software vulnerabilities. In game theoretic terms, rational-actions on a local level produce irrational effects on a global scale, representing a prisoners dilemma. The paper uses game theory to develop a set of international best practices to escape the prisoners dilemma of software vulnerabilities. The questions thus becomes, what the smallest common denominator of such a global vulnerability disclosure regime could be and under what conditions can such an agreement could reached. The case for developing these proposition is the EternalBlue incident of 2017, a software vulnerability that was hold back by an intelligence service and whose unintended disclosure resulted in several destructive malware campaigns with economic damage on a global scale.