When tech markets fail, lemons prevail

It took government intervention for Microsoft to act. Only after the US government issued a report in March criticising Microsoft’s insufficient security culture did the Seattle-based company promise to make security its number one priority. The case illustrates that even big players are not immune to government intervention. It also reignites questions about whether the security market is failing, as it leaves government institutions and companies at the mercy of a few big service providers for a crucial part of their infrastructure.

Although the US authorities have managed to wring at least lip service from Microsoft, there are doubts that the EU can achieve the same. Can Brussels pull similar strings to promote the security of IT services and products vis-à-vis the major US  oligopolies? Or is the EU dependent on the US authorities to act? There is no shortage of EU legislative projects that aim to improve IT security. Yet all these efforts will be futile if the root cause of the problem is ignored: the ability of powerful market players to dictate security prioritisation.

IT security: a market for lemons

IT product security has never been a major market priority. First, security is not ‘fun’: it must be good enough to be ignored, while consumers can enjoy the actual quirks and features that spark joy or add to the product’s value. 

Second, consumers often have difficulty assessing the security of the products or services they purchase. IT security has, therefore, always been a ‘market for lemons’: the customers cannot assess the actual security, so they are not willing to pay a markup for more secure products. They do not know whether they are getting a ‘lemon’ or a ‘peach’. If no one is willing to pay for safe products, then no one is willing to produce them.

The limited profits have incentivised few companies to invest in developing sustainable and secure products or services. For example, Microsoft has demonstrated, at best, a lack of motivation to make meaningful improvements to its Active Directory service, a technical service to manage users, clients, and servers. Even when the company fixes old vulnerabilities, it is a mere patch rather than a structural overhaul, and it often leads to new problems.

Most successful ransomware attacks exploit basic security vulnerabilities. Worse, cyber risks are generally abstract, and the value of secure systems is often only appreciated once the ‘milk is already spilt’ after a successful ransomware attack, for instance. 

Several European regulations address this issue. Minimum security standards for products, such as those mandated by the Cyber Resilience Act or certification under the Cybersecurity Act, improve the transparency of product security. The EU-wide legislation on cybersecurity, the NIS-2 directive, also makes headway in this area by designating certain aspects of large IT service providers, such as cloud or data centre providers, as critical infrastructure. This means that these providers must implement ‘minimum standards’ for security in providing their services. 

NIS-2 also attempts to address the demand side. By obliging critical infrastructure operators to secure their information technology, the directive makes it necessary for these operators to purchase secure products and employ secure service providers. Thus, NIS-2 helps create demand for verifiably secure service providers and products, which, in theory, should also trigger supply.

EU regulation ignores market power

In principle, stimulating demand is not a bad idea. However, it will fizzle out relatively ineffectively if supply-side market power is ignored.

The market for most IT services is dominated by a few tech giants – an oligopoly. It is frequently impossible to choose another provider if you disagree with a major supplier’s security practices. For example, although operators of critical infrastructure must maintain certain security levels across all their service providers, they may not be able to enforce such requirements when up against large, near-monopoly suppliers like Microsoft and its Office-IT services.

Even for chief technology officers of medium-sized companies, negotiating contract terms with a large provider can be a humbling experience. An annual license volume in the mid-single-digit million-dollar range does not entitle you to privileged insights into actual security practices. Take it or leave it: Big Tech knows you have no alternative.

Admittedly, the tech giant also has a certain self-interest in implementing at least minimum security regulations. However, since large companies do not face significant market competitive pressure, it is ultimately up to them to decide whether or not to prioritise security. 

Getting Big Tech to play along

The issue, therefore, is how to get large manufacturers and service providers to play along.

‘Minimum standards’ such as those made mandatory by the Cyber Resilience Act or NIS-2 are a step in the right direction. Individual regulatory measures may help to foster some level of IT security. However, in a monopoly or oligopoly, this does not lead to quality competition but only to the provision of the necessary minimum. In the end, minimum standards are just that: minimum standards.

Washington and Brussels plan to extend the warranty and liability for manufacturers to increase incentives and pressure on them. The United States explicitly mentions manufacturer liability as a means of driving higher security standards in its cyber strategy. The EU also intends to expand warranty and liability rights in case of data loss, but only in business-to-consumer interactions. In the business-to-business market, it is generally possible to negotiate individual agreements. Yet once again, the more powerful market player dictates the terms (a current example would be the far-reaching exclusion of liability in the contracts of Crowdstrike).

Tech giants are here to stay

The EU is beginning to address the problem of market failure in ensuring IT security, but most initiatives only treat the symptoms. US tech giants have major footholds on the continent, and the EU has not been able to establish regional competitors. 

Even if there was a desire to revitalise traditional antitrust measures, their impact on multinational corporations would be limited because enforcement is restricted to the European domestic market. While tools such as vertical disintegration (the separation of two value-added services into independent legal entities) and fusion control (preventing the takeover of a competitor) could be helpful, international players have already established their market dominance abroad. 

The EU is content with applying the more benign part of the competition law toolbox, such as breaking up abusive tying practices. One example of this was forcing Microsoft to offer a 365 Office package without a Teams License. However, considering Microsoft’s overall market power, this step resembles a toddler trying to empty the ocean using a bucket.

Therefore, reliance on a few dominant market actors takes a lasting toll on national IT security. EU legislation already allows issuing official warnings for specific products, similar to how it is done in the United States. These warnings specifically target unsecure products used in sectors like critical infrastructure.  

The EU can certainly develop a more cumulative negotiating power as it did with comparable developments in the aftermath of the GDPR. However, the Commission and national authorities have found it difficult to act, partly to avoid distortions of competition. Of course, where there is no competition, there can be no distortion. While the Digital Market Act and similar regulation initiatives attempt to curb the misuse of market power by ‘gatekeepers’, they do not adequately tackle the underlying issue of the gatekeepers’ presence in the first place.

In situations where alternative options are scarce, an official warning would serve more as a polite request to the manufacturer. However, in the absence of functioning market mechanisms, there is no other option. Yet even with limited regulatory resources, the EU should not hesitate to act against tech monopolies. At least not until the fundamental problem of dependence on monopolists is addressed.