No abstract

R ecent technological and market forces have profoundly impacted the music industry. Emphasizing threats from peer-to-peer (P2P) technologies, the industry continues to seek sanctions against individuals who offer a significant number of songs for others to copy. Combining data on the performance of music albums on the Billboard charts with file sharing data from a popular network, we assess the impact of recent developments related to the music industry on survival of music albums on the charts and evaluate the specific impact of P2P sharing on an album's survival on the charts. In the post-P2P era, we find significantly reduced chart survival except for those albums that debut high on the charts. In addition, superstars and female artists continue to exhibit enhanced survival. Finally, we observe a narrowing of the advantage held by major labels. The second phase of our study isolates the impact of file sharing on album survival. We find that, although sharing does not hurt the survival of top-ranked albums, it does have a negative impact on low-ranked albums. These results point to increased risk from rapid information sharing for all but the "cream of the crop."

I nformation systems and the Internet have facilitated the creation of used-product markets that feature a dramatically wider selection, lower search costs, and lower prices than their brick-and-mortar counterparts do. The increased viability of these used-product markets has caused concern among content creators and distributors, notably the Association of American Publishers and Author's Guild, who believe that used-product markets will significantly cannibalize new product sales. This proposition, while theoretically possible, is based on speculation as opposed to empirical evidence. In this paper, we empirically analyze the degree to which used products cannibalize new-product sales for books-one of the most prominent used-product categories sold online. To do this, we use a unique data set collected from Amazon.com's new and used book marketplaces to measure the degree to which used products cannibalize new-product sales. We then use these estimates to measure the resulting first-order changes in publisher welfare and consumer surplus.Our analysis suggests that used books are poor substitutes for new books for most of Amazon's customers. The cross-price elasticity of new-book demand with respect to used-book prices is only 0.088. As a result, only 16% of used-book sales at Amazon cannibalize new-book purchases. The remaining 84% of used-book sales apparently would not have occurred at Amazon's new-book prices. Further, our estimates suggest that this increase in book readership from Amazon's used-book marketplace increases consumer surplus by approximately $67.21 million annually. This increase in consumer surplus, together with an estimated $45.05 million loss in publisher welfare and a $65.76 million increase in Amazon's profits, leads to an increase in total welfare to society of approximately $87.92 million annually from the introduction of used-book markets at Amazon.com.

Identity theft resulted in corporate and consumer losses of $56 billion dollars in 2005, with about 30% of known identity thefts caused by corporate data breaches. Many US states have responded by adopting data breach disclosure laws that require firms to notify consumers if their personal information has been lost or stolen. While the laws are expected to reduce identity theft, their full effects have yet to be empirically measured. We use panel from the US Federal Trade Commission with state and time fixed-effects regression to estimate the impact of data breach disclosure laws on identity theft over the years 2002 to 2007. We find that adoption of data breach disclosure laws have marginal effect on the incidences of identity thefts and reduce the rate by just under 2%, on average. While this effect is marginal, reducing identity theft is only one means by which these laws can be evaluated: we appreciate that they may have other benefits such as reducing the average victim's losses or improving a firm's security and operational practices.

One key aspect of better and more secure software is timely and reliable patching of vulnerabilities by software vendors. Recently, software vulnerability disclosure, which refers to the publication of vulnerability information before a patch to fix the vulnerability has been issued by the software vendor, has generated intense interest and debate. In particular, there have been arguments made both in opposition to and in favor of alternatives such as full and instant disclosure and limited or no disclosure. An important consideration in this debate is the behavior of the software vendor. How quickly do vendors patch the vulnerabilities in general and after disclosure in particular? This paper compiles a unique data set from CERT/CC and SecurityFocus to answer this question. Our results suggest that disclosure policy has a significant positive impact on the vendor patching speed. Vendors are 137% more likely to patch due to disclosure. In particular, instant disclosure hastens the patch delivery by almost 29 days. Open source vendors patch more quickly than closed source vendors and severe vulnerabilities are patched faster. We also find that vendors respond more slowly to vulnerabilities not handled by CERT/CC. This might reflect unmeasured differences in the severity and importance of vulnerabilities. It might also reflect the stronger lines of communication between CERT/CC and vendors, and the value of the vulnerability analysis by CERT/CC.

The Interrelationships between Brand and Channel ChoiceWe propose a framework for the joint study of the consumer's decision of where to buy and what to buy. The framework is rooted in utility theory where the utility is for a particular channel/brand combination. The framework contains firm actions, the consumer search process, the choice process, and consumer learning. We develop research questions within each of these areas. We then discuss methodological issues pertaining to the use of experimentation and econometrics. Our framework suggests that brand and channel choices are closely intertwined, and therefore studying them jointly will reveal a deeper understanding of consumer decisionmaking in the modern marketing environment.Keywords: brand choice, channel choice, learning, utility theory 3 The Interrelationships between Brand and Channel ChoiceThroughout the post-industrial era, consumers have been faced with the decision of choosing brands. Levi's or Wrangler? Apple or Samsung? The last decade has seen a proliferation of channels through which firms interact with customers. Levi's, Wrangler, as well as Apple and Samsung can be purchased online, in bricks-and-mortar stores, or through catalogs. Platform retailing arrangements that give brands direct access to consumers are also becoming increasingly popular, both offline, such as "stores within a store" (Jerath and Zhang 2010), and online, such as Amazon Marketplace. Thus, today's consumer must choose both a brand and a channel. The question is how brand and channel choices are interrelated. We advocate that this question presents an opportunity to learn in more depth how consumers make decisions in the modern marketing environment.There has been much research on brand choice, dating at least to Kuehn and Rohloff (1967), continuing through Guadagni and Little (1983). See Russell (2014) for a history of the development of this field. Recently there has been a growing literature on channel choice (Thomas and Sullivan 2005;Valentini et al. 2011). However, to our knowledge there is little research that integrates brand and channel choice.One might argue that channel and brand choice could just be studied separately. Yet, researchers have found that consumers make different choices depending on which channel they use (Danaher et al. 2003), that marketing induces consumers to switch channels (Ansari et al. 2008) and that brand and channel perceptions together determine purchase intentions (Dodds et al. 1991). This suggests that the two processes are intertwined. Certainly managers are concerned with how to manage their brands across channels. Therefore, while the field is not well-4 developed, we believe there is significant academic and managerial motivation for studying the interrelationships between brand and channel choice. In particular, our objectives are to: § develop a framework for studying the interrelationships between channel and brand choice, § utilize the framework to generate research topics, and § discuss methodological challenges i...

Abstract-Security defects in software cost millions of dollars to firms in terms of downtime, disruptions, and confidentiality breaches. However, the economic implications of these defects for software vendors are not well understood. Lack of legal liability and the presence of switching costs and network externalities may protect software vendors from incurring significant costs in the event of a vulnerability announcement, unlike such industries as auto and pharmaceuticals, which have been known to suffer significant loss in market value in the event of a defect announcement. Although research in software economics has studied firms' incentives to improve overall quality, there have not been any studies which show that software vendors have an incentive to invest in building more secure software. The objectives of this paper are twofold. 1) We examine how a software vendor's market value changes when a vulnerability is announced. 2) We examine how firm and vulnerability characteristics mediate the change in the market value of a vendor. We collect data from leading national newspapers and industry sources, such as the Computer Emergency Response Team (CERT), by searching for reports on published software vulnerabilities. We show that vulnerability announcements lead to a negative and significant change in a software vendor's market value. In our sample, on average, a vendor loses around 0.6 percent value in stock price when a vulnerability is reported. We find that a software vendor loses more market share if the market is competitive or if the vendor is small. To provide further insight, we use the information content of the disclosure announcement to classify vulnerabilities into various types. We find that the change in stock price is more negative if the vendor fails to provide a patch at the time of disclosure. Also, more severe flaws have a significantly greater impact. Our analysis provides many interesting implications for software vendors as well as policy makers. In particular, our study provides some evidence of the value of secure software.

Software vulnerabilities represent a serious threat to cyber security, most cyber-attacks exploit known vulnerabilities. Unfortunately, there is no agreed-upon policy for their disclosure. Disclosure policy (which sets a protected period given to a vendor to release the patch for the vulnerability) indirectly affects the speed and quality of the patch that a vendor develops. Thus CERT/CC and similar bodies acting in the public interest can use disclosure to influence the behavior of vendors and reduce social cost. This paper develops a framework to analyze the optimal timing of disclosure. We formulate a model involving a social planner who sets the disclosure policy and a vendor who decides on the patch release. We show that the vendor typically release the patch less expeditiously than is socially optimal. The social planner optimally shrinks the protected period to push the vendor to deliver the patch more quickly and sometimes the patch release time coincides with disclosure. We extend the model to allow the proportion of users implementing patches to depend upon the quality (chosen by the vendor) of the patch. We show that a longer protected period does not always results in a better patch quality. Another extension allows for some fraction of users to use "work-arounds". We show that the possibility of work-arounds can provide the social planner more leverage and hence the social planner shrinks the protected period. Interestingly, possibility of work-arounds can sometimes increase the social cost due to the negative externalities imposed by the users who can use the work-arounds on the users who can not. (2005) and seminar participants at Stanford University, for their valuable feedback. We also thank the DE, the AE, and two anonymous reviewers for many valuable suggestions, and Ed Barr for suggesting many improvements in the writing. This research was partially supported through a grant from Cylab, Carnegie Mellon University. Rahul Telang acknowledges the generous support of National Science Foundation through the CAREER award CNS -0546009."First, the Nation needs a better-defined approach to the disclosure of vulnerabilities. The issue is complex because exposing vulnerabilities both helps speed the development of solutions and also creates opportunities for would be attackers."