Patents create technological monocultures that collapse cybersecurity

In addition to the historical review done so far, another approach to understanding the relationship among patents, competition, and national security is to consider the role of cybersecurity. There is little doubt that computer system vulnerabilities that enable hacking and spread of computer exploits are a threat to the nation's defenses, so better cybersecurity is a key part of national security strategy. 155

Strong competition can thus complement national security by enhancing domestic cybersecurity, and patent assertion that unduly weakens competition [*395] detracts from cybersecurity. 156 Competition promotes better cybersecurity in at least two ways. First, multiple studies show that competition encourages firms to improve their products on multiple vectors including cybersecurity. Second, competition avoids a situation that security experts call a "monoculture," which increases vulnerability to severe cyberattacks. As former Secretary of Homeland Security Michael Chertoff wrote recently, "We need competition and multiple providers, not a potentially vulnerable technological monoculture," to guarantee national security. 157 Thus, cybersecurity provides a useful lens for understanding how unfettered patent assertion and licensing can detract from national security.

A. Cybersecurity as Competitive Value-Add

Competition enhances national security by reducing the incidence of technical vulnerabilities. That effect is especially important for security-sensitive systems such as mobile telecommunications.

Intuitively, a causal chain from competition to cybersecurity makes logical sense. Computer security is a value-added benefit to consumers, so firms in competitive markets are likely to use security to gain an edge over their competitors. 158In monopolized markets, though, there may be less external impetus to test products for flaws, and the monopolist may choose to focus less on security and more on new product features or increased product quality.

Economic research confirms these hypotheses about competition leading to better cybersecurity. A 2009 empirical study of web browsers considered the impact of market concentration on the amount of time that vendors took to fix security vulnerabilities as they were discovered. 159The study found that the presence of more competitors correlated with faster cybersecurity response--a reduction of 8-10 days in response time per additional market rival. 160 Similarly, business researchers in 2005 modeled incentives for firms to engage in sharing of cybersecurity information, and concluded that the "inclination to share information and invest in security technologies increases [*396] as the degree of competitiveness in an industry increases." 161 Another study found that, where two software firms are in competition, at least one will be willing to take on some degree of risk and responsibility for cybersecurity, whereas a monopoly software firm will consistently fail to accept such responsibility. 162 To be sure, an unpublished study from 2017 found that some market concentration can make firms more responsive to cybersecurity issues, but only to a point: "being in a dominant position reduces the positive effect of having less competitors on the responsiveness of the vendor," and indeed the "more dominant the firm is, the less rapid it is in releasing security patches." 163 This research confirms that competition is more conducive to cybersecurity.

It is not hard to see how this applies to emerging communication technologies markets. In the absence of competition, the above research suggests that device manufacturers, chip makers, and software developers will lack incentives to respond to vulnerabilities, to share information about cybersecurity practices and issues, and to take responsibility for security matters. Mobile phone chips have had their share of cybersecurity failures already. 164 The best way to flush out ongoing and future cybersecurity issues is to maintain competitive pressure at all levels of the supply chain.

B. Vulnerabilities of "Monocultures"

A second reason why monopoly undermines cybersecurity is that monopoly leads to a "monoculture" of single-vendor products, opening the door to massive systemic failure in the case of a cyberattack. Computer researchers developed the theory of software monocultures in the early 2000s, in response to the regular phenomenon of computer viruses and other attacks spreading rapidly by exploiting flaws in the dominant operating system at the time, Microsoft Windows. 165 Where a computer system such as Windows has a commanding share of users, a virus that exploits a flaw in that system can [*397] quickly spread to infect a whole interconnected ecosystem. An operating system monopoly thus enables fast and easy spread of cyberattacks, and better cybersecurity would be achieved through greater diversity in online systems. 166As one research group posited, "a network architecture that supports a collection of heterogeneous network elements for the same functional capability offers a greater possibility of surviving security attacks as compared to homogeneous networks." 167

There has been considerable study of the theory that computer monocultures are naturally more vulnerable to attacks. 168 In one study, computer science researchers reviewed a catalog of 6,340 software vulnerabilities recorded in 2007, to compare whether comparable software would share the same flaws. 169 Of the 2,627 vulnerabilities applicable to application software (as opposed to operating systems, web scripts, and other software components), only 29 (1.1%) applied to substitute products from different vendors but providing the same functionality. 170By contrast, different versions of a single software product were found to share vulnerabilities 84.7% of the time. 171Thus, software monocultures share exploitable flaws even when there is some variation in versions across the monoculture; by contrast, diversity in software is almost guaranteed to prevent a single flaw from affecting all users.

In the case of 5G and wireless mobile communications, a monoculture is an especially concerning possibility. To the extent that systems such as smart city sensors or communication networks are widely deployed in a monoculture fashion, a widespread attack could have devastating consequences, potentially blacking out a region and affecting essential services such as 911. 172 A monoculture that is vulnerable to so-called "rootkits" or "backdoors"--maliciously installed software that enable bad actors to commandeer systems--could also enable mass surveillance or spying by private hackers or foreign governments. 173The presence of systems from multiple vendors would mitigate these possibilities.

[*398] The monoculture theory is not without critics, but a review of those criticisms shows them to be inapplicable to contemporary communication technologies. Some critics suggest that software diversity imposes unwarranted costs on firms who must forego economies of scale and devise seemingly duplicative yet different setups of computer systems. 174 But those concerns largely focus on the situation where a single firm produces and manages heterogeneous systems, concerns that are avoided where heterogeneity arises naturally through competition between two unrelated firms. Critics also argue that technological measures can create "artificial diversity" through automated randomization of software code, so software engineers can purportedly solve monoculture issues and device users need not worry about the issue. 175But even these critics acknowledge that artificial diversity techniques are often insufficient because they must make assumptions about what aspects of the technology are most vulnerable to attack, and they concede that artificial diversity cannot stop attacks involving operation of legitimate software functions in undesirable ways (sending spam emails or deleting document files, for example). 176

It is widely recognized that a monoculture is unavoidable in at least one respect: Most connected devices will need to conform to technical standards. 1775G, for example, is a technical standard developed by a private industry consortium called 3GPP. 178A flaw in any such standard would render all mobile devices implementing the standard vulnerable to an identical attack. 179 Avoiding these sorts of systemic flaws in standards requires rigorous development, analysis, and testing of the standard in the development process, which in turn requires ensuring that as many firms as possible, especially firms that share basic American values, are involved in the development of those standards. 180 Thus, the necessary standardization of information and communication technologies is perhaps the most important reason why a [*399] competitive communication technology market is essential to cybersecurity and national security.