Each time a malware designer, Pierre, sells a product on a chat server in the underground economy for fraudulent products and services, there is a chance that he will get caught and be fined by law enforcement officials. Suppose the probability that Pierre will get caught because of any one sale of malware is p, and this value is known to both Pierre and the law enforcement officials. What should

be the minimum fine for selling a keystroke logger so that it is not worth the effort for a rational malware designer like Pierre to sell it? What about the minimum fine for selling a botnet?

What will be an ideal response?

The point at which it is not worth the effort for a rational malware designer like
Pierre to sell a certain illegal product is the point at which his expected fine is more than
the selling price of the product. The expected fine for any product is F p, where F is the
fine value and p is the probability of getting caught. Thus, the fine for a keystroke logger
should be at least $23/p and the fine for a botnet should be at least $225/p.