Audit Games

Jeremiah Blocki, Nicolas Christin, Anupam Datta, Ariel D. Procaccia, Arunesh Sinha

Abstract: Effective enforcement of laws and policies requires expending resources toprevent and detect offenders, as well as appropriate punishment schemes todeter violators. In particular, enforcement of privacy laws and policies inmodern organizations that hold large volumes of personal information (e.g.,hospitals, banks) reliesheavily on internal audit mechanisms. We study economic considerations in thedesign of these mechanisms, focusing in particular on effective resourceallocation and appropriate punishment schemes. We present an audit game modelthat is a natural generalization of a standard security game model for resourceallocation with an additional punishment parameter. Computing the Stackelbergequilibrium for this game is challenging because it involves solving anoptimization problem with non-convex quadratic constraints. We present anadditive FPTAS that efficiently computes the solution.