  We consider the problem of regulating products with negative externalities to
a third party that is neither the buyer nor the seller, but where both the
buyer and seller can take steps to mitigate the externality. The motivating
example to have in mind is the sale of Internet-of-Things (IoT) devices, many
of which have historically been compromised for DDoS attacks that disrupted
Internet-wide services such as Twitter. Neither the buyer (i.e., consumers) nor
seller (i.e., IoT manufacturers) was known to suffer from the attack, but both
have the power to expend effort to secure their devices. We consider a
regulator who regulates payments (via fines if the device is compromised, or
market prices directly), or the product directly via mandatory security
requirements.
  Both regulations come at a cost---implementing security requirements
increases production costs, and the existence of fines decreases consumers'
values---thereby reducing the seller's profits. The focus of this paper is to
understand the \emph{efficiency} of various regulatory policies. That is,
policy A is more efficient than policy B if A more successfully minimizes
negatives externalities, while both A and B reduce seller's profits equally.
  We develop a simple model to capture the impact of regulatory policies on a
buyer's behavior. {In this model, we show that for \textit{homogeneous}
markets---where the buyer's ability to follow security practices is always high
or always low---the optimal (externality-minimizing for a given profit
constraint) regulatory policy need regulate \emph{only} payments \emph{or}
production.} In arbitrary markets, by contrast, we show that while the optimal
policy may require regulating both aspects, there is always an approximately
optimal policy which regulates just one.
