the cobra effect
expressionops culturegovernance & risk
An incentive that worsens the problem it was meant to solve, named for a colonial bounty on cobras that created cobra farms.
The story runs that British Delhi paid per dead cobra, enterprising residents bred them, and cancelling the bounty released the stock, leaving more cobras than before; the tale's documentation is thin but the mechanism is everywhere. Pay per bug found and bugs get planted; reward closed tickets and tickets get split; bounty vulnerabilities carelessly and you fund a gray market. It is Goodhart's law with fangs: the measure did not just decouple from the goal, it attacked it.
The cobra effect names an incentive that makes the problem worse. The story is that a colonial administration in Delhi offered a bounty for dead cobras, people bred cobras to collect it, and when the scheme was cancelled the now-worthless snakes were released, leaving more cobras than before.
The anecdote's historical basis is thin, and the effect it names is thoroughly documented elsewhere, which is worth saying plainly rather than repeating the story as fact. Bounty schemes that create farming, targets that create gaming and metrics that create the behaviour they measure are all the same shape, and it is closely related to Goodhart's law: this is what happens when the measure becomes a target and someone can manufacture the measure.
In technology the pattern is everywhere. Paying per bug found produces bugs written to be found, rewarding tickets closed produces tickets split in half, and a security programme measured by vulnerabilities remediated will quietly favour trivial findings over hard ones. The defence is to ask, before publishing any incentive, what the cheapest way to satisfy it would be, and then assume somebody will find that way.