Cybercrime: It’s Serious, But Exactly How Serious?

Everyone agrees cybercrime affects everyone—governments, corporations, the public—but to what extent? And while vast sums are spent on security to protect against the evildoers, why is it so difficult to determine the amount of the damage they have done?

According to its most recent study, security software manufacturer Symantec Corp. reports cybercrime is costing the world $110 billion every year. But, according to McAfee Inc.—Symantec’s closest competitor—the actual annual cost worldwide is almost 10 times that, approximately $1 trillion.

What’s going on here?

Unfortunately, say security experts, there seem to be at least four hurdles to accurate reporting:

Failure to report. Many organizations that have been cybercrime victims do not want to report the problem because they perceive it as bad for business.
Self-selection bias. Organizations that have not detected losses may be more likely to respond to cybercrime surveys than those that have. Or those that have had very public large losses may be more prone to reply than those with moderate unreported losses.
No standard mechanism for accounting for losses. Sometimes downtime is figured into the mix. Sometimes the cost of buying new equipment or upgrades or security services or outside consultants is included in the total. There is no agreement on what and what not to include.
Undetected losses. Often organizations are not even aware they have had losses or the full magnitude of the crime is not known.

Consider, for example, a company doing advanced research has a break-in and proprietary information is copied out of its computers, says Eugene H. Spafford, a professor of computer science at Purdue University. "If the company discovers the intrusion—and it might not—an audit might determine the loss equals the cost cleanup and perhaps changing to new security software. But what if the company isn’t aware of all that was taken or doesn’t know how to evaluate it? And what if that same proprietary information shows up a year later in a competitor’s product in another country? How then do you evaluate the loss? And what if the product has national defense associated with it? How do you put a value on a significant enough product? Millions of dollars? Billions?"

McAfee attributes a portion of the discrepancy between its reporting and Symantec’s to the fact that its study focuses on the amount of money businesses lose worldwide due to both malicious and accidental data loss.

The company concedes, however, that coming up with an estimate is particularly difficult because there are so many facets that need to be considered.

"You need to add up losses due to corporate espionage, losses that can’t be quantified, losses from damage to a brand’s reputation, and so on," says a McAfee spokesperson. "But the hardest to estimate is the cost to the long-term competitiveness of the U.S. economy. What is the cost to the U.S. down the road when competitors to our best hardware, software, and bio-tech companies emerge in the future and take away market share and American jobs? Those costs—which could be huge—are the ones that are the most difficult to evaluate."

And, for consumers, it is not only about what is lost through fraud with online banking; it is also about their digital assets.

"What’s the worth of that book draft they’ve been working on for a year?" asks the McAfee spokesperson. "And how much are their photographs worth? What about the worth of their online identity? Most victims spend a considerable amount of time trying to recover their identities and recreate information they’ve lost. What is that time worth?"

The true cost of cybercrime, he adds, involves looking at all these questions and adding them up "using a strong, clear, defensible methodology." Many companies and think tanks do not have the time or the money to do that kind of extensive research, he says.

Symantec chose not to comment or participate in this story.

Meanwhile, Cormac Herley, principal researcher at Microsoft Research, says he has "no faith whatsoever that either one of the numbers—Symantec’s or McAfee’s—is anywhere close to the truth. You can call anything an estimate," he says, "but that doesn’t mean it’s a reasonable reflection of the underlying reality."

Herley and his co-researcher, Dinei Florencio, recently wrote a paper, "Sex, Lies and Cybercrime Surveys," after reading cybercrime estimates "that varied by orders of magnitude. I mean, many things have some wiggle room. But if physicists couldn’t agree on the speed of light to within four orders of magnitude, they would just confess they didn’t know."

Herley blames the methodologies in the cybercrime surveys that, he says, almost always exaggerate the numbers on the high side. He believes the actual numbers are far smaller.

The problem, he says, is that cybercrime surveys are not like voting surveys where everyone’s answer counts equally.

"When you ask people what they lost from cybercrime, you have no ability to verify that they understood the question and that they answered truthfully," he explains. "And then, when even a single person gives you a number that is grossly incorrect, they have the ability to destroy the entire survey. It almost always results in a major upward bias in the numbers.

To illustrate how one person can make nonsense out of a survey, Herley suggests a study to determine how many people have pet unicorns. "If you ask 100 people (which substitutes for a population of 100 million people in the country), it means that whatever number you get you need to multiply by one million. Then you conduct the survey and everyone truthfully answers "zero," except for one person who misunderstands the question and says that, yes, they have one unicorn because their daughter has a stuffed one in her bedroom. Your estimate now shows there are one million unicorns in the U.S. It’s completely incorrect and it’s based on that one incorrect answer."

Cynics have charged that cybercrime stats are artificially inflated to scare more people into buying security software.

If that is the case, does it even make sense to try and determine the cost of cybercrime given the likelihood the results will be hugely inflated? Experts say "yes;" that if an organization uses the same consistent method repeatedly, trends emerge and that is valuable for those battling cyber losses.

In addition, from an awareness standpoint, experts say it is important to get the business world, private individuals, and government organizations to understand the magnitude of the problem. Otherwise, the usual attitude is "we’ve never had a problem so it’s likely we won’t have one in the future."

Cynics have charged that cybercrime stats are artificially inflated to scare more people into buying security software. And, they suggest, companies that profit by selling anti-malware software should not be the ones reporting on the size of the malware problem.

On the other hand, say observers, who else is going to conduct analyses of security other than the security companies who know the field, know whom to ask, and generally have respected names so people are likely to respond to them with good information.

"You’re not likely to see a survey in this area conducted by Hostess Snack Foods," said one. "As for the government doing it, many organizations simply don’t want to report to the government that they’ve had losses be cause they don’t trust how that information will be used."

But Microsoft’s Herley says he believes "with very high confidence and without much fear of contradiction the methodologies the companies use produce bogus answers. As far as their motivations go, I just don’t know and I don’t want to speculate. Mistakes happen all the time even when there’s no intent to deceive."

However, Ross Anderson suspects that most cybercrime statistics—"like the ridiculous $1 trillion number which means cybercrime is 2% of the world’s GDP"—have been unreliable "because people compiling them (like policemen or security software vendors) have had some axe to grind." Anderson is professor of security engineering at the University of Cambridge’s Computer Laboratory.

His 2008 study, "Security Economics And The Single Market," reports that has been the case for years. And in his more recent paper, "Measuring The Cost of Cybercrime," he suggests society ought to spend less money on antivirus software and more on policing the Internet.

"Many cybercrimes are committed by a small number of people," he says. "For example, in 2010, a third of all the spam in the world was sent by one botnet. So it would be a lot more efficient to just arrest the bad guys and put them in jail than to expect several hundred million users worldwide to run anti-virus and anti-spam software. Of course the anti-virus and anti-spam companies don’t agree."

A large part of the true cost of cybercrime is the money the world spends on anti-virus software, he maintains, adding "in fact, the anti-virus companies make much more money out of spam than the bad guys do."

"Many organizations simply don’t want to report to the government that they have had losses because they don’t trust how that information will be used."

If, in fact, measuring the true cost of cybercrime is viewed as important, experts have recommendations.

Purdue’s Spafford suggests that a reasonable set of metrics—and a reasonable set of questions to obtain those metrics—needs to be devised by an organization familiar with creating surveys and calculating costs.

He recommends a coalition of software or hardware vendors, perhaps one that already exists, perhaps an organization like the National Institute of Standards and Technology (NIST).

"Whoever it is," he says, "it needs to be someone who has everyone’s trust. And that’s not going to be easy, nor is it going to be cheap."

Cambridge’s Anderson suggests taking a different route: "Stop wasting money on measuring cybercrime and stop wasting money on cyberwar," he says. "Spend it on the police instead."