Editor’s Note: The paper “Measuring the Cost of Cybercrime” by Ross Anderson (Computer Laboratory, University of Cambridge), Chris Barton (UK), Rainer Bohme (University of Munster, Department of Information System), Richard Clayton (Computer Laboratory, University of Cambridge), Michel J.G. van Eeten (Faculty of Technology, Policy and Management, Delft University of Technology), Michael Levi (School of Social Sciences, Cardiff University), Tyler Moore (Department of Computer Science and Engineering, Southern Methodist University), and Stefan Savage (Department of Computer Science and Engineering, University of California, San Diego, CA) is attached here. For the Bloomberg Business Week story about the study, please see FISMA News here.
Below is the paper’s Abstract.
In this paper we present what we believe to be the rst systematic study of the costs of cybercrime. It was prepared in response to a request from the UK Ministry of Defence following scepticism that previous studies had hyped the problem. For each of the main categories of cybercrime we set out what is and is not known of the direct costs, indirect costs and defence costs { both to the UK and to the world as a whole. We distinguish carefully between traditional crimes that are now `cyber’ because they are conducted online (such as tax and welfare fraud); transitional crimes whose modus operandi has changed substantially as a result of the move online (such as credit card fraud); new crimes that owe their existence to the Internet; and what we might call platform crimes such as the provision of botnets which facilitate other crimes rather than being used to extract money from victims directly. As far as direct costs are concerned, we find that traditional offences such as tax and welfare fraud cost the typical citizen in the low hundreds of pounds/Euros/dollars a year; transitional frauds cost a few pounds/Euros/dollars; while the new computer crimes cost in the tens of pence/cents. However, the indirect costs and defence costs are much higher for transitional and new crimes. For the former they may be roughly comparable to what the criminals earn, while for the latter they may be an order of magnitude more. As a striking example, the botnet behind a third of the spam sent in 2010 earned its owners around US$2.7m, while worldwide expenditures on spam prevention probably exceeded a billion dollars. We are extremely ineffcient at fighting cybercrime; or to put it another way, cybercrooks are like terrorists or metal thieves in that their activities impose disproportionate costs on society. Some of the reasons for this are well-known: cybercrimes are global and have strong externalities, while traditional crimes such as burglary and car theft are local, and the associated equilibria have emerged after many years of optimisation. As for the more direct question of what should be done, our figures suggest that we should spend less in anticipation of cybercrime (on antivirus, rewalls, etc.) and more in response — that is, on the prosaic business of hunting down cyber-criminals and throwing them in jail.
Leave a Reply