Cybercrime’s $100 Billion Cost

The Center for Strategic and International Study reports in its new research paper, The Economic Impact of Cybercrime and Cyber Espionage:

If we are right in assuming that “tolerated costs”from malicious cyber activity falls into the same range as car crashes, pilferage, and drugs, this is a “ceiling” for an estimate of loss. They suggest that at most, cybercrime, cyber espionage costs less than 1% of GDP. For the US, for example, our best guess is that losses may reach $100 billion annually. To put this in perspective, annual expenditures on research and development in the US are $400 billion a year and $100 million in stolen IP does not translate into $100 million in gain for the acquirer.

It may be a poor idea to compare cybercrime to research and development, which many analysts believe is essential to America’s future. To claim that anything is negative at the level of research investment is to say that it is actually enormously large.

Despite the effort of the Center for Strategic and International Study to claim that cybercrime takes a fairly modest portion of America’s productivity and erodes it away, the analysis actually makes the problem substantial:

The effect of malicious cyber activities on jobs needs further work. The Commerce Department estimated in 2011 that $1 billion in exports equaled 5,080 jobs. This means that the high end estimate of $100 billion in losses from cyber espionage would translate into 508,000 lost jobs. While this translates into a third of a percent decrease in employment, this is not the “net” loss as many workers will find other jobs. The real concern might be if the lost jobs are in manufacturing or other high paying sectors. If workers displaced by cyber espionage do not find jobs that pay as well or better, the victim country would be worse off. The effect of cyber espionage may be to move workers from high paying blue-collar jobs into lower paying work or unemployment.

Whatever mitigating factors the authors may claim, anywhere near 500,000 jobs lost undermines, or would undermine in the future, some massive portion of the health of the economy.

Finally, beyond jobs, the study makes the point the there are factors beyond economic loss that should be taken into account:

We have not included one potential category of loss — the cost of the “pain and suffering” experienced by the victim. These costs are usually assigned by a court and while some are fixed (such as the cost of a human life in a crash) others can vary widely.

And at this point, the analysis takes a turn toward the absurd. A car crash and identity theft cannot be compared so blithely, at least not for the person in the hospital bed or the one who cannot use a credit card.