A new study, by the Center for Strategic and International Studies (CSIS), states that US cybercrime costs between $20 billion and $140 billion each year. It was estimated to be as much as $1 trillion a year, in 2009. Since then, the $1 trillion annual figure has been used by various politicians as a reason to improve the nation’s online defenses.
The report said, “Given the data collection problems, loss estimates are based on assumptions about scale and effect — change the assumption and you get very different results. Essentially, putting on financial figure on the cost of cybercrime isn’t close to an exact science. Additionally, some companies are likely to conceal their losses and some are not aware of what has been taken, further complicating the attempts to come to a solid estimate. The company cannot accurately assess the dollar value of the loss in military technology, again because not enough data is available.”
Much of the 17-page report written by CSIS, gives an explanation as to why estimating the true cost of cybercrime is so difficult. However, the report is still an improvement over that of the one in 2009. In regard to this, Tom Gann, McAfee’s vice president of government relations told the media, “The study here is newer, it’s based on extra rigorous work. This is clearly the one we’re going to focus on.”
The CSIS report also said, “We have revised McAfee’s methods for calculating the impact of cybercrime, but its numbers are still not definitive, which is why the range between $20 billion and $140 billion is so broad.”
One of the factors that accounted for McAfee’s 2009 report being flawed was a wrong approach in calculating the expense, a company incurs, when information is stolen. “In 2009, McAfee calculated the loss of data as equal to what it cost to acquire what was stolen. The new study instead calculates not as what it took to acquire what was stolen, but rather, what it may cost a company now that someone else has the stolen information.” the report further explained.