Measuring the Cost of Cybercrime

Abstract

In this paper we present what we believe to be the first systematic study of the costs of cybercrime. It was prepared in response to a request from the UK Ministry of Defence following scepticism that previous studies had hyped the problem. For each of the main categories of cybercrime we set out what is and is not known of the direct costs, indirect costs and defence costs -both to the UK and to the world as a whole. We distinguish carefully between traditional crimes that are now 'cyber' because they are conducted online (such as tax and welfare fraud); transitional crimes whose modus operandi has changed substantially as a result of the move online (such as credit card fraud); new crimes that owe their existence to the Internet; and what we might call platform crimes such as the provision of botnets which facilitate other crimes rather than being used to extract money from victims directly. As far as direct costs are concerned, we find that traditional offences such as tax and welfare fraud cost the typical citizen in the low hundreds of pounds/Euros/dollars a year; transitional frauds cost a few pounds/Euros/dollars; while the new computer crimes cost in the tens of pence/cents. However, the indirect costs and defence costs are much higher for transitional and new crimes. For the former they may be roughly comparable to what the criminals earn, while for the latter they may be an order of magnitude more. As a striking example, the botnet behind a third of the spam sent in 2010 earned its owners around US$2.7m, while worldwide expenditures on spam prevention probably exceeded a billion dollars. We are extremely inefficient at fighting cybercrime; or to put it another way, cybercrooks are like terrorists or metal thieves in that their activities impose disproportionate costs on society. Some of the reasons for this are well-known: cybercrimes are global and have strong externalities, while traditional crimes such as burglary and car theft are local, and the associated equilibria have emerged after many years of optimisation. As for the more direct question of what should be done, our figures suggest that we should spend less in anticipation of cybercrime (on antivirus, firewalls, etc.) and more in response -that is, on the prosaic business of hunting down cyber-criminals and throwing them in jail.

Modeling malicious domain name take-down dynamics: Why eCrime pays

“…Significant efforts have also been made in measuring the economic cost of cybercrime [18]. This is a difficult multi-disciplinary task, and there is still more work to be done.…”

“…This is a difficult multi-disciplinary task, and there is still more work to be done. [18] also importantly differentiates between direct and indirect losses to the defenders. The attackers can only monetize a percentage of the direct losses, even though indirect losses are often much larger.…”

How do consumers react to cybercrime?

“…It has been recognized that the indirect costs of cybercrime, including a reduction in online participation, can be very high [8]. But what exactly leads people to limit their activities in favor of improved security?…”

“…Therefore, it does not seem to be a winning strategy for banks to hush up cybercrime in order to move more retail business online. Nevertheless, it is interesting to note that banks' interest on the prominence of cybercrime in the media is exactly opposite to that of the security industry, who tries to play up the significance of the problem [8].…”

Discerning Novel Value Chains in Financial Malware

“…Next to phishing, malicious software, i.e. malware targeting financial service providers worldwide, is an ongoing and continuous threat to these financial service providers, causing millions in damages in both industrialised and non-industrialised countries (Anderson et al 2012).…”