The cyber world is relatively new, and unlike other types of assets, cyber assets are potentially accessible to criminals in far-off locations. This distance provides the criminal with significant protections from getting caught; thus, the risks are low, and with cyber assets and activities being in the trillions of dollars, the payoff is high.
When we talk about cybercrime, we often focus on the loss of privacy and security. But cybercrime also results in significant economic losses. Yet the data and research on this aspect of cybercrime are unfortunately limited. Data collection often relies on small sample sizes or has other challenges that bring accuracy into question.
In a recent NIST report, I looked at losses in the U.S. manufacturing industry due to cybercrime by examining an underutilized dataset from the Bureau of Justice Statistics, which is the most statistically reliable data that I can find. I also extended this work to look at the losses in all U.S. industries. The data is from a 2005 survey of 36,000 businesses with 8,079 responses, which is also by far the largest sample that I could identify for examining aggregated U.S. cybercrime losses. Using this data, combined with methods for examining uncertainty in data, I extrapolated upper and lower bounds, putting 2016 U.S. manufacturing losses to be between 0.4% and 1.7% of manufacturing value-added or between $8.3 billion and $36.3 billion. The losses for all industries are between 0.9% and 4.1% of total U.S. gross domestic product (GDP), or between $167.9 billion and $770.0 billion. The lower bound is 40% higher than the widely cited, but largely unconfirmed, estimates from McAfee.
What makes the estimates startling is that, despite being higher than commonly cited values, the assumptions I used to calculate losses pushed the lower bound estimate down significantly, meaning the true loss may be much higher. I calculated the low value assuming that those who did not respond to the Bureau of Justice Statistics survey did not experience any losses. This amounted to 77% of the 36,000 businesses surveyed being presumed as having no loss; thus, the true loss is most likely higher than the low estimate.
Additionally, the 2005 data from the Bureau of Justice Statistics comes from a time when cybercrime was considered to be less of a problem and the digital economy was smaller. If the Bureau of Justice Statistics data is representative, that is, if the average losses of the respondents’ companies equals the actual average U.S. losses per company, then the losses approach the high estimate of $36.3 billion for manufacturing and $770 billion for all industries. This would make total cybercrime losses greater than the GDP of many U.S. industries, including construction, mining and agriculture. If the losses per company have increased faster than inflation, which is likely, then the losses would be even higher.
Most other estimates, including widely cited values, tend not to present technical details of data collection and analysis. Also, some estimates assume that the ceiling of cybercrime losses doesn’t exceed the cost of car crashes or petty theft in a given year. However, cybercrime is not comparable to other types of property crime or losses. Typical property losses require physical presence, which limits the loss or damage. For instance, a burglar must be physically present to steal an object from a home or business. Cyber assets, however, are potentially accessible to any would-be criminals on the planet without them needing to leave their homes.
The removal of this obstacle (the need for physical presence) is a game-changing factor for criminal activity, making cybercrime more prevalent. For example, my personal information (e.g., Social Security number) has been stolen countless times and my credit card information has been stolen and used on numerous occasions, but my house has never been burglarized and my car has only been broken into once. If I wanted to engage with a cybercriminal, I would only need to look in my email inbox, but I have no idea where I could find a burglar.
My report describes methods in detail, uses public data, and doesn’t assume the losses are similar to other types of crime. Since the data I used from the Bureau of Justice Statistics is from 2005, these estimates are likely low. The digital economy, measured in real dollars, grew 129% between 2005 and 2016, and I did not adjust for this increase. Additionally, the number of businesses, which is used for estimation, was lower in 2016, according to the Census Bureau’s Annual Survey of Entrepreneurs. This pushes my low estimate for losses down even further.
Economic growth in recent years for the U.S. has been between 2% and 3%, at least prior to the COVID-19 pandemic. While this is considered a healthy growth rate, my estimates show that the economy could be growing even faster if not for cybercrime. With the U.S. being a wealthy country and having a commonly spoken language that increases the number of potential offenders (it’s difficult to send phishing emails in an unfamiliar language), it’s a prime target for cybercrime. If businesses and government underestimate the risk, they might underinvest in strategies for mitigating it. For instance, they might hire fewer IT security experts, take unnecessary risks with data/information, or disregard a recommended security measure. The result is unnecessary losses that may be quite substantial. If these losses are in the area of intellectual property, they can also reduce incentives for investing in research and development, limiting economic growth even more. For these reasons, it’s critical to gain a better understanding of cybercrime loss.
The implication from my report is that widely accepted estimates of cybercrime loss may severely underestimate the true value of losses. One of the first steps in addressing a problem such as cybercrime is to understand the magnitude of the loss, what types of losses occur, and the circumstances under which they occur. Without further data collection, we are in the dark as to how much we are losing. But the evidence suggests it’s more than we thought.
Question about the graph: how can the digital economy be more than the *total* economy? Isn't the digital economy a subset of the total?
It's plotted on the right axis, far less than the total GDP.
Ransomware is often crime
I have the same question regarding the grah. Why the orange line is above the blue line ? Is there part of the digital economy that would not be included in the global economy ? If this is the case, what are we talking about ?
Wow, really informative Douglas. Indeed, there are 3 or 4 methodologies that you point out where the numbers are being estimated far too low. And, while more qualified than most, those are the ones you can think of! Love this article will get the report. Thank you.
Given Dan Steven's question, it occurs to me that plot cybercrime as a % of GDP might be a little more eye-opening. I have enough numerical literacy to where I can more or less do that in my head, but most people cannot. Also, plotting % of GDP automatically adjusts for inflation.
HIre less security experts/ developers??? No way. I need a job.
China, Russia and the DNC. NSA, blockchain, cryptocurrency, quantum computers. The Federal Reserve creates digital trillion$ every month. What's real anymore? One big Carrington Event and .....
Doug, great article first off. Is there an initiative in the works to perform a more comprehensive and current report?
There has been some discussion of additional work, but nothing is scheduled at this time.
Nice article, but the data presented are too old, if this article presented and discussed with the latest data, then this article will be much more interesting.
Another big money impact: waste in US healthcare spending is also about the same as cybercrime $750B. Two huge opportunities for US voters.
A nice blog; the whole digital supply chain, needs attention from the cyber security perspective; as opposed to mere end -users.
Is this post tagged correctly? It is not showing up in the Cybersecurity topic feed, and I think it should.
Thank you for bringing that to our attention! We have fixed it!
All govts should have passed cyber crimes prevention laws with universal applicable provisions along with trans-border access of criminals.