The above information was reported on Anderson Cooper tonight by a computer security expert on CNN.
Just in the United States alone there is 1 Trillion dollars stolen from just American businesses from hackers around the world mostly in countries like Russia, China and North Korea where they have nothing legally to fear because any money they make isn't considered illegal there but only an asset to those countries and individuals.
The 1 trillion dollar figure I checked but it turns out it is the global figure whereas the U.S. figure is 250 billion dollars.
However, the 1 trillion for the world and 250 billion dollars for U.S. Businesses was as of 2 years ago so you can only imagine how much worse it is now.
Here is the news article:
Does Cybercrime Really Cost $1 Trillion?
National
Security Agency Director Gen. Keith Alexander speaks about cybersecurity
and the new threats posed to the U.S. economy and military at the
American Enterprise Institute in Washington, D.C., on July 9, 2012.
(Chip Somodevilla/Getty Images)
Gen. Keith Alexander is the director of the National Security Agency and
oversees U.S. Cyber Command, which means he leads the government’s
effort to protect America from cyberattacks. Due to the secretive nature
of his job, he maintains a relatively low profile, so when he does
speak, people listen closely. On July 9, Alexander addressed a crowded
room at the American Enterprise Institute in Washington, D.C., and
though he started with a few jokes — his mother said he had a face for
radio, behind every general is a stunned father-in-law — he soon got
down to business.
Alexander warned that cyberattacks are causing "the greatest transfer of wealth in history," and he cited statistics from, among other sources, Symantec Corp. and McAfee Inc., which both sell software to protect computers from hackers. Crediting Symantec, he said the theft of intellectual property costs American companies $250 billion a year. He also mentioned a McAfee estimate that the global cost of cybercrime is $1 trillion. "That’s our future disappearing in front of us," he said, urging Congress to enact legislation to improve America’s cyberdefenses.
Alexander warned that cyberattacks are causing "the greatest transfer of wealth in history," and he cited statistics from, among other sources, Symantec Corp. and McAfee Inc., which both sell software to protect computers from hackers. Crediting Symantec, he said the theft of intellectual property costs American companies $250 billion a year. He also mentioned a McAfee estimate that the global cost of cybercrime is $1 trillion. "That’s our future disappearing in front of us," he said, urging Congress to enact legislation to improve America’s cyberdefenses.
These estimates have been cited on many occasions by government
officials, who portray them as evidence of the threat against America.
They are hardly the only cyberstatistics used by officials, but they are
recurring ones that get a lot of attention. In his first major cybersecurity speech
in 2009, President Obama prominently referred to McAfee’s $1 trillion
estimate. Sen. Joseph Lieberman, I-Conn., and Sen. Susan Collins,
R-Maine, the main sponsors of the Cybersecurity Act of 2012 that is
expected to be voted on this week, have also mentioned $1 trillion in
cybercrime costs. Last week, arguing on the Senate floor in favor of
putting their bill up for a vote, they both referenced the $250 billion
estimate and repeated Alexander’s warning about the greatest transfer of
wealth in history.
A handful of media stories, blog posts and academic studies have previously expressed skepticism about these attention-getting estimates, but this has not stopped an array of government officials and politicians from continuing to publicly cite them as authoritative. Now, an examination of their origins by ProPublica has found new grounds to question the data and methods used to generate these numbers, which McAfee and Symantec say they stand behind.
One of the figures Alexander attributed to Symantec — the $250 billion in annual losses from intellectual property theft — was indeed mentioned in a Symantec report, but it is not a Symantec number and its source remains a mystery.
McAfee’s trillion-dollar estimate is questioned even by the three independent researchers from Purdue University whom McAfee credits with analyzing the raw data from which the estimate was derived. "I was really kind of appalled when the number came out in news reports, the trillion dollars, because that was just way, way large," said Eugene Spafford, a computer science professor at Purdue.
Spafford was a key contributor to McAfee’s 2009 report, "Unsecured Economies: Protecting Vital Information" (PDF). The trillion-dollar estimate was first published in a news release that McAfee issued to announce the report; the number does not appear in the report itself. A McAfee spokesman told ProPublica the estimate was an extrapolation by the company, based on data from the report. McAfee executives have mentioned the trillion-dollar figure on a number of occasions, and in 2011 McAfee published it once more in a new report, "Underground Economies: Intellectual Capital and Sensitive Corporate Data Now the Latest Cybercrime Currency" (PDF).
In addition to the three Purdue researchers who were the report’s key contributors, 17 other researchers and experts were listed as contributors to the original 2009 report, though at least some of them were only interviewed by the Purdue researchers. Among them was Ross Anderson, a security engineering professor at University of Cambridge, who told ProPublica that he did not know about the $1 trillion estimate before it was announced. "I would have objected at the time had I known about it," he said. "The intellectual quality of this ($1 trillion number) is below abysmal."
The use of these estimates comes amid increased debate about cyberattacks; warnings of a digital Pearl Harbor are becoming almost routine. "A cyberattack could stop our society in its tracks," Gen. Martin Dempsey, chairman of the Joint Chiefs of Staff, said earlier this year. Bloomberg reported just last week that a group of Chinese hackers, whom U.S. intelligence agencies referred to as "Byzantine Candor," have stolen sensitive or classified information from 20 organizations, including Halliburton Inc., and a prominent Washington law firm, Wiley Rein LLP.
There is little doubt that a lot of cybercrime, cyberespionage and even acts of cyberwar are occurring, but the exact scale is unclear and the financial costs are difficult to calculate because solid data is hard to get. Relying on inaccurate or unverifiable estimates is perilous, experts say, because it can tilt the country’s spending priorities and its relations with foreign nations. The costs could be worse than the most dire estimates — but they could be less, too.
Computer security companies like McAfee and Symantec have stepped into the data void. Both sell anti-virus software to consumers, and McAfee also sells a range of network security products for government agencies and private companies, including operators of critical infrastructure like power plants and pipelines. Both firms conduct and publish cybercrime research, too. "Symantec is doing outstanding work on threat analysis," said Thomas Rid, a cybersecurity expert at Kings College London. "But still, of course they have a vested interest in portraying a more dangerous environment because they stand to gain for it."
The companies disagree. Sal Viveros, a McAfee public relations official who oversaw the 2009 report, said in an email to ProPublica, "We work with think tanks and universities to make sure our reports are non-biased and as accurate as possible. The goal of our papers [is] to really educate on the issues and risks facing businesses. Our customers look to us to provide them with our expert knowledge."
Symantec said its estimates are developed with standard methods used by governments and businesses to conduct consumer surveys and come from "one of the few, large, multi-country studies on cybercrime that asks consumers what forms of cybercrime they have actually experienced and what it cost them."
One reason it’s a challenge to measure the financial costs of cybercrimes is that the victims often don’t know they’ve been attacked. When intellectual property is stolen, the original can remain in place, seemingly untouched. Even when the breach is known, how do you put a dollar value on a Social Security number, a formula for a new drug, the blueprints for a new car, or the bidding strategy of an oil firm? It may be impossible to know whether an attacker uses intellectual property in a way that causes economic harm to the victim; maybe the data isn’t of much use to the attacker, or maybe the attacker, though using the data to quickly bring out a new product, is not successful in gaining market share.
There’s an added complication in some attacks: Companies can be reluctant to admit they have been hacked because they fear a loss in confidence from consumers or clients. This can lead to underreporting of the problem.
"How do you even start to measure the monetary damages?" asked Nick Akerman, a partner at the law firm of Dorsey & Whitney LLP who specializes in computer cases — and one of the contributors to the McAfee report. "I would argue it is impossible. Not to say the problem isn’t enormous. It is enormous. But I don’t see how you can adequately come up with dollar figures."
Companies that sell security software are not bound by the same professional practices as academics, whose studies tend to refrain from sweeping estimates. Even when corporate reports involve academic researchers, the results can be suspect. Industry-sponsored studies — pharmaceuticals are an example, according to a 2003 study published by BMJ (formerly known as the British Medical Journal) — can have a bias toward the industry’s economic interests. Unlike academic journals, which use a peer review process, there’s no formal system of oversight for studies published by industry. The economic interest of security companies is clear: The greater the apparent threat, the greater the reason to buy their anti-intruder software. Norton, which is owned by Symantec and sells a popular suite of anti-virus software, advises in its latest cybercrime report: "Don’t get angry. Get Norton."
Computer scientists Dinei Florencio and Cormac Herley, who work at Microsoft Research, the software giant’s computer science lab, recently wrote a paper, "Sex, Lies and Cyber-crime Surveys," (PDF) that sharply criticized these sorts of surveys. "Our assessment of the quality of cyber-crime surveys is harsh: they are so compromised and biased that no faith whatever can be placed in their findings," their report said. "We are not alone in this judgement. Most research teams who have looked at the survey data on cyber-crime have reached similarly negative conclusions."
Julie Ryan, a professor of engineering management and systems engineering at George Washington University, co-authored a paper, "The Use, Misuse, and Abuse of Statistics in Information Security Research" (PDF). In an interview with ProPublica, she said: "From what I’ve seen of the big commercial surveys, they all suffer from major weaknesses, which means the data is worthless, scientifically worthless. But it’s very valuable from a marketing perspective."
Yet corporate cybersurveys are repeatedly invoked; the NSA’s Alexander is merely among the most prominent senior officials to do it. ProPublica provided the NSA’s media office with links to critical studies, stories and blog posts about the Symantec and McAfee numbers and asked whether Alexander or the agency was aware of them or, alternately, had other data to support the numbers he cited. The NSA media office responded: "The information is publicly available and was appropriately sourced."
In 2008, McAfee decided to commission a report that would look at how the global economic downturn was affecting data theft against companies. McAfee put one of its public relations officials, Viveros, in charge of the project. Viveros, in a phone interview, said a technology marketing company was hired to create and distribute a survey to about 1,000 information and technology executives across the globe. Purdue University’s Center for Education and Research in Information Assurance and Security, headed by Spafford, analyzed the survey results, conducted follow-up interviews and helped write the report. McAfee confirmed that it helped steer $30,000 from a foundation to Purdue for the work.
The 31-page report found that the companies surveyed had an average of $12 million worth of sensitive information stored in offshore computer systems in 2008, and that each lost an average $4.6 million worth of intellectual property in 2008. The report was released on Jan. 29, 2009, in Davos, Switzerland, during a meeting of the World Economic Forum. McAfee issued a news release to announce it, and the release included dramatic numbers that were not in the report.
"The companies surveyed estimated they lost a combined $4.6 billion worth of intellectual property last year alone, and spent approximately $600 million repairing damage from data breaches," the release said. "Based on these numbers, McAfee projects that companies worldwide lost more than $1 trillion last year." The release contained a quote from McAfee’s then-president and chief executive David DeWalt, in which he repeated the $1 trillion estimate. The headline of the news release was "Businesses Lose More than $1 Trillion in Intellectual Property Due to Data Theft and Cybercrime."
The trillion-dollar estimate was picked up by the media, including Bloomberg and CNET, which expressed no skepticism. But at least one observer had immediate doubts. Amrit Williams, a security consultant, wrote on his blog a few days later, "$1 trillion a year? Seriously? Where the hell did the figure come from? To give you some perspective of size the total US GDP is about 14 trillion and that includes EVERYTHING."
The news stories got the worried attention of some of the report’s contributors because McAfee was connecting their names to an estimate they had no previous knowledge of and were skeptical about. One of the contributors, Augusto Paes de Barros, a Brazilian security consultant, blogged a week after the news release that although he was glad to have been involved in the report, "I could not find any data in that report that could lead into that number. … I’d like to see how they found this number."
When the number was announced in 2009, McAfee provided no public explanation of how it was derived. "Initially we were just going to do the report, but a lot of people were asking us what was the total number, so we worked on a model," said McAfee’s Viveros. This week, in response to queries from ProPublica, he disclosed details about the methodology. He said the calculations were done by a group of technology, marketing and sales officials at McAfee and were based on the survey responses.
"McAfee extrapolated the $1 trillion … based on the average data loss per company, multiplied by the number of similar companies in the countries we studied," Viveros said in an email.
The company’s method did not meet the standards of the Purdue researchers whom it had engaged to analyze the survey responses and help write the report. In phone interviews and emails to ProPublica, associate professor Jackie Rees Ulmer said she was disconcerted when, a few days before the report's unveiling, she received a draft of the news release that contained the $1 trillion figure. "I expressed my concern with the number as we did not generate it," Rees Ulmer said in an email. She added that although she couldn't recall the particulars of the phone conversation in which she made her concerns known, "It is almost certainly the case that I would have told them the number was unsupportable."
Viveros said McAfee was never told by Purdue that the number could not be supported by the survey data. The company moved ahead with the news release and, Viveros noted, the trillion-dollar estimate "got a life of its own."
In February 2009, President Obama ordered a 60-day cybersecurity review to look into ways to better protect the country from cyberattacks, and he appointed Melissa Hathaway, who served as a cybersecurity adviser in the Bush administration, to oversee the effort. On May 29, Obama unveiled the review and delivered his first major cybersecurity speech. The second page of the 38-page review cited McAfee’s trillion-dollar figure, and the president used it in his speech, saying, "It’s been estimated that last year alone cybercriminals stole intellectual property from businesses worldwide worth up to $1 trillion."
The administration’s Cyberspace Policy Review (PDF) includes footnotes, and the one for the $1 trillion estimate directs readers to McAfee’s news release. It is not an ordinary occurrence that a president relies on the contents of a corporate news release to warn Americans of a major threat to the homeland’s economic and national security, but Hathaway, now a security consultant, told ProPublica that at the time of the president’s speech she was comfortable with McAfee’s estimate because it appeared to be associated with Purdue researchers. However, she became wary of it once she began making more inquiries after the speech. "I tend not to use that number anymore," she said. "I was surprised that there wasn’t proved methodology behind the number."
In March 2011, McAfee published its "Underground Economies" report, which repeated the $1 trillion estimate. Criticism of it continued, too. Robert Richardson, then director of the Computer Security Institute, skeptically wrote on the group’s website in the spring of 2011 that "The trillion dollar number is just too good to kill." Later in 2011, Wired’s British edition reported that "if true, the figure amounts to a massive 1.6 percent of global GDP." This year, Microsoft Research’s Florencio and Herley wrote an opinion piece in The New York Times that described widely circulated cybercrime estimates as "generated using absurdly bad statistical methods, making them wholly unreliable."
These critiques have now taken on added importance because government officials are citing a variety of industry-generated numbers in their efforts to bolster support for major cybersecurity legislation. The House passed its version of a cybersecurity bill this spring; the pending Senate bill, known as the Cybersecurity Act of 2012, would enable the U.S. government and private companies to more easily share information about cyberthreats and create a set of voluntary cybersecurity standards for operators of critical infrastructure.
The report mentions the figure in passing, sourcing it in a footnote to a legal paper, where, as it turns out, the $250 billion number is not mentioned at all. Eric Shaw, one of two forensic psychologists Symantec retained to research the "Behavioral Risk" report, told ProPublica the footnote was a mistake. Instead, it should have referred to a different paper that points to a 2003 speech by FBI Director Robert S. Mueller. The figure is also cited in old FBI news releases available via the Internet Archive.
An agency spokeswoman said that although she believed FBI officials used a reliable source for the number, the FBI had neither developed the number nor claimed to have done so. She pointed to another document (PDF), from the U.S. Department of Justice, attributing the $250 billion figure to the Office of the U.S. Trade Representative.
Then-Commerce Secretary Gary Locke used the $250 billion number in a 2010 speech. Like Locke, the trade representative is a member of the president’s cabinet; a spokeswoman for the office said the figure was not from them. "Your inquiry appears to refer to an industry-reported figure," the spokeswoman told ProPublica, pointing to a U.S. Chamber of Commerce paper on intellectual property theft. Sure enough, there’s the $250 billion again — this time attributed to none other than the FBI.
There are other concerns about Symantec estimates cited by Alexander. Drawing from the 2011 Norton Cybercrime Report, Alexander put the direct cost of cybercrime at $114 billion and cybercrime’s total cost, factoring in time lost, at $388 billion. The report was not actually researched by Norton employees; it was outsourced to a market research firm, StrategyOne, which is owned by the public relations giant Edelman.
StrategyOne surveyed almost 20,000 people in 24 countries, asking them to report whether they had experienced cybercrime and how much it had cost them. The company said it used "standard research practice for online surveys" to obtain a representative sample of Internet users. To calculate a total cost, it multiplied the estimated number of victims by the average cost of cybercrime in each country.
But that still leaves room for uncertainty, several researchers told ProPublica. For example, if responses came mainly from those most concerned about cybercrime or from those who suffered the biggest losses, it could inflate the average cost. And one person’s estimate of the financial damage from a cybercrime might be completely different from the next person’s guess, even if both suffered the same crime and the same amount of lost time.
A StrategyOne spokesman, asked if the Symantec estimates could be called scientific, responded, "Yes, as much as any survey or poll that relies on consumers to estimate their losses based on recall."
Some experts say that’s not good enough. "Nobody can really assess the true impact of cybercrime," said Franz-Stefan Gady, an analyst at a security-focused think tank called the EastWest Institute. "It’s really the self-reporting — because we can’t verify it. It’s just as simple as that."
In their 2011 paper, Florencio and Herley of Microsoft Research did not specifically mention the Symantec or McAfee numbers. But they observed, "Far from being broadly-based estimates of losses across the population, the cyber-crime estimates that we have appear to be largely the answers of a handful of people extrapolated to the whole population."
Sen. Collins added another layer of confusion about the mysterious $250 billion figure when she spoke last week in support of the cybersecurity bill. In remarks on the Senate floor, she mentioned Gen. Alexander and said, "He believes American companies have lost about $250 billion a year through intellectual property theft."
Collins’ office declined several requests for comment. A spokeswoman for Lieberman, who similarly cited Alexander and the $250 billion figure, replied, "Senator Lieberman and his staff believe that McAfee, Symantec, and General Alexander are reputable sources of information about cybersecurity."
A handful of media stories, blog posts and academic studies have previously expressed skepticism about these attention-getting estimates, but this has not stopped an array of government officials and politicians from continuing to publicly cite them as authoritative. Now, an examination of their origins by ProPublica has found new grounds to question the data and methods used to generate these numbers, which McAfee and Symantec say they stand behind.
One of the figures Alexander attributed to Symantec — the $250 billion in annual losses from intellectual property theft — was indeed mentioned in a Symantec report, but it is not a Symantec number and its source remains a mystery.
McAfee’s trillion-dollar estimate is questioned even by the three independent researchers from Purdue University whom McAfee credits with analyzing the raw data from which the estimate was derived. "I was really kind of appalled when the number came out in news reports, the trillion dollars, because that was just way, way large," said Eugene Spafford, a computer science professor at Purdue.
Spafford was a key contributor to McAfee’s 2009 report, "Unsecured Economies: Protecting Vital Information" (PDF). The trillion-dollar estimate was first published in a news release that McAfee issued to announce the report; the number does not appear in the report itself. A McAfee spokesman told ProPublica the estimate was an extrapolation by the company, based on data from the report. McAfee executives have mentioned the trillion-dollar figure on a number of occasions, and in 2011 McAfee published it once more in a new report, "Underground Economies: Intellectual Capital and Sensitive Corporate Data Now the Latest Cybercrime Currency" (PDF).
In addition to the three Purdue researchers who were the report’s key contributors, 17 other researchers and experts were listed as contributors to the original 2009 report, though at least some of them were only interviewed by the Purdue researchers. Among them was Ross Anderson, a security engineering professor at University of Cambridge, who told ProPublica that he did not know about the $1 trillion estimate before it was announced. "I would have objected at the time had I known about it," he said. "The intellectual quality of this ($1 trillion number) is below abysmal."
The use of these estimates comes amid increased debate about cyberattacks; warnings of a digital Pearl Harbor are becoming almost routine. "A cyberattack could stop our society in its tracks," Gen. Martin Dempsey, chairman of the Joint Chiefs of Staff, said earlier this year. Bloomberg reported just last week that a group of Chinese hackers, whom U.S. intelligence agencies referred to as "Byzantine Candor," have stolen sensitive or classified information from 20 organizations, including Halliburton Inc., and a prominent Washington law firm, Wiley Rein LLP.
There is little doubt that a lot of cybercrime, cyberespionage and even acts of cyberwar are occurring, but the exact scale is unclear and the financial costs are difficult to calculate because solid data is hard to get. Relying on inaccurate or unverifiable estimates is perilous, experts say, because it can tilt the country’s spending priorities and its relations with foreign nations. The costs could be worse than the most dire estimates — but they could be less, too.
Computer security companies like McAfee and Symantec have stepped into the data void. Both sell anti-virus software to consumers, and McAfee also sells a range of network security products for government agencies and private companies, including operators of critical infrastructure like power plants and pipelines. Both firms conduct and publish cybercrime research, too. "Symantec is doing outstanding work on threat analysis," said Thomas Rid, a cybersecurity expert at Kings College London. "But still, of course they have a vested interest in portraying a more dangerous environment because they stand to gain for it."
The companies disagree. Sal Viveros, a McAfee public relations official who oversaw the 2009 report, said in an email to ProPublica, "We work with think tanks and universities to make sure our reports are non-biased and as accurate as possible. The goal of our papers [is] to really educate on the issues and risks facing businesses. Our customers look to us to provide them with our expert knowledge."
Symantec said its estimates are developed with standard methods used by governments and businesses to conduct consumer surveys and come from "one of the few, large, multi-country studies on cybercrime that asks consumers what forms of cybercrime they have actually experienced and what it cost them."
* * *
Cyberattacks come in many flavors. There are everyday crimes in which
hackers access personal or financial information, such as credit card
numbers. There are industrial crimes and espionage in which the attacker
— perhaps a foreign country or company — breaks into a corporate or
government network to obtain blueprints or classified information;
sometimes the attacker gets inside a network and lurks there for months
or years, scooping up whatever is of interest. One of the biggest
categories of cybercrime is one of the least discussed — insider theft,
by disgruntled or ex-employees. There’s also a category of attacks that
do not have overt financial motives and that can constitute acts of war:
Attempts to create havoc in computer systems that control nuclear power
plants, dams and the electrical grid. This category is of the greatest
concern to national security officials.
One reason it’s a challenge to measure the financial costs of cybercrimes is that the victims often don’t know they’ve been attacked. When intellectual property is stolen, the original can remain in place, seemingly untouched. Even when the breach is known, how do you put a dollar value on a Social Security number, a formula for a new drug, the blueprints for a new car, or the bidding strategy of an oil firm? It may be impossible to know whether an attacker uses intellectual property in a way that causes economic harm to the victim; maybe the data isn’t of much use to the attacker, or maybe the attacker, though using the data to quickly bring out a new product, is not successful in gaining market share.
There’s an added complication in some attacks: Companies can be reluctant to admit they have been hacked because they fear a loss in confidence from consumers or clients. This can lead to underreporting of the problem.
"How do you even start to measure the monetary damages?" asked Nick Akerman, a partner at the law firm of Dorsey & Whitney LLP who specializes in computer cases — and one of the contributors to the McAfee report. "I would argue it is impossible. Not to say the problem isn’t enormous. It is enormous. But I don’t see how you can adequately come up with dollar figures."
Companies that sell security software are not bound by the same professional practices as academics, whose studies tend to refrain from sweeping estimates. Even when corporate reports involve academic researchers, the results can be suspect. Industry-sponsored studies — pharmaceuticals are an example, according to a 2003 study published by BMJ (formerly known as the British Medical Journal) — can have a bias toward the industry’s economic interests. Unlike academic journals, which use a peer review process, there’s no formal system of oversight for studies published by industry. The economic interest of security companies is clear: The greater the apparent threat, the greater the reason to buy their anti-intruder software. Norton, which is owned by Symantec and sells a popular suite of anti-virus software, advises in its latest cybercrime report: "Don’t get angry. Get Norton."
Computer scientists Dinei Florencio and Cormac Herley, who work at Microsoft Research, the software giant’s computer science lab, recently wrote a paper, "Sex, Lies and Cyber-crime Surveys," (PDF) that sharply criticized these sorts of surveys. "Our assessment of the quality of cyber-crime surveys is harsh: they are so compromised and biased that no faith whatever can be placed in their findings," their report said. "We are not alone in this judgement. Most research teams who have looked at the survey data on cyber-crime have reached similarly negative conclusions."
Julie Ryan, a professor of engineering management and systems engineering at George Washington University, co-authored a paper, "The Use, Misuse, and Abuse of Statistics in Information Security Research" (PDF). In an interview with ProPublica, she said: "From what I’ve seen of the big commercial surveys, they all suffer from major weaknesses, which means the data is worthless, scientifically worthless. But it’s very valuable from a marketing perspective."
Yet corporate cybersurveys are repeatedly invoked; the NSA’s Alexander is merely among the most prominent senior officials to do it. ProPublica provided the NSA’s media office with links to critical studies, stories and blog posts about the Symantec and McAfee numbers and asked whether Alexander or the agency was aware of them or, alternately, had other data to support the numbers he cited. The NSA media office responded: "The information is publicly available and was appropriately sourced."
* * *
McAfee was founded by John McAfee, a software engineer who wrote some of
the first anti-virus software in the 1980s. The company grew quickly,
thanks in part to a novel marketing strategy in those days
— McAfee gave away its software, charging only for tech support. The
company went public in 1992 and remained a leader in its field; last
year it was acquired by Intel Corp. for $7.68 billion. "We have had just
one mission: to help our customers stay safe," McAfee says on its
website. "We achieve this by creating proactive security solutions for
securing your digital world."
In 2008, McAfee decided to commission a report that would look at how the global economic downturn was affecting data theft against companies. McAfee put one of its public relations officials, Viveros, in charge of the project. Viveros, in a phone interview, said a technology marketing company was hired to create and distribute a survey to about 1,000 information and technology executives across the globe. Purdue University’s Center for Education and Research in Information Assurance and Security, headed by Spafford, analyzed the survey results, conducted follow-up interviews and helped write the report. McAfee confirmed that it helped steer $30,000 from a foundation to Purdue for the work.
The 31-page report found that the companies surveyed had an average of $12 million worth of sensitive information stored in offshore computer systems in 2008, and that each lost an average $4.6 million worth of intellectual property in 2008. The report was released on Jan. 29, 2009, in Davos, Switzerland, during a meeting of the World Economic Forum. McAfee issued a news release to announce it, and the release included dramatic numbers that were not in the report.
"The companies surveyed estimated they lost a combined $4.6 billion worth of intellectual property last year alone, and spent approximately $600 million repairing damage from data breaches," the release said. "Based on these numbers, McAfee projects that companies worldwide lost more than $1 trillion last year." The release contained a quote from McAfee’s then-president and chief executive David DeWalt, in which he repeated the $1 trillion estimate. The headline of the news release was "Businesses Lose More than $1 Trillion in Intellectual Property Due to Data Theft and Cybercrime."
The trillion-dollar estimate was picked up by the media, including Bloomberg and CNET, which expressed no skepticism. But at least one observer had immediate doubts. Amrit Williams, a security consultant, wrote on his blog a few days later, "$1 trillion a year? Seriously? Where the hell did the figure come from? To give you some perspective of size the total US GDP is about 14 trillion and that includes EVERYTHING."
The news stories got the worried attention of some of the report’s contributors because McAfee was connecting their names to an estimate they had no previous knowledge of and were skeptical about. One of the contributors, Augusto Paes de Barros, a Brazilian security consultant, blogged a week after the news release that although he was glad to have been involved in the report, "I could not find any data in that report that could lead into that number. … I’d like to see how they found this number."
When the number was announced in 2009, McAfee provided no public explanation of how it was derived. "Initially we were just going to do the report, but a lot of people were asking us what was the total number, so we worked on a model," said McAfee’s Viveros. This week, in response to queries from ProPublica, he disclosed details about the methodology. He said the calculations were done by a group of technology, marketing and sales officials at McAfee and were based on the survey responses.
"McAfee extrapolated the $1 trillion … based on the average data loss per company, multiplied by the number of similar companies in the countries we studied," Viveros said in an email.
The company’s method did not meet the standards of the Purdue researchers whom it had engaged to analyze the survey responses and help write the report. In phone interviews and emails to ProPublica, associate professor Jackie Rees Ulmer said she was disconcerted when, a few days before the report's unveiling, she received a draft of the news release that contained the $1 trillion figure. "I expressed my concern with the number as we did not generate it," Rees Ulmer said in an email. She added that although she couldn't recall the particulars of the phone conversation in which she made her concerns known, "It is almost certainly the case that I would have told them the number was unsupportable."
Viveros said McAfee was never told by Purdue that the number could not be supported by the survey data. The company moved ahead with the news release and, Viveros noted, the trillion-dollar estimate "got a life of its own."
In February 2009, President Obama ordered a 60-day cybersecurity review to look into ways to better protect the country from cyberattacks, and he appointed Melissa Hathaway, who served as a cybersecurity adviser in the Bush administration, to oversee the effort. On May 29, Obama unveiled the review and delivered his first major cybersecurity speech. The second page of the 38-page review cited McAfee’s trillion-dollar figure, and the president used it in his speech, saying, "It’s been estimated that last year alone cybercriminals stole intellectual property from businesses worldwide worth up to $1 trillion."
The administration’s Cyberspace Policy Review (PDF) includes footnotes, and the one for the $1 trillion estimate directs readers to McAfee’s news release. It is not an ordinary occurrence that a president relies on the contents of a corporate news release to warn Americans of a major threat to the homeland’s economic and national security, but Hathaway, now a security consultant, told ProPublica that at the time of the president’s speech she was comfortable with McAfee’s estimate because it appeared to be associated with Purdue researchers. However, she became wary of it once she began making more inquiries after the speech. "I tend not to use that number anymore," she said. "I was surprised that there wasn’t proved methodology behind the number."
In March 2011, McAfee published its "Underground Economies" report, which repeated the $1 trillion estimate. Criticism of it continued, too. Robert Richardson, then director of the Computer Security Institute, skeptically wrote on the group’s website in the spring of 2011 that "The trillion dollar number is just too good to kill." Later in 2011, Wired’s British edition reported that "if true, the figure amounts to a massive 1.6 percent of global GDP." This year, Microsoft Research’s Florencio and Herley wrote an opinion piece in The New York Times that described widely circulated cybercrime estimates as "generated using absurdly bad statistical methods, making them wholly unreliable."
These critiques have now taken on added importance because government officials are citing a variety of industry-generated numbers in their efforts to bolster support for major cybersecurity legislation. The House passed its version of a cybersecurity bill this spring; the pending Senate bill, known as the Cybersecurity Act of 2012, would enable the U.S. government and private companies to more easily share information about cyberthreats and create a set of voluntary cybersecurity standards for operators of critical infrastructure.
* * *
In his speech at the American Enterprise Institute, Gen. Alexander said
Symantec placed the cost of intellectual property theft to the U.S. at
$250 billion a year. Tracing the origins of this statistic — as both the
U.S. Government Accountability Office (PDF) and technology writer Julian Sanchez
have attempted before — is not unlike pulling a piece of yarn to
unravel an old sweater. Although Symantec mentioned the $250 billion
estimate in a 2011 report, "Behavioral Risk Indicators of IP Theft," the estimate is not Symantec’s.
The report mentions the figure in passing, sourcing it in a footnote to a legal paper, where, as it turns out, the $250 billion number is not mentioned at all. Eric Shaw, one of two forensic psychologists Symantec retained to research the "Behavioral Risk" report, told ProPublica the footnote was a mistake. Instead, it should have referred to a different paper that points to a 2003 speech by FBI Director Robert S. Mueller. The figure is also cited in old FBI news releases available via the Internet Archive.
An agency spokeswoman said that although she believed FBI officials used a reliable source for the number, the FBI had neither developed the number nor claimed to have done so. She pointed to another document (PDF), from the U.S. Department of Justice, attributing the $250 billion figure to the Office of the U.S. Trade Representative.
Then-Commerce Secretary Gary Locke used the $250 billion number in a 2010 speech. Like Locke, the trade representative is a member of the president’s cabinet; a spokeswoman for the office said the figure was not from them. "Your inquiry appears to refer to an industry-reported figure," the spokeswoman told ProPublica, pointing to a U.S. Chamber of Commerce paper on intellectual property theft. Sure enough, there’s the $250 billion again — this time attributed to none other than the FBI.
There are other concerns about Symantec estimates cited by Alexander. Drawing from the 2011 Norton Cybercrime Report, Alexander put the direct cost of cybercrime at $114 billion and cybercrime’s total cost, factoring in time lost, at $388 billion. The report was not actually researched by Norton employees; it was outsourced to a market research firm, StrategyOne, which is owned by the public relations giant Edelman.
StrategyOne surveyed almost 20,000 people in 24 countries, asking them to report whether they had experienced cybercrime and how much it had cost them. The company said it used "standard research practice for online surveys" to obtain a representative sample of Internet users. To calculate a total cost, it multiplied the estimated number of victims by the average cost of cybercrime in each country.
But that still leaves room for uncertainty, several researchers told ProPublica. For example, if responses came mainly from those most concerned about cybercrime or from those who suffered the biggest losses, it could inflate the average cost. And one person’s estimate of the financial damage from a cybercrime might be completely different from the next person’s guess, even if both suffered the same crime and the same amount of lost time.
A StrategyOne spokesman, asked if the Symantec estimates could be called scientific, responded, "Yes, as much as any survey or poll that relies on consumers to estimate their losses based on recall."
Some experts say that’s not good enough. "Nobody can really assess the true impact of cybercrime," said Franz-Stefan Gady, an analyst at a security-focused think tank called the EastWest Institute. "It’s really the self-reporting — because we can’t verify it. It’s just as simple as that."
In their 2011 paper, Florencio and Herley of Microsoft Research did not specifically mention the Symantec or McAfee numbers. But they observed, "Far from being broadly-based estimates of losses across the population, the cyber-crime estimates that we have appear to be largely the answers of a handful of people extrapolated to the whole population."
Sen. Collins added another layer of confusion about the mysterious $250 billion figure when she spoke last week in support of the cybersecurity bill. In remarks on the Senate floor, she mentioned Gen. Alexander and said, "He believes American companies have lost about $250 billion a year through intellectual property theft."
Collins’ office declined several requests for comment. A spokeswoman for Lieberman, who similarly cited Alexander and the $250 billion figure, replied, "Senator Lieberman and his staff believe that McAfee, Symantec, and General Alexander are reputable sources of information about cybersecurity."
What to Read Next
Sponsored Links
-
Can You Guess the 10 States That Are Most Dependent on the Federal Government? (Politics Cheat Sheet)
-
Pharmacist Costs Walgreens $1.4 Million for Violating HIPAA (Pharmacy Times)
-
The 10 Biggest Movie Flops Of All Time (Movieseum)
21 comments
There are a couple of problems when dealing with (ugh) “cybercrime.”
The first is that “Intellectual Property” damage number is basically whatever Hollywood says it is. It’s how much income they CLAIM they’ve lost because someone watched a movie without paying for it. Usually, it’s based on statutory copyright infringement damages—the amount they might get if they sue you for downloading. In the United States, willful infringement is a $150,000 award (per item), so they’re talking about a million and a half downloads. That number doesn’t sound out of whack, considering the fraction of the population that feels entitled to entertainment, people who can’t afford it and would never have paid money, and people who wanted to see if they liked the material before they bought it. (Most studies I’ve seen—granting it’s hard to track the whole picture—suggest that the last category is the largest, and giving material away for free is better for business than hiding behind pay-walls.)
But…by contrast, about ten times that went to the theater to pay to just see “The Dark Knight Rises” on its opening weekend. So scale your expectations accordingly and keep the numbers in perspective. A million people listening to a song or watching a TV episode without paying is a very small fraction of the people paying.
Also by contrast, rather than the 150K award for downloading grandmothers, when you hear music on the radio, the station paid a “mechanical license” for the year, which set them back a whopping fifty bucks. When you buy music from a cover band, they paid about two cents per minute for you.
So the “real” damage in Intellectual Property (assuming that every free listen is equal to one lost sale, and nobody listened who wouldn’t have purchased, and that all value is worth money) is about eighty thousand bucks. It’s not good, but it’s not exactly going to tank the economy. It’s about as much damage as one guy stealing a Lexus, basically.
(The real damage to the economy is after the lawsuits and the studios/labels get their blood money. By wiping out people’s bank accounts for daring to enjoy something without paying a dollar, that creates someone who can’t buy things unless they absolutely need them. And it causes people to turn away from the industry and spend their money elsewhere.)
The trillion dollars…that may well be a decent ballpark. For example, Sony’s PlayStation Network has ninety million users, according to Wikipedia. Just causing each of them about ten thousand bucks worth of grief (theft, credit damage, and so forth—hard, but not impossible) would hit the trillion mark. And that’s just one breach. The more companies involved, the easier that target would be to hit.
However, the lion’s share of the damage damage is usually done by the companies, not the attackers. When that Sony network was hacked, it turned out they hadn’t updated their software in at least five years, ignoring serious security patches; their relaunch used systematically guessable passwords. In Australia, it was Telstra that posted close to a million full customer records to a public website, not some shadowy criminal. When Sarah Palin’s e-mail was hacked, it was because Yahoo! uses your birthdate as a “security” question and she used her well-documented date of birth. Spam comes from “botnets” of millions of people worldwide who are or were all running an old, unpatched version of Windows.
That’s not always the case. Sometimes, hackers use “exploits” that nobody else knows about, known as “zero-days” (how much time there’s been to patch them). But you know what? It’s not illegal to buy, sell, or use them! A good one (lots of control with little work) can be sold to a perfectly-legal broker for about a quarter-million bucks. Stuxnet used at least a few, though I haven’t heard anything about whether they were bought or found. But that’s not exactly the point, the point is that you’re allowed to sell information that a criminal can use to commit theft and vandalism, and potentially endanger lives.
Worse, if you’re a security researcher who finds an exploit, the company will use parts of the Digital Millenium Copyright Act to sue you for copyright infringement, ensuring that only the bad guys can find the flaws.
Basically, the problem is real, but the proposed solutions—surveillance and tracking, treating the world’s population like criminals while giving known abusive corporations broad immunity—are not going to work at all. What will work is making companies responsible for updating their software and banning traffic in exploits.
The first is that “Intellectual Property” damage number is basically whatever Hollywood says it is. It’s how much income they CLAIM they’ve lost because someone watched a movie without paying for it. Usually, it’s based on statutory copyright infringement damages—the amount they might get if they sue you for downloading. In the United States, willful infringement is a $150,000 award (per item), so they’re talking about a million and a half downloads. That number doesn’t sound out of whack, considering the fraction of the population that feels entitled to entertainment, people who can’t afford it and would never have paid money, and people who wanted to see if they liked the material before they bought it. (Most studies I’ve seen—granting it’s hard to track the whole picture—suggest that the last category is the largest, and giving material away for free is better for business than hiding behind pay-walls.)
But…by contrast, about ten times that went to the theater to pay to just see “The Dark Knight Rises” on its opening weekend. So scale your expectations accordingly and keep the numbers in perspective. A million people listening to a song or watching a TV episode without paying is a very small fraction of the people paying.
Also by contrast, rather than the 150K award for downloading grandmothers, when you hear music on the radio, the station paid a “mechanical license” for the year, which set them back a whopping fifty bucks. When you buy music from a cover band, they paid about two cents per minute for you.
So the “real” damage in Intellectual Property (assuming that every free listen is equal to one lost sale, and nobody listened who wouldn’t have purchased, and that all value is worth money) is about eighty thousand bucks. It’s not good, but it’s not exactly going to tank the economy. It’s about as much damage as one guy stealing a Lexus, basically.
(The real damage to the economy is after the lawsuits and the studios/labels get their blood money. By wiping out people’s bank accounts for daring to enjoy something without paying a dollar, that creates someone who can’t buy things unless they absolutely need them. And it causes people to turn away from the industry and spend their money elsewhere.)
The trillion dollars…that may well be a decent ballpark. For example, Sony’s PlayStation Network has ninety million users, according to Wikipedia. Just causing each of them about ten thousand bucks worth of grief (theft, credit damage, and so forth—hard, but not impossible) would hit the trillion mark. And that’s just one breach. The more companies involved, the easier that target would be to hit.
However, the lion’s share of the damage damage is usually done by the companies, not the attackers. When that Sony network was hacked, it turned out they hadn’t updated their software in at least five years, ignoring serious security patches; their relaunch used systematically guessable passwords. In Australia, it was Telstra that posted close to a million full customer records to a public website, not some shadowy criminal. When Sarah Palin’s e-mail was hacked, it was because Yahoo! uses your birthdate as a “security” question and she used her well-documented date of birth. Spam comes from “botnets” of millions of people worldwide who are or were all running an old, unpatched version of Windows.
That’s not always the case. Sometimes, hackers use “exploits” that nobody else knows about, known as “zero-days” (how much time there’s been to patch them). But you know what? It’s not illegal to buy, sell, or use them! A good one (lots of control with little work) can be sold to a perfectly-legal broker for about a quarter-million bucks. Stuxnet used at least a few, though I haven’t heard anything about whether they were bought or found. But that’s not exactly the point, the point is that you’re allowed to sell information that a criminal can use to commit theft and vandalism, and potentially endanger lives.
Worse, if you’re a security researcher who finds an exploit, the company will use parts of the Digital Millenium Copyright Act to sue you for copyright infringement, ensuring that only the bad guys can find the flaws.
Basically, the problem is real, but the proposed solutions—surveillance and tracking, treating the world’s population like criminals while giving known abusive corporations broad immunity—are not going to work at all. What will work is making companies responsible for updating their software and banning traffic in exploits.
Ooh. Bad math. My estimate for IP damage
should be eighty MILLION dollars, not eighty thousand. Worse (not “just
a Lexus”), but still a bit shy of hundreds of billions.
If you count electronic vote shifting to
switch Presidential election results in favor of a neocon administration
that would pursue wars of choice and financial deregulation, the cost
of cybercrime must be a multiple of a trillion dollars.
President Truman was advised by his military
top brass to use the nuke against Japan to send a warning to USSR. He
did exactly that. Ike, our most pragmatic of all presidents, sensed the
danger and reminded us of the forces in Washington DC and the military
industrial complex. He predicted that “Trend is troublesome. It has a
potential to foster future wars”. Well Korea, Vietnam, Iraq and
Afghanistan proved he was right.
Now, we are putting trillions in our war industry enterprise at the cost of our education systems, economy, health, energy, and arts in order to defeat our cyberspace enemies: Russia, China, Pakistan, Cuba, Iran, India and the list can go on and on… We have become of a nation fearful of all that we do not approve, or like. Wait until we support Israel in her preemptive strike against Iran and then another episode.
Now, we are putting trillions in our war industry enterprise at the cost of our education systems, economy, health, energy, and arts in order to defeat our cyberspace enemies: Russia, China, Pakistan, Cuba, Iran, India and the list can go on and on… We have become of a nation fearful of all that we do not approve, or like. Wait until we support Israel in her preemptive strike against Iran and then another episode.
$60 billion per year of that figure is
attributable to the MPAA (Motion Picture Association of America). They
pulled it out of their ****, If the F.B.I. took their word for it it
wouldn’t surprise any of us, would it? The MPAA documentation reference
is on the image in the link at the bottom of this post.
Can we distinguish between cybercrime and cyberpiracy?
The address at the end of this post is to a bar chart image. It graphically illustrates the cyberpiracy losses claimed by the motion picture, music, and software industries, and contrasts them with the actual losses, as reported by them in their own documents (sources are at the bottom of the image. In summary, no evidence was provided to support their claims of losses to cybercrime.
Despite the lack of evidence, the government, industry, and academia, jumped to the front to lead the fear-mongering witch-hunt of these alleged criminals. The dip in sales of the American music industry that took place immediately before these claims corresponded to their own drastic cuts in the number of artists, and the variety of music, that they produced.
The motion picture industry profits grew predictably over the years in question before leveling off in the last 2 years. In light of the economy, and market shifts that have helped Netflix blossom in the soil of decayed and bankrupt Blockbuster, that is an outstanding performance. No matter how many imaginary numbers they throw around, or how much credibility they attempt to cloak themselves with, the entire cyberpiracy threat is a huge hoax, and the majority of the public knows it, because of the freedom of information inherent in the Internet.
So, if the cyberpiracy threat was a hoax perpetrated on the American people, and it (obviously) failed to provide a means of restricting access to information through SOPA, PIPA, etal., it shouldn’t be overlooked that whoever or whatever motivated the amount of money, time, and manpower that went into that attempt, would not be likely to walk away with their tail between their legs.
And so, here we are, after the dog and pony circus rash of “cybercrime” that miraculously swelled as SOPA and PIPA ebbed, confronting, conveniently, the same questions, and promoting the same kind of restrictions on the public sphere of information and encroachment on civil liberties. We all, of course, would love to see businesses and individuals thrive in a safe online world, but when that security for business comes at the price of access to information upon which our informed votes depend, and at the price of freedom and privacy for individuals to speak out against corporate “intelligence” overseers, we should all be highly cynical.
https://sphotos-b.xx.fbcdn.net/hphotos-ash3/s720x720/538673_405619989459554_297674106_n.jpg
Can we distinguish between cybercrime and cyberpiracy?
The address at the end of this post is to a bar chart image. It graphically illustrates the cyberpiracy losses claimed by the motion picture, music, and software industries, and contrasts them with the actual losses, as reported by them in their own documents (sources are at the bottom of the image. In summary, no evidence was provided to support their claims of losses to cybercrime.
Despite the lack of evidence, the government, industry, and academia, jumped to the front to lead the fear-mongering witch-hunt of these alleged criminals. The dip in sales of the American music industry that took place immediately before these claims corresponded to their own drastic cuts in the number of artists, and the variety of music, that they produced.
The motion picture industry profits grew predictably over the years in question before leveling off in the last 2 years. In light of the economy, and market shifts that have helped Netflix blossom in the soil of decayed and bankrupt Blockbuster, that is an outstanding performance. No matter how many imaginary numbers they throw around, or how much credibility they attempt to cloak themselves with, the entire cyberpiracy threat is a huge hoax, and the majority of the public knows it, because of the freedom of information inherent in the Internet.
So, if the cyberpiracy threat was a hoax perpetrated on the American people, and it (obviously) failed to provide a means of restricting access to information through SOPA, PIPA, etal., it shouldn’t be overlooked that whoever or whatever motivated the amount of money, time, and manpower that went into that attempt, would not be likely to walk away with their tail between their legs.
And so, here we are, after the dog and pony circus rash of “cybercrime” that miraculously swelled as SOPA and PIPA ebbed, confronting, conveniently, the same questions, and promoting the same kind of restrictions on the public sphere of information and encroachment on civil liberties. We all, of course, would love to see businesses and individuals thrive in a safe online world, but when that security for business comes at the price of access to information upon which our informed votes depend, and at the price of freedom and privacy for individuals to speak out against corporate “intelligence” overseers, we should all be highly cynical.
https://sphotos-b.xx.fbcdn.net/hphotos-ash3/s720x720/538673_405619989459554_297674106_n.jpg
I smell WMDs, aluminum tubes and yellow cake. Anybody got a knife?
Any quoted figure must be measured based on the benefit to be gained by the people who produced, and the people quoting it.
In this case, the figures are being produced by companies that want people to buy their products (or in the case of the content industry want laws to force everyone to pay an annual subscription just for living on the same planet as a movie is produced). They’re being quoted by someone who wants to get more money and more power for his agency. How does he do that? Persuade people that there’s a threat out there.
It’s something that’s been happening in the west for decades. Sell a threat, keep people docile and complicit, democracy really isn’t that important when you’re terrified about terrorists/communists/fascists/drug lords…
In this case, the figures are being produced by companies that want people to buy their products (or in the case of the content industry want laws to force everyone to pay an annual subscription just for living on the same planet as a movie is produced). They’re being quoted by someone who wants to get more money and more power for his agency. How does he do that? Persuade people that there’s a threat out there.
It’s something that’s been happening in the west for decades. Sell a threat, keep people docile and complicit, democracy really isn’t that important when you’re terrified about terrorists/communists/fascists/drug lords…
Does the $1T include alleged cybercrime by wall street?
Glad you investigated these estimates, but is
it fair to cite Microsoft researchers on the scale of cybercrime
without mentioning that they have an economic interest in proving that
systems—or at least their systems—are generally secure?
Since Victoria brought up laws, it’s worth
mentioning that today would be a good day to contact your Senators. The
Cybersecurity Act is ending debate today. Basically, there are three
issues.
1. The Act itself is overbroad and harmful to anything regarding due process, civil rights, and so forth. The SOPA- and PIPA-like parts have been removed, though.
2. Al Franken grew a backbone and proposed amendments that would eliminate corporate immunity (and “affirmative authority”) for spying on you and blocking your traffic, “just in case.” This is a good step, and if the Act MUST pass, this needs to be in it.
3. John McCain has proposed his own amendments that would put the NSA (military) in charge. I can’t imagine anything worse than pervasive military surveillance of Americans.
As I suggested above, though, there’s nothing in that bill that will stop an attack. What will stop attacks is keeping software up to date and finding (and fixing) security holes before the criminals do. That’s what the law needs to encourage, not watching what you read and send; the draconian measures are going to catch whistleblowers, not vandals or identity thieves.
In any case, my understanding is that switchboards are overloaded, so the staff aren’t registering nuances like “this amendment is good, that one’s bad,” but rather are just noting whether the caller supports the bill. If you call, make sure you’re clear and make sure the person you’re talking to is clear in his reporting. Otherwise, Twitter and Facebook are immediate and somewhat better-monitored, so those might be better routes.
1. The Act itself is overbroad and harmful to anything regarding due process, civil rights, and so forth. The SOPA- and PIPA-like parts have been removed, though.
2. Al Franken grew a backbone and proposed amendments that would eliminate corporate immunity (and “affirmative authority”) for spying on you and blocking your traffic, “just in case.” This is a good step, and if the Act MUST pass, this needs to be in it.
3. John McCain has proposed his own amendments that would put the NSA (military) in charge. I can’t imagine anything worse than pervasive military surveillance of Americans.
As I suggested above, though, there’s nothing in that bill that will stop an attack. What will stop attacks is keeping software up to date and finding (and fixing) security holes before the criminals do. That’s what the law needs to encourage, not watching what you read and send; the draconian measures are going to catch whistleblowers, not vandals or identity thieves.
In any case, my understanding is that switchboards are overloaded, so the staff aren’t registering nuances like “this amendment is good, that one’s bad,” but rather are just noting whether the caller supports the bill. If you call, make sure you’re clear and make sure the person you’re talking to is clear in his reporting. Otherwise, Twitter and Facebook are immediate and somewhat better-monitored, so those might be better routes.
Misha Glenny: Why you can’t trust the cybercrime stats !
http://www.wired.co.uk/magazine/archive/2011/12/ideas-bank/cybercrime-stats
http://www.wired.co.uk/magazine/archive/2011/12/ideas-bank/cybercrime-stats
And…the Cybersecurity Act failed. Great
news, but only by a narrow margin, and no thanks to Senators who swear
up and down they’ll never pass a bill that harms American liberty.
(My guess is that there’s a second definition of “liberty” used in Congress, to which we’re not privy…)
Bertrand, that’s a fairly good overview. Thanks for it.
(My guess is that there’s a second definition of “liberty” used in Congress, to which we’re not privy…)
Bertrand, that’s a fairly good overview. Thanks for it.
A basic rule in business is: “If you want to sell a solution, you first have to sell the problem”.
This strategy isn’t just limited to companies in the private sector like McAfee and Symantec. It also works if you are a government agency trying to get Congress to spend money on your budgetary wish-list.
This strategy isn’t just limited to companies in the private sector like McAfee and Symantec. It also works if you are a government agency trying to get Congress to spend money on your budgetary wish-list.
Well if you trust Symantec or McAfee then you
need your head examined. I think they create most of the viruses just
to stay in business! Wonder how much they rob corporations every year?
Aside from doubts about the accuracy of McAfee’s “answer”, we can’t
even tell what the question means. It suffers from the confusion that
the incoherent concept of “intellectual property” generally spreads,
because that term lumps together ten or more unrelated laws. When
they say “intellectual property theft”, it is not clear activities
they are talking about.
>From the substance of the article, I would guess that the term refers
in this context mainly to trade secrets, and that the “theft” referred
to in the article means obtaining those secrets. However, publishers
refer to sharing copies as “intellectual property theft”, even though
legally copyright infringement is not theft. Can we be sure which of
these the number in Symantec’s report is was supposed to measure?
Whatever it was, they should have stated it clearly. The only route
to clear thinking about any of the various issues that “intellectual
property” blurs and confuses is to reject that term, and use terms
that are properly specific.
even tell what the question means. It suffers from the confusion that
the incoherent concept of “intellectual property” generally spreads,
because that term lumps together ten or more unrelated laws. When
they say “intellectual property theft”, it is not clear activities
they are talking about.
>From the substance of the article, I would guess that the term refers
in this context mainly to trade secrets, and that the “theft” referred
to in the article means obtaining those secrets. However, publishers
refer to sharing copies as “intellectual property theft”, even though
legally copyright infringement is not theft. Can we be sure which of
these the number in Symantec’s report is was supposed to measure?
Whatever it was, they should have stated it clearly. The only route
to clear thinking about any of the various issues that “intellectual
property” blurs and confuses is to reject that term, and use terms
that are properly specific.
The 2012 CSA needs to include provisions to
address the unregulated pornography all over the internet, cyberbullying
and abuse of legacy court computer systems which is explained on the
home page of http://carolinacrimereport.com.
At the end of the day, what matter does it
make if the figure is $1 million, $1 billion, or $1 trillion? The US
Congress is doing nothing to prevent these thefts, principally on
account of politics. Meanwhile, the enemies of the US engorge themselves
on our inability to do anything constructive. Carry that into
education, the financial markets, etc., and the picture is far more grim
than it need be.
To give readers an idea of acceptable
methods, the Medicare Current Beneficiary Survey is a representative
sample of Medicare beneficiaries in the US. It paints a picture of
health spending, demographics, health status, and a lot of other cool
stuff. The survey does ask people to self-report medical events like
going to a doctor or to the hospital - but it checks every one of those
with Medicare’s database of actual claims filed by providers. And people
in the survey are interviewed three times a year - any longer and
people’s memory about specific medical events will start to decay and
become unreliable.
The Consumer Expenditures Survey paints a picture of what US consumers spend on daily necessities like food, housing, transport. It is entirely-self reported, because there’s no other way to do it. But again, the lookback period is four month.
In the case of any government-sponsored survey that is supposed to represent the entire country, the sample is randomly selected - but there are adjustments to ensure that certain demographic groups, or certain geographic regions, or a number of other factors are not over- or under-represented - otherwise that could skew the survey. They don’t just pick out a phone book and pick a random number of people. The ‘random’ sample has to be carefully constructed to ensure that it’s actually random, and we have no idea if this cyber crime survey did that (almost certainly not).
And at least CES asks you about concrete expenses that are more or less rememberable. I know what I spent on rent last month. I know what I sent to the power company. I know about what I spent on groceries and alcohol. Those are all common items. If I had been a cybercrime victim, I would almost certainly not remember it precisely. I would not remember it well if it had occurred earlier.
And the Medicare Current Beneficiary Survey has about 13,000 or 14,000 people in it, and it’s just for the United States. This cyber crime survey has 24,000 people for the entire world. That’s far too few for a good estimate, as it raises the margin of error for the entire survey.
The Consumer Expenditures Survey paints a picture of what US consumers spend on daily necessities like food, housing, transport. It is entirely-self reported, because there’s no other way to do it. But again, the lookback period is four month.
In the case of any government-sponsored survey that is supposed to represent the entire country, the sample is randomly selected - but there are adjustments to ensure that certain demographic groups, or certain geographic regions, or a number of other factors are not over- or under-represented - otherwise that could skew the survey. They don’t just pick out a phone book and pick a random number of people. The ‘random’ sample has to be carefully constructed to ensure that it’s actually random, and we have no idea if this cyber crime survey did that (almost certainly not).
And at least CES asks you about concrete expenses that are more or less rememberable. I know what I spent on rent last month. I know what I sent to the power company. I know about what I spent on groceries and alcohol. Those are all common items. If I had been a cybercrime victim, I would almost certainly not remember it precisely. I would not remember it well if it had occurred earlier.
And the Medicare Current Beneficiary Survey has about 13,000 or 14,000 people in it, and it’s just for the United States. This cyber crime survey has 24,000 people for the entire world. That’s far too few for a good estimate, as it raises the margin of error for the entire survey.
Musashi, from the entrepreneurs I know, our
“inability to do anything constructive” has nothing to do with
mysterious cyber-attacks. It has more to do with China biasing its
economy to make it a more attractive (read as: more lax) place to do
manufacturing and the aggressive (and probably bogus, in the final
analysis) litigation of companies like Apple, pounding any product that
has a chance of competing with the almighty established market.
To be more specific and direct, marketplaces that seem unfair are keeping people out of business, across the board.
It boils down to fear. Entrepreneurs fear that they’re going to get sued and/or that they’re not going to be able to compete against someone who outsources jobs and doesn’t need to care about environmental damage. Add in insecurity over energy prices (only an idiot runs a business if he can’t guess how much it’ll cost to turn on the lights in six months), and cyberattacks are a distant competitor, analogous to worrying about not liking a movie because you might get carjacked on the way there.
As to the cost, it’s very important when the government uses our money to fight it. If it costs a trillion dollars to prevent a million dollars in crime, it’s a better use of resources to allow the crime to happen, unless you think that the business profits are worth substantially more than taxpayer money.
(There’s also a smaller issue that centralization is starting to strain as a core, organizing principle of business as an indirect result of the economic problems we’ve seen. People are starting to look to repairing things instead of replacing them. What they do buy, they often want custom. An increasing number of designs are produced by volunteers. Employees and customers have the ability to keep a full computer system in their pockets and they want the independence. You CAN compete with this using the old Industrial Revolution models of top-down authority, but it’s an uphill battle. Focusing on distributed collaboration might be a smarter direction, for at least the next few years. Longer, if 3D printers and similar fabrication tools become more common.)
To be more specific and direct, marketplaces that seem unfair are keeping people out of business, across the board.
It boils down to fear. Entrepreneurs fear that they’re going to get sued and/or that they’re not going to be able to compete against someone who outsources jobs and doesn’t need to care about environmental damage. Add in insecurity over energy prices (only an idiot runs a business if he can’t guess how much it’ll cost to turn on the lights in six months), and cyberattacks are a distant competitor, analogous to worrying about not liking a movie because you might get carjacked on the way there.
As to the cost, it’s very important when the government uses our money to fight it. If it costs a trillion dollars to prevent a million dollars in crime, it’s a better use of resources to allow the crime to happen, unless you think that the business profits are worth substantially more than taxpayer money.
(There’s also a smaller issue that centralization is starting to strain as a core, organizing principle of business as an indirect result of the economic problems we’ve seen. People are starting to look to repairing things instead of replacing them. What they do buy, they often want custom. An increasing number of designs are produced by volunteers. Employees and customers have the ability to keep a full computer system in their pockets and they want the independence. You CAN compete with this using the old Industrial Revolution models of top-down authority, but it’s an uphill battle. Focusing on distributed collaboration might be a smarter direction, for at least the next few years. Longer, if 3D printers and similar fabrication tools become more common.)
How interesting that Chinese cybertheft and spy-theft of major German industries is hardly mentioned.
Read the following stories about how China and/or Chinese companies have stolen massive amounts of German technology, especially railway technology. While doing that, ask yourself: what is the cost of an entire industry?
http://www.bbc.co.uk/news/12382747
http://www.spiegel.de/international/world/0,1518,692969,00.html
http://www.reuters.com/article/2011/07/11/us-cybersecurity-electronics-idUSTRE76A60U20110711
http://www.spiegel.de/international/business/0,1518,698058,00.html
http://www.spiegel.de/international/world/0,1518,713478,00.html
http://www.guardian.co.uk/world/2009/jul/22/germany-china-industrial-espionage
http://www.carlisle.army.mil/USAWC/Parameters/Articles/2010summer/Thomas.pdf
http://www.youtube.com/user/deutschewelleenglish#p/u/4/UL4EvWyBHZg
Read the following stories about how China and/or Chinese companies have stolen massive amounts of German technology, especially railway technology. While doing that, ask yourself: what is the cost of an entire industry?
http://www.bbc.co.uk/news/12382747
http://www.spiegel.de/international/world/0,1518,692969,00.html
http://www.reuters.com/article/2011/07/11/us-cybersecurity-electronics-idUSTRE76A60U20110711
http://www.spiegel.de/international/business/0,1518,698058,00.html
http://www.spiegel.de/international/world/0,1518,713478,00.html
http://www.guardian.co.uk/world/2009/jul/22/germany-china-industrial-espionage
http://www.carlisle.army.mil/USAWC/Parameters/Articles/2010summer/Thomas.pdf
http://www.youtube.com/user/deutschewelleenglish#p/u/4/UL4EvWyBHZg
A flaw in this article is that it does not
discuss how cybercrime can actually increase the GDP. For example (and I
hate this example) if 100 people steal a copy of Photoshop the GDP has
actually increased $100K (GDP is a measure of all goods and services in
the economy). If Google steals a technology that Baidu has already
invested $100 million - well let your imagination do the math but lets
not forget that door swings both ways. Cybercrime can be both a
positive and negative to the economy we aren’t always the victims.
On another note I found it interesting that the US GDP is actually substantially smaller than it was in 1984 when Jobs first introduced the Mac. Seems counter-intuitive, yes?
end quote from:
http://www.propublica.org/article/does-cybercrime-really-cost-1-trillion
On another note I found it interesting that the US GDP is actually substantially smaller than it was in 1984 when Jobs first introduced the Mac. Seems counter-intuitive, yes?
end quote from:
http://www.propublica.org/article/does-cybercrime-really-cost-1-trillion
Aug. 1, 2012, 12:06 p.m.