Secrecy hampers battle for web There is an economy you will not find measured in the pages of the FT. It is a place where goods are traded and alliances formed. Margins are high and business is good - there is no tax, no regulation, no crisis nor recession. Growth is assured. It is here that cyber criminals, terrorists and even some governments ply their trade. It is a marketplace where anything from credit card details to an attack on critical infrastructure can be bought and sold. IN Cybersecurity 2013 Cyber security is a dominant feature of the global political agenda, with the focus having changed from weapons of mass destruction to a "credible threat of cyber attack capability." Industrial-scale theft of intellectual property has undermined competition and strained relations between China and the west. Meanwhile, security experts have made the humbling admission that the sophistication and evolution of the attacks are outpacing the defence. This year damning evidence emerged of the scale and seriousness of bilateral cyber espionage, most notably between the US and China. At a summit this weekend, President Barack Obama will be raising the problem with Xi Jinping, his Chinese counterpart, after it emerged that the designs of more than 30 US weapons systems had been compromised by Chinese hackers. Observers have been surprised at the level of penetration, which was detailed a fortnight ago in a report on cyber hacking by the Defense Science Board, which advises Pentagon leaders. Another reason for the escalating concern is that we are about to undergo a technological shift that will bring the connectivity of the internet into every aspect of life. Marketers call it the "internet of things," where everything, from shoes to pacemakers, will have an internet connection - a tenfold increase in the number of connected devices is expected by 2020. The damage that it will be possible to inflict through cyber crime, warfare or terrorism will increase exponentially. No longer limited to cyber space, hackers will be able to overload a power grid or derail a train if desired. A big increase in the sophistication and organisation of the attackers, a run of high-profile incidents and worsening international tensions have brought the issue to a head. Getting on the offensive will be hard. Cyber security is still hampered by secrecy. Businesses will acknowledge the threat but breaches are bad for business. Governments, too, are reluctant to bare the extent of their intelligence or capability. Ultimately, legislation may be the only route to more transparency but policy makers are finding it hard to strike the right balance between safety and burden. In the EU, draft legislation would require all companies to report attacks on and breaches of their networks to local authorities, which would be obliged to make them public. Business lobbyists are resisting, saying such rules would damage brand reputations and saddle companies with a high cost of compliance. In the US, Congress is focused on shifting more information into the open after the Cyber Security Act of 2012, which would have created voluntary standards for protecting key infrastructure, failed to pass through the Senate last year. In February, the White House issued an executive order that allowed the administration to share threats with more companies and people. The House of Representatives has passed a bill offering indemnity against potential lawsuits to companies that share breach information, but after lobbying from privacy activists the White House said it may veto the bill. Governments are increasingly candid, however, about the threat of cyber warfare, a phrase reserved for more insidious state-to-state attacks. The best example of this is Stuxnet, a worm believed to have been launched by the US and Israel, against Iran's nuclear programme in 2010. It was one of the first viruses designed to target a specific kind of machine and create physical damage. Analysts agree that an attack of this sophistication required state backing. But, unlike the cold war, cyber warfare is not a race in which developing the right technology takes money, resources and time. Worms and viruses can be examined and reverse engineered. In using a weapon, you give it to your enemy. Industry calls for a treaty to halt development of cyber weapons have fallen on deaf ears. Stuxnet changed the game. In 2011 the US Department of Defense designated cyber space an operational domain. In March this year Nato issued guidelines for cyber warfare based in international law in conjunction with the International Committee of the Red Cross and US Cyber Command. It stated that hackers were legitimate targets for a counterstrike. But all this assumes that cyber warfare will be distinguishable from cyber crime. It will not. For example, a report by Mandiant, a US cyber security company, in April openly accused China of state-sponsored cyber attacks. It said a unit within the People's Liberation Army stole technology blueprints, proprietary manufacturing processes, test results, business plans, pricing documents and partnership agreements from companies in mostly English-speaking countries. These were commercial, not military, targets. China denies the allegations. But attacks, which stopped after the Mandiant report, have resumed. Cyber criminals are capable of wreaking havoc without state backing. Most are turning their attention to high-value targets and few are more attractive than financial services. In Europe last year the Eurograbber virus used victims" mobile phones to steal €30m from more than 30 European banks. With a revolution in mobile payments round the corner, banks will have an increasingly difficult job keeping customers" money secure. Police, too, are having to change. In the UK the National Cyber Crime Unit, sitting within a new National Crime Agency, is expected to be running by the end of the year. The government has set up Fusion Cell, a collaboration between MI5, General Communications Headquarters (the UK's digital intelligence agency) and 83 representatives of leading businesses and owners of critical infrastructure. The US has a similar operation through its National Cyber-Forensics and Training Alliance, which draws on an army of volunteers within the IT industry to respond to urgent threats. The success stories are dwarfed by the volume of attacks. There remains no way yet of correlating the number of attacks reported by security companies and successful prosecutions by the police and government agencies. The consumerisation of business technology has made it difficult for companies to secure their data. As employees send sensitive information through mobile phones and personal cloud services, cyber security becomes something of an exercise in risk management. Nearly a third of companies forecast a rise in spending on staff, training or products, according to the 2013 Global Information Security Workforce Study, a survey of 12,000 information security managers conducted by Frost & Sullivan with Booz Allen Hamilton. This spending rise will boost economic growth as companies capitalise on demand for new products and services in cloud and mobile security. In the meantime, the secret economy where cyber criminals thrive will continue to grow.