Cybercrime costs US $100bn a year, report says Cybercrime and cyberspying are costing the US economy $100bn a year and the global economy perhaps $300bn annually, according to a first-of-its-kind report published on Tuesday. The report, "Estimating the Cost of Cybercrime and Cyber Espionage," prepared by the Washington-based Center for Strategic and International Studies (CSIS) and sponsored by McAfee, the security firm now owned by Intel, also estimates that malicious cyber activity costs as many as 508,000 jobs in the US alone. IN The Connected Business "It begs several important questions about the full benefit to the acquirers and the damage to the victims from the cumulative effect of continuous losses in cyberspace," the report said. "We believe the CSIS report is the first to use actual economic modelling to build out the figures for the losses attributable to malicious cyber activity," said Mike Fey, chief technology officer at McAfee. Other estimates have been bandied about for years, but no one has put any rigour behind the effort. As policy makers, business leaders and others struggle to get their arms around why cyber security matters, they need solid information on which to base their actions. The figures confirm that malicious cyberactivites do indeed represent what some have termed "the greatest transfer of wealth in human history." "Losses to the US [the country where data are most accessible] may reach $100bn annually," the report says. The cost of cybercrime and cyberespionage to the global economy is some multiple of this likely measured in hundreds of billions of dollars. To put this in perspective, the World Bank suggests that global GDP was about $70,000bn in 2011. A $300bn loss - and losses are probably in this range - would be four tenths of 1 per cent of global income. "This seemingly trivial amount begs several important questions about the full benefit to the acquirers and the damage to the victims from the cumulative effect of continuous losses in cyberspace," the report authors say. The report's authors note that the cost of malicious cyberactivity involves more than the loss of financial assets or intellectual property. There are opportunity costs, damage to brand and reputation, consumer losses from fraud, the opportunity costs of service disruptions "cleaning up" after cyber incidents and the cost of increased spending on cybersecurity. To help measure the real loss from cyberattacks, CSIS enlisted economists, intellectual property experts and security researchers to develop the report. The general accepted range for cybercrime launch was between $100bn and $500bn to the global economy. Researchers used real-world analogies like figures for car crashes, piracy, pilferage and drugs to build the model. They noted the difficulty of relying on methods such as surveys because companies that reveal their cyber losses often cannot estimate what has been taken, intellectual property losses are difficult to quantify and the self-selection process of surveys can distort the results. "This report is also the first to connect malicious cyberactivity with job loss," said James Lewis, director and senior fellow of the Technology and Public Policy Program at CSIS and a co-author of the report. Using figures from the Commerce Department on the ratio of exports to US jobs, we arrived at a high-end estimate of 508,000 US jobs potentially lost from cyberespionage. As with other estimates in the report, however, the raw numbers might tell just part of the story. If a good portion of these jobs were high-end manufacturing jobs that moved overseas because of intellectual property losses, the effects could be more wide ranging. A second report from the CSIS, which is under way, will look at the ramifications of cybersecurity losses on the pace of innovation, the flow of trade and the social costs associated with crime and job loss. Mr Lewis and co-author Stewart Baker of Steptoe & Johnson, point out that as thoroughly as they plan to develop their estimates, the dollar amount might not fully reflect all the damaging effects that cyber espionage and cybercrime have on the global economy. Both activities slow the pace of innovation, distort trade and bring the spate of social costs associated with crime and job loss, according to the report. The authors say the larger effect may be more important than any actual number, and it will be the focus of the next report.