Slashdot Mirror
Cybercrime Now Worth $105 Billion, Bypasses Drug Trade
Stony Stevenson writes "Citing recent highly publicized corporate data breaches that have beset major companies like Ameritrade, Citigroup, and Bank of America, McAfee CEO David DeWalt, said that cyber-crime has become a US$105 billion business that now surpasses the value of the illegal drug trade worldwide. Despite the increase in government compliance requirements and the proliferation of security tools, companies continue to underestimate the threat from phishing, data loss, and other cyber vulnerabilities, DeWalt said. 'Worldwide data losses now represent US$40 billion in losses to affected companies and individuals each year, DeWalt says. But law enforcement's ability to find, prosecute, and punish criminals in cyberspace has not kept up: "If you rob a 7-11 you'll get a much harsher punishment than if you stole millions online," DeWal remarked. "The cross-border sophistication in tracking and arresting cyber-criminals is just not there."'"
Considering the international nature of the Internet and the ability to hack from just about anywhere, including extradition-free countries, it seems like anyone could become a cybercriminal and make billions of dollars.
Does O'Reilly or Manning have a book on how to become a cybercriminal? Besides the Camel, I mean.
The covert Government support of CyberCrime by "intelligence" agencies, and the monopoly of profits from this - just like the drug trade.
Too bad the CIA can't destroy the black urban population of America with phishing spam, like they did to the brothers ad sisters with drugs in the 70's and 80's.
"Flyin' in just a sweet place,
Never been known to fail..."
Maybe drug dealers are getting smarter.
Task Mangler
Oh yeah.
That Conrad Black will be facing a real "three strikes" kind of deal!
"Flyin' in just a sweet place,
Never been known to fail..."
What an idiot.
How we know is more important than what we know.
Bypass: A means of circumvention.
Surpass: To be or go beyond, as in degree or quality; exceed.
...sounds like it was pulled out of someone's ass. I don't deny that there's a problem, but what concerns me is that this "number" could very well become another excuse for the government to pursue "solutions" that are even more invasive than our current crop of 9/11-related idiocy.
Legalize drugs for consenting adults, and put the crime-fighting resourses to use stopping cybercrime.
"If you rob a 7-11 you'll get a much harsher punishment than if you stole millions online,"
Like... distributing a mp3 on a P2P network?
Don't quote me on this.
Maybe they wouldn't be hacked so much if they used a secure operating system?
We're winning the drug war! That's the only way to explain such low numbers!
Maybe we'd better start a war on cyber crime too, seeing how the drug war has been so successful!
If you think about it, this makes perfect sense. Why risk getting 'capped' picking up ten bricks of heroin, risk getting snagged at some border transporting the bricks, and getting it home, just to get shot by your partner, when you could sit at some Starbucks, sipping a Venti White Chocolate Mocha and rake in tens of thousands of dollars.
Pushing ones and zeros are safer than pushing dope. No wonder organized crime has delved into the digital world.
"First things first, but not necessarily in that order."
- Doctor Who
I agree that cybercrime is a huge problem (although I don't buy that it's more of a problem than illegal drug trade). At the very least, it is a crime on a lesser level because no one is placed in danger of physical harm through it's effects.
Cybercrime, as well as other crimes, should be punished according to the level of damage caused.
With that in mind, the current US court systems cannot seem to wrap their heads around the tactics and ideas put forth in the discovery period of civil copyright cases. There is a common misunderstanding or complete lack of understanding on the part of most of society in the ways of computers and networking.
At this point, I doubt very seriously that most of the accused and prosecutors have the knowledge or ability to fairly fight a cybercrime court case.
In physical, there is always some level of evidence present to tie a suspect to the crime. In the land of computers, it's much more difficult to do so. Where a physical bank robber can wear a mask or clothing to conceal identifying aspects of his physical person. But there remains at the scene hairs, fibers, eyewitness accounts, surveillance tapes and other evidence that helps to narrow down the criminal.
With cybercrime, the 'break-in' can happen from thousands of miles away without the perpetrator ever setting foot, or having ever previously set foot on the premises. There is no physical description, no chemical or biological evidence left behind. The attack could come from a public terminal at a library, or even someone's open (or hijacked) wireless access point. Through the use of zombie computers, the attack could come from my mother's computer.
How can we expect to catch, let alone prosecute cybercriminals without special law enforcement and prosecution/defense attorneys and judges capable of fairly trying people like my mother or the guy who used her computer to break into the Bank of America system?
Message contains 1 attachment: spam.gif
I don't want to belittle the impact of cyber-crime, but this $105 Billion number is just fabricated to make the problem look large. On the other hand, the numbers for drug trade are basically an estimated amount of drug sales.
Drug numbers are *real* numbers. They still may not be accurate, but at least they represent the summation of finite transactions - like the global automobile trade, or the global whale oil trade. It is a sales number.
Cyber crime is a 'damages' number. Like the woman that spilled hot coffee on her leg and sued McDonalds for several million dollars in 'damages'... and at least she had a specific amount of damages ruled in her favor. The trumped up cyber-crime numbers... along with the RIAA numbers... are just manufactured because it is handy to provide very large numbers if you are on the side of the people producing the numbers.
What I would like to see is how many $$s were actually phished last year? How much did the Nigerians actually rake in by claiming to be my/your/her/his brother in law or trusted barrister?
You know what your hourly wage works out as any dealer not on top of the local pyramid? Check out Freakonomics, its an interesting case study. Using one gang's meticulously kept accounting records, they estimated the average dealer makes a bit more than minimum wage. Oh, and for that he has a 25% chance of death or imprisonment over an N month interval. (I can't remember what N was but, yikes, for 25% it wouldn't matter if it were 120!)
Compare this to cybercrime. I have been, at points in the past, a spam researcher. At the time, I lurked in spammer forums to get an idea of what the enemy is thinking. Ignoring the "I make a million a month and own a fleet of cars and a harem" boasting, and just focusing on the deals that were offered and consumated there, it is clear that cybercrime makes Serious Money especially by the standards of the locales where some criminals hang out. A single script to clean a spam mailing list, which is what, two or three hours of work, costs about a month worth of a legit Russian programmer's wages.
Or take a look at the opportunities for low-level criminals in the US, like "cashers". A casher is the guy at the end of the identity theft chain who gets the only risky job: turning the swiped data into money. (Phisher turns credentials over to casher, casher gets money, pays phisher.) He has a non-zero chance of his photo ending up on camera. For this, he gets perhaps 35% of the take from the scam. 35% of the banking account of say a lower-middle class family is easily thousands of dollars. No drugs in your pocket, no guns in your face, and no dedicated squad of police officers busting into your apartment at 1:00 in the morning if you get sold out by a buddy.
Why would you sell drugs if you weren't using, given these risk-vs-reward scenarios?
Help poke pirates in the eyepatch, arr.
The war on drugs and the war on terrorism is not enough, so they need yet another war... war on cybercrimes, they got to use up all those tax moneys somewhere!
Allow me to puke on yet another statistics based "news article" whith sole purpose of conditioning the general public like they do with the war on drugs and the like.
why hasn't anyone linked MS to this? surely being the target for nearly 99% of the botnets out there and the majority of cyber crime being directed at it you'd think someone would connect the two. it's a 105 billion dollar thing when MS doesn't make even half that, therefore MS hurts the economy more than it helps it
Cybercrime passes, or even surpasses drug trade but I don't know why you think cybercrime "goes around" drug trade.
Forgive me for being an English Nazi but jeez Louise, have they now outsourced Slashdot editing to people who don't speak English?
We don't see the world as it is, we see it as we are.
-- Anais Nin
"Thank you for your correspondence dated 17 May 2001, 22 January 2002, 8 July 2004, 14 March 2006, and 19 September 2007, requesting that the Federal Bureau of Investigation enforce existing wire fraud statutes with at least the same vigor with which we enforce non-violent drug posession statutes. Upon review, we regret to inform you that your requests to date were not of the form required by this authority.
"Please re-submit your request according to the traditionally established procedure. The most recent edition of this procedure may be obtained from the office of Senator Ted Stevens (R-AK). Your request may be filed at any Republican party field office. Please enclose with your request a cashier's check made payable to the Republican National Committee in the sum of no less than fifteen million (15,000,000) US dollars or equivalent sum in easily-convertible currency excepting Euros. Please do not enclose cash.
"We pride ourselves on providing our customers the best and most convenient law enforcement service possible, and look forward to receiving your request."
Editor, A1-AAA AmeriCaptions
The value of the global illegal drug trade is upwards of $300-500 billion by most estimates (and at least 150-200 by almost all others); of which the US market makes up about $60-100bn. Why is fact checking virtually non-existent with anything related to drug prohibition? And the other tactic, deceptive use of statistics, such as implying the $90bn maximum value of the trade is the entire value based and neglecting to mention that's only the wholesale market, is equally acceptable in even the most reputable publications. Why? Oh yeah, because virtually every actual fact contradicts the political consensus that prohibition is the best way to deal with the harms drugs create.
If the RIAA are involved in creating the stats, then they're probably using their $750 per track damages. If MS does the same thing for pirated versions of Office (probably $10000 per copy) etc, then just the piracy part of cybercrime would add up pretty quickly.
Bottom line: This sounds like a number that has been created to support some proposed course of action.
Engineering is the art of compromise.
Divide 105 B$ between these kinds of cyber-crime:
x B$ stolen from e-mail users who have to work through deluges of spam
x B$ stolen from drug companies by thieves who sell illegal generics online
x B$ stolen from software vendors by digital-high-seas pirates
x B$ stolen from the RIAA and the MPAA by the common man who won't pay retail price
x B$ stolen from bookstores by project Gutenberg
x B$ stolen from encyclopedia makers by Wikipedia users
x B$ stolen from McAfee and other security vendors by Linux and OS X users
x B$ stolen from buggy-whip makers by car drivers
McAfee is here to help: your computer will be safe from all these cyber-crime enablers.
The BBC has a nice write up on how open and inviting the world of cybercrime is. Tools are passed around and improved and auctioned along with the results, according to William Beer, of Symantec. The scene is booming, with almost double the number of new threats in the first six months of 2007 as in the last of 2006.
Arbor Networks is reporting the same boom from the ISP perspective, and thinks the infrastructure of the internet itself is in danger.
Darkreading details some of the sophistication of the attacks, from an IT perspective as reported by MessageLabs.
Hmmm. Symantec, MessageLabs, McAffe, all at once reporting the same thing. Not to downplay the threat, but is a new version of Windows out?
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
There must be more of me. Because my personal share is not going up that much.
We spent 87 Billion on the first year of war with Iraq. We managed to misplace 9 billion of it. We spend 400 Billion just on interest on the national debt. 105 billion? Chump change. But... from a jobs standpoint:
$105,000,000,000/$65,000=1,615,384 new tech jobs! So... If you can't make it legitimately because your job was shipped to India, there's always CyberCrime Inc. Now hiring 1.6 million techies. ;)
All kidding aside, I agree completely. Totally fabricated numbers. That would be a ten mile high stack of $1000 bills. If that kind of money was going out the doors, there'd be no end to new onshore tech jobs dedicated solely to defending against the threat. It would be major news, not a "slow news day" blurb on Slashdot.
- Whether Mr. DeWalt was alive or deceased;
- Why his US$105 billion could not easily be transferred out of the country. Although you hint at "cross-border sophistication in tracking and arresting..." I would still prefer a more explicit explanation of the difficulty.
- What you are offering as my percentage for assisting you with the transfer;
- Where I should reply with my acceptance of your offer.
I also note the absence of a pleasant, disarming greeting at the top, and the phrase "May the blessings of God be with you" at the end. Those are pretty much mandatory.Please correct these mistakes and try again.
"Yeah, it's the difference between a violent crime and shifting some numbers from one table in a database to another."
Indeed. What's your PIN number again?
TFA goes to show that the data (if such a thing exists) doesn't lie. The stoop heads spinning it do.
The game.
Yes, thankfully. It's been out for 8 months, it has twice the market share of Linux and OS X combined, and it's much more secure than the one it's replacing.
BTW, I think it's funny that you'd give so much weight to companies that you've referred to in the past as "snake oil vendors".
Given the fact that the vast majority of computers on botnets are there because of user action instead of exploited vulnerabilities, I fail to see what a new version of Windows has to do with this or not. People will infect a mainframe if the given the chance and someone can be bothered to write the malware for it. Hmmm. BonzyBuddy for OS/390 must be quite an experience. I wonder if it runs on InfoMan...
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
It's interesting that the comparison is between something that is, to the end-user, consensual in one case and not in the other, and in the consensual case 100 (1000?) times more resources are expanded to stop it.
... also, I can kill you with my brain.
Cybercrime alarmists have been saying this for two years, but it's simply not true. The United Nations drug statistics indicate that the global market for illicit substances is approximately $322 billion. More information here: http://arstechnica.com/news.ars/post/20051129-5648.html
Problems:
A) Pulling numbers out of ass.
It's crime. Criminals don't pay taxes. Where did this revenue estimate come from? Surely not from the IRS or the criminals' accounting department.
B) Playing the victim card.
The "victims" of "cybercrime" are almost always entirely at fault due to gross negligence. We shouldn't cry for people (or businesses) that cause themselves harm... especially if the "crime" involves losing a laptop filled with private data.
C) Trying to present something old as new.
It's not theft, it's cybercrime! It's not stalking, it's cyberstalking! It's not beating off, it's cybersex.
Lastly, SOX is a worthless piece of legislative bullshit.
"It's interesting that the comparison is between something that is, to the end-user, consensual in one case and not in the other, and in the consensual case 100 (1000?) times more resources are expanded to stop it."
Well here we go again. New to you, bud. Not all drug situations are victimless. And even if it's just you? I really don't want to get up at three in the morning and drive down to load your ass into the meat wagon. So do us both a favour and don't do drugs.
The drug dealers just need to move their whole business online, then they'll be on top again!
/me is ready to meet in the alley behind the liquor store
Imagine IRC channels dedicated to the drug trade!
that woosh is the sound of unstated cynicism flying over your head.
A man who stands to directly benefit from our fear of the cyberevil is telling us that said cyberevil is a) epic, b) growing in excess of other epic evils we are familiar with, and c) being grossly underestimated by everyone. Fantastic. Where's the credibility? We don't really need to attack his figures - the intractable flaw in the analysis is that his interpretation of them will never be without the looming spectre of disingenuousness, even if we cannot pinpoint it. Let's hear from people who aren't in line to make a few hundred million in salary, perks and bonuses if this ruse goes off without a hitch.
Even as you read this, your pants are strangling your loins! Aaa!
Just go back two articles and we see that the industry lied blatantly about the $40 billion losses of piracy in Canada, and that such numbers are hard or impossible to obtain. And in other news "cyber-crime has become a US$105 billion business"...
Do we ever learn?
x B$ stolen from Microsoft and SCO and others by Linux and OS X users
The truth shall set you free!
So now that there's better money in cybercrime than in drug trafficking, does that mean that now everyone involved in drugs is a loser instead of everyone except the higher-ups in the trafficking organisation?
"Bypass", v: to avoid something by going around it.
I think the word you're looking for is "surpass" (to do or be better than).
(Definitions taken from the Cambridge Advanced Learner's Dictionary.)
It's official. Most of you are morons.
That is nonsense. they are using grossly over inflated numbers. Kind of like when the RIAA claims they are being damaged by people downloading music.
-- -- Warning. Do not stare directly at the sun.
do not welcome our cybercrime overlords.
ordering blow with IRC... suddenly you have some dude at your door with a mirror and a razor blade.
bitching
I see it coming... We had a war on drugs, a war on terror and soon we'll have a war on cybercrime. What country must be invaded this time?
I've heard that penalties for white collar crime were a lot harsher than real life crimes.
Just have one of your friends give you a pardon.
Dump Windows! Flee to Mac or Linux or BSD or Solaris, whatever.
What does it take for people to WAKE UUUUPPPPP!?!?! Dump Windows! Dump Windows! Dump Windows! Dump Windows! Dump Windows!
Notice that the US govt hasnt really taken any major steps against this yet? and even to some extent condones it? simple, they want the problem to get really out of hand so when they do get involved, they will get away with a lot more then if they did now, like taking away freedoms from the internet that have no impact on cyber crime.
Hooray, one immeasurable statistic (cyber-crime) just passed another one (drug trade), and the person who mentions it just happens to be CEO of a cyber-security related company...?
Hmmm...
Give it a little while and GWB will add a War on Cyber-crime to the wonderful War on Terror; the successful War in Iraq; and the original War on Drugs...
-- "To ask a question is to show ignorance; Not to ask a question means you'll remain ignorant."
Does this remind anybody of the stats that the Canadian government used to justify more anti-consumer laws? These stats sound like the kind of numbers that you come up with sitting around a bar with your friends.
Sounds like someone is using the big numbers to try to get congress to write more laws to "protect" the banks (or whomever). And when big companies get together to propose laws, it's usually not good for everybody else.
You were mistaken. Which is odd, since memory shouldn't be a problem for you
Is this a story because of who made the claim? If not, this story is nearly two years old: http://www.theregister.co.uk/2005/11/29/cybercrime/
Bark less. Wag more.
Btw ... Mac OS and Mac Intel are both OS X so your Vista market share calculation is wrong, but those numbers will change seeing as almost 1 in 5 of laptops currently being sold is a Mac.
Good people do not need laws to tell them to act responsibly, while bad people will find a way around the laws-Plato
I tell ya, the more I read this stuff the more it makes me consider a life of crime! :)
A work that expires before its copyright never enters the public domain and thus enjoys eternal copyright protection.
DeWalt is likely quoting Valerie McNiven, from 2005 - who seemed to be somewhat unreliable even then...
From Ars Technica:
http://arstechnica.com/news.ars/post/20051129-5648.html
According to Valerie McNiven, a cybercrime advisor for the U.S. Treasury, the profits from global cybercrime exceeded profits from illicit drug sales last year. Modern technology certainly does provide a number of novel and unique ways for criminals to take advantage of other people, and in recent years we have seen a clear and apparent increase in instances of digitally perpetrated identity theft, data piracy, and fraud, but are the numbers really reliable? According to McNiven:
"Last year was the first year that proceeds from cybercrime were greater than proceeds from the sale of illegal drugs, and that was, I believe, over $105 billion."
McNiven's assertion is just plain wrong. According to United Nations statistics for 2003, the the global market for illicit substances is estimated at about US$322 billion, more than three times the value of McNiven's estimate, and larger than the GDP of 90 percent of the world's countries. I was unable to find the source from which McNiven got her estimate of $105 billion.
Other other hand, if you happen to be caught DL'ing music/movies you'll get a stiffer penalty than dealing drugs.
Obama's legacy: (N)othing (S)ecure (A)nywhere and (T)error (S)imulation (A)dministration
Yes, thankfully. It's been out for 8 months, it has twice the market share of Linux and OS X combined, and it's much more secure than the one it's replacing.
BTW, I think it's funny that you'd give so much weight to companies that you've referred to in the past as "snake oil vendors".
User action, and protecting from its bad consequences, has to do with the OS. e.g. : a badly designed OK/Cancel button is responsible for people losing their data (hint: ok/cancel dialogs just don't work), but you can say that data is lost due to "user action". The reality is that a well designed UI would help the user in identifying and preventing malware.Given the fact that the vast majority of computers on botnets are there because of user action instead of exploited vulnerabilities, I fail to see what a new version of Windows has to do with this or not. People will infect a mainframe if the given the chance and someone can be bothered to write the malware for it. Hmmm. BonzyBuddy for OS/390 must be quite an experience. I wonder if it runs on InfoMan...
In Ubuntu, for example, you always know where the software comes from. You don't usually run self-executable installers. You get a warning every time you are installing software from an untrusted source. Of course, it helps that you don't get those warnings most of the time, just in the not that frequent occasion of needing software outside of the trusted main repository.
If you were to be owned, you would need to perform an unusual operation to do it, whil in windows you get owned by the same procedure followed for installing base software like firefox.
I'm not sure its even true that you will loose the money if you put it somewhere safe enough. I often think that someone stealing $2 million and gets out within a few years has earned pretty good money.
:s/loose/lose
When I read the summary it immediately reminded me of Section 9 in Ghost in the Shell. While we don't have all the cool technology or cyborgs yet, it is interesting to see how technology is burying itself deeper and deeper into our everyday lives.
i mean scarface as a hacker, no it just doesn't quite work.
or are all vilans now supposed to be wimps ?
It sounds impresive, but i don't think cybercrime
really surpasses the drug trade in profits, except on paper.
Corporations routinely exaggerate losses to a
ridiculous degree. I read that the average cost
to a company for a lost or stolen laptop is
considered to be $85,000 (due to loss of time
and proprietary data.)
Another example:
A company's server is hacked by a friendly hacker.
The hacker just wanted a challenge and didn't
distribute any data. He's caught and the company
then claims $5 million dollars in damages.
CyberCrime figures look good on paper and make for
great insurance and tax write-offs. But they are
probably largely imaginary.
Many private citizens are victims of identity theft
and fraud, but I don't think those cases make up the
bulk of the CyberCrime dollar claim.
It's hard to believe the same person could say these two things:
[Thank God there's a new version of Windows. Vista is] much more secure than [XP].
and
the vast majority of computers on botnets are there because of user action instead of exploited vulnerabilities, I fail to see what a new version of Windows has to do with this
I mention it because it's about this time in the non free OS cycle that M$ usually kills the old version.
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
This is absolute proof that Microsoft is good for the economy. Without them, this substantial addition to the world economic growth would be much smaller. Open source just cannot match this.
Exactly HOW do they come up with these numbers?
I do hope McAfee's products are more up-to-date than their CEO's quote on cybercrime now exceeding the value of the US illegal drug trade. According to Reuters, that quote dates back to the fall of 2005 and refers to data for 2004. This statement was published in TechNewsWorld in November 2005: "Last year was the first year that proceeds from cyber crime were greater than proceeds from the sale of illegal drugs, and that was, I believe, over US$105 billion," Valerie McNiven, who advises the U.S. Treasury on cybercrime, told Reuters recently. http://www.technewsworld.com/story/47559.html.