Slashdot Mirror
What Cybercrime Stats Have In Common With Sexual Braggadocio
An anonymous reader writes "Microsoft researchers have rubbished figures from cybercrime surveys, deeming them subject to the types of distortions that have long bedeviled sex surveys. All it takes is a few self-styled Don Juans to hopelessly distort the sex-survey figures. Similarly, cybercrime surveys tend to get dominated by a minority of responses, normally those who have or think they have lost a great deal as a result of hacking or malware attack, and are vocal about it. 'Cybercrime surveys are so compromised and biased that no faith whatever can be placed in their findings,' the researchers write."
Hackers emailed me a grenade that blew up my PC!
It's true!
If I have been able to see further than others, it is because I bought a pair of binoculars.
Some of the worst offenders of this are outfits like the RIAA and MPAA that grossly overstate the impact of piracy in order to legitimize themselves. When a single kid with Limewire deserves a fine larger than the GDP of the entire world for a decade, you know the metrics have lost all basis in reality.
I read the internet for the articles.
Everyone exaggerates how many systems they've penetrated.
Give me Classic Slashdot or give me death!
Firstly: No. Outliers are part of a data set, and it's dishonest to simply dismiss data that does not fit with your expectations.
Secondly: The over-reporters aren't outliers. There is systematic error in asking people to self-report loss due to security breaches. People either fail to respond to polls due to internal security procedures, or they tend towards overestimating their own loss. It's not simply that there's one guy out there saying he lost $5 billion due to hackers; it's that people who respond to the poll tend to overestimate their real losses by some unknown percentage.
Unfortunately, this is also how Microsoft comes up with numbers for piracy ... they pull them out of their ass, and build guesstimates to suggest they've lost eleventy trillion dollars to piracy. Same goes for the RIAA/MPAA and the BSA. They have no objective numbers.
Microsoft just doesn't like these ones because their OS is at the heart of much of it.
You can't go dissing the methodology when you don't want them to be true, and using the methodology when it suits you. Although, corporations don't seem concerned by such things as logical inconsistencies.
Lost at C:>. Found at C.
When Microsoft collects $5 per computer license (MAR - Microsoft Authorized Refurbishers) on used PCs donated small schools and internet cafes in African nations, with incomes below $1,000 per year... for used PCs which already had a licensed version of Microsoft... and the people who copy the old license back on for free are "cybercriminals", and the billionaire people who take the $5 from countries where that money could save a child's life from malaria ... It seems to me to be kind of difficult to describe what the "cybercrime" is in the first place, much less reach consensus on whether the count was accurate.
It's not dishonest if you *say that you are excluding them*, and explain why you are doing so. It's not like the whole field of robust statistics doesn't exist. Real statisticians filter data for stuff like people misplacing decimal points, and so on, all the time.
Turn to page 4 of the associated pdf, and look at the figure. 'Chart title'? 'Axis title'? Yeah, this is real professional looking.