Slashdot Mirror
The $1 Trillion Cybercrime Myth
wiredmikey sends this excerpt from SecurityWeek:
"A recent article on ProPublica dissected two commonly quoted figures about cybersecurity: $1 trillion in losses due to cybercrime itself and $388 million in IP losses for American companies. Both figures have been scrutinized and challenged by many, and viewed as typical security vendor FUD. ... The $1 trillion figure is attributed to anti-virus vendor McAfee, while the $388 million in IP losses number belongs to Symantec's Norton division. According to ProPublica, 'The report was not actually researched by Norton employees; it was outsourced to a market research firm, StrategyOne, which is owned by the public relations giant Edelman.' The problem with both of these figures — $1 trillion and $388 million — is, as Microsoft researchers pointed out earlier this year in a report fittingly titled 'Sex, Lies, and Cybercrime,' they are studded with outliers. In one example they cite that a single individual who claims $50,000 losses, in an N = 1000 person survey, is enough to extrapolate a $10 billion loss over the population. In another, one unverified claim of $7,500 in phishing losses translates into $1.5 billion over the population. The Microsoft researchers concluded: 'Are we really producing cyber-crime estimates where 75% of the estimate comes from the unverified self-reported answers of one or two people? Unfortunately, it appears so. Can any faith whatever be placed in the surveys we have? No, it appears not.'"
Hah, won't get it with your logged in account now will you!
http://xkcd.com/605/
The REAL crime is the theft of our pensions for 'too big to fail'. This other crap is some kind of diversion.
This is what teaching plug and chug math reduces a population to...
Reread and try again.
The number will be accurate, assuming we accede to Dr. Evil's demands. Which we never do.
i once lost 1.21 jiggawatts in a time travel scam...
Obviously, the $1 trillion figure is made up. The real figure is more likely in the tens of millions, maybe a little higher, but probably even less than that. The thing is, and the reason people can get away with citing a number that ridiculous, is because it is so large. People simply have no concept of scale that large. You can't hold a number that large in your head, not insofar as it applies to something real. As a pure number, sure, but not as a number of something. The human brain can comprehend tens, even thousands: but trillions are simply too large for the mind to hold, which means that as a talking point, a couple billion is about the same as a trillion for your average human: it basically just ends up meaning "a really really really lot."
If you approach rebuking the number as "well what should the number really be", you aren't countering the key point behind those figures, which is simply to express a massive quantity. If you respond by saying the number should really be in the millions, people will usually scoff at you ("no way McAfee could have been that wrong") or at best simply take the average of the two numbers, which still yields a massive number in their head. The point of such studies isn't to be scientific: it's to be rhetorical. So ultimately, to the people citing that number, it doesn't matter in the slightest if it is true, or how it was a arrived at. All it matters is they have a really big number to cite that they can say is "scientific" or "proof that we need to take action."
"None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
Throw that one guy out as a strange "outlier" and the number is zero. That is more believeable.
Lies, damn lies and statistics. Grarbage in garbage out.
If it was only one person out of a full one thousand sample then the sample size is way to small to be statistically significant. Whoever did the statistical analysis should be fired. With that low a report rate you don't know it is 1/1e6 or 1/1e9 and you just got unlucky in the sample.
It is not only cyber-crime estimates that are coming from one or two self-reported unverified people. All the economy related numbers are made up, reverse engineered, adjusted to fit the narrative of the political power.
1 Trillion USD losses to cyber-crime? So taking the 15 Trillion GDP figure at face value (which you must not make mistake of doing), it means that over 6% of the GDP is lost due to all this 'cyber-crime'. 6%. The entire USA agriculture sector is 4% of the reported GDP.
MY OTHER COMMENTS
The RIAA and MPAA both use similar voodoo-comic book math techniques to justify their "losses" to cybercrime (illegal downloads).
Fifty watts per channel, baby cakes.
Security software vendors exaggerate business' losses due to cybercrime! Who would've thought....?
It's in Microsoft's interest to underestimate the losses from cybercrime, just as it's in McAfee's and Symantec's interest to overestimate it.
"Up to $1 Trillion in losses[1] and "$388 million in IP losses[2]"
[1] - someguysblog.com
[2] - foxnews.com
Join the Slashcott! Feb 10 thru Feb 17!
3D printing will not replace manufacturing
3D printing is not Star Trek level technology
Manned space "exploration" is a joke
We will never colonize the stars, the galaxy or even the Moon
OK nerds?? Grow up.
Your summary of " $388 million in IP losses for American companies" was actually $388 Billion, and it was in total cybercrime losses in the USA (including time lost due to outages/delays)
"Symantec [placed] cybercrime’s [US] total cost, factoring in time lost, at $388 billion".
You keep making errors like that and ProPublica is going to come after YOU next.
Wow, you aren't very smart are you?
Gee, why don't we just outsource calculations like these directly to Wall Street, or Phillip Morris, or R.J Reynolds?
Forward! -- Emperor Norton, 2012
Something like, $1 trillion with a 90% confidence interval of [$1000, $2 trillion] would have been completely honest :-)
(this is the kind of confidence interval you would get using the bootstrap method on the kind of data they describe, i.e. data with one huge outlier).
If they are including spyware/virus in their "cybercrime" definition, the numbers make sense.
Consider this:
I've got a customer who had two of their machines taken out by viruses. At a billable rate of $180/hour, it took approximately 10-12 hours to try the cleaning solutions (which of course did not work) and then reformat and reinstall Windows and the five-million updates to updates to updates. So that's just two occurrences in one week costing the client $4,000.00 for actions due in large part to whoever it was that sent the virus to them in the first place (bogus PDF attachment). This was just for this week. Annually they probably have 3-4 incidents like this per month at a company of just over 50 people. You could point the finger at the bonehead who opened the attachment or the non-functioning antivirus software, but the root cause was the sending of the virus in the first place. Doing the math, that's $2000*4*12 or $96,000.00 not including the costs of the antivirus software and other preventative measures which need to be taken.
Just the annual cost for this one company alone could justify extrapolating the seemingly over-inflated costs of cybercrime.
-- L8R, guitardood
I work for a company that analyzes transactions and detects account takeovers and thefts at banks. Banks call us when they suffer a loss or series of losses. When they call us these losses are typically over $300,000 and the largest attack we've seen is for about $1.5M. We do NOT deal with the biggest banks, mostly regional and local banks. In case you didn't know, there are about 15,000 banks and credit unions in the U.S., so there are a lot of targets for criminals. Not all these banks have assets worth stealing, and not all of them are even on line. By our estimate, roughly 6,000-8,000 of these banks are sufficiently interesting and available to be targets of criminals.
So can I give you a real number? No, because we don't deal with the biggest banks and we also don't talk to all 15,000 banks. But I can tell you that having worked with several hundred banks, these so-called cybercriminals are stealing a lot of money. Yes, true, the banks that call us self-select, so I am NOT saying that every bank is losing $1M/year. But we do see hundreds of banks with losses that seem to indicate that the criminals are stealing tens of millions, and possibly hundreds of millions of dollars. FWIW.
P.S. They are also successfully stealing a lot of money from brokerage houses, so that gets added to their haul, also.
... sheesh, they could have found a guy on Craigslist that would have immediately jumped to the "gotta reinstall windows" solution for $40 a pop.
"Just the annual cost for this one company alone could justify extrapolating the seemingly over-inflated costs of cybercrime."
No, your overinflated $180/hr billing rate is as much to blame for this one as does milking the client for money. Seriously, as someone that does AV cleanup as part of my security duties for a large global company I gotta call bullshit on your 10-12 hrs. You were looking at 2 hrs tops to try a number of different solutions before throwing in the towel.
Fifty watts per channel, baby cakes.
RIAA have this science down pat. I mean they sued Limewire for 51$ Trillion dollars! (insert pinky)
All these companies come up with BS numbers to push their own agenda. Oh and you can bet every study done by the MPAA and RIAA, were all done by "independent" sources... I mean I recall a number used for piracy being used in Canadian lobby, that was so self refreential it was neigh impossible to figure out where it came from. When they finally did, it was an unsourced, no details presentation, done by RIAA themselves, pass on from them to others, to studies, etc...
Just like the Academy of Tobacco Studies, the Moderation Council, and SAFTY were all unassoicated with their terrible industry overlords...
Tell this company I will guarantee virus free computers for 40k a year. Any virus they get I will remove and fix the machine, guaranteed! They save $56k a year and I get a nice part time job.
50 people and they have 3-4 incidents a month? Sounds like they need to fire you and hire a real IT person - somebody that knows what they are doing and charges a decent rate.
You could point the finger at the bonehead who opened the attachment or the non-functioning antivirus software, but the root cause was the sending of the virus in the first place.
If you remove the person who sent the virus someone else will send a virus and the problem remains. If you remove the retard who opened the attachment the problem is solved.
... enough to show me just how bad you are at your job. Your industry average of $250/hr is complete bs; a number pulled out of your ass to justify raping this company due to their own ignorance. I understand, it's your cash cow and you will do anything to protect your interests, but right now you look like a used car salesman from the 80's; lying to the customer just to make a buck.
Fifty watts per channel, baby cakes.
I'll put that in my morning memo: "Please Note: An anonymous coward on the internet will be glad to replace my 20 years of working with your company and 30 years of experience with setups exactly as yours with his own home spun bargain basement virus repair. I'll gladly repair them when he is finished".
-- L8R, guitardood
Agreed! Unfortunately not my call.
-- L8R, guitardood
... no matter what you say, or how you try to justify it, you're still giving it to them with no Vaseline or even so much as a reach around or peck on the cheek. The only reason you're still in business is because you found a sucker of a company and are milking them to make your BMW payments.
One can get an H1B Indian consultant to stand up an SAP BobJ instance on SUSE 10 for around $160/hr right now and he/she will sit in your office to do the job, you can get them for that much to do a wide range of things from writing your in-house applications to supporting and securing your networks. Companies like Robert Half, Modis, or Experis don't even bill remotely that much for a windows guy to come onsite for basic PC tech work (which is precisely what you're doing), I'll say $50-$60/hr where the consultant doing the work MIGHT get $20/hr of that.
Nope, you're pretty much a sheister that makes honest consultants look bad.
Fifty watts per channel, baby cakes.
A lot of what you have described could be mitigated with open-source software. A good consultant would have made those recommendations.
Fifty watts per channel, baby cakes.
Microsoft is calling others out on inflated numbers? Talk about the pot calling the kettle black. In 2009 people viewed BSA's $53 Billion Lost to Piracy claim with a healthy dose of skepticism. So which companies are in BSA? Oh look! Microsoft, Symantec and McAffee (among others).
Maybe McAfee, which TFA credits with the Trillion Dollar figure, is just applying what they've learned from their dealings with Microsoft and BSA.
http://www.nytimes.com/2012/04/15/opinion/sunday/the-cybercrime-wave-that-wasnt.html April 15th of this year.
Fugue for Aaron Swartz
Calling me a troll does nothing to change the fact that you're robbing this poor company blind.
Fifty watts per channel, baby cakes.
. . .a UK citizen, last I heard she was with the state gov't of Colorado, who pulled a hundreds of billions of dollars figure out of her butt while she was at some talk in Saudi Arabia --- pure BS as she was and probably still isn't -- at her age -- any type of computer science industry expert, etc. Frequently repeated, with no validation nor verification whatsoever --- typical of the Amerikan non-media.
McAfee and Symantec Norton are the source of maleware and virus programs!
They must be in order to benefit. Its their Business Model!
LOL