Spend less on cyber-defense and more on prosecution, says report

Governments would be better served by spending less money in anticipation of cybercrime and more money on catching and punishing the perpetrators, according to research (.pdf) by eight European and American university professors. The paper will be presented June 26 at the Workshop on the Economics of Information Security in Berlin, Germany.

The paper investigates the true costs of cybercrime, noting that available statistics often under- or over-report costs depending on the interests of the parties conducting the studies.

Online tax and welfare fraud cost each citizen a few hundred pounds, euros or dollars a year, find the authors. And with those crimes, the costs of cyber defense and subsequent enforcement are less than the amount stolen, says the paper.

The costs of losses due to payment card fraud are comparable to the defense costs, but "the indirect costs of business foregone because of the fear of fraud, both by consumers and by merchants, are several times higher," write authors.  

The real asymmetry is found with new cyber-frauds, such as fake antivirus scams. These crimes net the actors only tens of cents or pence per year, per target. "In total, cyber-crooks' earnings might amount to a couple of dollars per citizen per year," says the paper. But the indirect cost of defense is at least ten times that.

"The cleanup costs faced by users (whether personal or corporate) are the largest single component," find authors. "Owners of infected PCs may have to spend hundreds of dollars, while the average cost to each of us as citizens runs in the low tens of dollars per year," they add.

Given these findings cybercrime priorities are misplaced, say report authors. Cybercrime carries high indirect and defense costs, but there has been little incentive to pursue cybercriminals because unlike physical crimes, cybercrimes are impersonal and invoke less vindictiveness, they say. What's more cybercrimals are often global, making them difficult to pursue by local police.

For more:
- download the paper, "Measuring the Cost of Cybercrime" (.pdf)

Related Articles:
Reports of cybercrime increase slightly in 2011
More countries to join Convention on Cybercrime, says State Dept. official
China suspected in Operation Shady RAT hacks