Sizing cybercrime: incidents and accidents, hints and allegations

### Overview At Virus Bulletin 2015, Stephen Cobb of ESET addressed the persistent challenges and pitfalls surrounding the measurement of cybercrime. While the security industry agrees that cybercrime is pervasive and costly, quantifying its exact scale and economic impact remains fraught with methodological flaws, inflated claims, and unreliable statistics. Cobb examines historical attempts to measure crime, critiques prominent cybercrime surveys, and emphasizes why reliable measurement is crucial for risk management, law enforcement funding, and public policy.

### Key Topics - **The Purpose and Need for Measurement**: Despite critiques (such as Ross Anderson's suggestion to stop wasting money measuring cybercrime and fund police instead), measurement remains essential. Decision-makers require justification to allocate resources to law enforcement and to evaluate whether interventions work. Furthermore, frameworks like NIST SP 800 rely on risk management inputs—specifically likelihood of occurrence and magnitude of impact—to prioritize threats. - **Origins and Flaws of Cybercrime Statistics**: High-profile statistics often rely on ungrounded data. Cobb highlights the widely cited $1 trillion cyber attack cost mentioned by General Keith Alexander and President Obama, tracing it back to a McAfee press release calculation rather than empirical research. Early history (e.g., Don Parker's 1976 work, SRI case studies, and John Tabber's 1980 critique) showed how broad definitions like "computer abuse" and persistent rules of thumb (like the 80/20 insider threat rule) distorted public understanding. - **Survey Methodologies and Academic Critique**: Longstanding surveys, such as those from CSI/FBI, CERT/Secret Service/CSO, and PwC, often suffer from small sample sizes (typically 500–600 responses) and voluntary bias. A 2005 Bureau of Justice Statistics study surveyed over 8,000 firms, but 20 million out of 22 million reported incidents were classified merely as "other" and the study was never repeated. In 2003, Ryan and Jefferson highlighted anonymous surveys counting multiple reports from the same victim firm. Later, Florêncio and Herley's paper, *Sex, Lies and Cyber-crime Surveys*, demonstrated how unverified self-reported losses and extreme outliers heavily skew aggregate loss figures. - **Discrepancies in Key Industry Metrics**: Stark contrasts exist between industry reports. For example, the Ponemon Institute estimated the cost per compromised record at $145, whereas the Verizon Data Breach Investigations Report (DBIR) put it at $0.58—a 250-fold difference. Cobb also notes that vendor-backed reports, such as PwC's, keep underlying datasets proprietary despite relying on public agency partnerships like the U.S. Secret Service and CERT.

### Technical Details - **Criminology Frameworks**: Physical property crime statistics (burglary, larceny, auto theft per 100,000 people) in the U.S. dropped significantly after the 1980s and 1990s, raising the empirical question of whether crime declined overall or simply migrated online. - **Dark Figure of Crime**: Criminological concepts show that unreported and undiscovered offenses cannot be completely measured, though broad perception surveys (such as the EU Eurobarometer) offer valuable insight into public behavior and online transaction reluctance. - **Data Sources**: Sources such as the FBI's Internet Crime Complaint Center (IC3) have tracked internet fraud complaints since 2000 showing upward trends, but inconsistencies in data collection and international reporting limit their utility as clean academic datasets.

### Takeaways Cobb proposes a professional code of conduct for information security practitioners and marketers: never cite cybercrime statistics without transparent caveats, always detail the underlying sample and methodology, and clarify what is being measured and by whom. Developing rigorous, objective, non-proprietary data is essential for justifying security investments, directing law enforcement resources, and understanding whether crime has truly declined or merely transitioned into cyberspace.