Guess What? Most Cybercrime 'Losses' Are Massively Exaggerated As Well

Studies

from the because-they're-not-losses dept

We’ve talked about exaggerations in “losses” due to infringement for many years. However, we’ve also discussed how claims of “losses” due to so-called “cybercrime” are also massively inflated. It appears that others are figuring this out as well. The NY Times has an op-ed piece from two researchers, Dinei Florencio and Cormac Herley, highlighting how all the claims of massive damages from “cybercrime” appear to be exaggerated — often by quite a bit:

One recent estimate placed annual direct consumer losses at $114 billion worldwide. It turns out, however, that such widely circulated cybercrime estimates are generated using absurdly bad statistical methods, making them wholly unreliable.

Most cybercrime estimates are based on surveys of consumers and companies. They borrow credibility from election polls, which we have learned to trust. However, when extrapolating from a surveyed group to the overall population, there is an enormous difference between preference questions (which are used in election polls) and numerical questions (as in cybercrime surveys).

For one thing, in numeric surveys, errors are almost always upward: since the amounts of estimated losses must be positive, there’s no limit on the upside, but zero is a hard limit on the downside. As a consequence, respondent errors — or outright lies — cannot be canceled out. Even worse, errors get amplified when researchers scale between the survey group and the overall population.

This is pretty common. In the first link above, we wrote about how a single $7,500 “loss” was extrapolated into $1.5 billion in losses. The simple fact is that, while such things can make some people lose some money, the size of the problem has been massively exaggerated. As these researchers note, this kind of thing happens all the time. They point to an FTC report, where two respondents alone provided answers that effectively would have added $37 billion in total “losses” to the estimate.

This doesn’t mean that the problems should be ignored, just that we should have some facts and real evidence, rather than ridiculous estimates. If the problem isn’t that big, the response should be proportional to that. Unfortunately, that rarely happens. In fact, combining this with the recent ridiculous stories about the need for “cybersecurity,” perhaps we can start to estimate just how much of an exaggeration in FUD the prefix “cyber-” adds to things. I’m guessing it’s at least an order of magnitude. Combine bad statistical methodology with the scary new interweb thing, and you’ve got the makings of an all-out moral panic.

Filed Under: cybercrime, errors, exaggeration, fud, losses