Study Lowers Loss Estimates from Cyberespionage

July 22, 2013

Siobhan Gorman

The cost of cyberespionage and cybercrime to the U.S. may reach $100 billion a year, according to a study to be released Monday, casting doubt on earlier estimates that the costs were as much as 10 times higher.

The latest estimate is backed up by some U.S. intelligence analysts, who also believe the figure is closer to $100 billion, according to a former U.S. official familiar with the intelligence discussions. That figure is 1% or less of the U.S. gross domestic product and, for companies, puts cybertheft losses in a category of costs incurred in the course of doing business.

The joint study by the nonprofit Center for Strategic and International Studies and the computer-security firm McAfee reflects major revision of McAfee’s own previous estimate of $1 trillion, which has been cited widely, including by President Barack Obama in a 2009 cybersecurity speech. McAfee is a subsidiary of Intel Corp.

That figure also contrasts sharply with oft-quoted statement by Gen. Keith Alexander, head of U.S. Cyber Command, who last year said that the losses represent “the greatest transfer of wealth in human history.”

This study represented McAfee’s effort to work with CSIS “to develop the most analytically-sound report on the market,” said Tom Gann, McAfee’s vice president for government relations. The company’s previous $1 trillion estimate, he said, had been criticized by economists, and while it “was an honest effort” to extrapolate a figure from surveys, “some of the assumptions were wrong.”

One of the key reasons the study’s estimate is lower than many previous ones is that it takes into account the shifting benefits of cyber theft. “Cyber spying is not a zero-sum game,” the report says. “Stolen information is not really gone.”