January 19, 2006 2:20 PM PST

Computer crime costs $67 billion, FBI says

Dealing with viruses, spyware, PC theft and other computer-related crimes costs U.S. businesses a staggering $67.2 billion a year, according to the FBI.

The FBI calculated the price tag by extrapolating results from a survey of 2,066 organizations. The survey, released Thursday, found that 1,324 respondents, or 64 percent, suffered a financial loss from computer security incidents over a 12-month period.

The average cost per company was more than $24,000, with the total cost reaching $32 million for those surveyed.

Often survey results can be skewed, because poll respondents are more likely to answer when they have experienced a problem. So, when extrapolating the survey results to estimate the national cost, the FBI reduced the estimated number of affected organizations from 64 percent to a more conservative 20 percent.

FBI computer crime chart

"This would be 2.8 million U.S. organizations experiencing at least one computer security incident," according to the 2005 FBI Computer Crime Survey. "With each of these 2.8 million organizations incurring a $24,000 average loss, this would total $67.2 billion per year."

By comparison, telecommunication fraud losses are about only $1 billion a year, according to the U.S. Secret Service. Also, the overall cost to Americans of identity fraud reached $52.6 billion in 2004, according to Javelin Strategy & Research.

Other surveys have attempted to put a dollar amount on cybersecurity damages in the past, but the FBI believes its estimate is the most accurate because of the large number of respondents, said Bruce Verduyn, the special agent who managed the survey project.

"The data set is three or four times larger than in past surveys," he said. "It is obviously a staggering number, but that is the reality of what we see."

Responding to worms, viruses and Trojan horses was most costly, followed by computer theft, financial fraud and network intrusion, according to the survey. Respondents spent nearly $12 million to deal with virus-type incidents, $3.2 million on theft, $2.8 million on financial fraud and $2.7 million on network intrusions.

These figures do not include much of the staff, technology, time and software employed to prevent security incidents, Verduyn said. Also, losses to individuals who are victims of computer crime or victims in other countries are not included, he said.

The FBI's next fiscal year, for which budgets must be reviewed and approved, begins Oct. 1. Protecting the U.S. against high technology crimes is third on the agency's list of priorities.

Defenses in place
Survey respondents use a variety of security products for protection. Antivirus software is almost universally used, with 98.2 percent of respondents stating they use it. Firewalls follow in second place, with 90.7 percent, and anti-spyware and antispam are each used by about three-quarters of respondents, according to the survey.

The results mean that close to one in 10 organizations does not have a hardware or software firewall. Or perhaps they don't know they have one--the Windows Firewall in Windows XP, for example. "Some are very small businesses that should have that technology, but they don't," Verduyn explained.

Biometrics and smart cards--both relatively new security technologies--were used only by 4 percent and 7 percent of survey respondents, respectively. Intrusion prevention or detection systems were used by 23 percent and VPNs, or virtual private networks, by 46 percent.

Organizations were attacked despite use of security products, with nine out of 10 respondents saying they experienced a security incident. In fact, the most common attacks aligned with the most commonly used defenses. Computer viruses, worms or Trojan horses plagued 84 percent of respondents, 80 percent reported spyware trouble, and 32.9 percent said attackers were probing their systems using network port scans.

Not all threats came from outside the organization. More than 44 percent of the survey respondents reported intrusions from within the company. "Companies may be unaware of the internal potential for computer security incidents," Verduyn said. He recommends applying policies and procedures to thwart attacks from the inside.

The FBI surveyed companies in Iowa, Nebraska, New York and Texas. Companies older than three years, with more than five employees and with more than $1 million in revenue were asked to participate. Survey participants were asked to provide their responses by the end of July 2005, with their answers covering the previous 12-month period.

5 comments

Join the conversation!
Add your comment
OK kids...
Get your total cost of ownership scorecards out, your calculator
warmed up and ready, and start adding.

And by "kids," what I really mean is corporate IT management; to
the extent that IT and management can be used in the same
sentence when accounting for a genuine contribution towards
overall company interests.
Posted by Terry Murphy (82 comments )
Reply Link Flag
Almost the amount MSFT makes EACH YEAR selling you buggy software
It's odd that it costs everyone $67 billion and Microsoft makes almost that much each year selling you their software that *CAUSES* this cost of $67 Billion.

About time to make MSFT pay $1 billion PER VIRUS INCIDENT or exposed vulnerability *directly* into the national treasury. That would at least offset the cost to the country and make them more responsible.

If a bank left their door unlocked, their cameras off, and your safedeposit box open overnight and someone stole it, do you think YOU should be paying for their mistake? I think not. The bank should pay ALL clients for their mistakes. Same rules should apply to software.
Posted by Anon-Y-mous (124 comments )
Reply Link Flag
Why the world puts up with all this? Rather just use a free online desktop
I cannot understand why we put up with this and having to download and update and reboot every time we connect to the net, the online desktop offered free at <a class="jive-link-external" href="http://www.cosmopod.com" target="_newWindow">http://www.cosmopod.com</a> does away with all this can someone now give them the $67 billion so they can prosper.
Posted by iqula (59 comments )
Reply Link Flag
For $67 Billion you'd think ...
that people would abandon Windows for a more secure OS like
Linux or OS X. But very, very few will.

Just goes to show you that P.T. Barum was right: "There's a
sucker born every minute".
Posted by rcrusoe (1305 comments )
Reply Link Flag
Billions in Crime Need A Fast Block
I hear that there is a patent on Single Use Credit Card Number ID in the USA and whomever uses that is going to really grow fast if they have the right marketing plan in the US because the US FFIEC is by fiat requiring that everyone use 4 factor authentication that leads to that product, a single use ID either in tokens or in offline devices. Basically the time is now and we the consumers are watching.
Posted by Iohagh (54 comments )
Reply Link Flag
 

Join the conversation

Add your comment

The posting of advertisements, profanity, or personal attacks is prohibited. Click here to review our Terms of Use.

What's Hot

Discussions

Shared

RSS Feeds

Add headlines from CNET News to your homepage or feedreader.