Why does no one know the cost of computer crime?

Question

What will be an ideal response?

Answer 1

For one, there are no standards for tallying crime costs. Does the cost of a denial-of-service attack include lost employee time, lost revenue, or long-term revenue losses due to lost customers? Or, if an employee loses a $2,000 laptop, does the cost include the value of the data that was on it? Does it include the cost of the time of replacing it and reinstalling software? Or, if someone steals next year's financial plan, how is the cost of the value that competitors glean determined?
Second, all the studies on the cost of computer crime are based on surveys. Different respondents interpret terms differently, some organizations don't report all their losses, and some won't report computer crime losses at all. Absent standard definitions and a more accurate way of gathering crime data, we cannot rely on the accuracy of any particular estimate. The most we can do is look for trends by comparing year-to-year data, assuming the same methodology is used by the various types of survey respondents.