The press is awash with stories about McAfee's experts noting that losses are as high as a trillion dollars. Mr. DeWalt, CEO of McAfee, notes as much in this blog post:
There is a problem here. I can't find the word "trillion" anywhere in the actual report, which I took the trouble to download and read. In addition, I don't find anything in the press that asks how these numbers were derived.
Here's what I think. The report shows that the companies surveyed lost a combined $559 million and I assume McAfee is estimating based on these survey results. Assuming the companies are a representative sample of the world, then McAfee is suggesting that the companies surveyed represent .05% of all companies.
A trillion is a lot of money. Let's run a number or two:
- Amrit points out that the U.S. GDP is around $14 trillion.
- In 2007, the GAO said that cybercrime cost the U.S. about $117 billion for about 1% of U.S. GDP.
- The world's GDP is estimated somewhere between about $45 trillion and $75 trillion. 1% of that is $750 billion on the high side, which at this level isn't that far off from the $1 trillion.
It isn't necessarily too difficult to believe… but it sure would be nice to get a cleaner methodology and set of definitions down.