Report Challenges Assumptions On IP Valuation And Cybercrime

A new report released in the United States assesses assumptions and seeks to spark new thinking on the economic impact of cybercrime and cyberespionage, including the valuation and losses of intellectual property.

The report [pdf], The Economic Impact of Cybercrime and Cyberespionage, was published by cybersecurity company McAfee and the Center for Strategic and International Studies (CSIS). The authors are James Lewis, director and senior fellow for technology and public policy at CSIS, and Stewart Baker of CSIS, a partner at Steptoe & Johnson LLP.

The report seeks empirical data and evidence of the impact and finds that many existing assumptions are overly simplistic or just wrong.

“Intellectual property is hard to value in the abstract,” they said. “Estimates are often based on anecdotes or surveys.” They noted that “cyber spying is not a zero-sum game. Stolen information is not really gone. Spies can take a company’s product plans, its research results, and its customer lists today, and the company will still have them tomorrow.”

One assumption is that pirated intellectual property is automatically equal to the value of the research and development that went into it. In fact, there are more factors, they said.

“The actual value of intellectual property can be quite different from the research and development costs incurred in creating it,” they said. “If a company spends a billion dollars on a product that fails in the market, and a foreign power steals the plans, the loss is not a billion dollars but zero – the invention’s market value.”

Also, the recipient country must have the capability to produce a competing product in a reasonable time, and the time varies by sector.

“There are proponents of government-funded research who argue strenuously, albeit self-interestedly, that a dollar spent on research produces more than a dollar of economic benefit,” the report said. “If this is true, the multiplier effect for cyber espionage could be far greater if the research is acquired for free. The loss of a dollar of IP due to cyber espionage could produce more than a dollar of benefit for a foreign competitor. … But this is uncertain ground, as the estimation of a multiplier effect remains in dispute in economic literature.” It could be that the benefit is in fact worth only 80 cents, they noted.

There also can be opportunity costs, they said. “One opportunity cost usually not considered in estimating the damage of cyber crime is the effect on innovation in the receiving country,” the report said. “The theft of intellectual property is a transfer of wealth and knowledge from the victim country to the recipient, improving its ability to produce goods at a lower cost, but it is also likely that this creates disincentives in the recipient country for expanding its own innovative capabilities.”

Meanwhile, theft of confidential business information, or trade secrets, can be much more damaging and more quickly. “There is no delay in monetizing stolen confidential business information. Theft of oil exploration data, sensitive business negotiation data, or even, insider stock trading information can be used immediately by the acquirer,” they said. “The damage to individual companies can be great.” But again, valuation is very difficult.

While the report stopped well short of suggesting that theft of intellectual property has net benefits for victim nations, it did suggest that it can be a boon for receiving nations that have the ability to convert the stolen know-how into competing products with the originals.

Finally, the authors tied the real value to trade and economic policy. In cyber espionage, “The victim company still has access to the intellectual property. It has not lost the ability to make the product; what has in fact happened is that it now faces a new competitor,” they said. “The risk of this competition is increased if the new foreign competitor has access to other government subsidies that allow it to sell at a lower price or if it is supported in its domestic market by barriers that hamper outside companies from competing. We need, in our assessment of the cost of cyber espionage, to put it in the larger context of national economic and trade policy to understand the possible consequences.”

The authors are planning a second report. “[T]he heart of the matter is the effect on trade, technology, and competitiveness,” the new report said. “Our next report will provide a range of estimates, using a variety of techniques, models, and assumptions, but it will also assess these larger and more consequential effects. We plan in the final report to use data from other nations and refine our estimates of loss.”