Data insecurity and the buildup of offensive cyber capabilities are among the gravest threats to global economic prosperity in the modern era, according to a report by the Atlantic Council, in collaboration with Zurich Insurance Group and the University of Denver’s Frederick S. Pardee Center for International Futures.
The key message is that ICT drives global growth, but it doesn’t come for free.
The findings, in a nutshell: “The pessimists are right in the short term,” said Jason Healey, a Nonresident Senior Fellow in the Cyber Statecraft Initiative at the Atlantic Council’s Brent Scowcroft Center on International Security. The report reveals that the money societies around the world are spending on cybersecurity annually far outpaces the economic gains through new technologies and interconnectivity. But over the longer term, the optimists are correct about the expectation that the benefits will outweigh the costs.
However, short-term costs are on the verge of outweighing the benefits of global connectivity—and are already doing so in some parts of the developed world.
“In a high-income economy like the United States, on an annual basis we’re spending more in cybersecurity costs than we’re getting in benefits to global GDP,” Healey, author of the report, Risk Nexus: Overcome by Cyber Risks? Economic Benefits and Costs of Alternate Cyber Futures, said in a September 10 phone briefing.
But the future isn’t completely bleak. While the Internet’s young, unregulated nature makes its future nearly impossible to predict, the report concludes that that same uncertainty may be the silver lining.
Risk Nexus finds that the future of the Internet, and the fate of the global interconnected market, is best defined by a right set of business strategies and policies on cybersecurity.
“We’ve been able to reinforce that investment in redundancies, incident response, and business continuity on the long term have a much longer benefit than the overall annual, incremental cost,” said Lori Bailey, Global Head of Special Lines at Zurich Insurance Group.
While costs outweigh benefits in the short term, investigators found that the accumulated benefits of being globally connected will outpace costs by as much as $160 trillion by 2030.
The report modeled four hypothetical futures, dubbed “alternate worlds,” to explore variations of governance models and state of cybersecurity and their impact on global economic prosperity.
The most ideal future—“Cyber Shangri-La”—is one where the development of information and communications technology (ICT) is allowed to thrive unhindered, access to a global network is considered a human right, and privacy is respected.
A dystopian “Clockwork Orange” scenario, where Internet trolls and hacktivists are allowed to overwhelm the Internet, is foreseen as the most disastrous for the world economy, with potential losses over global networking in the trillions of dollars. These scenarios alternately represent the most prosperous future and the highest cost of cyber insecurity.
Two other scenarios were also investigated: the “Leviathan” scenario, involving a future Internet dominated by government regulation, and the “Independent” scenario, where non-state actors, such as the technology sector, maintain control over Internet policy.
Along those lines, the report includes a set of recommendations for companies and policymakers alike to aid in developing business and policy-making strategies to ensure the most prosperous future for cyberspace.
Resilience, agility, and a readiness for the worst-case scenario are essential for a business to protect itself from growing risks of attacks, outages, and breaches, the report concludes. But the future of cybersecurity is best left out of government hands, Healey suggested.
“When we look back at the history of cyber conflict and cybersecurity, most of the decisive actions have been done by companies and non-states,” Healey said, adding, “few of the really big cybersecurity problems have ever been solved by any government.”
Barry Hughes, Director of the University of Denver’s Pardee Center and a principal investigator on the report, said the new analysis brings together several different elements of cyber spending to create a broader picture of the costs and benefits of global connectivity.
“There are studies and projects out there that have dealt with the extent of government or private industry spending,” said Hughes, “but there hasn’t really been any type of study before this one that tried to develop an overall typology and bring all of these different pieces together.”
Bailey added: “This is really the first time that there has been a quantitative cost-benefit analysis put around this question about cyber risk.”
Alejandro Alvarez is an intern at the Atlantic Council.