The Atlantic Council, in collaboration with Zurich Insurance Group and the Pardee Center for International Futures, released a report today that examines the economic impact of cyber costs versus the benefits of interconnectivity under an array of complex scenarios. Written by Jason Healey of the Atlantic Council and Barry B. Hughes of the University of Denver, the report titled, Risk Nexus: Overcome By Cyber Risks?, uses economic modeling tools to gain an understanding of just how cyber costs and benefits affect national GDP over time – and what businesses and policymakers can do. The report is the second of the collaboration and follows their 2014 report Beyond Data Breaches: Global Aggregations of Cyber Risk, which explored the cascading and systemic cyber shocks, similar to the financial crisis of 2008.
“As far as we can tell, no one has ever examined the key question of how much the costs of cybersecurity problems compare to the economic benefits of being connected,” Jason Healey, co-author of the report and Senior Fellow at the Atlantic Council, noted. “Through research, modeling, and thinking about how the future might be better, worse, or just different, we can now put answers to such questions.”
“This report does an excellent job at creating potential scenarios that provide multiple perspectives from which to view the future of cyber risk and its economic impact,” said Cecilia Reyes, Zurich’s Chief Risk Officer. “It accurately exhibits that the economic impact of technology is dynamic and its associated risks can be predicted and planned for – and reminds us of the importance of understanding those impacts and the actions we need to take.”
The unpredictable future of cyber development is unlikely to resemble past circumstances the report cedes. In order to deal with this uncertainty, it explores four alternate scenarios based on two major uncertainties: The dominance of governments vs the private sector in matters of cyber security; and whether risks will be largely manageable or become unmanageable to the point that stable and secure connectivity becomes a luxury good.
“Cyber Shangri-La,” a best cased scenario outcome from the report details a possibility where technology booms are driven and supported by strong cybersecurity and the subsequent annual economic benefits result in a potential cumulative net global gain of $190 trillion by the year 2030; about $30 trillion higher than that of the current projection case.
On the opposite end of the spectrum, the most undesirable future scenario, called “Clockwork Orange Internet,” envisions a state of perpetual cybercrime and cyber-warfare that ultimately creates a negative impact of 2.5 percent of global GDP. While this net loss is still not enough to drag down the cumulative benefits to a point where risks outweigh the benefits, if cybersecurity falls dramatically behind, leading to a future of non-stop nation-state cyber attacks and hacks against increasingly vulnerable critical infrastructure, the world could miss out on $90 trillion relative to its current trajectory.
Along with the potential future scenarios that the report outlines, it provides specific recommendations to executives who are responsible for creating their companies’ cybersecurity protocols, as well as policymakers that have a hand in shaping national cybersecurity laws.
Among the recommendations for businesses, the report calls for a continued focus on resilience, the ability to bounce back from disruptions to make them as short and limited as possible. This includes measures such as building redundancy, incident response and business continuity, and scenario planning and exercises; and considering worst-case cyber futures when looking at business strategies.
“The focus for businesses in an interconnected world should be on how to bounce back from cyber risk events. It is very clear that businesses that want to protect themselves from cyber risks must adopt a mindset of resilience,” said Ms. Reyes.
For policymakers, the report recommends that governments work with the private sector for “next generation” solutions, with priority given to investments in overall stability, governance and resilience. “Aim for what is realistically attainable – a relatively secure internet and a partnership between the State and private sector on control.” This is known in the report as “a strategy of dynamic stability” and requires a collaborative approach between public and private sectors. For example, on systemic cyber risk, the earlier Beyond Data Breaches report by Atlantic Council and Zurich Insurance Group borrows an idea from Microsoft, discussing the possibility of a G20+20 group to handle cyber security issues.
Reyes added, “To protect business and communities from cyber risks and leverage the benefits of the cyber world with confidence, the private and public sectors need to work together based on an in-depth understanding of the nature and evolution of the underlying risks.”
“The Atlantic Council, in conjunction with Zurich Insurance Group and the Frederick S. Pardee Center for International Futures, has done really groundbreaking work in examining how cyber costs and benefits might affect global economies in the years to come,” said Barry Pavel, Vice President, Arnold Kanter Chair, and Director of the Brent Scowcroft Center on International Security. “The report’s recommendations offer a useful road map for policymakers, the private sector, and the general public alike on how to reap the benefits of the global Internet and steer ourselves towards the most rewarding cyber futures.”
The full report and recommendations are available online at http://www.atlanticcouncil.org/cyberrisks. Interested parties also can follow discussion of the report on Twitter at @ACScowcroft, @PardeeCenterIFs, @Zurich, and @ZurichNAnews, using #ACCyber.
For more details on the model, data, and process used in this report, please see and use the IFs model at http://www.pardee.du.edu, find the companion report produced by the Denver University’s Pardee Center for International Futures at http://www.pardee.du.edu/cyber-benefits-and-risks-quantitatively-understanding-and-forecasting-balance, and use the dashboard for simplified computer or mobile device analysis of our forecasts at http://www.ifs.du.edu/ifs/frm_CyberDashboard.aspx.
# # #
Atlantic Council is a nonpartisan organization that promotes constructive US leadership and engagement in international affairs based on the central role of the Atlantic community in meeting today’s global challenges. For more information, please visit AtlanticCouncil.org and follow us on Twitter @AtlanticCouncil.
Zurich Insurance Group (Zurich) is a leading multi-line insurer that serves its customers in global and local markets. With more than 55,000 employees, it provides a wide range of general insurance and life insurance products and services. Zurich’s customers include individuals, small businesses, and mid-sized and large companies, including multinational corporations, in more than 170 countries. The Group is headquartered in Zurich, Switzerland, where it was founded in 1872. The holding company, Zurich Insurance Group Ltd (ZURN), is listed on the SIX Swiss Exchange and has a level I American Depositary Receipt (ZURVY) program, which is traded over-the-counter on OTCQX. Further information about Zurich is available at www.zurich.com.
In North America, Zurich is a leading commercial property-casualty insurance provider serving the global corporate, large corporate, middle market, specialties and programs sectors through the individual member companies of Zurich in North America, including Zurich American Insurance Company. Life insurance and disability coverage issued in the United States in all states except New York is issued by Zurich American Life Insurance Company, an Illinois domestic life insurance company. In New York, life insurance and disability coverage is issued by Zurich American Life Insurance Company of New York, a New York domestic life insurance company. For more information about the products and services it offers and people Zurich employs around the world go to www.zurichna.com. 2012 marked Zurich’s 100-year anniversary of insuring America and the success of its customers, shareholders and employees.
© 2015 Zurich American Insurance Company
About the Frederick S. Pardee Center for International Futures
The Frederick S. Pardee Center for International Futures is based at the Josef Korbel School of International Studies at the University of Denver. The Pardee Center specializes in helping governments, international organizations, and private sector organizations frame uncertainty and think strategically about the future. The Pardee Center focuses on exploring past development trends, understanding the complex inter-relationships that drive development outcomes, and shaping policies that communicate and achieve a clear development strategy. The core tool used to achieve these aims is the International Futures (IFs) forecasting model. For more information, or to download or use the IFs tool online, please visit www.pardee.du.edu and follow us on Twitter @PardeeCenterIFs.