Cyber Benefits and Risks: Quantitatively Understanding and Forecasting the Balance Extended Project Report from the Frederick S. Pardee Center for International Futures Josef Korbel School of International Studies University of Denver www.pardee.du.edu September 2015 Barry B. Hughes, David Bohl, Mohammod Irfan, Eli Margolese-Malin, and José Solórzano In project collaboration with and the Table of Contents Executive Summary 4 Conceptualizing Benefits and Costs 4 Using the IFs System for Analysis 4 Background Research Foundations 5 Forecasts and Findings 9 Conclusion 11 A Final Note on Study Contributions 12 1. Introduction: Understanding and Anticipating Change in the Benefits and Costs of Cyber Technology 13 2. ICT and Cyber Development Indices 18 Indices Replicated in the IFs Forecasting System 18 ICT Development Index 18 Global Cybersecurity Index 19 Additional Indices of Importance in Cyber Security Analyses 21 Digitization Index 21 Digital Economy Ranking Index 21 Networked Readiness Index 22 3. Benefits 23 Competing Schools of Thought on Economic Benefits 23 Pessimism Versus optimism concerning ICT’s economic production impacts 23 ICT as a general-purpose technology 25 ICT’s Economic Impact: The Production Side 26 ICT as a growth sector in the economy 26 ICT investment and capital services 29 ICT and multifactor productivity 32 Comparing the Productivity Impacts of GPTs: Steam, Electricity, ICT 33 Variation in ICT Impact across Time/Pervasiveness and Countries 36 Drivers of variation in ICT impact: ICT (especially broadband) pervasiveness 36 Drivers of variable ICT impact: Beyond PCs and broadband 39 Drivers of variable ICT impact: Country development level 41 Consumer Surplus 42 Consumer surplus forecasts 46 Summary of Knowledge Concerning Cyber Risk Benefits: Modeling Implications 47 4. Costs 49 Spending on risk mitigation 49 The cybersecurity industry 50 National cyber defense spending 51 Cyber insurance 53 General comments on cyber security spending 53 Adverse Cyber Events: Micro Analysis 53 The cyber system itself 54 Beyond the internet 55 The evidence from actual events 56 Model-based analyses 57 Cyber Risk Extended Report 2 Very large-scale events 59 Adverse Cyber Events: Macro Analysis 60 Defining motivations, actions, actors and targets 60 Estimating probability of adverse cyber events 63 The debate around cyberwar occurrence/probability 64 General comments on probabilities of adverse events 65 Measuring costs of adverse events 66 Bringing probabilities and costs together: The Cyber Risk Matrix 69 Opportunity Costs 72 Summary of Knowledge Concerning Cyber Risk Costs: Modeling Implications 73 Comparing the Costs and Benefits of ICT/Cyber 74 5. Structure of Cyber Risks and Benefits Representation in IFs 77 Forecasting Cyber Risks and Benefits 77 ICT or Cyber Pervasiveness 78 Security Spending and Security Levels 79 Adverse Event Probabilities and Costs 81 Cyber Contributions to Economic Growth (Productivity) and Possible Opportunity Costs of Underutilizing ICT 84 Cyber Benefits: Consumer Surplus 88 Cyber Benefits: ICT Production Sector Growth 89 ICT/Cyber Total and Cumulative Costs and Benefits 90 Cyber Benefits and Costs: Forward Linkage to Economic Productivity 91 6. Forecasting of Cyber Benefits and Risk-Related Costs 93 Base Case Analysis 93 ICT/cyber pervasiveness 93 ICT/cyber benefits 94 ICT/cyber costs 96 Comparing cyber benefits and costs 100 Scenarios of Cyber Benefits and Costs: Foundational Analysis 103 Scenarios of Cyber Benefits and Costs: Defining a Scenario Space 107 Scenarios of Cyber Benefits and Costs: Exploring the Alternative Futures 109 7. Conclusions 115 Acknowledgments 116 Bibliography 117 Works Cited 117 Additional Works Consulted 124 Appendices 126 Appendix A: The Cyber Risk Dashboard Concept (Final May Differ Somewhat) 126 Appendix B: Productivity Impacts of ICT 129 MFP Physical Capital Equations 130 Appendix C: Cyber Risk Form in IFs Stand-Alone Model 131 Cyber Risk Extended Report 3 Executive Summary What is the balance of economic benefits and costs conferred upon societies by cyber technologies, also designated here as information and communication technologies (ICT)? And how might that balance change in coming years? This report, prepared as a quantitative foundation for work sponsored by the Zurich Insurance Group, addresses these questions by assessing the current pattern of benefits and costs in countries and globally, mapping their apparent trajectory in recent years, and exploring their possible futures through 2030. Conceptualizing Benefits and Costs Conceptually, the economic benefits from cyber technologies include the often rapid relative growth rates of cyber-producing sectors, the contributions to production, productivity (and therefore growth across the broader economy) from investments in cyber technologies, and consumer-captured surpluses from cost reductions as the technologies develop (i.e., surpluses not represented in standard economic measures such as gross domestic product). Costs include the spending required to defend against adverse cyber events stemming from hacking, cybercrime, cyber espionage, and cyber terror or war, the costs of such events themselves, and opportunity costs—the potential economic benefits not realized because of forgone use of cyber-technologies in fear of such events.1 All of these benefits and costs obviously depend on the changing technological landscape and decisions made by households, organizations including corporations, and governments with respect to cyber security, its use and abuse. Using the IFs System for Analysis Research for this report uses specialized cyber benefit and risk extensions to the existing International Futures (IFs) forecasting system, based at the Frederick S. Pardee Center for International Futures at the University of Denver. The IFs system includes highly integrated, long-term models of demographics, economics, education, health, energy, agriculture, governance and other systems that together provide a foundation for addressing the questions motivating this project. In addition to augmenting the existing modeling system so as to represent ICT/cyber pervasiveness and the various categories of benefits and costs, this project is building a new, stand-alone form or dashboard within the IFs system to support our analysis and that of others. 1 Countries that lack the human capital and infrastructure capacity to fully deploy cyber technologies can also suffer from such opportunity costs. Cyber Risk Extended Report 4 Background Research Foundations Among the findings of our research with respect to cyber benefits are: Estimates of the share of the Internet economy in the total economy vary from just over 1% of GDP in some countries (e.g. Indonesia at 1.3% and Brazil at 1.5%) to about 8 percent of GDP in others (e.g. the United Kingdom at 8.3% and South Korea at 7.3%). Interestingly, in the United States it appears to be only about 4.7%.2 Although exceptionally rapid growth rates in this sector have fueled some increments to GDP growth in recent decades, the sector is not likely to grow much larger over time—in many respects it is analogous to the energy sector of the global economy, in which value added of another general purpose technology is approximately 6 percent of GDP and where some forms of energy will grow rapidly and replace others, and some country shares (especially in developing countries) will rise while those of others will fall, but the sector size does not change much over time. The ICT sector’s value added has similarly been estimated globally to have grown from about 6 to 9 percent of total business value added and then to have actually begun a decline bringing it back down near 6 percent by 2011. The sector's growth as a share of global GDP is very likely behind us. We have therefore paid no attention to the further growth of this sector as a source of direct economic benefit. ICT’s greatest economic impact, however, is and will remain its contribution to the production of the larger economy. That has two potential elements. First, ICT capital investments in the ICT and other sectors provide capital services (just as capital investments in other sectors do). Second, many argue that ICT is a general-purpose technology that enhances the productivity of labor and capital broadly, just as steam power and electricity did in earlier centuries. Estimates of the two economic benefits range widely across not just time and countries, but analysis, with much clearer evidence for significant capital services contributions than for broader total factor productivity impact. Generally estimates for total GDP contribution fall into the range of 20-30 percent of economic growth, about 0.6-1.5 percentage points of absolute contribution to growth. Many studies focus more narrowly on the impact of broadband penetration rates and find that increases in penetration rates of 10 percent generate 0.9-2.0 percentage points of economic growth, with the greatest impacts coming as countries approach the middle range of the penetration process Yet, broadband is only a recent entry in a series of sub-waves of ICT technologies that have built on each other over time and will continue to do so into the future. Today, the use of the cloud for storage and computation is building on a foundation of 2 Because these are estimates for the “internet economy” they will somewhat underestimate the size of the cyber economy. Cyber Risk Extended Report 5 broadband access; and there is already visible movement on several future waves,