This blog was written by Grant Bourzikas, previous CISO at McAfee.
U.S. military drone technology surfaces on the black market and is bought by arms dealers. A pharmaceutical company based in Eastern Europe obtains trade secrets divulging the recipe for a popular prescription medication. A business that rejected an architect’s bid nevertheless uses part of that plan in construction. An advance copy of a much-anticipated “Game of Thrones” episode is sold to rabid fans on social media.
Welcome to the wide world of intellectual property theft, which accounts for one of the largest slices of overall global cybercrime. Unlike ransomware, crimes targeting financial institutions, or state-supported hacking, IP theft takes many forms – large and small, sophisticated and crude, strategic and unintentional – making it especially difficult to address. When it involves military technology, IP theft creates risks to national security. When it involves unlicensed use of creative assets, the losses can be invisible to the victim. Yet a resulting decline in revenue has an impact.
How serious is the global issue of IP theft? Diplomacy at the highest level prioritizes addressing IP theft above addressing state-run espionage. At the 2015 summit between Presidents Xi Jinping of China and Barack Obama of the United States, the leaders agreed that “neither country’s government will conduct or knowingly support cyber-enabled theft of intellectual property, including trade secrets or other confidential business information, with the intent of providing competitive advantages to companies or commercial sectors.” Interestingly, the language of this agreement was drafted by the U.S. to allow continued espionage. China and the U.S. tacitly agreed that they could continue to spy on each other if there was a national security justification. The resulting 2015 Obama Xi agreement on commercial cyber espionage may have “saved” the U.S. perhaps as much as $15 billion a year.
Putting a value on IP is an art. How much is spent on research and development does not determine the value of IP, Companies can estimate what the IP would fetch on the market if offered for sale or licensing. Companies can estimate the future revenue stream their IP will produce, but there may be a long lag between theft and the introduction of a competing product. One way to measure the cost of intellectual property theft is to look for competing products that take market share from the rightful owners. If hackers steal intellectual property from a small or medium sized enterprise, such as their product designs, it can be a fatal experience.
McAfee’s estimate puts the value of all IP in the U.S at $12 trillion, with an annual increase of between $700 billion and $800 billion annually. Based on our earlier analyses, and assuming that loss rates from IP theft track other kinds of cybercrime and the effect of the Obama-Xi agreement, the annual losses for the U.S. of between $10 billion and $12 billion from cybercrime targeting IP and perhaps $50 billion to $60 billion globally.
These figures may not reflect the full global loss. IP theft is everywhere, in many different forms.