loss due to fraud, almost 20 per cent due to theft or loss, 25 per cent to repairs, and the remainder to resolving the cybercrime or other financial loss.24 Figure 2.5 shows average losses by country from this survey.25 Differences in average reported loss across countries are likely due to a number of factors, including the type of cybercrime victimization, the effectiveness of cybersecurity measures, and the extent of victim use of the internet for online banking or payments. Costs estimated by victims themselves do not of course include indirect and defence costs. Average cost/loss (USD) For Figure 2.5: Estimated costs of consumer cybercrime, by country comparison, the $450.00 figure also shows Norton Cybercrime Report, average cost per incident estimated total $400.00 Calculations based on Anderson et al, average costs of losses per capita $350.00 cybercrime (including direct, $300.00 indirect and $250.00 defence costs) per $200.00 person, based on calculations from $150.00 available $100.00 The literature.26 $50.00 absolute levels of the two figures $0.00 CO JP TR RU SE DK MX CA CN ZA IN SA GB DE BR AE US FR AU should not be Source: Norton Cybercrime Report and UNODC elaboration of Anderson et al. compared – one is average direct costs per victim, the other represents total costs divided by the whole population. The relative patterns however do show some degree of correspondence. Where large differences arise, one contributing factor may be differences in internet penetration and distribution of costs across society. Dividing cybercrime losses across a large population that does not have access in its entirety to the internet – such as in less developed countries, for example – will have the effect of reducing apparent average losses per capita. This effect is clearly seen in the figure in the case of a number of developing countries, where the pattern for total estimated per capita losses does not well match the pattern for direct consumer reported losses. In such cases, it is likely that the underlying pattern is closer to that suggested by victim surveys. In contrast, in the case of highly developed countries with comparatively low consumer costs, estimated total losses per capita are higher than would be expected from consumer losses alone – alluding to additional significant indirect and defence costs in these countries. Private sector victimization – Cybercrime techniques are revolutionizing traditional fraud and financial-driven offences committed against private sector organizations. Increasing criminal possibilities of not only defrauding an enterprise, but also of obtaining stored personal and financial information through data breach, have led to a significant perceived rise in private sector cybercrime 24 25 26 think about the total amount lost, including any amounts stolen and costs of repair and resolution. Total annual loss data was reported in local currency and converted to USD for cross-national comparison. Ibid. The figure excludes countries where the standard error in the estimate was greater than 0.5. This was the case, in particular, for some of the higher reported loss estimates. UNODC calculations from Anderson, R., et al., 2012. Measuring the Cost of Cybercrime. Global estimates from this source were attributed to countries based on GDP share. 30