RE: [gnso-ff-pdp-may08] Cost of attacks (and proportion attributable to Fast Flux)

[Joe St Sauver <joe@xxxxxxxxxxxxxxxxxx>]

#Questions;
#
#-- Are there other cost numbers that we could use to express the 
#financial size of the *overall* problem?  (Dave pointed out that it's 
#not just phishing, and it's not just outright financial losses that 
#we should include, so let's expand on this a bit)

The quoted estimated $3.2 billion in phishing losses, while large, is 
dwarfed by losses in other sectors. 

For example:

-- the Business Software Alliance estimates losses due to software piracy at 
   $48 billion in 2007 (see
   global.bsa.org/idcglobalstudy2007/studies/2007_global_piracy_study.pdf )

-- The World Health Organization notes that "counterfeit drug sales 
   will reach US$75 billion globally in 2010, an increase of more than 
   90% from 2005." and "Medicines purchased over the Internet from sites 
   that conceal their physical address are counterfeit in over 50% of cases."
   http://www.who.int/mediacentre/factsheets/fs275/en/

-- The OECD estimated that international trade in counterfeit or pirated
   good totaled US$200 billion in 2005 (see
   www.oecd.org/document/50/0,3343,en_2649_34173_39542514_1_1_1_1,00.html 
   -- if you don't have free access to the full report and don't want to
   buy a copy for $86, see http://www.ddmcd.com/managing-technology/oecd-publ
   ishes-report-on-international-counterfeiting-and-pi.html (URL wrapped)
   for a summary. Some estimates are even higher yet (e.g., see
   http://www.comptroller.nyc.gov/bureaus/bud/04reports/Bootleg-Billions.pdf )

And that only touches the surface. For example, I've seen fastflux used in
conjunction with online casinos, which are illegal in the United States. A
*single* online gambling operation did $3.3 billion in wagers over a 28
month period; see www.queensda.org/pressreleases/2006/november/11-15-2006.pdf
but of course there are many, many more. 
   
And then there's the non-monetary costs of things such as child exploitation,
which I hope do not get ignored simply because that particular misery can't be 
financially quantified. 

Regards,

Joe