Cybercrime also includes the use of computers as tools to conduct  criminal activity such as fraud, identity theft, and copyright infringement. Cybercrime Has Significant Economic Impacts and Threatens U.S. National Security Interests, but Its Precise Magnitude Is Unknown

Cybercrime is a threat to U.S. national economic and security interests. Based on various studies and expert opinion, the direct economic impact  from cybercrime is estimated to be in the billions of dollars. The overall  loss projection due to computer crime was estimated to be $67.2 billion  annually for U.S. organizations, according to a 2005 FBI survey. In  addition, there is concern about threats that nation-states and terrorists  pose to our national security through attacks on our computer-reliant  critical infrastructures and theft of our sensitive information. Also, according to FBI testimony, terrorist organizations  have used cybercrime to raise money to fund their activities. However,  despite the reported loss of money and information and known threats  from our nation’s adversaries, there remains a lack of understanding about  the true magnitude of cybercrime and its impact because it is not always  detected or reported. In  addition, the report stated that Chinese intelligence services are capable of  compromising the security of computer systems. Numerous Public and Private Organizations Have Responsibilities to Protect Against, Detect, Investigate, and Prosecute Cybercrime

Federal agencies, state and local law enforcement, private industry, and  academia have responsibilities, based on their primary missions or  business interests, to protect against, detect, investigate, and prosecute  cybercrime. Many Public Entities Have Responsibilities for Addressing Cybercrime

DOJ, DHS, and DOD and the FTC have key roles in addressing cybercrime  within the federal government, along with the federal inspectors general. Numerous Public and Private Partnerships Work to Address Cybercrime

Numerous partnerships have been established between public sector  entities, between public and private sector entities, and internationally to  collaborate and implement effective cybercrime strategies. While numerous public and private entities—federal agencies, state and  local law enforcement, industry, and academia—have responsibilities to  address these threats, they face challenges in protecting against, detecting,  investigating, and prosecuting cybercrimes. Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) determine the impact of cybercrime on our  nation’s economy and security; (2) describe key federal entities, as well as  nonfederal and private-sector entities, responsible for addressing  cybercrime; and (3) determine challenges being faced in addressing  cybercrime. To determine the impact of cybercrime on the U.S. economy and security,  we analyzed various government and private-sector reports, surveys, and  statistics related to cybercrime and conducted interviews with experts  from law enforcement, academia, and information technology and security  companies to verify, clarify, and gain a greater understanding of  cybercrime’s impact.
Why GAO Did This Study

Computer interconnectivity has produced enormous benefits but has also enabled criminal activity that exploits this interconnectivity for financial gain and other malicious purposes, such as Internet fraud, child exploitation, identity theft, and terrorism. Efforts to address cybercrime include activities associated with protecting networks and information, detecting criminal activity, investigating crime, and prosecuting criminals. GAO's objectives were to (1) determine the impact of cybercrime on our nation's economy and security; (2) describe key federal entities, as well as nonfederal and private sector entities, responsible for addressing cybercrime; and (3) determine challenges being faced in addressing cybercrime. To accomplish these objectives, GAO analyzed multiple reports, studies, and surveys and held interviews with public and private officials.

What GAO Found

Cybercrime has significant economic impacts and threatens U.S. national security interests. Various studies and experts estimate the direct economic impact from cybercrime to be in the billions of dollars annually. The annual loss due to computer crime was estimated to be $67.2 billion for U.S. organizations, according to a 2005 Federal Bureau of Investigation (FBI) survey. In addition, there is continued concern about the threat that our adversaries, including nation-states and terrorists, pose to our national security. For example, intelligence officials have stated that nation-states and terrorists could conduct a coordinated cyber attack to seriously disrupt electric power distribution, air traffic control, and financial sectors. Also, according to FBI testimony, terrorist organizations have used cybercrime to raise money to fund their activities. Despite the estimated loss of money and information and known threats from adversaries, the precise impact of cybercrime is unknown because it is not always detected and reported. Numerous public and private entities have responsibilities to protect against, detect, investigate, and prosecute cybercrime. The Departments of Justice, Homeland Security, and Defense, and the Federal Trade Commission have prominent roles in addressing cybercrime within the federal government, and state and local law enforcement entities play similar roles at their levels. Private entities such as Internet service providers and software developers focus on the development and implementation of technology systems to detect and protect against cybercrime, as well as gather evidence for investigations. In addition, numerous cybercrime partnerships have been established between public sector entities, between public and private sector entities, and internationally, including information-sharing efforts. Entities face a number of key challenges in addressing cybercrime, including reporting cybercrime and ensuring that there are adequate analytical capabilities to support law enforcement. While public and private entities, partnerships, and tasks forces have initiated efforts to address these challenges, federal agencies can take additional action to help ensure adequate law enforcement capabilities.