Cyber-attacks: Effects on UK Companies

Gary Becker’s seminal 1968 paper on the economics of crime shaped the way economists think about crime policy and is still applied in many contexts today. Becker explored the decision making function of rational criminal actors, suggesting that criminals choose to engage in illicit activity based on their own assessment of the costs and benefits. Rational criminal actors weigh up the potential yield from a criminal act, the risk of being caught and the severity of the punishment.
The decision making process of state-sponsored cyber-attacks differs from that of ordinary criminals in important ways, which may potentially limit the direct applicability of the traditional economic models of crime such as Becker’s. State- sponsored attackers are characterised by the very fact that a “non-profit” state entity is involved (as opposed to Becker’s individual “for profit” criminals), potential information asymmetry, a perception of immunity from prosecution and the intangible value attributed to acts of patriotism (which does not figure in traditional economic approaches to crime, such as Becker’s).
At the same time, there is value in understanding the economic theory of crime, as advanced by Becker. States are unlikely to change their activities in the short term, particularly because of non-pecuniary/distorted concepts of returns. However they may do so in the long term, especially if deterred by adequate security measures and changes in operational procedures, (i.e. if the costs of cyber-attacks rise) and as they realise that the returns to cyber-attacks may be mixed at best . This again points to a need for firms to understand the nature of - and threat posed by - current attacks, so as to raise the costs of cyber-attacks for nation-state perpetrators in order to help deter future attacks.