Cyber-enabled Competitive Data Theft: A Framework for Modeling Long-Run Cybersecurity Consequences

Cybersecurity has become a pressing policy issue, and has drawn the attention of the national security community. Yet there is an emerging consensus among experts that one of the largest policy problems faced in cyberspace may be not a question of military threats in a new domain, but the massive exfiltration of competitive information from American companies. Economic espionage has existed at least since the industrial revolution, but the scope of modern cyber-enabled competitive data theft may be unprecedented. With this paper, Friedman, Mack-Crane, and Hammond present what they believe is the first economic framework and model to understand the long-run impact of competitive data theft on an economy by taking into account the actual mechanisms and pathways by which theft harms the victims.

The initial results suggest five important conclusions:

1. The three dimensions along which the framework differentiates CCDT can all be important to model outcomes. In some cases, sector matters, in others the type of data stolen matters, and in others protection regime matters.
2. By seeing stolen data from a business process perspective, rather than a lost asset, the authors were able to understand the problem in a longer time frame. This not only avoids the challenges of short term analysis and gives us the context of equilibria, it is more extensible in a policy analysis.
3. These simulations demonstrate that different interventions will have different effects. Not only is there no ‘silver bullet,’ but some sectors will benefit from solutions that may offer no help to others.
4. The framework introduces a new way of thinking about cybersecurity that does not easily map onto existing theoretical structures or evidence.
5. This basic model is not only extensible, but can help us understand a range of critical cybersecurity policy problems.