Balancing benefits against risks — cyber futures weighed in Zurich report

With every discussion of cyber risks comes acknowledgement of the many benefits offered by technological advancement, as well as the costs of securing those benefits. A new report from Zurich and the Atlantic Council asks when do the potential negative effects of interconnectivity outweigh the benefits and is society heading toward a “darkest timeline” scenario in terms of cyber futures?

“In 2030, will the Internet and related information and communications technologies (ICT) continue to drive global innovation and prosperity? Or, will that bright promise be swamped by an unstable and insecure Internet, so overwhelmed by non-stop attacks that it has become an increasing drag on economic growth?” questioned the authors of the report, the second in a series of cyber research from Zurich and the Atlantic Council. “The answers, as far as we can predict, are not promising and mean the difference in tens of trillions of dollars in global economic growth over the next fifteen years. So far, cyberspace has been safe enough, secure enough, and resilient enough for the past decades to re-invent nearly every industry, create a ’hyperconnected world,’ and transform the global economy. Unfortunately, these benefits come with an increased dependence on a shared, stunningly complex system-of-systems, which no one truly understands in its entirety.”

Organizations and individuals have come to understand that connected devices and a digital information environment mean the potential for accidental or intentional invasion of privacy, lost data, or – it has been speculated – physical harm. Proponents argue that global interconnectivity advances the greater good, saving money through better efficiency, strides in medical techniques, and more.

However, Zurich and the Atlantic Council sound the alarm in their report that expenses related to securing cyberspaces may already be outstripping the costs saved as a result of connectivity.

“For all economies, the inversion of costs and benefits is expected to occur within the next five years. In Latin America, it is expected before the year 2030, as the region bridges the digital divide. In the Asia-Pacific region, the inversion is expected sometime after that. This is the bad news,” the groups stated. “Fortunately, there is good news, and it is actually pretty great. Although the one-time costs of being connected are higher on an annual basis, benefits accumulate over time, as they tend to be made as long-term investments in productivity. In other words, cyber benefits tend to keep delivering each year after they are originally felt, whereas the costs tend to be experienced as ’one offs.’”

This reassuring knowledge did not sway researchers from evaluating the “what ifs” associated with various scenarios for the future. For example, the report delves into the possibility of a “Cyber Shangri-La” where all is well and good and strong cybersecurity efforts keep the hackers at bay, leading to net gain of $190 trillion by 2030. On the other end of the spectrum, the report suggests a “Clockwork Orange Internet,” where attackers mire interconnectivity down to the point where it could cost the world almost $90 trillion in economic gains.

“Cyber risks will continue to rise significantly in the near future. Technological and process innovation might help some organizations, but overall there is little on the immediate horizon that suggests that cyberattacks will become less common,” noted the authors. “With the massive profusion of recent tension between major military powers, the trend is perhaps more towards a Clockwork Orange or Leviathan Internet. Cyberattacks might get much worse, far more quickly than many risk managers and policymakers may be expecting. At first, it may be difficult to determine the trajectory we are on, because projections for the alternate worlds are not that different in 2016 or 2017. If cyber-incidents continue to grow steadily, then it is likely that we are heading towards Clockwork Orange Internet, meaning immediate costs that exceed benefits by 1.5 percent of GDP each year, a gap that could rapidly grow larger.”

Other possible futures include a highly regulated government state – a “Leviathan Internet” and the reverse, a free-from-regulation, corporate-driven “Independent Internet,” according to the report. The authors point out that the preferable result between Clockwork Orange Internet and Shangri-La is clear, but the other scenarios offer more complex dynamics. Government regulation could stymie progress with few benefits, according to the report.

“A strong and resilient Internet will be driven by a healthy non-state sector, supported when needed by governments. Avoiding the worst futures is a global collective action problem that requires a sense of joint stewardship over the Internet, needing actions that go far beyond just admonitions to ‘improve cyber security.’ We must also focus on improving resilience and, above all, international governance for the globe and the Internet,” commented the authors.

The significant takeaway, according to the report, should be to understand the options and choose wisely, implement policies for better outcomes, and take action to reduce the risk.

“Deciding how to steer between alternate futures to guide policy often results in a very basic problem of political philosophy worthy of Hobbes, Locke, and Rousseau: is it better to avoid the worst cyber futures or to aim for the best? Of course, we want the best cyberspace for ourselves and our children, but when humanity has aimed for heaven, then missed, we have often wound up in hell,” the authors said.