ANDY BATES sets out the often-overlooked environmental impact of cyber-crime.
The impact of cyber-crime is increasingly familiar and far-reaching. From technology downtime and reputational damage to the devastating personal consequences and huge cost to business, it’s already right up there as one of the 21st century’s defining global challenges.
Understandably, the financial impact tends to occupy the headlines. The global cost of cyber-crime is estimated to be in the region of US$3 trillion annually.
But, if that wasn’t bad enough, the latent impact of cyber-crime could also be a contributor towards the biggest contemporary global crisis of them all – carbon emissions.
The infrastructure that supports its US$3 trillion criminal ecosystem is truly vast, consuming a huge amount of technology resources, computing power and, of course, energy. Yet it is faceless, unaccountable and immune to every environmental argument and regulation that legitimate businesses must adhere to.
Clearly, no one can expect cybercriminals and nation-state adversaries to view their activities through any kind of moral lens and take responsibility for their carbon footprint. While the ethical use of IT is increasingly focused on improving energy efficiency, organised crime has different, narrower objectives.
The question, therefore, is how do the rest of us offset the environmental impact of ransomware, hacking, identity theft and all the other tech-led cyber-crime tactics used on a daily basis?
The human factor
Given the sheer scale of the cyber-crime problem, an effective and holistic approach to good cyber-defence must incorporate people as well as technology. The problem is that, in general, personal engagement in cyber-security remains low. For example, cyber-criminals regularly ‘outsmart’ cyber-security defences by exploiting common human frailties, traits and behaviours, particularly their use of tactics such as phishing and social engineering.
In fact, cyber-crime and fraud rely on exploiting the “human element” inherent in most cyber-security strategies and is seen in 82 per cent of all data breaches.
As a result, and despite ongoing and significant improvement in technology-based cyber-crime prevention and mitigation, effective human engagement in cyber-defence remains frustratingly elusive.
In contrast, it’s increasingly obvious that people everywhere are now engaging emotionally in the carbon debate. They put time, energy and commitment into improving their own environmental performance and of the people around them. Extending this trend to cover much-needed cyber-engagement is a logical step towards mitigating the impact of cyber-crime and reducing the carbon emissions it creates.
Corporate cyber-crime responsibility
Another part of the problem is that relatively few organisations have recognised the direct link between protecting themselves against cyber-crime and improving their environmental performance.
Think of it this way – businesses everywhere have made serious public commitments to controlling and eliminating their carbon footprint. The most committed work hard to become more energy efficient, invest significant sums in carbon offsetting projects and embrace flexible working practices to help employees and the environment alike. The list goes on.
What they often fail to consider, however, is the emissions ‘dividend’ that an overall reduction in cyber-crime could deliver.
While organisations everywhere have established business cases focused on reducing cyber-risk, many have limited executive time or capital resources to execute on their objectives. However, carbon can be used to help the prioritisation of these cases as it plays to emotional intent rather than pure economic reasoning.
Ultimately, bringing cyber-security into the discussion around corporate ESG strategies has the potential to make a significant difference to the success of organisations in dealing with both priorities.
On an individual and organisational level, one of the most beneficial developments long term would be a change in mindset. For instance, many aspects of cyber-defence create a benefit to someone other than the primary defender: person “A” takes action that benefits person “B”, who is unknown to person “A” and has no direct impact or relationship with them.
This paradigm shift has happened in conventional carbon understanding in that many people now fully appreciate the actions of one country or organisation that can affect people in a different part of the world.
The same system effect is true in the case of cyber – everyone connects to one internet in the same way they breathe the same atmosphere, but in cyber, this mindset is generally absent and is not acted upon.
In contrast, using the carbon debate has tremendous potential to act as a catalyst for achieving a win-win scenario where defeating cyber-crime can also help protect the planet.
- Bates is Practice Director – Security at Node4.
