Truth About Computer Security Hysteria

Mathematical atrocity

HOW MUCH MONEY did ILoveYou cost? It depends on who you ask, when you asked, and in what context you asked. Let's look at a sampling of newswires & press releases...

Computer Economics calculated an absurdly accurate guesstimate of $2.61 billion. This indicates a worldwide accuracy of a mere ±$10 million!

No, waitaminit. First I want you to read a paragraph from a Washington Post story:

By late last week, after the television cameras had left the [Philippine] computer crime unit's offices, it was hard to tell that investigators still had the case of the world's most potent virus on their hands. Of the four agents in the office on Thursday afternoon, two were engrossed in computer games, one was playing solitaire (not on the computer but with a deck of cards), and one was snoring loudly in the corner. When a reporter asked the solitaire player if he might check if his boss was in an adjoining office, he replied, "I'm busy right now."

Okay, now let's look at a sampling (I repeat: a sampling!) of newswires & press releases...

millions to billions...

• 4 May 2000
  • Reuters newswires said "computer experts ... [estimated] damage in the millions, or even billions, of dollars from lost data, interrupted work, and the cost of fixing the damage."

  $1 to $2.61 billion...

• 5 May 2000
  • Reuters newswires upped the ante "with losses now counting in the billions of dollars... 'We estimate $2.61 billion of damage has been done worldwide,' said Samir Bavnani, a research analyst with Computer Economics. 'By Wednesday, the total can reach $10 billion... We see damages growing by $1 billion to $1.5 billion a day until the virus is eradicated.' "
  • Computer Reseller warned "some estimates claim this little love letter could cost more than $1 billion in software damage and lost commerce."
  • A Finjan press release quotes president Bill Lyons: "as Love Bug proved, billions of dollars can be lost due to lost productivity in the first 24 hours."
  • TechWeb said "experts are predicting costs upwards of $1 billion."
  • ABC World News Tonight set the damages "at $2 Billion and Growing."

  $1 to $6 billion...

• 6 May 2000
  • The Houston Chronicle said "Computer Economics estimates that $2.6 billion in damage has been done, and the bill could reach $10 billion by the middle of next week. That would make it even more destructive than the infamous Melissa virus that spread in a similar fashion early last year. 'Melissa was verging on economic terrorism,' says [Computer Economics research analyst Samir] Bhavnani. 'This is beyond that.' "
  • The Xinhua news agency said "some estimates have put the cost of the damage at more than 1 billion U. S. dollars."
  • PA News said "Computer Economics ... estimated damage at 6 billion before it is contained."
  • From a Kyodo newswire: "experts say damage could be in the billions of dollars."

  Possibly $1 to $12 billion...

• 7 May 2000
  After repeatedly declaring ILoveYou cost "billions of dollars in damages," Reuters suddenly started saying it "possibly" cost billions.
  • The Wall Street Journal said "estimates of the virus's total cost run as high as $10 billion, most of that in lost work time."
  • A Chicago Tribune opinion piece said experts tagged the virus for "nearly $12 billion in damage from lost files and lost productivity."
  • A Kyodo newswire said the virus "may cause billions of dollars worth of damage."
  • United Press Int'l said "experts have estimated the damage caused worldwide by the Love Bug virus at some $2.6 billion, mostly in lost work time and e-commerce business, but also in files that were wiped out."

  Unknown! to $10 billion...

• 8 May 2000
  • AsiaPulse notes the virus resulted in "damages at more than $1 billion."
  • The Wall Street Journal declared "reliable damage estimates from the attacks were impossible to calculate... [yet] Computer Economics Inc. of Carlsbad, Calif., estimated damages at $2.61 billion. 'It's too early to tell in any concrete way what the overall damage is,' said Michael Vatis, head of the FBI National Infrastructure Protection Center."
  • Another Finjan press release quoted president Bill Lyons as saying "billions of dollars in damage was done."
  • A press release from Angus Reid (in conjunction with Symantec) claimed the virus caused "more than 2.5 billion dollars in damage."
  • A Dow Jones newswire said the virus "is estimated to have done about $10 billion in damage worldwide."

  $2.6 to $10+ billion...

• 9 May 2000
  • Xinhua announced the virus "has caused up to 2.6 billion U.S. dollars in damage"
  • One Reuters reporter declared "estimates ... have already reached about $5 billion and could total $10 billion, market research firm Computer Economics said." A different Reuters reporter declared it "wreak[ed] more than $2 billion in estimated damages."
  • 123Jump said the virus cost "billions of dollars."
  • A Computer Economics press release quoted president Michael Erbschloe as saying "it is clear that the total economic impact of these worms will exceed $10 billion before we can reach eradication."
  • London's Financial Times noted the damage was "estimated at up to $10 billion by some experts."

  $1 to $6.7 billion...

• 10 May 2000
  • Some Reuters newswires said "experts estimate the virus ... has caused damages amounting to $6.7 billion in the five days it has been in existence." Other Reuters newswires declared "experts say about $7 billion damage has been caused so far by the virus."
  • United Press Int'l said "[ICSA president Peter] Tippett told [Congress] the cost of repairing the damage ... could approach $1 billion."

  $6.7 to $15 billion...

• 11 May 2000
  • The Associated Press said the virus "may end up costing governments and corporations billions of dollars." Getting more specific, AP noted "Lloyd's of London has estimated the worldwide damage caused by the Love Bug to be over $15 billion, said Rep. Constance Morella, R-Md., chairwoman of [a congressional] subcommittee."
  • A Reuters reporter who interviewed science fiction writers about the virus pegged the damage at "an estimated $7 billion, and counting."
  • A.M. Best reported the "economic toll in terms of lost productivity added up to $6.7 billion in the first five days, with the potential for far more, said Samir Bhavnani, research analyst at Computer Economics."

It looks like ICSA offered the first "official" guesstimate in a press release dated 4 May — the same day the virus appeared. " 'ICSA.net believes damages will exceed $1 billion before this problem is over,' said Peter Tippett, Chief Scientist."

A Reuters reporter interviewed movie critics and science fiction writers about the ILoveYou virus. I don't make this stuff up, folks.

Then again, perhaps someone else beat ICSA to the punch. I can't say for sure. My news clipping service overflowed for the first time as a result of the virus hysteria.

However, I do know Computer Economics reigned as the media darling when they offered guesstimates with a worldwide accuracy of a mere ±$10 million! Reuters quoted research analyst Samir Bhavnani: "we estimate $2.61 billion of damage has been done worldwide... The total can reach $10 billion... We see damages growing by $1 billion to $1.5 billion a day until the virus is eradicated."

YOU MIGHT WONDER how Computer Economics arrived at such an absurdly accurate figure. Their press releases encouraged reporters to contact them for "information about the methodology [we use] for our estimates." An A.M. Best newswire observed "the research company arrived at the estimate by conferring with anti-virus companies, governments and major corporations. It calculated the number of e-mail recipients affected, then broke down this number into categories based on significance of the monetary impact."

Ah, of course. The very people who didn't bother to collect virus data for the first 14 years somehow came up with intricate metrics and empirical evidence just a few hours after the virus made its debut. From this, Computer Economics calculated damages with a worldwide accuracy of ±$10 million.

Ouch! My brain can't absorb the previous sentence. Time to renew my thorazine prescription...

Mathematician John Allen Paulos wrote multiple books about the world's "innumeracy" problem — and he derides people like Bhavnani for making absurdly accurate claims like this. Paulos coincidentally wrote how even one bad value in an equation can "infect" the whole equation.

"'Melissa was verging on economic terrorism,' says [Computer Economics research analyst Samir] Bhavnani. 'This is beyond that.' "

"Economic terrorism"? Bah. It fit more into the category of a bad snow storm...

The media has a deep-rooted fetish for juicy computer virus stories, and Computer Economics knows it. They proved you can catch reporters all day long with a Popeil Pocket Fisherman and a rancid press release.

Two words, folks: "mathematical atrocity."

What more can I say to you at this point? What can I say without sounding like a broken record? I showed you the Philippine version of Keystone Cops. I highlighted the media's wildly fluctuating guesstimates. I exposed the role Computer Economics played in all the hysteria...

Oh, just forget it. I need to get some sleep. "The end."