Faking It: Criminal Sanctions and the Cost of Computer Intrusions

Thoroughly and consistently calculating losses from computer intrusions is a difficult endeavor because security incidents are characterized by intangible harms like interference with system availability and interference with the integrity of data. These harms can be difficult to translate into monetary terms. More easily measured are labor and hardware costs associated with repairing and restoring compromised systems, if there is a methodology in place for tracking these expenditures of time and money. The area of computer crime sentencing should be one where an accurate method for assessing the cost of attacks develops, since the most important factor in computer crime sentencing under the Federal Sentencing Guidelines is the harm caused by the intruder. Hundreds of computer crime cases are adjudicated in the courts every year, and in each one loss valuation factors into the disposition of the case.