Cybercrime Hysteria and the Value of Information

There is a NYTimes article on whether there is too much hype around Cybercrime. The argument, made by the authors centres around the extrapolations and the lack of real data backing up the financial harm suffered due to cybercrime. These arguments are not new - the financial harm apparently caused by piracy has attracted similar criticism before; but that argument has been extended further to cover the entire spectrum of cybercrime.

But there is one argument, that this argument doesn't cover - and that currently there is no established mechanism to valuate information. This is a problem I have posed to a number of people, and have looked at researching in my spare time (though I have not gone very far). If we take the physical world analogy - physical objects have a value. That value can be established by one of two ways - you can look at what was paid for the object (i.e. historical price) or what the market is willing to pay for the object (i.e. market value).

But data does not have value as such. There are certain ways to measure certain types of data; but no generic approach. For example, certain types of information - such as credit card numbers - there is an established black market; thus it is possible to valuate the information of having "credit card data". With the recent valuation of Facebook, it can be easy to argue that "personal information" is worth approximately USD 100; if one takes the simple maths of taking Facebook's market valuation and the core asset of Facebook that is embodied in that valuation. But what is the cost of a word document detailing the business strategy? Or a thesis? Or a drug formula? And how does that translate to the value of the bits and bytes?

That is one of the reasons why information security is hard to sell - is the cost of what you are protecting actually worth what you are paying to protect it? And one can argue (as argued partially in the article); when one considers the cost of PCI-DSS compliance; and the cost of the actual credit card information; PCI-DSS just doesn't seem to be worth it. But there are other costs if one does not comply to PCI-DSS; so the true cost is higher than the credit-card information - but it is still difficult to build the actual business case purely on whether the security was worth it ...

Facebook Valuation

Facebook's recent valuation of 50 Billion USD, has created quite a lot of commentary - mostly centred around it being way too high (from most commentary I have read). The valuation is based on what Russian (and part South African) venture capitalist firm Digital Sky Technologies and Goldman Sachs were willing to pay for a share in Facebook. In essence, most commentators have argued, that they paid too much.

In terms of classical economics, that is true, or at least based on given information. Afterall, Facebook is a private company, and thus its financial results are not public information.

However, valuations can also be based on the net worth of Facebook's assets. And its biggest assets have currently no real means of being objectively evaluated - personal information. Facebook has over 500 million active members; which in turn translates to personal information including likes, dislikes, freinds, connections, activities, photos, and a whole lot more of 500 million people on the planet.

If one ignores Facebooks' traditional assets (servers, datacentres, offices etc) and liabilities, it means that the personal information of 500 million people is worth 50 billion dollars - or 100 dollars an individual.

The resultant question is simple - is the personal information of you, or any other person worth more or less than 100 dollars? In fact, if someone would offer you 101 dollars, would you give them more information than what you have willingly published in Facebook for free?

50 billion dollars? I think Facebook is undervalued ...