This week's Security Special Report highlights the impossibility of getting a reliable picture of the true extent of e-crime and major IT security breaches in the UK.
While there have been various surveys and research from industry bodies such as the National Hi-Tech Crime Unit and the National Computing Centre, none of these statistics can be regarded as accurate.
At the heart of the problem is the fact that many organisations feel insecure about reporting incidences of computer crime. They are worried that news of an attack, whether by hacking or a piece of malicious code, will reflect badly on them as a company.
If news that an organisation has vulnerable IT systems makes it into the public domain it can cause untold damage to its reputation - denting customer confidence, and dragging down the company's share price.
At the same time, the specialist law enforcement agencies that focus on e-crime and other IT-related malfeasance are chronically under-funded. To secure any significant funding, the likes of the NHTCU have to justify their existence - they need real evidence that internet-related crimes are being committed on a large scale. If organisations are reluctant to come forward, this evidence is difficult to obtain - it is a Catch 22 situation.
Of late the main law enforcement agencies have made it much easier for victims of such attacks to hand over details of security breaches. The NHTCU has introduced a confidentiality charter which states that companies reporting IT crimes are assured anonymity.
Meanwhile, Scotland Yard's Computer Crime Unit has been given additional powers to deal with hackers. In what is called a disruption operation, officers can impound computer equipment and generally make life difficult for a suspected hacker even if they do not have enough evidence to make an arrest.
But, of course, the initial crime has to be reported.
Companies are fighting an ongoing battle against increasingly sophisticated threats and it is in their interest to work with the authorities to ensure that the bad guys are kept at bay. It is time for businesses to bite the bullet and speak to the law enforcement agencies to enable them to get a better picture of the true extent of computer crime and to win the resources to deal with it.
After all, when your company is burgled, you do not try to live with it, or to keep it under wraps - you call the police straightaway. Why should IT crime be treated any differently?
This was first published in September 2003