When I worked on a cybercrime startup idea in 2008-9, every single "cost of cybercrime" calculation I found - even from government agencies - was based on the s

When I worked on a cybercrime startup idea in 2008-9, every single "cost of cybercrime" calculation I found - even from government agencies - was based on the same original, unsourced estimate from MarkMonitor, which sells various brand protection services to IP holders (e.g. they'll watch eBay for counterfeit auctions of Rolex watches). After a few years, MM was able to cite the more "official" sources with a circular reference. There's no financial incentive for anyone to say "nah, it's not that bad".