What if the Internet turns out not to be a viable place to do business? What if you couldn't use the Internet for anything except public information? In short, what if Internet security proved to be so bad that most of the commercial roles we currently see for the Internet become impossible?

One wonders if it's indigestion that causes such negative thoughts. Perhaps what promotes the gloom is the ignominious slide into oblivion of hundreds of dot-coms. Perhaps we're on the dark side of the Internet, at least for a moment, out of contact with the warm and sunny stock prices and looking only at the bone-chilling losses. Here are some numbers to throw into the gloaming: By one estimate (from PriceWaterhouseCoopers) the global hit from viruses and hackers in 2000 was $1.6 trillion. That's trillion. This isn't all because of the Internet, but most of it is. How close is that number to rendering the Internet unprofitable?

Certainly all the news about hackers, crackers, cybercrooks, and so forth has created the impression that the Internet is riddled with weaknesses and is under constant attack. From time to time, as yet another story of Internet crime hits the news, no doubt you have wondered just how secure the Internet really is--and whether it can be secure enough to handle serious business.

Bingo! I've been hacked!

Maybe none of the bad news about Internet insecurity bothers you. Many people love lotteries. They think, "Somebody has to win; it could be me." Internet hackery is a reverse lotto. "Somebody has to lose; but it probably won't be me." The odds in both cases are long. The odds of any particular company (and especially any one person) being hit with a destructive attack are small--but not nonexistent.

There is (some) safety in numbers. As we zip by 150 million Internet users and millions of Web sites, being a deliberate target is a remote possibility for most of us, and suffering a random hit is even more remote. On the other hand, not all hackers are looking for single victims; in fact, most of them are looking for the biggest bust for their buck. A worm or virus that has tens of thousands of victims is more to their liking. That's why almost all of us who use a computer have at some time or another run into a virus or other attack. This personal experience is often at the root of our misgivings about Internet security in general.

The terrors of the last percent

The psychology of small probabilities is fascinating. Though we know that the odds of suffering a fatal car accident are not insignificant, that does not stop most people from driving or riding. Somehow we do an intuitive calculation and decide that the necessity of driving is worth the relatively small risk involved. The fact that almost everyone who has driven has had an accident at some time or another doesn't seem to change the calculus. In fact, most of those who have had bad accidents drive again.

We regard an automobile accident as exceedingly bad luck. Not so with skydiving. Although the percentage of accidents from jumping out of airplanes is much smaller than that incurred driving the local freeway, not many people consider the risks of skydiving worthwhile. What's the real difference? Skydiving is considered an elective, a sport; driving a car is not.

Skydiving and car driving have unlikely but emotionally charged potential outcomes--death. Such outcomes make us very sensitive to the percentage, no matter how small. Can we put a number on the percentage, such as a 2 percent chance of fatality every time you step into a car? If you use your car seven days a week, five times a day, that's 35 times a week or 1820 times a year. What if your odds of having a fatal car accident were three out of 1820 (.16 percent)? You'd probably never get into a car again.

Fortunately, viruses and hacking virtually never have fatal outcomes. Lacking that sense of mortality about them, we relax the need for the odds to be extremely long. Still, we employ our obscure sense of risk calculation. At some point, we as individuals may decide that the risk of doing business on the Internet is not worth it. Likewise, enterprises that rely on the Internet to do their business may decide that it's unprofitable.

Acceptable losses

All businesses accept some level of risk and loss. It's usually built into the cost of doing business, which of course is usually passed on to the customer. The credit-card industry is a classic example of coping with risk and loss. Credit-card companies tolerate a certain percentage of loss; however, they're sophisticated about it. Losses are classified, for example: theft, fraud, negligence, technical failure, and default. Some categories, such as theft and fraud, provoke investigation and legal action. Other categories are turned over to companies specializing in collection. Still other categories are simply ignored, and losses become insurance claims. The profile of response is different among the credit-card companies, but the point is that they all have mechanisms in place to deal with the problems. However, they also watch the indicators on the losses closely, because in the event of shifting percentages, as happens when the economy changes, they must react.

There may be a point, however, when the credit-card companies can't react quickly enough. For example, an Internet hacker could break into a large online retail site and siphon off a million or more credit-card numbers (something that almost happened to Egghead Software). If these numbers were immediately used to make false purchases all over the Internet, the losses could be immense--perhaps catastrophic--for the credit-card companies. Their ability to cope with the consumer panic, process the complaints, and ultimately find ways to pay for the losses is limited.

While a company, or even the economy as a whole, might be able to absorb a catastrophic hacker attack or massive virus damage, the issue may really be what it does to public confidence. That elusive calculus that we do concerning risk may be skewed by the knowledge that the Internet is subject to massive and expensive cybercrime events. While there may be hundreds of millions of transactions and only a million might be violated, it still changes the odds. This has some similarity to the risk of flying in airplanes. While the overall risk is low, the accidents are spectacular. With enough accidents, many people would cease to fly.

Mounting defenses

Obviously, a good defense against hackers, viruses, and other cyber-malefactions is needed. Many are willing to provide it--mostly for a price. The price is significant. Like the losses incurred from cybercrime, the cost of defending against it is part of the total package. How much money is a company willing to pay? And for what level of security? Defense has its limits.

It's axiomatic that no security system is perfect, and that no security measure remains effective forever. The hackers are always one step ahead of the security--it's the nature of offense. As in football, the offense knows where it's going, and the defense must guess. In general, the defense knows where the plays are going, but it's the surprise details that count. What this means is that the odds of a spectacular failure to defend against Internet-based attacks are fairly high.

Does this all mean that we could see the disappearance of confidence in the Internet as an arena of commerce? Nothing so dramatic. The Internet is a big place, and its commerce comes in many forms. Not all aspects of e-commerce are subject to hacker attacks: There are virtual private networks and other types of encrypted and well-defended transactions. Those segments that can demonstrate a long track record of reliability will prosper. Other aspects may not do as well, particularly where open commerce with credit-card information is required.

It will be interesting to see over the next few years just how the leapfrog game of hacker and defender progresses. How many times will the Internet take a hit, and how big? Who will be the big losers, and how much will they lose? How much of a role will sensationalism play in setting public opinion? These are open questions right now, but the odds of some negative answers seem uncomfortably high.

Editor at Large Nelson King also writes Enterprise Pursuits on ComputerUser.com, a weekly column discussing enterprise-level technology integration.