Let’s do this.

Cybercrime · the long read

Averting the Unspoken Threat of Cybercrime

What you can do What’s true On Medium

Since this was written. The essay is as published. These figures have changed or were off; the Learn and Do pages use the corrected ones.

The Invisible Siege

[figure] We tend to picture threats to humanity in physical terms — missiles, pandemics, famine. But one of the most pervasive dangers we face is largely invisible, and most people encounter it only as a vague anxiety about whether their password is strong enough. Cybercrime is not a niche technical problem. It is a civilizational vulnerability, and it is growing faster than our collective ability to address it.

In 2025 alone, the scale was staggering. A coordinated ransomware campaign shut down major UK retailers, costing hundreds of millions in losses. A cyberattack on Jaguar Land Rover halted production across multiple countries and caused an estimated $2.5 billion in economic damage — the costliest cyber event in UK history. North Korean state hackers stole nearly $1.5 billion in cryptocurrency in a single theft. Chinese state-linked actors were found embedded in telecommunications networks across the US, Canada, and beyond, intercepting communications and mapping military infrastructure. Schools, hospitals, breweries, banks, government ministries, and universities were all hit. No sector was spared. The global cost of cybercrime is now measured in the trillions annually, and it continues to climb.

But the numbers, as overwhelming as they are, actually obscure what makes this problem so dangerous. The deeper threat is to the fabric of trust that holds modern life together.

What’s Really at Stake

Every institution we depend on — healthcare, finance, energy, governance, communication — now runs on interconnected digital systems. When those systems are compromised, the consequences aren’t abstract. Patients can’t receive care. Families lose their savings. Elections are manipulated. Power grids go dark. The physical and the digital are no longer separate worlds, and an attack on one is increasingly an attack on the other.

At the individual level, cybercrime inflicts real psychological harm. Identity theft, phishing, doxing, and blackmail carry consequences that go far beyond financial loss — they erode a person’s sense of safety and agency. The rise of AI-generated deepfakes has made this worse, creating new vectors for fraud, manipulation, and personal destruction that most people are not yet equipped to recognize, let alone defend against.

Culturally, the cumulative effect of constant breaches and data exposures is a slow erosion of trust — in institutions, in technology, in each other. When people stop believing their information is safe, their communications are private, or their elections are legitimate, the social contract begins to fray. This is not a hypothetical concern. It is already happening.

And at the systemic level, the inequality built into our digital infrastructure means that the most vulnerable — developing nations, underfunded school districts, small businesses, rural hospitals — are the least protected and the most exploited. Cybercrime is not distributed evenly. It follows the same fault lines as every other form of injustice.

Why It Persists

Cybercrime thrives in the gap between how fast technology moves and how slowly human awareness, governance, and cooperation adapt. The attackers — whether teenage hacker collectives, organized criminal enterprises, or nation-state actors — operate with speed, creativity, and global reach. The defenders are fragmented, underfunded, and often working within institutional structures that were designed for a different era.

But the problem isn’t only structural. There’s an interior dimension too. Most people still treat cybersecurity as someone else’s responsibility — an IT department problem, a government problem, a “tech thing.” This psychological distance is itself a vulnerability. A person who doesn’t understand that clicking one link can compromise an entire hospital network is not a bad person — they’re an uninformed one. And our collective failure to make cyber literacy as fundamental as physical hygiene is a cultural blind spot with enormous consequences.

There’s also a moral dimension that rarely gets discussed. Some of the most sophisticated cyber capabilities in the world are developed by governments to spy on their own citizens, suppress dissent, or gain geopolitical advantage. The same tools and techniques then leak into the criminal ecosystem. The line between state-sponsored hacking and organized cybercrime is increasingly blurry, and until we’re honest about that, no amount of technical defense will be sufficient.

What Would Actually Help

Addressing this requires work at every level.

For individuals, cyber hygiene needs to be treated with the same seriousness as public health. Password management, multi-factor authentication, the ability to recognize a phishing attempt — these are not optional skills anymore. They are survival skills for the digital age, and they need to be part of every school curriculum and every workplace training program.

For institutions, the shift from “prevention only” to resilience is essential. Breaches will happen. The question is whether an organization can detect them quickly, respond effectively, and recover without catastrophic damage. This means investing in incident response capabilities, backup systems, zero-trust architectures, and regular drills — not just compliance checklists.

For governments, we need international cooperation on a scale we haven’t yet achieved. Something analogous to nuclear non-proliferation — cyber non-aggression frameworks, shared attribution capabilities, coordinated law enforcement, and real consequences for state actors who weaponize cyberspace. This is diplomacy for the twenty-first century, and it is woefully behind where it needs to be.

And on the technological frontier, the arms race between attack and defense is only accelerating. AI-powered threat detection is becoming essential as attacks grow more sophisticated and automated. The looming arrival of quantum computing, which could render current encryption methods obsolete, demands urgent investment in post-quantum cryptography. These aren’t future problems — the data stolen today could be decrypted by quantum machines tomorrow, a strategy attackers are already employing.

The Unseen Connection

Here’s what makes cybercrime a genuinely “wicked” problem in the integral sense: it can’t be solved from any single quadrant of human experience. Better technology alone won’t fix it if the people using that technology are careless or uninformed. Better policy alone won’t fix it if the culture doesn’t value digital trust. Better individual awareness won’t fix it if the systems remain designed with security as an afterthought. And none of it holds if we don’t address the deeper moral questions about what governments and corporations are doing with these capabilities in the first place.

Cybercrime isn’t just a threat to our data. It’s a threat to the trust, cooperation, and shared infrastructure that make complex societies possible. Addressing it is not optional, and it is not someone else’s job. It is one of the defining challenges of our time, and meeting it will require us to grow — technically, culturally, institutionally, and personally — all at once.

Part of a series on humanity’s wicked problems. How these were written: source and method.

Contest a fact, suggest something, or tell us what’s broken

If someone is in danger right now, don’t use this form. Call your local emergency number (911 in the US). For trafficking: 1-888-373-7888, or text 233733.

What is it?

No name, no account. Your note goes into the site’s private records, nothing about your browser or connection is stored with it, and the email box is the only way we’d know who you are. The weekly review reads every note, re-reads the original source, and fixes the page if it should. A contested fact and its outcome are listed on Contested, in the review’s words, never yours.

No tracking on any link.Ticks stay on this device.What changedContested