In its sixth annual Computer Crime and Security Survey, the Computer Security Institute reported that 85 percent of respondents (mostly large corporations and government agencies) detected computer security breaches within the last 12 months, and 64 percent acknowledged financial losses from these break-ins.

What should companies do differently?

Security is a process, not an event, and that makes it very hard to handle on an ongoing basis. It's not like fire, where you put in a fire extinguisher, pay a yearly bill for a monitoring service, and wipe your hands of the whole thing. Computer security is more complex because the technology keeps changing. The vulnerabilities keep changing and people become aware of new ones. The only way you can successfully manage that is with continual effort.

We tend to think of computer crime in purely economic terms, but haven't some incidents had more tangible repercussions?

Absolutely. There was a case involving a juvenile in Worcester, Massachusetts, who hacked a telephone switch and shut it down. The difficulty was that switch serviced the local airport, where the tower was unmanned. The airport had to be closed and the planes diverted.

Computers have given individuals power that was reserved for governments in previous decades. Do we need new laws that limit how computers can be used? Do we go as far as licensing them?

We need much more education. We've given weapons of war to five-year-olds. We don't normally do that. With most powerful technologies—think about guns or cars—adults get them first and then they teach their children how to use them. 'With computers,' we did it the other way, with admittedly very mixed results.