Industrial Espionage in America - Essay Example

INDUSTRIAL ESPIONAGE IN AMERICA The information revolution and the advances in technology during the past decades has brought to fore many challengesand issues to both governments and businesses – the age-old crime of espionage or the practice of spying to gather secret information is one the most potential issues facing information-based societies such as the United States, today. While high technology offers the ability to collect and use information for competitive edge over others in meeting business and government objectives, it also makes modern information and technology-based nations and businesses vulnerable as information can be stolen from electronic storage media and transmitted in seconds without even physically removing the data. The paper attempts to examine and understand the challenge of espionage to industries and businesses in America. However, in doing so, it shall also look at the historical development of espionage and examines how the advances in technology in the recent years have facilitated the act of espionage, and also the measures that may prove useful in controlling industrial espionage. As a prelude to the research, it may be worthwhile to understand how industrial espionage is defined, its nature and implications. Industrial Espionage – Definition and Nature The Federal Bureau of Investigation defines industrial espionage as “an individual or private business entity sponsorship or coordination of intelligence activity conducted for the purpose of enhancing their advantage in the marketplace.” [Cited Boni and Kovacich, 2000; p. 48] While the definition may imply industrial espionage to be more or less the same as business or competitive intelligence, John F Quinn explains the essential difference between the two – while business intelligence is generally under private sponsorship using an “open” methodology, espionage may be either government or privately sponsored and clandestine. [Cited Boni and Kovacich, 2000; p. 47] In the highly competitive and globalized business environment, proprietary intellectual property and economic information is considered the most valuable commodity by all nations, particularly the advanced ones. Businesses and/or governments involve in espionage activities for the purpose of unlawfully or clandestinely obtaining sensitive financial, trade or economic policy information, proprietary/sensitive economic information; or critical technologies including but not limited to data, plans, tools, mechanisms, compounds, designs, formulae, processes, procedures, programs, codes or commercial strategies, whether tangible or intangible, for competitive business advantage. The proprietary information so stolen may have been stored, compiled or memorialised physically, electronically, graphically, photographically or in writing and may be reasonably protected by the owner and not available to the general public. [Boni and Kovacich, 2000; p. 48] Proprietary information may be stolen by employees accessing the business and company databases, hackers breaking into the company server, or sponsored teams of burglars. While companies may lose vital business information through employees leaving the job, espionage occurs when the employee willfully looks for the data, steals it, copies it and sells it for money, or for his own unit, when he intends to produce a similar item. Espionage by competitors involve spying the activities of other businesses and unlawfully gathering of secret information, so that they can steer their businesses by adopting appropriate strategies and stay at par with, if not ahead of, competition in the marketplace. Interested outsiders and competitors adopt many methods including bribery, detective spying through shady agencies, searching through garbage, also referred to as ‘dumpster diving,’ scams to trick workers through ‘social engineering’, or even expose loopholes and weak points in the lives of workers and blackmail them for gathering information. The theft or unlawful receipt of intellectual property and economic information, particularly by competitors and foreign governments threatens the development and production of goods derived from such information and also results in loss of profits, market share and perhaps the business itself and may thereby result in the weakening of the economic power of one’s country. [Boni and Kovacich, 2000] In the present information-driven business environment, businesses tend to address the threat seriously, and in their quest to gain power, maintain control, increase market share and beat competition, nations and businesses espouse espionage, treating it casually and engaging themselves in espionage, using information and technology as armaments of business and economic warfare. [Jones, Kovacich and Luzwick, 2002] Espionage – A Brief History The technological advances and the global Internet have drastically reformed the art of espionage. The practice of espionage has transformed revolutionarily over the years, as any aspect of life and civilization, from the old manual and human intensive profession to the sophisticated, hi-tech pursuit of stealing electronic information in networked societies. Toffler and Heidi provide a Three Wave Evolution model to explain the technological evolution, as well as the evolution of espionage. [Toffler, 1980; Toffler & Heidi, 1994] Accordingly, during the First Wave period, extending from the beginning of human race to about mid 1700s and characterized by the agricultural revolution, information was passed by word of mouth or in written correspondence. The theft of information was minimal as most of the people could not read or write and espionage was manual, relying mostly on personal observation and one-to-one contact. The Second Wave or the ‘rise of the industrialized civilization,’ which followed and last until a few years after World War II, experienced exponential growth in communications and the sharing of information, made possible by such inventions as telegraph, telephone and computers. The later years of this period saw the development and use of cryptography as communication protection and anti-espionage tool, though essentially by governments. While businesses had also begun to use computers, most of the systems were stand-alone and hence the threat of espionage was limited. Espionage was thought of primarily as a government and/or military problem and anti-espionage measures during the period essentially consisted of some form of physical security of physical documents and equipment, such as combination of locks, guards, alarms and fences. Emphasis was also placed on personnel security – hiring honest and ethical employees in computer field was deemed to limit espionage threats. As only few people operated computers, the threat to electronically stored information was limited. [Toffler, 1980; Toffler and Heidi, 1994] The Third Wave or the age of technology and information, sweeping the world today has seen more advances in communication and information sharing, and paradoxically more threats, than the First and Second Wave periods combined. While the Internet and the globally linked communication systems serve as a mainstream business medium, objectionable reports on how high-tech criminals in businesses and government intelligence agencies of all advanced nations are exploiting the possibilities of the cyber world to meet their various ends, continue to be appal the world conscience. Today, a large number of organizational actors and individual information-brokers sponsored by government and otherwise, are using the Internet to commit the old crime of espionage in a revolutionary new way – what Boni and Kovacich terms the ‘netspionage’ or network enabled espionage. According to them, in the present information-driven globalized society, the distinction between espionage motivated wholly by military advantage and the quest for market domination is blurred of not completely eliminated. The researchers claim that the 21st century, envisaged as ‘the “Information Age” or the “Age of Technology” to be may instead come to be known as the “Age of Netspionage Agent and Techno-Spy.”’ [Boni and Kovacich, 2000; p. 5] Before attempting to understand the occurrence of industrial espionage in America, it may be vital to understand the techniques used by the modern espionage – Netspionage – agents and techno-spies so that adequate and effective measures could be adopted to prevent the threat of espionage. Some of the common methods used by Netspionage agents include: Data Diddling - changing data before or during entry into the computer Scavenging - Obtaining information left around a computer system and in trash cans Data Leakage - Removing information by smuggling it out as part of the printed document Piggybacking/ Impersonation - Physical access to electronic data using another’s User ID and password to gain computer access and protected information. Simulation and Modelling - Using the computer as a tool to plan and/or control a criminal act Wire Tapping - Tapping into a computers communication links to be able to read the information being transmitted between systems and networks [Boni and Kovacich, 2000; p. 58] Apart from the above, the use of software application programs, which are standardized over the years enable the use of a variety of hacker tools including Trojan Horse enabling covert placement of instructions in the program for unauthorized functions; Trap Doors for inserting debugging aids that provide breaks in the instructions for insertion of additional code and intermediate output capabilities; Logic Bombs or programs executed at a specific time period; and the common Computer Virus which are malicious codes that cause damage to the system information. [Boni and Kovacich, 2000; p. 59] Industrial Espionage in America The United States being the most dominant economic power in the world today is also a major target of espionage. In 1988, the FBI accused a former Amgen Inc. researcher of peddling secret documents concerning the wonder drug Epogen. In 1989, U.S. agents tracked down three moles working at an IBM affiliate in France after they supposedly botched a sale of confidential documents. [Cited Crock, 1997] The massive information technology infrastructure enables businesses and industries to tap proprietary and secret information of competitors to gain control of the global market place. Research suggests that the threat of espionage and the loss of proprietary/sensitive information have hit the manufacturing industries particularly hard. As the R & D expenses for manufacturing companies are costly, some companies, foreign or domestic, are tempted to catch up even if through unlawful means. [Naef, 2003] Industrial espionage is rampant in the United States -- according to the FBI, of the 173 world nations, 57 were actively running operations targeting the U.S. companies; about 100 countries spent some portion of their funds targeting U.S. technologies. [Boni and Kovacich, 2000; p. 50] A survey conducted by PricewaterhouseCoopers and the American Society for Industrial Security revealed that Fortune 1000 companies lost more than $45 billion in 1999 due to theft of their proprietary information alone. The study finds that “although manufacturing reported only 96 incidents, the acknowledged losses of manufacturing companies accounted for the majority of losses reported in the survey, and averaged almost $50 million per incident.” [Cited Naef, 2003] While current and former employees, suppliers and customers are considered to be responsible for 70 to 80% of proprietary/sensitive information losses, an unidentified survey suggests that 21 percent of attempted or actual thefts of proprietary/sensitive information occurred in overseas locations. [Boni and Kovacich, 2000; p. 50] It is significant to note that the U.S is not only a target of espionage, but also actively indulge in espionage activities themselves. The US government has admitted using commercial espionage – phone calls were illegally tapped to determine that a French competitor of a US firm was bribing Brazilian officials to obtain an air traffic control radar contract; it was later revealed that the US firm was also bribing officials. It is generally believed that large intelligence agencies of developed nations are involved in the practice of espionage. A commission of the European Parliament suspects that ECHELON, a communications espionage system operated by the U.S. National Security Agency and agencies of the United Kingdom, Germany, Canada, Australia and New Zealand, is used for political espionage and occasionally to help American companies against European competitors. [Vest, 1998] Economic Espionage Act of 1996 Economic and industrial espionage present many challenges to many American companies as rampant information breaches are costing companies substantial sums of money. While corporations and businesses often do not report espionage incidents to law enforcement, the Federal government today recognizes industrial and economic espionage as a crime; the Congress has legislated the Economic Espionage Act of 1996 in an attempt to aid companies to protect themselves from espionage. Section 19831 punishes the theft, misappropriation, wrongful alteration and delivery of trade secrets when accused parties intended to, or knew that their misconduct would benefit a foreign government, instrumentality or agent. The Act allows for legal action regarding “financial, business, scientific, engineering, technical and economic information,” if a company can demonstrate it has attempted to keep this information classified and protected. The prescribed maximum punishment for an individual offender is 15 years’ imprisonment, $ 500,000 fine or both; for an organization the fine is $10 million. [Kelley, 1997] It is understood that many companies don’t take advantage of the Act; companies safely exploit the law in full knowledge when news of the breach is known publicly. However, as Naef observes, if the trade secret theft is not publicly known, a company may have to meticulously assess the advantages and disadvantages of suing another company and thereby going public as news of the theft may damage the company’s reputation. [Naef, 2003] Yet, cases of industrial and economic espionage have been reported since the enactment of the Act, though scantily. In September 2003 one man was pled guilty of copying trade secrets as defined under the Economic Espionage Act of 1996; the case was the first of its kind in Northern California. The US Attorney’s office later publicized that Say Lye Ow, a 31 year old originally from Malaysia, copied sensitive information on Intel’s first 64-bit processor when he left the company in 1998. [Naef, 2003] Industrial Espionage and Corporate Vulnerability It is often the failure of corporations to adequately protect their information resources that makes them vulnerable to espionage. The vulnerability and the nonchalant attitude of companies are by no means excusable, given the economic implications of the threat of espionage as well as the weakening of the economic power of the subject nation. It may be worthwhile, perhaps vital, to understand the reasons for the vulnerability of corporations in order to prevent espionage and the resulting economic losses to businesses. Businesses make themselves vulnerable to espionage for a variety of reasons, including: Proprietary/sensitive business information not identified Proprietary information not adequately protected Computer and telecommunication systems not adequately protected Lack of or inadequate policies and procedures Employees not aware of their responsibilities Management attitude of “ We don’t have proprietary or sensitive information” and/or “It can’t happen to us” [Boni and Kovacich, 2000; p. 50] These factors along with such other threats as increasing miscreants trying to steal information for money and the vulnerabilities of systems on the Internet facilitating information theft on a global scale present pervasive threat to information worth protecting as well as challenge managers, security personnel and law enforcement officials responsible for safety and security of information. Preventing Industrial Espionage While legal measures and legislations that send strong messages against espionage can be effective in preventing its occurrence, the role and responsibility of corporations is crucial. Even as companies take a non-serious approach to espionage, there is little debate that companies should guard themselves effectively against the ‘info-thieves’, both insiders and those unleashed by outsiders, who try to get secrets by all possible means. Measures that may help companies to prevent espionage include: Conducting a survey of risk assessment, and identifying potential risk areas, Developing a security policy without much of safety risks. Frequently evaluating the security policy and procedures and modify if necessary Classifying and marking sensitive and valuable information Isolating information that should never fall into the hands of a competitor Detecting the vulnerable areas that could be exploited by a competitor Controlled storage of sensitive information Controlled destruction of materials Executing Nondisclosure Agreements for employees, vendors and contractors Securing computer systems and networks by installing appropriate information system security products Monitoring email and Internet use [Winkler, 1997; Boni and Kovacich, 2000] While the above methods may be useful in protecting against espionage, central to controlling the industrial espionage is security awareness and training of employees as one of the major points of vulnerability is spying activities by people belonging to the same organization. “Security awareness and training programs can serve to inform employees about their organization’s information security policy, to sensitize them to risks and potential losses, and to train them in the use of security practices and technologies” [Denning, 1998, p.382]. By investing in security procedures and training, corporations may train employees in the areas of personnel, cyberspace and physical security; they can also be made aware of their responsibilities regarding information security of the organization. Conclusion The increasing value of trade secret information in the global and domestic marketplace and the possibilities of the information technology revolution have resulted in a significant rise in espionage activities in the recent years, particularly against the U.S. being the most dominant economic power in the world. While legislations may be useful in preventing the crime of industrial and economic espionage, the onus is largely on corporations to implement adequate security policies and measures to protect themselves from business losses as well as prevent the weakening of the economic power of their country. References 1. Boni W. & Kovacich G.L. (2000) Netspionage: The Global Threat to Information MA: Butterworth- Heinemann 2. Crock, S. (1997) “Business Spies: The New Enemy Within?” Book Review: War By Other Means” Economic Espionage in America By John J. Fialka Business Week Available at: http://www.businessweek.com/1997/06/b351325.htm Accessed 02/26/06 3. Denning, D. E. (1998) Information Warfare and Security MA: Addison-Wesley 4. Jones A. Kovacich G.L. & Luzvick P.G. (2002) Global Information Warfare: How Businesses, Governments and Others Achieve Objectives and Attain Competitive Advantage Florida: Auerbach Publications 5. Kelley, P.W. (1997) “The Economic Espionage Act of 1996” In Boni W. & Kovacich G.L. Netspionage: The Global Threat to Information MA: Butterworth- Heinemann p. 241-247 6. Naef, W. E. (2003) “Economic and Industrial Espionage: A Threat to Corporate America” Infocon Magazine Issue One, October Available at: http://www.iwar.org.uk/infocon/economic-espionage.htm Accessed 02/26/06 7. Vest, J. (1998) “Erosion of Individual Privacy - Echelon Subchapter” The Village Voice, August 11 Available at: http://www.mega.nu:8080/ampp/echelon.html Accessed 02/26/06 8. Toffler, A. & Heidi. (1994) Creating a New World Civilization Atlanta: Turner Publishing 9. Toffler, A. (1980) The Third Wave NY: Bantam Book 10. Winkler, I. (1997) Corporate Espionage CA: Prima Publishing Read More