Industrial espionage as a threat to U.S. business security

Industrial Espionage

Information is an element that can make an astounding difference in terms of succeeding, or attaining a profit, and failure, or attaining a loss in the realm of business. According to Robinson (2003), when a trade secret is stolen, it can either level the playing field, or worse, tip it in favor of the competitor. This aspect is even more intricate as trade secrets are sought after not just by rivaling companies but also by foreign countries as well (Robinson, 2003). This is done with the hope that the embezzled corporate data and information can be employed to enhance the competitive advantage of that country in the international marketplace (Robinson, 2003). Even though plenty of information collection is attained by scrutinizing and going over public records such as filings and databases, the paramount way of getting proper information is simply by taking it (Robinson, 2003).

Industrial espionage as well as extraneous economic collections are considered to be a considerable and mounting threat to the success and security of the United States (FSS, 2011). Because most of the business activities, and also the generation of new conceptions, currently take place in cyberspace, this has only increased the likelihood of such threats. Mischievous actors, in the form of tarnished insiders, or foreign intelligence services (FIS) can easily steal and transfer numerous amounts of data or information and at the same time remain mysterious and very difficult to detect (FSS, 2011).

Impact of Industrial Espionage on Companies and Individuals

Any form of business whose source of revenue or means of support is reliant on information should be wary of the threat that is corporate espionage. The information or data being sought after could be lists of clienteles, employee records, prototype strategies, blueprints for a new product or service, supplier contracts, and research documents (Robert, 2002). This sort of information or data could be of immense financial benefit to a competitor or individual, whereas its loss could have a disparaging and adverse financial impact on a company (Robinson, 2003). Pretty much any information collected from a company could be employed or utilized to conduct fraud, extortion, blackmail, or scams against the corporation or the personnel who work there (Williams, 1999; Robinson, 2003). For instance, a consumer list could be sold to a rival company, or utilized by a sales representative to create and boost his own company, and in doing so would have an impact on the profitability and success of the victim corporation (Robinson, 2003).

Companies are continuously enacting and implementing technology more rapidly in comparison with the manner in which they institute policies and mechanisms to defend themselves from potential Industrial Espionage (Robinson, 2003). With company infrastructures becoming more welcoming and intricate, in order to handle more cultured and refined applications, isolated consumers and users, distant workplaces and free-lancers, companies will increasingly come to be more vulnerable to impositions and information robbery (Robinson, 2003). In spite of the possible risks, security is unfortunately a second thought or late addition for the majority of corporations (Robinson, 2003). At present, only a small number of companies expend the resources required to train personnel or to obtain hardware and software required to supervise and safeguard their computers and systems (Robinson, 2003). The main reason behind this is because companies do not like to use resources and capital on an issue that they do not perceive they have (Robinson, 2003).

According to Edwards (2000), in the year 1999, about 1,000 corporations experienced losses of $45 billion due to theft of trade secrets, as per the results of a survey conducted by Price Waterhouse Coopers and the American Society for Industrial Security. In the present day, according to Robinson (2003), it is approximated that the theft of trade secrets is worth about $100 billion. Attaining precise statistics on corporate espionage is very difficult and challenging because most corporations do not want to make it known that they have become a victim of industrial espionage. In addition, most of the companies opt not to report such theft to the authorities due to fear that when such information is made public it could cause plummeting of its share price or perhaps interfere with ongoing major transactions (Robinson, 2003). Financial institutions such as banks are infamous for failing to report breaches in their network systems, because they do not want the federal government scrutinizing their systems or even more so interrogating their practices and strategies. On the other hand, small businesses and companies choose not to report any sort of incidences of corporate espionage as they are afraid that their trading partners might choose not to continue doing business with them once it is revealed that their systems and networks are not fully secure or are vulnerable (Robinson, 2003).

The Mission -- Information Retrieval

Taking into consideration that there are tools and players already, what sort of information do corporate spies in particular seek to find? According to Robinson (2003), in essence any digital, as well as hardcopy, data or information can be of value to rival companies and competitors in the market. The more information a competitor gains, the more useful it becomes to understand and/or predict the actions, strategies, practices, and policies of the firm being 'hacked'. In the end, the objective is to get the better of a company and attain the competitive edge (Robinson, 2003). Some of the information sought after by competitors include:

i. Marketing and new product plans

ii. Source code(s)

iii. Corporate strategies

iv. Manufacturing, technological operations

v. Target markets and prospect information

vi. Plant closures and development vii. Usual business methods viii. Product designs, research and costs

ix. Alliance and contract arrangements: delivery, pricing, terms

x. Company Websites

xi. Customer and supplier information xii. Merger and acquisition plans xiii. Financials, revenues, P&L, R&D budgets xiv. Marketing, advertising and packaging expenditures

xv. Pricing issues, strategies, lists xvi. Staffing, operations, org charts, wage/salary (Robinson, 2003).

Other sources of data that are sought after include employee records, such as their medical records, their social security number(s), salaries, and also performance reviews.

Who are the Perpetrators?

With the advancement of computers and the internet, it has become easier to steal trade secrets. Being in the information era, it is not really necessary for a thief to break into an office and steal a file cabinet that is full of data and information (Robinson, 2003). As technology use has increased and greatly developed, it is quite easy for a thief to process copies of digital data and information into discs, or even send it through emails via the internet to an account and retrieve it much later. As is said, "information is power" and having power transforms to having money; the corporate realm in particular has a lot of information (Robinson, 2003). Perceptibly exclusive information such as secret formulas, industrial representations, merger or acquisition strategies, and marketing policies are all of enormous value and are targets to cyber pilfers (Robinson, 2003).

It is expected by corporations that a thief will attempt to enter through the paths that are of least resistance. More often than not, this path can be the main front door. With companies promoting a more casual setting and climate with their personnel, they are disregarding executing proper procedures for security. For instance, in several companies, security guards are rarely placed in the lobby areas, office door are constantly left unlocked, and the computer systems are not secured with passwords or safeguards such as antiviruses (Edwards, 2001). This makes it possible for the attackers to use a variety of techniques to gain access to important and delicate company information.

Steps of Defense

The most common line of defense against any sort of corporate espionage is making use of a two-pronged line of attack. Basically, this consists of simply having well-ordered access, and knowing your personnel and consumers (Robinson, 2003).

1. Controlled Access

This is basically done by ensuring that the most vital and important data of the company is protected through data encryption. This is because once data is encrypted, even if it is stolen thereafter, it pretty much becomes of no use. If the network of the company in operation uses the internet, then it is important to have a firewall and to undertake an audit of the company servers for any security gaps from time to time. In addition, it is imperative for the company to ensure that its operating system has all of the security fixes installed and up-to-date (Robert, 2002).

Corporations should also ensure that in the secured system there are installed anti-viruses and software for password security. The computers should be scanned for viruses every week; as well, the password should be changed frequently if many individuals have access to the sensitive data and information. It is also recommended that companies should use disk drive locks to make sure that not every person can copy files from and into the drives as this may inadvertently result in the insertion of viruses into the computer (Robinson, 2003; Robert, 2002).

Another recommendation given is for companies to undertake frequent reviews of security measures in susceptible areas of operations, for instance in the R&D department. It is also important to make sure that constantly travelling executives and managers are well educated about the safety measures they should use to prevent any theft (Robinson, 2003).

2. Knowing Personnel

Gaining knowledge of the employees simply means undertaking verification of the backgrounds of new personnel, or even those personnel who are assigned tasks on projects that are sensitive. When hiring new workers to operate in sensitive areas of the company, including access to sensitive data, it is important for the company to undertake comprehensive background checks. For instance, the company should call all of the referees listed by the prospective employee to confirm they know him or her, and also to ascertain that indeed they are who they say they are (Robert, 2002).

In addition, the following list of basic security checks will be of assistance to a company in preventing any form of corporate espionage taking place (Robinson, 2003):

i. Locking all building doors. The passwords alone cannot be considered sufficient.

ii. Encryption of sensitive files and folders.

iii. Not discussing company secrets and sensitive information in unsecured settings

iv. Demand that all visitors should be escorted to avoid them gaining access to vital information

v. Design the BIOS to boot from hard drive only, and if the BIOS will sustain it, permit the setup password to preclude someone from changing the boot sequence.

vi. Use of code figures or names when using two-way receivers or pagers.

Conclusion

It is important for firms to acknowledge that Industrial Espionage does exist, and can form a potential danger if methods of security are not employed. The tremendous utility of computerized methods for creating and storing information has a downside in that it may provide access to outside intervention and outright theft if firms are not pro-active in protecting themselves.