Industrial espionage as a real time phenomenon Ankit Rupda Rupam Chatterjee

Address: Institute for Technology and Management,

Kharghar, Navi Mumbai 410210. E-mail: rupda_ankit@itm.edu rupamrocks30@itm.edu

Abstract The objective of this paper is to discuss the concept of Industrial espionage with an HR point of view. This paper also aims at throwing light on the various forms of industrial espionage and its countermeasures. The world today projects a scenario where competitors are experiencing cut-throat competition to its last level. In India also, healthy competition is rarely visible and unethical measures like spying have become common to gain a competitive advantage over ones competitors. The recession adds to the scarcity of financial resources and thus every lead over ones competitor matters a lot in terms of money. Todays market scenario in India demands a real time need for knowledge about industrial espionage. We are presenting this research paper to create awareness and to provide countermeasures to such unethical activities. Topics included in our research paper are- Meaning & definition of industrial espionage; Brief history of espionage; Motives of industrial spying; Various forms of industrial espionage; Spy devices and agencies; Indicators of spying and characters of spies; Psychology of spies; How to prevent industrial spying; How to catch the spies; Legal aspects of industrial spying; etc. The research is mainly based on secondary data collection, analysis and representation of the information from various sources like business journals, news papers as well as different websites.

1. Defining industrial espionage Industrial espionage is acquisition of trade secrets from business competitors. It is a reaction to the efforts of many businesses to keep secret their designs, formulas, manufacturing processes, research, and future plans. Trade secrets may find their way into the open market through disloyal employees or through various other means. Penalties against those found guilty range from an injunction against further use of the knowledge to substantial damages.

2. Brief history of espionage Espionage is the second oldest profession of the world (The first one is prostitution). The ancient strategists of India and china such as Chanakya and Sun-tzu have mentioned espionage in their books as one of the strategies of war and politics. In Japan also Ninjas were used as spies to gather information. The Cold War involved intense activities on espionage between the United States of America and its allies, the Soviet Union and the People's Republic of China and their
2

allies, particularly related to secrets of nuclear weapons. Recent trends illustrate the evolution of espionage as an important tool to success amongst industries and corporate. According to American Society of Industrial Security, between 1992 and 1995, breaches in corporate security rose by 323 %. It caused about $2 billion of loss in R&D and sales. These activities reached at peak during 1998 when it caught the attention of everyone. In response to this problem, US government passed Economic espionage act which makes stealing this kind of information and secrets a federal crime. Yet according to a recent survey, 205 firms admitted that their secrets were penetrated by outsiders through computer networks and through employees. Thus, industrial espionage today adds in as an additional significant factor in the determinants of threats and opportunities in the global corporate world today.

3. Motives for industrial spying 3.1. Individual Motives Money: For many spies, the primary motivating factor is the prospect of financial gain. Spies may simply seek to supplement whatever income they already receive, or may be driven to spying due to financial difficulties. Ideology: Sometimes, a person will become a spy simply because of their beliefs. These can include their political opinions, their national allegiances, or their cultural or religious beliefs. Personal Relations: A spy may also be motivated by personal connections and relationship. Conflicts in relations in past may motivate a person to do spying and harm the organization. Ego: The role of ego and pride in motivating spies has occasionally been observed, but is often hard to demonstrate. This motivation often involves the target gaining a sense of superiority over his or her colleagues, whom he or she is outwitting. Self-importance or excitement: The role of ego and pride in motivating spies has occasionally been observed, but is often hard to demonstrate. In some situations, a person can be enticed to spy by the sense of importance or significance which it gives them they cease to be simply a minor functionary, and are having a substantial, albeit covert, impact. This motivation often involves the target gaining a sense of superiority over his or her colleagues, whom he or she is outwitting. Furthermore, in rare cases a spy may even be motivated by the excitement of tradecraft alone. Coercion: Not all spies enter into service willingly sometimes, a person can be threatened into providing secret information to another country. Threats of injury or death are the most direct form of coercion. For example, Mathilde Carr, a member of the French Resistance, was captured by the Nazis and threatened with torture unless she became a double agent. Threats can also be made against family or friends of the target.
3

3.2. Organizational Motives To gain some kind of competitive advantage against the competitor. To acquire a new technology without any cost and hard work. To obtain research material at the lowest possible cost. To be able to reap the benefits of competitors research without even spending on R & D. To get the database of potential customers. To know competitors future plans. To get an intimation of prospective product launches. To get the information regarding manufacturing process or a part of it. To get confidential formulas and mixes regarding the product. To spoil competitors reputation.

4. Forms of Industrial Espionage i. ii. Stealing, or without authorization appropriating, taking, carrying away, or concealing, or by fraud, ratifying, or obtaining a trade secret. without authorization copying, duplicating, sketching, drawing, photographing, downloading, uploading, altering, destroying, photocopying, replicating, transmitting, delivering, sending, mailing, communicating or conveying a trade secret. Receiving, buying, or possessing a trade secret, knowing by stealing, obtaining, or converting without authorization.

iii.

5. Methods of Spying 5.1. Legal Methods There are also several forms of industrial espionage which are legal. They can be described as given below. Open Source Information is one of the mostly used legal methods for industrial espionage. In this method, the competitor collects information from variety of forms including newspaper articles, corporate Annual Reports, patent filings, court papers, and marketing information sources. From this information they can presume some of the critical information regarding the company. Companies can also hire former employees of their competitors. Through that they can get their way and system of doing the work. Many companies use trade shows and conferences to elicit information from competitors. Typically, corporations send their researchers and marketing staff to these events to either stay abreast of the latest research or sell services or products. These people usually give out information better than they collect it. Companies involved with industrial espionage also send information collection specialists to these events. They usually act like potential customers or fellow researchers to elicit information from people that are all to willing to give it up. Through Advanced training these collection specialists have perfected the art of drawing out as much Information as possible.

5.2 Illegal Methods There are a number of illegal espionage methods prevailing in the corporate world to get the information from other companies or persons. Lets discuss them one by one.
5

Snagging: A spy can try snagging information by listening in on a telephone extension, through a wiretap, or over a cubicle wall while the victim gives critical information to someone.. Dumpster diving: One of the popular techniques is dumpster diving. Spies can go through garbage cans, dumpsters or trash bins to obtain cancelled checks, credit card statements or bank account statements and much other critical information regarding company which can harm it. Sending spies as employee: Spyware: Spyware is a kind of software which can track a computer users activities and report them to someone else. There are now countless varieties of spy ware programs. Some types of spyware operate openly. For example, when you install and register a program, it may ask you to fill a form. The program then sends the information to the developer, who stores it in a database. More commonly, spyware is installed in a computer without the users consent. Spyware can land on the system from many sources like web pages, e-mail messages and pop ups. Spyware can track virtually anything you do and secretly report your activities to someone else. Spyware can record individual keystrokes, web usage, email addresses, personal information or anything which is in your computer system. Surveillance: Surveillance is currently a large type of espionage that spies are using. The advancement of the technology age has allowed surveillance to be a more prevalent and widely used technique. Cameras can be made as small as postage stamps and satellites can take pictures of nearly anything in the world. In 1999 a Denver-based company launched an internet based company that offered satellite images to the everyday consumer. Space Imaging, launched its Ikonos satellite and offers one-meter black-and-white photos.

6. Spy devices and Agencies We can discuss this topic in two parts. 6.1. Spy devices There are several hundred retail and Internet spy stores selling a wide variety of Spy Stuff, which come in all sizes, shapes and functional reliability. Depending upon the application, you can buy Spy Stuff that will intercept room conversations, wiretap phone conversations or use a pin-hole lens to secretly watch someone.

These spy devices includes a number of varieties like spy cameras, mini cameras, wireless cameras, motion activated cameras, security cameras, counter spy equipment, spy gadgets, telephone recorders, digital voice recorders, tiny video recorders, digital video recorders, gps vehicle tracking, GPS asset tracking, audio transmitters, video transmitters, tracking transmitters, lock pick kits, lock pick courses, lock pick tools, lock pick books, can safes, gun safes, diversion safes, wall safes, paper shredders, strip cut shredders, cross cut shredders, high capacity shredders, night vision, self defense products, self defense books, self defense videos, and much more. Apart from all these devices, nowadays spyware are also used widely for this purpose. Its easy to use but very tough to detect. Many websites and spying agencies provides this kind of software which can be used to steal data or change data from a computer system. 6.2. Spy agencies There are many agencies and firms which provides services regarding investigation. In 1833 Eugne Franois Vidocq, a French soldier, criminal and privateer, founded the first known private detective agency, "Le Bureau des Renseignements Universels pour le commerce et l'Industrie" (Office of Intelligence) and hired ex-convicts. Some of these agencies are as given bellow. Pinkerton Consulting and Investigations is a security guard and detective agency established by Allan Pinkerton in 1850. The agency merged with the William J. Burns Detective Agency in 2003 under Securitas AB. The Thiel Detective Service Company was a private detective agency formed by George H. Thiel, a former Civil War spy and Pinkerton employee. The Thiel Detective Service Company headquarters were in St. Louis, Missouri. The company was formed to be a direct competitor to the Pinkerton Detective Agency, but never achieved this status. The William Burns International Detective Agency was Pinkerton's largest competitor. Griffin Investigations was once the most prominent group of private investigators specializing in the gambling industry. The company was founded in 1967 by Beverly S. Griffin and Robert R. Griffin. Carratu International was set up in 1963 by Vincent Carratu as a corporate investigations company. The company has a general corporate investigations practice, but has a number of key specialisms, including the protection of intellectual property (attacking counterfeiting and piracy and protecting trademarks), an anti-fraud unit, a specialist employee vetting service, Bad Apple Services and a computer forensics unit.

7. Indicators of spying and Characteristics of Spies

Counterintelligence indicators are signs that an individual may already be involved in espionage or other improper use of classified information. The record of past espionage cases shows that co-workers and supervisors often overlooked or failed to report counterintelligence indicators which, had they been reported, would have permitted earlier detection of the spy. Some of the following indicators are clear evidence of something wrong going on in your organization. Asking others to obtain or facilitate access to classified or unclassified but protected information to which one does not have authorized access. Obtaining or attempting to obtain a witness signature on a classified document destruction record when the witness did not observe the destruction. Offering extra income from an outside activity to a person with a sensitive job, in an apparent attempt to entice that person into some unspecified illegal activity. Undue curiosity or requests for information about matters not within the scope of the individuals job or need-to-know. Taking classified materials home or on trips, purportedly for work reasons, without proper authorization. Working odd hours when others are not in the office without a logical reason, or visiting work areas after normal hours for no logical reason. Bringing cameras or recording devices, without approval, into areas storing classified or other protected material. Unexplained affluence or life-style inconsistent with known income. Includes sudden purchase of high-value items or unusually frequent personal travel which appears to be beyond known income sudden repayment of large debts or loans, indicating sudden reversal of financial difficulties.

8. Prevention of Industrial espionage 8.1. For persons having high posts in organization Do not trust: The most important advice is not to simply trust everyone. Do not get so personal with anyone who can be harmful to you or your company by taking out the secrets. Excess confidence on others becomes harmful many times. Make your things safe: Make your office, your papers, your lockers, your briefcase, your laptops everything so safe that even a single bit of information could not go out of it in the hands of wrong person. Be wary about filling out forms: Whenever you fill a form on a webpage or for any kind of survey, or submit a warranty card for a product, you give information about yourself. Some o
8

these forms ask for more than your name and address. Dont fill this kind of forms unless you know companys privacy policy. Guard your official email address: Give your official email address only to people you trust and second address for everything else. This secondary address will have all of your spams, leaving your primary inbox clean. 8.2. For general purpose: The problem often lies in the fact that we are constantly tempted because the corporate jewels are literally just lying around where anyone can find them. The problem for todays enterprise is that the transfer of information is increasingly time-critical and the traditional approaches such as FTP and secure email are awkward to manage, and often lack the security mechanisms that sensitive data demands, thus making the risk of leakage very possible. And where it becomes really challenging is when you need to share information with business partners. So here are a few suggestions Do not expose your internal network: The process of transferring files in and out of the enterprise must be carried out without exposing and risking the internal network. No type of direct or indirect communication should be allowed between the partner and the enterprise. Make sure that intermediate storage is secure: While information is waiting to be retrieved by the enterprise or sent to the business partner, it must reside in a secure location. This is especially critical when the intermediary storage is located on an insecure network, such as the enterprises DMZ, outsourced site, or even the internet. End-to-End network protection: Security must also be maintained while the data is being transported over the network. The process of transferring data must be in itself secure. Users that store or retrieve data must be authenticated, sometimes using strong authentication mechanisms. In addition Access control must ensure that users only take appropriate action, and that only authorized actions are carried out. Auditing is required to ensure that a detailed history of activities can be reviewed and validated. A sophisticated user management scheme along with strong authentication capabilities is essential. Access control must allow the ability to departmentalize the data and the access to it, and detailed logs auditing and tracking of every activity must be available. Process Integrity: As data transfer is an essential part of a larger business process, it is critical to be able to validate that this step in the process was executed correctly. This requires the solution to provide auditing features, data integrity verification and guaranteed delivery options.
9

Its always comforting to know that there is still some honesty in the business world when we hear about Pepsis action in alerting their main competitor. But I guess we have to accept that this is the exception rather than the rule; so whos deciding today whether to alert you to the fact that your corporate jewels are being hawked around, or are they just accepting that fate has dealt them a favorable hand.

8.3. Preventive actions at the time of recruitment: In most of the industrial espionage cases, the spy is caught from inside the organization working as an employee. So, it is better to have some precautions at the time of recruitment of employees. According to a former soviet union KGB officer 1,000 initial contacts lead to 100 operational contacts, which leads to 10 developmental contacts, which leads to 3 trusted sources, which leads to 1 recruitment

Besides, dont only check his knowledge but also check his ethical strength by some questionnaires or interviews regarding ethics. By this you can check his psychology that whether he will do spying (if he got a chance) or not.

10

9. Catching the spies It is so important for anyone who may be considering espionage to understand that they WILL be caught. Perhaps not right away, but eventually. The statute of limitations does not apply to the crime of espionage. Anyone who commits this crime will have to be looking over their shoulder for the rest of their life. Intelligence Service: Of the people who held a security clearance who have been arrested for espionage, many were caught as a result of information provided by intelligence services agencies, or a penetration agent or friend within other industries that the spy was working for. People who betrayed their organization often have little fear of being caught, because they think they are smarter than everyone else. No matter how smart or clever a spy may be, he or she has no protection against the sources within intelligence services.

11

Routine Counterintelligence Monitoring: In many industries, routine counterintelligence monitoring is done. In this monitoring the spies are caught many times. So, we can say that this kind of monitoring should be done in big industries at regular intervals to prevent industrial espionage. Surprise checkups, checking of personal belongings, checking of income etc are the routine counterintelligence monitoring. Changes in Behavior: Espionage usually requires keeping or preparing materials at home, traveling to signal sites or secret meetings at unusual times and places, change in ones financial status with no corresponding change in job income, and periods of high stress that affects behavior. All of these changes in normal pattern of behavior often come to the attention of other people and must be explained. Other people become suspicious and pass their suspicions on to others. Spying is a lonely business. To explain these changes in behavior, or out of a need to confide in someone else, spies often confide in a spouse or try to enlist the help of a friend. The friend or spouse in whom the spy confides often does not remain a friend or loyal spouse after he or she realizes what is going on. Irrational Behavior: They are driven, in large part, by irrational emotional needs to feel important, successful, and powerful or to get even. These emotional needs are out of control, so the same emotional needs that lead them to betray also cause them to flaunt their sudden affluence or to brag about their involvement in some mysterious activity. Because they are so mixed up psychologically, they make mistakes that get them caught.

10. Legal Aspects of Industrial Spying In USA, Industrial espionage act, 1996 is prevailing against malpractices of corporate spying. It was introduced on August 27, 1996. But in India, there is no specific and powerful act against it. Neither there is any provision against this kind of practices. It is a real time need to make and implement this kind of act.

12

References: 1) 2) 3) 4) www.wikipedia.org www.net-security.org www.answers.com Comparing Insider IT Sabotage and Espionage: A Model-Based Analysis

by Stephen R. Band, Ph.D. (Counterintelligence Field Activity) Dawn M. Cappelli (CERT) Lynn F. Fischer, Ph.D. (DoD Personnel Security Research Center) Andrew P. Moore (CERT) Eric D. Shaw, Ph.D. (Consulting & Clinical Psychology, Ltd.) Randall F. Trzeciak (CERT) December 2006 TECHNICAL REPORT CMU/SEI-2006-TR-026 5) Industrial espionage: the dark side of espionage by dr. Omid nodoushani 6) www.spysite.com 7) www.newsfactor.com 8) Industrial espionage act of 1996, USA government. 9) www.ntc.doe.gov 10) www.rediff.com/news 11) www.forensics-intl.com 12) www.businessweek.com 13) www.cbsnews.com 14) www.koreatimes.co.kr 15) www.CIOZone.com

13