Economic Espionage

Clandestine Methods Used to Disadvantage Canadian Interests

June 1999

Editor's Note: This CSIS Liaison / Awareness Brief will be of particular interest to those concerned with the risks to Canadian government and private sector interests posed by the clandestine activities which certain foreign governments may pursue to obtain economic and commercial information.

This brief is published as part of CSIS's national Liaison/Awareness Program. Through this program, the Service seeks to establish ongoing dialogue with organizations, both public and private, concerning the threat posed by those engaging in computer-based attacks against Canadian interests and by foreign government involvement in economic espionage.

I. Introduction

Economic espionage is damaging Canadian interests at home and abroad. This damage takes the form of lost contracts, jobs and markets, and overall, a diminished competitive advantage. However, the full impact of this activity is difficult to quantify for a number of reasons, including the reticence of companies to reveal the full extent of losses, even when they are known. While not all foreign governments are involved, they all have the potential to commit acts of economic espionage in support of their public and private sector interests. The methods most often employed involve the covert activities of people who have legitimate access to company facilities and information. Vulnerability to acts of economic espionage can be reduced through effective security practices. This paper highlights some of the more common means in which information and technology can be compromised and provides ways in which vulnerabilities can be reduced.

II. Clandestine Access

Employees

Employees may be targeted for their knowledge of, or ability to gain access to, valuable proprietary or sensitive information. For example, employees may be approached for the expertise they personally possess relative to specific scientific work or projects they may be involved in. Similarly, employees with legitimate access to classified government or other sensitive private sector information including reports, passwords (ie: to access computer systems or secure areas) and R&D projects, can be recruited to steal or copy the information. Motivation on the part of an employee to cooperate with a foreign interest can range from monetary remuneration to revenge, from patriotism to coercion. Employees may also unwittingly cooperate with those clandestinely seeking to acquire information; for example, by providing information to an individual posing as a client or government official.

Foreign governments, including their intelligence services, have the potential either to recruit existing employees and/or facilitate the placement of new employees in particular companies or organizations in order to access specific information. In one example, a Canadian company's technology was compromised when the company, hoping to secure a lucrative contract from a foreign government, accepted a national of that country to work on a sensitive, leading-edge technology project. The foreign government then proceeded to duplicate the technology based on the information obtained through the direct access their national had to this project.

In another case, a foreign national working at a Canadian company was found in possession of restricted R&D and sensitive proprietary data. The individual had entered the premises after hours with an assistant, and together they attempted to steal information stored in electronic databases, which they had spent several weeks correlating. The extent to which company interests were compromised before the individuals were caught has never been determined.

Individuals who intentionally move between companies can gain valuable information and expertise at each job; knowledge which can then be passed or sold to foreign interests.

Contract Employees and Consultants

The use of outsiders, contracted for specific purposes and durations, is a normal part of conducting business today, but represents another avenue through which a company's economic interests may be compromised. As part of a legitimate business agreement, a foreign interest can use contract personnel to gain access to valuable data or information. In one case, a Canadian company discovered two technicians from a foreign state-owned company covertly engaged in trying to obtain proprietary data. The two foreign nationals had been placed in the Canadian facility as part of a contract agreement. Compounding this, an executive from the Canadian company, while visiting the foreign company overseas, believes that his briefcase and documents were compromised while they were left in the "security" of the foreign corporation's office. One target of these activities may have been the Canadian company's contract and subcontracting information. According to the Canadian company, a multimillion dollar contract may have been lost as a result of this activity.

Exchanges

Visiting scientists, technicians, students and delegations are also known avenues by which foreign governments can clandestinely acquire valuable economic information and technology. While this abuse is believed to be limited, it does represent a vulnerable point, particularly as cooperation, joint ventures, between universities, companies and government organizations increase. In one incident, a professor working at a Canadian university on specialized applications for high-energy equipment had his technology stolen. Two foreign exchange students had gained access to the project and the technology they clandestinely acquired was subsequently reproduced in their native country. In a separate incident, a foreign scientist working in the biotechnology sector stole laboratory cultures and confidential company manuals from a Canadian company which is believed to have lost valuable R&D data, as well as potential earnings. It was later determined that the individual involved was implicated in the theft of similar materials from his previous employer.

Members of visiting foreign delegations have also been known to engage in clandestine activities to acquire sensitive information and technology. In one incident, a Canadian company, at the request of a foreign customer, allowed a third country delegation access to its facilities. The delegates took advantage of the visit to covertly acquire company notes and to photocopy technical drawings. This same delegation also attempted, unsuccessfully, to steal a sensitive planning document. In yet another incident, one Canadian company noted instances where visiting delegates from a foreign country tried clandestinely to acquire information from the company. In violation of company security policy which had been explained to them, one member of the delegation was caught taking pictures inside the facility while another intentionally left the group and was found in a restricted area of the facility with his visitor's pass hidden in a pocket.

Abuse of International Institutions and Organizations

International organizations and institutions play a significant role in furthering cooperation, scientific advancements and mutual economic prosperity. However, some countries abuse exchange opportunities available to them via their membership in international institutes and organizations. Nationals of such countries who are sponsored by an international organization may be accorded privileges and access that, on a bilateral basis, they would not have normally received. The ability of these individuals to abuse their access can be compounded by host organizations, who in the spirit of international cooperation, do not apply the security policies and practices they might normally afford bilateral arrangements. In one such case, a foreign national sponsored by a credible international organization and working at a Canadian research site was suspected of having removed, without authorization, numerous documents containing technical data. While the full extent of material taken remains unknown, the Canadian research organization deemed this a serious loss.

Communications Interception

Governments, business enterprises, research institutes and individuals rely on sophisticated electronic equipment for communications. The interception of these telecommunications, through the use of commercially available equipment, is another method used by foreign interests to obtain proprietary information. Cellular phones, faxes and telephone communications, both domestic and international, have been increasingly targeted for clandestine interception.

Two cases of deliberate telecommunications interception for commercial gain indicate how Canadian companies can be disadvantaged by this type of activity. In the first incident, it was suspected that the host government was intercepting telephone communications between an executive abroad and his Canadian company headquarters. In this respect, Canadian executives on the phone discussing the bottom line price for a contract under negotiation with a foreign government were surprised when this figure became the immediate counter offer put forward by the host organization the following day. In another case, a Canadian business executive suspected that his telephone communications were monitored by a foreign government during contract negotiations when the exact phrasing the executive used in discussions with his Canadian office became part of the negotiation terminology the following day.

Computer systems can also be vulnerable to clandestine access. Information including R&D data, proprietary information, reports, analysis and personnel records contained in computer systems can be the target of foreign interests. In the case of one Canadian company, a protected computer system was compromised by a perpetrator who gained unauthorized access and intentionally tampered with existing computer codes and files. In a separate incident, a foreign government is believed to have tasked its intelligence service to gather specific information. The intelligence service in turn, contracted computer hackers to help meet the objective, in the course of which, the hackers penetrated databases of two Canadian corporations. These activities resulted in the compromise of numerous computer systems, passwords, personnel and research file of the two companies.

Disposal of Waste Materials

Another avenue of clandestine access to information is the retrieval of an organization's waste material from containers located internally and externally. Discarded business notes, reports, plans, operational manuals and other sensitive data with regular waste materials can offer valuable insight into the inner workings of an organization. One telecommunications organization found its computer programs accessed by individuals who had rummaged through an unlocked dumpster located next to the building, and were then able to retrieve sensitive computer reports and codes which allowed them to traverse all levels of the company's computer systems. In addition, recycling practices have sometimes blurred the importance of proper disposal of sensitive documents. While there is good intent in encouraging environmentally-friendly waste disposal practices, sensitive documents and reports should be first rendered illegible (ie: shredded) before being recycled. Discarded computer disks that do not have their contents magnetically erased can also provide valuable information.

Business Trips and Other Related Activities Outside Canada

International business activities conducted abroad can result in an increased vulnerability to economic espionage due to the limited amount of control an organization can exercise over the foreign business environment and the more intrusive methodologies a foreign government can use in its own country. The more significant the information may be to a foreign competitor, the more likely the government may be prepared to assist in acquiring the information. In this respect, if the potential gains are significant enough, a variety of methods are available to foreign governments in order to compromise the desired information or technologies. Briefcases and other luggage can be searched and copied covertly on point of entry, exit or at any time during the visit when not under direct control. In addition, foreign hotel rooms, safes and local communication systems are accessible to foreign security and intelligence services.

III. Reducing Vulnerabilities

Canada is a world leader in several fields including aerospace, biotechnology, computer technology and telecommunications. Canadian public and private organizations possess information of both technological and economic significance, the protection of which is essential to their economic well-being, and by extension, the economic interests of Canada. Leading-edge technology, R&D and other sensitive business information are vulnerable to targeting by foreign interests. Canadian organizations are often in the best position to assess the information they must protect and from whom it is to be protected. The following are some security measures which may help reduce the vulnerability of organizations to economic espionage:

• Appropriate classification, control and protection of sensitive documents;

• Protection of computer databases and network links from unauthorized access;

• Identification and controlled destruction of sensitive company waste material;

• Proper storage and disposal of sensitive documents;

• Discussion of sensitive company matters in appropriate locations;

• Full assessments of the value of the information (relative to both the organization and your foreign competitor's interests), the utility of the information being taken abroad, and implementation of security measures commensurate with this assessment, based on the underlying premise that "if you cannot afford to lose it, do not take it with you";

• Realistic controls on employee/visitor access to sensitive facilities, material, etc., based on the "need to know" principle;

• Sensitivity and caution with the choice of medium used for business communications (ie: cellular phones, open fax and phone lines);

• Education and sensitization of all employees to the threat that economic espionage may pose to job security and the organization's economic well-being. Emphasis on sharing responsibility amongst all employees for adherence to effective security policies and practices.

Cooperation between government and business is important to develop and maintain a secure business environment conducive to advancing Canadian economic interests in the global marketplace and reducing the vulnerabilities to economic espionage activities.

---

Comments on this brief are welcome, and should be directed to the National Coordinator, Economic and Information Security, Box 9732, Station "T", Ottawa, K1G 4G4, phone 613-231-0100, fax 613-842-1390. If you'd like to talk to CSIS regarding a particular security concern, please contact the local Economic and Information Security Coordinator at one of the CSIS offices listed below: