Tuesday, July 28, 2009

Industrionage: As economic warfare become more industrial based, the distinction between economic and industrial espionage becomes less relevant

Industrionage is a term I created from the phrase "Industrial Espionage". Just what is Industrionage; moreover, exactly what is involved in the act of espionage as it applies to industry? The following articles and musings will help focus this very important issue.

Economic and Industrial Espionage:
A Question of Counterintelligence or Law Enforcement?
By Harvey Rishikof


Introduction

Economic or industrial espionage is an old problem. As the current head of the National Counterintelligence Executive (NCIX) under the Director of National Intelligence (DNI), Joel F. Brenner, likes to muse, espionage itself is as old as Joshua reconnoitering the Promised Land, and it will be with us forever.[1] In the Cold War the archetype for technological counterintelligence, as well as industrial espionage, was the American born Russian spy Dr. George Koval’s penetration of the Manhattan Project for the atomic bomb.[2] But the paradigm is shifting in the economic era of globalization. The end of the Cold War and the explosion of technology, increased access to computers and the internet, potential profits, poor prosecutorial tools, fear of reporting the theft, and inadequate federal and state laws, have all contributed to the attractiveness of economic espionage.[3] In the words of Bernard Esambert, former Chairman of the Board of the Pasteur Institute, “Today’s economic competition is global. The conquest of markets and technologies has replaced former territorial and colonial conquests. We are living in a state of world economic war and this is not just a military metaphor... the companies are training the armies and the unemployed are the casualties.”[4]

International commerce and advancing technology have increased the likelihood of and opportunity for economic intelligence and industrial espionage, placing intellectual property and trade secrets at increased risk of appropriation. Consider the iPod, while Apple developed it, its 451 parts are made in several different countries, including Japan, Philippines, Korea, China, and Taiwan.[5] Such outsourcing although efficient and cost effective, leaves Apple open to foreign industrial espionage at critical stages of design. When viewed from the perspective of the NCIX trying to protect economic secrets in a world of shifting boundaries, world supply lines, and spheres of influence, it is a monumental challenge:

Boundaries of every kind are eroding—legally, behaviorally, electronically—in all aspects of our lives: Between the public and private behavior of ordinary people; for example, the sense of dress and decorum appropriate to the home, the street, the office, or houses of worship. Between the public and private—that is, secret—behavior of governments. Between the financing, legal norms, and research activities of public as opposed to private institutions; [and] universities, for instance. Between state and non-state actors and the relative size of the resources they control. Cyber boundaries are also eroding—and not always in ways we like—but simply because we are sometimes helpless to enforce them.[6]

But those in charge are still responsible, and they have to try to craft a response to the new era of globalization, computerization, secrets, and spying. The mission therefore is increasingly difficult and will not go away because the stakes are so high. Our recent economic downturn may only enhance the incentives to increase this type of spying. In the elegant words of Joel Brenner the “intellectual thieves” seem to have the upper hand at the moment. As he recently explained at a public-private sector conference:

The fact is, intellectual thieves are eating our lunch—eating your lunch. The public and private sectors are both leaking badly. I’m not talking about just the pirating of DVDs and movies in Asia. I’m talking about significant technologies that are walking out of our laboratories on electronic disks, walking onto airplanes bound for foreign ports, and re-entering the country as finished products developed by foreign entrepreneurs. In effect, we’re buying back our own technology. This is bad enough when we’re talking about commercial innovation. But when we’re talking about technology with substantial defense applications, we’re talking about losses of intellectual capital that in wartime could cost many lives of our fellow citizens. These losses are occurring, and they are occurring in a targeted, systematic manner.

Protecting innovative technology before it can be patented or classified is an urgent task, and it is difficult. If any of us knew how to do it, he’d be very rich, because it’s a question of handicapping basic research.[7]

Protecting critical business information is not only a bottom line issue but also may be increasingly a national security issue. Companies however, are fearful of government classification schemes that will hinder innovation and openness. Given this reality and boundary erosion, perhaps it is not surprising that a former head of the French intelligence service in 1994 admitted that his agency spied on U.S. executives abroad and “bugged” first-class seats on Air France to monitor conversations.[8] Moreover, this arena is complicated not only by the fact that the key to our information networks is openness but the information can be transmitted through standard business practices – merger and acquisitions, joint ventures, strategic alliances, and licensing agreements. Therefore, both military friends and foes may be adversaries in the economic arena of espionage. Sometimes the attack is from government-sponsored espionage, other times it is the private illicit acquisition of proprietary information, and sometimes it may be a combination of the two.

As one can imagine, it is hard to find data in this arena. As one of my old professor’s use to say – studying smuggling is hard and potentially dangerous. A measure of the extent of the growing problem is the number of prosecutions for the illegal export of US technology as reported by the 2003 Annual Report on Foreign Economic Collection and Industrial Espionage (FECIE). During fiscal year 2003, US Department of Immigration and Customs Enforcement (ICE) conducted more than 2,000 investigations involving violations of the Arms Export Control Act, International Traffic in Arms Regulations, Export Administration Regulations, International Emergency Economic Powers Act, and the Trading with the Enemy Act. Those investigations resulted in 120 arrests, 75 criminal indictments, and 55 convictions.[9]

According to a survey published in 2007 by the American Society for Industrial Security (ASIS), the financial impact of individual cases of espionage range from less than $10,000 to more than $5.5 million per incident, for a cumulative year-end total in the American economy of billions of dollars in losses – to reputation, image, goodwill, competitive advantage, core technology, and profitability.[10] But as we began to recognize in the late 1990s corporations are of strategic interest to the United States on three levels since they: 1) produce classified products for the government; 2) produce dual-use technology used in both the public and private sectors; and 3) are responsible for R&D and the creation of leading-edge technologies critical to maintaining U.S. economic security. Losses at any of these levels could affect U.S. international competitiveness and security.[11] Regardless of the source, the threat to US interests is real, and the US is extremely vulnerable.

The 2005 Annual Report to Congress on FECIE reported that 108 countries – both friend and foe – were involved in information collection efforts against the United States.[12] China, Russia, and India top the list. The FECIE reports indicate that foreign collectors tend to target dual-use technology, which can be used for both peaceful and military objectives, and military technology. There is no dispute that foreign governments go after trade secrets for the sake of national security advantage. But what is the United States government’s role in company v. company warfare? Should investigations be considered a counterintelligence or law enforcement matter? Do these old jurisdictional boundaries and responsibilities still work? What should be a secret, and what is the government’s role in making that determination? What can be done to protect US interests?

The critical issue in the new world of commerce is whether one can clarify the differences between economic and industrial counter-espionage and explain why the latter is particularly problematic. To many, governments have long engaged in economic intelligence but have found the need to engage in economic espionage declining as more and more critical information is available through open sources. Industrial espionage, on the other hand, may be becoming the most prevalent form of economic espionage as governments seek industry-related information for the intelligence they need on battlefield capabilities, for design of counter-measures, and for preparation of the battlefield – including how to attack energy grids, and industrial plants important for war-making etc. Industrial espionage involving the theft of trade secrets, perhaps at one time seemed to be able to be restricted to an industrial sphere, but dual use technologies erase what once was an easy distinction as government involvement becomes more prevalent.

Some recent cases --How to balance counterintelligence v. law enforcement?

At the time of the passage of the Economic Espionage Act in 1996 (EEA), 23 to 26 countries were identified as practicing suspicious collection and acquisition activities and 12, in particular, were targeting trade secrets. In particular the technology categories, many of which are dual-use technologies, listed in the Military Critical Technology List published by the DOD were of greatest interest.[13] The FBI had seen the number of cases of suspected economic espionage under investigation in its Economic Counterintelligence Program started in 1994 leap from 400 to 800 cases by 1996. By 2005 the number of countries involved in collection efforts against sensitive and protected US technologies had risen dramatically.

More specifically, the immediate issue is whether the government should be engaged in a back-door industrial policy by determining which industrial products deserve protection with federal dollars. Criterion might be direct relevance to national security, actually threatened industries, or a mixed strategy using a case-by-case approach. Recent cases brought under the EEA are illustrative of the range of potential problems for prosecution under the current charging schemes as the government tries to establish foreign involvement.

If the companies are selected according to their direct relevance to national security (i.e. they have defense contracts) then the contracting process becomes the tool the FBI and others use for building their database of which industries to help—regardless of whether the thief is a foreign government or a competing firm acting on its own. This is, of course, a very defensive posture but allows for a potential marshalling of resources. An example of such a national security case is United States v. Meng that involved military technology, computer source code, and economic opportunity.[14]

In 2007 Xiaodong Sheldon Meng, formerly a resident of Beijing, China, and a resident of Cupertino, California, was charged with stealing military combat and commercial simulation software and other materials from his former employer Quantum3D, a company based in San Jose, California. Meng was charged under the EEA with stealing the trade secrets from Quantum3D with the intent that they would be used to benefit the foreign governments of China, Thailand, and Malaysia.

Many of Quantum3D’s products were designed primarily for military purposes, including military combat training in simulated real-time conditions during the day and night and the use of advanced infrared (IR), Electro-Optical (EO), and Night Vision Goggle (NVG) devices. The indictment alleges that Meng stole numerous Quantum3D products, including “viXsen™” and “nVSensor™,” which were used exclusively in military applications and designed for precision training of military fighter pilots in night vision scenarios among other applications. Both “viXsen™” and “nVSensor™” are classified as defense articles on the U.S. Munitions List and cannot be exported outside the United States without an export license.

In 2003 after a number of years of employment, Meng entered into a consulting agreement with Quantum3D in which he would serve as an independent consultant for Quantum3D in Asia. In this capacity he tried to sell sensitive source code to the Malaysian Air Force. In 2004 he severed his relationship with Quantum3D, joined a competitor, and attempted to sell Quantum3D products to the Chinese and Thailand.[15] In essence Meng given his knowledge of the products became the carrier.

Another recent case highlighting the overlap of economic and industrial espionage in the national security area and they type of cases to focus on is the 2007 Chi Mak case. In the Chi Mak case, five members of a southern California family were charged with acting as agents of the People’s Republic of China and with conspiring with each other to export United States defense articles to the People’s Republic of China a violation of the Arms Export Control Act. This technology theft ring focused on acquiring corporate proprietary information and embargoed defense technology related to the propulsion, weapons and electrical systems of U.S. warships. The family, the father a naturalized citizen from China, had pursued a long-term plan of infiltration over years.

Though the object was clear, who sponsored the ring? Chi Mak was a support engineer at L-3 Communications working on navy quiet drive propulsion technology. The espionage effort appears to have been directed by a Chinese academic at a research institute for Southeast Asian affairs at Zhongshan University in Guangzhou, China. The Chi family encrypted the information it was passing back to China into a computer disk that appeared to contain television and sound broadcasts. It was literally embedded in the other data in encrypted form. This effort has all of the earmarks of professional espionage tradecraft and state-directed espionage, with sophisticated control and sophisticated clandestine communications means. The government university in Guangzhou could have been cover for a state-directed espionage effort. However, Chi Mak and his alleged co- conspirators could just as well have been part of a sophisticated economic espionage operation run out of a university research institute. The future plea agreements will perhaps make clear the true nature of the conspiracy.[16]

This “direct relevance” approach would require prioritizing military programs and “tagging” all employees with access to high value products. And as these cases illustrate the targeting countries are not beyond “planting” potential operatives as “sleepers” whose goal is to join critical companies and plot long-term career paths.

Alternatively, law enforcement could build a database of those industries actually threatened by foreign governments’ intelligence activities, whether or not the US uses the technology for national security purposes. The rationale here would be: if a foreign government wants the technology, there is national security gain to be had, by definition, in keeping that technology from them. This approach is problematic because of its underlying assumption and because many non-defense firms do not necessarily want the federal government probing their businesses to discover what their R&D involves or interfering in their choices on how to develop, protect or share such technologies.

Such a case was, United States v. Okamoto and Serizawa, when Takashi Okamoto, a resident of Japan, and Hiroaki Serizawa, a resident of Kansas, were indicted of stealing trade secrets from the Cleveland Clinic Foundation (CCF). [17] Okamoto and Serizawa conspired to misappropriate from the CCF certain genetic materials called Dioxyribonucleic Acid (DNA) and cell line reagents and constructs which were developed by researchers employed by CCF, with funding provided by the CCF and the National Institutes of Health, to study the genetic cause of and possible treatment for Alzheimer’s. Alzheimer’s affects an estimated 4,000,000 people in the United States alone and is the most common cause of dementia. The pharmaceutical market for this disease is a potentially rich profit center for any company in the field. The Alzheimer's disease market is forecast to continue to expand significantly over the next ten years. Aided by growing elderly populations, successive product launches have seen global revenues grow at over 35%.[18]

The goal of the conspiracy was to benefit the Institute of Physical and Chemical Research (RIKEN), a quasi-public corporation located in Saitama-Ken, Japan, which received over 94 percent of its operational funding from the Ministry of Science and Technology of the government of Japan. The Brain Science Institute (BSI) of RIKEN was formed in 1997 as a specific initiative of the Ministry of Science and Technology to conduct research in the area of neuroscience, including research into the genetic cause of, and possible treatment for, Alzheimer’s Disease

Okamoto and Serizawa had committed economic espionage by stealing, altering and destroying trade secrets that were property of the CCF, specifically, 10 DNA and cell line reagents developed through the efforts and research of researchers employed and funded by the CCF and by a grant from the National Institutes of Health. [19] Okamoto and Serizawa were also charged with transporting, transmitting, and transferring in interstate and foreign commerce, DNA and cell line reagents developed through the efforts of researchers employed and funded by the CCF.[20]

Should law enforcement be focused on lucrative emerging world markets, as in the above case of Okamoto and Serizawa and be using limited resources to protect private companies from losing market share? How can the federal government, given its limited resources, spread itself across such a large canvas? Will corporations want to cooperate with the government?

A third option is to develop a counter intelligence strategy that mixes the two previous approaches and determines, on a case by case basis, whether the efforts at acquisition by a foreign entity represent a national security threat. United States v. Ye and Zhong[21]presents such a choice. Fei Ye, and Ming Zhong were arrested at the San Francisco International Airport with stolen trade secret information in their luggage while attempting to board an aircraft bound for China. Ye and Zhong admitted to possessing stolen trade secrets for an integrated circuit design from Sun Microsystems, Inc. and Transmeta Corporation with the intent to benefit the Peoples Republic of China.

Ye and Zhong admitted that they intended to utilize the trade secrets in designing a computer microprocessor that was to be manufactured and marketed by a company that they had established, known as Supervision, Inc. They admitted that Supervision was to have provided a share of any profits made on sales of chips to the City of Hangzhou and the Province of Zhejiang in China, from which Supervision was to receive funding. Mr. Ye and Mr. Zhong also admitted that their company had applied for funding from the National High Technology Research and Development Program of China, commonly known as the “863 Program.”

Fei Ye is alleged to have possessed a corporate charter for Hangzhou Zhongtian Microsystems Company Ltd. at his house which states that the joint-venture will raise China’s ability to develop super-integrated circuit design and form a powerful capability to compete with worldwide leaders’ core development technology and products in the field of integrated circuit design.[22]

The problem here is that, in addition to the issues with the first two previous enforcement approaches raise, the Ye and Zhong case introduces a third: acquiring the expertise within the counter intelligence community to analyze industrial R&D at its most cutting edge. And even if the community were successful in doing this, law enforcement would have to employ a sliding authorization for use of counterintelligence tools (wiretaps, undercover surveillance, etc.) during the investigative process or risk alienating firms it might need to cooperate in an eventual prosecution. Any investigations that did not pan out as espionage would have to be prosecuted as crimes, unless companies decide to drop charges in the interest of pursuing profits instead. But could the corporations count on the federal government or IC to pull back once an interest had been pursued? For some of the proponents of the EEA in 1996, the act was an attempt to pursue this third option, but the infrastructure and groundwork has not materialized to pursue such a nuanced course.

Why these cases are of interest is that they illustrate how difficult counterintelligence is when the focus is the private sector? What were the roles of the firms in each of the cases? Did the company alert law enforcement or the other way around? How were decisions made regarding the use of counterintelligence vs. counter-crime techniques and did internal law enforcement disagreements arise that complicated or slowed down investigations? These important questions demonstrate how difficult pursuing prosecutions in this area.[23]

But if government regulations and enforcement continue to prove ineffective the private sector may be the place where an attempted solution will be looked to, in order to stop having our “lunch eaten.” The questions are: 1) are we willing to pay the price to our privacy and will it work? and, 2) what is a US economic interest and what is a multinational conglomerate interest as it pursues its globalization strategy?

These issues of economic and industrial espionage bleed into other categories of security and competition. Recently Joel Brenner characterized the key three strategic challenges now confronting the counterintelligence community: (1) threats to our cyber networks and opportunities to understand and counter them; (2) acquisition vulnerabilities created by the international nature of our markets; and (3) the need for better collaboration in countering espionage.[24]

A corporate security culture must entail a shift in the traditional notions of privacy.[25] This shift will be a challenge to the previous zone of privacy many of us grew up with. Interestingly, the new generation of “MySpace,” “FaceBook,” and YouTube” employees may approach the new transparent work place with a different appreciation for the new corporate security culture of trade secrets. The government’s responsibility historically has been to concentrate on the espionage side of the national security arena and not be so involved in the industrial, a more private sector field. The private sector paid for its own slackness in lost revenue. Modern technology has helped to erode these two distinct arenas and this has created new burdens for the government. As economic warfare become more industrial based, the distinction between economic and industrial espionage becomes less relevant.

One reason for the erosion is that our adversaries have taken such a view, as in the Chinese 863 Program in the Ye and Zhong case. The 863 Program is a funding plan created and operated by the government of the People’s Republic of China, and is also known as the National High Technology Research and Development Program of China. The program was designed by leading PRC scientists to develop and encourage the creation of technology in the PRC and focused on issues such as high technology communications and laser technology, with an emphasis on military applications. The General Armaments Department ("GAD") of the People’s Liberation Army was responsible for the Army, Navy, and Air Force in the PRC, and oversaw the development of weapons systems used by the PRC. The GAD had a regular role in, and was a major user of, the 863 Program.[26]

This approach is perhaps more understandable in political/economic cultures that encourage state-owned enterprises. In countries where government interests can coincide with corporate interests, or national champions, intelligence agencies can be more easily instructed to assist the private sector. This perhaps explains why France over ten years ago established, the Ecole de Guerre Economique (EGE) or School of Economic Warfare. The founder of the school contends that rather than teaching economic espionage it is more the management of information to develop an economic strategy in the context of conflicts to gain market share.[27] For such state corporate-centric approaches the distinction between fair or unfair business practices can become blurred. Some have contended that the US open competitive market based system and our anti-trust laws combined with our Foreign Corrupt Practices Act has made state sponsored economic espionage a non-starter.[28]

The new Director of National Intelligence has many problems on his plate – Iraq, Afghanistan, the Middle East, China, Pakistan, India etc. How will economic-industrial espionage fair? In Andrew Niccol's 1997 science fiction film Gattaca, set in the near future, the Gattaca Aerospace Corporation has created a totally transparent work place with technology able to manipulate genetic codes and monitor all employee interactions. Although the hero is able to fool the system, the world depicted is a possible modern future that would bring corporate monitoring to one possible logical conclusion. If we do start to travel down this path of a culture of corporate security, future generations will have to judge if the price paid for corporate and national security, so that we stopped having our lunch eaten, was in the end worth the meal.

Harvey Rishikof is
Former Chair, Department of National Security Strategy and Professor of Law and National Security Studies with National War College.

_____________________________________________________________________________________

[*] See the Department of Justice web site at http://www.usdoj.gov/usao/can/press/2006/2006_12_14_meng.indictment.press.htm.



[1]
See Remarks of Joel F. Brenner, ABA Standing Committee on Law and National Security, March 29, 2007, at http://www.ncix.gov/publications/speeches/ABAspeech.pdf.

[2] See, William J. Broad, A Spy’s Path: Iowa to A-Bomb to Kremlin Honor, New York Times, November 12, 2007 A1.

[3]See Chris Carr, Jack Morton, and Jerry Furniss, “The Economic Espionage Act: Bear Trap or Mousetrap?”, Vol. 8.2 Texas Intellectual Property Law Journal (2000) p. 159, 163-170.

[4] Wanja Eric Naef, Economic and Industrial Espionage: A Threat to Corporate America?; Infocon Magazine Issue One, October 2003 at http://www.iwar.org.uk/infocon/print/espionage-cid.htm.

[5] Hal R. Varian. June 28, 2007. “An iPod Has Global Value. Ask The (Many) Countries That Make It,” http://www.nytimes.com/2007/06/28/business/worldbusiness/28scene.html

[6] See “Welcoming Comments by National Counterintelligence Executive Dr. Joel F. Brenner DNI –Private Sector Workshop on Emerging Technologies,” Carnegie Endowment for International Peace, Washington, DC, 7 December 2006 http://www.ncix.gov/publications/speeches/CarnegieSpeech20061207.pdf

[7] Ibid.

[8] Chris Carr, Jack Morton, and Jerry Furniss, “The Economic Espionage Act: Bear Trap or Mousetrap?”, Vol. 8.2 Texas Intellectual Property Law Journal (2000) p. 159, 161.

[9] See p. 3 Report 2003 at http://www.ncix.gov/publications/reports/fecie_all/fecie_2003/fecie_2003.pdf.

[10] ASIS. Trends In Proprietary Information Loss; Survey Report, 3. August 2007. http://www.asisonline.org/newsroom/surveys/spi2.pdf. The 2001 FECIE report stated that an estimated $100-250 billion was lost in sales at the end of calendar year 2000.

[11] See Statement by FBI Director Louis J. Freeh, Hearing on Economic Espionage before the House Judiciary Subcommittee on Crime, May 9, 1996, at http://www.fas.org/irp/congress/1996_hr/h960509f.htm.

[12] 2005 FECIE Report, 1.

[13] The categories for 1997/1997were: Advanced material coatings; Advanced transportation and engine technology; Aeronautics systems; Armaments and energetic materials; Biotechnology; Chemical and biological systems; Directed and kinetic energy systems; Electronics; Ground systems; Guidance, navigation, and vehicle control; Information systems; Information warfare; Manufacturing and fabrication; Marine systems; Materials; Nuclear systems; Power systems; Semiconductors; Sensors and lasers; Signature control; Space systems; Weapons effects and countermeasures.

[14]The allegations, facts, and plea agreement for this section are drawn directly from the Department of Justice’s web sites at http://www.usdoj.gov/usao/can/press/2006/2006_12_14_meng.indictment.press.html

[15] The Indictment charged Meng under a number of statutes with the following maximum penalties: Conspiracy, in violation of 18 U.S.C. § 371, (five years in prison, a fine of $250,000 or twice the value of the property involved in the transaction, whichever is greater, a three year term of supervised release); Economic Espionage and Attempted Economic Espionage, in violation of 18 U.S.C. §§ 1831(a)(3), 1831(a)(4), (fifteen years in prison, a fine of $500,000 or twice the value of the property involved in the transaction, whichever is greater; a three year term of supervised release; Arm Export Control Act, in violation of 22 U.S.C. § 2778, (ten years in prison, a fine of $1,000,000 or twice the value of the property involved in the transaction, whichever is greater; a three year term of supervised release); Misappropriation of Trade Secrets and Attempted Misappropriation of Trade Secret, in violation of 18 U.S.C. §§ 1832(a)(1), 1832(a)(4), (ten years in prison, a fine of $250,000 or twice the value of the property involved in the transaction, whichever is greater, a three year term of supervised release); Interstate and Foreign Transportation of Stolen Property count, in violation of 18 U.S.C. §§ 2314, (ten years in prison, a fine of $250,000 or twice the value of the property involved in the transaction, whichever is greater, a three year term of supervised release); False Statement to Government Agency, in violation of 18 U.S.C. § 1001, (five years in prison, a fine of $250,000 or twice the value of the property involved in the transaction, whichever is greater, a three year term of supervised release). However, the court could impose any sentence following conviction after consideration of the U.S. Sentencing Guidelines and the federal statute governing the imposition of a sentence, 18 U.S.C. § 3553.

[16] Case description quoted from the Testimony of Larry M. Wortzel, Before the Subcommittee on Crime, Terrorism, and Homeland Security of the House Committee on the Judiciary Hearing on “Enforcement of Federal Espionage Laws” January 29, 2008, http://www.fas.org/irp/congress/2008_hr/012908wortzel.pdf

[17] The allegations, facts, and plea agreement for this section are drawn from the Department of Justice’s web sites at http://www.usdoj.gov/criminal/cybercrime/Okamoto_SerizawaIndict.htm and http://www.usdoj.gov/criminal/cybercrime/serizawaPlea.htm.

[18] See Alzheimer’s at http://www.piribo.com/publications/diseases_conditions/alzheimers/pipeline_commercial_insight_alzheimers_disease.html

[19] The Indictment is still pending against Okamoto, which charges him with Conspiracy, Economic Espionage Act offenses, and the Transporting of Stolen Property in Interstate and Foreign Commerce.

[20] Thus far Hiroaki Serizawa has pleaded guilty to making false statements to the government. In the plea Serizawa admits he: falsely understated the number of vials of research material which Okamoto had taken from Serizawa’s laboratory (hundreds of vials); initially denied any recent personal contact with Okamoto when in fact Serizawa had been in recent telephone, electronic mail and personal contact with Okamoto; and initially denied any knowledge of Okamoto having accepted a research position with RIKEN when in fact Serizawa knew that Okamoto had accepted a research position at RIKEN. The false statements offense carries a maximum penalty of five years incarceration and a $250,000 fine. Under the law, conspiracy carries a maximum penalty of five years incarceration and a $250,000 fine, while economic espionage carries a maximum penalty of 15 years incarceration and a $500,000 fine, while interstate transportation of stolen property carries a maximum penalty of 10 years incarceration and a $250,000 fine.

[21] The allegations, facts, and plea agreement for this section are drawn directly from the Department of Justice’s web sites at http://www.usdoj.gov/criminal/cybercrime/yeIndict.htm and http://www.usdoj.gov/usao/can/press/2006/2006_12_14_ye.zhong.plea.press.html

[22] Ye and Zhong were charged with a total of ten counts, including: one count of conspiracy, in violation of 18 U.S.C. §§ 371, 1831(a)(5) and 1832(a)(5); two counts of economic espionage, in violation of 18 U.S.C. § 1831(a)(3); five counts of possession of stolen trade secrets, in violation of 18 U.S.C. § 1832(a)(3); and two counts of foreign transportation of stolen property, in violation of 18 U.S.C. § 2314.

[23] In particularly would like to thank the editors, Jennifer Sims and Burton Gerber, for their assistance in framing the article and many helpful suggestions.

[24] Remarks by Joel F. Brenner, National Counterintelligence Executive, “Strategic Counterintelligence: Protecting America in the 21st Century,” The Nro/National Military Intelligence Association Counterintelligence Symposium, Washington DC, 24 October 2007 at http://www.ncix.gov/publications/speeches/NRO-NMIA-CI-Symposium-24-Oct-07.pdf.

[25]

[26] See, Two Bay Area Men Indicted On Charges Of Economic Espionage http://www.intellectualpropertylawfirms.com/national-content.cfm/Article/107306/Two-Bay-Area-Men-Indicted-On-Charges.html.

[27] See, Kelly Uphoff, Tilting the Playing Field: Economic Espionage Hasn't Gone Away Since 9/11Costs to the U.S. Economy Could Be in the Hundreds of Billions of Dollars, at http://www.jinsa.org/articles/view.html?documentid=2835.

[28] Though in 2000 a small controversy erupted when James Woolsey, former DCI, program maintained that the US did not collect or even sort out secret intelligence for the benefit of specific American companies in response to European reports concerning alleged US/British spying on Europe under the Echelon program for industrial espionage purposes. See Woolsey, R. James. "Why We Spy on Our Allies." Wall Street Journal, 17 Mar. 2000.



Thursday, July 23, 2009

MegaFon Deploys Cisco CRS-1 Routing Platform as Foundation of Next-Generation Mobile Network

SAN JOSE, CA, May 27 (MARKET WIRE) --

http://www.reuters.com/article/pressRelease/idUS132685+27-May-2009+MW20090527


(NASDAQ: CSCO) -- Five years after being introduced, the Cisco(R) CRS-1 Carrier Routing System continues to be deployed by telecommunications service providers as the foundation of their Internet Protocol Next-Generation Networks (IP NGNs). The CRS-1 was recently deployed by Russian mobile operator MegaFon, one of the fastest-growing mobile operators in Europe and Russia's first service provider of 3G global system for mobile communications (GSM).

The Cisco CRS-1 platform was unveiled in May 2004 as a new class of routing system designed to deliver continuous system operation, service flexibility and extended system longevity to service providers. Designed to accommodate the acceleration of video, voice and data traffic on IP NGNs, the Cisco CRS-1 is the first router to scale to more than 90 terabits of bandwidth capacity. It helps enable reliable, large-scale network delivery of high-bandwidth applications, including video on demand, online gaming, multimedia content distribution, real-time interactive services and many others.

Facts:

-- The Cisco CRS-1 platform has been deployed by more than 300 customers in more than 40 countries on all continents except Antarctica.

-- Driven by a greater convergence of networks and applications to facilitate the delivery of video, voice and data services, total worldwide cumulative shipments of this platform have reached more than 3,200. That figure includes 250 multi-chassis configurations at more than 25 service providers. MegaFon is the first service provider in Russia to deploy a multi-chassis CRS-1 platform.

The total current capacity of all Cisco CRS-1 units shipped to date is estimated at 2,919 terabits per second or nearly three petabits-per-second. This capacity is equivalent to that of: -- More than 25,000 users downloading a 2.5-hour high-definition movie in one second.


-- Hosting 250 million simultaneous meetings on a Cisco TelePresence(TM) system. Based on an average of 12 megabits per second required for a Cisco TelePresence System 3000 and considering that each session can accommodate 12 people, the deployed current capacity of the Cisco CRS-1 would be enough to accommodate live Cisco TelePresence sessions with the entire combined populations of China, the European Union, the United States, Russia, Brazil, Saudi Arabia, Japan, Indonesia and Mexico -- (that is, nearly half of the world's population) -- at the same time.



-- Publicly announced Cisco CRS-1 customers to date include AT&T, BT, Cable & Wireless, Comcast, China Telecom (ChinaNet), China Education and Research Network (CERNET), Czech National Research Network (CESNET2), Deutsche Telekom, FairPoint Communications, Free (Iliad Group), Kabel Deutschland, Kazakh Telecom, Korea Telecom, Magyar Telekom, MTS Allstream, MTN, National Institute of Informatics' SuperSINET research network in Japan, Netia, Neuf Cegetel, National LambdaRail, nTelos, Pittsburgh SuperComputing Center (PSC), RAIRomtelecom, SaskTel, Savvis Communications, Sify, Softbank Yahoo! BB, Sprint, Swisscom, Shanghai Telecom, Strato Medien, TeliaSonera, Terremark, Telstra, Verizon Wireless, VTR and XO Communications.

Quotes:

-- "MegaFon is innovative in our approach to growing our customer base and improving our mobile services," said Sergei Soldatenkov, chief executive officer, MegaFon. "We have found that the multi-chassis Cisco CRS-1 platform, with highly secure domain routing, serves as the foundation of our Internet Protocol next-generation network. This gives us confidence in our ability to scale to meet increased traffic and quality demands."

-- "When we introduced the Cisco CRS-1, most industry observers believed we over-engineered a routing platform and made it too powerful for the needs of service providers," said Tony Bates, Cisco senior vice president and general manager, service provider group, and one of the lead developers of the Cisco CRS-1. "Now, no one disputes that the Cisco CRS-1 has been essential in allowing service providers to complete the move from the analog age to the digital age, from the era of the phone to the era of the Internet."

-- Bates added, "Cisco realized early on that Internet-based networks were going to be the platforms of choice to deliver communication, information and entertainment to consumers and businesses worldwide. The Cisco CRS-1's continuing success is evidence that our vision, strategy and execution were all in line with the evolution of the market and the needs of service providers."

-- "Rising demand for broadband, video and mobility continues to propel
Cisco CRS-1 deployments," Bates said. "The same trends that are driving the transformation toward 4G networks are also driving demand for the Cisco ASR 9000 Series Aggregation Services Router, which does for the edge what the Cisco CRS-1 does for the core."


Supporting Resources:


-- Cisco Web Site
-- Cisco Service Provider
-- Cisco CRS-1


Technorati Tags:
Cisco, Carrier Routing System-1, CRS-1, Internet
Protocol Next-Generation Network, IP NGN, Tony Bates, Cisco ASR 9000,
MegaFon

About Cisco
Cisco (NASDAQ: CSCO) is the worldwide leader in networking
that transforms how people connect, communicate and collaborate.
Information about Cisco can be found at http://www.cisco.com. For ongoing news, please go to http://newsroom.cisco.com.

Cisco, the Cisco logo, Cisco Systems, and Cisco TelePresence are
registered trademarks or trademarks of Cisco Systems, Inc. and/or its
affiliates in the United States and certain other countries. All other
trademarks mentioned in this document are the property of their
respective owners. The use of the word partner does not imply a
partnership relationship between Cisco and any other company. This
document is Cisco Public Information.

For direct RSS Feeds of all Cisco news, please visit "News@Cisco" at the
following link:

http://newsroom.cisco.com/dlls/rss.htmlImage Available:
http://www2.marketwire.com/mw/frame_mw?attachid=990074

Image Available: http://www2.marketwire.com/mw/frame_mw?attachid=990071


Cisco Press Contact:
Kevin Petschow
Cisco
(773) 444.5106
kpetscho@cisco.com

Industry Analyst Contact:
Carter Cromwell
Cisco
(408) 526.6914
ccromwel@cisco.com

Investor Relations Contact:
Matt Tractenberg
Cisco
(408) 525.3170
matthew2@cisco.com

Copyright 2009, Market Wire, All rights reserved.

Monday, July 20, 2009

Top 10 Web Attack Vectors in Second Half of 2008

http://securitylabs.websense.com/content/Assets/WSL_ReportQ3Q4FNL.PDF

As Internet users increase, the Web attack vector continues to grow. Web servers are increasingly compromised through persistent cross-site scripting (XSS) and SQL injection as well as DNS cache- poisoning attacks. The Web Application Security Consortium reports that 97 percent of sites it studied continue to be plagued with significant vulnerabilities.
Below are the top ten Web attack vectors over the last six months. Browser vulnerabilities, SQL injection attacks and the increase of social networking vulnerabilities rounded out the top three vectors. This list remains relatively consistent with the previous top-ten Web attack vector list cited
during the first half of 2008.

1. Browser vulnerabilities
2. Rogue antivirus/social engineering
3. SQL injection
4. Malicious Web 2.0 components (e.g. Facebook applications, third-party widgets and gadgets,
banner ads)
5. Adobe Flash vulnerabilities
6. DNS Cache Poisoning and DNS Zone file hijacking
7. ActiveX vulnerabilities
8. RealPlayer vulnerabilities
9. Apple QuickTime vulnerabilities
10. Adobe Acrobat Reader PDF vulnerabilities


Learn How To Hack

Learn How To Hack



Browser vulnerabilities continued to plague unsuspecting users. Opera version 9.5.1 enabled attackers to steal arbitrary samples of data in memory from desktops through specially crafted JavaScript code while vulnerabilities in Firefox provided attackers additional opportunities for spoofing by exploiting alternate names on self-signed certificates.

In August 2008, Digg, MSNBC, Newsweek, and MSN Norway were hit by a series of malicious third-party banner ads, which led visitors to rogue security software sites and hijacked the clipboards of visitors.

One of the vulnerabilities exploited was an integer overflow in Adobe Flash (CVE-2007-0071). That same month, Websense Security Labs discovered that a major Chinese ISP, China Netcom (CNC), had its DNS cache poisoned. Unsuspecting customers were redirected to a malicious site when the hostname in a URL was mistyped.

Thursday, July 16, 2009

US Ignored Warnings of Cyber Attack

Aggregated from: http://www.defensetech.org/archives/cat_cyberwarfare.html




Advance information did not prompt a response.

The U.S. Government now admits they did not properly handle the situation. Sources have revealed that the South Korean government knew in advance that the distributed denial of service (DDoS) attacks that hit multiple web sites of major institutions in South Korea had begun earlier in the United States.

Late last week South Korea's intelligence agency briefed its lawmakers on circumstantial and technical evidence behind their belief that North Korea was behind the recent cyber attacks. Other intelligence sources went as far as to state that Kim Chong Un, the third son of North Korean dictator Kim Jong Il, was the mastermind of the cyber attacks that have hit government computers in the United States, South Korea and other some 14 other countries.

Foreign intelligence sources have also reported that the North Korean government sent a cyber contingent of approximately a dozen people across the northern border into China to conduct some of the operations and that Kim Chong Un actually was in commanded of that unit. Also sources have speculated that North Korean Research and Development Unit (110 or 101) and Cyber Warfare Unit 121 were the primary military units involved in the planning and execution of the DDoS style cyber attack. At least one Republican lawmaker urged President Obama to take retaliatory action (cyber attacks) against North Korea for the cyber attacks launched last week.

Learn How To Hack

Learn How To Hack


Given the extremely limited telecommunication infrastructure (estimated 1.18 million phone lines) and the limited Internet connectivity (given the less than 80,000 broadband connections) a cyber attack would be next to useless. After studying and researching the cyber attacks the following observations are offered.

1. The current U.S. defenses against cyber attack are woefully inadequate against even moderate level attacks as we have just experienced.

2. The fact that these attacks were well-coordinated, lasted as long as they did and were able to bring down a number of sites says more about the state of our defenses than the moderate rated offensive cyber capabilities of North Korea.

3. This clearly shows the need for the international agreement for cyber attack investigation cooperation that has been called for by many cyber warfare experts including me. These attacks were routed/launched through compromised computers in 16 countries.

4. Reports that the Department of Defense was not alerted to the attacks and found out through the media indicate that better coordination between DOD, DHS, DOJ and other government organizations as well as the private sector is critical in times of cyber attack and therefore must be improved and maintained.

5. There are unconfirmed reports for typically reliable sources that a South Korean intelligence agency has obtained documents ordering North Korean army units to start the cyber attack. If true, this could be the smoking gun! Once verified, that would open the way for retaliatory action.

-- Kevin Coleman

Saturday, July 11, 2009

Link for Defense Tech's Cyber-Warfare Archives





Learn How To Hack

Learn How To Hack


Ironically, it is the most technologically advanced country in the world that lacks a coherent national cyberdefense-

Where Is Our Cyber Defense?

By Alexandra Petri

The prolonged assault on American and South Korean websites that began July 4 shows why President Obama declared cyber security a priority of his administration. But it also highlights that, so far, we don’t have a coherent national cyber defense.

Learn How To Hack

Learn How To Hack




The attacks this past weekend targeted a wide array of sites within the public and private sector, from the National Security Agency to NASDAQ to Washington Post Digital. But this is no isolated incident. Literally millions of attacks occur on U.S. systems every day. The past several years have seen a spike in online attacks on government agency sites -- from 5,503 in fiscal year 2006 to 16,843 in 2008. The private sector, too, is continually under attack, with 280 million sets of data compromised last year alone. What is noteworthy about the attacks of the past week is how organized and effective they were -- some sites, such as that of the Department of Transportation, experienced 24-hour outages.

The government is doing something. Currently, the Department of Homeland Security is responsible for securing dot-gov sites and the Department of Defense handles dot-mil, both of which were targeted in the recent assault. And Defense Secretary Gates announced last month the creation of a “cyber command” to handle the Defense Department’s side, to be helmed by the director of the National Security Agency.

But as our defense grows, we need to make sure that whatever system develops is one that respects privacy. Like real war, cyber warfare has a tendency to take civilian casualties, and as the battle wages on, any hard lines between public and private threats will be easy to blur. As happened this weekend, the same attackers can target public and private sites. Collaboration between government and private cyber defenders to anticipate and thwart attacks is key to a successful defense, but there must be a system in place to protect privacy and make certain that the sharing goes both ways -- for instance, an anonymous, secure database where businesses and government entities can share information about ongoing threats and responses.

President Obama can start by appointing a cyber czar who will ensure our cyber defense doesn’t fall into the cracks between government agencies. And as we deal with threats that tread the line between public and private, we need someone in place to ensure transparency and accountability, too, so that it won’t infringe on the privacy we seek to protect.

By Alexandra Petri | July 8, 2009; 3:20 PM ET

Tuesday, July 7, 2009

George Ledin teaches students how to write viruses, and it makes computer-security software firms sick.

The Virus Professor

This Bug Man Is a Pest

By Adam B. Kushner | NEWSWEEK

In a windowless underground computer lab in California, young men are busy cooking up viruses, spam and other plagues of the computer age. Grant Joy runs a program that surreptitiously records every keystroke on his machine, including user names, passwords, and credit-card numbers. And Thomas Fynan floods a bulletin board with huge messages from fake users. Yet Joy and Fynan aren't hackers—they're students in a computer-security class at Sonoma State University. And their professor, George Ledin, has showed them how to penetrate even the best antivirus software.

The companies that make their living fighting viruses aren't happy about what's going on in Ledin's classroom. He has been likened to A.Q. Khan, the Pakistani scientist who sold nuclear technology to North Korea. Managers at some computer-security companies have even vowed not to hire Ledin's students. The computer establishment's scorn may be hyperbolic, but it's understandable. "Malware"—the all-purpose moniker for malicious computer code—is spreading at an exponential rate. A few years ago, security experts tracked about 5,000 new viruses every year. By the end of this year, they expect to see triple that number every week, with most designed for identity theft or spam, says George Kurtz, a senior vice president at antivirus software maker McAfee. "You've got a whole business model built up around malware," he says.

Ledin insists that his students mean no harm, and can't cause any because they work in the computer equivalent of biohazard suits: closed networks from which viruses can't escape. Rather, he's trying to teach students to think like hackers so they can devise antidotes. "Unlike biological viruses, computer viruses are written by a programmer. We want to get into the mindset: how do people learn how to do this?" says Ledin, who was born to Russian parents in Venezuela and trained as a biologist before coming to the United States and getting into computer science. "You can't really have a defense plan if you don't know what the other guy's offense is," says Lincoln Peters, a former Ledin student who now consults for a government defense agency.

That doesn't mean Ledin isn't trying to create a little mischief. His syllabus is partly a veiled attack on McAfee, Symantec and their ilk, whose $100 consumer products he sees as mostly useless. If college students can beat these antivirus programs, he argues, what good are they for the people and businesses spending nearly $5 billion a year on them? Antivirus software makers say Ledin's critique is misleading, and that they are a step ahead of him—and the hackers. "We've changed the game, and viruses have changed in recent years because of the protection we're putting into place," says Zulfikar Ramzan, the technical director of Symantec's security team.

Still, beneath Ledin's critique lies a powerful polemic. Ledin compares the companies' hold over antivirus technology (under the Digital Millennium Copyright Act of 1998, the companies' codes are kept secret) to cryptography decades ago, when the new science of scrambling data was largely controlled by the National Security Agency. Slowly, the government opened the field to universities and companies, and now there are thousands of minds producing encryption that is orders of magnitude more complex than code from just a decade ago. That's why you can safely transmit your credit-card numbers online. "Why should we shy away from learning something that is important to everyone?," Ledin asks. "Yes, you could inflict some damage on society, but you could inflict damage with chemistry and physics, too." He hopes one day to share antivirus techniques. But that would require infrastructure and financial support, which the federal government so far has declined to give. Until then, Ledin will have to live with his reputation as the guy who gave away the secrets to the Internet's bomb.



Learn How To Hack

Learn How To Hack

Federal Web Sites Knocked out by Cyber Attack

Federal agency Web sites knocked out by massive, resilient cyber attack


A widespread and unusually resilient computer attack that began July 4 knocked out the Web sites of several government agencies, including some that are responsible for fighting cyber crime, The Associated Press has learned.

The Treasury Department, Secret Service, Federal Trade Commission and Transportation Department Web sites were all down at varying points over the holiday weekend and into this week, according to officials inside and outside the government. Some of the sites were still experiencing problems Tuesday evening.

Federal government officials refused to publicly discuss any details of the cyber attack, and would only generally acknowledge that it occurred. It was not clear whether other government sites also were attacked.

Others familiar with the outage, which is called a denial of service attack, said that the fact that the government Web sites were still being affected three days after it began signaled an unusually lengthy and sophisticated attack. The officials spoke on condition of anonymity because they were not authorized to speak on the matter.

The Homeland Security Department confirmed that officials had received reports of "malicious Web activity" and they were investigating the matter, but had no further comment. Two government officials acknowledged that the Treasury and Secret Service sites were brought down, and said the agencies were working with their Internet service provider to resolve the problem.

Ben Rushlo, director of Internet technologies at Keynote Systems, called it a "massive outage" and said problems with the Transportation Department site began Saturday and continued until Monday, while the FTC site was down Sunday and Monday.

Keynote Systems is a mobile and Web site monitoring company based in San Mateo, Calif. The company publishes data detailing outages on Web sites, including 40 government sites it watches.

According to Rushlo, the Transportation Web site was "100 percent down" for two days, so that no Internet users could get through to it. The FTC site, meanwhile, started to come back online late Sunday, but even on Tuesday Internet users still were unable to get to the site 70 percent of the time.

Ben Rushlo, director of Internet technologies at Keynote Systems, called it a "massive outage" and said problems with the Transportation Department site began Saturday and continued until Monday, while the FTC site was down Sunday and Monday.

Keynote Systems is a mobile and Web site monitoring company based in San Mateo, Calif. The company publishes data detailing outages on Web sites, including 40 government sites it watches.

According to Rushlo, the Transportation Web site was "100 percent down" for two days, so that no Internet users could get through to it. The FTC site, meanwhile, started to come back online late Sunday, but even on Tuesday Internet users still were unable to get to the site 70 percent of the time.

"This is very strange. You don't see this," he said. "Having something 100 percent down for a 24-hour-plus period is a pretty significant event."

He added that, "The fact that it lasted for so long and that it was so significant in its ability to bring the site down says something about the site's ability to fend off (an attack) or about the severity of the attack."

Denial of service attacks against Web sites are not uncommon, and are usually caused when sites are deluged with Internet traffic so as to effectively take them off-line. Mounting such an attack can be relatively easy using widely available hacking programs, and they can be made far more serious if hackers infect and use thousands of computers tied together into "botnets."

For instance, last summer, in the weeks leading up to the war between Russia and Georgia, Georgian government and corporate Web sites began to see "denial of service" attacks. The Kremlin denied involvement, but a group of independent Western computer experts traced domain names and Web site registration data to conclude that the Russian security and military intelligence agencies were involved.

Documenting cyber attacks against government sites is difficult, and depends heavily on how agencies characterize an incident and how successful or damaging it is.

Government officials routinely say their computers are probed millions of times a day, with many of those being scans that don't trigger any problems. In a June report, the congressional Government Accountability Office said federal agencies reported more than 16,000 threats or incidents last year, roughly three times the amount in 2007. Most of those involved unauthorized access to the system, violations of computer use policies or investigations into potentially harmful incidents.

The Homeland Security Department, meanwhile, says there were 5,499 known breaches of U.S. government computers in 2008, up from 3,928 the previous year, and just 2,172 in 2006.



Learn How To Hack

Learn How To Hack


70 Resources for hacking and viruses and worms

http://updates.zdnet.comtagshacking+and+viruses++and++worms.html





Learn How To Hack

Learn How To Hack

The Challenge of Cyberterrorism: Excerpted from A Survey of Terrorism, By Robert T. Thetford, J.D.

The first known cyberattack occurred in 1998, and was a limited attempt by Tamil guerrillas to swamp Sri Lankan embassies with e-mail, according to U.S. officials.(1) This attack may have been crude and ineffective but it set the stage for more serious cyberattacks in the future.

Learn How To Hack

Learn How To Hack

While the use of hacking or more appropriately named cracking techniques have been used by unscrupulous individuals (mostly teenagers) for over 10 years in the United States to gain unauthorized access to computer systems, the use of these techniques by states or organized groups to deliberately disable or destroy the computer systems and infrastructure of their enemies is a relatively recent phenomena.

In 1999, an Associated Press report detailed an apparent coordinated electronic attack by the Chinese on Internet web sites operated by the Falun Gong meditation group.(2) The report stated that at least one hacking attempt appeared to have been traced back to a Chinese national police bureau in Beijing.

Attack Methods

The vast majority of electronic attacks involve amateurs who have copied programs from the Internet or from their friends. Armed with these programs, the attackers, most of whom are still in school or are school age, can and have caused damages running in the millions of dollars. Other hackers attack computer systems merely for the thrill of the attack itself and leave “calling cards” as to their visits, or simply do it in order to brag to their friends.

Often a hacker will gain access and open a “back door,” a separate entry point to the computer system, which allows the hacker to enter the system undetected at will and provides a sense of ownership over the system. Knowing that the system is his for the taking provides a feeling of absolute power, an emotional state that is frequently necessary for the hacker’s self-esteem.

A further measure of control involves inserting a “Trojan Horse” into the system files. This is a program which a system accepts, usually because it is not detected or because it is recognized as a benign file. Trojan Horses often contain malicious code in the form of “Logic Bombs,” which are programs residing in a system without interfering with the system operation until activated through the passage of a certain amount of time or the occurrence of a certain event. Upon activation, the Logic Bomb may do anything its designer has programmed it to do, including destroying the system files or spreading viruses.

A virus is by definition a program that reproduces itself. It may destroy or alter data or use system memory, or it may simply reproduce itself, but it generally stays within the computer system. Worms are similar to viruses in that they copy themselves over and over, generally degrading system resources, but they are designed to reproduce across computers systems (for example, through e-mail) and are therefore potentially much more dangerous. Even the most innocuous of these are vicious, however, and cause serious problems for computer systems. Although the total number of viruses (and worms) is unknown, one leading manufacturer of anti-virus software advertises that its program protects against over 50,000 viruses.

Just how much damage do they cause? The latest estimates of one of the more recent worldwide virus, the “Love Bug,” which originated in the Philippines and quickly spread to both Europe and the United States, indicate that the damage to computer systems may have run as high as $10 billion.(3) This virus was allegedly created by college students as a research project. Imagine what a terrorist group could accomplish with determination and a fundamental understanding of computer technology.

A growing form of cyberterrorism common in Europe (and beginning to be used in the United States) is Cyber-extortion. The typical scenario in this criminal activity occurs when an individual or group threatens to destroy, publish or sell data files of a company if a certain fee is not paid or an action by the company is not undertaken. Often the extortionists will have gained entry into the system files and left a “calling card” in order prove the validity of the threat. Companies frequently accede to the demands rather than report the threat to the police because they understand the damage that can be done and also because they are afraid of the effect on their customer or client base if a security breach of client data becomes publicly known.

Perhaps the most devastating computer attacks occurring from 1999 to 2001 have been “Denial of Service” (DoS) attacks or “Distributed Denial of Service” (DDoS) attacks, often caused by “Mail Bombs.” In a DoS attack, a computer (or a group of computers in the case of an organized attack) is directed to flood the target system with e-mail or requests for information. A DDoS attack accomplishes the same goal using captured, third party computers. In this type of attack, third party computer systems (called Zombies) are in essence hijacked and used to flood the target system with requests for information or e-mails, thereby totally overwhelming the target system and shutting it down for commercial traffic.

DoS and DDoS attacks cost private industry only $77,000.00 in 1998, but cost an estimated $8 million in damages during the first two months of the year 2000 alone.(4) In the United States, Mail Bombs have been used by eco-terrorists to tie up their adversaries, with over 50,000 e-mails being sent in 1998 to a Swedish facility that conducts research using monkeys.(5) The DoS attacks of the last few years have caused considerable damage to major U.S. Corporations, yet they appear to have been directed by teenagers, not organized terrorist groups. The magnitude of damage which could be caused by a well organized and orchestrated attack carried out simultaneously from numerous locations is staggering to computer security professionals. Richard Clark, a National Security Council analyst, advised in December, 2000, that the U.S. government believes tens of thousands of innocent computer systems may have already been turned into Zombies that hackers could use to cripple the Internet.(6)

The Targets

Most experts feel that military installations, power plants, air traffic control centers, banks and telecommunication networks themselves are the most likely targets for a cyberterrorist attack. Other targets include police, medical, fire and rescue systems, which could easily be damaged, along with Wall Street brokerage firms and water/sewage systems.

During the Gulf War in 1990, a group of Dutch hackers calling themselves “High Tech for Peace” approached diplomats in the Iraqi Embassy in Paris. The hackers offered to disrupt the electronic network handling logistics messages between bases in the U.S. and U.S. military units in Saudi Arabia if the Iraqi Government paid a fee of $1 million. The Iraqis refused, but in reality they probably should have accepted the offer. A study later showed that 25 percent of the electronic messages coming into Saudi Arabia were uncoded and were totally vulnerable to interception and disruption. Had this offer been accepted the U.S. military supply lines would have been severely affected.(7)

In a recent briefing before the U.S. Congress, George Tenet, Director of the U.S. Central Intelligence Agency, said at least a dozen countries are developing programs to attack other nations' information and computer systems. China, Libya, Russia, Iraq, and Iran are among those developing such systems. Additionally, a new classified National Intelligence Estimate reports at least one instance to date of active cybertargeting of the United States by a foreign nation.(8)

In 1996, a Swedish hacker, moving through cyberspace from London to Atlanta to Florida, rerouted and tied up telephone lines to 11 counties, put 911 emergency service systems out of commission, and impeded the emergency responses of police, fire, and ambulance services.(9)

While many of the foreign cyberattacks grab the headlines, domestic cyberattacks are increasing at an alarming rate with the number of pending FBI cases involving cyberattacks increased from 128 in 1996, to 1,154 in 1999.(10)

Nor are the cyberattacks limited to business and educational establishments. In 1998, the FBI executed search warrants on the homes of two California high school students after determining that they had gained entry to a number of government computer sites. Their hacker assaults on the Pentagon, NASA, and a U.S. nuclear weapons research lab were described by a deputy defense secretary as the most organized and systematic attack on U.S. computers ever discovered. To make the Pentagon attack hard to trace, the hackers routed it through the United Arab Emirates. They were directed in this attack by a teenage hacker in Israel.(11) While all of those involved were arrested, in a typical case little punishment is imposed on teen hackers due to their age. The situation is even more complicated with the discovery of a teenage hacker in another country. In most recent situations, the United States has left the prosecution of teenagers to the discretion of their home country, even if extradition treaties would allow prosecution here.

The vulnerability of technologically advanced countries such as the United States to cyberattacks became acutely apparent through government studies of the Y2K problem in 1999. It was discovered that the “triad” of electric power, banking, and telecommunications was especially susceptible to cyberattacks because of the heavy use of computers in these industries and the mandated use of telecommunications to link the computers. The interdependence of these industries makes protection against electronic intrusion vital to the continuation of an advanced society. When it is understood that without telecommunications, both banking and electric power will fail; that without electric power, both telecommunications and banking will fail; and that without banking, the economic infrastructure of a country will fail, then the magnitude of the problem can be seen.

James D. Kallstrom, former chief of engineering at the FBI laboratory in Quantico, Virginia, in discussing the possibility of computer network based cyberattacks, advised:

We are using the efficiencies of technology and the Information Age to control everyday things like traffic lights, 911 systems, the environment of buildings, the communications network, and the power grid. We even control the water supply with computers. We are doing more and more things like that. In the old days…Fort Knox was the symbol of how we protected things of great value: we put them in buildings with thick walls and concrete. We put armed guards at the doors, with sophisticated multiple locks and locking bars. We could even build a moat and fill it with alligators…. Today [with] things of that same value, you wonder if some teenager is going to go in on the phone lines and steal it all. We are not equipped to deal with those issues both in the government and private industry.(12)

Brian Jenkins, an analyst at the Rand Corporation, a U.S. think tank, expressed a similar view:

In the past, when terrorists wanted to conspire, they usually had to get together and meet in person. Nowadays, they can take to the Internet and find like-minded believers, even if they don't know them already. We have not even begun to comprehend the consequences of the Internet to create an army. Their ability to communicate with one another, to find reinforcement -- even justification -- for crazy views is of extraordinary importance.(13)

The Future

It has been estimated that 90 percent of all criminals in the U.S. are now computer literate.(14) This percentage would indicate a dramatic increase in the number of computer crimes overall, including the use of computers for terrorist acts. As the computer literacy of terrorists increases, so should the number of cyberattacks by terrorist groups show a corresponding increase.

There has never been a greater need for joint government and private industry cooperation to meet what will likely be the next great threat to the security of our nation’s infrastructure. Reaction on the part of cyberattack victims (in both government and private industry sectors) continues to vary widely to both published and unpublished attacks. Some companies have taken an extremely aggressive stance, even to the point of reversing DoS attacks and actually counterattacking the DoS originators.(15) On the opposite end of the spectrum, many companies merely attempt to close the door to the attack and quietly look for ways to defeat attacks in the future, giving as little publicity as possible to the attack and hoping the attacker will seek another victim in the future. Still other companies have opted for litigation and criminal action to stop the attacks, understanding that only by pursuing actions which inflict legal pain will attacks be stopped.

Recent technology has enabled government agencies to electronically search an attacking computer for evidence of the attack,(16) and the potential is not limited to purely defensive methods. According to the New York Times, the U.S. Department of Defense has set up a Cyberwarfare Center which provides offensive cyberwarfare capabilities, including strategies designed to “infect enemy software, upset enemy logistics, and disable enemy air defense systems.” One immediate usage for the Center’s programmers during the war in Kosovo was to conduct “attacks on Serbian computer systems in an effort to change banking records and deplete Serbian assets.”(17)

A review of published data indicates no unified approach in the defense of cyberattacks today, whether they be from teenage computer hackers or from dedicated terrorist groups bent on destroying the United States. While recent changes in state and national criminal laws have closed some of the more obvious loopholes, the basic fact is that as a nation we have failed to recognize the enormous nature of the threat to our society. Law enforcement attempts to plug gaping holes in electronic fences have been repeatedly and effectively thwarted by those who consistently place privacy above security. The recent attacks on the Pentagon and Twin Trade Towers of the World Trade Center may soften the resistance to law enforcement and intelligence surveillance legislation which, if passed, may include cell phone, Internet and e-mail tracing, increased access to credit-card billing information; roving wiretaps linked to people instead of telephones, tougher penalties for terrorist crimes; and new methods to follow financial transactions by suspected terrorist groups.

A recent analysis of past cyberattacks makes some ominous predictions for the near future as the U.S. engages in its war on terrorism:(18)

* Electronic information sites in the U.S. and allied countries will be exposed to increasing attempts at defacing for the purpose of spreading disinformation and propaganda.
* DoS attacks will increase, as will the use of worms and viruses.
* Unauthorized intrusions into U.S. systems and networks will result in critical infrastructure outages and corruption of vital data.

Until the threat is recognized as not random and isolated, not the pranks of a few talented but misguided individuals, but is rather the opening salvo of a massive and deadly serious assault against the very fabric of our technological culture, no effective steps will be taken to prevent and neutralize the threat. It may just be that until we experience an “Electronic Pearl Harbor,” we will continue to approach the problem in a piecemeal and ineffective manner, always playing catch-up with the other side and always at least one step behind in the ongoing war against computer literate criminals and cyberterrorists.

Preparation for the Attack

If one assumes that a future cyberattack is likely in some form, what are the steps, if any, which may be taken to protect networked governmental, corporate or even home computer systems? First and foremost, learn from other’s mistakes by undertaking the following specific steps:

Policy review

Every government and virtually every business in the United States now has at least one computer system. If employees have access to computers and systems, a review should be immediately taken of the current practices and procedures to determine appropriate use of network resources.

* Who has access and to which systems?
* What is their level of access?
* Exactly what are employees able to do with their access?
* Are written policies in place?
* Are they enforced?

Policy reviews should address e-mail and Internet use as well as basic security practices. There are many sample policies available and numerous reputable companies in existence that conduct security audits. Much of what they do is plain common sense, but is generally based upon known methods of intrusion. If your organization is contemplating the use of a physical/technology security service for a review of your procedures, insure that those who conduct the audit have ample experience in their fields – in other words, use the best people you can find. Once policies are written and/or upgraded, they should be implemented as part of normal training, and every employee should acknowledge the receipt of training by signature.

After review by appropriate legal counsel, consideration should be given to the use of an on-system warning screen advising the user that the system confers no privacy rights and is to be used by authorized personnel only for official government/company business. Users should be notified that the system is subject to being monitored for appropriate use (perhaps defining the term “appropriate use”). The warning should further advise that system resources are subject to being retained and reviewed by the government and may be furnished to others, including law enforcement agencies, at the discretion of the government. Finally, users should be notified that by using the system they understand and consent to the provisions of the warning.(19) If not placed in a warning screen, the above should be incorporated into the government policy and should be acknowledged by all employees having access to system resources.

Firewalls and Virus Checkers

Computers and networks without operating firewalls and up-to-date virus protection are similar to open entrance doors in homes – they are invitations for criminals to enter, steal, and vandalize.

Firewalls are generally considered necessary when using “always on” connections like T1 lines, cable and DSL connections because a typical telephone modem for a home line uses a different computer address (URL) each time the server is dialed. To test a particular computer’s vulnerability to outside probes, run the tests at Gibson Research or at the Symantec site. These will show the need for firewall protection or will show how much protection an existing firewall offers.

One additional bonus for firewalls that should not be overlooked is the filtering capacity that they offer. Most provide filtering options ranging from no filtering to totally paranoid, and site-blocking features prevent most (but not all) unauthorized site visits. E-mail programs provide the same provision for blocking unwanted e-mail, but their ability to filter is somewhat limited.

Virus checkers are relatively cheap and offer substantial protection from e-mail and Web viruses, but must be frequently updated to be effective. The once laborious process of updating has been simplified and now is easily accomplished through automatic updates or one-button clicks.

Most virus protection software is based on pattern recognition of known virus characteristics. Since these recognition patterns are developed only after new viruses are identified, they are unable to prevent new and unrecognized viruses. Because no virus checking software offers 100 percent protection, an examination of company computer operating policies should be mandatory with a goal of limiting Internet access to only those employees who have a need for Internet use in their jobs.

E-mail use also should be examined and policies formulated to restrict the receipt of attachments, which often contain viruses. Thought should be given to notifying employees that their e-mail usage is subject to being monitored (they should sign a statement of acknowledgement) and then periodically examine e-mail content for inappropriate or excessive usage. Finally, a retention period for e-mail messages should be established to decrease storage requirements and incidental exposure. This period should be more than 30 days but less than a year. The ability to retrieve e-mail messages may become extremely important in the event that a cyberattack or virus renders the system inoperable.

Password Protection

Individuals generally resist having to bother with passwords and when forced to do so, they often pick common words that are easily determined by scanning computers. To be safe, passwords should be a combination of letters and numbers and should be changed often. It is also a mistake to leave passwords in easily accessible places, such as under mouse pads or taped to the back of computers.

Security Patch Updates

Many attacks could be thwarted simply by installing system patches provided by software manufacturers to plug known security breaches. Network administrators and individuals should check system vendor sites often for upgrades designed to repair system deficiencies.

Along the same lines, administrators should frequently check the FBI’s National Infrastructure Protection Center (www.nipc.gov) site and Carnegie Mellon University’s CERT Coordination Center site, a federally funded research site (www.cert.org) for updated cyberattack information. The CERT site is particularly helpful for home computer users as it offers practical tips in non-technical language.

The National Infrastructure Protection Center (NIPC) also provides a forum (InfraGard) which encourages the exchange of information between the U.S. Government and private sector members. NIPC acts as a facilitator to its members through the dissemination and exchange of information about infrastructure protection. InfraGard may be accessed through the NIPC site above or directly through www.infragard.net.

Data Backup

One of most common complaints among computer users involves system crashes, whether they are caused by a virus, sabotage, or malfunction. Other than virus protection, the easiest and cheapest way to protect a system is through periodic data backups. Most home users and small businesses, however, seldom backup their data on a frequently scheduled basis, and when the crash comes, which it inevitably does, weeks or months of work can be lost. Nor is it enough to simply copy the data. Provisions should be made to store the data at a secure off-site location for fire and theft protection.

Backup procedures and schedules should be thoroughly covered in the governmental policy or procedure manual. In addition to electronic data backup, vital hard copy files should also be archived for the unlikely event that extended power or computer outages might occur. Protection against transient power outages should be provided by UPS battery backup systems to eliminate unnecessary down time, with thought given to implementing generator-supplied power supply for the entire computer system.

Internal Security

Finally, because most of the computer attacks today, including vandalism and theft, still originate from within organizations, internal security must be given more consideration. Information technology training, security education, and employee screening are all tools used to safeguard against internal attacks and theft. Periodic security audits from trusted outside agencies (discussed above), offer an unbiased view of the level of protection offered, as well as providing notice to company employees that infractions will likely be discovered and appropriate sanctions imposed.

While preventing all cyberattacks is impossible, with some basic planning and security awareness in mind, there are definite steps that companies, agencies and individuals can take to prepare their systems and personnel for the challenge. Failing to take these basic steps outlined above is akin to playing Russian roulette. Disaster may not strike immediately, but statistically it is bound to occur. What will you (or your organization) do when it does?

Conclusion

Many, if not most, governmental entities are on tightly restricted computer system budgets. Systems are expensive to purchase and maintain, especially with such a limited effective lifespan. If corners are to be cut, it is often in the systems security and training areas.

In light of the current threats, policy makers should carefully reconsider this view by asking one simple question: Just how much damage could be inflicted on my organization in a worst-case scenario attack on our computer system(s)? If a realistic initial appraisal determines a high level of vulnerability for continued operation, serious consideration should be given toward an immediate and thorough review of the organization’s information technology security. This security review can be implemented using the bullet point topics in the preceding section as guideposts. The review should begin with a policy review, and after inspection and corrective action on the other items have been completed, the policy should again be examined to insure all necessary changes have been incorporated.

It is not enough to make system and policy changes, however. All personnel (not just systems personnel) must be given adequate training in physical security, threat analysis, and emergency operations to insure that they understand likely threats and know what actions (including reporting procedures) to take in the event of a threat. In addition, computer systems personnel should be continuously trained in protection methods as outlined above and should be encouraged to be alert for potential violations and security breaches. The key to this training is to realistically portray the threat so that each employee understands his/her role in protecting both employees and the organization.

All personnel must understand that the likelihood of serious security breaches is now at such an increased level that their continued employment and possibly their physical safety depend upon compliance with organizational policy and threat consciousness. Security infractions and breaches must be thoroughly investigated and corrective action immediately taken, to include after-action reviews so that violations are not repeated. Employees should be encouraged to report violations, and inadvertent breaches should not be punished if reported. The idea is to prevent mistakes or violations from being buried through fear of reprisal rather than being reported and corrected.

Not all of the above suggestions are expensive. Many can be accomplished “in house,” and with a minimum of effort. All systems should be reviewed immediately, however, as we are faced with dangers never before seen. President Bush advised following the September 11 attacks that we would most likely be engaged in a long war against very determined terrorists. Based upon the available evidence, those who have proclaimed themselves to be our enemies are well prepared. Are we?

Endnotes

1. “U.S.: First cyberattack by terrorists,” Reuters Report, 5/5/98, (4/25/00).
2. “China Sect Claims Sites Under Attack,” Associated Press, 7/31/99, (4/25/00).
3. David Noack, “Love Bug' Damage Worldwide: $10 Billion,” ABP News, 5/8/00, (5/9/00).
4. Andrew Quinn, “Risky Business; Computer Security a Top Issue,” ABC News, 3/22/00, (3/25/00).
5. Miguel Llanos, “Eco-extremists using e-mail bombs,” MSNBC, 10/24/98, (11/2/98).
6. Michael Kirkland, “NSC: 'Zombies' could cripple 'Net,” UPI Report, 12/28/00, (12/29/2000).
7. John J. Fialka, War by Other Means, (New York: W.W. Norton, 1997), pp. 104-105.
8. Douglas Pasternak and Bruce B. Auster, “Terrorism at the touch of a keyboard,” US News and World Report, 7/13/98, p.37, (4/27/00).
9. Ibid.
10. Sue Pleming, “Freeh: Cyber attacks doubled in ’99,” Reuters, 3/28/00 <> (4/1/00).
11. Douglas Pasternak and Bruce B. Auster, “Terrorism at the touch of a keyboard,” US News and World Report, 7/13/98, p.37. (4/27/00).
12. Simson Garfinkel, Database Nation, (Sebastopol, California: O’Reilly & Associates, 2000), p. 224.
13. Jim Krane, “Terror's 'Dark Undercurrent' Rises in America,” APB News, 4/19/00, (4/20/00).
14. Richard S. Groover, “Overcoming Obstacles: Preparing For Computer-related Crime,” FBI Law Enforcement Bulletin, August, 1996, (4/26/00).
15. “Can you hack back?” CNN News, 6/1/00, (6/3/00).
16. Patrick Riley, “Feds Use Convicted Pedophile To Create Internet Spy Software,” Fox News, 8/16/00, (8/17/00).
17. Elizabeth Becker, Pentagon Sets Up New Center for Waging Cyberwarfare, New York Times, 10/08/99, p. A16.
18. Michael A. Vatis, “Cyber Attacks During the War on Terrorism,” Institute for Security Technology Studies at Dartmouth college, 9/22/01, 10/1/01.
19. William C. Boni and Gerald L. Kovacich, I-Way Robbery, Crime on the Internet, (Boston:Butterworth-Heinemann, 1999), p. 166.