Tuesday, July 28, 2009

Industrionage: As economic warfare become more industrial based, the distinction between economic and industrial espionage becomes less relevant

Industrionage is a term I created from the phrase "Industrial Espionage". Just what is Industrionage; moreover, exactly what is involved in the act of espionage as it applies to industry? The following articles and musings will help focus this very important issue.

Economic and Industrial Espionage:
A Question of Counterintelligence or Law Enforcement?
By Harvey Rishikof


Introduction

Economic or industrial espionage is an old problem. As the current head of the National Counterintelligence Executive (NCIX) under the Director of National Intelligence (DNI), Joel F. Brenner, likes to muse, espionage itself is as old as Joshua reconnoitering the Promised Land, and it will be with us forever.[1] In the Cold War the archetype for technological counterintelligence, as well as industrial espionage, was the American born Russian spy Dr. George Koval’s penetration of the Manhattan Project for the atomic bomb.[2] But the paradigm is shifting in the economic era of globalization. The end of the Cold War and the explosion of technology, increased access to computers and the internet, potential profits, poor prosecutorial tools, fear of reporting the theft, and inadequate federal and state laws, have all contributed to the attractiveness of economic espionage.[3] In the words of Bernard Esambert, former Chairman of the Board of the Pasteur Institute, “Today’s economic competition is global. The conquest of markets and technologies has replaced former territorial and colonial conquests. We are living in a state of world economic war and this is not just a military metaphor... the companies are training the armies and the unemployed are the casualties.”[4]

International commerce and advancing technology have increased the likelihood of and opportunity for economic intelligence and industrial espionage, placing intellectual property and trade secrets at increased risk of appropriation. Consider the iPod, while Apple developed it, its 451 parts are made in several different countries, including Japan, Philippines, Korea, China, and Taiwan.[5] Such outsourcing although efficient and cost effective, leaves Apple open to foreign industrial espionage at critical stages of design. When viewed from the perspective of the NCIX trying to protect economic secrets in a world of shifting boundaries, world supply lines, and spheres of influence, it is a monumental challenge:

Boundaries of every kind are eroding—legally, behaviorally, electronically—in all aspects of our lives: Between the public and private behavior of ordinary people; for example, the sense of dress and decorum appropriate to the home, the street, the office, or houses of worship. Between the public and private—that is, secret—behavior of governments. Between the financing, legal norms, and research activities of public as opposed to private institutions; [and] universities, for instance. Between state and non-state actors and the relative size of the resources they control. Cyber boundaries are also eroding—and not always in ways we like—but simply because we are sometimes helpless to enforce them.[6]

But those in charge are still responsible, and they have to try to craft a response to the new era of globalization, computerization, secrets, and spying. The mission therefore is increasingly difficult and will not go away because the stakes are so high. Our recent economic downturn may only enhance the incentives to increase this type of spying. In the elegant words of Joel Brenner the “intellectual thieves” seem to have the upper hand at the moment. As he recently explained at a public-private sector conference:

The fact is, intellectual thieves are eating our lunch—eating your lunch. The public and private sectors are both leaking badly. I’m not talking about just the pirating of DVDs and movies in Asia. I’m talking about significant technologies that are walking out of our laboratories on electronic disks, walking onto airplanes bound for foreign ports, and re-entering the country as finished products developed by foreign entrepreneurs. In effect, we’re buying back our own technology. This is bad enough when we’re talking about commercial innovation. But when we’re talking about technology with substantial defense applications, we’re talking about losses of intellectual capital that in wartime could cost many lives of our fellow citizens. These losses are occurring, and they are occurring in a targeted, systematic manner.

Protecting innovative technology before it can be patented or classified is an urgent task, and it is difficult. If any of us knew how to do it, he’d be very rich, because it’s a question of handicapping basic research.[7]

Protecting critical business information is not only a bottom line issue but also may be increasingly a national security issue. Companies however, are fearful of government classification schemes that will hinder innovation and openness. Given this reality and boundary erosion, perhaps it is not surprising that a former head of the French intelligence service in 1994 admitted that his agency spied on U.S. executives abroad and “bugged” first-class seats on Air France to monitor conversations.[8] Moreover, this arena is complicated not only by the fact that the key to our information networks is openness but the information can be transmitted through standard business practices – merger and acquisitions, joint ventures, strategic alliances, and licensing agreements. Therefore, both military friends and foes may be adversaries in the economic arena of espionage. Sometimes the attack is from government-sponsored espionage, other times it is the private illicit acquisition of proprietary information, and sometimes it may be a combination of the two.

As one can imagine, it is hard to find data in this arena. As one of my old professor’s use to say – studying smuggling is hard and potentially dangerous. A measure of the extent of the growing problem is the number of prosecutions for the illegal export of US technology as reported by the 2003 Annual Report on Foreign Economic Collection and Industrial Espionage (FECIE). During fiscal year 2003, US Department of Immigration and Customs Enforcement (ICE) conducted more than 2,000 investigations involving violations of the Arms Export Control Act, International Traffic in Arms Regulations, Export Administration Regulations, International Emergency Economic Powers Act, and the Trading with the Enemy Act. Those investigations resulted in 120 arrests, 75 criminal indictments, and 55 convictions.[9]

According to a survey published in 2007 by the American Society for Industrial Security (ASIS), the financial impact of individual cases of espionage range from less than $10,000 to more than $5.5 million per incident, for a cumulative year-end total in the American economy of billions of dollars in losses – to reputation, image, goodwill, competitive advantage, core technology, and profitability.[10] But as we began to recognize in the late 1990s corporations are of strategic interest to the United States on three levels since they: 1) produce classified products for the government; 2) produce dual-use technology used in both the public and private sectors; and 3) are responsible for R&D and the creation of leading-edge technologies critical to maintaining U.S. economic security. Losses at any of these levels could affect U.S. international competitiveness and security.[11] Regardless of the source, the threat to US interests is real, and the US is extremely vulnerable.

The 2005 Annual Report to Congress on FECIE reported that 108 countries – both friend and foe – were involved in information collection efforts against the United States.[12] China, Russia, and India top the list. The FECIE reports indicate that foreign collectors tend to target dual-use technology, which can be used for both peaceful and military objectives, and military technology. There is no dispute that foreign governments go after trade secrets for the sake of national security advantage. But what is the United States government’s role in company v. company warfare? Should investigations be considered a counterintelligence or law enforcement matter? Do these old jurisdictional boundaries and responsibilities still work? What should be a secret, and what is the government’s role in making that determination? What can be done to protect US interests?

The critical issue in the new world of commerce is whether one can clarify the differences between economic and industrial counter-espionage and explain why the latter is particularly problematic. To many, governments have long engaged in economic intelligence but have found the need to engage in economic espionage declining as more and more critical information is available through open sources. Industrial espionage, on the other hand, may be becoming the most prevalent form of economic espionage as governments seek industry-related information for the intelligence they need on battlefield capabilities, for design of counter-measures, and for preparation of the battlefield – including how to attack energy grids, and industrial plants important for war-making etc. Industrial espionage involving the theft of trade secrets, perhaps at one time seemed to be able to be restricted to an industrial sphere, but dual use technologies erase what once was an easy distinction as government involvement becomes more prevalent.

Some recent cases --How to balance counterintelligence v. law enforcement?

At the time of the passage of the Economic Espionage Act in 1996 (EEA), 23 to 26 countries were identified as practicing suspicious collection and acquisition activities and 12, in particular, were targeting trade secrets. In particular the technology categories, many of which are dual-use technologies, listed in the Military Critical Technology List published by the DOD were of greatest interest.[13] The FBI had seen the number of cases of suspected economic espionage under investigation in its Economic Counterintelligence Program started in 1994 leap from 400 to 800 cases by 1996. By 2005 the number of countries involved in collection efforts against sensitive and protected US technologies had risen dramatically.

More specifically, the immediate issue is whether the government should be engaged in a back-door industrial policy by determining which industrial products deserve protection with federal dollars. Criterion might be direct relevance to national security, actually threatened industries, or a mixed strategy using a case-by-case approach. Recent cases brought under the EEA are illustrative of the range of potential problems for prosecution under the current charging schemes as the government tries to establish foreign involvement.

If the companies are selected according to their direct relevance to national security (i.e. they have defense contracts) then the contracting process becomes the tool the FBI and others use for building their database of which industries to help—regardless of whether the thief is a foreign government or a competing firm acting on its own. This is, of course, a very defensive posture but allows for a potential marshalling of resources. An example of such a national security case is United States v. Meng that involved military technology, computer source code, and economic opportunity.[14]

In 2007 Xiaodong Sheldon Meng, formerly a resident of Beijing, China, and a resident of Cupertino, California, was charged with stealing military combat and commercial simulation software and other materials from his former employer Quantum3D, a company based in San Jose, California. Meng was charged under the EEA with stealing the trade secrets from Quantum3D with the intent that they would be used to benefit the foreign governments of China, Thailand, and Malaysia.

Many of Quantum3D’s products were designed primarily for military purposes, including military combat training in simulated real-time conditions during the day and night and the use of advanced infrared (IR), Electro-Optical (EO), and Night Vision Goggle (NVG) devices. The indictment alleges that Meng stole numerous Quantum3D products, including “viXsen™” and “nVSensor™,” which were used exclusively in military applications and designed for precision training of military fighter pilots in night vision scenarios among other applications. Both “viXsen™” and “nVSensor™” are classified as defense articles on the U.S. Munitions List and cannot be exported outside the United States without an export license.

In 2003 after a number of years of employment, Meng entered into a consulting agreement with Quantum3D in which he would serve as an independent consultant for Quantum3D in Asia. In this capacity he tried to sell sensitive source code to the Malaysian Air Force. In 2004 he severed his relationship with Quantum3D, joined a competitor, and attempted to sell Quantum3D products to the Chinese and Thailand.[15] In essence Meng given his knowledge of the products became the carrier.

Another recent case highlighting the overlap of economic and industrial espionage in the national security area and they type of cases to focus on is the 2007 Chi Mak case. In the Chi Mak case, five members of a southern California family were charged with acting as agents of the People’s Republic of China and with conspiring with each other to export United States defense articles to the People’s Republic of China a violation of the Arms Export Control Act. This technology theft ring focused on acquiring corporate proprietary information and embargoed defense technology related to the propulsion, weapons and electrical systems of U.S. warships. The family, the father a naturalized citizen from China, had pursued a long-term plan of infiltration over years.

Though the object was clear, who sponsored the ring? Chi Mak was a support engineer at L-3 Communications working on navy quiet drive propulsion technology. The espionage effort appears to have been directed by a Chinese academic at a research institute for Southeast Asian affairs at Zhongshan University in Guangzhou, China. The Chi family encrypted the information it was passing back to China into a computer disk that appeared to contain television and sound broadcasts. It was literally embedded in the other data in encrypted form. This effort has all of the earmarks of professional espionage tradecraft and state-directed espionage, with sophisticated control and sophisticated clandestine communications means. The government university in Guangzhou could have been cover for a state-directed espionage effort. However, Chi Mak and his alleged co- conspirators could just as well have been part of a sophisticated economic espionage operation run out of a university research institute. The future plea agreements will perhaps make clear the true nature of the conspiracy.[16]

This “direct relevance” approach would require prioritizing military programs and “tagging” all employees with access to high value products. And as these cases illustrate the targeting countries are not beyond “planting” potential operatives as “sleepers” whose goal is to join critical companies and plot long-term career paths.

Alternatively, law enforcement could build a database of those industries actually threatened by foreign governments’ intelligence activities, whether or not the US uses the technology for national security purposes. The rationale here would be: if a foreign government wants the technology, there is national security gain to be had, by definition, in keeping that technology from them. This approach is problematic because of its underlying assumption and because many non-defense firms do not necessarily want the federal government probing their businesses to discover what their R&D involves or interfering in their choices on how to develop, protect or share such technologies.

Such a case was, United States v. Okamoto and Serizawa, when Takashi Okamoto, a resident of Japan, and Hiroaki Serizawa, a resident of Kansas, were indicted of stealing trade secrets from the Cleveland Clinic Foundation (CCF). [17] Okamoto and Serizawa conspired to misappropriate from the CCF certain genetic materials called Dioxyribonucleic Acid (DNA) and cell line reagents and constructs which were developed by researchers employed by CCF, with funding provided by the CCF and the National Institutes of Health, to study the genetic cause of and possible treatment for Alzheimer’s. Alzheimer’s affects an estimated 4,000,000 people in the United States alone and is the most common cause of dementia. The pharmaceutical market for this disease is a potentially rich profit center for any company in the field. The Alzheimer's disease market is forecast to continue to expand significantly over the next ten years. Aided by growing elderly populations, successive product launches have seen global revenues grow at over 35%.[18]

The goal of the conspiracy was to benefit the Institute of Physical and Chemical Research (RIKEN), a quasi-public corporation located in Saitama-Ken, Japan, which received over 94 percent of its operational funding from the Ministry of Science and Technology of the government of Japan. The Brain Science Institute (BSI) of RIKEN was formed in 1997 as a specific initiative of the Ministry of Science and Technology to conduct research in the area of neuroscience, including research into the genetic cause of, and possible treatment for, Alzheimer’s Disease

Okamoto and Serizawa had committed economic espionage by stealing, altering and destroying trade secrets that were property of the CCF, specifically, 10 DNA and cell line reagents developed through the efforts and research of researchers employed and funded by the CCF and by a grant from the National Institutes of Health. [19] Okamoto and Serizawa were also charged with transporting, transmitting, and transferring in interstate and foreign commerce, DNA and cell line reagents developed through the efforts of researchers employed and funded by the CCF.[20]

Should law enforcement be focused on lucrative emerging world markets, as in the above case of Okamoto and Serizawa and be using limited resources to protect private companies from losing market share? How can the federal government, given its limited resources, spread itself across such a large canvas? Will corporations want to cooperate with the government?

A third option is to develop a counter intelligence strategy that mixes the two previous approaches and determines, on a case by case basis, whether the efforts at acquisition by a foreign entity represent a national security threat. United States v. Ye and Zhong[21]presents such a choice. Fei Ye, and Ming Zhong were arrested at the San Francisco International Airport with stolen trade secret information in their luggage while attempting to board an aircraft bound for China. Ye and Zhong admitted to possessing stolen trade secrets for an integrated circuit design from Sun Microsystems, Inc. and Transmeta Corporation with the intent to benefit the Peoples Republic of China.

Ye and Zhong admitted that they intended to utilize the trade secrets in designing a computer microprocessor that was to be manufactured and marketed by a company that they had established, known as Supervision, Inc. They admitted that Supervision was to have provided a share of any profits made on sales of chips to the City of Hangzhou and the Province of Zhejiang in China, from which Supervision was to receive funding. Mr. Ye and Mr. Zhong also admitted that their company had applied for funding from the National High Technology Research and Development Program of China, commonly known as the “863 Program.”

Fei Ye is alleged to have possessed a corporate charter for Hangzhou Zhongtian Microsystems Company Ltd. at his house which states that the joint-venture will raise China’s ability to develop super-integrated circuit design and form a powerful capability to compete with worldwide leaders’ core development technology and products in the field of integrated circuit design.[22]

The problem here is that, in addition to the issues with the first two previous enforcement approaches raise, the Ye and Zhong case introduces a third: acquiring the expertise within the counter intelligence community to analyze industrial R&D at its most cutting edge. And even if the community were successful in doing this, law enforcement would have to employ a sliding authorization for use of counterintelligence tools (wiretaps, undercover surveillance, etc.) during the investigative process or risk alienating firms it might need to cooperate in an eventual prosecution. Any investigations that did not pan out as espionage would have to be prosecuted as crimes, unless companies decide to drop charges in the interest of pursuing profits instead. But could the corporations count on the federal government or IC to pull back once an interest had been pursued? For some of the proponents of the EEA in 1996, the act was an attempt to pursue this third option, but the infrastructure and groundwork has not materialized to pursue such a nuanced course.

Why these cases are of interest is that they illustrate how difficult counterintelligence is when the focus is the private sector? What were the roles of the firms in each of the cases? Did the company alert law enforcement or the other way around? How were decisions made regarding the use of counterintelligence vs. counter-crime techniques and did internal law enforcement disagreements arise that complicated or slowed down investigations? These important questions demonstrate how difficult pursuing prosecutions in this area.[23]

But if government regulations and enforcement continue to prove ineffective the private sector may be the place where an attempted solution will be looked to, in order to stop having our “lunch eaten.” The questions are: 1) are we willing to pay the price to our privacy and will it work? and, 2) what is a US economic interest and what is a multinational conglomerate interest as it pursues its globalization strategy?

These issues of economic and industrial espionage bleed into other categories of security and competition. Recently Joel Brenner characterized the key three strategic challenges now confronting the counterintelligence community: (1) threats to our cyber networks and opportunities to understand and counter them; (2) acquisition vulnerabilities created by the international nature of our markets; and (3) the need for better collaboration in countering espionage.[24]

A corporate security culture must entail a shift in the traditional notions of privacy.[25] This shift will be a challenge to the previous zone of privacy many of us grew up with. Interestingly, the new generation of “MySpace,” “FaceBook,” and YouTube” employees may approach the new transparent work place with a different appreciation for the new corporate security culture of trade secrets. The government’s responsibility historically has been to concentrate on the espionage side of the national security arena and not be so involved in the industrial, a more private sector field. The private sector paid for its own slackness in lost revenue. Modern technology has helped to erode these two distinct arenas and this has created new burdens for the government. As economic warfare become more industrial based, the distinction between economic and industrial espionage becomes less relevant.

One reason for the erosion is that our adversaries have taken such a view, as in the Chinese 863 Program in the Ye and Zhong case. The 863 Program is a funding plan created and operated by the government of the People’s Republic of China, and is also known as the National High Technology Research and Development Program of China. The program was designed by leading PRC scientists to develop and encourage the creation of technology in the PRC and focused on issues such as high technology communications and laser technology, with an emphasis on military applications. The General Armaments Department ("GAD") of the People’s Liberation Army was responsible for the Army, Navy, and Air Force in the PRC, and oversaw the development of weapons systems used by the PRC. The GAD had a regular role in, and was a major user of, the 863 Program.[26]

This approach is perhaps more understandable in political/economic cultures that encourage state-owned enterprises. In countries where government interests can coincide with corporate interests, or national champions, intelligence agencies can be more easily instructed to assist the private sector. This perhaps explains why France over ten years ago established, the Ecole de Guerre Economique (EGE) or School of Economic Warfare. The founder of the school contends that rather than teaching economic espionage it is more the management of information to develop an economic strategy in the context of conflicts to gain market share.[27] For such state corporate-centric approaches the distinction between fair or unfair business practices can become blurred. Some have contended that the US open competitive market based system and our anti-trust laws combined with our Foreign Corrupt Practices Act has made state sponsored economic espionage a non-starter.[28]

The new Director of National Intelligence has many problems on his plate – Iraq, Afghanistan, the Middle East, China, Pakistan, India etc. How will economic-industrial espionage fair? In Andrew Niccol's 1997 science fiction film Gattaca, set in the near future, the Gattaca Aerospace Corporation has created a totally transparent work place with technology able to manipulate genetic codes and monitor all employee interactions. Although the hero is able to fool the system, the world depicted is a possible modern future that would bring corporate monitoring to one possible logical conclusion. If we do start to travel down this path of a culture of corporate security, future generations will have to judge if the price paid for corporate and national security, so that we stopped having our lunch eaten, was in the end worth the meal.

Harvey Rishikof is
Former Chair, Department of National Security Strategy and Professor of Law and National Security Studies with National War College.

_____________________________________________________________________________________

[*] See the Department of Justice web site at http://www.usdoj.gov/usao/can/press/2006/2006_12_14_meng.indictment.press.htm.



[1]
See Remarks of Joel F. Brenner, ABA Standing Committee on Law and National Security, March 29, 2007, at http://www.ncix.gov/publications/speeches/ABAspeech.pdf.

[2] See, William J. Broad, A Spy’s Path: Iowa to A-Bomb to Kremlin Honor, New York Times, November 12, 2007 A1.

[3]See Chris Carr, Jack Morton, and Jerry Furniss, “The Economic Espionage Act: Bear Trap or Mousetrap?”, Vol. 8.2 Texas Intellectual Property Law Journal (2000) p. 159, 163-170.

[4] Wanja Eric Naef, Economic and Industrial Espionage: A Threat to Corporate America?; Infocon Magazine Issue One, October 2003 at http://www.iwar.org.uk/infocon/print/espionage-cid.htm.

[5] Hal R. Varian. June 28, 2007. “An iPod Has Global Value. Ask The (Many) Countries That Make It,” http://www.nytimes.com/2007/06/28/business/worldbusiness/28scene.html

[6] See “Welcoming Comments by National Counterintelligence Executive Dr. Joel F. Brenner DNI –Private Sector Workshop on Emerging Technologies,” Carnegie Endowment for International Peace, Washington, DC, 7 December 2006 http://www.ncix.gov/publications/speeches/CarnegieSpeech20061207.pdf

[7] Ibid.

[8] Chris Carr, Jack Morton, and Jerry Furniss, “The Economic Espionage Act: Bear Trap or Mousetrap?”, Vol. 8.2 Texas Intellectual Property Law Journal (2000) p. 159, 161.

[9] See p. 3 Report 2003 at http://www.ncix.gov/publications/reports/fecie_all/fecie_2003/fecie_2003.pdf.

[10] ASIS. Trends In Proprietary Information Loss; Survey Report, 3. August 2007. http://www.asisonline.org/newsroom/surveys/spi2.pdf. The 2001 FECIE report stated that an estimated $100-250 billion was lost in sales at the end of calendar year 2000.

[11] See Statement by FBI Director Louis J. Freeh, Hearing on Economic Espionage before the House Judiciary Subcommittee on Crime, May 9, 1996, at http://www.fas.org/irp/congress/1996_hr/h960509f.htm.

[12] 2005 FECIE Report, 1.

[13] The categories for 1997/1997were: Advanced material coatings; Advanced transportation and engine technology; Aeronautics systems; Armaments and energetic materials; Biotechnology; Chemical and biological systems; Directed and kinetic energy systems; Electronics; Ground systems; Guidance, navigation, and vehicle control; Information systems; Information warfare; Manufacturing and fabrication; Marine systems; Materials; Nuclear systems; Power systems; Semiconductors; Sensors and lasers; Signature control; Space systems; Weapons effects and countermeasures.

[14]The allegations, facts, and plea agreement for this section are drawn directly from the Department of Justice’s web sites at http://www.usdoj.gov/usao/can/press/2006/2006_12_14_meng.indictment.press.html

[15] The Indictment charged Meng under a number of statutes with the following maximum penalties: Conspiracy, in violation of 18 U.S.C. § 371, (five years in prison, a fine of $250,000 or twice the value of the property involved in the transaction, whichever is greater, a three year term of supervised release); Economic Espionage and Attempted Economic Espionage, in violation of 18 U.S.C. §§ 1831(a)(3), 1831(a)(4), (fifteen years in prison, a fine of $500,000 or twice the value of the property involved in the transaction, whichever is greater; a three year term of supervised release; Arm Export Control Act, in violation of 22 U.S.C. § 2778, (ten years in prison, a fine of $1,000,000 or twice the value of the property involved in the transaction, whichever is greater; a three year term of supervised release); Misappropriation of Trade Secrets and Attempted Misappropriation of Trade Secret, in violation of 18 U.S.C. §§ 1832(a)(1), 1832(a)(4), (ten years in prison, a fine of $250,000 or twice the value of the property involved in the transaction, whichever is greater, a three year term of supervised release); Interstate and Foreign Transportation of Stolen Property count, in violation of 18 U.S.C. §§ 2314, (ten years in prison, a fine of $250,000 or twice the value of the property involved in the transaction, whichever is greater, a three year term of supervised release); False Statement to Government Agency, in violation of 18 U.S.C. § 1001, (five years in prison, a fine of $250,000 or twice the value of the property involved in the transaction, whichever is greater, a three year term of supervised release). However, the court could impose any sentence following conviction after consideration of the U.S. Sentencing Guidelines and the federal statute governing the imposition of a sentence, 18 U.S.C. § 3553.

[16] Case description quoted from the Testimony of Larry M. Wortzel, Before the Subcommittee on Crime, Terrorism, and Homeland Security of the House Committee on the Judiciary Hearing on “Enforcement of Federal Espionage Laws” January 29, 2008, http://www.fas.org/irp/congress/2008_hr/012908wortzel.pdf

[17] The allegations, facts, and plea agreement for this section are drawn from the Department of Justice’s web sites at http://www.usdoj.gov/criminal/cybercrime/Okamoto_SerizawaIndict.htm and http://www.usdoj.gov/criminal/cybercrime/serizawaPlea.htm.

[18] See Alzheimer’s at http://www.piribo.com/publications/diseases_conditions/alzheimers/pipeline_commercial_insight_alzheimers_disease.html

[19] The Indictment is still pending against Okamoto, which charges him with Conspiracy, Economic Espionage Act offenses, and the Transporting of Stolen Property in Interstate and Foreign Commerce.

[20] Thus far Hiroaki Serizawa has pleaded guilty to making false statements to the government. In the plea Serizawa admits he: falsely understated the number of vials of research material which Okamoto had taken from Serizawa’s laboratory (hundreds of vials); initially denied any recent personal contact with Okamoto when in fact Serizawa had been in recent telephone, electronic mail and personal contact with Okamoto; and initially denied any knowledge of Okamoto having accepted a research position with RIKEN when in fact Serizawa knew that Okamoto had accepted a research position at RIKEN. The false statements offense carries a maximum penalty of five years incarceration and a $250,000 fine. Under the law, conspiracy carries a maximum penalty of five years incarceration and a $250,000 fine, while economic espionage carries a maximum penalty of 15 years incarceration and a $500,000 fine, while interstate transportation of stolen property carries a maximum penalty of 10 years incarceration and a $250,000 fine.

[21] The allegations, facts, and plea agreement for this section are drawn directly from the Department of Justice’s web sites at http://www.usdoj.gov/criminal/cybercrime/yeIndict.htm and http://www.usdoj.gov/usao/can/press/2006/2006_12_14_ye.zhong.plea.press.html

[22] Ye and Zhong were charged with a total of ten counts, including: one count of conspiracy, in violation of 18 U.S.C. §§ 371, 1831(a)(5) and 1832(a)(5); two counts of economic espionage, in violation of 18 U.S.C. § 1831(a)(3); five counts of possession of stolen trade secrets, in violation of 18 U.S.C. § 1832(a)(3); and two counts of foreign transportation of stolen property, in violation of 18 U.S.C. § 2314.

[23] In particularly would like to thank the editors, Jennifer Sims and Burton Gerber, for their assistance in framing the article and many helpful suggestions.

[24] Remarks by Joel F. Brenner, National Counterintelligence Executive, “Strategic Counterintelligence: Protecting America in the 21st Century,” The Nro/National Military Intelligence Association Counterintelligence Symposium, Washington DC, 24 October 2007 at http://www.ncix.gov/publications/speeches/NRO-NMIA-CI-Symposium-24-Oct-07.pdf.

[25]

[26] See, Two Bay Area Men Indicted On Charges Of Economic Espionage http://www.intellectualpropertylawfirms.com/national-content.cfm/Article/107306/Two-Bay-Area-Men-Indicted-On-Charges.html.

[27] See, Kelly Uphoff, Tilting the Playing Field: Economic Espionage Hasn't Gone Away Since 9/11Costs to the U.S. Economy Could Be in the Hundreds of Billions of Dollars, at http://www.jinsa.org/articles/view.html?documentid=2835.

[28] Though in 2000 a small controversy erupted when James Woolsey, former DCI, program maintained that the US did not collect or even sort out secret intelligence for the benefit of specific American companies in response to European reports concerning alleged US/British spying on Europe under the Echelon program for industrial espionage purposes. See Woolsey, R. James. "Why We Spy on Our Allies." Wall Street Journal, 17 Mar. 2000.



Thursday, July 23, 2009

MegaFon Deploys Cisco CRS-1 Routing Platform as Foundation of Next-Generation Mobile Network

SAN JOSE, CA, May 27 (MARKET WIRE) --

http://www.reuters.com/article/pressRelease/idUS132685+27-May-2009+MW20090527


(NASDAQ: CSCO) -- Five years after being introduced, the Cisco(R) CRS-1 Carrier Routing System continues to be deployed by telecommunications service providers as the foundation of their Internet Protocol Next-Generation Networks (IP NGNs). The CRS-1 was recently deployed by Russian mobile operator MegaFon, one of the fastest-growing mobile operators in Europe and Russia's first service provider of 3G global system for mobile communications (GSM).

The Cisco CRS-1 platform was unveiled in May 2004 as a new class of routing system designed to deliver continuous system operation, service flexibility and extended system longevity to service providers. Designed to accommodate the acceleration of video, voice and data traffic on IP NGNs, the Cisco CRS-1 is the first router to scale to more than 90 terabits of bandwidth capacity. It helps enable reliable, large-scale network delivery of high-bandwidth applications, including video on demand, online gaming, multimedia content distribution, real-time interactive services and many others.

Facts:

-- The Cisco CRS-1 platform has been deployed by more than 300 customers in more than 40 countries on all continents except Antarctica.

-- Driven by a greater convergence of networks and applications to facilitate the delivery of video, voice and data services, total worldwide cumulative shipments of this platform have reached more than 3,200. That figure includes 250 multi-chassis configurations at more than 25 service providers. MegaFon is the first service provider in Russia to deploy a multi-chassis CRS-1 platform.

The total current capacity of all Cisco CRS-1 units shipped to date is estimated at 2,919 terabits per second or nearly three petabits-per-second. This capacity is equivalent to that of: -- More than 25,000 users downloading a 2.5-hour high-definition movie in one second.


-- Hosting 250 million simultaneous meetings on a Cisco TelePresence(TM) system. Based on an average of 12 megabits per second required for a Cisco TelePresence System 3000 and considering that each session can accommodate 12 people, the deployed current capacity of the Cisco CRS-1 would be enough to accommodate live Cisco TelePresence sessions with the entire combined populations of China, the European Union, the United States, Russia, Brazil, Saudi Arabia, Japan, Indonesia and Mexico -- (that is, nearly half of the world's population) -- at the same time.



-- Publicly announced Cisco CRS-1 customers to date include AT&T, BT, Cable & Wireless, Comcast, China Telecom (ChinaNet), China Education and Research Network (CERNET), Czech National Research Network (CESNET2), Deutsche Telekom, FairPoint Communications, Free (Iliad Group), Kabel Deutschland, Kazakh Telecom, Korea Telecom, Magyar Telekom, MTS Allstream, MTN, National Institute of Informatics' SuperSINET research network in Japan, Netia, Neuf Cegetel, National LambdaRail, nTelos, Pittsburgh SuperComputing Center (PSC), RAIRomtelecom, SaskTel, Savvis Communications, Sify, Softbank Yahoo! BB, Sprint, Swisscom, Shanghai Telecom, Strato Medien, TeliaSonera, Terremark, Telstra, Verizon Wireless, VTR and XO Communications.

Quotes:

-- "MegaFon is innovative in our approach to growing our customer base and improving our mobile services," said Sergei Soldatenkov, chief executive officer, MegaFon. "We have found that the multi-chassis Cisco CRS-1 platform, with highly secure domain routing, serves as the foundation of our Internet Protocol next-generation network. This gives us confidence in our ability to scale to meet increased traffic and quality demands."

-- "When we introduced the Cisco CRS-1, most industry observers believed we over-engineered a routing platform and made it too powerful for the needs of service providers," said Tony Bates, Cisco senior vice president and general manager, service provider group, and one of the lead developers of the Cisco CRS-1. "Now, no one disputes that the Cisco CRS-1 has been essential in allowing service providers to complete the move from the analog age to the digital age, from the era of the phone to the era of the Internet."

-- Bates added, "Cisco realized early on that Internet-based networks were going to be the platforms of choice to deliver communication, information and entertainment to consumers and businesses worldwide. The Cisco CRS-1's continuing success is evidence that our vision, strategy and execution were all in line with the evolution of the market and the needs of service providers."

-- "Rising demand for broadband, video and mobility continues to propel
Cisco CRS-1 deployments," Bates said. "The same trends that are driving the transformation toward 4G networks are also driving demand for the Cisco ASR 9000 Series Aggregation Services Router, which does for the edge what the Cisco CRS-1 does for the core."


Supporting Resources:


-- Cisco Web Site
-- Cisco Service Provider
-- Cisco CRS-1


Technorati Tags:
Cisco, Carrier Routing System-1, CRS-1, Internet
Protocol Next-Generation Network, IP NGN, Tony Bates, Cisco ASR 9000,
MegaFon

About Cisco
Cisco (NASDAQ: CSCO) is the worldwide leader in networking
that transforms how people connect, communicate and collaborate.
Information about Cisco can be found at http://www.cisco.com. For ongoing news, please go to http://newsroom.cisco.com.

Cisco, the Cisco logo, Cisco Systems, and Cisco TelePresence are
registered trademarks or trademarks of Cisco Systems, Inc. and/or its
affiliates in the United States and certain other countries. All other
trademarks mentioned in this document are the property of their
respective owners. The use of the word partner does not imply a
partnership relationship between Cisco and any other company. This
document is Cisco Public Information.

For direct RSS Feeds of all Cisco news, please visit "News@Cisco" at the
following link:

http://newsroom.cisco.com/dlls/rss.htmlImage Available:
http://www2.marketwire.com/mw/frame_mw?attachid=990074

Image Available: http://www2.marketwire.com/mw/frame_mw?attachid=990071


Cisco Press Contact:
Kevin Petschow
Cisco
(773) 444.5106
kpetscho@cisco.com

Industry Analyst Contact:
Carter Cromwell
Cisco
(408) 526.6914
ccromwel@cisco.com

Investor Relations Contact:
Matt Tractenberg
Cisco
(408) 525.3170
matthew2@cisco.com

Copyright 2009, Market Wire, All rights reserved.

Monday, July 20, 2009

Top 10 Web Attack Vectors in Second Half of 2008

http://securitylabs.websense.com/content/Assets/WSL_ReportQ3Q4FNL.PDF

As Internet users increase, the Web attack vector continues to grow. Web servers are increasingly compromised through persistent cross-site scripting (XSS) and SQL injection as well as DNS cache- poisoning attacks. The Web Application Security Consortium reports that 97 percent of sites it studied continue to be plagued with significant vulnerabilities.
Below are the top ten Web attack vectors over the last six months. Browser vulnerabilities, SQL injection attacks and the increase of social networking vulnerabilities rounded out the top three vectors. This list remains relatively consistent with the previous top-ten Web attack vector list cited
during the first half of 2008.

1. Browser vulnerabilities
2. Rogue antivirus/social engineering
3. SQL injection
4. Malicious Web 2.0 components (e.g. Facebook applications, third-party widgets and gadgets,
banner ads)
5. Adobe Flash vulnerabilities
6. DNS Cache Poisoning and DNS Zone file hijacking
7. ActiveX vulnerabilities
8. RealPlayer vulnerabilities
9. Apple QuickTime vulnerabilities
10. Adobe Acrobat Reader PDF vulnerabilities


Learn How To Hack

Learn How To Hack



Browser vulnerabilities continued to plague unsuspecting users. Opera version 9.5.1 enabled attackers to steal arbitrary samples of data in memory from desktops through specially crafted JavaScript code while vulnerabilities in Firefox provided attackers additional opportunities for spoofing by exploiting alternate names on self-signed certificates.

In August 2008, Digg, MSNBC, Newsweek, and MSN Norway were hit by a series of malicious third-party banner ads, which led visitors to rogue security software sites and hijacked the clipboards of visitors.

One of the vulnerabilities exploited was an integer overflow in Adobe Flash (CVE-2007-0071). That same month, Websense Security Labs discovered that a major Chinese ISP, China Netcom (CNC), had its DNS cache poisoned. Unsuspecting customers were redirected to a malicious site when the hostname in a URL was mistyped.

Thursday, July 16, 2009

US Ignored Warnings of Cyber Attack

Aggregated from: http://www.defensetech.org/archives/cat_cyberwarfare.html




Advance information did not prompt a response.

The U.S. Government now admits they did not properly handle the situation. Sources have revealed that the South Korean government knew in advance that the distributed denial of service (DDoS) attacks that hit multiple web sites of major institutions in South Korea had begun earlier in the United States.

Late last week South Korea's intelligence agency briefed its lawmakers on circumstantial and technical evidence behind their belief that North Korea was behind the recent cyber attacks. Other intelligence sources went as far as to state that Kim Chong Un, the third son of North Korean dictator Kim Jong Il, was the mastermind of the cyber attacks that have hit government computers in the United States, South Korea and other some 14 other countries.

Foreign intelligence sources have also reported that the North Korean government sent a cyber contingent of approximately a dozen people across the northern border into China to conduct some of the operations and that Kim Chong Un actually was in commanded of that unit. Also sources have speculated that North Korean Research and Development Unit (110 or 101) and Cyber Warfare Unit 121 were the primary military units involved in the planning and execution of the DDoS style cyber attack. At least one Republican lawmaker urged President Obama to take retaliatory action (cyber attacks) against North Korea for the cyber attacks launched last week.

Learn How To Hack

Learn How To Hack


Given the extremely limited telecommunication infrastructure (estimated 1.18 million phone lines) and the limited Internet connectivity (given the less than 80,000 broadband connections) a cyber attack would be next to useless. After studying and researching the cyber attacks the following observations are offered.

1. The current U.S. defenses against cyber attack are woefully inadequate against even moderate level attacks as we have just experienced.

2. The fact that these attacks were well-coordinated, lasted as long as they did and were able to bring down a number of sites says more about the state of our defenses than the moderate rated offensive cyber capabilities of North Korea.

3. This clearly shows the need for the international agreement for cyber attack investigation cooperation that has been called for by many cyber warfare experts including me. These attacks were routed/launched through compromised computers in 16 countries.

4. Reports that the Department of Defense was not alerted to the attacks and found out through the media indicate that better coordination between DOD, DHS, DOJ and other government organizations as well as the private sector is critical in times of cyber attack and therefore must be improved and maintained.

5. There are unconfirmed reports for typically reliable sources that a South Korean intelligence agency has obtained documents ordering North Korean army units to start the cyber attack. If true, this could be the smoking gun! Once verified, that would open the way for retaliatory action.

-- Kevin Coleman

Saturday, July 11, 2009

Link for Defense Tech's Cyber-Warfare Archives





Learn How To Hack

Learn How To Hack


Ironically, it is the most technologically advanced country in the world that lacks a coherent national cyberdefense-

Where Is Our Cyber Defense?

By Alexandra Petri

The prolonged assault on American and South Korean websites that began July 4 shows why President Obama declared cyber security a priority of his administration. But it also highlights that, so far, we don’t have a coherent national cyber defense.

Learn How To Hack

Learn How To Hack




The attacks this past weekend targeted a wide array of sites within the public and private sector, from the National Security Agency to NASDAQ to Washington Post Digital. But this is no isolated incident. Literally millions of attacks occur on U.S. systems every day. The past several years have seen a spike in online attacks on government agency sites -- from 5,503 in fiscal year 2006 to 16,843 in 2008. The private sector, too, is continually under attack, with 280 million sets of data compromised last year alone. What is noteworthy about the attacks of the past week is how organized and effective they were -- some sites, such as that of the Department of Transportation, experienced 24-hour outages.

The government is doing something. Currently, the Department of Homeland Security is responsible for securing dot-gov sites and the Department of Defense handles dot-mil, both of which were targeted in the recent assault. And Defense Secretary Gates announced last month the creation of a “cyber command” to handle the Defense Department’s side, to be helmed by the director of the National Security Agency.

But as our defense grows, we need to make sure that whatever system develops is one that respects privacy. Like real war, cyber warfare has a tendency to take civilian casualties, and as the battle wages on, any hard lines between public and private threats will be easy to blur. As happened this weekend, the same attackers can target public and private sites. Collaboration between government and private cyber defenders to anticipate and thwart attacks is key to a successful defense, but there must be a system in place to protect privacy and make certain that the sharing goes both ways -- for instance, an anonymous, secure database where businesses and government entities can share information about ongoing threats and responses.

President Obama can start by appointing a cyber czar who will ensure our cyber defense doesn’t fall into the cracks between government agencies. And as we deal with threats that tread the line between public and private, we need someone in place to ensure transparency and accountability, too, so that it won’t infringe on the privacy we seek to protect.

By Alexandra Petri | July 8, 2009; 3:20 PM ET

Tuesday, July 7, 2009

George Ledin teaches students how to write viruses, and it makes computer-security software firms sick.

The Virus Professor

This Bug Man Is a Pest

By Adam B. Kushner | NEWSWEEK

In a windowless underground computer lab in California, young men are busy cooking up viruses, spam and other plagues of the computer age. Grant Joy runs a program that surreptitiously records every keystroke on his machine, including user names, passwords, and credit-card numbers. And Thomas Fynan floods a bulletin board with huge messages from fake users. Yet Joy and Fynan aren't hackers—they're students in a computer-security class at Sonoma State University. And their professor, George Ledin, has showed them how to penetrate even the best antivirus software.

The companies that make their living fighting viruses aren't happy about what's going on in Ledin's classroom. He has been likened to A.Q. Khan, the Pakistani scientist who sold nuclear technology to North Korea. Managers at some computer-security companies have even vowed not to hire Ledin's students. The computer establishment's scorn may be hyperbolic, but it's understandable. "Malware"—the all-purpose moniker for malicious computer code—is spreading at an exponential rate. A few years ago, security experts tracked about 5,000 new viruses every year. By the end of this year, they expect to see triple that number every week, with most designed for identity theft or spam, says George Kurtz, a senior vice president at antivirus software maker McAfee. "You've got a whole business model built up around malware," he says.

Ledin insists that his students mean no harm, and can't cause any because they work in the computer equivalent of biohazard suits: closed networks from which viruses can't escape. Rather, he's trying to teach students to think like hackers so they can devise antidotes. "Unlike biological viruses, computer viruses are written by a programmer. We want to get into the mindset: how do people learn how to do this?" says Ledin, who was born to Russian parents in Venezuela and trained as a biologist before coming to the United States and getting into computer science. "You can't really have a defense plan if you don't know what the other guy's offense is," says Lincoln Peters, a former Ledin student who now consults for a government defense agency.

That doesn't mean Ledin isn't trying to create a little mischief. His syllabus is partly a veiled attack on McAfee, Symantec and their ilk, whose $100 consumer products he sees as mostly useless. If college students can beat these antivirus programs, he argues, what good are they for the people and businesses spending nearly $5 billion a year on them? Antivirus software makers say Ledin's critique is misleading, and that they are a step ahead of him—and the hackers. "We've changed the game, and viruses have changed in recent years because of the protection we're putting into place," says Zulfikar Ramzan, the technical director of Symantec's security team.

Still, beneath Ledin's critique lies a powerful polemic. Ledin compares the companies' hold over antivirus technology (under the Digital Millennium Copyright Act of 1998, the companies' codes are kept secret) to cryptography decades ago, when the new science of scrambling data was largely controlled by the National Security Agency. Slowly, the government opened the field to universities and companies, and now there are thousands of minds producing encryption that is orders of magnitude more complex than code from just a decade ago. That's why you can safely transmit your credit-card numbers online. "Why should we shy away from learning something that is important to everyone?," Ledin asks. "Yes, you could inflict some damage on society, but you could inflict damage with chemistry and physics, too." He hopes one day to share antivirus techniques. But that would require infrastructure and financial support, which the federal government so far has declined to give. Until then, Ledin will have to live with his reputation as the guy who gave away the secrets to the Internet's bomb.



Learn How To Hack

Learn How To Hack