[ISN] The spies in the next cube

[InfoSec News]

http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2005/04/25/BUGGLCDPUJ1.DTL

Birgitta Forsberg
Chronicle Staff Writer
April 25, 2005

When Shin-Guo Tsai gave notice of resignation from his job as a design
engineer at the Fremont semiconductor company Volterra on Feb. 15, he
allegedly told his manager that he was returning to Taiwan to get
married and that he didn't have a job lined up.

The story was a smoke screen, according to the FBI. Tsai, the agency
alleges, had downloaded information on Volterra products. The FBI
accuses him of using a private e-mail account to send some of the
information to a Taiwanese startup company that was recruiting him for
a job.

When Tsai announced his resignation, several co-workers told a manager
that he had been downloading company information.

On Feb. 25, Volterra's vice president of design engineering, David
Lidsky, and the FBI confronted Tsai, who allegedly admitted he had
sent proprietary information to the Taiwanese firm. Two days later,
FBI agents turned up at Tsai's home in San Jose late at night and
arrested him. He is out on bail.

Tsai's lawyer, John Robertson of Los Angeles, said his client's
actions did not involve industrial espionage.

"Our intention is to plead not guilty," Robertson said. "We plan to
contest certain of the allegations."

Cases like this are far from unusual. Experts say U.S. companies are
losing billions of dollars as a result of domestic and international
espionage.

When it comes to cross-border theft of trade secrets, there are more
foreigners spying on U.S. corporations than ever, according to Todd
Davis, an FBI supervisor in Sacramento.

"Corporate America ought to be darned worried," Davis said. "If you
are a major corporation with very sensitive technology, you have been
targeted. Somebody is spying on you right now."

When corporate spies come to America, they tend to flock to Silicon
Valley.

"We have prosecuted more theft of trade secret cases than any other
district in the country," said Christopher Sonderby, chief of the
Computer Hacking and Intellectual Property Unit of the U.S. attorney's
office in San Jose.

His computer hacking unit was founded as the country's first such
entity in February 2000. There are now 18 such units in U.S.  
attorneys' offices nationwide.

"Silicon Valley has more than 7,000 technology-based companies. It is
home to the largest concentration of technology expertise in the world
... and there is a substantial temptation for some businesses and
companies to acquire this technology by illegal means," he said.

Many thefts kept quiet

Davis estimates there have been about 20 to 30 cases in the past 10
years, including both domestic and cross-border industrial espionage
incidents. A lot of cases, however, are never reported because many
companies handle the incidents quietly to avoid publicity.

The FBI has a list of about 20 countries that actively spy on U.S.  
companies, according to corporate security consultant John Case, who
does not want to name any countries.

Davis acknowledges there is such a list, but he declined to mention
which countries are on it.

"Certain countries are doing their darnedest to gain economic
superiority, and we are the No. 1 target for all corporate and
international spying," Davis said.

He did mention China, without confirming that it is on the list.

"PRC, the People's Republic of China, has been accused of setting up
small firms" that act as front companies, he said.

In a written statement, the Chinese consulate in San Francisco denied
that the country engages in industrial espionage:

"A few people in the United States stiffly hold on to the Cold War
mentality and drum up the so-called 'China Threat Theory' by
fabricating stories about China stealing technologies from the United
States. All these allegations are baseless with ulterior motives.  
Their purpose is to use this to denigrate China and harm Sino-U.S.  
relations. Facts have proven that such attempts are doomed to fail."

Anne Rogers, vice president of marketing at the Information Systems
Security Association, noted that China is far from the only country
that has been implicated in corporate espionage.

"Some years ago, one of our biggest problems was with the French," she
said.

The French Consulate in San Francisco said its policy is not to
comment on industrial espionage matters.

Many of those charged with corporate espionage allegedly e-mailed
stolen information or stored it on their home computers, as if they
hadn't considered the possibility of detection.

"The Internet facilitates the commission of crimes, but it also
facilitates their investigation and prosecution by creating a robust
trail of electronic evidence," Sonderby said.

Some corporate spies apparently suffer from hubris.

"White-collar crooks have always thought they were smarter than
everyone else. But they'll make a little mistake somewhere, and you
can put a case together," said John Smith, a high-technology
investigator and security consultant.

Many companies take elaborate measures to protect the security of
their trade secrets. For example, Intel, the world's largest
chipmaker, requires employees to sign forms explaining procedures for
handling proprietary information. The company insists spying is not a
problem for it.

"This has not been an issue for us in recent years," spokesman Chuck
Mulloy said. "It is a testament to the controls we have in place,
which we have developed over many years. Companies that are immature
have fewer controls in place."

Pizza man not to blame

Experts say that company insiders are a much bigger problem than
someone hacking into the system from the outside.

"Seventy-five to 85 percent of all theft per se is done by an
insider," said Julie Snyder, president of the Silicon Valley chapter
of the International High Technology Crime Investigation Association.

Smith agrees.

"In all the cases I am aware of, a trade secret theft usually involves
an employee or a contractor or a person who has a legitimate right to
be on the company's premises. They are operating inside the company's
network firewalls, " Smith said.

Among the signals that should raise a red flag, Davis said, are
employees staying late at night, tours and delegations in which
visitors strike up a friendship with insiders, and outsiders who are
found in sensitive areas of a facility, such as network
administration.

"It will not be the pizza deliverer," Davis said. "It's real
engineers, and they infiltrate U.S. technology companies,
pharmaceutical companies and weapons contractors."

International travel raises special problems, experts say.

"Corporate employees who have foreign contacts and make frequent trips
overseas should be closely scrutinized," Davis said. "Some employees
think they can have safe conversations in their hotel room abroad.  
They are not aware that the hotel room is a target for the foreign
government."

Employees should be briefed before attending a symposium, whether at
home or abroad, to warn them of the hazards of disclosing information,
then debriefed when they come back, said Case, the corporate security
consultant.

"Ask them if someone tried to talk to them and what that person
asked," he said.

Background checks key

Most experts mention background checks as key. Not hiring the
potential spy in the first place is the absolute best way to keep out
of trouble.

"Ask their former employer if the persons are re-hirable. If they are
not re-hirable, that is a big clue," said Snyder said of the High
Technology Crime Investigation Association.

The ultimate question is whether trade secrets can truly be protected.  
It's an issue that security pros debate with a fervor that is almost
theological.

"Sure you can if you don't try to classify too much information as
secret and allow too many people in on the secret," Case said. "The
classical example is Coca-Cola with only a handful of people who know
the formula."

But Doron Ben-Atar, a history professor at Fordham University in New
York, disagrees.

"To protect secrets is a human fantasy. People can't protect secrets,"  
he said. "The U.S. was founded on piracy. Every branch of American
industry was pirated."

Ben-Atar argues that protecting a corporation's intellectual property
should be overridden by other concerns.

"The Third World can't let its people pay $20,700 for a drug against
leukemia when they can get it for $2,700," he said. "We shouldn't be
so self- righteous sanctimonious about it."