News

America’s Department of Defense has released its annual report on China’s military capabilities. The report states that an essential element of China’s defense planning includes electronic warfare and information dominance. The report states that China’s defense industry has benefited from integration with its expanding civilian economy and science and technology sectors, particularly sectors with access to foreign technology. Examples of foreign technologies that China seeks to (and has) acquired include: advanced aviation and aerospace (hot section technologies, avionics and flight controls), source code, traveling wave tubes, night vision devices, monolithic microwave integrated circuits, and information and cyber technologies.

How will China gain these technologies?  The report goes on to state that “the PLA continues to decrease its reliance on foreign weapons acquisitions in more capability areas as China’s defense-industrial and research bases mature. However, the PLA still looks to foreign assistance to fill some critical near-term capability gaps. China continues to leverage foreign investments, commercial joint ventures, academic exchanges, the experience of repatriated Chinese students and researchers, and state-sponsored industrial and technical espionage to increase the level of technologies and expertise available to support military research, development, and acquisition.”

In other words, China has plans to continue its recent dominance as a major espionage factory.  American companies that are invested in technology should take immediate steps to protect their critical information technology by implementing robust cyber security protocols, conducting vulnerability assessments on key areas for information loss, and consider screening to protect themselves from the trusted insider.

See me speak at CEIC 2013 in Orlando on Monday, May 20 at 3:30.  I’ll be speaking about Cyber espionage and the threat to our national infrastructure: How the World will End: The Spy is in the Cybersphere.

CEIC is one of the leading conference for cyber security.  I was pleased to provide the keynote in 2011 and am honored to have been asked back to provide a more focused training session.

For more information, or to register go to: http://www.ceicconference.com/

Here is my session description:

Threats to cyberspace pose one of the most serious economic and national security challenges of the 21st century for the United States and our allies. The growing connectivity between information systems, the internet, and other infrastructures creates opportunity for attackers to disrupt telecommunications, electrical power, energy pipelines, financial networks, and other critical infrastructures. The concern has gone beyond spyware on your personal PC. We now have to be concerned about theft of IP, theft of our secrets, even the theft of our very identities. Worse, we have to be concerned that a cyber terrorist or state enemy may figure out how to turn off our lights and send us back to the dark ages. We are moving toward the dark side of the communications super highway. We are beyond malicious theft of information. I predict that in the next five years we will see a number of attacks spreading malicious information – serving up everything from political unrest to electronic infrastructure destruction. The Internet is not a safe environment. It is a frontier. We are all gunslingers in the old American west, hoping not to step on a rattlesnake. My topic investigates the recent trends in cyber security, the treats to the individual user, the business bottom line, and the American way of life.

Mitigating risk through proper cyber security practices is critical to protecting your company from liability – including plaintiff’s class action lawsuits.

According to a KPMG study, over the last 5 years hackers accessed 681 million records.  The last two years have shown a 40% increase in the number of publicly disclosed data breaches. The Poneman Institute recently found that the mean annual cost of cybercrime in 2012 was $8.9 million per company and companies experience an average of 1.8 cyber attacks per week.  According to US Investigators, China has stolen terabytes of sensitive data – from usernames and passwords for State Department computers to designs for multi-billion dollar weapons systems – from a variety of United States companies, agencies and individuals.  The threat is not only external.  In a recent study, 60% of employees admitted to taking data of one sort or another from their employers.

To add insult to injury, companies are susceptible to class-action litigation, and may pay an average settlement of $2,500 per plaintiff.  Attorney’s fees may average more than $1 million.  Clearly the high cost of a data breach suggests that a proactive approach to cyber security is not only critical, but is part of best business practices.

The Internet grew from a network of researchers to a global nervous system because practically anyone could access it from anywhere in the world.  The Internet has brought about a golden age of communication; information sharing and virtual communication has occurred between cultures that may have never crossed paths.  It made a very large world very small.  But the Internet is not a safe environment.  It is a frontier.

In the face of both increased data breach-related litigation, and pending government regulation, companies and individuals should take a very serious look at their cyber security practices.

If you’d like to discuss or need some help understanding how to proceed, shoot me an email at eoneill@georgetowngroup.com.

Are your executives and managers cognizant of espionage threats?

This week a U.S. defense contractor with Top Secret security clearance was arrested on charges of passing national defense secrets, including classified information about nuclear weapons, to a Chinese woman with whom he was romantically involved. The 59-year-old contractor met the 27-year-old Chinese national in Hawaii during a conference on international military defense issues and began an 18 month affair where he allegedly passed national defense secrets to her on multiple occasions, including classified information about nuclear weapons and the planned deployment of U.S. strategic nuclear systems.

The fact of the matter is that beautiful Chinese women are being enlisted as spies.  In the last few years a number of breaches of security in Western countries have occurred through the Honey Trap – a long standing spy method where an attractive woman or man targets a “mark” who has access to desired information, and seduces them to either trick them into providing the information voluntarily, or blackmails them into handing it over.  In recent years, the Chinese have used this espionage method to compromise security information in the United States, the United Kingdom, France and Canada, to name a few.

Counterespionage agencies have provided guidance on identifying and resisting the Honey Trap.

In 2008, MI5’s Center for the Protection of National Infrastructure distributed a fourteen page document titled: “The Threat from Chinese Espionage,” to hundreds of British banks and other financial institutions and businesses. The document stated that China posed “one of the most significant espionage threats” to Britain.  The document identified Chinese honey Traps as a major threat to traveling executives dealing with China: “Chinese intelligence services have also been known to exploit vulnerabilities such as sexual relationships and illegal activities to pressurize individuals to cooperate with them,” it warned. “Hotel rooms in major Chinese cities such as Beijing and Shanghai which have been frequented by foreigners are likely to be bugged. Hotel rooms have been searched while the occupants are out of the room.”
China is not only targeting the trousers of Western government officials.  Numerous business executives have fallen prey to the honey trap – often at the cost of professional reputations and loss of critical intellectual property.

Because China is not the only foreign intelligence service out there to use the Honey trap – it is critical that Western businesses (A.K.A. “targets”) train their executives to spot the espionage signals and resist the urge to bed a spy.

Here is how it works:  A solo business person is approached by an attractive person who seeks to cultivate a personal relationship, often using lavish hospitality, flattery and flirtation.  There will generally be some cover story in the social engineering approach to reeling in the target.  For example, younger, beautiful women might approach an older man sitting alone at a bar during a technology conference.  She learns his name and his employer from the name badge most conferences require personnel to wear, and perhaps she attended a breakout lecture he gave on a technology that her company or foreign intelligence service is targeting.

Often the Honey Trap is a “long game” where the spy might seduce the target that night, and then reel him in using flirtation, sex and further meetings.  If he is married, she will record the sexual interactions.  At some point, she will ask the target for a favor, seeking to use the emotional connection and trust she has fostered to convince him that she will not use the information to harm him or his business, only to “help me get a promotion” or some other story.  At first, the requests will be for small things that are not significant security breaches, but would cause the target trouble if it became known that he was passing the information.  As time progresses, the spy will ask for more critical and sensitive information.   If the target is completely enamored, he might continue providing the information.  In the event the target has a moment of conscience, the Honey Trap can then turn to blackmail –using both the affair and the threat of exposure for information already turned over – to hook the target as a source for further information.

It is critical that companies be aware of the Honey Trap threat and train their executives and managers in simple counter espionage techniques.  Without this training, your intellectual property and financial stability may be at risk.  The Georgetown Group provides on-site training regarding how to spot the spy.  If you’d like more information, shoot me an email at eoneill@georgetowngroup.com.