Security Supervision and Management

Theory and Practice of Asset Protection

IFPO, Sandi J. Davies,Brion P. Gilbride,Chris A. Hertig

• Publisher: Butterworth-Heinemann
• Year: 2015
• ISBN:
  9780128004890
• Edition: 4
• Topic: Commerce
• Subtopic: Gestion de l'information

Security Supervision and Management, Fourth Edition, fills the basic training needs for security professionals who want to move into supervisory or managerial positions. Covering everything needed from how to work with today's generation security force employees to the latest advances in the security industry, Security Supervision and Management, Fourth Edition, shows security officers how to become a more efficient and well-rounded security professional. Security Supervision and Management, Fourth Edition, is also the only text needed to prepare for the Certified in Security Supervision and Management (CSSM) designation offered by International Foundation for Protection Officers (IFPO).

The IFPO also publishes The Professional Protection Officer: Practical Security Strategies and Emerging Trends, now in its 8th edition.

• Core text for completing the Security Supervision and Management Program/Certified in Security Supervision and Management (CSSM) designation offered by IFPO
• Contributions from more than 50 experienced security professionals in a single volume
• Completely updated to reflect the latest procedural and technological changes in the security industry
• Conforms to ANSI/ASIS standards

Unit VII

Current Issues in Security

Outline

37. Espionage: A Primer

38. Cyber Security

39. Workplace Violence: Prevention, Mitigation, Response, and Recovery

40. An Overview of Security Risk Management Concepts

41. Standards, Guidelines, and Regulation for the Security Industry

42. The Relationship Between Corporate Security and Information Technology Professionals

43. International Perspectives on Security in the Twenty-First Century

37

Espionage

A Primer

Brion P. Gilbride

Abstract

Espionage, in essence, is stealing secrets. Secrets can be in nearly any form—a document, an email, computer files, recorded conversations, text messages, etc. Who keeps secrets? Governments do, as do companies and people. The original recipe for Kentucky Fried Chicken is a secret. The schematics for a new machine may be a secret. Negotiations for a merger between two companies, plans for a brand-new aircraft carrier, and a list of spies with official cover working in Turkmenistan are all secrets. There are thousands of examples. If another entity—either a corporation or even a government—got its hands on one of these secrets, consider what the impact would be. A competitor’s product may beat your employer’s product to market, costing millions in revenues. A government may begin feeding misinformation to your government’s spies because it now knows who they are. Two companies may not merge; instead, your company fails while the other survives. The outcomes are legion, and most of them are bad.

Keywords

Encryption; Espionage; Information; Sabotage; Safety; Secrets; Social Engineering; Stealing; Trade Secrets; Tradecraft

Gentlemen do not read each other’s mail.

Henry L. Stimson, US Secretary of State, 1929

When you think of espionage, what is the first thing that comes to mind? Perhaps you imagine shadowy government agents trading briefcases full of secrets in a dark alley, the CIA and KGB, or James Bond/007. This is what most people, regardless of where they are in the world, understand about the business of espionage. The reality is that governments do collect all manner of information on the operations and activities of other countries, both friend and foe. Also, part of this reality is that businesses and individuals collect information on each other—whether for business advantage, revenge, protection, or any other reason.

Espionage, in essence, is stealing secrets. Secrets can be in nearly any form—a document, an email, computer files, recorded conversations, text messages, etc. Who keeps secrets? Governments do, as do companies and people. The original recipe for Kentucky Fried Chicken is a secret. The schematics for a new machine may be a secret. Negotiations for a merger between two companies, plans for a brand-new aircraft carrier, and a list of spies with official cover working in Turkmenistan, are all secrets. There are thousands of examples. If another entity—either a corporation or even a government—got its hands on one of these secrets, consider what the impact would be. A competitor’s product may beat your employer’s product to market, costing millions in revenue. A government may begin feeding misinformation to your government’s spies because it now knows who they are. Two companies may not merge; instead, your company fails while the other survives. The outcomes are legion, and most of them are bad.

Espionage in History

If the previous examples seem vague, there are plenty of real-life examples. In November 1778, General George Washington ordered that a spy ring be established to operate in New York City and supply information on British troops. The ring, called the Culver Spy Ring, operated until 1783. None of the members were ever caught. Methods used by the spy ring included pseudonyms, writing messages in invisible ink, and designing a numerical substitution system to identify people and places. During the ring’s 5 years, its successes included thwarting a British attack on Rhode Island in 1780, as well as the capture of British Major John Andre—the spy who had led the Americans to Benedict Arnold.¹

In the period after World War II, the Soviet Union was able to produce an atomic bomb years before anyone thought they could. They had help from several people; one was noted scientist Klaus Fuchs, who worked on the Manhattan Project. The scientists involved in the Manhattan Project developed the atomic bombs that were ultimately dropped on Nagasaki and Hiroshima, Japan at the end of the war. Fuchs passed along information on bomb design and assembly when he worked in the United States; when he moved to London, he passed along information on plans for a hydrogen bomb. To whom did he pass this information? The Soviet Union.² Fuchs was arrested in February 1950 and sentenced to 14 years in prison.

During the 1980s, an Iraqi scientist working on Saddam Hussein’s nuclear program used his memory to identify foreign recipients of a restricted report so that he could obtain copies of it for Iraqi use. In his book The Bomb in My Garden, Dr. Mahdi Obeidi described his search for a particular report on the design of an atomic weapon. He tracked down this report to a library at the University of Virginia. When Dr. Obeidi went to see it, he learned that he would need to complete paperwork and provide identification for security purposes. To avoid leaving anything incriminating behind, Dr. Obeidi protested that the paperwork would take time and asked if he could briefly peruse the report to confirm it was the particular report he was looking for. The university agreed, and Dr. Obeidi was given the report. In doing this, Dr. Obeidi had the paper in his possession long enough to review the list of people to whom copies were provided to at the time it was published. This list contained the name of an Italian professor of Dr. Obeidi’s acquaintance who may not have been subject to restrictions such as those placed by the University of Virginia. In this way, Dr. Obeidi was able to obtain a copy of the report without anyone in the United States knowing that he did so. In the United States, his attempt to access the report at the University of Virginia likely would have been reported to the authorities.³

Espionage in the Twenty-First Century

As demonstrated, different varieties of espionage have been used over the years. As the amount of information amassed by people and the methods of storing or transporting all of that data have exploded, the threats generated by espionage have changed. Espionage cases from the twenty-first century demonstrate some of the differences. In June 2013, an Indian national living and working in the United States was arrested and charged with theft of trade secrets. This person allegedly downloaded 8000 files from Becton Dickinson’s computer servers for a disposable pen injector that the company was developing. The files were stored on external hard drives, thumb drives, and other storage devices.⁴ This case is currently pending.

On February 28, 2007 Hanjuan Jin, a naturalized US citizen of Chinese descent from Aurora, Illinois, was intercepted at Chicago O’Hare International Airport attempting to board a flight to China. In her possession were more than 1000 electronic and paper documents that were property of Motorola. During her trial in 2011, a number of facts came to light. Jin joined Motorola in 1998 and worked until taking a leave of absence in 2006. During this leave, Jin obtained a job with Sun Kaisens, a Chinese communications company with connections to the Chinese military. On February 15, 2007 Jin returned to the United States and resumed employment with Motorola on February 26. Jin made multiple visits to Motorola between February 26 and 27; during those visits, Jin downloaded hundreds of technical documents from Motorola’s servers and transported numerous hard-copy documents out of the facility. Among the materials seized from Jin on February 28 at O’Hare Airport were descriptions of specific Motorola product features, classified Chinese military documents, and $30,000 in cash. Jin was convicted on three counts of theft of trade secrets but was acquitted on three counts of economic espionage on behalf of China.⁵

On May 20, 2013, a man named Edward Snowden boarded a flight from Hawaii to Hong Kong. In his possession, or under his control at that time, were numerous files and documents containing classified information on US intelligence and diplomatic activities throughout the world. Snowden is believed to have obtained these items via his work with the US National Security Agency (NSA) as a contract employee. Prior to this work, Snowden had worked for the US Central Intelligence Agency from 2007 to 2009 as an information technology (IT) specialist, and before that for the NSA as a security guard.⁶ It was primarily his IT background that enabled him to find and then copy the materials he ultimately fled with. Among those materials were documents relating to NSA capabilities concerning the collection, recording, and analysis of international and domestic phone calls involving the United States.⁷

Sabotage

Espionage cannot be adequately covered without discussing its evil twin, sabotage. Sabotage occurs when an individual takes an action that interferes with normal business or government operations. Keep in mind that the action does not have to be physical, such as pouring sugar into the gasoline tank of a car to prevent the engine from working properly. It can be something simple, such as renaming an important computer file so that others cannot find it. Being able to commit sabotage requires many of the same elements that committing espionage requires—particularly, opportunity or access to items or systems that can be sabotaged....