Are your employees secretly stealing trade secrets for a foreign government?
The threat is not as far-fetched as you might think, according to US national security officials. At RSA, the feds warned American businesses to be on guard, specifically against Chinese government attempts to use their own employees to steal company trade secrets.
“We see [trade secret theft] more and more manifesting itself from the insider threat,” said John Demers, US Assistant Attorney General for National Security, during a panel at the cybersecurity conference on Tuesday.
Increasingly, the US government is getting vocal in blaming China for hacking into Americans companies to both steal intellectual property and people’s personal data. Just this month, the Justice Department indicted four Chinese military officers for the 2017 Equifax breach, which looted information on 145 million Americans.
But at RSA, US officials came to remind the public that intellectual property theft can also occur from the “insider threat,” or when a company employee goes rogue and pilfers confidential information. It's an attack vector that China has been successfully exploiting, they went on to claim.
From left to right, William Evanina, John Demers, and Major General Thomas Murphy
“It’s not a spy versus spy game anymore,” said William Evanina, Director of the National Counterintelligence and Security Center, during the panel. “This is the businessman, the engineer, the scientist, the student, the professor.”
Other foreign governments such as Russia, Iran, and North Korea also want to obtain US trade secrets, specifically on military technologies. However, federal officials say China’s appetite for American IP goes beyond defense; the country wants to become the dominant provider across 10 different commercial sectors, including agriculture, high-speed rail, and electric vehicles.
“Eighty percent of our economic espionage cases go back to China,” Demers added. “That’s why we’re talking about China. They are the main actor in this space.”
Indeed, one of the biggest cases has involved Chinese vendor Huawei, which the US recently accused of rewarding company employees with bonuses to steal trade secrets from competitors. However, other cases have involved US-based academics who may have been trying to obtain sensitive research for the benefit of Beijing. Last month, the FBI arrested a Harvard University scientist over his ties to a Chinese government program that’s been recruiting foreign scientists.
Despite US attempts to fight back, China’s suspected IP theft has been going on for years now, and is threatening to undermine the US’s competitive edge in both the commercial sector and in military defense technologies. “Every time China and others steal our technology, that [edge] whittles away. Look at their newest airlifter. Look at their newest fighter. They should look very familiar to you. That is not a coincidence,” said Major General Thomas Murphy, Director of the Office of the Secretary of Defense.
To stop the intellectual property theft, the feds are urging US companies to protect against insider threats, which can be spurred on both by foreign governments and domestic rivals, they noted. But the answer isn’t to profile employees or stop hiring staffers from certain countries, Demers said. He suggests companies develop internal systems that can track when employees are accessing sensitive company files, which can help pinpoint when a IP theft might be occurring. For example, if a soon-to-be ex-staffer is suddenly accessing a huge trove of a confidential documents, the system should immediately flag the download to company administrators.
“You are not profiling people. Because you are looking for online behaviors. You’re looking for access behaviors.” Demers added. “There are many talented people of good faith from China here working. Hire them all. But protect yourself and all your employees by having a mechanism in place.”
Further Reading
- Nest Cameras Stopped Working for 16 Hours
- How Google Is Stopping Malicious Office Docs From Targeting Gmail Users
- Majority of IoT Traffic on Corporate Networks Is Insecure, Report Finds
- Election War Games: How I Tried to Undermine Democracy
- More in Security
More Security Reviews
- Private Internet Access VPN (for macOS)
- NordPass Premium
- Qustodio
- Virtru Email Protection for Gmail
- ShieldApps Cyber Privacy Suite