Surveillance or Security?: The Risks Posed by New Wiretapping Technologies (29 page)

Japan's focus on consumer technologies has not stopped it from spying
on U.S. military technologies. Three Japanese companies, Nissan, Mitsubishi, and Ishikawajima-Harima Heavy Industries, bought stolen software
that had been developed for the Department of Defense's Strategic Defense
Initiative ("Star Wars"), hoping to employ it in civilian applications.35

As nations expanded their industrial bases and new industries developed, new targets for industrial espionage emerged. Currently, biotechnology and energy technologies are of particular interest. Research and
development of biologically tailored drugs may cost millions, but successful drugs can reap billions in profit. Taxol, a drug used to treat breast and
ovarian cancer, is one example.

Taxol originally came from the bark of a yew tree, but the tree is an
endangered species, and Bristol-Myers Squibb spent $15 million finding an
alternative process for culturing the drug. Profits from Taxol are now estimated to be a billion dollars a year for Bristol-Myers Squibb. In 1995-1996
the formula for producing Taxol was the target of theft by three employees
of Taiwan's Yuen Foong Paper Company.

During the 1980s and 1990s, France, Germany, Israel, Japan, and South
Korea were the main players in economic espionage against U.S. industry
among the U.S. allies.36 More recently, India, Indonesia, and Taiwan have
joined the action. But the most serious threats come from China and
Russia. China targets U.S. industrial, scientific, and technical work, while
Russia is more focused on military technology and energy technologies
(specifically gas and oil).37

In 1996 the FBI reported that "biotechnology, aerospace, telecommunications (including technology to build the Internet), computer software
and hardware, advanced transportation and engine technology, advanced
materials and coatings, including 'stealth' technologies, energy research,
defense and armaments technology, manufacturing processes, and semiconductors" are the targets of industrial espionage. In addition, information about business plans-including bidding, contracts, and strategy-is
targeted.38 In the United States, acquiring intelligence on competitors is
legal. Economic espionage is not. Even if actions are committed abroad,
U.S. companies attempting the same type of espionage on competitors
as was being done to them would be violating U.S. law. Meanwhile each
piece of technology stolen, each trade secret lifted, each marketing plan discovered, is costly to U.S. business, weakening the economy and U.S.
industry, and ultimately U.S. national security.

In 2003 the FBI estimated the cost to the U.S. economy of industrial
espionage at $200 billion.39 In point of fact, pinning down actual damages
is quite difficult. Many times the espionage occurs without being noticed.
Even when it is discovered, it is difficult to put a dollar figure on the
lost sales and increased costs incurred by a company that has to compete
differently as a result of the theft.40 Nonetheless there is no question that
the damage done to U.S. competitiveness as a result of economic espionage
is substantial.

Much of the industrial spying comes in the form of HUMINT, human
intelligence-corporate or government spies who visit U.S. plants and
laboratories posing as potential customers or partners, foreign graduate
students placed in specific U.S. university laboratories,41 and industry
funding for U.S. academic researchers that is tied to a commitment
that the research will be shared with the foreign funders first.42 Other forms
of penetration include the time-honored methods of spycraft:43 bribing
insiders for information, attending industrial meetings and chatting with
company employees, even going through trash.44 Then there is electronic
eavesdropping employed by U.S. allies; faxes are particularly fruitful sources
of information.

German intelligence shared the information gained with German industry,45 while French intelligence did so for French industry. The French not
only tapped phone lines, but were even alleged to have bugged first-class
airline seats and hotels in order to eavesdrop on U.S. business visitors.46
The Japanese government was believed to monitor all telecommunications
traffic from the Japan offices of U.S. corporations for the benefit of Japanese
corporations.47

The U.S. government response has generally been to stay above the fray
and press for level playing fields. In the process of targeting the Soviet
Union during the Cold War, information including proprietary data from
foreign companies fell into the hands of U.S. intelligence, but it appears
that the government did not use this information. With the end of the
Cold War, the gloves partially came off. U.S. intelligence, which had previously confined its interest to military and diplomatic affairs, now sought,
in the words of former CIA Director Stansfield Turner, to "redefine 'national
security' by assigning economic strength greater importance."" The CIA
embarked on economic espionage.49

This turned out to be a heavy-handed effort. It was not a perfect fit
for an agency more accustomed to narrowly defined missions than the open-ended ways of economic investigations. CIA agents doing industrial
spying in Germany and France were discovered and quite publicly
expelled.50 Explicit economic targeting died a quiet death, although indirect targeting continued.

Intelligence was sometimes gleaned through ECHELON, a collection and
analysis system jointly run by the United States, the United Kingdom,
Canada, Australia, and New Zealand. Although in use for many decades,
ECHELON seems to have come into public view in the late 1990s, first with
the 1996 publication of Nicky Hager's Secret Power: New Zealand's Role in
the International Spy Network, and then as a result of a 1999 European Union
report by investigative journalist Duncan Campbell.51 The report noted
that ECHELON targeted commercial communication channels; this fact
caught Europe's attention in a major way. With the Americans listening
in, the Europeans wanted to protect their proprietary business information,
and European governments relaxed their cryptographic export controls.
(In turn, six months later the United States relaxed its cryptographic export
controls.) But it appears that the United States was not using the proprietary
information it acquired in the same way the Europeans anticipated.

A close read of the Campbell report showed only two examples where
U.S. intelligence had actually shared business information outside the U.S.
government. Both were bribery cases: Thomson-CSF, a U.K. electronics and
defense contractor,52 which was alleged to have bribed members of a
Brazilian government selection panel in order to sell a $1.3 billion surveillance system for the Amazon rainforest, and Airbus, which had offered
bribes to Saudi officials. In the latter case, the information was passed to
a U.S. trade negotiator who had been pressing the Saudis to "buy American."
The Saudis bought their planes from Boeing and McDonnell Douglas.

While spy agencies of foreign nations stole trade secrets and proprietary
information and gave it to their nation's industries, it seems that U.S.
agencies did not. The intelligence garnered by U.S. agents went to U.S.
trade negotiators. Even then, only a particular type of information was
used. Former CIA Director James Woolsey told the Europeans, "We have
spied on you because you bribe ... you bribe a lot.... When we have
caught you at it, you might be interested, we haven't said a word to the
U.S. companies in the competition. Instead we go to the government
you're bribing and tell its officials that we don't take kindly to such corruption. They often respond by giving the most meritorious bid (sometimes American, sometimes not) all or part of the contract."53

The U.S. government policy of limiting the sharing of economic intelligence to information on unfair trade practices of other nations,54 but not sharing the fruits of intelligence with private companies, is unusual. In our
cynical age, many find it hard to believe that the U.S. government really
behaves this way. It is, of course, difficult to prove a negative, but there is
evidence to buttress this. Primary, of course, is the lack of any evidence to
the contrary. Further evidence takes the form of the 1996 Economic Espionage Act,55 which criminalizes theft of a trade secret if there is intent to
benefit a foreign government or related agency (§1831).56 It is notable that
few, if any, other nations criminalize economic espionage.57 Nine years
after the Woolsey statement, a 2009 National Research Council report
observed,

The United States has a long-standing policy not to use cyberattack or cyberexploitation to obtain economic advantage for private companies ... the economic domain
is one in which the operational policies of adversaries are markedly different from
those of the United States. That is, adversaries of the United States are widely
believed to conduct cyber-espionage for economic advantage-stealing trade secrets
and other information that might help them to gain competitive advantage in the
world marketplace and/or over U.S. firms ... the intelligence services of at least one
major nation-state were explicitly tasked with gathering intelligence for its potential
economic benefits. This asymmetry between U.S. and foreign policies regarding
cyberexploitation is notable."

Meanwhile, according to the FBI, almost a hundred nations are targeting
U.S. technologies, with China accounting for almost half the investigations
into export violations.59 Targets of foreign espionage are not so much the
"crown jewels"-the newest computer virtualization technology, the best
night-vision goggles-as dual-use and dated military technologies. The
techniques used in the last century, front companies, approaches by foreign
intelligence at industry conferences, foreign research labs located near U.S.
universities, spies within visiting delegations, remain the same, but espionage has become much simpler to arrange.

Instead of a foreign scientist having to visit a U.S. R&D facility, or
placing a foreign graduate student in a U.S. lab, the "visit" comes via the
network. This can happen in ways that are completely unnoticed. Such
espionage is cheaper and safer than traditional forms of snooping. It
should be no surprise that the Internet has become a major tool for economic espionage. The U.S. Department of Defense reported in 2008 that
the number of foreign contacts evaluated as suspicious was growing exponentially. A large cause was the ease of conducting such efforts via the
Internet.60 This form of spying is happening at a time when the Internet
is increasingly embedded in the production process. It is to that role of the
network that we now turn our attention.

7.2 Supply Chains in the Information-Based Economy

Supply chain is a fancy term to describe the systematic way of moving
products from the maker to the consumer. As such, supply chains are part
of human history and are older than the Silk Route and trading across the
Mediterranean in ancient times. A supply chain can be as simple as a
farmer bringing fruit to market and as complex as an automobile being
designed in Germany, with components produced in Japan, Taiwan, and
Singapore, assembled in Korea, and sold in the United States.61

Many pieces have to be in place for complex supply chains to function.
At each level of the chain there must be enough suppliers to deliver products to the next. Products at each level must be sufficiently customizable.
And delivery must be reliable. For a farmer delivering produce to the local
market, this is easy to manage; for a manufacturer building a car or a
computer, the links are more complicated.

The 451 different parts in the Apple iPod, for example, come from
China, Japan, Korea, the Philippines, and Taiwan.62 The hard drive is
manufactured by the Japanese firm Toshiba, which produces most of its
hard drives in the Philippines and China. The display module and panels
are made by the Korean company Samsung; the video/multiprocessor chip
comes from the U.S. firm Broadcom; the controller chip is from another
U.S. firm, PortalPlayer; and memory is provided by Samsung.63 Final assembly is done in Chinese factories operated by Taiwanese firms.64 The overall
concept and design of the iPod, as well as organization of the supply chain,
are handled by Apple in the United States.65 As such things go, the iPod is
a relatively simple device.

Modern supply-chain management requires information technology
(IT). While supply-chain complexity increased after World War II, in the
1950s it still relied on people, paper, and phones. The first customized
inventory management systems were introduced in the 1960s. By the
1980s, IT's ability to quickly aggregate and analyze massive amounts of
data made much accurate forecasting of business needs possible.

Wal-Mart was one of the first companies to tap into this. Every sale in
a Wal-Mart store is linked through a satellite-based communications system
to company headquarters. Sales information is fed into a database that
Wal-Mart's suppliers use to adjust their production.66 Wal-Mart has discovered, for example, that before hurricanes people stock up on beer and
afterward on easy-to-store, nonperishables like Pop-Tarts. The chain modifies store stocks according to storm forecasts.67 Other companies manage
stocks even more directly. The Italian clothing company Benetton does its own production. By tracking daily sales in the company stores, Benetton
nimbly adjusts manufacturing. Are pink turtlenecks selling, but not yellow?
Make more pink.68 Communication technologies allow a complex model
of production,69 with an ability to respond to customer demand almost
instantaneously.

Outsourcing is not limited to production. For example, U.S. clothing
retailers The Limited and The Gap not only outsource the manufacture of
the clothes they sell, they outsource the business processes behind the
manufacturing. Both companies use Li and Fung,70 a Hong Kong company
that exports goods and services, to manage the supply chains of their dispersed manufacturing base.71 Li and Fung manage schedules, including
inventory and just-in-time flow, through the supply chain. Modern communications technologies enable small clothing companies to compete
profitably with large firms.