Experts say that industrial espionage is now no different from competitive intelligence. Yet these used to be two separate activities, and the former was illegal.
Spying on other people's industrial secrets has become much easier today than it was 10–15 years ago — thanks to the very same IT. Is it possible to protect yourself from those who hunt for other people's secrets? Obozrevatel asked experts for their views.
BMW caught in industrial espionage
The French industrial group Bolloré recently accused the German carmaker BMW of trying to gain illegal access to the group's proprietary technologies behind its Autolib electric cars.
What is interesting in this case is how the information was gathered — hardly typical of the IT age. Autolib employees spotted two men who were driving an electric car rented from the company and trying to examine an Autolib charging station using high-tech equipment. The suspects were detained by the Paris gendarmerie.
BMW representatives soon admitted that the engineers detained in Paris worked for the German carmaker. At the same time, the company insisted there had been no espionage at all. It was, they said, merely a pan-European testing program, and the BMW engineers were studying how compatible public charging stations were with the Bavarian i3 electric car, due to go into production this autumn.
Notably, industrial espionage was first talked about in America in 1789, when the country's industrial revolution began. And it was "brought" there by a man named Slater, who founded a textile mill in Pawtucket, Rhode Island. Having worked as an apprentice in England, he memorized all the designs of a textile mill. Slater then secretly left England for the United States, where he used those designs to break England's textile monopoly.
Spy tricks on the internet
There are, however, plenty of ways to spy on competitors remotely. One could, of course, use agents, as BMW did. But the remote approach is still less costly. And it lets you "watch" every company that has a website (and which large company doesn't?).
So let's look at some of the spy tricks the internet has to offer.
- SEMrush lets you analyze competitors' websites, their traffic sources and the keywords they use to promote themselves on Google. With SEMrush you can estimate a website's traffic to draw conclusions about the popularity of a particular product and guess how much money a competitor spends on promoting it.
- With the Wayback Machine you can find out what a competitor's website looked like a month or even six years ago and analyze how it has changed over the years. You can even see websites that closed down long ago.
- Ahrefs and Open Site Explorer let you analyze external links to a competitor's website. They help you find out where the potential audience for your product is.
- The AdVse.ru service helps you identify who your competitors are and shows the search queries for which their ads appear. The service also assesses the level of competition.
- You can also get access to the "insides" of competitors' websites with specialized services by entering a domain name. This gives you information about the server, framework, advertising platforms, SEO analytics systems and widgets.
Social media monitoring does not provide direct information about competitors' actions, but it shows what customers say about them. In other words, it helps you build a picture of their corporate reputation.
- BrandSpotter lets you spot fake reviews of a company written by PR people and fish out suspicious comments and user accounts. BrandSpotter can also help you find out what a competitor's employees say about it.
- IQBuzz saves every mention of your competitor's brand on social media, even ones the competitor has deleted, and lets you track peaks of online activity and build brand comparison charts.
- SemanticForce monitors competitors' information space and media activity not only on social media but also in online publications, and tracks the activity of the company's employees.
A cable away from "prying eyes"
Whole countries are also trying to shield themselves from "prying eyes." Brazilian President Dilma Rousseff recently proposed requiring the country's internet companies to store all personal information of Brazilian users on servers inside the country. The aim is to bring the Brazilian internet industry under the control of local legislation and to make unauthorized access to personal information by US intelligence agencies more difficult. The bill requiring Brazilian users' data to be stored on servers in the country is still being drafted.
For now, 99% of global internet traffic passes through undersea fiber-optic lines. In most cases, the data carried by these cables ends up in one of the American data centers.
According to some estimates, last year alone around 70–80% of Latin American traffic passed through the "bowels" of US data centers, while Europe accounted for about 20% of such traffic.
It is worth bearing in mind that the servers of many of the world's best-known social networks and websites (Google, Facebook, Microsoft services and others) are also located in the US, and the information on them falls under American law.
Brazil also plans to lay a fiber-optic cable connecting the country to the communication networks of Europe, Africa and Asia. The key requirement is that the cables bypass the US, running from the Brazilian port of Fortaleza to Russia's Vladivostok by way of Cape Town, Mauritius, Singapore, Chennai and Shantou.
Most of the world has no secrets
Technologies in practically any field can become the target of industrial espionage, from arms manufacturing and the development of alternative energy sources to flower-growing techniques, believes Yevhen Nevmerzhytsky, PhD in Economics and managing partner of Financial Studio.
The aim of industrial espionage is to appropriate a new technology or idea whose implementation could bring significant economic benefit. On the other hand, for large corporations industrial espionage serves a security function, since the emergence of a new technology that makes it possible to produce goods with a much greater economic effect could destroy their business, the expert noted.
"Espionage requires considerable spending, and the cost of organizing and maintaining it has to be weighed against the expected benefit of using information obtained by spying," Nevmerzhytsky told Obozrevatel. "Reputational risks also have to be taken into account. And stealing an idea or a technology is far from enough to implement it successfully, because the ability to bring an idea to life cannot be stolen. That's why, in my view, industrial espionage is justified only for very large corporations or states."
In the expert's opinion, it is far more effective for a business not to spend money on espionage programs to study competitors, but to do its own work professionally, bringing in qualified specialists and studying publicly available information.
Yuriy Syvytsky, a member of the supervisory board of Intecracy Group, told Obozrevatel that industrial espionage is now regarded as an offshoot of competitive intelligence, although just a few years ago people still saw a difference between the two. It used to be thought that collecting data in line with ethical standards was competitive intelligence, while a competitor who stopped at nothing was engaged in espionage.
"Today, with the development of IT, there is no fundamental difference," the expert says. "An information system for collecting and processing information is not a person, and nobody taught it ethics. The example with the French and BMW involved a crude method. Evidently, all attempts to access the competitor's information by hacking its corporate system had failed. Most likely, the engineers' computers simply were not connected to the internet and exchanged information within their own secure network."
According to Syvytsky, computers used for development usually have no way to insert a flash drive, and there is no hard drive inside them (they are connected to a server located in a separate room that is protected like a bank vault).
Such solutions are expensive, however. And they are out of reach for novice entrepreneurs who want to make money from their inventions.
"So all you can advise such entrepreneurs is to take precautions: communicate with the outside world from one computer, and work (with drawings, program code and so on) on another one that is not connected to the internet," Syvytsky says. "Until you have registered your copyright (and/or obtained a patent), you shouldn't share the details of your know-how. Large companies can protect information only by implementing a comprehensive information security system. There is no other way. And even then, it is important not only to put a set of measures in place but also to follow the rules. Otherwise even the best technical solution will be ineffective."
Mobile banking expert Serhiy Skabelkin is more skeptical about protection from spies. According to him, cloud storage, SaaS systems and Google's server farms can now be used for espionage. SaaS is a business model for selling and using software in which the provider develops and manages a web application and gives the customer access to the software over the internet. In other words, you work on someone else's servers under someone else's system, so anything can be stolen.
Dropbox has tarnished its reputation as well. From the very start, Dropbox claimed that its employees had no access to users' encrypted files. But in 2011 it emerged that Dropbox employees could decrypt files if they deemed it necessary, the expert noted.
"And recently internet users were shocked by yet another discovery," Skabelkin told Obozrevatel. "It turns out that the security of circuits in critical industrial and military systems can be compromised by hardware-modified chips. Researchers from the US, the Netherlands, Switzerland and Germany have shown that integrated circuits can be altered at the physical level in such a way that nobody can tell them apart from unmodified ones."
A synthetic Trojan embedded in the hardware (the factory board) does not affect the computer's operation. Yet it creates a hidden channel for leaking the secret keys of a company or institution. It is virtually impossible to detect with existing methods.
That is why, Skabelkin says, most of the world has no secrets. After all, as is well known, the servers of many popular websites are under US control. And former CIA agent Edward Snowden has already shown the whole world what secrets the States hold. Although, according to Skabelkin, the Chinese are also starting to "stir" in this direction. That is why US officials have been banned from using Lenovo. "They are afraid of American information leaking to China," the expert remarked.
Source: Obozrevatel
Read also: Who is watching Ukrainians online, and why (Vesti, November 20, 2013)