The company was in the process of bargaining with the Chinese government for drilling rights off that country’s coast. Chinese officials told the company’s negotiators that everything looked fine and that its contracts would soon be approved. But they also presented a list of 30 Chinese students graduating from "fine American universities" and indicated that China would consider it a sign of goodwill if the company hired them. The Chinese negotiators also pointed out that the company would benefit from having employees who were familiar with China. Because the company wanted to please the Chinese government, it acceded to the request.

Shortly thereafter, the company’s security manager received a disturbing call. An employee was alarmed that her coworker–one of the recent Chinese hires–was spending an inordinate amount of time on the phone speaking in Chinese. The security manager pulled the employee’s phone log and found numerous calls to one number. He then passed the phone log to the FBI, which confirmed that the number in question was registered to the Chinese consulate in Houston, and that the specific number was that of a known spy.

Few would think of an old economy industry such as big oil as a prime target for espionage. Yet, just the opposite is true. Corporate espionage exists in nearly all industries.

The company quietly fired the employee. During this episode, I spoke with the company’s security manager about the daunting challenges global corporate espionage presents. "While we don’t believe that all of the other 29 Chinese employees are spies, how can we tell which ones are, and what can we do to minimize the loss?" he wondered.

Alarmingly, such cases are increasingly common. The American Society for Industrial Security (ASIS) in Alexandria, Va., projects that global corporate espionage costs businesses more than $300 billion annually. Because few firms will publicly admit to having been the victim of spying, the true costs are unknown. What is certain is that the loss of critical proprietary information can destroy a company’s competitiveness and ultimately lead to financial ruin.

Although it may come as no surprise that those industries whose business models are built on intellectual property–high technology and pharmaceuticals, for example–are particularly vulnerable to its loss, few would think of an old economy industry such as big oil as a prime target for espionage. Yet, just the opposite is true. Corporate espionage exists in nearly all industries.

Consider this: An oil company owns intellectual property related to processes and formulas for refining petroleum, which give it a competitive advantage. Licensing this IP can generate a great deal of revenue. Furthermore, some of an oil company’s most critical IP are the mathematical simulations of the location and size of oil reserves. If Chinese authorities knew exactly how much oil the company expected to get from the Chinese reserves, they would know how far they could push the oil company during negotiations to obtain more favorable contract terms.

The Houston oil company targeted by the Chinese spies will not suddenly go out of business, but its earnings and stock prices could be affected over time. Espionage can also lead to numerous small losses that add up to the equivalent of a large setback. Bill Boni, the chief information security officer of global technology giant Motorola, calls this the "death by a thousand cuts."

The Silent Killer
The Chinese government is hardly the only perpetrator of industrial espionage. Although the U.S. National Counterintelligence Executive (NCIX), a federal entity that oversees and executes the president’s national counterintelligence strategy, has consistently cited China as the most egregious architect of corporate espionage, there are many other countries, including Russia, Pakistan and Iran, that aggressively spy on behalf of their national industries. The NCIX also cites U.S. allies such as Israel, France, Germany and Japan as frequent offenders. The NCIX reports that more than 100 countries practice corporate espionage.

While governments often work in tandem with their national industries to steal corporate secrets, they are not the only agents. Numerous prosecutors who investigate corporate espionage crimes have told me that the majority of the offenses they pursue involve companies targeting their domestic rivals. For example, the process for making soft-center chocolate chip cookies became the focus of epic industrial espionage efforts as Nabisco, Pillsbury and others raced to bring the revolutionary new cookie to market.

Motorola chief information security officer Bill Boni describes the damage incurred by acts of corporate spying as "death by a thousand cuts."

But in a global economy, does it really matter which company brings a product to market? For investors and consumers, the answer is, emphatically, yes. Say an American pharmaceutical company invests $800 million into the development of a new drug. If another firm steals the formula, it will probably manufacture the drug overseas, and the resulting product will end up on the black market. This means that the drug will sell for a fraction of its normal price. The developer cannot recoup its investment, and quality control issues may damage its reputation. Even if the counterfeit drug is not sold domestically, the overseas competition will eat into the developer’s profits.

Diverse, multinational corporations may be able to survive this type of blow. But small and midsize companies would be devastated. In the mid-1980s, Recon/Optical, a Barrington, Ill., manufacturer of high-quality optical products for military applications, won a contract from the Israeli military. Israel’s government said it wanted contract monitors on site to observe the progress of the effort. In reality, these Israeli air force officers were spies who stole every important aspect of Recon/Optical’s technology. An Israeli company that used the same technology opened three months later and sold the products for one-third of Recon/Optical’s price, effectively crippling the company. Litigation ensued, and in 1993 the Israelis reportedly paid $3 million in damages and fines, which was little consolation to the company, which faced near ruin.

Briefcase, Cloak and Dagger
The case of Recon/Optical is somewhat unique in that the company not only knew its IP had been stolen, but it knew who stole it. Most companies are not aware of either. While I often help companies investigate known espionage cases, my main business is performing simulations of espionage attempts in which a team of intelligence professionals targets a company technologically, physically and operationally. Over the years, I have been able to compromise the entire product line of a pharmaceutical company and the fund-transfer systems of major financial organizations, as well as to steal nuclear reactor designs. We have never been caught, and our clients never know what was stolen until we inform them. Disturbingly, in half of these simulations, my team finds evidence of previously undetected crimes or espionage attacks.

In 1996, Congress passed the Economic Espionage Act, making the theft or misappropriation of a trade secret a federal crime. The law directly addresses global corporate espionage in that it has extraterritorial jurisdiction for any crimes involving U.S. citizens (as victims or perpetrators). While the number of prosecutions under this law has increased, most agree that the volume of global and domestic corporate espionage has risen at a much faster pace, and will continue to do so. Technology, particularly the Internet, is providing more opportunities for espionage, especially against small businesses.

Companies are also making themselves vulnerable by moving operations overseas. Those that seek the benefits of a new market, without considering the potential costs of entering it–including losses due to espionage–can offset any gains. Consider the global companies that are tripping over themselves to break into the Chinese and Indian markets. They are lured by lower manufacturing costs and the potential to sell their products to billions of new customers. Yet I know of only a handful that have IP protection policies in place to deal with the very real threat of espionage. At the same time, the host countries and local competitors have continued to refine their espionage skills.

We are also seeing large companies develop their own competitive intelligence programs to monitor the activities of their competitors. While internal groups probably use legal methods, they will inevitably hire outside firms to assist in gathering information, and these firms are more likely to engage in illegal espionage efforts.

Many companies will experience espionage-related losses. While most will not be devastated by these crimes, death by a thousand cuts remains a very real possibility. Better-prepared and managed companies can minimize these losses and boost their chances of recovery by preventing attacks and detecting and responding to successful attacks. Unfortunately, as corporate espionage proliferates, we are seeing few improvements in corporate security efforts. IP protection and security programs are still generally considered luxuries, not necessities.

Ira Winkler is president of Internet Security Advisors Group. He is also the author of Spies Among Us, a book on corporate espionage.

Additional Information
 Managing Espionage Risks