Information Security: Cyber Threats Facilitate Ability to Commit Economic Espionage
Published: 2012-06-28T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The threat of economic espionagethe theft of U.S. proprietary information, intellectual property (IP), or technology by foreign companies, governments, or other actorshas grown. Moreover, dependence on networked information technology (IT) systems has increased the reach and potential impact of this threat by making it possible for hostile actors to quickly steal massive amounts of information while remaining anonymous and difficult to detect. To address this threat, federal agencies have a key role to play in law enforcement, deterrence, and information sharing. Consistent with this threat, GAO has designated federal information security as a governmentwide high-risk area since 1997 and in 2003 expanded it to include protecting systems and assets vital to the nation (referred to as critical infrastructures). GAO was asked to testify on the cyber aspects of economic espionage. Accordingly, this statement discusses (1) cyber threats facing the nations systems, (2) reported cyber incidents and their impacts, (3) security controls and other techniques available for reducing risk, and (4) the responsibilities of key federal entities in support of protecting IP. To do this, GAO relied on previously published work in this area, as well as reviews of reports from other federal agencies, media reports, and other publicly available sources.
section_title: What GAO Found
paragraphs: The nation faces an evolving array of cyber-based threats arising from a variety of sources. These sources include criminal groups, hackers, terrorists, organization insiders, and foreign nations engaged in crime, political activism, or espionage and information warfare. These threat sources vary in terms of the capabilities of the actors, their willingness to act, and their motives, which can include monetary gain or political advantage, among others. Moreover, potential threat actors have a variety of attack techniques at their disposal, which can adversely affect an organizations computers or networks and be used to intercept or steal valuable information. The magnitude of the threat is compounded by the ever-increasing sophistication of cyber attack techniques, such as attacks that may combine multiple techniques. Using these techniques, threat actors may target individuals and businesses, resulting in, among other things, loss of sensitive personal or proprietary information.
These concerns are highlighted by reports of cyber incidents that have had serious effects on consumers and businesses. These include the compromise of individuals sensitive personal data such as credit- and debit-card information and the theft of businesses IP and other proprietary information. While difficult to quantify monetarily, the loss of such information can result in identity theft; lower-quality counterfeit goods; lost sales or brand value to businesses; and lower overall economic growth and declining international trade.
To protect against these threats, a variety of security controls and other techniques are available. These include technical controls such as those that manage access to systems, ensure system integrity, and encrypt sensitive data. But they also include risk management and strategic planning that organizations undertake to improve their overall security posture and reduce their exposure to risk. Further, effective public-private partnerships are a key element for, among other things, sharing information about threats.
Multiple federal agencies undertake a wide range of activities in support of IP rights. Some of these agencies include the Departments of Commerce, Justice, and Homeland Security, among others. For example, components within the Justice Department and the Federal Bureau of Investigation are dedicated to fighting computer-based threats to IP. In addition, both Congress and the Administration have established interagency mechanisms for better coordinating the protection of IP. Ensuring effective coordination will be critical for better protecting the economic security of Americas businesses.
section_title: What GAO Recommends
paragraphs: In prior reports, GAO has made hundreds of recommendations to better protect federal systems, critical infrastructures, and intellectual property.

section_title: Letter
paragraphs: Thank you for the opportunity to testify at today’s hearing on the threat of  economic espionage facing U.S. businesses.
The threat of economic espionage is not new. In April 1992, we testified  that the theft of U.S. proprietary information or technology by foreign  companies has long been a part of the competitive business  environment. We also testified that the unauthorized acquisition of U.S.  proprietary or other information by foreign governments to advance their  countries’ economic position was growing.
Today, this threat continues to grow. According to the Federal Bureau of  Investigation (FBI), the theft of intellectual property (IP)—products of  human intelligence and creativity—is a growing threat which is  heightened by the rise of the use of digital technologies. The increasing  dependency upon information technology (IT) systems and networked  operations pervades nearly every aspect of our society. In particular,  increasing computer interconnectivity—most notably growth in the use of  the Internet—has revolutionized the way that our government, our nation,  and much of the world communicate and conduct business. While  bringing significant benefits, this dependency can also create  vulnerabilities to cyber-based threats. Cyber attacks are one way that  threat actors—whether nations, companies, or criminals—can target the  intellectual property and other sensitive information of federal agencies  and American businesses. According to the Office of the National  Counterintelligence Executive, sensitive U.S. economic information and  technology are targeted by intelligence services, private sector  companies, academic and research institutions, and citizens of dozens of  countries. To help address this threat, federal agencies have a key role  to play in law enforcement, deterrence, and information sharing.  Underscoring the importance of this issue, we have designated federal  information security as a high-risk area since 1997 and in 2003 expanded  this area to include protecting computerized systems supporting our  nation’s critical infrastructure.
In my testimony today, I will describe (1) cyber threats facing the nation’s  systems, (2) reported cyber incidents and their impacts, (3) security  controls and other techniques available for reducing risk, and (4) the  responsibilities of key federal entities in support of improving the  protection of intellectual property. In preparing this statement in June  2012, we relied on our previous work in these areas. (Please see the  related GAO products in appendix II.) These products contain detailed  overviews of the scope and methodology we used. We also reviewed  relevant reports from the Department of Justice and Office of the National  Counterintelligence Executive, and information on security incidents,  including those involving economic espionage, from the U.S. Computer  Emergency Readiness Team (US-CERT), media reports, and other  publicly available sources. The work on which this statement is based  was conducted in accordance with generally accepted government  auditing standards. Those standards require that we plan and perform  audits to obtain sufficient, appropriate evidence to provide a reasonable  basis for our findings and conclusions based on our audit objectives. We  believe that the evidence obtained provided a reasonable basis for our  findings and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: As computer technology has advanced, both government and private  entities have become increasingly dependent on computerized  information systems to carry out operations and to process, maintain, and  report essential information. Public and private organizations rely on  computer systems to transmit sensitive and proprietary information,  develop and maintain intellectual capital, conduct operations, process  business transactions, transfer funds, and deliver services. In addition,  the Internet has grown increasingly important to American business and  consumers, serving as a medium for hundreds of billions of dollars of  commerce each year.
Consequently, ineffective information security controls can result in  significant risks, including  loss or theft of resources, including money and intellectual property;  inappropriate access to and disclosure, modification, or destruction of  sensitive information; use of computer resources for unauthorized purposes or to launch  attacks on other computers systems; damage to networks and equipment; loss of business due to lack of customer confidence; and  increased costs from remediation.
section_title: The Nation Faces an Evolving Array of Cyber-Based Threats
paragraphs: Cyber-based threats are evolving and growing and arise from a wide  array of sources. These sources include business competitors, corrupt  employees, criminal groups, hackers, and foreign nations engaged in  espionage and information warfare. These threat sources vary in terms of  the capabilities of the actors, their willingness to act, and their motives,  which can include monetary gain or political advantage, among others.  Table 1 shows common sources of cyber threats.
These sources of cyber threats make use of various techniques, or  exploits, to adversely affect an organization’s computers, software, or  networks, or to intercept or steal valuable or sensitive information. Table 2  provides descriptions of common types of cyber exploits.
Cyberspace—where much business activity and the development of new  ideas often take place—amplifies these threats by making it possible for  malicious actors to quickly steal and transfer massive quantities of data  while remaining anonymous and difficult to detect. For example, cyber  attackers do not need to be physically close to their victims, technology  allows attacks to easily cross state and national borders, attacks can be  carried out at high speed and directed at a number of victims  simultaneously, and cyber attackers can more easily remain anonymous.  Moreover, the use of these and other techniques is becoming more  sophisticated, with attackers using multiple or “blended” approaches that  combine two or more techniques. Using such techniques, threat actors  may target individuals, resulting in loss of privacy or identity theft;  businesses, resulting in the compromise of proprietary information or  intellectual property; critical infrastructures, resulting in their disruption or  destruction; or government agencies, resulting in the loss of sensitive  information and damage to economic and national security.
section_title: Reported Cyber- Incidents Illustrate Serious Risk to the Security of Intellectual Property and Other Sensitive Economic Information
paragraphs: Reports of cyber incidents affecting both public and private institutions are  widespread. The U.S. Computer Emergency Readiness Team (US- CERT) receives computer security incident reports from federal agencies,  state and local governments, commercial enterprises, U.S. citizens, and  international computer security incident response teams. In its fiscal year  2011 report to Congress on implementation of the Federal Information  Security Management Act of 2002, the Office of Management and Budget  reported that US-CERT received over 100,000 total incident reports in  fiscal year 2011. Over half of these (about 55,000) were phishing exploits;  other categories of incidents included virus/Trojan horse/worm/logic  bombs; malicious websites; policy violations; equipment theft or loss;  suspicious network activity; attempted access; and social engineering.
Private sector organizations have experienced a wide range of incidents  involving data loss or theft, economic loss, computer intrusions, and  privacy breaches, underscoring the need for improved security practices.  The following examples from news media and other public sources  illustrate that a broad array of information and assets remain at risk.
In March 2012, it was reported that a security breach at Global  Payments, a firm that processed payments for Visa and Mastercard,  could compromise the credit- and debit-card information of millions of  Americans. Subsequent to the reported breach, the company’s stock  fell more than 9 percent before trading in its stock was halted. Visa  also removed the company from its list of approved processors.  In March 2012, it was reported that Blue Cross Blue Shield of  Tennessee paid out a settlement of $1.5 million to the U.S.  Department of Health and Human Services arising from potential  violations stemming from the theft of 57 unencrypted computer hard  drives that contained protected health information of over 1 million  individuals.  In April 2011, Sony disclosed that it suffered a massive breach in its  video game online network that led to the theft of personal  information, including the names, addresses, and possibly credit card  data belonging to 77 million user accounts.  In February 2011, media reports stated that computer hackers had  broken into and stolen proprietary information worth millions of dollars  from the networks of six U.S. and European energy companies.
A retailer reported in May 2011 that it had suffered a breach of its  customers’ card data. The company discovered tampering with the  personal identification number (PIN) pads at its checkout lanes in  stores across 20 states.  In mid-2009 a research chemist with DuPont Corporation reportedly  downloaded proprietary information to a personal e-mail account and  thumb drive with the intention of transferring this information to Peking  University in China and also sought Chinese government funding to  commercialize research related to the information he had stolen.
Between 2008 and 2009, a chemist with Valspar Corporation  reportedly used access to an internal computer network to download  secret formulas for paints and coatings, reportedly intending to take  this proprietary information to a new job with a paint company in  Shanghai, China.  In December 2006, a product engineer with Ford Motor Company  reportedly copied approximately 4,000 Ford documents onto an  external hard drive in order to acquire a job with a Chinese automotive  company.
These incidents illustrate the serious impact that cyber threats can have  on, among other things, the security of sensitive personal and financial  information and proprietary information and intellectual property. While  these effects can be difficult to quantify monetarily, they can include any  of the following:
For consumers or private citizens: identity theft or compromise of  personal and economic information and costs associated with lower- quality counterfeit or pirated goods.
For business: lost sales, lost brand value or damage to public image,  cost of intellectual property protection, and decreased incentive to  invest in research and development.
For the economy as a whole: lower economic growth due to reduced  incentives to innovate and lost revenue from declining U.S. trade with  countries that have weak IP rights regimes.
section_title: Security Controls and Other Techniques Can Reduce Vulnerability to Cyber-Based Attacks
paragraphs: The prevalence of cyber threats and the risks they pose illustrate the  need for security controls and other actions that can reduce  organizations’ vulnerability to such attacks. As we have reported, there  are a number of cybersecurity technologies that can be used to better  protect systems from cyber attacks, including access control  technologies, system integrity technologies, cryptography, audit and  monitoring tools, and configuration management and assurance  technologies. In prior reports, we have made hundreds of  recommendations to federal agencies to better protect their systems and  cyber-reliant critical infrastructures. Table 3 summarizes some of the  common cybersecurity technologies, categorized by the type of security  control they help to implement.
In addition, the use of an overall cybersecurity framework can assist in  the selection of technologies to protect an organization against cyber  attacks. Such a framework includes determining the business requirements for security; performing risk assessments; establishing a security policy; implementing a cybersecurity solution that includes people, process,  and technology to mitigate identified security risks; and  continuously monitoring and managing security.
Risk assessments, which are central to this framework, help  organizations determine which assets are most at risk and to identify  countermeasures to mitigate those risks. Risk assessment is based on a  consideration of threats and vulnerabilities that could be exploited to inflict  damage.
Even with such a framework, there often are competing demands for  cybersecurity investments. For example, for some companies, mitigating  physical risks may be more important than mitigating cyber risks. Further,  investing in cybersecurity technologies needs to make business sense. It  is also important to bear in mind the limitations of some cybersecurity  technologies and to be aware that their capabilities should not be  overstated. Technologies do not work in isolation. Cybersecurity solutions  make use of people, process, and technology. Cybersecurity technology  must work within an overall security process and be used by trained  personnel. We have also emphasized the importance of public-private  partnerships for sharing information and implementing effective  cybercrime prevention strategies.
Similarly, the Office of the National Counterintelligence Executive has  identified a series of “best practices in data protection strategies and due  diligence for corporations.” strategy; insider threat programs and awareness; effective data  management; network security, auditing, and monitoring; and contingency  planning.
section_title: Key Federal Agencies Have Responsibilities for Protecting Intellectual Property
paragraphs: Multiple federal agencies undertake a wide range of activities in support  of IP rights. Some of these agencies are the Departments of Commerce  (including the U.S. Patent and Trademark Office), State, Justice  (including the FBI), Health and Human Services, and Homeland Security;  the U.S. Trade Representative; the U.S. Copyright Office; and the U.S.  International Trade Commission. In many cases, IP-related efforts  represent a small part of the agencies’ much broader missions.
Office of the National Counterintelligence Executive, Foreign Spies Stealing U.S.  Economic Secrets in Cyberspace.
Department of Justice’s (DOJ) U.S. attorneys offices, Criminal Division,  and the FBI investigate and prosecute federal IP crimes. DOJ established  the Computer Hacking and Intellectual Property program, which consists  of specially trained assistant U.S. attorneys to pursue IP cases. Each of  the 93 U.S. attorneys offices throughout the country have assistant U.S.  attorneys designated as Computer Hacking and Intellectual Property  coordinators, who are available to work on IP cases. In addition, DOJ has  created Computer Hacking and Intellectual Property units in 25 U.S.  attorney’s offices with histories of large IP case loads. DOJ’s Computer  Crime and Intellectual Property Section—based in Washington, D.C.— consists of prosecutors devoted to enforcing computer crime and IP laws.  Computer Crime and Intellectual Property Section attorneys prosecute  cases, assist prosecutors and other investigative agents in the field, and  help develop and implement an overall criminal enforcement strategy.  The FBI’s Cyber Division oversees the bureau’s IP enforcement efforts;  though not all of its IP investigations are cyber-related.
Over the years, Congress and the administration have created  interagency mechanisms to coordinate federal IP law enforcement efforts.  These include the National Intellectual Property Law Enforcement  Coordination Council (NIPLECC), created in 1999 to coordinate U.S. law  enforcement efforts to protect and enforce IP rights in the United States  and abroad and the Strategy for Targeting Organized Piracy initiative,  created by the President in 2004 to target cross-border trade in tangible  goods and strengthen U.S. government and industry IP enforcement  action. In December 2004, Congress passed legislation to enhance  NIPLECC’s mandate and created the position of the Coordinator for  International Intellectual Property Enforcement, located within the  Department of Commerce, to lead NIPLECC. In November 2006 we  reported that NIPLECC continued to face persistent difficulties, creating  doubts about its ability to carry out its mandate. We also noted that  while the Strategy for Targeting Organized Piracy had brought attention  and energy to IP efforts within the U.S. government, it had limited  usefulness as a tool to prioritize, guide, implement, and monitor the  combined efforts of multiple agencies.
In 2008, Congress passed the Prioritizing Resources and Organization for  Intellectual Property Act (PRO-IP Act), which, among other things,  created the position of the Intellectual Property Enforcement Coordinator  (IPEC) to serve within the Executive Office of the President. The duties of  the coordinator outlined in the act include specific efforts to enhance  interagency coordination, such as the development of a comprehensive  joint strategic plan. The act also required the Attorney General to devote  additional resources to IP enforcement and undertake other IP- enforcement-related efforts. In October 2010, we noted that DOJ and FBI  officials and Office of the IPEC staff reported taking many actions to  implement the requirements of the PRO-IP Act. Moreover, the IPEC  coordinated with other federal entities to deliver the 2010 Joint Strategic  Plan on Intellectual Property Enforcement to Congress and the public. We  reported that the plan addressed the content requirements of the act, but  that enhancements were needed, such as identifying responsible  departments and entities for all action items and estimates of resources  needed to carry out the plan’s priorities. Accordingly, we recommended  that the IPEC take steps to ensure that future strategic plans address  these elements. IPEC staff generally concurred with our findings and  recommendations.
In summary, the ongoing efforts to steal U.S. companies’ intellectual  property and other sensitive information are exacerbated by the ever- increasing prevalence and sophistication of cyber-threats facing the  nation. Recently reported incidents show that such actions can have  serious impact not only on individual businesses, but on private citizens  and the economy as a whole. While techniques exist to reduce  vulnerabilities to cyber-based threats, these require strategic planning by  affected entities. Moreover, effective coordination among federal  agencies responsible for protecting IP and defending against cyber- threats, as well as effective public-private partnerships, are essential  elements of any nationwide effort to protect America’s businesses and  economic security.
Chairman Meehan, Ranking Member Higgins, and Members of the  Subcommittee, this concludes my statement. I would be happy to answer  any questions you have at this time.
section_title: Appendix I: Contact and Acknowledgments
paragraphs: If you have any questions regarding this statement, please contact  Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov. Other  key contributors to this statement include Michael Gilmore and Anjalique  Lawrence (Assistant Directors), Bradley Becker, Kush Malhotra, and Lee  A. McCracken.
section_title: Appendix II: Related GAO Products
paragraphs: Cybersecurity: Threats Impacting the Nation. GAO-12-666T. Washington,  D.C.: April 24, 2012  IT Supply Chain: National Security-Related Agencies Need to Better  Address Risks. GAO-12-361. Washington, D.C.: March 23, 2012.
Critical Infrastructure Protection: Cybersecurity Guidance Is Available, but  More Can Be Done to Promote Its Use. GAO-12-92. Washington, D.C.:  December 9, 2011.
Cybersecurity: Continued Attention Needed to Protect Our Nation’s  Critical Infrastructure. GAO-11-865T. Washington, D.C.: July 26, 2011.
High-Risk Series: An Update. GAO-11-278. Washington, D.C.: February  2011.
Electricity Grid Modernization: Progress Being Made on Cybersecurity  Guidelines, but Key Challenges Remain to be Addressed. GAO-11-117.  Washington, D.C.: January 12, 2011.
Intellectual Property: Agencies Progress in Implementing Recent  Legislation, but Enhancements Could Improve Future Plans. GAO-11-39.  Washington, D.C.: October 13, 2010.
Critical Infrastructure Protection: Key Private and Public Cyber  Expectations Need to Be Consistently Addressed. GAO-10-628.  Washington, D.C.: July 15, 2010.
Cyberspace: United States Faces Challenges in Addressing Global  Cybersecurity and Governance. GAO-10-606. Washington, D.C.: July 2,  2010.
Cybersecurity: Continued Attention Is Needed to Protect Federal  Information Systems from Evolving Threats. GAO-10-834T. Washington,  D.C.: June 16, 2010.
Intellectual Property: Observations on Efforts to Quantify the Economic  Effects of Counterfeit and Pirated Goods. GAO-10-423. Washington,  D.C.: April 12, 2010.
Cybersecurity: Progress Made but Challenges Remain in Defining and  Coordinating the Comprehensive National Initiative. GAO-10-338.  Washington, D.C.: March 5, 2010.
Intellectual Property: Enhancements to Coordinating U.S. Enforcement  Efforts. GAO-10-219T. Washington, D.C.: December 9, 2009.
National Cybersecurity Strategy: Key Improvements Are Needed to  Strengthen the Nation’s Posture. GAO-09-432T. Washington, D.C.:  March 10, 2009.
Intellectual Property: Federal Enforcement Has Generally Increased, but  Assessing Performance Could Strengthen Law Enforcement Efforts.  GAO-08-157. Washington, D.C.: March 11, 2008.
Cybercrime: Public and Private Entities Face Challenges in Addressing  Cyber Threats. GAO-07-705. Washington, D.C.: June 22, 2007.
Intellectual Property: Strategy for Targeting Organized Piracy (STOP)  Requires Changes for Long-term Success. GAO-07-74. Washington,  D.C.: November. 8, 2006.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.