MR. WILLIAM C. UBAGAN CSP,LSO
Marketing Officer, CLM-CBIS Philippines
In the business community it is seldom heard about the protection of such information which we believe should be given enough protection. In the security protection, a security professional should deal with this squarely and fairly as in other security aspects like physical security and personnel. In our discussion, we will try to understand why this should be and what kind of information should be given ample protection and distinguish them from one another. Also, why and in what way we are losing them.
SCOPE OF THE TASK
Information which in some special way relates to the status of activities of the possessor and over which the possessor asserts ownership. In the business community, proprietary information relates to the structure, products, or business methods of the organization. It is usually protected in some way against casual or general disclosure.
What kind of information needs protection?
A trade secret may consist of any formula, pattern,
device or compilation of information which is used in one’s business and which gives one an opportunity to gain an advantage over competitors who do not know or use it. It may be a formula for a chemical compound, a process of manufacturing, treating or preserving materials, a pattern for a machine or other device, or a list of customers.
The most basic distinction in regard to proprietary information is between trade-secret data and all other types of confidential data.
The difference is of great importance because the rights and remedies available to one which proprietary information is improperly disclosed or exploited depends upon the legal status of that information.
Generally, trade secrets are afforded greater legal protection than confidential information not amounting to trade secrets. Of practical importance is the test applied to determine whether information is a trade secret.
All proprietary information is confidential, but not all confidential information is proprietary.
For example, confidential personnel data in employee files is not proprietary information even though the company treats it as confidential.
Trade Secret means information including a formula, pattern, compilation, program, device, method, technique or process that:
- Derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable by proper means, by other persons who can obtain economic value from its disclosure or use, and
- Is the subject of efforts that are reasonable under the circumstances to maintain its secrecy.
- The definition of “trade secret” contains a reasonable departure from the Restatement of Torts definition which required that a trade secret be “continuously used in one’s business”. The broader definition in the proposed Act extends protection to a plaintiff who has not yet had an opportunity or acquired the means to put a trade secret to use.
A more recent legal definition of a Trade Secret is found in Section 1(4) of the Uniform Trade Secret Act.
- “Trade Secret” means information including a formula, pattern, compilation, program device, method, technique or process that
- derives independent economic value, actual or potential from not being generally known to and not being readily ascertainable by proper means, by other persons who can obtain economic value from its disclosure or use, and
3) Is the subject of efforts that are reasonable under the circumstances to maintain its secrecy.
The essential elements of a Trade Secret:
- It is not to be generally known to others and
- some advantages are gained by the user from its use or possession.
WHAT IS A SECRET?
This question is taken up first because it is relevant even in cases where the data involved are not trade secrets but merely simple facts. If information is not novel or secret, it is not entitled to any protection; it is the property of everyone and it is in the public domain.
To be secret, information must generally meet the following tests:
- It must be identifiable.
- It must not be already available in public sources.
- It must be disclosed by the owner only to persons who are under some duty to protect its secrecy.
- Persons to whom it is disclosed must know it is a secret.
- There must be some objective indication that the owner is attempting to prevent its unauthorized disclosure
The amount of information or data defined as secret or confidential should be as small as possible while remaining consistent with the business’s real objectives and operating needs.
NOT ALREADY IN PUBLIC
If information claimed as secret is found in publicly accessible sources such technical journals, trade meeting minutes, encyclopedias, and documents filed with public agencies, then it is very hard to achieve protection.
DISCLOSE TO A WITH A DUTY TO PROTECT
One person cannot make another person the unwilling possessor of the first person’s secret.
There must be a relationship between the persons that requires receiving the disclosure to safeguard it, or there must be an agreement, expressed or implied, imposing that obligation.
Otherwise, a disclosure of a secret cannot build the one to whom it is disclosed to protect it.
This class of persons under a duty to safeguard-fiduciaries – as the law terms them – must first be shown the existence of a secret. Then the relationship must be shown as well as the fact that the fiduciary, the trusted person, knew that the information involved was secret. Subsequent disclosure during the relationship and knowledge or pressurized knowledge, is wrongful.
Under common laws employees are presumed to be fiduciaries to the extent that they may disclose the secrets of their employers without authorization.
As a class, the employees are the largest group of persons bound to secrecy because of their status or relationship.
In general, employees are bound to protect their employer’s secret.
PERSONS OTHER THAN EMPLOYEES
Other than employees, persons to be bound to secrecy must agree to be so bound. Agreement may be implied from the acts and conduct of the parties, and need not be written or expressed.
The wiser course in such cases is to reduce the agreement in writing. Even the acceptance of a purchase order by return of an acknowledgement copy is already enough to hold the vendor to all the terms and conditions of the order which are recited on it.
DISCLOSEES MUST KNOW THE INFORMATION IS CONFIDENTIAL
Any company may require employees not to disclose any information about the company not already known outside, whether such information is a trade secret or not.
OBJECTIVE INDICATIONS OF ATTEMPT TO PROTECT SECRECY
The owner of the secret information must be able to show that he or she undertakes to protect the information claimed to be secret. There is no single “laundry list” of protective measures, but the following have been recognized at one time or another, by one court or another:
- Restricting non-employee access to places containing secret information.
- Placing warning signs and instructions to alert employees to the sensitivity of certain things and places.
- Informing employees and visitors that information obtained or things seen in certain locations within a facility are secret.
- Storing sensitive documents separately in containers for which special security precautions are taken.
- Imposing area controls within a facility among different classes of employees with respect to certain information or operations.
Obviously, the more precaution the owner of secret information takes to prevent unauthorized disclosure, the better the information is protected and the easier it is to show that an unauthorized person must have done something wrongful to obtain access.
A ‘Patent’ is grant made by government to an inventor, conveying and securing to him the exclusive rights to make, use and sell his invention for a term of 17 years.
The main differences between a Trade Secret and a Patent are:
- The requirement for obtaining a patent are specific, to qualify for a patent, the invention has to represent a positive contribution beyond the skill of the average person, whereas the trade secret needs a much lower novelty.
- A trade secret can remain a secret for as long as it continues to meet the “trade secret test”, whereas an exclusive right patent expires after a period of 17 years.
- Since anyone can purchase a patent, they are not industrial espionage targets, whereas trade secrets are.
VULNERABILITIES OF SENSITIVE DATA
There are three broad threats to sensitive data or information:
- It can be lost through inadvertent disclosure.
- It can be deliberately stolen by an outsider – an industrial espionage agent in the classic sense.
- It can be deliberately stolen by an insider entrusted with access to it.
Inadvertent Disclosure usually occurs in one of its following context:
Trade Association Meetings/Shows
Discussion with Suppliers
Off Premises Statements by Employees
Press & Public Relations
INTENTIONAL THEFT BY INSIDERS
In addition to theft by a current employee, there is also the problem that a former employee may obtain a better position with a competitor and, once there, expose the former employer’s sensitive data. This typically arises in the trade secrets situation and, as was pointed out earlier, is then important for the original owner to establish a proprietary position and also to establish the former employee’s breach of trust.
Litigating trade secret cases involving former employees now working for a competitor poses three serious threats
- The original owner may have to expose the very trade secret data he or she wishes to protect in order to prove ownership. Secrecy precautions invoked in court may not safeguard the owner against further compromise.
- Legal action may be much costlier than protective steps properly taken.
- The owner may lose the litigation because the new employer in the course of the new employment relationship is better achieved by requiring non competitive covenants from key employees. This technique is more fully developed in the later discussion of countermeasures.
COUNTERMEASURES TO PROTECT SENSITIVE DATA
Effective Programs of information security involve considerations touching on physical, personnel, and communications countermeasures.
COMPETITIVE INTELLIGENCE COLLECTIONS
The most important function of competitive intelligence is to alert senior management to marketplace changes to prevent surprise.
A single element of information may mean little, but the compilation and analysis of many elements of many sources can provide an astonishingly accurate portrait of a highly sensitive proprietary process. For example
- Newspaper classified advertising for new employees can provide the types of workers required and facilitate deducing the probable production start date.
- Documents filed with local planning authorities can provide the physical dimensions of the facility and interior layout.
- Technical journal articles by the engineering staff offer information on advanced manufacturing process to be employed.
- A presentation by a member of the marketing staff, published in the proceedings of a marketing seminar, may detail a statistical formula for pricing and product distribution and
- Casual conversations with construction workers can reveal the intended layout of a manufacturing line for a new project.
In general, complete programs of data protection include the following elements:
- Policy and procedural statements which cover the recognition, classification, and handling of sensitive information.
- Pre-employment screening techniques and incumbent employee review procedures to assure that persons entrusted with sensitive data do not have any ascertainable motive or reason to exploit such data and are basically stable.
- Awareness programs in which all employees are made aware of the existence of sensitive data in the company, their responsibilities in protecting it, and the required procedures.
- Nondisclosure agreements from employees, in which they acknowledge their fiduciary responsibility.
- 5. Nondisclosure agreements from employees to whom significant kinds and amounts of sensitive data are released. These records may also include periodic reaffirmations of non-disclosure responsibility.
- Noncompetitive agreements from specified classes of personnel to prevent their taking employment with defined competitors within a stated future period.
- Physical measures such as area and access controls, admittance controls, identification devices and routines, secure storage containers, regulated reproduction facilities, controlled trash disposal, and restrictions on use of communications media to minimize the probability that unauthorized persons will gain access to sensitive data on or off the premises.
- Follow up efforts with new employers of former employees who were exposed to sensitive data but who were not required to execute non competitive agreements. Such programs include notices to the new employer of the former employee’s exposure and responsibility to protect
- Continuous and informed monitoring of routine activities in the field to detect appearances of one’s sensitive data.
The model policies utilize two familiar principles of military security, those of classification and need-to-know.
Knowingly and without lawful authority:
- Entering into a private place with intent to listen surreptitiously to private conversations or to observe the conduct of any other person or persons therein; or
- Installing or using outside a private place any device for hearing, recording or amplifying, or broadcasting sounds originating in such place, which sounds would not ordinarily be audible or comprehensible outside, without the consent of the or persons entitled to privacy therein;
- Installing or using any device or equipment for the interception of any telephone, telegraph, or other wire communication without the consent of the person in possession or control of the facilities for such wire communication.
EAVESDROPPING TACTICS AND EQUIPMENT
Is the interception of communications over a wire without the consent of the participants and requires physical entry into the communication circuit.
Some devices however use induction as a means of intercepting the signal and therefore do not need physical entry into the circuit. In most states you only need the consent of one of the parties.
Is the interception of communications without the consent of the parties by means of electronic devices without penetration of the circuit.
Carbon Microphone, commonly used in a standard (old fashioned) telephone handset.
Crystal Microphone, this generates a small electric current when the crystal is vibrated by sound waves. They are used in two different ways.
1) Contact Microphones installed on a common
wall with the target area.
2) Spike Microphones installed in a hole in the
common wall (not so that they penetrate).
Dynamic Microphones, these operate by the movement of a small wire near a permanent magnet which converts the vibration (caused by the sound) into electrical energy (self powering). A good eaves-dropping device and it operates like a loud speaker in reverse.
Pneumatic Cavity Device, has a specifically designed small cavity which picks up surface vibrations (like the glass tumble effect).
Condenser Microphone, used primarily in personnel address (PA) systems and audio recording – it is extremely small.
Electret Microphone, used primarily in conferences, picks up sound from many directions around the room.
Cardioid Microphone, picks up sound from directly in front of the microphone.
Parabolic Microphone, gathers audio energy and directs it to a conventional microphone in the center of a dish type reflector.
Shotgun Microphone, a bulky arrangement of tubes gathers sound and sends it to a microphone connected to the tubes.
A radio frequency (RF) device consisting of a microphone, transmitter, power supply, antenna and in some applications a receiver as well (BUG).
CURRENT CARRIER DEVICES
Carry audio signals over virtually every type of wire path (e.g., wireless home intercom system). Signal is usually blocked by power transformers.
Laser beam focused on a window pane, the vibrating glass modulates the reflected beam and the sound signal is extracted from the reflected light signal.
Detectable electro-magnetic energy is generated by electronic information processing devices.
Detection of the energy and extracting the information, is possible over several hundred feet.
The ‘Faraday Cage’ method of screening is used for very sensitive processing. (Tempest Shielding).
Ordinary speakers in TV’s, radios, PA systems, intercoms, etc., can be used in reverse to pick up sounds from the room they are located.
Interceptions from the line. Information is acquired from the line and includes voice, fax, teletype and other data.
Two main principles used are:
- Direct physical connection anywhere on the line between the target area and the telephone exchange.
- Inductive coupling which does not require a physical connection.
Use of target’s telephone equipment requires physical entry into the target area.
Three types of attack are:
- Wiring alterations of the telephone require technical knowledge.
- Drop-in transmitter, used on older types of telephones (bug).
- Infinity transmitter, can be accessed from anywhere in the world using another telephone. Cannot be used in electronic telephone switching systems.
DEFENSE AGAINST ELECTRONIC EAVESDROPPING
Scrambler, an encryption equipment used to disguise information.
“VOCODER” is the best available scrambler in the market.
Sound Barrier (not acoustic tiles)
Partitions, floors, ceilings, use non-porous material or staggered stud construction.
Windows and doors, double panes with curtains, solid doors with rubber or felt gaskets.
It is better if two doors are used in series and are properly sealed.
Cracks, holes, and ducts. Seal all openings, line ducts and install acoustic baffles. (A/C duct!!)
Detailed, time consuming, and an expensive task conducted in special areas only. It is required for a complete counter measures survey.
- All furniture and equipment moved and examined.
- Baseboards examined for signs of modification.
Examined in detail for holes, mismatch paint, new plaster, etc
- All wiring traced and accounted for, any not in use to be removed.
- Light switches, telephone jack sockets and main outlets pulled out and examined.
- Ventilation duct covers removed and ducts examined.
- Space above plenum ceiling, and below raised floors, stages, etc. examined
This task is carried out by a technician who is familiar with the telephone equipment used.
- Handsets inspected for drop-in transmitter or writing alterations.
- All cables inspected for unusual attachments or bulges.
- Junction boxes and writing cupboards examined and all connections verified.
- Telephone distribution room wiring verified (probably the most sensitive and vulnerable area).
No electronic sweeping equipment (scanners etc.) or techniques can guarantee to find a well installed device installed by an experienced technician.
THE TYPES OF EQUIPMENT EMPLOYED IN ELECTRONICS SEARCHES
- Time Domain Reflectometry, an electronic picture of the telephone line at a particular time which is compared to the same line at a future time.
- Telephone Analyzer, an electronic analysis of the telephone instrument and of the telephone line for wiring modifications or an installed radio transmitter.
- Field Strength Meter, measures the relative radio frequency energy present at a given point, not as good as a countermeasures receiver.
- Counter-measures Radio Receiver, searches a large part of the RF Spectrum to isolate and identify a signal.
- Spectrum Analyzer, displays a large part of the RF spectrum and the corresponding side bands. It is used in conjunction with the Counter-measures Receiver to find and give a visual analysis of the signal.
- Non-linear Junction Detector, this detects such devices as microphones, recorders, transmitters (when not transmitting) etc. It looks for the ‘non linear’ junctions between dissimilar metals.
- Metal Detectors are not very reliable.
- A Pen-Register is a device used to monitor telephone calls by providing a record of all telephone numbers dialed from a particular phone and the date and time the calls were
The generation of noise at the perimeter of the secure area to cover or mask conversations.
Music is not used, as it is fairly easy to filter out from a recording, best to use ‘white’ or ‘pink’ noise.
POST SEARCH SECURITY
After a search is completed, the room must be kept very secure, or else survey cannot guarantee the room to clean when next used. If a device, or wiring alteration is found, then a decision is needed on what action is to be taken; removal or use to provide dis-information.
SAFE, VAULTS AND OTHERS STORAGE CONSIDERATIONS
Safes are designated either fire resistivE or burglary resistive.
There is no federal or state law or code mandating the rating of safes, and two organizations currently rate safes in theUS.
Safe Manufacturers National Association (SMNA), and Underwriters Laboratories (UL).
FIRE RESISTANT SAFE
Fire Resistant Safes offer very little protection against the safe cracker and once exposed to a fire the original degree of protection offered is lost, and it must be replaced. For tables which list the various categories and ratings see the Physical Security Section.
BULGLAR RESISTANT SAFE
They are available in the market for the purpose of storing
Defined as enlarged safes, usually made of high quality reinforced concrete, except the door. The five sides should be twice as thick as the door but never less than 12”. The vault door is usually made of high grade steel and normally 6” thick. Vaults are normally installed at or below ground level because of their heavy weight. It is also usual to have a clear sterile walkway around the five above base sides when installed below a buildings foundations. Ratings for vaults are established by the Insurance Services Office (ISO).
DESIGNING A PROPRIETARY INFORMATION PROTECTION PROGRAM
In developing a proprietary information protection program, it is important to remember the following:
- There is no such thing as a permanent secret of nature.
- Any scientific discovery is a link to the future, which if kept secret, can impede the next step, but does not prevent others from creating their own links.
- Restrictions on the dissemination of information may jeopardize true security by attempting to protect non-essentials.
- Research and development (R&D) cannot be envisioned without communication of the results of that effort. This principle also applies to most other forms of competitive business information as well.
- The printed word, particularly in the form of complete reports or documents, has ceased to be the principal means of communicating information. More and more vital data are being processed and analyzed electronically. This has increased the difficulty of preventing its outright loss or undetected compromise, because of the interdependence of many functions which can be remote in time and place to each other.
PROPRIETARY INFORMATION AREAS OF VULNERABILITY
PEOPLE ACTIVITIES OR EVENTS
- Disgrantled employees or former employees
- Mobile employees
- Marketing, sales representative, etc.
- Purchasing agents, buyers, subcontract administrators
- Visitors and customers
ACTIVITIES OR EVENTS
- Publications, public releases,
- Seminars, conventions, trade shows
- Handling of trash or scrap
- Survey or questionnaire
- Merger, acquisitions, joint ventures, licensing
- Reverse engineering
- Term paper, master thesis
- Plant tours, open houses
AMOUNT OF INFORMATION LOSS ACCORDING TO SOURCES
Inadvertent Disclosure 95%
Competitive Intelligence 3%
Indtrial Espionage 2%us