Legacy Systems Threaten Security in Mergers & Acquisitions

Here’s a simple fact: Legacy systems are far more likely to get hacked. This is especially true for companies that become involved in private equity transactions, such as mergers, acquisitions, and divestitures...

We have seen two primary trends throughout 2023:

– Threat groups are closely following news cycles, enabling them to quickly target entire portfolios with zero-day attacks designed to upend aging technologies — disrupting businesses and their supply chains.

– Corporate espionage cases are also on the rise as threat actors embrace longer dwell times and employ greater calculation in methods of monetizing attacks. more

Crocs Sues Rival Joybees Over Stolen Trade Secrets...

...by former manager...

Footwear makers Crocs and rival Joybees have filed competing claims against each other in a U.S. court, as the companies clash over corporate trade secrets, intellectual property and competition in the foam clog market.

The new complaint accuses McCarvel, who was a midlevel manager at Crocs, of stealing several thousand documents containing Crocs’s highly confidential and proprietary business information, as well as the contents of an entire Crocs email account...

The complaint accuses McCarvel of using the stolen documents to build Crocs' rival shoe company, Joybees. more

Business Espionage: Quote of the Week

“...cyber threat actors target successful firms, possibly for industrial espionage,” AEI researchers said in a study released this month. “Large cash holdings increase the likelihood...” more

Step one: Identifying Your Trade Secrets

Can you identify your business’ most valuable information, how it is stored and who has access to it?

Are you sure? 

It may surprise you that even some of the most sophisticated companies in the world don’t have a proper handle on their information “crown jewels” or trade secrets until someone tries to take them. 

Now is a good time to review your business’ approach to protection of its trade secrets and other confidential information and make sure you have done everything you can to protect them.

Why now? Data is one of the most valuable assets any business has. Industrial espionage is becoming more prevalent (and sophisticated)... more

Once you know what you have to protect, install an alarm system. In this realm, Step One is creating a scheduled program of Technical Surveillance Countermeasures (TSCM) inspections.

The Spying Scandal Inside One of America’s Biggest Power Companies

A private investigator surveilled Southern Co.’s CEO, prompting an internal investigation into whether it was commissioned by another executive...

On a late spring day in 2017, a private investigator parked outside a fitness center in an Atlanta strip mall and covertly recorded video of a personal trainer as she entered her business.

Forty-five minutes later, the investigator took photos as the woman returned to her car, stowed her gym bag and drove away. He next followed her for 25 minutes to the home of her then-boyfriend, Tom Fanning, who, as chief executive of Southern Co., had for years been one of the energy industry’s most powerful figures.

Atlanta-based Southern, one of the largest utility companies in the U.S. and one of the most prominent corporate brands across the Southeast, has been bedeviled for much of the past year by the peculiar espionage effort, which led to an internal investigation but no public explanation.

Word of the surveillance surfaced last summer in a lawsuit between consultants in a firm that for decades has done work for Alabama Power, a Southern subsidiary. One of them alleged that, at the direction of Alabama Power officials, the other consultant had ordered surveillance of Southern executives in order to possibly gain internal leverage. more

Nissan Installed Covert Camera to Monitor No. 2's Home

Nissan installed a camera surveillance system at the home of former executive Ashwani Gupta so the automaker's internal security team could monitor him, according to the preliminary findings of an investigation into the surveillance, two people with knowledge of the report said.

Nissan has been investigating a claim that Chief Executive Makoto Uchida carried out surveillance of the carmaker's second- in-command to acquire leverage to remove him from the company because of Gupta's opposition to some terms in a new partnership deal with Renault. more

China’s Corporate Spy War

CNBC Documentaries examines the case of a Chinese government spy who tried to steal secrets from some of America’s biggest companies and delves into the shadowy world of economic espionage that could endanger millions of U.S. jobs. more

A Tale of High-Stakes Corporate Espionage... a cautionary tale.

When Chinese tech giant Huawei learned it was set to lose a $200 million contract, a run-of-the-mill equipment deal spiraled into a saga of hidden microphones, drone encounters and covert surveillance, according to investigators for a Danish telecoms firm. Bloomberg reporters crisscrossed Copenhagen for the tale of TDC’s 5G showdown, in which technology, business and national security collide. more

No business is immune. Help is available. Click here. 

Corporate Espionage - Legal or Illegal? (The Full Story)

Corporate espionage, or economic or industrial espionage, involves stealing or illegally acquiring trade secrets and confidential information from a company or organization. This process, which may also include practices such as bribery, blackmail, and surveillance, is a growing concern for businesses in various industries. Companies may engage in such activities in an increasingly competitive global market to gain a competitive advantage or undermine competitors.

The legality of corporate espionage is a complex subject, as it encompasses various actions and laws depending on the jurisdiction. Corporate spying may be considered illegal under various statutes that protect intellectual property, trade secrets, and economic interests. However, there are instances where certain espionage activities may fall within legal limits, especially in cases where information is obtained from public sources or through legitimate means... more

(Now that you know, protect yourself.)

77 Industrial Espionage Arrests

South Korean police have arrested 77 people involved in 35 cases of suspected industrial espionage discovered during a recent nationwide investigation, Yonhap news agency reported on Sunday.

Most cases only involved domestic companies, although eight were related to the leak of technology secrets to China or other countries, Yonhap quoted the National Police Agency as saying...

The number of international cases was double that of a similar probe conducted one year ago, Yonhap said, citing police data. more

Blackmail with Email, or The Employer's Lawyer Destroyer

Last month, Lewis Brisbois Bisgaard & Smith, one of the nation’s largest law firms, was rocked by the announcement that two top partners were starting their own boutique practice and taking as many as 140 colleagues with them.

The shock inside Lewis Brisbois’ downtown Los Angeles headquarters soon gave way to anger... over the weekend, Lewis Brisbois struck back.

In an extraordinary move, its management team directed the release of scores of emails in which Barber and Ranen used vile terms for women, Black people, Armenians, Persians, and gay men and traded in offensive stereotypes of Jews and Asians. In one fell swoop, the venerable firm managed to torpedo its new rival, destroy the defecting partners’ careers and send the legal establishment reeling. more

-----

“Say it with flowers,

Say it with mink,

But never, ever say it with ink."

-----

Business Espionage: The Employee Competitor… and what to do about it

Cautionary Tale: Commercial Espionage - Bugging of Business Meetings

The billionaire owners of the Telegraph newspapers say their businesses are in good shape following claims they are on the cusp of receivership...

The sale of the Ritz hotel in London in 2020 exposed a bitter rift between the two families of the twins, with claims of commercial espionage over the bugging of business meetings.

At the centre of the affair was CCTV footage allegedly showing Sir Frederick's nephew handling a device. It saw the billionaire and his daughter, Amanda, sue three of Sir David's sons for invasion of privacy...

One person close to the talks said the banking group's patience over the debt was "running out", the FT said. more  previous coverage

Corporate TSCM Information Security Inspections - Myths, Excuses & Reality

There are some myths and excuses that really need to be debunked.

(Not sure what a TSCM inspection is. Check here first.) 

TSCM SECURITY INSPECTION MYTHS and EXCUSES

Espionage is a Covert Act

Excuse: “I don’t see that we have a problem. No one is bugging our offices and boardroom.” 

 

Reality: The first rule of espionage is, “Be invisible.” You won’t know if you are being eavesdropped on if you never check.

Fear of being Labeled Paranoid

Myth: Peer pressure from upper management. 

 

Reality: Most top management appreciate proactive security thinking from their staff.

Lack of Awareness

Excuse: Yes. 

 

Reality: A lack of awareness of the risks associated with electronic eavesdropping, or the need for TSCM security inspections is common. Management may be unaware of TSCM as an available countermeasure.

Cost

Myth: TSCM inspections can be expensive. The costs involved in hiring a professional TSCM specialist, or purchasing specialized equipment, and conducting regular inspections can be a deterrent to scheduling TSCM inspections. 

 

Reality: Espionage losses are more expensive, much more. Hiring a TSCM specialist is very cost-effective, if you hire a competent firm. TSCM inspections are cheap insurance. Actually, better than insurance; TSCM can prevent the loss in the first place.

Perception of Low Risk

Excuse: Some businesses may believe that the risk of electronic eavesdropping is low in their industry or specific workplace. They might assume that their organization does not hold valuable or sensitive information that would attract eavesdroppers. 

 

Reality: Being “in business” means having a competitive advantage, and others do want it.

Lack of In-House Expertise

Excuse: Conducting TSCM inspections requires specialized knowledge and equipment. If a business does not have the expertise in-house they may choose not to pursue these inspections. 

 

Reality: Hiring an information security consultant–who has TSCM as their speciality–is the solution.

 

More TSCM Security Inspection Myths & Excuses

Fear of Disruption

Myth: TSCM security inspections can temporarily disrupt normal business operations. The process involves sweeping the premises, potentially causing interruptions or inconveniences to employees or ongoing activities. Some businesses might be reluctant to undergo such disruptions. 

 

Reality: Most inspections are conducted after business hours. When necessary, a TSCM team will assume the same dress and demeanor as employees, have a plausible reason for being in the area, and will work around employees so as not to disturb them.

Trust in Existing Security Measures

Excuse: Businesses may have confidence in their existing security measures, such as physical security, cybersecurity, or access controls. They might believe that these measures are sufficient to protect against eavesdropping and thus forego TSCM security inspections. 

 

Reality: Experience has shown that do-it-yourself security measures are never sufficient to protect against eavesdropping and other forms of information loss. TSCM inspections always identify vulnerabilities and provide recommendations for improvement.

Lack of Legal or Regulatory Requirements

Excuse: Depending on the industry or geographical location, there may be no legal or regulatory obligations that mandate TSCM inspections. In the absence of such requirements, businesses may choose not to prioritize these inspections. 

 

Reality: The financial success of a business should be a more effective motivator than a legal requirement.

Perception of Invasion of Privacy

Myth: TSCM security inspections are invasive or a breach of employee privacy. They might fear that conducting such inspections could harm employee morale or create an atmosphere of distrust. 

 

Reality: Employees appreciate security measures which protect their livelihood and personal privacy. When an employer demonstrates care for information security, employees will act more carefully too.

Limited Resources

Excuse: Small businesses or those with resource constraints may prioritize other operational needs over TSCM security inspections. They might allocate their limited resources to other critical areas or invest in measures they perceive as more immediate concerns. 

 

Reality: Defense is mandatory for survival. Budget waste and misallocation can usually fund TSCM security inspections without added expense, once corrected.

Overconfidence

Excuse: Some businesses might have a sense of overconfidence in their security measures, believing that they are already adequately protected against electronic eavesdropping. This false sense of security can lead to complacency and a disregard for TSCM inspections. 

 

Reality: These businesses are at-risk.

Carefully assess the risks in your workplace. Schedule TSCM security inspections, because… corporate espionage is not a myth.

###

Murray Associates is an independent technical information security consulting firm. They provide electronic surveillance detection and counterespionage services to business, government and at-risk individuals.

Headquartered in the New York metropolitan area, a Murray Associates team can assist you quickly, anywhere in the United States, and internationally.

The Mail Room Guy and the USB Spy Cable

Someone "lost" a USB charging cable. You found it. Lucky you? Maybe not...

USB spy cables look exactly like legitimate ones... exactly. 

In this example, the competition has paid an inside employee (the Mail Room guy) to drop a few cables around certain parts of the corporate headquarters. They didn't tell him why. And, he doesn't care. Why should he? He gets $50 per cable dropped.

Once plugged in, the cable takes control of your device. (cell phone, laptop, desktop, etc.) All your data becomes accessible. Next, pre-loaded penetration tools spring into action.

The connection can be used as a pivot point to attack other computers on the network. This is controlled remotely by the spy/hacker, via Wi-Fi to the internet, or via their nearby smartphone.

Once the hacker has infiltrated your network, more data can be extracted, viruses planted, or a ransomware attack staged. Obviously, this is dangerous in a business environment.

Recommendations:
• Mark your cables so if swapped you'll notice.
• Call us. We test USB cables as part of our debugging sweeps.
• If you use our services, we will give you a free test instrument so you can test new cables yourself.

Why More Businesses Are Not Conducting Periodic TSCM Inspections

IT & Security Pros Pressured to Keep Quiet About Data Breaches

Organizations globally are under tremendous pressure to address evolving threats like ransomware, zero-day vulnerabilities, and espionage, and they face challenges in extending security coverage across multiple environments and dealing with an ongoing skills shortage, according to Bitdefender.

Alarmingly, more than 42% of the total IT/security professionals surveyed said they have been told to keep a breach confidential when they knew it should be reported and 30% said they have kept a breach confidential.

43% of IT/security professionals surveyed said extending capabilities across multiple environments (on-premises, cloud, and hybrid) is the greatest challenge they face which tied with complexity of security solutions also at 43%.

Not having the security skill set to drive full value came in as a strong second at 36%. more

This is an old phenomenon. We call it The Ostrich Effect.

KamiKakaBot: Corporate Espionage & Eavesdropping Tool

Suspected government-backed hackers are attacking...with malware called KamiKakaBot that is designed to steal sensitive information. Researchers from Amsterdam-based cybersecurity firm EclecticIQ attributed the attacks to the advanced persistent threat (APT) group Dark Pink...

Dark Pink's main goals were to conduct corporate espionage, steal documents, capture sound from microphones of infected devices, and exfiltrate messaging data, according to research by cybersecurity firm Group-IB. more

A New National Cybersecurity Strategy

State-sponsored cyberattacks and corporate espionage are becoming a bigger concern with each passing year, often resulting in millions of dollars in damages. Attackers are making off with critical data as governments, businesses, and cybersecurity experts struggle to protect citizens and customers. As of now, individuals and small businesses are on their own when attacked, but the Biden administration wants to change that and make multibillion dollar tech firms more accountable for Americans' digital safety.

The White House on Thursday unveiled a new National Cybersecurity Strategy to make cyberspace more secure for Americans. The new policy puts the onus on tech firms and large organizations to make their systems more secure, so that they are better able to resist the increasingly more sophisticated cybersecurity threats from around the world.

Explaining its stance, the Biden administration said that the "organizations that are most capable and best-positioned to reduce risks" should do more to ensure the online safety of American citizens rather than shifting the burden of cybersecurity to individuals, small businesses, and local governments. more

My 2012 cunning plan to really protect sensitive information may be catching on... 

"Impose a legal responsibility to proactively protect National Interest Assets. Hold the corporate caretakers of our economic future accountable for protecting their valuables. Create standards of protection. Provide penalties for inadequate or negligent protection. Enforce compliance before the theft occurs."

Legal Claim: Glimpse into World of Corporate Espionage

Covert cameras and alleged hacking: how bust payments company Wirecard ‘hired spies and lawyers to silence critics’... 

The claim, which has just been lodged in London’s high court, details allegations of covert surveillance by Kroll, and hacked communications and proposals for hi-tech attacks to intercept mobile phone data by other unknown operators.

Through its lawyers Kroll said that it had “acted entirely in accordance with all applicable laws and regulations”, that Earl’s claim was “misconceived” and that the company denied the claim in full. Jones Day did not respond to requests for comment.

Whether or not the legal claim against Jones Day or Kroll succeeds, the case, and emails disclosed in it, provide a rare glimpse into the murky world of corporate espionage and reputation management – and the lengths to which some companies will go to try to silence critics. more

"Technical Surveillance Countermeasures Market (TSCM) Is Likely to Experience a Tremendous Growth by 2029"

(Orion Market Research reports, with explanation links added.)

Technical surveillance countermeasures market (TSCM) is anticipated to grow at a significant CAGR during the forecast period. The emergence of wireless technology and Internet of Things technology, growing adoption of espionage device detecting systems in various sectors such as commercial, government, industrial, defence and aerospace, and rising demand for modern surveillance technologies are some of the major factors, that are expected to fuel the technical surveillance countermeasures (TSCM) market demand, during the forecast period.

TSCM, also referred to as digital bug sweeping, entails detection and identification of the presence of technological surveillance hazards and devices, including hidden microphones, cameras, or other electronic devices. It offers thorough instrumented, and, physical and visible evaluation of a facility's technical security status. This system not only detects and locates espionage devices, however, additionally identifies various regions, where an enterprise has a risk factor to lose any vital information through illicit eavesdropping devices or systems such as electronic bugs, hidden cameras, listening devices, cellular interception, Bluetooth interception, burst transmitters, laser microphones, among other devices. more

• Security Companies: Add TSCM to your services menu.

• Corporate Security Departments: Add TSCM to your enterprise services.

In-house, or contract... Contact Murray Associates TSCM for free turnkey advice.