A Spy in the Office

[InfoSec News <isn () C4I ORG>]

http://www.montrealgazette.com/news/pages/000723/4497311.html

Foreign intelligence agencies busy in our businesses, CSIS warns

LEVON SEVUNTS
7/23/00
The Gazette

Attention, high-tech managers: Do you have an employee or a colleague
who is really eager to work overtime or come in during weekends?

Before rewarding such zeal, check with your security department: such
an employee could be working for one of the 25 foreign intelligence
agencies spying on Canadian companies.

The startling estimate comes from the Canadian Security and
Intelligence Service, which says that Montreal's aerospace,
biotechnology, chemical, communications and information-technology
companies are all prime targets for economic spying.

"Given sufficient motivation, every country will engage in economic
espionage," CSIS spokesman Jim Comeau said. And that includes our
closest allies - as well as ourselves.

Mike Frost, who used to work for Canada's Communications Security
Establishment (CSIS's sister agency, which monitors communications
systems), claims that in the early 1980s the Canadian government was
eavesdropping on the U.S. embassy in Ottawa, using U.S.-produced
technology.

In 1982, Frost says in his autobiography, Spyworld, the CSE overheard
U.S. Ambassador Paul Robinson discussing a pending grain sale to
China. Using information thus gained, the Canadians were able to
underbid the Americans and secure a $2.25-billion contract.

When the stakes are that high, the simple fact of international life
is that there's no such thing as a friendly nation.

Ghislain Levesque, an economic-espionage investigator with CSIS's
regional bureau in Montreal, says espionage costs Canadian companies
billions in lost contracts, jobs and markets, and a diminished
competitive edge.

CSIS officials could offer no such dollar figure for Canada, but the
U.S. Chamber of Commerce has said that losses to the American economy
from economic espionage amount to about $2 billion every month.

For more than eight years, CSIS has been trying to educate business
executives about economic espionage, through a liaison and awareness
program.

As a part of that program, CSIS officers give presentations about
economic spying to the leaders of Canada's public and private
companies.

"Our message to Canadian companies," Levesque said, "is that if you
think you have a jewel - a unique technology, scientific or marketing
expertise - you have to protect it. And we can show you how to do it."

In exchange, these companies are supposed to let CSIS know when they
feel that they have been targeted.

Ideally for CSIS, that should allow the spy agency to keep an ear to
the ground without actually having to put a counterintelligence
officer in every high-tech company.

But relations between businesses and CSIS are far from rosy.

"Companies are often reluctant to admit that they've been targeted by
foreign spy agencies, because they fear adverse effects on share
prices and the company's reputation," Levesque said.

Corporate security specialists, on the other hand, charge that the
CSIS itself is not always forthcoming with information, for fear of
compromising sensitive sources or methods.

"If they come to me and ask for information without explaining why
they need it, I won't give them anything," said Darell Booth, head of
security of Mitel Corp. of Kanata, Ont.

Two years ago, Mitel had what it believes was a brush with economic
espionage.

The company alleges that one of its employees, To Van Tran, conspired
with Vietnamese government officials to defraud Mitel and steal
sensitive technical data on its cutting-edge PBX (private branch
exchange) telephone-switching system.

Tran, arrested by the Ontario Provincial Police in March 1998, was
charged with fraud and possession of stolen property, because the
Canadian Criminal Code has no specific section covering economic
espionage. Tran is to appear in court on Aug. 15.

"We thought that since a foreign government is involved, we have to
notify CSIS, but they weren't able to help us at all," Booth said.
"They had no contacts in Vietnam and no powers. Frankly, I don't
understand how they can work, the way they are set up with all that
red tape."

Many security experts agree with Booth. In an increasingly globalized
marketplace, they say, the weak and restricted intelligence capability
of CSIS puts Canadian businesses at a disadvantage compared with other
industrialized nations, which do not shy away from using their
offensive-intelligence capabilities to promote the interests of their
flagship companies.

Al Hensler agrees. Hensler is a former CSIS assistant director who has
been a vocal advocate for the establishment of Canada's own
foreign-intelligence agency - as opposed to CSIS, which is not allowed
to spy on foreign governments abroad.

"During the Cold War, our allies shared their political and military
intelligence with us, but now the focus is shifting toward economic
intelligence," Hensler said. "Americans are not going to share
economic information with us. The reality has changed."

During negotiations on setting up the North American Free Trade
Agreement, "some Ottawa bureaucrats thought that we shouldn't spy on
Americans, that it was unethical," he said.

"But Americans were spying on us. If you don't use your intelligence,
how do you know that you are getting the best deal?

"If, let's say, Bombardier is negotiating a deal and is being
undermined by unfair trade practices, the CSIS can offset that by
warning Bombardier and the concerned Canadian government agencies."

David Harris, former head of strategic planning for CSIS, does not
agree that the agency should use its intelligence efforts help
individual Canadian companies. "Using offensive intelligence to
promote interests of Canadian businesses raises all kind of tricky
questions," he said. "Who will receive this intelligence? Are we going
to play favourites? And not least, in this fluid business environment,
what is a Canadian company?"

Hensler's response: "The same questions were raised by the Americans,
but they found a way around them. So can we. Every billion in lost
contracts translates into roughly 12,000 lost jobs."

Despite the concerns, the CSIS liaison and awareness program is
growing in popularity with business executives. The agency estimates
that it has given more than 2,000 presentations across Canada since
1992.

"We show them their vulnerable points," Levesque said. "Business
executives are most vulnerable abroad. Foreign intelligence agencies
collect up to 60 per cent of their information on their own soil."

Methods can range from simple wiretapping and electronic eavesdropping
to outright theft. The French intelligence agency DSGE is said to have
bugged the first-class cabins of Air France jets to eavesdrop on
traveling foreign business executives. Bugging of hotel suites and
phone wiretaps are perfectly legal in many countries.

Theft of laptop computers is a common way of gathering corporate
intelligence. "I always say in my presentations," Levesque said, "that
before taking a foreign trip, executives must do a mental check of
what's on their laptop hard drive; they should take only the
information that is absolutely necessary.

"Don't take your entire company in your laptop; you may lose it all."

Security specialists warn that sensitive documents should never be
left in a hotel room. "In many countries, intelligence services and
the hotel security often exchange little favours," Levesque said.

Victor Ostrovsky, a defector from the Israeli spy agency Mossad, says
in his book By Way of Deception that Mossad, which was famous for its
lock-picking talent, had a collection of keys to most hotels in
Europe, North America and the Middle East. British intelligence used
to send locks for testing in Israel; Mossad would figure out how to
pick a new model of lock, but would send back a report saying that the
model was unpickable, he says.

The principal spy agency of the old Soviet Union, the KGB, used to
have an office in each major hotel in the country, and virtually all
hotel employees were coerced to report on foreigners. The KGB's
successor, the Federal Security Service (known under the Russian
acronym FSB), continues this tradition.

Russians are famous for using escort agencies to collect information
on visiting dignitaries and business executives. Imagine the
information you can pump from a half-drunk and completely satisfied
visiting businessman.

Levesque also teaches his students never to get into the first cab
that pulls over in a foreign city. If you're an espionage target, the
driver may be a bit overqualified and will probably speak English
and/or French, though he may pretend not to, he said.

Trade shows and job fairs can also be gold mines of information and
contacts, not only for legitimate business people but for intelligence
agencies. The Federal Bureau of Investigation in the U.S. estimates
that one in 50 people at any given trade show is gathering
intelligence for a foreign power.

ISN is hosted by SecurityFocus.com
---
To unsubscribe email LISTSERV () SecurityFocus com with a message body of
"SIGNOFF ISN".