$400 million corporate espionage incident at DuPont
The U.S. Department of Justice (DOJ) pulled the covers off a previously-sealed case of corporate espionage by a former DuPont scientist who stole $400-million in intellectual property from his employer.
Gary Min, pled guilty on Nov. 13, 2006 but Delaware Attorney General Joseph R. Biden III did not release the information until Thursday. Min faces up to 10 years in jail, $250,000 in fines and restitution when he goes before the court for sentencing on March 29.
“This case clearly demonstrates the seriousness with which we regard allegations of the illegal export of technology which is crucial to the security of the United States,” said Darryl Jackson, assistant secretary of commerce for export enforcement.
A 10-year veteran with DuPont at the time of the crime, Min accessed 16,706 documents and more than 22,000 scientific abstracts between August and December 2005 with the intention of giving them to Victrex, a DuPont rival. Min had been in discussions with the company for a new job since July 2005 and eventually signed an agreement in October 2005 with an intended start date in January 2006, but he left his superiors oblivious of the upcoming career change for months.
In the interim, he began accessing sensitive scientific information from the server containing DuPont’s electronic data library (EDL), where much of the company’s research is stored. During that period of time, he accessed more than 15 times as many documents as the second most active user on the EDL. Most of the documents he accessed had little to do with his job functions, the DOJ reported. According to court records, the overall value of the data he accessed exceeded $400 million.
After months of accessing the intellectual property unimpeded, Min finally informed DuPont of his upcoming departure date. Little to his knowledge, DuPont noticed his unusually high data-access rate within the EDL following his giving notice. At that point the company contacted the authorities.
“Late in 2005, our internal investigation determined that Mr. Min had apparently misappropriated a significant volume of confidential and proprietary DuPont technical documents,” said Stacey J. Mobley, DuPont senior vice president and general counsel. “We immediately notified authorities at the Federal Bureau of Investigation (FBI) and the U.S. Department of Commerce.”
While DuPont contacted the FBI to begin an investigation of the matter, Min was at work putting the final touches on his plan to transfer intellectual property to his new employer. On Feb. 2, he uploaded 180 DuPont documents on to his Victrex-issued laptop.
The next day, FBI officials contacted Victrex and explained the situation to management. The company seized Min’s laptop the next week and handed it over to investigators. Less than a week after that investigators arrived at Min’s home to search the premises.
According to their records, Min was in the process of shredding garbage bags full of DuPont documents and there were remnants of documents in his fireplace where he had set some of them ablaze. There was also hard drive deletion software installed on his computer.
According to figures from the U.S. Secret Service, 75 percent of intellectual property thefts are perpetrated by employees.
Professionals in the information security industry are growing very concerned about insider threats that include rogue employees like Min. In fact, “data leakage” was the buzz phrase du jour at the RSA Conference last week.
Security vendors are increasingly looking for ways to prevent incidents like the DuPont case from happening.
“Internal threats are on the rise,” said Wain Kellum, president of Trusted Network Technologies, who believes breaches such as these are avoidable. “They are easily preventable — you just have to be willing to have granular access policies in place and the physical network controls to be able to implement those controls.”
In Kellum’s opinion, as the dollar value of intellectual property thefts escalates, businesses are going to need to forgo the crossed-fingers method of security and find better ways to control access based on their roles within an organization.
“There are people who when it comes down to securing their critical information assets, their strategy is hope,” he said. “And what we believe is that hope is not a strategy. You have got to have very clear policy, you’ve got to implement controls on that policy and then you’ve got to audit usage.”
Click here to email West Coast Bureau Chief Ericka Chickowski.