One 2010 report issued to the U.S. government by defense company Northrop Grumman describes Chinese economic espionage as comprising 'the single greatest threat to U.S. technology.'
The feds see cyberespionage as one of three major cybersecurity concerns, the other two being cybercrime and cyber-terrorism.
We've lost the war [in cyberespionage] and we need to gain back ground." – Mark Culp, FBI San Diego Cybercrimes Division
Shocking but the black ops world of industrial espionage still has teeth even with malware infesting everything. Unfortunately a physical fortress with a network is still vulnerable – a hard learned fact causing quite a stir in the hotel industry this year. SC Magazine's Angela Moscaritolo reported several key points concerning hotel data security:
Cybercriminals last year targeted hotels more than any other industry for credit card theft, according to a recent report by data security company Trustwave.
Hotels are being targeted because they have large amounts of credit card data and frequently neglect to implement the most basic security precautions, such as changing default passwords or ensuring programs are up to date, said Nicholas Percoco, senior vice president of Trustwave's SpiderLabs.
The Hotel Technology Next Generation (HTNG), a nonprofit hotel trade association, recently issued a security standard which defines how card data should securely flow between a hotel's various systems.
Additionally, large, brand-name organizations are beginning to take data security seriously, experts said. But many others are lagging."
There's more to it than just credit card data being lost, but the same lax security principles affect your intellectual privacy as discussed previously. While there are ways to minimize risk, the ultimate reality is to simply assume that every time you leave your laptop in your hotel, someone else can and will try to gain access to it.
There are many underemployed private investigators, intelligence analysts and the like who [globally] have the ability to quickly gain access into a hotel whether through social engineering by financial incentive [Read: BRIBE] or through a cousin [Read: INSIDER]. In a conversation this last weekend with a retired LEO, the issue of a warrant to search a hotel room was mentioned in connection with our tales of war stories and 'there I was.'
The difference between law enforcement officers' approach and the private sector was underscored in the simple methods we used. Where they would get a search warrant in the course of an investigation I, acting [LEGALESE] as a private individual not acting as an agent of the law, would simply wave my investigation credentials at the clerk with a good story (sometimes accompanied by a couple dead presidents) and after a quick discussion often a room key would appear.
What's important is that this trick was much harder to do as the price of the hotel went higher. What works at a flophouse fleabag won't work as the stars go higher than two, three or four, although a well-couched bribe of ‘this cash is for the takeout pizza which will soon be delivered here – help yourself' worked much better than the gauche, overplayed technique of just handing folded bills over.
One simple rule is: Don't use them. Ever. That pretty much covers the widespread threat of hotel networks, hotel business centers. Just like gas pumps and credit card skimmers have become so thoroughly compromised, everything short of your own WWAN cell-based solution and a VPN back to your home network is to be treated as completely unsecure and compromised.
Let's talk about some of the methods to guard against the old school industrial espionage.
Rule one: You get what you pay for – justify spending more for increased security.
In my last article, I spoke about my Taiwan trip 10 years ago where I stayed (without laptop) at a low-end hotel directly across from the business I visited. While this worked out fine, as a savvy traveler I had eyeballed the state department recommendations ahead of time. Had physical safety been a factor in Taiwan, I would have bumped the accommodations up to provide another layer of security.
Taking all into consideration, after my business was concluded I made for Taipei and a higher level accommodation for my final night.
Six months later, I was bound for Mexico City to do partner training in a party of five. At the time (and currently as well), there was a state department travel advisory warning of widespread kidnapping in Mexico City, not to mention a risk of earthquakes.
After a quick discussion with another traveler who was also prior military with nearly the same security background, we agreed first on a four-star hotel and second on the justification for the extra cost being the margin of safety it offered. This followed rule one of getting what you pay for and we leveraged our available corporate experience.
Rule Two: Leverage the corporate experience you have.
The company we worked for trusted us to set the standard based on our travel experience in less than friendly areas (Somalia, Haiti, Arabian Gulf) and our entire contingent had a safe and eventless visit.
On rule two, after meeting one night at the free buffet dinner, we found each of us had separately based our theory on observing what the military did outside the U.S. when we/they had to operate (not vacation) out of civilian hotels – stay at the high-dollar ones which had higher standards of internal security. Essentially your tax dollars at work lowered our risks by spending just a bit more each night.
Side note: I've yet to be in any company which had an IT division which didn't have at least one military veteran hired. While simply being a vet doesn't make someone a security expert, in the land of the blind the one-eyed man is often king. Most global militaries have a formalized counter-intelligence program which begins in basic training. My further recommendation is to find out who of the veterans had further formalized training in anti-terrorism (AT) which is NOT the Jack Bauer / 24 stuff known as CT, and ask their opinions prior to finalizing travel plans.
Rule Three: Harden the target and make bad guys work for a living.
Let's face it, the top way to cope with jet lag is not by sleep. In the industrial espionage game, however, industrial espionage interrogations aren't a water-boarding affair – unless you count body shots done at a karaoke bar.
When in Rome, we do as the Romans do. Since 85 percent of the world's business population would be offended by a guest not partaking in a host's offer to go, we go along with, and the hardware we carry either stays in the hotel or in the host's office.
Think that part through – if, as is recommended in other Spy vs. Spy articles, you don't have the hardware then you make the bad guy work for a living. As for the human element, the acronym HOTSU is often applicable: He's Out To Screw U: whether intentionally or unintentionally, a good night getting sloshed puts your common sense into a hurt locker.
Thwart the risk by restricting the data you're carrying with you whether through file encryption (okay), or physically carrying it in a small encrypted micro-SD data drive (better), or leaving the main laptop at home (best).
Make the potential espionage bad guy work for a living. Read Spy vs. Spy: Two traveler tools under $10.
In other Spy vs. Spy articles, we'll look at more ways out of the darkness of industrial espionage. For now, answering these questions within the IT department as a process provides at least the fundamental risk assessment. For those who think that industrial espionage simply doesn't exist, I refer you to Ira Winkler, who works with Stanislav Lunev, a former GRU Colonel. Both now consult for corporate counterintelligence. Some of Col. Lunev's testimony is on record in the Senate, do a search and you'll find plenty of precedence.