Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Strike Back If China Steals IP, Companies Told

Bipartisan report argues that businesses should be allowed to retrieve stolen intellectual property from attackers' networks.

The Syrian Electronic Army: 9 Things We Know
(click image for larger view)
The Syrian Electronic Army: 9 Things We Know
When online attackers operating from China or other countries steal corporate secrets, let businesses strike back and retrieve stolen information from attackers' networks.

That gloves-off approach is just one of many recommendations for combating industrial espionage outlined in a new report from the Commission on the Theft of American Intellectual Property, which is headed by the former director of national intelligence, Dennis Blair, as well as Jon Huntsman, who's served as the governor of Utah as well as U.S. ambassador to China.

"China is two-thirds of the intellectual property theft problem, and we are at a point where it is robbing us of innovation to bolster their own industry, at a cost of millions of jobs," Huntsman told The New York Times. "We need some realistic policy options that create a real cost for this activity because the Chinese leadership is sensitive to those costs."

[ For another viewpoint, read Don't Blame China For Security Hacks, Blame Yourself. ]

The report offers 21 specific recommendations, including increasing the budget of the FBI and Department of Justice to investigate trade theft and amending U.S. counter-espionage laws to allow businesses that suffer intellectual property (IP) theft to sue foreign organizations for damages. It also advocates longer-term measures, such as rating countries on their ability to protect IP, as well as ensuring that U.S. officials "push to move China, in particular, beyond a policy of indigenous innovation toward becoming a self-innovating economy."

Indigenous innovation refers to the Chinese government's current policy of investing billions of dollars for research and development in Chinese technology businesses. But according to the Organization for Economic Cooperation and Development, too much of that money goes into development and not enough into research, creating an environment in which homegrown innovation fails to flourish, in part because of piracy.

The IP Commission's report echoes that assessment, noting that "with rare penalties for offenders and large profits to be gained, Chinese businesses thrive on stolen technology." According to estimates cited in the report, China accounts for between 50% and 80% -- depending on the industry -- of the world's IP theft.

"I've often told victims the quote by David Etue, that one only need worry about the enemy who understands that they can spend $1 billion to compete with you or $10 million to steal what you developed," said Nick Selby, CEO of StreetCred Software, on the Police-Led Intelligence blog. "This report bears that concept out."

But the report also urges U.S. businesses to take the information security threat more seriously, saying that too many organizations fail to master vulnerability management practices or layered defenses.

As noted, the commission's report calls for businesses to be allowed to recover stolen IP from attackers' networks -- "without damaging the intruder's own network" -- and to prevent stolen information from being used, through legal means. The report also calls on Congress to pass laws allowing businesses to pursue "a range of more aggressive measures that identify and penalize illegal intruders into proprietary networks," provided those measures avoid collateral damage.

"Only when the danger of hacking into a company's network and exfiltrating trade secrets exceeds the rewards will such theft be reduced from a threat to a nuisance," said the report.

The report comes as many businesses are seeking terms of engagement for responding to online attacks. Currently, businesses have some latitude in how they respond, such as being able to conduct reconnaissance of suspected malicious infrastructure or socially engineering attackers -- corporate counsel permitting. But questions remain. For example, can -- or should -- businesses be allowed to hire the equivalent of cyber-Pinkertons to take the fight to online attackers?

Not everyone agrees with the IP Commission's strike-back recommendations. "This is a remarkably bad idea that would harm the national interest," said James A. Lewis, senior fellow and director of the Technology and Public Policy Program at the Center for Strategic and International Studies (CSIS), in an essay titled "Private Retaliation in Cyberspace."

"Our goal is to make cyberspace more stable and secure, not less. Endorsing retaliation works against that goal in many ways, all damaging," he said.

Furthermore, state-sanctioned retaliation could backfire. "The United States is also a leading proponent of the Budapest Convention on Cybercrime, to which we and many other countries are signatories," Lewis said. "Under this convention, private retaliation would be a crime. The victim could reasonably ask the United States to assist in an investigation and extradite those found guilty. They could then bring suit against the perpetrators in U.S. courts."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
alexcrittenden
50%
50%
alexcrittenden,
User Rank: Apprentice
5/31/2013 | 7:57:33 PM
re: Strike Back If China Steals IP, Companies Told
I haven't looked at the report, but you've obviously pulled out an interesting piece of information regarding the 'strike-back' recommendation. I have to agree with Mr. Lewis - I just don't see how this wouldn't turn into the Wild West (and not in a good way).
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19767
PUBLISHED: 2019-12-12
The Linux kernel before 5.4.2 mishandles ext4_expand_extra_isize, as demonstrated by use-after-free errors in __ext4_expand_extra_isize and ext4_xattr_set_entry, related to fs/ext4/inode.c and fs/ext4/super.c, aka CID-4ea99936a163.
CVE-2019-19768
PUBLISHED: 2019-12-12
In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrace.c (which is used to fill out a blk_io_trace structure and place it in a per-cpu sub-buffer).
CVE-2019-19769
PUBLISHED: 2019-12-12
In the Linux kernel 5.3.10, there is a use-after-free (read) in the perf_trace_lock_acquire function (related to include/trace/events/lock.h).
CVE-2019-19770
PUBLISHED: 2019-12-12
In the Linux kernel 4.19.83, there is a use-after-free (read) in the debugfs_remove function in fs/debugfs/inode.c (which is used to remove a file or directory in debugfs that was previously created with a call to another debugfs function such as debugfs_create_file).
CVE-2019-19771
PUBLISHED: 2019-12-12
The lodahs package 0.0.1 for Node.js is a Trojan horse, and may have been installed by persons who mistyped the lodash package name. In particular, the Trojan horse finds and exfiltrates cryptocurrency wallets.