International Law

Who's Stealing Your China Trade Secrets?

By Dan

Smiling faces, sometimes, hey, they don't tell the truth.

Smiling faces, smiling faces, tell lies and I got proof.

Hey, your enemy won't do you no harm, cause you'll know where he's coming from.

Don't let the handshake and the smile fool ya, take my advice I'm only try' to school ya.

From the song, "Smiling Faces Sometimes," by The Undisputed Truth

The Wall Street Journal's Joseph Sternberg recently wrote an interesting article, entitled "China WikiLeaks Itself" and subtitled, "Perhaps the threat of cyber crime will finally lead to a long-awaited intellectual-property epiphany." The thrust of the article is that companies should worry less about losing their trade secrets and Intellectual property lost by outsider hacking and start worrying more about having those things taken by insiders:

Sternberg writes that the information being published by Wikileaks does not evidence "a hacking problem per se so much as a theft problem exacerbated by the Internet's ability to rapidly disperse information." Insiders are the biggest threat:

The fundamental information-security threats are not so different in China compared to the rest of the world. Insiders remain the biggest problem. Hackers can do some damage simply by being disruptive—as with the group that crashed the websites of Amazon, Visa and MasterCard in connection with WikiLeaks. But hackers can do significant damage if they know what information to steal and how to exploit it. Most outsiders won't. Therefore they stick to hacking bits of information that are easily identified and used, such as strings of credit-card numbers zipping between customer and merchant in the ether.

The article briefly sets forth possible defenses:

Rather, companies need to do a better job of understanding which of their many bytes of data are valuable, and why, and to whom. Only then is it possible to design systems to protect those data. For instance, a manufacturing company might allow only a handful of engineers to access particularly sensitive product designs. A mobile-phone handset manufacturer might limit the number of programmers with access to the source code for the software that makes the phones work. 

Nothing really earth-shattering here, but in my experience, many companies simply do not want to accept that their "own people" are usually their biggest threat. This is particularly true of SMEs, who for reasons of cognitive dissonance, so much want to believe that their treatment in China will be different from that of others. I do not want to be too cynical here, but in my experience (and this is true not just in China, but everywhere) companies are much more likely to lose trade secrets through the people they know than through strangers. The reason for this is obvious: it takes knowledge of the secret to be able to pilfer it.

What do you think?

Full post as published by China Law Blog on December 28, 2010 (boomark / email).