The Scale and Impact of Industrial Espionage and Theft of Trade Secrets Through Cyber
Total Page:16
File Type:pdf, Size:1020Kb
The scale and impact of industrial espionage and theft of trade secrets through cyber Written by PricewaterhouseCoopers December – 2018 The scale and impact of industrial espionage and theft of trade secrets through cyber EUROPEAN COMMISSION Directorate-General for Internal Market, Industry, Entrepreneurship and SMEs Directorate F — Innovation and Advanced Manufacturing Unit GROW-F.5 — Intellectual property and Fight against Counterfeiting Contact: Jorge NOVAIS GONCALVES E-mail: [email protected] European Commission B-1049 Brussels 2 The scale and impact of industrial espionage and theft of trade secrets through cyber Europe Direct is a service to help you find answers to your questions about the European Union. Freephone number (*): 00 800 6 7 8 9 10 11 (*) The information given is free, as are most calls (though some operators, phone boxes or hotels may charge you). LEGAL NOTICE This document has been prepared for the European Commission however it reflects the views only of the authors, and the Commission cannot be held responsible for any use which may be made of the information contained therein. More information on the European Union is available on the Internet (http://www.europa.eu). Luxembourg: Publications Office of the European Union, 2018 ISBN 978-92-79-77355-6 doi: 10.2873/48055 © European Union, 2018 Reproduction is authorised provided the source is acknowledged. Printed in Belgium Image(s) © artist's name + image #, Year. Source: Fotolia.com (unless otherwise specified) 4 The scale and impact of industrial espionage and theft of trade secrets through cyber Table of contents 1. EXECUTIVE SUMMARY ........................................................................................ 7 2. INTRODUCTION AND SCOPE OF THE STUDY ...................................................... 10 3. METHODOLOGY FOR THE PREPARATION OF THE STUDY .................................... 13 3.1. Desk Research .......................................................................................... 13 3.2. Interviews ................................................................................................ 13 3.3. Online Questionnaire ................................................................................ 14 3.4. Workshop “Industrial Espionage In A Digital World” ............................... 14 3.5. Aggregation of Results Obtained .............................................................. 14 4. LITERATURE REVIEW ON CYBER THEFT OF TRADE SECRETS .............................. 15 5. STAKEHOLDER CONSULTATION ......................................................................... 19 6. KEY FINDINGS OF THE STUDY ........................................................................... 22 6.1. State of the Threat ................................................................................... 22 6.1.1. Threat and Trends. Current Risks and Growing Concern........................... 22 6.1.2. The (In)ability to Detect Cyber Intrusions and Lack of Awareness........... 24 6.1.3. Impact on Companies and Organisations ................................................. 26 6.1.4. How Targeting Changes from One Company to Another: Sector, Size and Country .............................................................................................. 29 6.1.5. Cyber Theft in the SME Environment ........................................................ 32 6.2. Prevention, Mitigation and Reporting ....................................................... 35 6.2.1. Risk Management and Adoption of a Multi-disciplinary Approach to Develop Cyber Theft of Trade Secrets Frameworks .................................. 35 6.2.2. Investments to Prevent Cyber Theft of Trade Secrets .............................. 39 6.2.3. Awareness and Training ........................................................................... 41 6.2.4. The EU Policy Background and its Coordination Action ............................. 42 6.2.5. Law Enforcement ..................................................................................... 47 6.2.6. Incident Reporting Schemes .................................................................... 48 7. RECOMMENDATIONS TO ADDRESS THE CHALLENGE .......................................... 52 8. CONCLUSIONS ................................................................................................... 57 ANNEX A: METHODOLOGY FOR THE PREPARATION OF THE REPORT ......................... 60 Revision of the Literature Review and the Stakeholder Consultation ................. 60 Integration of the Stakeholder Consultation ..................................................... 61 Refinement and integration of recommendations to address the challenge ....... 63 Preparation of the Event and the Dissemination Report .................................... 63 ANNEX B: CASE STUDY PROTOCOL ............................................................................ 65 ANNEX C: CASE STUDIES IDENTIFIED ....................................................................... 67 ANNEX D: SURVEY QUESTIONNAIRE ......................................................................... 71 ANNEX E: WORKSHOP REPORT – INDUSTRIAL ESPIONAGE IN A DIGITAL WORLD .......................................................................................................................... 93 ANNEX F: THE DIRECTIVE ON SECURITY OF NETWORK AND INFORMATION SYSTEMS (NIS DIRECTIVE) ............................................................................. 109 ANNEX G: THE EUROPEAN UNION AGENCY FOR NETWORK AND INFORMATION SECURITY (ENISA) .......................................................................................... 111 ANNEX H: THE US STRATEGY IN PREVENTING AND MITIGATING CYBER THEFT OF TRADE SECRETS.......................................................................................... 112 ANNEX I: COMPREHENSIVE BIBLIOGRAPHY ........................................................... 115 5 The scale and impact of industrial espionage and theft of trade secrets through cyber List of Acronyms APT Advanced Persistent Threat CEO Chief Executive Officer CERT Computer Emergency Response Team CIO Chief Information Officer CISO Chief Information and Security Officer CSIRT Computer Security Incidents Response Team CTO Chief Technology Officer CYSPA (European) Cyber Security Protection Alliance DoD Department of Defense (United States) EC European Commission EDA European Union Defence Agency ENISA European Union Agency for Network and Information Security EOS European Organisation for Security EU European Union EUROPOL EC3 European Union Agency for Law Enforcement Cooperation, European Cybercrime Centre FSB Federation of Small Businesses GDPR General Data Protection Regulation ICT Information and Communication Technology IFSR International Financial Reporting Standards IP/IPRs Intellectual Property/Intellectual Property Rights ISAC Information Sharing Analysis Centre ISO International Organization for Standardization IT Information Technology LEA Law Enforcement Agency NCSC National Cyber Security Centre (UK) NIS (directive) Directive on the security of Network Information Systems NIST National Institute of Standards and Technology PoC Point of Contact PPP Public Private Partnership R&D Research and Development SME Small and Medium Enterprise 6 The scale and impact of industrial espionage and theft of trade secrets through cyber 1. EXECUTIVE SUMMARY The past decade has seen rapid development in the field of information technology and a digital revolution that has provided unprecedented benefits to the European society and economy, facilitating trade and the provision of services, creating new opportunities for businesses and boosting productivity and economic gain. While a better-connected world offers new opportunities, there are also new risks. This study focusses on investigating the impact on European businesses and organisations of a specific type of cyber incident, namely cyber theft of trade secrets. Information represents a pivotal economic asset for businesses, which rely on confidentiality of data as a key for their industrial progress, crucial for the development of their innovation process and their economic growth. The study is based on an extensive literature review complemented by stakeholder engagement, namely through an online survey, interviews with key stakeholders and a workshop organised in cooperation with the services of the European Commission (EC) in Brussels on 4th October 2018. Industrial espionage is a method employed throughout history. Europe is particularly vulnerable to this threat. Because of its first class industrial and academic research and development (R&D), Europe attracts interest from emerging countries and competitors. The Tilburg University confirmed this trend in 2015, estimating that “20% of European companies suffered a breach”.1 The study demonstrates that European businesses are particularly exposed to this kind of threat, because of their advanced know-how and production development. In fact, national businesses in Italy (36%), France (24%), Germany (20%) and The Netherlands (17%) topped the list as the Europeans who fear cyber espionage the most.2 Among these countries, the analysis reveals that German companies are most affected with 17% of them declaring sensitive data stolen between 2015 and 2017. Sectors with distinctive industrial expertise are targeted more often, such as luxury manufacturing in Italy or finance in the UK. At European Union (EU) level, manufacturing, information and