Counterintelligence Program
Lockheed Martin Aeronautics
Blink Today…Gone Tomorrow
J. Kuhnell Counterintelligence Program Manager
1 Overview • Counterintelligence mission vs. Cowgirl mission • Lockheed Martin Aeronautics CI Program • Analogy … Education On More Than Just the Obvious • Aeronautics CI Education Pillar • What is Counterintelligence? • Perspective Change • What Are The Threats? • Foreign Intelligence Service (FIS) Recruitment Cycle • Insider Threat • External Threat • Foreign Visits • Counterintelligence THEN • Classified Vs. Proprietary • Counterintelligence NOW • Trends • Suspicious Contact Reports (SCR) & The Value of Reporting
• Conclusion 2
What is Counterintelligence to me?
3 AERO CI PROGRAM
Education & Compliance
Investigations
Assessment & Analysis
External Agency Collaboration
The Four Pillars 4 Analogy
Your task is to move a single line so that the below false arithmetic statement becomes true IV = III + III
5 Analogy
Did you get it right?
In this example you would move the first Roman Numeral I to the right side of the numeral V so that it reads VI=III+III. VI = III + III
6 The Point
– Employees may be able to correctly identify their company is a target because it requires a fairly obvious approach. IV = III + III VI = III + III
7 A Much More Challenging Equation to Fix
Again, the task is to move a single line so that the below false arithmetic statement becomes true III = III + III
8 Reason this is so difficult
Did you get it right? III = III +Not soIII easy this time. III = III = III
People are not used to thinking about the operator in an equation, they fix their attention and restrict it to the obvious
9 The Point: A Much More Challenging Equation to Fix
– Many employees may not be able to correctly identify they are a target because of a “not so obvious” approach III = III = III
10 Our Challenging Equation
“1 in 1,000 persons in a position of trust are eligible targets for recruitment” Bruce Held, Director of Intelligence and Counterintelligence for the Department of Energy and 25 year CIA veteran
Education: Consider the Operator What’s the Chance that an employee will file a SCR?
No one can say for sure, however, a prepared mind increases that chance.
Our Mission: Prepare LM Minds to pay attention to and REPORT the “not so obvious”.
“Chance favors the prepared mind” Louis Pasteur
12 Education Pillar
• Education: – Protect Our Technology – External & Internal Threats – Why it is important to report (SCR’s) • Don’t restrict your observations to the obvious
13 What is Counterintelligence?
• Counterintelligence (CI) is information gathered and activities conducted to identify, deceive, exploit, disrupt, or protect against espionage, other intelligence activities, sabotage, or assassinations conducted for or on behalf of foreign powers, organizations, or persons, or their agents, or international terrorist organizations or activities. Executive Order 12333
• Simply stated: CI is about identifying the threats and developing mitigation strategies to address those threats.
14 Perspective Change
“Espionage used to be a problem for the FBI, CIA and military, but now it's a problem for corporations…” Joel Brenner, ODNI, 2008
Government Private Industry
Corporate proprietary, Classified information intellectual property, pre-classified research
US technological edge and National Security financial prosperity
Foreign Nations Industry Competition
15 Courtesy of Washington Post, April 2008 What Are The Threats?
• Insider Threat – Employees with access to information • Acting on behalf of FIS • Acting in furtherance of self interests • External Threat – Foreign Intelligence Service (FIS) – Foreign and Domestic Industry Competitors – Criminal and Terrorist Organizations
16 FIS Recruitment Cycle
Bruce Held, Former CIA SPOTTING
TERMINATION ASSESSING
HANDLING RECRUITMENT
17 18 Insider Threat
What causes someone to commit espionage?
• Divided Loyalty – (Camp of The Enemy) • Disgruntled – (Wanting Revenge) • Ego – (Bragging about What You Know) • Financial Gain – (Money)
“I was angry all the time…I had an overwhelming need to lash out (at the FBI)…and strike out…I wanted to hurt them.” Earl Pitts, FBI Agent
“I am an American citizen, but I strongly feel that I am still a Korean. While carrying out classified work for the US government, I was not able to shake off that feeling.” Robert Kim, US Navy Analyst 19 Courtesy of CI CENTRE and SPYPEDIA Insider Threat
Successful Insider Threat Detection Program MUST be proactive!
• Education – “Get Smarter” NCIX – “Betrayed” FBI – The Hunch – Presentations – Posters and Hand-outs
• Information Assurance
• Security
• YOU 20 Courtesy of FBI.gov and NCIX.gov External: What Are the Methods?
• Direct requests for information
• Suspicious work offers
• Exploitation of joint ventures and/or research
• Acquisition of technology and/or companies
• Co-opting of former employees
• Soliciting employment
21 External: What Are the Methods?
• Targeting cultural commonalities
• Recruitment of third parties
• Electronic surveillance
• Searches of hotel rooms and/or luggage
• “Honey pot” scheme
• Inappropriate conduct during facility visits
22 Foreign Visits
• Suspicious Indicators
– Last minute additions or changes to visit party
– An agenda different than stated purpose
– “Wandering” visitors
– Asking questions outside the scope of the visit
– Visitors accompanied by embassy officials who attempt to conceal identity during commercial visit
23 Counterintelligence THEN...
• Focus primarily on US Classified information – penetrations of Intelligence Community and DoD
• Emphasis on military technologies
• Lengthy recruitment and vetting periods
• Heavy reliance on volunteers
• Difficulty in moving documents
“I took a huge document and another huge document with me, went across the hall into an unsecured room, laid the documents out on the table, and had my camera ready, and started photographing...” Jeff Carney, USAF, spy for Germany 1982-1991
24 Courtesy of CI CENTRE and SPYPEDIA Classified vs. Proprietary
• Classified information has always been a highly sought-after target for adversaries and must be properly safeguarded
• We CANNOT discount the appeal of proprietary information and the implications if compromised
“US intelligence officials put the cost of lost sales due to illicit appropriation of technology and business ideas at between $100 billion and $250 billion a year.”
Financial Times, January 2011
25 Jeffrey Carney (“Cincinnati Kid”)
• Air Force Linguist; stationed in West Berlin
• Held a TOP SECRET/SCI security clearance
• Spied for East Germany 1982-1989
• Wanted to defect; was convinced to spy instead
• Motivated by disgruntlement with U.S
• Passed originals and copies of classified documents to Stasi (German Ministry for State Security)
• Information passed was used for East German and Soviet military superiority 26 Courtesy of CI CENTRE and SPYPEDIA and Hanford DOE.gov Counterintelligence NOW...
• Focus has expanded to Corporate America’s proprietary information, pre-classified research
• Internet and social media dramatically cut down on recruitment cycle
• Expansion of adversaries’ methods
• Advancements in technology aid in ease of moving data
"Economic espionage is intensifying. The foreign intelligence services of China, Russia, Iran and other countries are after our technology, and most of what they want is in the electronic-information systems of private companies -- and the law and accounting firms that work for them.” Joel Brenner, former National Counterintelligence Executive, 2011
27 Courtesy of Bloomberg.com February 2011
Tze Chao
• DuPont Scientist for 36 years
• No security clearance / gov’t affiliation
• March 2012, pleaded guilty to conspiracy to commit economic espionage
• Motivated by Chinese loyalty
• Sold DuPont trade secrets to a Chinese state-run company
• Global titanium dioxide market valued at 12 billion “Pangang Group employees, in asking me to provide DuPont trade secrets to them, overtly appealed to my Chinese ethnicity and asked me to work for the good of the PRC'' 28 Courtesy of US Justice Department February 8, 2012, public release and CI CENTRE and SPYPEDIA
Upward Trend in Economic Espionage Economic Espionage Arrests 1995-2011 20 18 16 14 12 10 8 6 4 2 0
29 Courtesy of CI CENTRE and SPYPEDIA Overall Espionage Activity...
Individuals Charged in Espionage-Related Activities 1945-2011 40 35 30 25 20 15 10 5
0
1961 1945 1947 1949 1951 1953 1955 1957 1959 1963 1965 1967 1969 1971 1973 1975 1977 1979 1981 1983 1985 1987 1989 1991 1993 1995 1997 1999 2001 2003 2005 2007 2009 2011
30 Courtesy of CI CENTRE and SPYPEDIA ...and Related Employment Status Employment Status
DoE INS DoJ NATO Journalist OSS DoD DIA Marines University Employee NSA FBI State CIA Air Force Contractor Army Navy Foreign National Civilian 0 50 100 150 200
31 Courtesy of CI CENTRE and SPYPEDIA Overall Upward Trend
22.2% of all Espionage arrests in the past 66 years have occurred in the LAST 4 YEARS!
32 Courtesy of CI CENTRE and SPYPEDIA Suspicious Contact Reports
• Official documentation of contact with an employee: – By any individual • to obtain unauthorized access to sensitive information (LMPI, PII, classified) • or to compromise the employee... – By • a known or suspected intelligence officer from any country • or by a representative of a foreign or domestic industry competitor...
– Which suggests an employee may be the target of an attempted exploitation or recruitment by the intelligence services of another country, or by an industry competitor. 33 SCR Example
• In 2012, an Engineer attended a conference and advised that during the conference he was approached by a FN who had presented a paper.
• It was verified the FN was representing a University and he told the Engineer that he was aware that our company was working on technology similar to his own. He states that he could produce better results with his technology and was trying to contact the appropriate people at our company and offer them his technology.
• The FN gave the Engineer a thumb drive which he said contained his paper and presentation materials and asked if he could facilitate the contact with those at our company who are involved in this technology.
34 Importance of Reporting
• Your community must be informed – The sole means for Insider Threat Detection – Understanding targeting trends allows for more effective countermeasures
• Intelligence Community must be informed – Critical in understanding threat against industry – Information used for global trend analysis – Publication of intelligence products – The potential for operations and investigations by FBI / NCIS / OSI
35 Conclusion
• CY 2011, best estimates are $1 trillion in losses of revenue
• FBI reports, cases adjudicated in 1Q CY 2012 amounted to $13.2 billion
• FBI current espionage case load is at all time high, 25% economic espionage
• High percentage of current economic espionage cases involve CDCs
• DSS referrals to FBI increased 400% in CY 2011
36 Courtesy of FBI Questions?
“The Cold War is not over, it has merely moved into a new arena: the global marketplace” www.FBI.gov
37