U.S. Office of the National Counterintelligence Executive, "Foreign Spies Stealing U.S. Economic Secrets in Cyberspace," released Nov. 3, 2011

Executive Summary

Foreign economic collection and industrial espionage against the United States represent significant and growing threats to the nation’s prosperity and security. Cyberspace—where most business activity and development of new ideas now takes place—amplifies these threats by making it possible for malicious actors, whether they are corrupted insiders or foreign intelligence services (FIS), to quickly steal and transfer massive quantities of data while remaining anonymous and hard to detect.

US Technologies and Trade Secrets at Risk in Cyberspace

Foreign collectors of sensitive economic information are able to operate in cyberspace with relatively little risk of detection by their private sector targets. The proliferation of malicious software, prevalence of cyber tool sharing, use of hackers as proxies, and routing of operations through third countries make it difficult to attribute responsibility for computer network intrusions. Cyber tools have enhanced the economic espionage threat, and the Intelligence Community (IC) judges the use of such tools is already a larger threat than more traditional espionage methods.

Economic espionage inflicts costs on companies that range from loss of unique intellectual property to outlays for remediation, but no reliable estimates of the monetary value of these costs exist. Many companies are unaware when their sensitive data is pilfered, and those that find out are often reluctant to report the loss, fearing potential damage to their reputation with investors, customers, and employees. Moreover, victims of trade secret theft use different methods to estimate their losses; some base estimates on the actual costs of developing the stolen information, while others project the loss of future revenues and profits.

Pervasive Threat from Adversaries and Partners

Sensitive US economic information and technology are targeted by the intelligence services, private sector companies, academic and research institutions, and citizens of dozens of countries.

• Chinese actors are the world’s most active and persistent perpetrators of economic espionage. US private sector firms and cybersecurity specialists have reported an onslaught of computer network intrusions that have originated in China, but the IC cannot confirm who was responsible.

• Russia’s intelligence services are conducting a range of activities to collect economic information and technology from US targets.

• Some US allies and partners use their broad access to US institutions to acquire sensitive US economic and technology information, primarily through aggressive elicitation and other human intelligence (HUMINT) tactics. Some of these states have advanced cyber capabilities.

Outlook

Because the United States is a leader in the development of new technologies and a central player in global financial and trade networks, foreign attempts to collect US technological and economic information will continue at a high level and will represent a growing and persistent threat to US economic security. The nature of the cyber threat will evolve with continuing technological advances in the global information environment.

• Over the next several years, the proliferation of portable devices that connect to the Internet and other networks will continue to create new opportunities for malicious actors to conduct espionage. The trend in both commercial and government organizations toward the pooling of information processing and storage will present even greater challenges to preserving the security and integrity of sensitive information.

• The US workforce will experience a culturalshift that places greater value on access to information and less emphasis on privacy or data protection. At the same time,deepening globalization of economic activities will make national boundaries less of a deterrent to economic espionage than ever.

•We judge that the governments of China and Russia will remain aggressive and capable collectors of sensitive US
economic information and technologies,particularly in cyberspace.

The relative threat to sensitive US economic information and technologies from a number of countries may change in response to internationaleconomic and politicaldevelopments. One or more fast-growing regionalpowers may judge that changes in its economic and political interests merit the risk of aggressive cyber and other espionage against US technologies and economic information.

Although foreign collectors will remain interested in all aspects of US economic activity and technology,we judge that  the greatest interest may be in the following areas:

• Information and communications technology (ICT), which forms the backbone of nearly every other technology.

• Business information that pertains  to supplies of scarce natural resources or that provides  foreign actors an edge in negotiations with  US businesses or the US Government.

• Military technologies,particularly marine systems,unmanned aerial vehicles (UAVs), and other  aerospace/
aeronautic technologies.

• Civilian and dual-use technologies in sectors likely to experience fast growth,such as clean energy and health care/pharmaceuticaIs.

Cyberspace provides relatively small-scale actors an opportunity to become players in economic espionage.  Under­ resourced governments or corporations could build relationships with hackers to develop customized malware or remote-access  exploits to steal sensitive US economic or technology information,just as certain FIS have already done.

• Similarly,politicalor socialactivists may use the tools of economic espionage  against US companies,agencies, or other entities, with  disgruntled insiders leaking information about  corporate trade secrets or critical US technology to "hacktivist" groups like Wikileaks.