Michael Kilchling

Michael Kilchling

Michael Kilchling | Sixth International Spring Course | Dubrovnik | March 2014

ECONOMIC ESPIONAGE – ECONOMIC ESPIONAGE – CAUSES AND CONSEQUENCESCAUSES AND CONSEQUENCES

Pho

to: w

ww

.it-b

usin

ess.

de

1

Contents

• Introduction

• Two main areas of regulation

• Economic espionage in a comprehensive (wider) sense

– Legal & criminal-political aspects

– Criminological & victimological aspects

• Conclusions & perspectives for comparative research

Michael Kilchling | Sixth International Spring Course | Dubrovnik | March 2014 2

Introduction


Introduction


Introduction

• Diffuse, ambiguous terminology

• Variety of patterns / scenarios and modi operandi (internal, external)

• Intersection of crimes against state security (traditional approach) and economic crime (modern approach)

• Intersection of conventional (physical) crime and cybercime

• Fragmented legal (penal) regulations

• Fragmented jurisdictions

• Political interests involved

• State control vs. self-control


Introduction

• Incomplete, sometimes also incorrect statistical coverage

• Scarce literature

• No up-to-date empirical research

• Some information about the impact of the threat can be deduced from some studies on victimization of and awareness in the ecnonomic sector (enterprises, businesses)

• Large dark field

• Double dark field


Two main areas of regulation



Economic espionage Industrial espionage•Corporate / business / competitive espionage•Industrial theft•Commercial spying•"Competitive intelligence"

Two main areas

8


Economic espionage • Sponsored, supported or

orchestrated by govern-ments

• Conducted by state agencies or on behalf of those

• Intended to reach political gain (as positive or negative stategy, or both)

• Focus on military or dual use goods (not exclusively)

• International • Crime against the state

(state security)

Industrial espionage•Commercial background•Conducted by business actors or on behalf of those•Intended to make economic profit (direct or indirect, or both)•Focus on any kind of information that can be commercially exploited•State agencies/governments can be targets, too•National or international•Economic crime

Two main areas

9


Economic espionage • Crime against the state

(state security)• Traditional statutory regula-

tions which are based on different models / traditions

• Harsh statutory penalties• Often separate jurisdiction

(e.g. attorney general, special chambers/courts)

• Involvement of intelligence agencies

• Prosecution guided by political interests

• "Friendly spies"

Industrial espionage•Economic crime•Unlawful competition•Business law, competition rules•Regulatory sometimes not part of the (core) criminal law•Statutory penalties can be more moderate•Shares the general charac-teristics of prosecution in the area of business crime •No particular state interests

Two main areas

10

Economic espionage in a comprehensive (wider) sense



• Similar / identical modi operandi and aims:» illegal obtainment of knowhow, information theft

• Same targets:» owners / holders of intellectual property (e.g.,

manufacture secrets, ideas, techniques / pro-cesses, recipes, formulas, etc.), operational information (e.g., customer datasets, pricing, sales, marketing, research and development, policies, prospective bids, planning, marketing strategies, etc.), or any other valuable piece of information

» includes the science sector!• Different purpose / motivation:

» commercial benefit versus political advantage



• From the perspective of the comprehensive approach, the similarities of the crimes in both areas seem to be predominant

• Can (should) the differences in pupose and motivation still justify the traditional split approach (separate regulation)?

• A variety of legal, criminological, victimological and criminal-political aspects to be considered:– is the split approach still plausible (up-to-date)?– is it justified from a legal and criminal-political point of view?– is it relevant from the perspective of the victims?– is it (i.e., the concrete purpose) recognizable in case of an

attack or an attempted attack?– is it not even counterproductive, thus impeding effective

prosecution and control?


13

• What is the specific interest of the state for treating a violation of property rights of a company as a violation of state security?

• What is the legally protected value (legal good)?– in a globalized economy– in a europeanized economy

» EU member states lost sovereignty» economic sector fully 'communitarized'» national interests (as manifested by traditional

categories such as national economy, domestic market, GDP, etc.) are no longer relevant

» national intervention may be justifiable as proxy action in absence of EU institutions, but requires adaption of the legal rules

• How to handle a spy attack against a multinational enterprise?Michael Kilchling | Sixth International Spring Course | Dubrovnik | March 2014

Legal aspects

14

• Procedural consequences of the split approach

– separate jurisdictions

– different investigative powers and responsibilities

– co-operation vs. self-interest of and competition between actors / agencies

• Practical problems in unclear cases

– origin of attack unknown or unclear

– purpose / motivation unknown or unclear

– sometimes even the nature of a suspicious incident remains unclear

• In lack of clear evidence investigations often dropped or prosecutions dismissed


Legal & criminal-political aspects

15

• Phenomenology / modi operandi

• Basic patterns

– extern vs. intern activities

– direct (theft of data or hard copies) vs. indirect attacks (break into IT systems from outside)

• Technological development increased the risks of being targeted

• Attacks difficult to recognize

• Rapid technological development is increasing the costs of the business sector for prevention and self-control


Criminological aspects

16


Traditional spy equipment

17


Gadgeds with memory functionality

18



19



20

• As a consequence of the technical developments in the phenomenology (i.e., the shift to internet-based modi operandi) modern (expanded) definitions also include sabotage (USA)

• Today in fact, any cyber attack (or attempted attack) may be a (hidden or undisclosed) act of spying

• Low clear-up rate

• High probability of incorrect statistical registration

• Leads to underestimated figures of economic espionage in official records, e.g., police statistics

• Lack of realistic quantitative estimates


Criminological aspects

• Double dark field

– incidents remain unnoticed or their impact is underestimated

– even clear cases often remain unreported, based on internal cost-benefit assessments in which the fear of reputational damage or the fear that business secrets will be disclosed during a public trial is often considered to outweight the actual real costs


Criminological/victimological aspects

• Contemporary business-related victimization studies indicate a rather high prevalence of inicidents and a low reporting rate

• It is further questionnable whether it makes a difference from the perspective of the victimized commercial companies if a theft has been initiated and/or conducted by a private competitor or by a foreign intelligence service

• In the latter case investigations initiated ex officio may even be considered as being in contradiction to the interests of a victimized company

• Further disturbances might be caused by political influence on prosecutorial considerations (e.g., friendly/unfriendly spies)


Victimological aspects

Conclusions & perspectivesfor comparative research


• Systems of control and legislation in Europe are often outdated; they still reflect patterns of the Cold War era

• The present systems can produce counterproductive practical effects

• The split approach should be replaced by adopting a broader general concept

• Modi operandi changed dramatically: shift to cyber crime• Inaccurate official figures


Conclusions

25

• Comparative research is required• There is an explicit need for

– Systematic analyses of the different models of control (both preventive and repressive) which are currently implemented in the Common European Economic Area (EEA)

– Empirical exploration of the bright and the dark fields of all relevant modi operandi, independent of (current) legal regulations and definitions

– Empirical exploration of the current state of self-control practices: risk management (staff risks, organizational risks, technical risks), generation of suspicion, reactions

– Identification of factors that hamper effective internal (inter-agency) and external (state and private actors) co-operation in the control of economic espionage in the wider sense


Perspectivesfor comparative research

26

Thank you for your attention.

Dr. Michael KilchlingSenior ResearcherMax Planck Institute for Foreign and International Criminal LawDepartment of CriminologyGünterstalstr. 73D-79100 Freiburg i.Br. Tel.: +49-761-7081-230Fax: [email protected]

www.mpicc.deMichael Kilchling | Sixth International Spring Course | Dubrovnik | March 2014 27

Michael Kilchling

Documents

introductionmichael

selfcontrolmichael kilchling

economic espionage causes

economic profit direct

exclusivelyinternational

behalf of thoseintended

business actors

political gain