ETHICS IN INTELLIGENCE AND INFORMATION SECURITY

Lesson 8 – August 19th, 2011

LECTURER: Isabel Santos

CURSO: “INTELIGÊNCIA ESTRATÉGICAGERIR A MUDANÇA OBSERVANDO OS SEUS SINAIS”

Discussing Ethics in SI/CI

• “In Corporate Warfare an action of a competitor in one country may be construed as industrial espionage and in another country it may amount to terrorism, whereas in certain countries this may just be the usual practice in which they gather information on competitors”.

Vivek Raghuvanshi, CI Practitioner

Isabel Santos ©

DON’TS

- Not false job interviews- Misrepresent ourselves- Compromise Proprietary information

Isabel Santos ©

Fédération des Professionnels de l'Intelligence Economique (FEPIE)

• N'accepter que des missions pour lesquelles nous disposons de la compétence professionnelle requise ou pour lesquelles nous sommes en mesure de monter les équipes de travail répondant au besoin

• Ne fournir que des informations accessibles par des moyens légaux, quel que soit le lieu d'application de l'activité.

• Ne délivrer et n'utiliser que des informations dont nous avons vérifié la véracité et la crédibilité de la source.

• Assurer une totale confidentialité concernant les informations et données fournies par le client et celles recueillies à son profit au cours de la mission.

• Ne pas travailler pour deux sociétés concurrentes sur des problématiques similaires risquant d'entraîner un conflit d'intérêt.

• Ne pas porter atteinte aux intérêts fondamentaux de la France. Les termes de la mission doivent alors être modifiés ou la mission refusée.

Isabel Santos ©

• Competitors’ brochures, Annual, Gov. Reports• Court Records, Articles and news on internet• Monitoring archives belonging to the competitor• Collecting open source information• Mapping competitors by finding their partners,

vendors and customers by searching internet for pages with links to the competitor

• Mapping competitors customers on social media platforms

• Searching through archives and Google News and newspapers home pages for keywords that are connected to the company being monitored

• Publications from competitors sometimes give very detailed information about what they have bought or sold or joint venture, M&A.

Ethical Sources and Procedures in Intelligence

Market surveys and consultants’ reports Financial reports, and brokers’ research surveys Trade fairs and competitors’ brochures Analysis of competitors’ products Overt surveillance Meetings with suppliers (‘grey area’ ) Trade shows Sales force meetings Seminar / conferences Recruiting ex-employees of competitors (‘grey area’ ) Discussion with shared competitors Social contact with competitors Advertising campaigns and Promotions Tenders and Patent applications

SOURCE: Vivek RaghuvanshiOther sources and Ning CI community

Isabel Santos ©

SI/CI Ethics(Competitors)

• Grey Area: A ‘grey area’ is a Competitive Intelligence activity (normally related with information collection) that raises ethical doubts or questions for a practitioner.

For example: What ethical questions emerge in these specific situations?

• Elicitation of information using email and telephone calls in the form of disclosures made by competitors’

• Legitimate employment interviews with people who worked for competitor• Disguised questioning and ‘drawing out’ of competitors’ employees at technical meetings• Hiring competitors employees to acquire specific know how• Mapping competitors internal networks in connection with projects or consultancy

Isabel Santos ©

• • Trespassing on competitors premises• Bribing competitors employees and suppliers• Inserting a fake employee in competitors

organization• Blackmail• Extortion• Industrial Espionage (Proprietary Information)• Phony job interviews• Using private investigators and detectives to

extract specific information• Fake negotiations with competitors for license• Covert surveillance• Accessing competitors internal pages on

internet with a false identity or an identity used by the competitor’s customers

Forbidden Practices in Intelligence (Conc.)

Source: Ning CI and others

Isabel Santos ©

Industrial Espionage: Some Methods

• Hacking– System Hacking – Remote Hacking– Physical Hacking

• Social Engineering

– Managing/ Manipulating Human Behaviour

(passwords, corporate information)

Isabel Santos ©

• Dumpster Diving (company phone books, organizational charts, memos, company policy manuals, calendars of meetings, events and vacations, system manuals, printouts of login names and passwords, printouts of source code, disks and tapes, company letterhead and memo forms, andoutdated hardware)

• Phone Eavesdropping (fax and telephone transmissions)

(SANS INSTITUTE, 2007)

SANS Institute Report (2007):

• Marketing Plans• Source Code• Customers Profiles• Product Development Plans• Production Process Manuals• Data on Geographic Markets• Manufacturing Facility Plants and Plans• Location of Factories and Commercial Branches• Description of Organizational Process and

Procedures• Corporate Web Sites • Suppliers, Distributors, others Stakeholders Isabel Santos ©

Information Target by Industrial Espionage

Isabel Santos ©

• Contracts (details about pricing, costs, product delivery, distribution, etc)

• Information about Mergers & Aquisitions• Advertising Campaigns.• Strategy and Strategic Goals • Organograms • Employees’s Salaries and Wages• Human Resources Policies and Procedures• Finantial Data: Profits Forecasts, Cost Structure,

Departaments Bugdets.• Team Profiles, Skills and Competences

and….

Isabel Santos ©

Information Target by Industrial Espionage

Isabel Santos ©

Personal Data

• Home Adresses• Phone Numbers • Names of Family Members• Medical Records• Tax Payer and National Insurance Numbers • Employees Performance Evaluation • Confidential Finantial Data (Credit Card Numbers,

Bank extracts, etc)

Isabel Santos ©

Information Target by Industrial Espionage

Isabel Santos ©

Competitive Intelligence & Counterintelligence

1 - Identificar Necessidades de Informação

2 - Mapear Fontes; Recolher Informação

3 - Análise

4 - Comunicação

1 – Definir Requisitos de Protecção de Informação

Avaliar a ConcorrênciaAvaliar as Vulnerabilidades

Desenvolver e Aplicar Contra medidas

Análise

Comunicação

Isabel Santos ©

“The strategic goal of the Economic Security Program (PSE) is to defend and protect the portuguese economic assets and investments from foreign threats”

Isabel Santos ©

LÍDER

Obter Apoio e Recursos

Para Onde Olhar?

CONTEXTO AMPLO

PEAST

Ferramentas

Definir os Parâmetros de Comunicação

Colaboradores

5 Forças de Porter

Questão de

Invest.

Fontes

FCS

KITs

Para Onde Olhar?

INDÚSTRIA

Envolver a Organização

Gestores I. .

Investigador(es) de Intelligence(Requisitos)

Sensibilizar Vender a ideiaCaptar Apoio

• Conhecer a Organização• Conhecer a Indústria• Dominar Métodos• Apetência pela Pesquisa &

Investigação• Curiosidade ‘Renascentista’• Atento/ Interessado no que

ocorre Fora das Fronteiras formais da Empresa

• Criativo / Pensar ‘algo’ fora da Caixa

• ‘Atitude’ e Apetência para pesquisar, descobrir informação exclusiva, trazer ‘novidades’ do terreno (sobre os clientes, sobre um fornecedor, a partir de eventos, etc.)

• Capacidade de consumir e absorver grandes quantidades de informação

14

Apresentar logo um‘Serviço’

Ex: Vigilância de um concorrente

Análise

INTELLIGENCE

• Definir outros Focos: • Monitorizar sistematicamente

um Concorrente (desempenho, vendas, promoção, canais de distribuição, etc.), Clientes existentes ou potenciais, Recursos Humanos, Fornecedores, Campanhas de Comunicação,

• Aplicar Ferramentas & Técnicas

Sensibilização e Cultura Organizacional

Sensibilizar para a Partilha de Informação

Sensibilizar para proteger informação sensível e evitar comportamentos de risco.

Formação ‘in house’ ou fora. Recursos de Aprendizagem

Definir procedimentos e meios:Identificação e Participação em EventosSubscrição de Serviços/BD informação Orçamento? Tecnologias genéricas: IntranetEmail, ‘caixa de ideias’ Wikis, outros Periodicidade de Pesquisa e ReportingModo de Comunicar e Instrumentos de apoio

- Quem?- Sobre o Que?- Periodicidad

e- Informação

Actualizada- Forma- Canal

Isabel Santos ©

IMPLEMENTING AN “INTELLIGENCE FUNCTION”What is needed?

15

Environmental scanning is the (1) acquisition and use of information about events, trends, and

relationships in an organization’s external environment, (2) the knowledge of which would assist

management in planning the organization’s future course of action (Aguilar 1967, Choo and

Auster 1993). Organizations scan the environment in order to understand the external forces of

change so that they may develop effective responses which secure or improve their position in the

future. (3) They scan in order to avoid surprises, identify threats and opportunities, gain competitive

advantage, and improve long- and short-term planning (Sutton 1988). To the extent that an (4)

organization’s ability to adapt to its outside environment is dependent on knowing and interpreting

the external changes that are taking place, environmental scanning constitutes a primary mode of

organizational learning. (5) Environmental scanning includes both looking at information (viewing)

and looking for information (searching). It could range from a casual (6) or a conversation at the

lunch table or a chance observation of an angry customer, to a formal market research program

scenario planning exercise. (CHOO,2001)

STRATEGIC INTELLIGENCE: Uma definição integrada enquanto actividade de Exploração

do Meio Ambiente (ENVIROMENTAL SCANNING)

Isabel Santos ©

Caso 1 –Concorrência Crédito ao Consumo (2007)

Empresa do Crédito ao Consumo no mercado português actuando no Financiamento Automóvel, Crédito Pessoal e Crédito Consolidado (este último composto junto com o Crédito Habitação, o Crédito Hipotecário)

Encomenda um Identificação da Concorrência do sector

Bancos SFACs Marcas Automóveis

Financeiras Concessionários

Consultores Individuais

Franchising (Banca Estrangeira)

Clubes de Futebol

Novos Concorrentes

ProdutosCondições

Preços

ProdutosCondições

Preços

ATENÇÃO- Aumento da Pressão dos

Consumidores- Volúme de Queixas em

Reguladores e Associações- Directiva EU em aprovação

“Protecção ao Consumidor”

- REVISÃO + RESTRITIVA DA LEGISLAÇÃO Isabel Santos ©

REFERENCES

• Chun, Wei Choo. “Environmental scanning as information seeking and organizational learning”. Faculty of Information. University of Toronto. Available at: http://choo.fis.utoronto.ca/ir/choo/choo.html

• Fédération des Professionnels de l'Intelligence Economique (FEPIE). http://www.synfie.fr/

• Ning Competitive Intelligence Community. http://competitiveintelligence.ning.com

• Programa de Segurança Económica. Available at: http://www.pse.com.pt

• SANS Institute (2007) “Corporate Espionage 201”. Report.

Isabel Santos ©