IT Security Blog. Mitigating Risks. Enabling Business Strategies. W. Mark Brooks

Confessions of a Corporate Spy - Got Ethics?

Details magazine had a great article on the “Confessions of a Corporate Spy”.  The author writes about being hired by a client to spy on a rival business.

The article highlights what most industry experts believe is a growing trend in Corporate Espionage.   Corporate Espionage is generally defined as illegal or unethical activities conducted for commercial gain.   These activities can include theft of information, inappropriate use of information, sabotage, bribery, blackmail, hacking, or social engineering.

The article is not necessarily intended to discuss the ethical issues associated with Corporate Espionage, but I would like to examine them.

With the advent of the Internet, the lines between what is considered legal or illegal have certainly blurred.  This is driven by the availability of information on Internet and the power of search engines.  Information that a company might have had to steal in the past to conduct espionage can now often be found by simply using Google.  In fact, the author mentions “Google Hacking” which is simply using Google to find secret information.   So these days, companies don’t necessarily have to do anything illegal to gain secret information that that can use to conduct espionage. 

While the lines have been blurred on what is legal vs. illegal, the line between what is ethical vs. unethical really hasn’t blurred.   All a company has to do is ask the question: We would want and willingly approve our conduct if another company was conducting the activity against our own company?  Think of it like the Golden Rule applied to companies. In fact, some companies have instituted policies that basically use the concept of the Golden Rule, when it comes to competitive intelligence.  In other words, they don't allow activities that they don't want other companies conducting.

Ultimately, I think you can look at the behaviors and intent of the activities to clearly delineate what is ethical vs. unethical.  For example, does the behavior involve?

• Deceit
• Pretexting
• Hiding
• Covering up activities
• Hiring someone because you don’t feel right about conducting the activity yourself.

If the answer is yes to any of these questions, then you have probably already crossed the line from ethical to unethical.

As for the example shared in the article, what do you think?  Was his snooping on the rival firm ethical?  It was certainly legal, but was it ethical?  Let’s answer the questions I posed above for the case outlined in the article. 

Did the activity involve?

• Deceit. Yes
• Pretexting.  YES.
• Hiding.  NO.
• Covering up activities.  NO.
• Hiring someone because you don’t feel right about conduct the activity yourself.  YES

Given these answers, I would have to say the activity in the article was unethical.  I don't believe the activities can be retationalized as, "that's what we were hired to do".

The author “Anonymous” admits as a corporate spy you have to be willing to ‘get your hands dirty” and work in “the gray area”.  While he also admits to “trying to stay within the law”, he never acknowledges trying to be ethical.  

Do you agree?

While many Corporate Espionage cases revolve around the use of technology such as hacking, the article also highlights how information can be obtained through simple human observation.  Later I will discuss the more common types of methods used for Corporate Espionage, both non-technology oriented as well as those enabled by technology.

Mark Brooks

HIPAA Mashups Enable Targeted Healthcare Ads

HIPAA Mashups? Really?  Read on...

Gastrol Oil in the UK recently went live with it's customized billboards, that display the type of oil your car needs based upon a database look up from the UK's Driver and Vehicle Licensing Agency (DVLA).  See video for Castrol Oil Billboard Ad. 

The DVLA apparently sold licensing data to a third party, and this third party sold the data to Gastrol.  In a statement, the DVLA said it did not sell Castrol the data and denied providing any data to Castrol or receiving any fee in relation to the marketing campaign.

This type of advertising is reminiscent of the mall scene from the Minority Report movie, where actor Tom Cruise's character has customized ads presented to him based upon an IRIS scan of his identity.  If you haven't seen Minority Report, you can view the mall scene on YouTube, just search for "Minority Report Mall Scene".   Expect to get a scary view into our future.  In Gastrol's case, once the advertising campaign was launched, it was quickly shut down, read DVLA Denies Selling Data to Castrol. 

So what's this have to do with HIPAA Mashups? 

Consider this imaginary scenario:

"Average Mary Jo Citizen who happens to have high cholesterol, makes use of a free GPS service in her car.  It's free because she allows splash banner advertising occasionally on her car's mini-LCD screen.  This morning, when Mary started her car, an advertisement for LoCHOLS, a new Cholesterol-Lowering Drug that recently hit the market was displayed on her car's navigation screen."

In the future, could a HIPAA Mashup on Mary be done to enable such an ad? Well, let's also imagine the following:

"Mary's high speed internet service is free because she allows her ISP to track her internet surfing history in a large database.  This allows the ISP to provide customized ads to Mary's homepage.  Recently, Mary database records indicated that she has been surfing for Weight Loss Clinics and Health Clubs in her local area.

Mary's grocery convenience card that she uses to get discounts at the local grocery store tracks all of her purchases.  The grocery store's database shows that Mary, despite her best efforts to watch what she eats, has recently increased her purchases of potato chips, fatty meats, and her favorite "Muffin Top Cakes".  Mary also opted in to receiving special store coupons via email, by allowing 3rd parties to send her advertisements to her home.

Mary has also been receiving birthday wishes from a number of local restaurants that have birthday clubs.  The restaurants make use of the same market leading CRM database application for managing interactions with customers.  It turns out that Mary just had her 55th birthday.

MinHealthCo, a third party service provider contracted by the Department of Health and Well Being in the US to educate consumers on preventative healthcare to help reduce costs, has subscribed to all three databases mentioned above.  MinHealthCo analysis concludes Mary might be a good candidate LoCHOLS, because Mary is concerned about weight gain, eats foods with high fatty content, and has recently turn 55, a key risk threshold for high cholesterol in women."

HIPAA Mashups Enable Targeted Healthcare Ads??

So what are the legal and regulatory considerations of this imaginary scenario? How much of this is a stretch?  

Can such a scenario be enabled with proper controls and yet meet the needs of government, businesses, and consumers?  What ethical or privacy dilemmas are are stake?

Please let me know your thoughts.   

Mark Brooks

Healthcare Industry Group Publishes Certifiable Security Framework

Progress continues to occur in industry regarding the establishment of common information controls standard.

 The Health Information Trust Alliance (HITRUST) recently announced that its Common Security Framework (CSF) is now available and free, and is located at HITRUST Alliance.  HITRUST also offers a premium subscription that includes additional services and content.  The CSF is a standard IT security control framework developed specifically for health care information. The HITRUST CSF leverages recognized industry standards, including HIPAA, NIST, ISO, PCI, FTC and CoBIT.  It is scaleable and risk-based.

HITRUST believes that the capability to provide secure access, storage, and exchange of personal health information is fundamental to enabling the effective use and exchange personal health in the Healthcare industry.  This security framework is also a good an example of the type of strategies that organizations need to embrace effectively address emerging regulatory requirements and guidance in the The American Recovery and Reinvestment Act of 2009 and HITECH Act.

While this is certainly great news, you should also know that there are other security frameworks.  A cross-industry IT group recently developed the IT Unified Compliance Framework and NIST (National Institute of Standards) also recently released SP 800-53, Security Controls for Federal Information Systems & Organizations.

The important take away is that solid progress is clearly being made across industry to establish common information control standards.  This will help all of us involved in compliance, risk, and security related roles, but especially those in organizations that make use of sensitive information that is governed by different sets of laws and regulations.

Mark Brooks

FTC PHR Breach Rule Sites Cloud Computing Requirements

Yes...that's correct "Cloud Computing" cited.  Read on.

 The FTC issued its final rule on Health Breach Notifications on August 17th, after soliciting comments over the past several months.  The rule applies to all "Vendors of Personal Health Records" as defined in the ruling.

Definition: "Vendor of Personal Health records” is “an entity, other than a HIPAA-covered entity or an entity to the extent that it engages in activities as a business associate of a HIPAA-covered entity, that offers or maintains a personal health record (PHR).” 

In addition, the ruling addresses some of the realities of today's market and the use of third party service providers, as well as entities that leverage the use of web based technologies to offer products and services to manage/process PHR.  In reading through the 88 page ruling (AAGH!), I found it interesting that there was a specific reference to the use of cloud computing.  The ruling addresses the breach notification requirements for cloud computing providers in the context of "third party service providers".

Listed below is the section of the ruling that references cloud computing.  The "one commenter" is a reference to an entity that made comments to the ruling during the solicitation of public comments.

"From Proposed section 318.3:  Breach notification requirement" paragraph...

First, one commenter noted that a third party service provider may be unaware that it is dealing with a vendor of personal health records.  For example, a cloud computing service provider may offer computing power and storage without knowing whether customers use them to offer PHRs.   The Commission agrees with this comment and, accordingly, adds the following sentence to paragraph 318.3(b):  “For purposes of ensuring implementation of this requirement, vendors of personal health records and PHR related entities shall notify third party service providers of their status as vendors of personal health records or PHR related entities subject to this Part.”

Second, one commenter noted that some third party service providers may have multiple vendors of personal health records as clients. [M. Brooks: Sounds just like cloud computing service provider!]  If the third party service provider experiences a breach, it should not be required to identify every individual whose information was breached to each of its clients, regardless of whether the individual is a customer of the client.  This could result in the third party service providers’ sharing customer lists with competing vendors of PHRs, and could undermine the privacy of such customers.  The Commission agrees.  Thus, instead of requiring the third party service provider to identify each “individual” whose information was breached, the Commission’s final rule requires the service provider to identify each “customer of the vendor of personal health records or PHR related entity” whose information was breached.  

 85  Cloud computing is the provision of Internet-based computer services.  Cloud computing provides businesses and consumers with access to software, data storage, and infrastructure services that are hosted remotely. 

Here is the FTC press release, FTC Health Breach Notification Rule News.  Also, you can find the complete FTC ruling here 16. C.F.R. Part 318: Notice of Proposed Rulemaking and Request for Public Comments Concerning Proposed Health Breach Notification Rule, Pursuant to the American Recovery and Reinvestment Act of 2009. 

Suffice it to say, companies or vendors that are evaluating or making use of cloud computing for data that includes PHRs, will now be required to notify their cloud computing service providers.  Hopefully this isn't new news for vendors of PHRs! 

Second, it is clear that the FTC understands enough how companies are leveraging cloud computing providers and industry may see enforcement action in the cloud computing domain.  The Rule will take effect 30 days after publication in the Federal Register and the FTC said it would begin enforcement 180 days after publication.

HITECH Act Compliance

Recently, Brian Wolfe who heads the Security and Compliance practice at Laurus Technologies, commented in this article about the need for the health care sector to ready themselves for electronic health records (EHRs).  In fact, some of the changes and dictates to move to EHRs are found in the recently approved HITECH Act.

I agree with Mr. Wolfe that ISO 27001:2005 provides a great foundation for organizations to ready themselves for the necessary changes and controls to process EHRs.  I think IT Security professionals should appreciate that their business partners would be apprehensive in leveraging standards like those from ISO.  I think some of the apprehension is in part driven by how Information Security professionals position the use of "industry standards" and the stereotypes that are easily developed given the use of the word "standards".  It is important to remember that standards like ISO 27001:2005 are voluntary.  In fact, ISO states at their website that "ISO standards are voluntary."

I believe you are more likely to be succesful in implementing industry standards and ultimately enabling business strategies by applying standards from the perspective that they are truly VOLUNTARY.  There are many IT Security professionals that will say, "I know standards are voluntary", but many don't operate that way.  Too often I have ended up in long debates about whether to implement certain standards because IT Security professionals end up engaging and behaving in the debate like industry standards are non-negotiable.  I have to admit, I have sometimes fallen into that trap myself...

The ISO 27001 ISMS specification as well as ISO 27002 the Code of Practice Information Security, provide great guidance to companies for establishing the systems and controls for securing information and enabling compliance.  Companies should leverage the use of ISO 27001:2005 for HITECH Act compliance, but should also view them as best practice guidance vs being mandatory.  Viewing these standards as best practice guidance also supports a risk based approach to securing information.

Mark Brooks

Corporate Espionage

This hit the news recently.  Hilton hired two senior executives from Starwood Hotels.  Starwood is now suing Hilton along with the two executives for allegedly using stolen Starwood information to develop a new luxury hotel chain.  The executives are accused of stealing more than 100,000 electronic and paper documents containing sensitive information.

I have dealt with very similar circumstances in my work, and it is very challenging.  First, it is difficult to define what is personal property or company property.  While most companies tend to take a stance of,  "Anything and everything is ours, take nothing with you," many employees considered to be "generally" honest don't believe this meets muster in terms of common sense.  A recent study at the Ponemon Institute indicated that 59% of employees leaving companies take confidential information.  Personally, I think this is a low percentage.  Second, it is difficult to detect electronic and physical theft of property, especially if the theft occurs far in advance of an employee's departure.

The best strategy for a company to diminish this type of risk is in the context of a comprehensive information security strategy.  Unfortunately, many companies fall into the trap of wanting a quick return and will look to implement quick fixes.  As result, you see the emergence of the DLP (Data Loss Prevention) market as the latest wave in quick fixes.  If a consulting firm or security professional is forced into having to or needing to execute the short-term play, there are ways to wrap longer-term information security strategy into a near term DLP implementation. In essence, it is simply pointing at the need for DLP as a symptom of a broader need for an information security strategy, and then incrementally incorporating elements of the long-term strategy as a part of the tactical game plan.

Mark Brooks