Rewards for Information on Cyberattacks Paying Off Already?

On July 15, 2021, the U.S. State Department announced that up to $10 million rewards would be provided to informants with information concerning cyberattacks sponsored by or on behalf of foreign governments.  Details of the program can be found here and here.   Notably, today, the White House has announced that the United States and its allies have determined that the Chinese government has utilized contract criminal hackers in cybersecurity hacking involving zero day vulnerabilities in Microsoft’s Exchange Server.  The Biden Administration notes generally that:

[United States Department of Justice] imposing costs and announcing criminal charges against four MSS [PRC Ministry of State Security] hackers.

The US Department of Justice is announcing criminal charges against four MSS hackers addressing activities concerning a multiyear campaign targeting foreign governments and entities in key sectors, including maritime, aviation, defense, education, and healthcare in a least a dozen countries. DOJ documents outline how MSS hackers pursued the theft of Ebola virus vaccine research and demonstrate that the PRC’s theft of intellectual property, trade secrets, and confidential business information extends to critical public health information. Much of the MSS activity alleged in the Department of Justice’s charges stands in stark contrast to the PRC’s bilateral and multilateral commitments to refrain from engaging in cyber-enabled theft of intellectual property for commercial advantage.

The Biden Administration notes that it “working around the clock” to address cybersecurity issues.  Here are some of the measures the Administration is taking:

• The Administration has funded five cybersecurity modernization efforts across the Federal government to modernize network defenses to meet the threat. These include state-of-the-art endpoint security, improving logging practices, moving to a secure cloud environment, upgrading security operations centers, and deploying multi-factor authentication and encryption technologies.
• The Administration is implementing President Biden’s Executive Order to improve the nation’s cybersecurity and protect Federal government networks. The E.O. contains aggressive but achievable implementation milestones, and to date we have met every milestone on time including:
  
  
• The National Institute of Standards and Technology (NIST) convened a workshop with almost 1000 participants from industry, academia, and government to obtain input on best practices for building secure software.
• NIST issued guidelines for the minimum standards that should be used by vendors to test the security of their software. This shows how we are leveraging federal procurement to improve the security of software not only used by the federal government but also used by companies, state and local governments, and individuals. 
• The National Telecommunications and Information Administration (NTIA) published minimum elements for a Software Bill of Materials, as a first step to improve transparency of software used by the American public.  
• The Cybersecurity and Infrastructure Security Agency (CISA) established a framework to govern how Federal civilian agencies can securely use cloud services.
• We continue to work closely with the private sector to address cybersecurity vulnerabilities of critical infrastructure. The Administration announced an Industrial Control System Cybersecurity Initiative in April and launched the Electricity Subsector Action Plan as a pilot. Under this pilot, we have already seen over 145 of 255 priority electricity entities that service over 76 million American customers adopt ICS cybersecurity monitoring technologies to date, and that number keeps growing. The Electricity Subsector pilot will be followed by similar pilots for pipelines, water, and chemical.
• The Transportation Security Administration (TSA) issued Security Directive 1 to require critical pipeline owners and operators to adhere to cybersecurity standards. Under this directive, those owners and operators are required to report confirmed and potential cybersecurity incidents to CISA and to designate a Cybersecurity Coordinator, to be available 24 hours a day, seven days a week. The directive also requires critical pipeline owners and operators to review their current practices as well as to identify any gaps and related remediation measures to address cyber-related risks and report the results to TSA and CISA within 30 days. In days to come, TSA will issue Security Directive 2 to further support the pipeline industry in enhancing its cybersecurity and that strengthen the public-private partnership so critical to the cybersecurity of our homeland.

By exposing the PRC’s malicious activity, we are continuing the Administration’s efforts to inform and empower system owners and operators to act. We call on private sector companies to follow the Federal government’s lead and take ambitious measures to augment and align cybersecurity investments with the goal of minimizing future incidents.

John Huntsman and the Commission on the Theft of American IP's New Update

In an interesting development, John Huntsman, Jr. is being considered by the Trump Administration for the position of ambassador to Russia.  Mr. Huntsman was the previous U.S. ambassador to China (Obama Administration) and Singapore (G.H. Bush Administration), and was a credible candidate for the U.S. Presidency in 2012.  Importantly, Mr. Huntsman is also the co-chair for the Commission on the Theft of American Intellectual Property.  In 2013, the Commission released its first Report on the Theft of American Intellectual Property.  Recently, on February 27, 2017, the Commission released an Update to the IP Commission Report of 2013.  The new Update states:

Since 2013, at the release of the IP Commission Report, U.S. policy mechanisms have been markedly enhanced but gone largely unused. We estimate that the annual cost to the U.S. economy continues to exceed $225 billion in counterfeit goods, pirated software, and theft of trade secrets and could be as high as $600 billion.1 It is important to note that both the low- and high-end figures do not incorporate the full cost of patent infringement—an area sorely in need of greater research. We have found no evidence that casts doubt on the estimate provided by the Office of the Director of National Intelligence in November 2015 that economic espionage through hacking costs $400 billion per year.2 At this rate, the United States has suffered over $1.2 trillion in economic damage since the publication of the original IP Commission Report more than three years ago.

The Update notes that since the publication of the first Report that several recommendations were adopted by Congress and the Obama Administration including enactment of the Defend Trade Secrets Act, the 2015 National Defense Authorization Act , The National Cybersecurity Protection Act of 2014, The Federal Information Security Modernization Act of 2014, The Cybersecurity Workforce Assessment Act of 2014, and The Cybersecurity Enhancement Act of 2014. The Update continues to focus on China as a source of trade secret theft, but notes that cyberattacks from China have decreased.  The Update does hedge and note that this may be hard to measure.  In discussing China’s efforts to protect intellectual property, the Update also states:

To realize those reforms, China’s State Council issued a new action plan in 2016. Building on a 2015 policy document outlining goals to develop a stricter IPR regime, the action plan, titled “Opinion of the State Council on Accelerating the Construction of Intellectual Property Powers for China as an Intellectual Property Strong Country under the New Situation—Division of Tasks,” duplicates standing policy but also lists several priorities for reform of the IPR regime.50 According to analysis by Mark Cohen, a long-standing expert on China’s IP environment, the document suggests that China is making a greater effort to raise the damages a victim can sue for in Chinese courts.51 The action plan also stresses international cooperation and the placement of more IP officials overseas to protect Chinese companies. It goes on to encourage the study of China’s IP-intensive industries and the use of fiscal policy to promote their development.52 Taken as a whole, the plan appears to be more geared toward fostering stronger IP-intensive industries at home than developing the rule of law.

The Update notes that the recent United States Trade Representative’s 301 Report on China states that there are several areas of concern in China’s protection of intellectual property that require attention according to industry, such as the participation of foreign firms in standard setting in China.  Curiously, the Update then points to some potential fields in which it is alleged that state owned enterprises in China may be engaging in theft.  The Update provides two examples of possible issues; however, they both are not concretely closely tied to theft of trade secrets.  More information would be helpful.  The Update also points to state subsidization of industry and underbidding as two potential problems that help Chinese industry to the detriment of U.S. companies.  The Update concludes with a call to the Trump Administration to tackle the theft of intellectual property early in the Administration, and provides a list of recommendations that have not been adopted by the U.S. government.  For additional discussion of IP enforcement in China, please see here, here and here. 

Protecting Trade Secrets: How Many Shades of Gray Do You Need To Count?

Study after study shows the claimed widespread reliance on trade secrets in protecting a company's intellectual property. In that regard, a management course addressing the creation, exploitation and protection of a company's intangible assets/intellectual property will usually seek to place these assets in juxtaposition to patents and to highlight the characteristics that distinguish one from the other. Much less considered, if at all, is the dynamics by trade secrets are treated in the actual swirl of the commercial marketplace. Indeed, academic colleagues with a particular interest in the topic repeatedly lament the difficulty in getting beyond high-level research findings, usually based on statistical analytics, in order to "find out what is really going on."

Against that background, I noticed an article that Reuters published several days ago that show just how uncertain the treatment of trade secrets can be. The March 27 article—"China eyes $3.5 billion Russian arms deal despite ire over Sukhoi copy" here, describes the cat-and-mouse game that Russia has been playing with China as it confronts the dilemma that faces many concerns who wish to do business with China—how can I balance my commercial (and in this case, perhaps also geostrategic) interests against the risk of having valuable trade secrets uncovered by my business partner. Beyond all of the talk about NDAs and the patent/trade secrets trade off, the dynamics between Russia and China provide an illuminating window are instructive about "the 50 shades of grey" that characterize the treatment of trade secrets in the marketplace.

The Reuters report focuses on China's efforts to receive renewed deliveries of certain advance weaponry from Russia to the tune of $3.5 billion, mainly fighter planes and submarines, this despite the lingering memory among Russian officials about alleged previous purloining of Russian military technology by their Chinese customers. It appears that the Chinese are particularly eager to obtain this advanced technology to fill in gaps in their domestic military technology, especially in the area of jet engine technology. As well, with the changing of the guard in China, new President XI Jinping apparently sees the transaction as having both substantive as well as reputational value.

All of this is understandable enough for China, even at the price of $3.5 billion. But what about Russia? Certainly $3.5 billion is a respectable sum of money, especially when one considers how eager they are to earn hard currency for something other than the sale of natural resources. However, from the point of view of protecting valuable military trade secrets, is it worth these sums? Starting in the 1990s, Russia transferred to China Russia weaponry and technology in the amount of $26 billion, enabling the Chinese to close its military technology gap with the West.

But at the same time, the Russians noted that while they had delivered 280 fighters of the Su-27 family to China, China also managed to produce 160 units of its J-11 fighter which, in the view of the Russians, is simply "the reverse engineered version" of the Su-27. Apparently, the copying was so blatant that it angered the Russian defence industry, who viewed it as out and out "intellectual property theft" of some of its most valuable military technology. The thought of one day having to encounter a reverse-engineered version of the Su-27 somewhere along the 2,600 mile-long China-Russia border also gave them pause for thought.

So here is the problem for the Russians. Can they take any material steps to prevent a repeat of what happened the last time they transferred valuable trade secrets to the Chinese. Three steps are suggested in the article:

1. As noted by a Russian-based analyst, " [i]t is understood that the Chinese will try to steal or copy any system they are given access to. But the amount of time they will need to do that [apparently in this case—NJW] might be very significant." In other words, managerial consideration no. 1 is simply a version of "first mover advantage", although the application is this tactic to the development of military hardware seems a bit problematic.

2. Russia sees itself as being better placed this time to limit Chinese access to the trade secrets. The previous time, it seems, the Chinese were able to make use of know-how found among experts located in Belarus and Ukraine, which were no longer part of Russia after the collapse of the Soviet Union. This time, it is noted, "[t]he new Russian systems cannot be found in the Ukraine or Belarus." This sounds like a version of what I used to hear about technology transfer by Japan to China—either hold-back key technology or make sure that it stays "between the ears" of the transferring party, with no documentary access available. Maybe yes, maybe no, depending upon how "first mover advantage" plays out.

3. The parties will be entering into contracts that will presumably protect Russian interests in this regard and provide steep penalties for breach. The problem with this is, as a lawyer, I am familiar with the limitations of contractual protection with respect to trade secrets. It is what we tell students is a "second-best" line of protection at most. Whatever the amount of any court judgment for breach, the trade secret smoke is out of the bottle and not even Aladdin will be able to retrieve it.

All of this seems to underscore the difficulty of ensuring reasonable protection of one's trade secrets when there is a concern that the counter-party may be less than forthcoming in its commitment. It also points to the need for management education to develop better tools to teach students how to weigh the trade off between revenues and other benefits and the loss of control of one's trade secret assets.

More on the Sukhoi fighter here.

Carrefour, Brands and the Russian Market;

I can think of no greater branding challenge than seeking to establish a transnational presence in the retail chain space. Even the 800lb gorilla --Wal-Mart--has not succeeded in establishing a dominant position in each of the national markets which it has sought to enter. The reason is not difficult to fathom. When compared with the difficulties in marketing a single branded product in a new jurisdiction, the requirements for successfully establishing a large-scale retail service brand in a new country are exponentially greater.

Thousands of products of inventory, ranging from perishable food to home furnishings, have to be purchased and made available to customers, real estate sites need to be carefully selected, pricing has to walk a tightrope between being competitive and being profitable, cultural differences have to be addressed, and managerial and on-the-floor service has to be constantly maintained. It is often a wonder that large retail chains can succeed at all across diverse regional settings.

That said, I was struck (even thunderstruck) by the announcement in mid-October that the giant French-based retailer Carrefour here was pulling out the Russian market. Just to keep the size of the company in perspective, it is the second largest retailer in the world (behind Wal-Mart) and racked up sales of nearly $36 billion dollars for Q3 2009. Nor do they shy away from adventurous markets. Nearly half a decade ago, my daughter found herself temporarily working at a Carrefour store in far Western China.

Against that backdrop, the compressed rise and apparent fall of Carrefour in Russia is noteworthy. As reported on the nytimes.com website on October 17, in an article entitled "French Retailer to Close its Russian Stores" under the by-line of Matthew Saltmarsh and Andrew Kramer, Carrefour opened its first hypermarket in Moscow in June 2009. A second store was opened on September 10, 2009, in a city called Krasnodar. The announcement of that opening, as reported on carrefour.com, was careful to add that it was being done "in line with the agreement concluded with the Administration of the Krasnodar region."

And yet, slightly more than one month later, the company announced (albeit apparently "buried ... in a trading update") that the closure was taking place because of an "absence of sufficient organic growth prospects and acquisition opportunities in the short and medium term that would have allowed Carrefour to attain a position of leadership." This is quite remarkable. We are not talking about closing a 180 square meter corner grocery, but rather two facilities, each of which was over 86,000 square feet. Moreover, we are not talking about a gradual phase-out of the facilities, but rather what appears an exodus of Biblical proportions. If there is any recent precedent for a retail pull-back of this size and alacrity from a entire national jurisdiction, I am not aware of it.

Coming and Going in Russia

Oversaturation of the Moscow market, limited growth possibilities elsewhere in the country, a difficult consumer ethos, a deteriorating economic environment, endemic red-tape and even corruption (recall the role of the Administration of the Krasnodar region in the opening of the second Carrefour megastore) all seem to have played a part. Still, these factors did not suddenly come together like a perfect storm only between June and October of this year. If these were factors contributing to the debacle, surely they must have been present, in whole or in part, before the summer 2009. If so, it sure sounds like someone was asleep at the wheel at company headquarters.

And now for the branding question: will the apparently ignominious withdrawal from Russia affect the transnational value of the Carrefour brand? I suspect that the answer is no. Mega-retailing is far more local than international. Still, this is a double-edged sword.

On the one hand, there is likely little added value to the Carrefour name per se when the company seeks to enter a new market. True, the size and recognition of the chain may ease the initial entry into a jurisdiction, but ultimate commercial success, and the resulting goodwill in the brand, must be earned. This seems quite different from the introduction of, for example, a MacDonald's chain into a new country, where the transnational goodwill preceding entry will likely be of assistance.

On the other hand, a local failure will not materially affect the overall value and goodwill of the brand. What happened in Russia will not likely cause an impairment of the Carrefour brand in France--the markets are separate and distinct . Despite globalization, digitization, and the growth of famous marks, for most brands the territoriality notion of trade marks is not merely of legal significance, but of commercial import as well.

The Questionable Notion of the National Brand

I have to admit: I have never been a big fan of the notion of "national brands”. The reasons are both analytical and political. Even the most socially and culturally homogeneous countries are composed of many “moving parts”. As such, any attempt to encapsulate the national ethos in a few chosen descriptive words, much less to rank nations on the basis of their “brand” strength, seems to me an analytically futile task. At the political level, my concern is darker. National branding too easily slides in national stereotypes, which itself can slide in national demonization, if not worse. The last century has shown us the tragic consequences of this process, if left unchecked.

That said, in recent times we have seen increasing efforts to turn national branding into a respectable activity. One interesting effort is that of a consultancy called Future Brand, which has for several years produced a report which they call the “Country Brand Index” here. Based on interviews with 2700 travelers, supplemented by expert opinions and some statistical analysis, the most recent report for 2008 found the 10 leading national brands to be, in order--Australia, Canada, America, Italy, Switzerland, France, New Zealand, Britain, Japan and Sweden.

One might be tempted to treat these findings in a rather cavalier manner (despite the 64 power point slides in the 2008 report), especially since the focus of the rankings is the perception of tourists. But there may be a more serious aspect to the exercise. In commenting on these rankings, a blog posted under the auspices of Economist.com (called Gulliver, I believe) noted in a posting on November 10, 2008, as follows:

“… [T[he brand experts are very definite that theirs is a science that countries need to take seriously:

“ "Countries are becoming more aware of the importance of defining how they want to be perceived and the need to improve and leverage their assets. While tourism is often the most visible manifestation of a country brand, it is clear that the image, reputation and brand values of a country impact its products, population, investment opportunities and even its foreign aid and funding."”

Is that true? Are investors and funders really swayed by national branding? Surely their decisions are too rigorous to be swayed by marketing campaigns? Gulliver awaits conversion.”

Gulliver From Another Time

I thought about Gulliver’s comments as I was recently reading a piece in the July 4, 2009 issue of The Economist entitled “Courting Disaster: Russia’s Dismal Investment Climate.” The piece recounts several examples of the unfavorable business climate for foreign investors and the like in Russia. One paragraph particularly grabbed my attention:

“The clearest indictment of Russia’s investment climate came a few days ago from IKEA, a Swedish retail chain, whose local operation has grown quickly since it opened it first store near Moscow in 2000. On June 23 IKEA said it was suspending its investment in Russia because of the “unpredictable character of administrative procedures”, a euphemism for graft. A symbol of Russia’s economic rebound from the 1998 financial crisis has become an emblem of its dire investment climate.”

My point here is not to enter into the debate about whether or not Russia’s investment climate has deteriorated. Rather, it is consider briefly the notion of the “national brand” issue when juxtaposed against the power international private brand of IKEA. Maybe the reported action by IKEA (I am not certain what the article means by “suspending its investment’) is a straight-forward business decision to scale-back its activities in Russia; maybe it is a tactical ploy to pressure the Russian authorities in order to obtain more favorable conditions for the retailer.

Either way, there is a Manichean tone to The Economist’s description of the situation. IKEA is the retail white knight, whose very presence in Russia once served to validate a positive image of Russia, but whose white-knight image is now threatened by the gathering storm clouds of public perception about the nature of Russian administrative and commercial practice. The constant here is the IKEA brand, the variable is the national Russian brand. Seen in this way, the call by Gulliver for taking the notion of the national brand more seriously seems to be more siren than prescription. The notion of the national brand still has a long way to go.

IKEA--Ever the White Knight

Russia’s 40 most valuable brands

Familiar with companies like CTC or PIK?

If not yet, read up on them in Interbrand’s fourth annual ranking of the 40 most valuable Russian brands.

Interbrand, in cooperation with Kommersant DENGI magazine, looks behind the numbers, presenting the top 40 Russian brands of 2008 arranged by their brand value, the dollar value of a brand, calculated as Net Present Value (NPV) or today’s value of the earnings the brand is expected to generate in the future.

The telecom sector tops the ranking with Beeline and MTS. From a pure value point of view, Interbrand explain that these two companies would fit in the Best Global Brands around rank 50.

From the 40 brands featured, only six come from a pre-soviet era - with two prominent new entries in the automotive sector (LADA and KAMAZ).

The ranking can be accessed at the Interbrand website.