Trump Administration Moves Against Iranian Institute for Theft of University Information

US Department of Treasury and US Department of Justice charge Iranians and Iranian research institute with theft of intellectual property from universities throughout the world.  The press release from the US Department of Treasury names the Iranians.  Specifically, the press release states:

Today’s action designates one Iranian entity and 10 Iranian nationals pursuant to E.O. 13694, as amended, which targets malicious cyber activities, including those related to the significant misappropriation of funds or economic resources, trade secrets, personal identifiers, or financial information for private financial gain.

The Mabna Institute is an Iran-based company that engaged in the theft of personal identifiers and economic resources for private financial gain. The organization was founded in or about 2013 to assist Iranian universities and scientific and research organizations in obtaining access to non-Iranian scientific resources. The Mabna Institute also contracted with Iranian governmental and private entities to conduct hacking activities on its behalf.  

The Mabna Institute conducted massive, coordinated cyber intrusions into computer systems belonging to at least approximately 144 United States-based universities, in addition to at least 176 universities located in 21 foreign countries:  Australia, Canada, China, Denmark, Finland, Germany, Ireland, Israel, Italy, Japan, Malaysia, the Netherlands, Norway, Poland, Singapore, South Korea, Spain, Sweden, Switzerland, Turkey, and the United Kingdom.  The exfiltrated data and stolen login credentials acquired through these malicious cyber-enabled activities were used for the benefit of Iran’s Islamic Revolutionary Guard Corps (IRGC), and were also sold within Iran through at least two websites. The stolen login credentials belonging to university professors were used to directly access online university library systems.  

Today, OFAC is also designating nine Iran-based individuals who were leaders, contractors, associates, hackers for hire, and affiliates of the Mabna Institute for engaging in malicious cyber-enabled activities related to the significant misappropriation of economic resources or personal identifiers for private financial gain.

According to a Reuters article, this type of action was relatively rare under the Obama Administration. 

E-CRIME and the economic impact of cyber crime in Europe

Monica Lagazio (Associate Partner, Trilateral Research & Consulting LLP), has informed us of the commencement of a new European project, E-CRIME, which focuses  on the economic impact of cyber crime [which also touches on criminal aspects of intellectual property right protection] in Europe.  In conjunction with this, she has sent us a media release which reads, in relevant part:

"Some progress has been made in understanding and managing cyber crime as well assessing its economic impact. Yet much remains to be done. Lack of co-ordination in law enforcement and legislation, lack of common consensus on the nature of cyber crime and lack of knowledge sharing and trust are just some of the issues that both afflict cyber crime responses and cloud our understanding of cyber crime. 

The European Union is sponsoring a European project called E-CRIME in order to address these well-known problems. E-CRIME focuses on analysing the economic impact of cyber crime and developing concrete measures to manage risks and deter cyber criminals in non-ICT sectors. E-CRIME does so by adopting an inter-disciplinary and multi-level-stakeholder approach that fully integrates a wide range of stakeholders’ knowledge and insights into the project. 

First, the project will create a detailed taxonomy and inventory of cyber crime in non-ICT sectors, and analyse cyber criminal structures and economies by combining the best existing data sources with specialist new insights from key stakeholders and experts. 

Secondly, E-CRIME will assess existing counter-measures against cyber crime in non-ICT sectors in the form of current technology, best practices, policy and enforcement approaches, and awareness and trust initiatives. 

Thirdly, the project will use available information and new data to develop a multi-level model to measure the economic impact of cyber crime on non ICT-sectors. 

Fourthly, E-CRIME will integrate all its previous findings to identify and develop diverse, concrete counter-measures, combined in portfolios of inter-sector and intra-sector solutions.

... 

The consortium has now set up the E-CRIME Stakeholder Forum (ESF) comprising 24 representatives from key non-ICT sectors, ISPs and communication networks, law enforcement agencies, cyber security, legal, civil, and insurance companies, and governmental organisations from the Member States. The ESF acts as an advisory body for the consortium."

IP Finance proposes to keep an eye on this project, for which some ϵ3,749, 289 has been allocated. It will be interesting to see whether, and to what extent, the work of E-CRIME overlaps or is complementary to that of another institution, the OHIM-hosted European Observatory on Infringements of Intellectual Property Rights.

The cost of IP crime -- but how do we know?

Last month the UK's Cabinet Office published a notice proclaiming its report, "The cost of cyber crime", about which it says

"The overall cost to the UK economy from cyber crime is £27bn per year, according to the first joint Government and industry report into the extent and cost of cyber crime across the UK, launched today by the Office of Cyber Security & Information Assurance in the Cabinet Office and information intelligence experts Detica.

With society now almost entirely dependent on cyber space, developing effective strategies to tackle cyber crime requires a better understanding of its impact. Its breadth and scale have been notoriously difficult to understand and past attempts to set cyber crime policy or develop strategies have been hampered by a real lack of insight into the problem.

"The Cost of Cyber Crime" report reveals that whilst government and the citizen are affected by rising levels of cyber crime, at an estimated £2.2bn and £3.1bn cost respectively, business bears the lion’s share of the cost. The report indicates that, at a total estimated cost of £21bn, over three-quarters of the economic impact of cyber crime in the UK is felt by business. In all probability, and in line with worst-case scenarios, the real impact of cyber crime is likely to be much greater".

The summary records as follows with regard to IP theft:

"With the exception of the well-understood and documented copyright theft issue, the
types of IP most likely to be stolen by cyber criminals are ideas, designs, methodologies and trade secrets, which exist mostly in tangible form and add considerable value to a competitor.

But calculating the impact of this type of less-publicised IP theft is complex. Our approach produced three-point estimates for the economic value of IP by taking published figures for the value added to the economy per year in each sector and estimating the fraction attributable to IP.

Our results show that several business sectors are likely to be affected by IP theft because they either generate large volumes of IP or their IP can be exploited with relative ease. However, although no business sector is likely to be entirely immune from IP theft, the impact of cyber attacks is likely to be much smaller in sectors where relatively low volumes of IP are created".

IP Finance would like to understand more about the mechanism for assessing the cost of cyber crime and IP theft.  If any reader has the time and the inclination to read through these documents and would like to write them up for this weblog, he or she should please let me know.

You can download the summary here and the full report here.