This past February marked the one-year anniversary of the enactment of Law 1/2019, dated February 20, on Trade Secrets. The preamble states that organizations use confidentiality as a tool for managing business competitiveness, facilitating public-private knowledge transfer, and fostering innovation in research, with the aim of protecting information that encompasses not only technical or scientific knowledge but also business data relating to customers and suppliers, business plans, and market studies or strategies.
However, innovative companies are increasingly exposed to unfair practices aimed at the misappropriation of trade secrets, such as theft, unauthorized copying, industrial espionage, or breaches of confidentiality requirements. Globalization, increasing outsourcing, longer supply chains, and greater use of information and communication technologies all contribute to an increased risk of such practices.
Criminal law scholars have always agreed that the most serious violations of industrial or trade secrets should also be subject to criminal penalties, in line with neighboring countries. Currently, corporate espionage is criminalized under Article 278 of the Penal Code.
The wave of technological innovation has emboldened certain threat actors, who are capable of wiping out large amounts of a company’s data in seconds, exposing businesses to a greater risk of being hacked by competitors, foreign governments, and hacktivist groups. State-sponsored corporate espionage is a reality and is on the rise in a globalized, cyber-driven economy.
However, many companies will not realize the true value of their confidential information until it is stolen, which can have devastating consequences. Even the intelligence services of EU member states acknowledge that they are “groping in the dark” when it comes to cases of economic espionage. A key reason for the lack of data on the cybertheft of trade secrets is that many intrusions go undetected.
Cyber theft of trade secrets affects small and medium-sized businesses morethanlarge companies
According to ECIPE (February 2018), the negative impact on the EU resulting from the cybertheft of trade secrets amounts to approximately 60,000 million euros in lost economic growth, which translates into a loss of competitiveness and jobs and a reduction in R&D investment. More specifically, 289,000 jobs may have been at risk in 2018, and that number is projected to rise to one million jobs by 2025. Cyber theft of trade secrets affects SMEs more than large companies, due to their limited budgets, a lack of awareness that they are targets of espionage, and a shortage of qualified IT professionals.
We found a surprising 64% increase in security incidents attributed to competing companies, some of which may be backed by governments. When carrying out attacks, competitors often combine sophisticated high-tech techniques with other methods such as recruiting employees from the target company, bribery, extortion, and the promise of a new job. The rise in cybercrimes attributed to states and competitors coincides with an increase in the number of thefts of intellectual property and other sensitive information.
One of the most significant current conflicts in the field of technology and security worldwide is the Huawei case, with the U.S. accusing the company of industrial espionage, among other crimes. The issue has many facets, ranging from industrial espionage involving the use of foreign equipment to the advent of new technologies such as 5G and the trade war between China and the U.S.
Reluctance to award projects to Chinese companies out of fear of espionage has reached Europe
Chinese talent programs —which recruit experts from companies and universities around the world with various incentives to work in China—have been under FBI scrutiny since 2015 due to the threats they pose to U.S. companies and universities.
Reluctance to award projects to Chinese companies out of fear of espionage has also reached Europe. The EU is the top destination for Chinese companies. In 2017 alone, they invested more than 35 billion euros in Europe, with nearly 60% of that capital going toward infrastructure and communications. This has led several countries to view the influx of Chinese public capital into strategic companies with particular concern and to fear that these acquisitions could result in a transfer of technology to Beijing.
Cyberspionage as a common practice of certain governments is recognized by the National Cryptology Center and, similarly, by the 2019 National Cybersecurity Strategy.
The more technologically advanced a country is, the greater the risk that its companies will be targeted by attacks
These attacks are typically directed against industrial sectors and critical and strategic infrastructure around the world with the aim of gaining geopolitical advantages, state and/or corporate secrets, intellectual or industrial property, as well as data and information from strategic sectors.
The volume of trade secrets stored electronically, coupled with the rise in cyber intrusions, has created a perfect storm for economic espionage. The more technologically advanced a country is, the greater the risk that its companies will suffer attacks of this kind. Consequently, companies will find themselves embroiled in commercial and technological wars not only with other companies but also among states themselves. Hence, it is of the utmost importance to have effective and swift criminal responses to corporate espionage.
Author: Juan José Caselles