Schneier on Security

Skeptical • June 3, 2014 1:49 AM

The only difference between the U.S. and China’s actions is that the U.S. doesn’t engage in direct industrial espionage. That is, we don’t steal secrets from Chinese companies and pass them directly to U.S. competitors. But we do engage in economic espionage; we steal secrets from Chinese companies for an advantage in government trade negotiations, which directly benefits U.S. competitors. We might think this difference is important, but other countries are not as as impressed with our nuance.

Many are looking at the distinction conceptually as an ethical question. This approach misses the point, and I think it explains the slightly mystified tone some have in wondering why the distinction matters.

That is, they ask whether there is any moral difference between spying for national economic advantage in a treaty negotiation, and spying for (arguably) national economic advantage in the course of commercial competition.

They look at the ethically relevant conceptual similarities, and then stare in disbelief at those who claim that the distinction is important. And, in turn, the latter are simply puzzled as to why the former group “doesn’t get it.”

The ethical question is important. It is worthy of time, thought, and discussion. But it’s actually not the question that reveals why the distinction is important, and it completely misses the reasons for which the US, and other nations, are attaching much greater importance to it.

So let’s ask the question from a different vantage.

How important is the distinction to the development of global free trade?

The answer is contingent on empirical factors: it depends on the magnitude of commercial espionage being conducted and the magnitude and direction of the effect trade treaty espionage.

In other words, the importance of the distinction rests not on conceptual differences but on empirical differences in the effects of trade treaty espionage and commercial espionage.

Trade Treaty Espionage

I actually don’t think espionage during trade treaty negotiations makes a substantial difference relative to other factors, usually. The relative economic interests for example, surely a much larger factor, can be derived easily from open source intelligence and will inform the positions of all parties involved.

Indeed, much of the criticism of free trade policy is that free trade agreements are heavily biased in favor of powerful countries with leverage. These arguments have little trouble adducing evidence showing the significance of leverage that has nothing to do with espionage.

Commercial Espionage

Until several years ago, I would have said that this is of insufficient magnitude to matter much (though the lack of appropriate IP protections internationally was, and is, a major problem).

However, a combination of the easy scale-up of network intrusion operations, the enormous number of trade secrets that sit on network exposed devices, and hugely increased incentive to steal those secrets, has (perhaps predictably) resulted in a current magnitude, and a sharp direction of increase, that the impact on global free trade can be highly significant.

I don’t think any reader here needs to be persuaded of the truth of the last paragraph, but by way of additional background and support, let me quickly mention two useful references, one lengthy and one that can be read quickly.

This 100 page, well sourced, report chronicles the magnitude of the losses from IP theft generally, and the secondary effects of such losses (the policy proposals however are sometimes very unpersuasive). The report estimates the losses in 2012 to be around 320 billion US dollars (about the equivalent of US exports to Asia that year, and cites estimates below and above that figure). Although the report goes beyond commercial espionage, the incentives for commercial espionage and the size of its effects are closely linked to the other IP issues the report discusses.

This Financial Times article published just prior to Snowden does fair work of describing the increasing importance of the issue, the dangers that it creates, and the clear need for the US to escalate its response.

So looking at the distinction between the two activities in terms of their respective effects on important policies, we can see why the distinction matters so much, and why consensus has developed that the US has no choice but to escalate its response.

This has little to do with US and PRC national security espionage; neither country expects the other to stop doing so. Instead this has to do with defining and defending certain norms of behavior that can allow free trade in an information-centric global economy to flourish.

That said, one can usefully link concern about PRC national security espionage with concern about Chinese commercial espionage.

As Ross Anderson expounded upon last week, and as Nick P in particular has explained carefully and often with useful source material, the nature of networks and the tighter linking of networked systems means that security of commercial systems can have implications for the security of military systems. The division between the two, once tenable, has become more difficult to control.

Both of those points flow perfectly into Bruce Schneier’s argument that it is very unlikely, and increasingly unlikely, that we can provide security for some parties and some systems, and not for others.

I have to say that I’m not fully persuaded that a security differential cannot be maintained, even if in certain cases it may be difficult to impossible. I would really like to see the argument elaborated upon.

The takeaway is this:

The distinction is very important from the perspective of policy and global trade due to the current empirical differences in how trade treaty espionage and commercial espionage affect free trade and IP generally.

This is the case even if we find the two types of actions to be highly similar, and the distinction unimportant, from an ethical vantage.

Put differently: the distinction is mere nuance, perhaps, if the question is “is one act more ethically defensible than the other”; great importance if the question is “which one, as practiced, is the more pressing policy issue”.

While the media will focus on the “which one is worse” angle, because that’s the most relatable angle, which will attract the widest audiences and which also allows everyone to have an opinion, that angle misses the real problems being faced and the real forces that are shaping the actions of the US and the PRC.

This also provides an opportunity for those who are more interested in a practical, responsible, balanced approach to improving information policy and security than they are in playing the “which country is worse” game, or the “let’s demonize the government” game, or the “us against them” game.

Commercial espionage is an issue on which opinions of those across the political spectrum converge; it is an issue favorable to those who advocate better information security policies; and it is an issue that links, in interesting and as yet unexploited ways, to consumer privacy and individual control of personally identifying information.

Skeptical • June 3, 2014 10:54 AM

To Moderator: Just a heads up that a comment of mine was snagged in the spam filter.

@Clive: Your comments re lax US IP protection are applicable largely to the 18th and 19th centuries (the two comments that are applicable to more recent years: “submarine patents” don’t enable IP misappropriation, and overly broad claims in a patent are obviously problematic). While the US patent system has many problems, inadequate protection of IP isn’t one of them and has not been for a very long time.

Skeptical • June 3, 2014 6:05 PM

To Moderator: Thanks for posting the comment that was caught in the spam filter.

@Clive: The simple fact is the US plundered as and where it felt it could, be it ideas or physical resources, now it feels it’s got to the point where it is becoming obvious the only way is down, it’s drawn up the draw bridge and trying to turn it’s blatant hostile theiving activities into what it thinks is a moral high ground….

The US is asking the PRC to stop stealing things from companies in order to enrich companies owned and run by the PRC.

It’s not something that the US does, so they’re not asking the PRC to play by different rules.

I’m not sure what you think is terribly unreasonable about the US request.

What is obvious to those in science and industry is that such fervant nationalistic activities are not relevant to the way the rest of the world now functions.

What are you on about? Asking China to stop stealing private property to enrich companies owned by the Chinese Government is a “fervent nationalistic” activity?

It’s only the bought and payed for politicos banging the drum to mislead the gulable that the legislation created by corps and their lobyists –that the politico has not even bothered to read befor sponsoring it– is good for the gulable, not the plutocrats paying for it.

What legislation are you talking about?