In fiscal year 2012 (FY12), the total number of industry reports to the Defense Security Service (DSS) concerning attempts by foreign collectors to obtain illegal or unauthorized access to sensitive or classified information and technology resident in the U.S. cleared industrial base continued to rise.
In the FY10 version of this publication, the reported year-over-year rise was 50 percent; in the FY11 version, it was 74 percent; in this year’s version, it is 60 percent.
In FY12, industry reporting reached a watermark of sorts.
For the first time, one region–East Asia and the Pacific–was the origin of half of all reported incidents, an increase from 43 percent of the total in FY11.
The number of reported cases DSS ascribed to every other region also rose from FY11 to FY12.
However, given the magnitude of the increase in reports attributed to East Asia and the Pacific, the share of the total ascribed to every other region either stayed the same as in FY11 or declined.
The Near East remained the second most active collector region, based on industry reporting, at 16 percent of the FY12 total.
The only change in the relative positions of the different regions with regard to industry reporting of collection attempts linked to associated entities was South and Central Asia’s assumption of the third spot at 12 percent, displacing Europe and Eurasia at nine percent.
The even greater predominance of East Asia and the Pacific within the regional attributions meant even greater predominance in the data for suspicious network activity (SNA) as a method of operation (MO), because industry reporting reflects significant reliance on this method by East Asia and the Pacific collectors.
This year, SNA became the most commonly reported MO, displacing both attempted acquisition of technology (AAT) and request for information (RFI) from last year.
In FY12, AAT stepped back to second position, but RFI slipped to fourth, as academic solicitation, the most commonly reported MO in Near East-connected reports, replaced it in the top three.
These changes meant that more direct and transparent methods were increasingly displaced by more indirect and opaque methods.
The predominance of entities linked to East Asia and the Pacific and the Near East in industry reporting had a parallel effect regarding collector affiliations.
While commercial collectors remained most common in the data relating to all collectors world-wide, the portion DSS attributed to this category fell from 34 percent in FY11 to 29 percent in FY12.
In contrast, government (the most common affiliation in East Asia and the Pacific-connected reports) and government-affiliated (the most common affiliation in Near East-connected reports) both increased their share of the total, from 17 to 25 and from 18 to 22 percent, respectively.
The technologies that industry reported as targeted in collection attempts showed significant stability.
The top four technologies were information systems; electronics; lasers, optics, and sensors; and aeronautics systems technologies.
They accounted for from eight to 15 percent apiece in FY11 data, and remained the top four in FY12 (albeit in somewhat different order), accounting for from nine to 11 percent of the data.
Similarly, the next eight technologies in order of frequency of reporting remained the same between the two years.
While there was some repositioning between these individual technologies, and while collectively the eight accounted for over a quarter of the total, each one accounted for only two to five percent of the total, so the variations had little effect on the overall picture.
That overall pattern continued to show foreign entities attempting illicit collections against a wide range of technologies.
The most significant movement within the targeted technology data was the surge in reported collection attempts against electronics.
The number of cases related to this category increased by 94 percent, significantly higher than the overall increase in reported cases, and the category went from accounting for eight percent of the total in FY11 to 11 percent in FY12.
A substantial number of East Asia and the Pacific entities’ requests for electronics technology targeted radiation-hardened (rad-hard) integrated circuits, the special focus area of last year’s version of this publication.
Rad-hard circuits have applications in nuclear weapons, ballistic missiles, aerospace vehicles, and space programs.
Foreign entities, especially those linked to countries with mature missile programs, increasingly focused collection efforts on U.S. missile technology, usually aimed at particular missile subsystems.
This version of Targeting U.S. Technologies: A Trend Analysis of Cleared Industry Reporting covers missiles in a special focus area.
EAST ASIA AND THE PACIFIC
Recent changes in political leadership have caused a number of regimes to reassess or modify their defense postures, approaches, and responsibilities, affecting their collection strategies.
More so than most, regimes in the region must address both short- and long-term threats and defense challenges.
All this makes the region’s record of attempted collections a mix of continuity and change.
East Asia and the Pacific reached 50 percent in industry reports attributed to the region’s collectors.
While other regions remained active collectors, East Asia and the Pacific’s nearest competitor accounted for only about one-third as many reported collection attempts.
Electronics became East Asia and the Pacific’s most commonly reported targeted technology, with attempts aimed at specific sensitive components rather than complete systems.
But as a variety of end uses for the technology was possible, their ultimate purposes remained unclear.
East Asia and the Pacific cyber actors conducted relentless collection efforts, continually innovated, and demonstrated increasingly sophisticated abilities and targeting.
SNA became their foremost reported MO: the number of relevant SNA incidents increased by almost three and a half times, and the category increased its proportion of the total from 23 to 42 percent.
THE NEAR EAST
Significant frictions and international hostility within the Near East and with states from other regions as well as world organizations provided national regimes with a great deal of motivation to buttress defense forces.
International financial strictures and current national economic difficulties provided additional pressures to maintain and improve defense forces while expending the fewest resources possible, including by enabling cheaper indigenous manufacture.
Near East entities, most often government-affiliated, attempted to exploit delegation visits to cleared contractor facilities when possible, but otherwise tended to use complicated and opaque procurement networks to attempt to avoid export-control regulations.
Academic solicitations increased by almost 80 percent over FY11, becoming the top MO.
Students sought to conduct postgraduate-level research at U.S. academic centers involved in sensitive or classified research, especially in mechanical and aerospace engineering, materials science, and electrical and computer engineering.
SOUTH AND CENTRAL ASIA
As U.S. foreign policy priorities change, some South and Central Asia states may begin to realign their relationships toward other states outside the region.
The new relationships will likely pose a significant threat of transfer of U.S. defense technology, whether acquired legally or illicitly.
Shrinking regional defense budgets will potentially increase the illicit targeting of Western, including U.S., technology as multiple states attempt to maintain and modernize their militaries.
The number of cases ascribed to government affiliated collectors more than tripled, so the latter category accounted for 37 percent of the FY12 total, just higher than the commercial segment at 36 percent.
While AAT remained the most commonly reported MO, academic solicitation increased its share from nine to 25 percent of the total and climbed to the second position.
Instances of AAT largely involved commercial entities acting as procurement agents seeking U.S. technology and military equipment, and who identified the military or some other government entity as the intended end user.
Academic collectors demonstrated overt interest in U.S. technology in the large volume of requests from government-affiliated university entities to subject matter experts in U.S. industry.
While electronics jumped from being the fourth most targeted technology sector in FY11 industry reporting to the top position in FY12, South and Central Asia entities continued to display a wide-ranging interest in U.S. information and technology.
This almost certainly reflected the military modernization efforts for which states in the region perceived a need for Western technologies.
Collectors very likely intended to use many of the targeted technologies to upgrade older variants or to conduct reverse-engineering.
EUROPE AND EURASIA
Europe and Eurasia contains some of the most effective economic competitors to U.S. cleared contractors.
The region’s economic woes and popular pressures constantly exert pressure toward leaner defense budgets, even as its alliances and traditional international responsibilities continue to require relatively large, modern, well-equipped, and quickly deployable military forces.
Europe and Eurasia collectors targeted every technology sector in pursuit of these combined goals.
Some countries with less robust export-control regimes found themselves used as pass-through sites for illicit technology-collection attempts, whether wittingly or unwittingly.
Although in FY12, Europe and Eurasia slipped to being the fourth-ranked region in reported collection attempts, those attempts increased by 13 percent, and the region contains some of the most skillful and worrisome collectors targeting U.S. information and technology.
Commercial entities were the primary reported Europe and Eurasia collectors in FY12, accounting for more than twice the portion of the next most active, which was government-affiliated entities, often research institutions.
AAT and RFI combined to account for 60 percent of all reported suspicious contacts ascribed to this region.