2014 DSS Targeting Trends Report

The Defense Security Service has published its 2014 Targeting US Technologies: A Trend Analysis of Cleared Industry Reporting (pdf)

Executive Summary

Fiscal year 2013 (FY13) saw a continuation of the past decade’s steady rise in reported foreign collection attempts to obtain unauthorized access to sensitive or classified information and technology resident in the U.S. cleared industrial base.

While industry reports to the Defense Security Service (DSS) in FY13 increased a considerable 33 percent, this was less than the 50, 74, and 60 percent increases of immediately preceding years.

The six collector regions remained in the same relation to each other in FY13 as in FY12 with regard to the frequency with which they appeared in industry reporting to DSS.

Increases for the six regions ranged from 15 percent for the relatively large number of East Asia and the Pacific reports to over 100 percent for the relatively small number of Western Hemisphere reports.

With regard to shares of total reporting, the perennial top collector region, East Asia and the Pacific, receded six percentage points, while each of the other major regions gained between two and four percentage points.

While the number of industry reports linked to East Asia and the Pacific increased from FY12, they did so by only 15 percent, less than in recent years, and regional collector entities’ share of the total decreased from 50 to 44 percent.

A plausible explanation is that beginning in February 2013 press reports highlighted corporate and industry reports detailing a multi-year analysis of cyber espionage conducted by East Asia and the Pacific cyber operatives.

The coverage included specifics concerning their infrastructure, protocols, and methods, and DSS’ U.S. government partners followed up by providing industry with additional technical indicators.

The level of industry reporting of cyber operations linked to East Asia and the Pacific dropped.

But after a period of several months—sufficient for cyber actors to make adjustments—the level of reporting began to rise again.

However, the temporary suppression had an impact on other aspects of FY13 data.

Suspicious network activity (SNA), the method of operation (MO) most commonly reported in recent years for collection attempts linked to East Asia and the Pacific, decreased in number of cases and slid from 29 to 19 percent of the yearly total.

This publication discusses these issues in greater detail in the East Asia and the Pacific section.

The temporary overall decrease in reports of SNA allowed academic solicitation, which increased over 80 percent in number of reported cases year-overyear, to become the most common MO in overall reporting at 22 percent.

A similar MO, seeking employment, by far the most common MO in South and Central Asia-connected reporting, also experienced a huge increase overall, increasing by more than a factor of five in number of reported cases, increasing from three to 14 percent of the total, and becoming the fourth most reported MO.

Attempted acquisition of technology and request for information both claimed reduced shares, although they remained the third and fifth most reported MOs, and combined they still accounted for over a quarter of the total.

Solicitation or marketing services remained stable, accounting for nine percent of the total both years.

The dip in cyber reporting linked to East Asia and the Pacific also affected collector affiliation data.

DSS attributes a high percentage of East Asia and the Pacific SNA to the government affiliation.

In overall FY13 data, government was the only affiliation that declined in number of reported cases, its share of the total fell from 25 to 17 percent, and it fell from the second to the fourth position.

Commercial remained the most cited affiliation, accounting for 27 percent of the total, down slightly from the year before.

The government-affiliated and individual categories rose in share, to 27 and 19 percent, respectively, taking over the second and third positions.

This reflected the large increase in reported academic solicitation by individuals linked to government-related institutions or seemingly acting on their own.

DSS’ shift in technology categorization schemes (discussed in the Background section) introduced some volatility to that aspect of the data.

Nonetheless, electronics was the top targeted technology sector at eight percent, declining from 11 percent in FY12.

The command, control, communication, and computers (C4) (five percent) and software (three percent) sectors—last year making up the top-ranked information systems category—combined to account for eight percent of the FY13 total, down from 11 percent in FY12.

Similarly, the now-separate radars, optics, sensors (acoustic), and lasers sectors together accounted for seven percent, compared to their ten percent as one category last year.

Aeronautic systems rose from the fourth to the third most targeted technology sector in industry reporting, although it declined in both number of reported cases and share of the total.

In contrast, marine systems increased almost 50 percent in number of reported cases and rose from the eighth most targeted sector to fourth.

The remaining reported collection efforts targeted technologies ranging widely over nineteen additional sectors.

While none of these individually accounted for more than three percent, DSS considered the positioning, navigation, and time category to be especially significant.

The special focus area of this publication addresses inertial navigation systems, a subset of that category.

Key Points

East Asia and the Pacific

• Continued to be the most prolific collector region, accounting for 44 percent of all reports
• While SNA remained the region’s most common MO, there was a significant drop from FY12, whereas there was a substantial increase in academic solicitation
• Emphasized electronics, C4, aeronautic systems, and marine systems technologies
• Showed sustained interest in building business relationships with cleared industry

Near East

• Leveraged its network of intermediaries, procurement agents, brokers, and front companies, as well as access to cleared contractor facilities and personnel where possible
• Practiced academic solicitation as top MO (46 percent), but SNA capabilities improved
• Targeted research programs specializing in computational fluid dynamics—with applications to both marine and aeronautic systems—as well as electronics
• Government-affiliated collectors accounted for 44 percent of collection activities

South and Central Asia

• Amidst government intentions to produce more military technology indigenously, reported suspicious incidents linked to the region increased by two-thirds, making it the third most prolific
• Academic solicitation and seeking employment MOs accounted for nearly two-thirds of reported contacts, and individual affiliation more than doubled its share of the total
• Continued targeting electronics (especially enabling components) and C4; also focused on radars and nanotechnology

Europe and Eurasia

• Reported suspicious contacts increased over 50 percent
• Commercial entities were the most reported collectors, but individuals accounted for more than a quarter
• Attempted acquisition of technology remained the most reported MO, but seeking employment increased ten-fold and became the next most common

Read the report:

2014 Targeting US Technologies: A Trend Analysis of Cleared Industry Reporting (pdf)