ECONOMIC ESPIONAGE: An Information Warfare Perspective

By Dr. Myron L. Cramer

Dr. Myron L. Cramer
Principal Research Scientist
Georgia Tech Research Institute
Georgia Institute of Technology

present address: BCT LLC

February 24-25, 1997

"The Economic Espionage act of 1996" Symposium
Society of Competitive Information Professionals (SCIP)
Georgetown University, Washington DC
presented: February 24-25, 1997

What is Information Warfare?

Information Warfare involves achieving and maintaining an information advantage over competitors or adversaries. Since competitive advantages can impact an organization's success or failure, it is important to understand the factors that affect this balance, and to understand the framework created by the new technologies and the new paradigms.

Elements of Information Warfare

With the increased value of information comes the need to approach it in new ways. Information Warfare has many aspects. To appreciate these it is important to discuss Information Warfare from several perspectives which may be thought of as the constituent elements; these are: information collection, protection, denial, management, and transport. Together, these define options, risks, and opportunities; how an organization chooses to implement and prioritize these elements is its Information Warfare strategy, which will impact its competitive position.

Information Collection. An organization needs a variety of information to support is operations. These needs include planning its activities, executing its plans, monitoring its progress, and reporting its results. Information collection includes the entry points for information into an organization from both internal and external sources. Issues include quantity (completeness), quality (accuracy), and timeliness of this information. Business examples of collection systems include point-of-sale (POS) systems, market surveys, government statistics, and internal management data.

Infomation Protection. Once information is collected by an organization, the next logical consideration is how to protect it. The vulnerability of the "Information Infrastructure" is widely discussed and publicized and is one important aspect of protection. Information protection addresses two types of threats: information compromise and destruction. Compromise involves a competitor gaining access to an organization's proprietary data. Destruction involves the loss of these data (or loss of access to these data) as the result of a hostile attack by an adversary.

Information Denial. Information denial includes measures beyond normal protection to specifically target an adversary's collection systems. There are two types of denial: direct attacks on the adversary's information systems, and providing misinformation to its systems to deceive and induce the adversary to take actions that are not to its advantage.

Information Management. An important element of Information Warfare is information management. The underlying concept is that with the increasing value of information in business, a competitive advantage can result from improved management of this resource. There are many aspects to this element including the selection and introduction of information technologies and the methods for controlling data within information systems. The decentralization of computing and data resources within organizations has created many issues for corporate data managers, including questions of "Where is the data?", "Who has it?", and "Which version is the most current?" Other issues include deciding which data to retain (archive) for future reference, and how to store these archived data so that they will be readable by future systems. As an organization's intellectual property exists increasingly in electronic forms, it is harder to manage using traditional methods (such as paper records) and may be more easily misplaced, lost or discarded. Automated solutions are important elements.

Information Transport. An essential element of Information Warfare is information transport. The speed with which this is done affects the timeliness of the data availability and therefore the responsiveness of the organization to situations. Since this responsiveness can be a big factor in the competitive process, the speed and efficiency of an organization's transport capabilities can be an important factor in the organization's survival or failure. Competitive transport systems must be fast, reliable, and controlled. Transport considerations must be viewed within the overall Information Warfare perspective, since the same efficiency that facilitates rapid message and data transportation also may be used by a competitor to download proprietary data bases in seconds or minutes.

Corporate Strategies An Information Warfare Strategy is an organization's relative mix of efforts among the five elements (information collection, protection, denial, management, and transport); this balance, whether explicitly selected or the result of separate investment and operational decisions affects the organization's competitive posture. Significant factors include market opportunities, likely competitor actions, and current competitive situation. Some of the areas in which these effects are evident are capital investment and operations. Incorporating Information Warfare into operational missions involves many choices. These choices are driven by competitiveness consideration. The aggressiveness shown by competitors in collecting information will affect the need for protection and denial. There are many possible postures an organization can take, each of which reflects the results of different attitudes toward the Information War. I illustrate these differences by considering five extreme positions where a single Information Warfare element is dominant.

Defensive. A heavily defensive posture is characterized by an emphasis on information protection including significant access-control and limited external system interconnections. This posture might be appropriate for a dominant market leader or an organization that benefits from the status quo. This strategy will have advantages in an environment containing emerging adversaries who are pursuing strategies to attack the leader or to change the current situation.

Offensive. The offensive posture is characterized by an emphasis on information denial including attacks on the market leader. This posture might be taken by organizations that are dissatisfied by their current standing and who may be desperate to take down their stronger adversaries.

Quantity. The quantity posture is characterized by an emphasis on supreme information transport capability. An organization adopting this posture places its confidence in its ability to move and use massive amounts of information over large well-established infrastructure. It depends upon the sheer volume and timeliness of its data to make attacks impractical. This posture will work best when the value of the organization's information is widely distributed and is of low sensitivity.

Quality. The quality posture is characterized by an emphasis on information management. A practitioner of this posture gains its advantage by its ability to manage its information needs better than its competitors. Compared with these competitors, its investments may be more modest, but they are wisely made. It makes better use of less information, and optimizes its use of modest protection. This posture may have advantages in a highly competitive, cost-sensitive market.

Sponge. The sponge posture is characterized by an emphasis on information collection and an insatiable thirst for large amounts of information. Practitioners of this posture may have adopted a follower strategy in which they quickly bring products to market based upon the innovations of others. They gain their competitive advantage by saving in research and product development. To avoid being left behind, they must monitor the activities of other more innovative adversaries and survey market responses so that once they can decide to follow a given initiative, they an quickly catch up in the marketplace using their previous market presence.

The optimum strategy in any arena depends on the competitor's actions. A more scientific treatment of strategy analysis is possible through Game Theory. In a competitive environment, the optimum strategy may depend on what the competition is doing.