 |
 |
||
 |
 |
 |
|
 |
|
||
    |   |  |  | ||||||||||||||||||
| |||||||||||||||||||||
 |  | |||
 |
||||
 |
|||
|
|||
|
CONSIDER IT A NEW FORM of corporate espionage. Stealing your competitor’s secrets to cash in on them is as old as commerce itself. But stealing your enemy’s secrets and giving them away, thereby diluting or eliminating their value? That seems to be a new corporate weapon born of the Internet age. Publishing the Colonel Sanders’ secret recipe online would be one thing; but publishing the keys to a pay-TV kingdom is quite another. Hacking pay-TV systems has been sport for hundreds of thousands of video pirates around the world for more than a decade. All that stands between a TV viewer and free programming is a “smart card” inserted in a DirecTV-style set-top box. Crack the secret code in the card, make your own version, and TV is free. In fact, during a day notoriously known as “Black Sunday” in the piracy community, DirecTV effectively zapped some 200,000 piracy cards around North America by sending destructive computer code at them. However widespread, TV piracy has always been viewed as the work of hobbyists. Until last month. In a lawsuit filed March 11 in California by French-based Canal Plus Technologies, a division of Vivendi Universal, the company claims just such chicanery by a division of Rupert Murdoch’s News Corp., named NDS. Canal Plus says NDS hired a team of hackers who broke its smart card codes, then distributed the secret on a well-known piracy Web site. The impact on Canal Plus was staggering — sources inside the firm suggest somewhere between half and three-fourths of all Canal Plus users in Italy were pirates, for example. Canal Plus is suing for $1.1 billion in lost revenues. The lawsuit is proceeding apace. Just yesterday, a California judge granted Vivendi’s request for an accelerated discovery schedule. |
||||||||
|
|
NDS said in a statement last month that the charges are baseless, and in fact were used recently as leverage for merger talks. The company declined to say more to MSNBC.com. ‘TOO FRIENDLY’ WITH PIRATES But sources in the computer underground say NDS has at times been “too friendly” with pirates. In fact, there are accusations that NDS employs many computer hackers, including the hacker who developed the the first widely-used counterfeit smart card in the early 1990s. NDS has reportedly admitted to partially funding another underground Web site, Thoic.com, but said it did so only for intelligence-gathering purposes. In a deposition last week, consultant Oliver Kommerling — who has worked for both Canal Plus and NDS — directly accused NDS employee Chris Tarnovsky FEARED FOR HIS LIFE But the stakes may be even higher. In a declaration filed with the court by Canal Plus security manager Gilles Kaehlin, Kaehlin says Tarnovsky admitted NDS was behind the smart card hack, and that he was prepared to tell the truth in court. But, the filing says, Tarnovsky refused to be the the whistle-blower on NDS’ illegal activities, “because he feared too much for his life and that of his family,” Kaehlin said. None of Canal Plus’ allegations have been proven, and NDS has offered a plausible alternative explanation — that their rival’s smart cards were simply easy to hack, and that’s why the pirates had a field day. But the case is the first high-profile, public look inside a world many computer security experts once only talked about in hushed voices. While graffiti-style Web-page hacks and other nuisance attackers get most of the press attention, high-stakes hacking — information-age corporate espionage — has been going on silently for some time. It’s carried out by criminals too smart to get caught, with too much money and stock value at stake for corporations to come clean when victimized. VEIL OF SECRECY There is only a trickle of information available on digital corporate espionage. The most authoritative seems to be an annual survey conducted jointly by the Computer Security Institute and the FBI. Released April 7, the anonymous survey of 500 companies and government agencies revealed once again that cyber espionage is soaring — theft of proprietary information cost the group some $170 million. But little is known about what kind of information was actually lost. “People have struck up online friendships with employers and then lured them into conspiracy to commit espionage. People have put bounties on laptops of executives. People have disguised themselves as janitors to gain physical access,” said Richard Power, editorial director for the institute. But would they steal a rival’s proprietary product and give it away, just to make it worthless? |
||||||||
“Do not underestimate stupidity and greed. Look at Enron,” Power said. “If company executives could participate in that kind of activity and cover it up it is quite plausible they would engage in the kind of activity charged in this case.” In fact, Power said, the only thing unusual about this case is the fact that the victim has gone public.SIMILAR TO DOS ATTACK The idea of diluting a rival’s value isn’t completely without precedent, said Tom Talleur, another cyber-espionage expert with KPMG Consulting Inc. Five years ago, rival Internet service providers would bombard each other with traffic in a denial-of-service attack to make surfing sluggish, and thus entice customers to switch. Two years ago, an Internet hosting provider was accused of hacking into a competitor’s customer database, publishing the data online, and then e-mailing the customers with the claim their competitor wasn’t secure. The claim was never proven. “Internet technology is so ubiquitous, all you’ve got to do is sit down and think about ‘How can I destroy my competitor?’ and you can do it,” Talleur said. “This is not a far-fetched notion. I’ve seen competitors do this to each other. It’s not far-fetched at all.” Ira Winkler, chief security strategist at Hewlett-Packard Co., said it is standard corporate practice to disassemble competitors’ products immediately after they arrive on the market — and what happens to that information is a legal question that’s yet to be settled. “Once a car is sold to the public every car manufacturer in the world knows the first buyers are competitors, who tear the car apart bolt by bolt and see how it works,” Winkler said. “There are more than enough indications this has gone on. Reverse-engineering your competitors’ practices is standard practice. “If industries start doing this as general practice, put on their corporate Web site ‘Here’s how to steal services from my competitor,’ well, is there anything illegal about detailing how you can rob a bank? No, but do you want to be known for that?” The court of public opinion may very well be the ultimate arbiter. Canal Plus and Vivendi have even bigger problems right now than hackers. Vivendi Chairman Jean-Marie Messier was already under fire because the firms’ slumping stock price, but things got nasty this week when he fired popular Canal Plus chief executive Pierre Lescure. Lescure founded Canal Plus and his ouster was viewed as disloyal; it’s prompted broadcast interruptions by protesting Canal Plus employees. And it’s even become an issue in the French presidential campaign. All the chaos adds fuel to claims that Canal Plus lawsuit is really just sour grapes, a desperate move by a company that’s simply being beaten in the marketplace. But if Canal Plus lawyers follow through on their promise to march a series of underground computer hackers to the witness stand in California, all to make ugly claims about who really funded their work, News Corp. might suffer an even more serious blow to its reputation. “Any company found guilty of performing this kind of piracy would be putting great deal of its reputation on the line,” said Bill Malik, an analyst with KPMG. “Corporate integrity is primary, especially when you’re not talking about some physical goods, you’re talking about something like content.” | |||||||||
| |
|||||||||||||||||
|
|||||||||||||||||
The week that wasn't on Wall Street
| |
|||
|
|
 |
|||||||||||||||
  |
|||||||||||||||||
|
|||||||||||||||||
|
|||||||||||||||||
 |
|||||||||||||||||
|
Advertisement
|
|||||||
 |
|||||||
 VirusScan 6.0 (Windows) $28.95 Dell |
|||||||
|
|||||||
