ll I I TARGE TING US TECHWIE TREND ANALYSIS OF REPORTING FROM DEFENSE INDUSTRY DSS MISSION DSS supports national security and the warfighter secures the nation’s technological base and oversees the protection of sensitive and classified information and technology in the hands of industry We accomplish this mission by clearing industrial facilities personnel and associated information systems collecting analyzing and providing threat information to industry and government partners managing foreign ownership control and influence in cleared industry providing advice and oversight to industry delivering security education and training and providing information technology services that support the industrial security mission of the Department of Defense and its partner agencies THIS PRODUCT WAS COORDINATED WITH ACIC AFOSI DIA NGA Produced by the Defense Security Service Counterintelligence Directorate www DSS mil TARGE TIN US TECHNOLOGIES A TREND ANALYSIS OF REPORTING I j FRDM DEFENSE INDUSTRY TABLE OF CONTENTS PREFACE 5 EXECUTIVE SUMMARY 6 BACKGROUND 9 SPECIAL FOCUS AREA RADIATION-HARDENED MICROELECTRONICS 15 EAST ASIA AND THE PACIFIC 23 NEAR EAST 33 EUROPE AND EURASIA 45 SOUTH AND CENTRAL ASIA 53 OTHER REGIONS 63 CONCLUSION 64 OUTLOOK 67 ABBREVIATIONS AND ACRONYMS 70 REFERENCES 72 TA R G E T I N G U S T E C H N O L O G I E S 2 0 1 2 FIGURES EXECUTIVE SUMMARY NEAR EAST FIGURE 1 REGIONAL TRENDS 6 FIGURE 11 COLLECTOR AFFILIATIONS 34 FIGURE 2 FISCAL YEAR 2011 COLLECTION TRENDS 8 FIGURE 12 METHODS OF OPERATION 36 BACKGROUND FIGURE 13 TARGETED TECHNOLOGY 40 EUROPE AND EURASIA FIGURE 3 COLLECTOR AFFILIATION DEFINITIONS 10 FIGURE 14 COLLECTOR AFFILIATIONS 46 FIGURE 4 METHOD OF OPERATION DEFINITIONS 11 FIGURE 16 TARGETED TECHNOLOGY 50 SPECIAL FOCUS AREA RADIATION-HARDENED MICROELECTRONICS FIGURE 15 METHODS OF OPERATION 48 SOUTH AND CENTRAL ASIA FIGURE 17 COLLECTOR AFFILIATIONS 54 FIGURE 5 REGIONS OF ORIGIN 17 FIGURE 18 METHODS OF OPERATION 57 FIGURE 6 COLLECTOR AFFILIATIONS 19 FIGURE 19 TARGETED TECHNOLOGY 59 FIGURE 7 METHODS OF OPERATION 20 EAST ASIA AND THE PACIFIC FIGURE 8 COLLECTOR AFFILIATIONS 24 FIGURE 9 METHODS OF OPERATION 27 FIGURE 10 TARGETED TECHNOLOGY 29 IN THE INTERESTS OF READABILITY AND COMPREHENSI ON THE EDI TORS HAVE DEFERRED THE CONVENTIONAL STYLISTIC USE OF REPEATED ACRONYMS I N FAVOR OF A FULL EXPOSITION OF TERM S AS THEY ARE FI RST USED WI THI N EACH SECTI ON TA B L E O F C O N T E N T S THIS PAGE INTENTIONALLY LEFT BLANK 4 TA R G E T I N G U S T E C H N O L O G I E S 2 0 1 2 PREFACE The stakes are high in the battle against foreign collection efforts and espionage that target U S technology intellectual property trade secrets and proprietary information Our national security relies on our collective success at thwarting these persistent attacks Every time our adversaries gain access to sensitive or classified information and technology it jeopardizes the lives of our warfighters since these adversaries can exploit the information and technology to develop more lethal weapons or countermeasures to our systems Our national security is also at risk in the potential loss of our technological edge which is closely tied to the economic success of the cleared contractor community and the well-being of our economy Preventing such losses takes a team effort The Defense Security Service DSS builds on the information contained in reports from industry to develop analytical assessments that articulate the threat to U S information and technology resident in cleared industry This annual publication Targeting U S Technologies A Trend Analysis of Reporting from Defense Industry presents DSS’ analysis of those industry reports Like any analysis this one is only as good as the information that goes into it Timely and accurate initial reports of illicit collection attempts are the foundation upon which this process rests and it is cleared contractor employees who originate those suspicious contact reports When this process works well our national security warfighters cleared industry partners and local communities all benefit The information contained in this report helps employees companies and intelligence and law enforcement professionals better understand the continuing yet changing nature of the threats we face Increased awareness of the U S technologies being targeted by foreign entities and the methods of operation they use in their efforts to acquire those technologies can only make us better at identifying and thwarting illicit collection attempts In fiscal year 2011 our combined efforts produced 485 operations or investigations based on information that industry provided Over threequarters of these are still undergoing significant action with many foreign collectors already identified isolated diverted or otherwise thwarted P R E FA C E But these combined efforts face a threat that is growing persistent pervasive and insidious Cleared industry DSS and the intelligence and law enforcement communities continue their efforts to further expand develop and refine their methods of defending our national security Yet the response by foreign collectors who seek to illicitly acquire U S information and technology despite those efforts also continues to undergo expansion development and refinement During fiscal year 2011 the persistent pervasive and insidious nature of that threat became particularly noteworthy and the pattern became even more firmly established Foreign collectors seek to elude the protective efforts of industry DSS the Intelligence Community and law enforcement by concealing their activities behind various covers such as third countries front companies and cyber identities This report will present various examples of such activities Increasingly the result of all this foreign collection activity is like malignant plants with multiple interlocking roots and branches These noxious weeds root in unexpected places then send out shoots and tendrils that encroach through any crack or gap into the nurseries and gardens of our industrial base We may pull out some parts of a plant by the roots and lop off the leaves of others but the pervasive penetrating weeds remain It is only by the continued vigilance and focused and unstinting effort of those of you in cleared industry—by “tending your garden” assiduously and reporting incursions of “weeds” promptly and fully—that the rest of the nation’s defenders can help protect its security Stanley L Sims DIRECTOR DEFENSE SECURITY SERVICE 5 EXECUTIVE SUMMARY In one way the data concerning industry reports of foreign attempts to obtain illegal or unauthorized access to sensitive or classified information and technology resident in the U S cleared industrial base remained very consistent between fiscal year 2010 FY10 and FY11 The East Asia and the Pacific region accounted for 43 percent of the total in both years the Near East accounted for 18 percent in both years Europe and Eurasia dropped only from 15 percent to 13 percent and South and Central Asia was reasonably stable rising from nine percent to twelve percent REGIONALTRENDS FIGURE 1 EASTASIAAND - THE PACIFIC NEAR EAST qu's EUROPE AND 7 EURASIA scum AND CENTRAL ASIA 1 But this seeming stability in the data does not reflect the overall phenomena in the past year The total number of reports received from industry increased over 75 percent from FY10 In the past year reports from the East Asia and the Pacific and Near East regions increased by around 75 percent from Europe and Eurasia by over 60 percent and from South and Central Asia by a steep 129 percent All other regions increased in number of reports as well Thus the only stability in the data is the relentless upward trend Considerable diversity exists within each region Countries vary in size resources economic development political system degree of militarization and foreign policy orientation and goals And the situation is not static change continues in these variables as well Some countries are on the way others down however defined Some are satisfied with their place and role in the world others aspire to change them and work aggressively to do so Any of these factors can lead to attempts to obtain illegal or unauthorized access to sensitive or classified information and technology resident in the us cleared industrial base Despite the diversity between regions and countries discussed above collectors continue to expand the degree of interaction between them in their attempts to obtain illegal or unauthorized access to sensitive or classified information and technology resident in the U S cleared industrial base Whether working with each other working through each other buying from each other or attempting to throw suspicion on each other these convoluted pathways make it more difficult to ascribe collection attempts to a particular country region or collector affiliation TARGETING U S TECHNOLOGIES 2012 KEY FINDINGS The order of the regions linked to the most prolific collectors of U S information and technology remained unchanged from fiscal year 2010 FY10 commercial remained the most common collector affiliation and the top four most targeted technology categories remained the same Constancy of the order of the regions represents the most enduring trend Over the past five years East Asia and the Pacific and the Near East have remained the first and second most prolific collector regions responsible for at least 56 percent of all reported collection attempts each year including 61 percent in FY11 However industry reports of collection attempts originating from South and Central Asia increased by 129 percent reflecting aggressive collection efforts Commercial entities constituted the most common affiliation in FY11 industry reporting residing at the top of the ranking in five of the six regions Collectors’ most frequently applied methods of operation MO sought information or technology directly whether by attempted acquisition of technology or request for information RFI Combined these MOs accounted for 43 percent of reported collection attempts in FY11 A DSS redefinition of attempted acquisition led to different apportionment of cases in FY11 than in previous years but taken together these two MOs represent direct overt contact EXECUTIVE SUMMARY with cleared industry in an attempt to receive information or acquire technology— by simply asking for it In FY11 suspicious network activity SNA was the most prevalent collection MO for entities originating from East Asia and the Pacific SNA figured no more prominently than fifth in any other region Due to the nature of SNA it remains difficult to attribute such collection attempts to an entity or even to a region of origin The top four most targeted technology categories in FY11—information systems IS lasers optics and sensors LO S aeronautics systems and electronics— remained unchanged Armaments and energetic materials replaced marine systems as the fifth most targeted category of the Militarily Critical Technologies List MCTL But there was a broadening of reported interest in technology to space systems processing and manufacturing and directed energy systems in FY11 Foreign governments are beginning to move into space for commercial telecommunications increased command and control and intelligence surveillance and reconnaissance ISR and the demand for radiation-hardened rad-hard microelectronics is likely to dramatically rise over the coming years Foreign entities’ interest in these technologies rose over the past year and collectors will likely increase their targeting of cleared contractors’ design manufacturing and packaging of rad-hard microelectronics 7 FISCAL YEAR 2011 COLLECTION TRENDS FIGURE 2 soum AID 12mm EURODE mu CENTRAL ASIA EURASIA EAST ASIA AND THE PACIFIC COLLECTOR METHODS OF TOP TARGETED a COMMERCIAL ATTEMPTED ACOUISITION INFORMATION SYSTEMS OF TECHNOLOGY INDIVIDUAL g LASERS OPTICS ANO SENSORS REQUESTS FOR INFORMATION GOVERNMENT AFFILIATED AERONAUTICS SYSTEMS I SUSPICIOUS NETWORK ACTIVITY GOVERNMENT mcmomcs ACADEMIC SOLICITATION 7 UNKNOWN If sm PERCENTAGE or CASES ormuu roam VISITS 1 ARMAMENTS AND ENERGETIC MATERIALS SOLICITATION OR MARKETING REGIO CONFERENCES CONVENTIONS Helm n AND TRADE SHOVIS MATERIALS AND PROCESSES 6 EXPLOITATION OF RELATIONSHIPS snouno SYSTEMS SEEKING EMPLOYMENT 8 INFORMATION SECURITY CRIMINAL ACTIVITIES PROCESSING AND MANUFACTURING 6- TARGETING U S TRAVELERS OVERSEAS TOP TECH HT r'methcuI-a telil'u lolc'gle s aha-m appear ur-I r cwemll FY11 8 TARGETINC U S TECHNOLOGIES 2012 BACKGROUND THE ROLE OF THE DEFENSE SECURITY SERVICE DSS supports national security and the warfighter secures the nation’s technological base and oversees the protection of U S and foreign classified information and technology in the hands of industry The DSS Counterintelligence CI Directorate seeks to identify unlawful penetrators of cleared U S industry and stop foreign collection attempts to obtain illegal or unauthorized access to sensitive or classified information and technology resident in the U S cleared industrial base DSS CI articulates the threat for industry and U S Government leaders THE ROLE OF INDUSTRY In carrying out its mission DSS relies on the support of cleared contractor employees and the U S intelligence and law enforcement communities Chapter 1 Section 3 of Department of Defense DoD Instruction 5220 22-M National Industrial Security Program Operating Manual NISPOM dated February 28 2006 requires cleared contractors to remain vigilant and report suspicious contacts The process that begins with initial industry reporting and continues with ongoing and collective analysis reaches its ultimate stage in successful investigations or operations by federal investigative or intelligence agencies In accordance with the reporting requirements laid out in the NISPOM DSS receives and analyzes reports from BACKGROUND cleared contractors and categorizes them as suspicious unsubstantiated or of no value For each reported collection attempt DSS data aggregation and analysis methodologies seek to gather as much information as possible The analysis of this information forms the basis for this report Such cleared contractor reporting provides information concerning actual probable or possible espionage sabotage terrorism or subversion activities to DSS and the Federal Bureau of Investigation When indicated DSS refers cases of CI concern to its partners in the law enforcement and intelligence communities for potential exploitation or neutralization DSS follows up with remedial actions for industry to decrease the threat in the future This builds awareness and understanding of the individual and collective threats and actions and informs our defenses THE REPORT DoD Instruction 5200 39 Critical Program Information CPI Protection within the Department of Defense dated July 16 2008 requires DSS to publish a report that details suspicious contacts occurring within the cleared contractor community The focus of the report is on efforts to compromise or exploit cleared personnel or to obtain illegal or unauthorized access to classified information and technology resident in the U S cleared industrial base Each year DSS publishes Targeting U S Technologies A Trend Analysis of Reporting 9 from Defense Industry In this report the 14th annual Targeting U S Technologies DSS provides a snapshot of its findings on foreign collection attempts It provides a statistical and trend analysis that covers the most prolific foreign collectors targeting the cleared contractor community during fiscal year 201 1 FY11 compares that information to the previous year's report and places that comparison into a larger context Instruction 5200 39 requires DSS to provide its reports to the CI community national entities and the cleared contractor community This unclassified version of the report constitutes part of ongoing effort to assist in better protecting the U S cleared industrial base by raising general threat awareness encouraging the reporting of incidents as they occur identifying specific technologies at risk and applying appropriate countermeasures DSS intends the report to be a ready reference tool for security professionals in their efforts to detect deter mitigate or neutralize the effects of foreign targeting DSS released a classified version of this report earlier this year DSS bases this report primarily on SCRs collected from the cleared contractor community It also includes references to all-source Intelligence Community IC reporting DSS considers all SCRs received from cleared industry It then applies analytical processes to them including the DSS foreign intelligence threat assessment methodology This publication is organized first by targeting region then 10 by collector affiliation methodologies employed and technologies including the specific technology sectors targeted It incorporates statistical and trend analyses on each of these areas Each section also contains a forecast of potential future collection attempts against the cleared contractor community based on analytical assessments COLLECTOR AFFILIATION DEFINITIONS FIGU RE 3 MER DIAL Entities whose span of business Includes the defense sector GOVERNMENT AFFILIATED Research Institutes laboratories universities or contractors funded by representing or otherwise operating In cooperation with a foreign government gency Mme shred purposes may Include acquiring access to U S classified or export-controlled lnforrnatlon AA GDVER NMENT Min lstries of Defense and branches of the as well as foreign military attaches foreign liaison of cers and the like INDIVIDUAL Persons who for financial gain or ostensibly for academic or research purposes seek to acquire access to U S sensitive classified or export-controlled Information or technology or the means of transferrim It out of the country ll Instances In which no attribution of a contact to a specific end user could be directly made A TARGETING U S TECHNOLOGIES 2012 METHOD OF OPERATION DEFINITIONS FIGURE 4 at BACKGROUND ACADEMIC SOLICITATION Via request for or arrangement of peer or sclentliic board reviews of academic papers or presentations or request to study or consult with faculty members or applications for admission Into academic Institutions department majors or programs as faculty members student fellows or employees ATTEMPTED OF TECHNOLOGY Via direct purchase of firms or the agency of hont companies or third countries these ae attempts to acquire protected Information In tfre form of controlled technologies whether the equlprnent Itself or schematics plans spec sheet or the lIke CONFERENCES CONVENTIONS AND TRADE SHOWS This refers to suspicious activity at such events especially those involving dual-use or sensitive technologies that lrrvoive protected Infonnatlon such as taking of photogaphs making sketches or asking of detailed technical questions CRIMINAL ACTIVITIES Vla theft these are attempts to acquire protected Information with no pretense or plausibility of legitimate acquisition EXPLOITATION OF RELATIONSHIPS Vla establishing connections such as joint ventues official aaeements foreign sales business arranpments or cultud these are attempts to play upon existing legitimate or ostensi biy innocuous relationships to gain unauthorized access OFFICIAL FOREIGN VISITS AND TARGETINC Vla visit to cleaed contractor facilities that are either pre-arranged by foreign contingent or unannounced these are attempt to gain access to and collect protected Information that goes beyond that permitted and intended tor shalng 9 9 REQUESTS FOR Vla phone email or webcard approaches these are attempt to collect protected Information under the guise of price quote maketlng surveys or other direct and Indirect effort SEEKI NO EMPLOYMENT Vla resume submissions applications and references these re attempt to Inirodrrce persons who or unwittingly will thereby gain access to protected information which could prove useful to agencies of a foreign government SOLICITATION OR MARKETI NC Vla sales representation or agency offers or response to tenders for technical or business services these are attempt by foreign entities to establish a connection with a cleared contractor vulnerable to the extraction of protected Information SUSPICIOUS NETWORK ACTIVITY Vla cyber intrusion viruses maiware backdoor attacks acquisition of user names and passwords and simlla targeting these re attempt to cary out Intrusions into cleaed contractor networks and exfiitrate protected Information TARGETINC U S TRAVELERS OVERSEAS Via airport searches hotel room Incurslons computer device accesslru telephone monitoring personal lntercharge and the like these are attempt to gain access to protected information through the presence of cleared contractor employees traveling abroad as a result of invitations and or payment to attend seminars provide training deliver speeches and the like 11 Pending a transition in technology categorization schemes DSS continues to analyze foreign interest in U S defense technology in terms of the 20 sections in the Militarily Critical Technologies List MCTL The MCTL is a compendium of the science and technology capabilities under development worldwide that have the potential to significantly enhance or degrade U S military capabilities in the future It provides categories and subcategories for DSS to use in identifying and defining targeted technologies This publication also makes reference to the Department of Commerce’s Entity List This list provides public notice that certain exports re-exports and transfers incountry to entities included on the Entity List require a license from the Bureau of Industry and Security An End-User Review Committee ERC annually examines and makes changes to the list as required The ERC includes representatives from the Departments of Commerce Defense Energy State and when appropriate Treasury For FY11 the categories DSS used to identify methods of operation remained unchanged from the previous year However improved industry reporting and a refinement in DSS methodology resulted in more cases falling into the attempted acquisition of technology category that might previously have been labeled requests for information 12 ESTIMATIVE LANGUAGE AND ANALYTIC CONFIDENCE DSS uses the IC estimative language standard The phrases used such as we judge we assess or we estimate and terms such as likely or indicate represent the agency’s effort to convey a particular analytical assessment or judgment Because DSS bases these assessments on incomplete and at times fragmentary information they do not constitute facts nor provide proof nor do they represent empirically based certainty or knowledge Some analytical judgments are based directly on collected information others rest on previous judgments and both types serve as building blocks In either variety of judgment the agency may not have evidence showing something to be a fact or that definitively links two items or issues Intelligence judgments pertaining to likelihood are intended to reflect the approximate level of probability of a development event or trend Assigning precise numerical ratings to such judgments would imply more rigor than the agency intends The chart below provides a depiction of the relationship of terms to each other REMOTE VERY UNLIKELY UNLIKELY EVEN CHANCE PROBABLY LIKELY VERY LIKELY ALMOST CERTAINLY TA R G E T I N G U S T E C H N O L O G I E S 2 0 1 2 The report uses probably and likely to indicate that there is a greater than even chance of an event happening However even when the authors use terms such as remote and unlikely they do not intend to imply that an event will not happen The report uses phrases such as we cannot dismiss we cannot rule out and we cannot discount to reflect that while some events are unlikely or even remote their consequences would be such that they warrant mentioning DSS uses words such as may and suggest to reflect situations in which DSS is unable to assess the likelihood of an event generally because relevant information is sketchy fragmented or nonexistent In addition to using words within a judgment to convey degrees of likelihood DSS also assigns analytic confidence levels based on the scope and quality of information supporting DSS judgments HIGH CONFIDENCE • Well-corroborated information from proven sources minimal assumptions and or strong logical inferences • Generally indicates that DSS based judgments on high-quality information and or that the nature of the issue made it possible to render a solid judgment MODERATE CONFIDENCE • Partially corroborated information from good sources several assumptions and or a mix of strong and weak inferences • Generally means that the information is credibly sourced and plausible but not of sufficient quality or corroborated sufficiently to warrant a higher level of confidence LOW CONFIDENCE • Uncorroborated information from good or marginal sources many assumptions and or mostly weak inferences • Generally means that the information’s credibility or plausibility is questionable or that the information is too fragmented or poorly corroborated to make solid analytic inferences or that we have significant concerns or problems with the sources BACKGROUND 13 THIS PAGE INTENTIONALLY LEFT BLANK 14 TA R G E T I N G U S T E C H N O L O G I E S 2 0 1 2 RADIATION-HARDENED MICROELECTRONICS OVERVIEW Ionizing radiation affects microelectronics and electronic systems during high-altitude flights and space operations in particle accelerators and in the proximity of fission or fusion reactions In environments of high ionizing radiation non radiationhardened rad-hard microelectronics or insufficiently rad-hard microelectronics operationally degrade or fail due to single-event effects SEEs Radiation hardening by process or design protects microelectronics and electronic systems from the effects of ionizing radiation The Defense Security Service DSS produced this Special Focus Area assessment to alert cleared industry to the increasing foreign threat to rad-hard microelectronics and facilitate the implementation of mitigation strategies to counter that threat RADIATION HARDENING BY PROCESS – This method requires a foundry dedicated to hardened microelectronics Recipe steps are the proprietary information of the manufacturer or classified by the U S Government Radiation hardening by process can consist of proprietary steps added to a standard process of manufacturing a wafer so as to make it rad-hard In such a case there is no distinction between standard wafers and rad-hard wafers during much of the process RADIATION HARDENING BY DESIGN – This method relies solely on integrated circuit design and layout techniques to mitigate damage caused by ionizing radiation Manufacturers design custom circuits for optimal performance in a targeted radiation environment then fabricate them separately in a high-volume commercial approach Radiation hardening by design presumes no access or visibility into the manufacturing process to enhance radiation tolerance reliability S P E C I A L F O C U S A R E A R A D I AT I O N - H A R D E N E D M I C R O E L E C T R O N I C S 15 RADIATION-HARDENED MICROELECTRONICS SPECIAL FOCUS AREA RADIATION-HARDENED MICROELECTRONICS Foreign entities’ interest in rad-hard or destructive they can result in the total microelectronics has risen over the past abandonment of a space system versus year a trend reflected in industry reporting spending the time and money to fix the from fiscal year 2011 FY11 which saw problem a 17 percent rise in reported targeting DSS analysis of industry documentation of rad-hard microelectronics from FY10 reveals that reported foreign collection When analyzed collectively these reports attempts directed at cleared contractors that show a particularly strong interest in these design manufacture and package rad-hard technologies from regions with active or microelectronics maturing space programs increased 17 percent Acquisition of a relatively SINGLE-EVENT EFFECTS from FY10 to FY11 small number of rad-hard Near East and Europe microelectronics SOFT ERRORS non-destructive and Eurasia collectors would likely assist • SINGLE-EVENT TRANSIENT – Discharge targeting rad-hard foreign governments in of collected charges from an ionizing microelectronics who developing their own event were frequently noted radiation hardening • SINGLE-EVENT UPSET – Changes of in reporting in previous processes or increase memory or register bits caused by a years emerged as the the reliability and single ion interaction on the chip most active collectors effectiveness of their • SINGLE-EVENT FUNCTIONAL with each region indigenous technologies INTERRUPTION – Ionizing events cause accounting for 26 percent already in use Foreign temporary loss of device functionality of FY11 reports Entities entities focused connected to East Asia collection activities HARD ERRORS destructive and the Pacific however on cleared contractors • SINGLE-EVENT LATCHUP – Ionizing remained the top producing rad-hard events cause circuit lockup and or collectors as represented memory whose resistance catastrophic device failure by their 40 percent of to the effects of ionizing • SINGLE-EVENT BURNOUT – Destructive total industry reporting radiation make them burnout due to high current conditions suitable for supporting Foreign entities • SINGLE-EVENT GATE RUPTURE – Rupture manned and unmanned appear to rely on three of gate dielectric due to high electrical space activities methods of operation field conditions MOs when targeting Foreign governments • STUCK BITS – Unalterable change rad-hard designers are beginning to move of state in a memory element manufacturers and to space for commercial packers requests for telecommunications information RFIs attempted acquisitions increased command and control and of technology and academic solicitations intelligence surveillance and reconnaissance These MOs account for 97 percent of FY11 ISR Failure of microelectronics in space collection attempts reported by industry is costly Whether SEEs are non-destructive The packaging of microelectronics is as important as the design and manufacturing of integrated circuitry Timothy May of Intel Corporation noted the first packaging-induced soft errors in 1979 In an article entitled “Alpha-Particle-Induced Soft Errors in Dynamic Memories ” first published in IEEE Transactions on Electron Devices May analyzed single-event upsets occurring due to uranium and thorium decay in microelectronics packaging 16 TA R G E T I N G U S T E C H N O L O G I E S 2 0 1 2 REGIONS OF ORIGIN 0 East Asia and the Pacific 0 Requested specific quantities of rad- hard static random-access memory SRAM optical transceivers and databus controllers Primarily used commercial entities with RFI as MO 0 Near East 0 Primarily used student requests to attempt to elicit information from leading experts 0 Europe and Eurasia Attempted to acquire specific quantities of rad-hard SRAM and optical transceivers Primarily attempted acquisition by commercial entities REGIONS OF ORIGIN FIG 5 FY 2011 SOUTH AND OTHER REGIONS CENTRAL 6% EAST ASIA AND THE PACIFIC 40% EUROPE AND EURASIA 26% NEAR EAST 26% EAST ASIA AND THE PACIFIC East Asia and the Pacific entities accounted for 40 percent of FY11 industry reporting on the targeting of rad-hard microelectronics In many requests for rad-hard microelectronics from entities in this region the requestor solicited the US cleared manufacturer for a specific quantity of the product implying that there was an immediate need from a customer for the microelectronics Twelve East Asia and the Pacific countries have active or planned space programs Three with the most active space programs are spending $4 billion annually for launching space platforms controlling satellites and observing space Expanding East Asia and the Pacific economies are using space-based technologies to communicate command and control across growing land and sea lines of communications FY 2010 SOUTH AND CENTRAL ASIA 14% EAST ASIA AND THE PACIFIC 55% OTHER REGIONS 14% EUROPE AND EURASIA 17% SPECIAL FOCUS AREA RADIATION-HARDENED MICROELECTRONICS RADIATION-HARDENED MICROELECTRONICS However many of these countries do not possess the technical proficiency to design manufacture and rad-hard microelectronics capable of withstanding sustained cosmic radiation These countries seek Western Hemisphere and Europe and Eurasia rad-hard microelectronic suppliers to enable them to assemble space-worthy systems that will withstand high radiation for a sustained period Analyst Comment Based on reporting from cleared industry it is likely that East Asia and the Pacific collectors have immediate needs for rad-hard microelectronics for various commercial and military programs The lack of East Asia and the Pacific technical proficiency to design and manufacture space-worthy rad-hard microelectronics coupled with East Asia and the Pacific commercial entities’ specific requests for the technology from cleared industry likely signify that the microelectronics markets in East Asia and the Pacific are unable to meet the strategic goals of included countries Confidence Level Moderate NEAR EAST Near East entities were the second most active FY11 collectors of rad-hard microelectronics information as reflected in attempts reported by industry Near East entities are consistently among the most active collectors of U S technology overall but this is the first year in which industry reporting portrayed a particular and deliberate effort to obtain restricted rad-hard information from U S universities researching radiation hardening To do so Near East entities relied on academic solicitation in the form of student requests seeking restricted rad-hard information CASE STUDY On November 11 2010 a Colorado-based cleared contractor received a request from an i ndi vi dual repres enting an E a s t A s ia a n d t h e P a c if ic c o mme r ci al ent i t y f or r ad- har d SR AM The i ndi vi dual did not specify the end use or end user of the rad-hard SRAM however according to the commercial entity’s website an East Asia and the Pacific military is a customer of the company On Nov ember 17 2 0 1 0 t h e s a me C o lo r a d o - b a s e d cl ear ed cont r act or r epor t ed r ecei vi ng an almos t identica l r e q u e s t f r o m a n o t h e r in d iv id u a l r epr esent i ng a separ at e East Asi a and t he Pacific commer c ia l e n t it y I n a n e ma il t h e in d iv id ual r equest ed t o pur chase a l ar ge num ber of the company ’s r a d - h a r d mic r o e le c t r o n ic s f o r a n East Asi a and t he P aci f i c cust om er The indiv idual did no t f u r t h e r id e n t if y t h e in t e n d e d e n d use or end user of t he r equest ed pr oduct s T he quantities a n d s p e c if ic a t io n s o f t h e r e q u e s t e d r ad- har d m i cr oel ect r oni cs f ol l ow • 2000 pieces o f 5 1 2 K r a d - h a r d S R A Ms wit h a s tandar d m i cr oci r cui t dr aw i ng • 2000 pieces o f 2 5 6 K r a d - h a r d S R A Ms wit h a s tandar d m i cr oci r cui t dr aw i ng T hes e commercia l e n t it ie s ’ c o lle c t io n a c t iv it ie s d em onst r at e t he aggr essi ve nat ur e of t he attempts to acq u ir e U S r a d - h a r d mic r o e le c t r o n ics f r om cl ear ed cont r act or s Analy s t Comment A lt h o u g h a c o n n e c t io n b e t we e n t hese com m er ci al ent i t i es cannot be confirmed giv e n t h e s imila r it y o f t h e r e q u e s t s o v e r a r el at i vel y shor t per i od i t i s l i kel y t hat the end us er of t h e r a d - h a r d S R A M wo u ld h a v e b e e n cust om er s w i t hi n t he sam e East Asi a and the Pacific c o u n t r y E a s t A s ia a n d t h e P a c if ic com m er ci al ent i t i es and t hei r pr oxi es w i l l likely continue t o e mp lo y t h e s e MO s in a t t e mp t s t o ci r cum vent U S expor t l aw s cover i ng t hi s res tricted techn o lo g y C o n f id e n c e L e v e l H ig h 18 TA R G E T I N G U S T E C H N O L O G I E S 2 0 1 2 from cleared contractors and research and employment opportunities at facilities specializing in radiation hardening Analyst Comment Near East governments' association with universities likely provides an avenue for procurement of restricted rad-hard microelectronics research and development under the guise of academic cooperation for the advancement of sciences and technologies Rad-hard microelectronic information garnered through academic cooperation with U S universities would almost certainly advance current Near East space capabilities and provide a foundation for long-term space and military advancements in hardening of microelectronics Con dence Level High EUROPE AND EURASIA Europe and Eurasia entities' targeting of rad-hard microelectronics increased from the previous year now representing 26 percent of the FY11 reported total Although collectors connected to Europe and Eurasia are consistently among the top foreign entities attempting to collect U S technology this is the first year that reporting suggested a concerted effort by Europe and Eurasia collectors to acquire rad-hard microelectronics from cleared contractors In almost every reported incident Europe and Eurasia commercial entities attempted to acquire specific numbers of rad-hard microelectronics Europe and Eurasia leaders have stated their beliefs that national defensive capabilities are directly related to strong microelectronics design and manufacturing processes For over ten years Europe and Eurasia leaders have discussed the need to end reliance on foreign microelectronics In some countries over 90 percent of the microelectronics used in defense systems are imported Analyst Comment Although indigenous microelectronics design and manufacturing and radiation hardening research appear to be a priority among Europe and Eurasia strategic technology pursuits regional producers almost certainly cannot provide U S -quality and -quantity rad-hard microelectronics The attempted acquisition of specific numbers of rad-hard microelectronics probably means there is a specific Europe or Eurasia program requiring certain capabilities to be found only in U S cleared contractor-manufactured rad- hard microelectronics Confidence Level Moderate AFFILIATIONS AND METHODS OF OPERATION Once DSS established the collecting entity s country of origin it identified its affiliation and the M0 used The following paragraphs detail the top affiliations and M05 identified in FY11 reporting from cleared industry COLLECTOR AFFILIATIO NS FIG 6 PERCENT FY2010 FY2011 COMMERCIAL GOVERNMENT GOVERNMENT INDIVIDUAL UNKNOWN AFFILIATED DSS analysis of industry reporting shows that collectors affiliated with East Asia and the Pacific primarily relied on commercial entities to obtain sensitive or classified U S information and technology in FY11 They did so using two M05 The RFI was used most often employing email to seek price quotes and technical information regarding rad-hard technology At 45 percent attempted acquisition of technology via email was the other MO East Asia and the Pacific commercial entities used to attempt SPECIAL FOCUS AREA RADIATION-HARDENED MICROELECTRONICS r110 r_2 CI 133' mm OD 2m 3 circumvent U S laws restricting the export of rad-hard microelectronics In emails when individuals representing commercial entities were notified that the U S cleared contractor would need an export determination prior to a transaction the U S manufacturer either did not receive a response or the suspicious entity provided a U S address and reiterated the same request In contrast Near East entities efforts as reflected in industry reporting relied solely on government-affiliated university students who made academic solicitations to rad- hard research facilities Radiation reliability experts at a cleared U S university received numerous emails and curricula vitae CVs from Near East university students expressing interest in obtaining research positions under their supervision Often the r sum or CV demonstrated a history of research in microelectronics and radiation effects on microelectronics In one email the collector cited experience working in a METHODS OF OPERATION FIGURE 7 20 laboratory studying space radiation effects on satellite systems Europe and Eurasia entities like East Asia and the Pacific entities relied on and the attempted acquisition of technology through commercial collectors in attempting to acquire sensitive rad-hard technology in FY1 1 ranged from requesting data sheets for a U S contractor s rad-hard technology to requesting a list of a U S company's distributors in a particular foreign country TARGETING RAD-HARD SRAM Reporting from cleared industry pointed to SRAM being the most sought after rad-hard microelectronics technology SRAM is a type of memory that is faster and more reliable than the more common dynamic random-access memory DRAM While DRAM supports access times of about 60 nanoseconds SRAM can support ACADEMIC I REQUESTS FOR SOLICITATION INFORMATION ATTEMPTED SEEKING ACQUISITION EMPLOYMENT OF TECHNOLOGY COMERENCES I SOLICITATION CONVENTIONS 0R MARKETING TRADE SHOWS CRMNAL I SUSPICIOUS ACTIVITIES NETWORK ACTIVITY EXPLOITATION OF I TARGETING U S RELATIONSHIPS TRAVELERS OFFICIAL FOREIGN VISITS TARGETING OUTER RING FY 2011 INNER RING FY 2010 Includes potential espionage indicators and cases not otherwise listed TARGETING U S TECHNOLOGIES 2012 access times as low as 10 nanoseconds In addition its cycle time is much shorter than that of DRAM because it does not need to pause between accesses It is also much more expensive to produce so SRAM is usually employed only as a memory cache The following table shows the number and type of rad-hard SRAMs that entities from East Asia and the Pacific and Europe and Eurasia requested according to reporting from cleared industry in FY11 TARGETED STATIC RANDOM ACCESS MEMORY cnumv TYPE QUANTITY EAST ASIA AND 128K 256K THE PACIFIC 512K 33 EUROPE AND mm 128K 512K 6640 Analyst Comment Although previous assessments found that these requests for rad-hard microelectronics were likely intended to fill immediate requirements in commercial and military programs there is an even chance that the requestor could divert rad-hard microelectronics to commercial or government organizations specializing in reverse-engineering Confidence Level Moderate According to IC reporting multiple foreign companies and government labs conduct failure and vulnerability analysis and reverse-engineering FAVA-RE to validate microelectronics design Although the FAVA-RE process is legal in the United States to discover and analyze circuit designs it can reveal sensitive information contained in microelectronics and proprietary fabrication processes -2 Analyst Comment Success by East Asia and the Pacific and Europe and Eurasia companies in the illegal acquisition of U S rad-hard SRAM would probably result in the revelation of sensitive information and proprietary fabrication processes The likely diversion of these items to university or government labs capable of conducting FAVA-RE analysis would probably spur indigenous development of rad-hard microelectronics This would likely decrease the funding that entities in these regions would have to dedicate to researching radiation hardening techniques and increase world-wide competition to supply rad-hard microelectronics potentially impacting U S companies sales Confidence Level Moderate OUTLOOK Reporting from industry confirms that U S rad-hard microelectronics are of significant interest to collecting entities in several regions They are likely to use a variety of MOs by commercial government-affiliated government and individual entities to attempt to collect rad-hard microelectronics information or technology Confidence Level High 038 assesses that agents from East Asia and the Pacific the Near East and Europe and Eurasia in particular will likely continue their efforts to collect U S rad-hard microelectronics in the immediate future largely reliant on the RFI and attempted acquisition of technology MOs Confidence Level High With more countries moving toward conducting space activities and operations DSS assesses that it is likely the demand for rad-hard microelectronics will dramatically rise over the coming years especially as once-torpid economies grow and outdated militaries modernize and move terrestrial communication and ISR activities into space As U S companies continue to increase rad-hard microelectronics speed and decrease their susceptibility to ionizing radiation foreign entities will likely increase their targeting of cleared contractors' design manufacturing and packaging of rad-hard microelectronics Confidence Level Moderate SPECIAL FOCUS AREA RADIATION-HARDENED MICROELECTRONICS 21 0 233' EU 03 0 mo r_Z no RADIATION-HARDENED MICROELECTRONICS CASE STUDY A DATE FOR THE PROM On S e p t e mb e r 3 0 2 0 1 1 t wo C h in e s e n at i onal s w er e sent enced t o 24 mo n t h s in p r is o n f o r p a r t ic ip a t in g i n a conspi r acy t o vi ol at e t he Arms E x p o r t C o n t r o l A c t H o n g We i X ian al so know n as H ar r y Zan and co- c o n s p ir a t o r L i L i a ls o k n o wn a s L ea Li at t em pt ed t o acqui r e and s mu g g le r a d - h a r d mic r o c h ip s o u t o f the U ni t ed St at es f or an agency con t r o lle d b y t h e C h in e s e g o v e r n me n t Xia n a n d L i r e p r e s e n t in g B e ijin g S t a r cr eat es Space Sci ence and Tech n o lo g y D e v e lo p me n t C o mp a n y L im i t ed engaged i n t he i m por t i ng and s e llin g o f p r o g r a mma b le r e a d - o n l y m em or y P R O M t o C hi na Aer o s p a c e S c ie n c e a n d Te c h n o lo g y C or por at i on B et w een Apr i l 2009 and S e p t e mb e r 2 0 1 0 t h e y c o n t a c t e d a com pany i n t he East er n Dist r ic t o f V ir g in ia r e q u e s t in g t o p u r c hase t housands of r ad- har d PRO Ms C h in a A e r o s p a c e is c o n t r o lle d by t he gover nm ent of C hi na and res e a r c h e s d e s ig n s d e v e lo p s a n d p r oduces st r at egi c and t act i cal mis s ile s a n d e x o - a t mo s p h e r ic la u n c h vehi cl es Xia n a n d L i s o u g h t P R O Ms s p e c if ic a lly desi gned t o w i t hst and s us t a in e d r a d ia t io n b o mb a r d me n t in space The conspi r at or s knew the P R O Ms we r e e x p o r t - c o n t r o lle d b u t t hey di d not seek l i censes bec a u s e d o in g s o wo u ld h a v e r e v e a le d t he ul t i m at e end user of the r a d - h a r d mic r o e le c t r o n ic s — C h in a Aer ospace Xi an and Li con s p ir e d t o b r e a k u p o r d e r s in t o mu l t i pl e shi pm ent s i n an at t em pt to c ir c u mv e n t U S e x p o r t - c o n t r o l r e st r i ct i ons on t he sal e of U S Mun it io n s L is t t e c h n o lo g y t o C h in a 3 Ana ly s t C o mme n t T h is c o lle c t io n a t t em pt and t hw ar t ed schem e demo n s t r a t e a n a p p r o a c h u s e d b y c o l l ect or s t o i l l egal l y acqui r e rad - h a r d mic r o e le c t r o n ic s B a s e d o n i nvest i gat i ons i t i s al m ost cer t a in t h a t C h in a A e r o s p a c e is d r iv ing i t s com m er ci al suppl i er s to c o lle c t U S - ma n u f a c t u r e d r a d - h a r d m i cr oel ect r oni cs Con f id e n c e L e v e l H ig h 22 TA R G E T I N G U S T E C H N O L O G I E S 2 0 1 2 EAST ASIA AND THE PACIFIC EAST ASIA AND THE PACIFIC OVERVIEW Foreign collectors connected to this region remain dominant among those attempting to obtain illegal or unauthorized access to sensitive or classified information and technology resident in the US cleared industrial base The East Asia and the Pacific region maintained the same 43 percent share of the total in fiscal year 2011 1 as in FY10 This steady share represented an increase in the number of reported cases of more than 75 percent from FY10 to FY11 Despite this continuity in East Asia and the Pacific's portion of the year's total reports from industry some interesting shifts occurred from FY10 to FY11 within the data applicable to the region The most significant overall trend within industry reporting was the increased clustering in the data among collector affiliations as well as methods of operation MOs There was also increased quality of industry reporting especially of the new top MO suspicious network activity SNA which resulted in improved attribution by the Defense Security Service DSS Counterintelligence CI DirectorateC 20 1 So m-n ICL i Li DI cc LLJ Commercial entities in their 31 percent of total reported attempts in FY11 were probably attempting to gain opportunistic access to sensitive technologies for subsequent resale to other East Asia and the Pacific actors Additionally industry reporting reflects a large number of cases a combined 27 percent of the year's total in which East Asia and the Pacific-connected entities reportedly attempted to establish a relationship with a cleared contractor either through academic exchange commercial deals or individual employment While these incidents did not suggest specific targeting of technology they remain of interest due to the possibility that such relationships could lead to future opportunities for exploitation Multiple countries within East Asia and the Pacific perceive themselves as being surrounded by threats including from each other This leads them to believe that they must significantly upgrade their military capabilities building their capacity for deterrence Many of those countries also desire to make their militaries more self- reliant although at present they remain significantly dependent on the acquisition of military technology from abroad Reflecting the significant scope of these military modernization efforts ongoing in the region requests originating in East Asia and the Pacific sought technologies found in nearly every section of the Militarily Critical Technologies List MCTL As in FY10 information systems IS was the single most targeted technology category although reduced from FY10's 25 percent to 13 percent However the majority of those incidents were attributed to cyber actors and were non-specific in nature In addition to IS technology lasers optics and sensors technology remained a top identifiable targeting priority 24 Despite the aforementioned frictions that exist between some countries in the East Asia and the Pacific region unique relationships continue to exist between some of its geopolitical entities Close economic ties between some of these entities continue to make third-party technology transfers a possibility Some locations within the region are not governed by enforcement regimes that are sufficiently robust to adequately implement transit transshipment license controls creating popular diversion points for third-party transfers Some East Asia and the Pacific collectors attempt to obtain U S technology to sell to third countries hostile to U S interests COLLECTOR AFFILIATIONS East Asia and the Pacific entities targeting cleared industry were characterized by significantly variegated affiliations 0f the five categories of collector affiliation four increased in number of reports from industry concerning East Asia and the Pacific while the unknown category decreased in number of reports and its share of all FY11 reports went from 28 to nine percent Two categories the top category commercial and government-affiHated increased in number of reports but fell in percentage of the total commercial from 35 to 31 percent and government-affiliated COLLECTOR AFFILIATIO NS FIGURE8 PERCENT 100 COMMERCIAL GOVERNMENT GOVERNMENT INDIVIDUAL UNKNOWN AFFILIATED TARGETING U S TECHNOLOGIES 2012 demonstrations of interest in a very specific system or capability from multiple separate entities making it likely that they were acting on behalf of a common end user Confidence Level Moderate Analyst Comment The pattern revealed in industry reporting is that some East Asia and the Pacific collection entities use a diversified and persistent approach often employing multiple collector types and MOs at the same time When one entity fails a second entity often with a different affiliation reengages the cleared contractor in pursuit of the same technology DSS assesses that some East Asia and the Pacific collection campaigns probably represent coordinated national strategies Confidence Level Moderate While some requests for information RFIs from or attempts to purchase components by commercial entities resolved to innocuous entities industry reporting cited a significant number of instances in which the companies and individuals behind these requests had appeared in previous industry or Intelligence Community IC reporting Many of these entities were based in third countries including the United States Canada and European nations but could be attributed to East Asia and the Pacific end users In particular increased attribution of cyber incidents highlights the multifaceted nature of the threat to U S information and technology originating in East Asia and the Pacific Overt collection efforts by commercial entities run in parallel with aggressive cyber collection activities which target cleared contractor networks in attempts to exfiltrate data relating to sensitive U S information and technologies and the companies that produce them Analyst Comment Some collectors were likely attempting to circumvent U S export laws that apply different regulations to different locations within East Asia and the Pacific It is likely that many of these collectors were acting as illicit technology brokers for other East Asia and the Pacific actors DSS assessed that most requests made by entities identified in IC reporting as illicit technology brokers very likely reflected tasking by end users to acquire specific components systems or technologies Additionally inquiries from technology brokers associated with particular East Asia and the Pacific entities which mirrored otherwise innocuous requests can identify otherwise unidentified or intentionally misidentified end users Confidence Level High In some cases within East Asia and the Pacific commercial entities are known to be tightly interwoven with other East Asia and the Pacific actors relationships that cleared industry reporting and subsequent DSS analysis confirmed in FY11 This is especially so with regard to attempted technology collection and defense sales as other collectors often use commercial entities to collect information on U S technology and programs Commercial entities involved ran the gamut from large international corporations to small privately owned companies with ten or fewer employees Analyst Comment In many cases involving commercial entities requestors failed to identify intended end users or uses However cleared industry reported frequent EAST ASIA AND THE PACIFIC A substantial minority of the commercial cases consisted of interest from companies in establishing business relationships with cleared contractors either as distributors in the East Asia and the Pacific market or as suppliers of components for integration into systems under development by the contractors Analyst Comment Integration of foreignmanufactured components into U S defense systems is a growing concern within the 25 EAST ASIA AND THE PACIFIC from 17 to 15 percent The final two categories increased both in number of reports and share of the total government from 12 to 25 percent and individual from eight to 20 percent EAST ASIA AND THE PACIFIC IC and U S cleared industrial base While the majority of cases in which companies attempted to establish supply chain relationships with cleared contractors appear unlikely to be directed efforts to infiltrate the contractors DSS CI deemed these cases likely to be of intelligence value due to the identity of the companies interested in establishing connections with cleared contractors Confidence Level Moderate In many other cases the acquisition mechanisms employed by East Asia and the Pacific militaries are manifestations of complex and very opaque systems of competing interests sharing common goals and end users There are many unknowns concerning commercial entities other collectors and the varying nature of the relationships between them This frequently makes specific attribution of commercially originated requests to the ultimate requestors and end users uncertain at best and concrete findings of any kind difficult to establish Overt requests usually come from nontraditional collectors such as commercial and academic entities In the majority of cases associated with commercial entities East Asia and the Pacific companies contacted cleared contractors and attempted to acquire sensitive export-controlled or dual-use components and systems by overt means Analyst Comment Most separate incidents appeared to be innocuous involving entities which did not appear to be acting in a duplicitous manner and which had not been cited in classified reporting for previous suspicious activities Most of the commercial collectors involved maintain no apparent ties to intelligence services and in many instances are likely motivated by financial gain Confidence Level Moderate Additionally the sharp rise from FY10 to FY11 in the number of reported cases attributed to government entities and the doubling of their share of the total while noteworthy should not be viewed as reflecting new entry into attempted 26 technology collection by governments from East Asia and the Pacific but rather as the result of refined attribution by DSS and increased quality of reporting from industry Through security education and other means of generating increased awareness cleared contractors increasingly recognized the threat posed by seemingly innocuous contacts and reported these incidents with greater frequency and attention to technical indicators As a result of this increased fidelity DSS attributed a large number of cases to government entities which would likely have been designated with the unknown affiliation in FY10 Industry-reported cases attributed to individuals provided 20 percent of the FY11 total Students attempting to obtain postdoctoral positions or other employment opportunities with cleared contractors dominated reported attempts and the majority of these reports came from cleared contractors associated with U S universities While available information can seldom establish a direct connection between foreign intelligence services and most if any of the students and academics who contacted cleared contractors IC and law enforcement reporting provides numerous instances in which East Asia and the Pacific students have exploited access to sensitive or classified technologies to support parallel research and development R D efforts in their home countries Analyst Comment While most or all of these individuals are likely legitimately interested in obtaining positions with cleared contractors placement within those facilities would likely offer academics the opportunity to exploit their access to personnel information and technologies resident in those facilities Moreover some individuals have used the bona fides of U S universities to acquire otherwise inaccessible components materials and systems for end users in their home countries Review of industry and IC reporting leads DSS to assess that many TA R G E T I N G U S T E C H N O L O G I E S 2 0 1 2 academics and their sponsoring institutions very likely view placement in U S facilities as supporting national technology collection goals Con dence Level High METHODS OF OPERATION The data on frequency of use of different MOs by collectors from East Asia and the Pacific fell into two tiers SNA attempted acquisition of technology RFI and academic solicitation each accounted for 16 percent of the total or more whereas the portion that all other MOs accounted for individually remained in the single digits A major change in the DSS categorization method led to many reports that in previous years would have been labeled RFI being listed as attempted acquisition of technology moving the latter category from low in the second tier in FY10 to the second highest category in FY11 at 21 percent Within the upper tier this dropped RFI from the top METHODS OF OPERATION FIGURE 9 EAST ASIA AND THE PACIFIC position in FY10 at 41 percent down to third in FY11 at 16 percent It was joined at 16 percent by academic solicitation up from eight percent in FY10 Partly as a result of the accounting change but also due to a continued increase in illicit cyber activity SNA surged to the top of the region's M0 list in FY11 at 23 percent of the total Together these four MOs accounted for over three-quarters of the East Asia and Pacific total The next most common M05 as measured by reports from industry were official foreign visits and targeting and solicitation or marketing services at only seven percent apiece The new top MO practiced by East Asia and the Pacific collectors SNA experienced increased quality of reporting from industry which led to significant refinement in attribution Increased clarity allowed 033 to discard most reports of unsophisticated attempts to access cleared INNER RING FY 2010 'lncludes potential espionage indicators and cases not othermse listed 27 - ACAOENIC - REQUESTS FOR SOLICITATION INFORMATION I ATTENPTED SEEKIVG ACQUISITION EWLOYMENT OF TECHNOLOGY I CONFERENCES I SOLICITATION CONVENTIONS 0R MARKETNG TRADE SHOWS I CRIMINAL I SUSPICIOUS ACTIVITIES NETWORK ACTIVITY EXPLOITATION OF I TARGETNG U S RELATIONSHIPS TRAVELERS OVERSEAS - OFFICIAL FOREIGN VISITS 8 TARGETING OUTER RING FY 2011 I l CD _4 2 2 EAST ASIA AND THE PACIFIC contractor networks through tactics such as brute-force attacks attributing these actions to criminal rather than intelligence actors Notably almost all of the SNA reporting deemed to be of intelligence value resulted from spear phishing emails with malicious attachments received by cleared contractors Analyst Comment While FY11 industry reporting of spear phishing emails significantly increased over FY10 this probably does not represent greater use of that vector or delivery mechanism but rather increased cleared contractor awareness recognition and acknowledgement of such collection attempts In those instances in which a compromise occurred but no vector was identified DSS CI assessed that the initial intrusion was likely achieved through an unidentified spear phishing email Confidence Level Moderate Although attempted acquisition of technology and RFIs accounting for 21 and 16 percent respectively of the total collection attempts reported by industry in FY11 are separated into different reporting categories these MOs are employed very similarly and both are associated very closely with commercial entities Typically reports of either type resulted from commercial entities requesting sensitive components or specifications through the cleared contractor’s sales department with many initial contacts failing to disclose the intended end user and use In most instances of attempted acquisition of technology the entity sent an email with a purchase order for the cleared contractor’s products The second most common MO reported was RFI again most commonly executed via email web-card submission or telephone call RFIs often begin with general questions whose answers if supplied could be used to confirm or deny information on the technology or system opening the way to more pointed and sensitive questions 28 Both attempted acquisition and RFI represent a low-risk high-reward approach to collection If the request is questioned or deemed inappropriate the entity can claim it was made in good faith with no knowledge of restrictions If the request goes unchallenged it provides immediate reward as well as building a potential relationship that can be exploited in the future If the acquisition attempt is successful it provides opportunity for reverse-engineering and significant savings in R D costs Some requests initially appear innocuous but gradually reveal themselves as apparent attempts to acquire sensitive or controlled technology for East Asia and the Pacific end users In a handful of reports entities openly or implicitly stated their intention to circumvent export controls by transshipping purchased components through third countries Analyst Comment While U S export controls prevent many collection entities from purchasing sensitive dual-use components and systems it is likely that unauthorized East Asia and the Pacific end users have acquired components through entities located in countries without such restrictions and the falsification of end-use documents Confidence Level High Academic solicitations jumped significantly as a percentage of industry reports from eight percent in FY10 to 16 percent in FY11 and more than tripled in the number of reported approaches This largely resulted from increased industry reporting of attempts by students and postdoctoral researchers to obtain positions with cleared contractors U S universities reported receiving by far the greatest number of academic solicitations noted in DSS reporting Reporting also reflected a significant number of solicitations in which individuals affiliated with East Asia and the Pacific universities and institutes requested research and other academic information produced by cleared contractor employees TA R G E T I N G U S T E C H N O L O G I E S 2 0 1 2 Analyst Comment While much of the requested research material was both publicly available and basic in nature attempts to acquire information directly from the author present the opportunity to expand conversations into areas outside the scope of the initial paper and into more sensitive areas of the cleared contractor employee's current research Taking advantage of the academic predilection to share information in this way almost certainly presents an excellent avenue to support military research Confidence Level Moderate TARGETED TECHNOLOGIES In FY11 the four most common targeted technologies by collectors connected to East Asia and the Pacific were electronics and aeronautics systems just as they were in FY10 However the top technology IS actually fell in number of reports and by almost half in share from 25 to 13 percent Technologies in the next three sections of the MCTL all increased in number of reports but decreased in percentage from 13 to ten percent electronics increased from seven to eight percent and aeronautics maintained its share unchanged at eight percent Even more interesting variation occurred in the second tier of technologies The next four most commonly targeted technologies all increased in number of reports from industry But while positioning navigation and time merely maintained its five percent share of the total and marine systems declined to five percent two categories armaments and energetic materials and space systems doubled in the number of reports year over year and increased in proportional share the former actually doubled its share to six percent East Asia and the Pacific's increased practice of the SNA MO meant that there were more incidents in which the specific data targeted could not be determined in such cases DSS frequently TARGETED TECHNOLOGY FIGURE 10 Frerrwr 25 20 15 FY 2011 10 I FY 2010 5 m i 2 02 INFORMATION LASERS ELECTRONICS AERONAUTICS AR MAMENTS MARINE SPACE POSITIONNG MATERIALS GROUND SYSTEMS OPTICS AND SYSTEMS AND ENERCEIIC SYSTEMS SYSTEMS NAVIGATION AND SYSTEMS SENSORS MATERIALS AND TIME PROCESSES Figure Illustrates the top ten most targeted technology categories In FY11 compared With the reporting statistics for the same categories from EAST ASIA AND THE PACIFIC 29 EAST ASIA AND THE PACIFIC identified attempts with the primary technologies affiliated with the subject facility However this determination was made on a case-by-case basis and in many instances it was not possible to associate a cyber incident with a specific MCTL section In instances in which entities contacted a facility more directly but still did not mention a specific product or technology such as the case with many student requests and business solicitations analysts regarded the request as undefined with regard to MCTL category Despite the fall in the number of cases attributed to IS technology in both numbers and share of the total it remained the most commonly targeted section Most cases involving IS as well as aeronautics technology originated from cyber actors and were nonspecific in nature In the non-cyber cases in which entities expressed interest in specific IS technologies software programs were the most common targets particularly those supporting satellites radar and signals Analyst Comment Whereas in FY10 DSS analysts frequently assessed the targeted technologies based on incomplete information regarding the incident or targeted facility the improvement in the quality of industry reporting allowed for better identification of targeted technologies DSS analysts did not designate a targeted MCTL category in those incidents which suggested multiple targeted technologies or targeting of nonMCTL information The sharp decrease in reporting regarding IS compared to the previous year is almost certainly due to improved attribution techniques and results Confidence Level Moderate Requests from East Asia and the Pacific that fell within the category of LO S encompassed a wide range of technologies Some of the most commonly targeted were advanced radar and sonar systems suitable for upgrading and modernizing the region’s sometimes antiquated missile air and 30 maritime defense networks and improving command and control capabilities Similarly interest in unmanned aerial systems within the aeronautics category is consistent with a need to survey and monitor against neighbors’ infiltration and attack The geographical topographical and geopolitical landscape of the East Asia and the Pacific region makes such technologies a matter of high priority to regimes and militaries within the region Among the most targeted LO S technologies were shortwave infrared optical systems which are useful for measurements imaging for a variety of civilian and military purposes ranging from agricultural to battlefield targeting applications While some of the requests received were ostensibly civilian in nature others made specific reference to military hardening and specifications exceeding those required for civilian use Collection entities also sought a variety of laser technologies Requests for electronics technology accounted for eight percent of the total slightly more than the previous year This section also encompassed a wide range of sub-technologies Many requests targeted a variety of antenna systems as well as space-qualified equipment Based on the specifications requested the items were appropriate for use in satellite communications but could also be applied to a number of other end uses Of additional note industry reporting concerning attempts by East Asia and the Pacific students to obtain placement with cleared contractors showed that a large number of requests were sent to professors and employees working in areas of study that have both commercial and military uses including sensors positioning and detection technologies Analyst Comment Many East Asia and the Pacific universities and research institutes have associations with their nations’ militaries Reported interest by such institutions in the study of the TA R G E T I N G U S T E C H N O L O G I E S 2 0 1 2 technologies and applications discussed above is noteworthy as many of the requesting academics and students are likely to contribute to military R D following completion of their studies Confidence Level Moderate Analyst Comment It is not apparent what if any specific requirements have driven these increases They are likely a result at least in part of general modernization and upgrade efforts and or attempts to reverseengineer any technology obtained to produce indigenous variants for domestic use and foreign sales Confidence Level Moderate OUTLOOK As anticipated in previous years’ versions of this publication industry awareness of the threat posed by entities from East Asia and the Pacific has consistently increased year over year and will likely lead to greater numbers of reports from cleared contractors and further identification of entities of concern However even as this awareness has grown DSS has not observed any discontinuities from the reported MOs that entities from the region have used over preceding years providing evidence that those methods continue to be useful in acquiring U S technologies Therefore DSS CI assesses that East Asia and the Pacific entities will continue to aggressively target cleared contractors through both computer network exploitation activities and the overt means used predominantly by non-cyber actors Confidence Level High EAST ASIA AND THE PACIFIC This year’s industry reporting does not suggest any single common driving goal behind technology collection efforts beyond the continuing frictions in relations between countries within the region and between countries within the region and those from outside It is likely that these general concerns will continue to drive the great scope of efforts to modernize and upgrade the somewhat backward and antiquated existing militaries of countries within East Asia and the Pacific and thus collection attempts related to them Confidence Level High The breadth of systems components and capabilities that East Asia and the Pacific collection entities target underscores these frictions and the dangers to which various regimes consider themselves subject The immediacy of the perceived threats calls for a high priority on border surveillance and air and maritime defenses Consequently LO S particularly sensor technologies will almost certainly remain a high priority Confidence Level High Multiple regimes within East Asia and the Pacific seek advanced technology to transform their militaries from quantitative to qualitative forces Technology can be a force multiplier crucial to success in that transformation In pursuit of this collection 31 EAST ASIA AND THE PACIFIC The noted increase in industry reports concerning the attempted collection of armaments and energetic materials and space systems technology involved integrated circuits switches amplifiers and other electronic components with applications to a variety of systems which could include missile systems or weapons countermeasure systems East Asia and the Pacific commercial entities continued to lead all other collector affiliations This points to some degree of success by those entities so their collection efforts are likely to continue The opaque but arguably close relationship between governments and industry within East Asia and the Pacific often manifests itself in collection patterns characteristic of coordinated collection strategies DSS assesses it is very likely that commercial entities will lead the accounting of the East Asia and the Pacific collection effort in FY12 but may receive significant support from government government-affiliated and individual entities Confidence Level High EAST ASIA AND THE PACIFIC entities will almost certainly continue to place a high priority on IS technologies and aeronautics systems technologies However the broadness of the goals pursued will likely drive collection entities whether tasked or not to target a very wide array of technology categories across nearly the entire MCTL Confidence Level High Requests for sensitive or classified information and technology resident in the U S cleared industrial base if successful would likely directly support development of new military systems or upgrades to existing capabilities Such requests also emphasize the degree to which indigenous research capabilities in the region while improving continue to rely on acquisition of foreign technology to further ongoing development efforts and will likely continue to do so in the foreseeable future Confidence Level High Similarly based on industry reporting East Asia and the Pacific collection entities practice a diverse suite of collection methodologies with significant effort exerted in SNA attempted acquisition of technology RFIs and academic solicitation These MOs are either “stand-off” methods practiced from a distance or arguably innocuous and the use of this combination of methods is very likely to continue Confidence Level High 32 CASE STUDY “IF AT FIRST YOU DON’T SUCCEED…” In September 2011 a Massachusetts-based cleared contractor received a request for an export-controlled amplifier from a company based in East Asia and the Pacific The company did not state the intended end user or end use in the initial contact R epor t i ng f r om t he sam e cl ear ed cont r act or i ndi cat ed t hat t he m odel of am pl i f i er r equest ed had been t he subj ect of num er ous pr evi ous r equest s i ncl udi ng sever al f r om com pani es l ocat ed i n t he U S and t hi r d count r i es Sever al of t hese r equest s l i st ed ot her East Asi a and t he P aci f i c act or s as t he i nt ended end user s Reporting from other cleared contractors cited several of the entities requesting the equipment as having contacted separate facilities seeking other particular items of sensitive dual-use technologies IC reporting identified several of those entities as suspected technology brokers for East Asia and the Pacific actors and enterprises associated with multiple military development projects Analyst Comment Requests such as this one were typical of overt attempts by East Asia and the Pacific entities to acquire sensitive or classified information and technology resident in the U S cleared industrial base While the contacting entities were likely unaware of each others’ requests viewing the requests together allowed DSS CI to establish a likely connection between the soliciting entities and end users associated with the national military in question Confidence Level Low TA R G E T I N G U S T E C H N O L O G I E S 2 0 1 2 NEAR EAST EAR EAST OVERVIEW The Near East accounted for 18 percent of the worldwide total of industry reports to the Defense Security Service 083 for fiscal year 2011 FY11 just as it did in FY10 The aggressive efforts of collectors associated with this region to obtain illegal or unauthorized access to sensitive or classified information and technology resulted in almost 75 percent more reports in FY11 than FY10 Near Eastern collectors' steadily increasing volume of suspicious contacts over the last several years signifies a continued high value placed on the acquisition of U S defense technology and technological know-how This is despite national goals in several cases of achieving greater self-sufficiency in the production of defense equipment While the region produces some of its own defense equipment the technology remains foreign-influenced and rapid advances in defense technology mean the Near East continues to rely on accessing foreign sources At present increased perceived threats from regional neighbors and or the United States may have temporarin taken precedence over longer-term goals of self-sufficiency Near East short-term collection efforts may be driven by the perceived need to quickly improve national defense infrastructures particularly air defense- related technologies 33 2 4 p I LLJ CE '1 LLJ DSS continues to receive reports of Near Eastern entities' attempts to acquire U S technology by subterfuge Near Eastern collectors have become exceptionally adept at using complex networks of front companies shell companies brokers and procurement agents in their efforts to acquire U S technology These collectors continue their attempts to acquire U S - origin technology through third countries leveraging relaxed export-control laws Sometimes the subterfuge is somewhat more direct Some Near East collectors attempt to exploit established trade assistance agreements TAAs with U S cleared contractors Official visits and targeting was also prevalent in reporting as collectors sought to leverage official facility visits to gain unauthorized access to U S technology information Other frequently attempted MOs manifested themselves in FY11 when Near Eastern commercial entities sought to acquire U S technology requested sensitive information or solicited marketing relationships Although not as prevalent as in FY10 targeting by Near East government agents of U S travelers on official business overseas usually as cleared contractor personnel were departing the region remained a threat In FY11 Near Eastern collectors targeted a wide array of defense technologies ranging from antiquated U S military hardware to new state-of the-art military technologies Consistent with previous years' reporting Near East collection targets spanned nearly all the sections of the Militarin Critical Technologies List MCTL Students from the Near East continue to show interest in conducting postgraduate- level research in emerging technologies Reporting received from industry shows evidence of an increase in academic solicitations from students seeking to conduct postgraduate research in cleared university-affiliated research centers Near East student enrollment in these 34 programs poses a technology transfer risk when students return home equipped with the knowledge and technological know- how to design and develop new defense technologies necessary to help their countries achieve self-sufficiency COLLECTOR AFFILIATIONS All five collector affiliations increased year over year in number of reports from industry The top two affiliations swapped places in the ranking from FY10 to FY11 while the remaining three maintained their positions The interesting changes were in the percentages of the total each category accounted for The new most common identification government-affiliated increased in percentage from 27 to 35 percent while all four other categories including the former top category commercial declined in share by one to three percentage points each COLLECTOR AFFILIATIONS FIGURE 11 PERCENT 100 COMMERCIAL GOVERNMENT GOVERNMENT INDIVIDUAL UNKNOWN AFFILIATED Within the government-affiliated category for the Near East the two main models involved affiliations between the government and either academics or commercial firms Government-affiliated academics purporting to be students and professors tended to be associated with major universities government-affiliated firms tended to TARGETING U S TECHNOLOGIES 2012 be major commercial companies The academics typically requested access to cleared contractors’ postgraduate research placements for sabbaticals assistance with or collaboration on research and scientific publications and or employment government-affiliated firms tended to attempt to exploit established relationships with cleared contractors and leverage official cleared facility visits Although industry reports identified with the commercial affiliation declined in their share of the Near East total and the affiliation fell from the top spot it still accounted for nearly a third of all reports During FY11 commercial entities maintained a consistent targeting of cleared contractors by seeking dual-use technologies Sometimes the same individual attempted to acquire the same technology while purportedly representing multiple companies sometimes multiple companies from the same country attempted to acquire the same technology Using commercial firms for collection attempts can constitute an effort to obscure government involvement in attempted collection against U S information and technology Near East companies sometimes contacted cleared contractors in an attempt to either procure an export-controlled NEAR EAST Various industry reports recounted incidents in which Near East commercial distributors requested U S technology in what would nominally be a legal and permitted acquisition However the purchases sometimes were on behalf of end users from other regions after multiple attempts by entities in those regions to procure the same technology themselves had failed In such cases any subsequent transfers of defense technology violated signed agreements requiring U S approval In other cases regimes’ acquisition of U S technology itself was illicit and was then followed by a sharing of U S technology with the third parties that sought it indirectly Analyst Comment DSS assesses that aggressive collectors from other regions likely exploit Near East relations with the United States to acquire U S defense technology for misrepresented end uses as well as employ other successful MOs When Near Eastern states obtain illegal or unauthorized access to sensitive or classified information and technology resident in the U S cleared industrial base it is likely to undergo further illicit transfer Confidence Level Moderate FY11 industry reporting attributed to individual collectors represented 17 percent of suspicious contacts to cleared industry remaining proportionally consistent with last year’s results These collectors continue to provide little to no information to indicate ties to commercial or government entities Individual collectors typically employed the academic solicitation the request for information RFI and seeking employment MOs Analyst Comment Individual collectors likely attempt to increase their chances of successfully obtaining U S sensitive or classified information and technology 35 NEAR EAST Analyst Comment Near Eastern countries desiring to maintain or enhance their status as regional powers likely seek to establish technological autonomy and gain recognition as scientific and technological achievers which requires the ability to independently develop advanced and innovative technologies Currently their education systems scientific establishments industrial bases and or forces of skilled workers probably lack the resources equipment and technical expertise to achieve such goals Therefore they likely continue to rely on collections against western countries’ industrial bases to cultivate the necessary knowledge and technical abilities and keep current on technology advances Confidence Level Moderate technology or solicit an opportunity to market the cleared contractor’s technology within the country or region obscuring ties to governments and commercial firms known to the United States Con dence Level High Reported collection attempts associated with Near Eastern government entities declined in proportion of the whole from 14 percent in FY10 to 11 percent in FY11 even as the number of industry reports in that category increased by over 40 percent In FY11 governments with access to cleared contractor facilities via established TAAs continued to attempt to leverage them to collect against us information and technology Known or suspected intelligence officers lOs supplemented official delegations in visits to cleared facilities typically under the guise of official representation Also in conformance with a FY10 trend in some countries airport security continued targeting cleared contractor personnel while on official business in-country Industry reporting documented multiple incidents of cleared contractor personnel METHODS OF OPERATION FIGURE 12 19 36 receiving intense scrutiny from airport security elements when attempting to depart the country METHODS OF OPERATION An adjustment in the DSS accounting system for MOs resulted in many FY11 cases that would previously have been categorized as RFIs being labeled instead as attempted acquisitions of technology This had a major effect on the top of the listing of MOs used by Near East collectors as represented by industry reporting The RFI which had been at the top of the FY10 listing by accounting for half of that year's reports fell to third at 18 percent of the total in FY11 The corresponding rise in attempted acquisition of technology reports was from no reports in FY10 to 19 percent of the total in FY11 The most notable change however occurred with regard to reports on academic solicitation The number of such reports - ACADEMIC I REQUESTS FOR SOLICITATION INFORMATION I ATTEMPTED SEEKIVG ACQUISITION EWLOYMENT OF TECFIVOLOGY I CONFERENCES - SOLICITATION CONVENTIONS OR MARKET IVG TRADE SHOWS I CRIMINAL I SUSPICIOUS ACTIVITIES NETWORK ACTIVITY EXPLOITATION OF I TARGETIVG U S RELATIONSHIPS TRAVELERS OVERSEAS I OFFICIAL FOREIGN VISITS TARGETING OUTER RING FY 2011 INNER RING FY 2010 'Includes potential espionage Indicators and cases not otherwise listed TARGETING U S TECHNOLOGIES 2012 more than tripled an increase of 220 percent Academic solicitation accounted for 31 percent of this year’s larger total Recent changes in U S visa requirements loosened restrictions on foreign students allowing more to remain in the United States after graduation and available statistics verify that the number of such students staying has increased in recent years Of the lower tier of MOs as measured by the number of industry reports none individually accounted for more than nine percent of reports Some increased in number of reports some declined and there were resultant adjustments in proportional share Two of these lesser MOs deserve specific comment however There were 11 times as many reports of targeting during official foreign visits to cleared contractors in FY11 than in FY10 In contrast the suspicious network activity that represents such a noted threat from other regions actually declined in number of reports related to the Near East measured year over year and in FY11 accounted for only one percent of reports As noted in the previous section academics both students and professors constituted a major bloc of Near Eastern governmentaffiliated collectors Students sent emails to cleared U S professors requesting to join research programs in technology areas related to energy materials electronics and mechanical and aerospace engineering Analyst Comment The levels at which students from the Near East are contacting U S professors engaged in classified NEAR EAST Although no available evidence corroborates that Near Eastern government agencies are presently tasking student placement at cleared contractor facilities some intelligence reporting suggests that the practice has occurred in the recent past Students may be recruited trained and tasked as sources and receive financial aid and support Analyst Comment Some Near Eastern students seeking placement at cleared contractor facilities receive financial support from their governments Governmentsponsored students would likely attempt to collect technical information on behalf of their government in return for its sponsorship Confidence Level Moderate Although attempted acquisition of technology was the second most prevalent MO practiced by Near Eastern collectors as represented by industry reporting at 19 percent of the total it fell far behind academic solicitation Intelligence Community IC reporting showed that some countries’ collectors attempted to purchase sensitive or classified U S technology directly usually via email or telephone whereas others made their approaches indirectly using front companies or thirdcountry entities to make contact with U S companies Industry reporting during FY11 corroborates IC reporting with requests for 37 NEAR EAST Analyst Comment Some of the statistical shift can be attributed to the recategorization of many reports from RFIs to the attempted acquisition of technology However it is likely that a greater part of the explanation for the diversion of Near Eastern collection efforts into solicitations aimed at exploiting U S academia lies in loosened visa requirements Confidence Level Moderate research are alarming Almost exclusively such programs are classified because the research they conduct is defense-related It is noteworthy that the U S universities targeted are not commensurate with the top universities attended by Near Eastern students in the United States or located in areas with large home-country expatriate communities where foreign students typically seek to live It is likely that many of the approaches to particular U S professors by Near Eastern students are intended to gain illicit access to sensitive or classified information and technology in targeted technology areas Confidence Level Moderate NEAR EAST export-controlled technology linked to the Near East originating from at least a dozen foreign countries system or act as an intermediary for brokering aerospace and defense deals with the United States Analyst Comment Because of the nature of clandestine attempts to acquire sensitive or classified U S technology DSS assesses that FY11 industry reporting almost certainly does not provide a complete representation of this aspect of Near Eastern collection activities Some companies in other regions have a documented history of providing Near Eastern collectors with U S technology and during FY11 DSS analysis found a substantial increase in such links DSS assesses it as very likely that some portion of the reported attempts to acquire U S technology that DSS attributed to collectors from other regions had intended Near Eastern end users Confidence Level Moderate As represented by FY11 industry reporting the RFI was Near Eastern collectors’ third most frequently used MO representing 18 percent of reported cases These contacts consisted of web-card submissions that requested the cleared contractor to provide more information regarding its products and emails to cleared contractor employees to obtain additional information For example in May 2011 a Californiabased cleared contractor facility received an unsolicited email request for information regarding ship technology The sender stated that he was studying naval architecture and drafting an article about such technology for a home-country newspaper Direct attempts to acquire sensitive or classified U S technology via purchase usually requested via email or telephone were most often made by commercial firms overtly requesting to purchase exportcontrolled technology When commercial entities target U S technology it is often for competitive advantage with the export of defense production in mind Most often such Near Eastern collection entities attempted to procure U S technology in a seemingly innocuous and legitimate manner Similarly commercial firms constitute the affiliation of Near Eastern collectors predominantly employing the relatively similar and seemingly straightforward MOs of the RFI and solicitation and marketing Analyst Comment The email to the cleared employee was likely an attempt to obtain specific information about such ships under the guise of drafting an article Any information provided to the sender probably would have been used to determine specifications and aid in reverse-engineering a ship for home-country use Confidence Level Moderate As noted earlier however such seemingly innocuous legitimate and straightforward requests can be the result of deliberate efforts to minimize the signature of government involvement DSS evaluation of information concerning certain Near Eastern firms reveals the likelihood that the government in question had a hand in certain requests such as requests to market a cleared contractor’s global positioning 38 Although FY11 industry reporting registered official visits and targeting at only nine percent of the year’s total that represented a noteworthy increase in both number of cases and percentage share from FY10 This MO is typically employed by governments or defense firms that maintain defense relationships with cleared contractors In FY11 under the auspices of official delegation visits Near Eastern entities made numerous attempts in multiple variants to leverage their admission to cleared contractor facilities to gain illegal or unauthorized access to sensitive or classified U S information and technology For example some visitors typically through casual conversation persistently queried cleared contractor personnel for sensitive information that fell outside the agreed-upon topic or scope of discussion Additionally TA R G E T I N G U S T E C H N O L O G I E S 2 0 1 2 delegations attempted to make last-minute revisions to the approved list of individuals visiting the facility so as to insert known or suspected IOs into their delegations In FY11 some Near Eastern entities employed additional methods to exploit established trade agreements Typically employees of privileged firms would contact cleared contractor personnel via email and attempt to leverage an established relationship by inquiring about sensitive information beyond the scope of the TAA The pattern in previous incidents using this approach has been for foreign personnel to deliberately solicit multiple cleared contractor personnel through casual conversation in pursuit of the same information Analyst Comment While limited in number the recent Near East-originating spear phishing campaigns likely served to collect information about the recipients so as to check the accuracy of target lists and the effectiveness of the messages in getting recipients to open them Collection agents almost certainly sought this data in order to more effectively target particular employees when conducting future spear phishing operations against cleared contractors Confidence Level Moderate TARGETED TECHNOLOGIES Although constituting only two percent of industry reports the targeting of cleared contractor personnel traveling overseas on official business did still occur in the Near East in FY11 Industry reported multiple instances of airport security personnel selecting cleared contractor employees for enhanced scrutiny as they attempted to depart for home Actions included invasive questioning regarding classified and proprietary information and occasional seizure and exploitation of contractor-issued laptops and electronic devices Of collection activity ascribed to Near Eastern entities in FY11 suspicious network activity remained at a low level Reported Near East-originating cyber activity directed against cleared contractors included bruteforce password attacks against internetaccessible servers and spear phishing emails that sent back information on recipients but contained no malware in attachments or links Some Near Eastern actors conducted NEAR EAST The top six technology categories targeted by collectors from the Near East as measured by FY11 reports from cleared industry were the same as in FY10 The numbers of reports relating to all six sectors of the MCTL increased in FY11 by percentages ranging from 45 to 210 percent However while four of these technologies lasers optics and sensors LO S space systems armaments and energetic materials and electronics also increased their share of the total two sectors including the top category information systems IS as well as aeronautics systems declined in share The result was that these top six targeted technologies became more tightly bunched ranging from eight to 14 percent apiece in FY11 in contrast to five to 16 percent in FY10 Thus reporting showed that Near East entities’ technology interests became more evenly spread across the field with collectors seeking more U S information 39 NEAR EAST Analyst Comment DSS assesses that some Near Eastern entities likely prefer using the official foreign visit MO over email contact to target cleared industry because inperson requests appear less premeditated Confidence Level Moderate an intelligence campaign that consisted of relatively innocuous but extensive collection efforts including on social network sites Directed against the Department of Defense and its personnel as well as some cleared contractors they sought to gather email contact lists and similar information Such tracking and reconnaissance-type activities posed a low threat and did not result in any confirmed intrusions into cleared contractor networks in FY11 p '1 LLJ CE '1 Lu TARGETED TECHNOLOGY FIGURE 13 PERCENT 20 15 FY2011 10 I FY 2010 5 0 INFORMATION LASERS AERONAUTTCS SPACE AR MAMENTS SYSTEMS OPTICS AND SYSTEMS SYSTEMS AND ENERCETIC SENSORS MATERIALS ELECTRONICS DIRECTED MATERIALS POSITIONING MARNE ENERGY AND NAVIGATION SYSTEMS SYSTEMS AND TIME Figure Illustrates the top ten most targeted technology categories In compared With the reporting statistics for the same categories from FY10 and technology almost impartially Within this wide range of technology sectors some particular technologies came to the fore including unmanned aerial vehicles underwater autonomous vehicles night vision devices modeling and simulation software radiation-hardened rad- hard electronics commercial aircraft missile technology and radar components On the other hand while a particular technology an inertial navigation system was absent from this year s industry reporting on the Near East it should be noted that some requests for the technology resolved to companies from other regions which have a history of conducting business with Near Eastern entities and which failed to identify an end user Analyst Comment It is likely that some of the third-country requests for the system were intended to supply Near Eastern end users Confidence Level Moderate 40 The IS technology sector received the most attention from Near Eastern collectors as reflected in FY11 industry reporting The number of reported collection attempts from this region rose 75 percent from FY10 representing 14 percent of the total in FY1 1 Potential Near Eastern collectors practicing the longer-term MO of academic solicitation showed a high level of interest in academic programs addressing radar communications antenna and radio technologies Other Near Eastern collectors attempted to acquire IS technologies more directly They specifically targeted U S -developed command control communications computers intelligence surveillance and reconnaissance C4ISR systems technology and requested to purchase dual-use telecommunications equipment TARGETING U S TECHNOLOGIES 2012 Analyst Comment The courses of academic study in question are likely targeted for their defense applications that support advances in wireless networking and communication Those who sought C4ISR technology probably did so to enhance battle space awareness airborne electronic warfare systems and naval electronic support measures systems Confidence Level Moderate LO S technology at 12 percent of the total was the second highest Near Eastern collection priority in FY11 based on industry reports that doubled year over year The attention was attributable largely to interest in U S -developed radar technologies associated with naval and ground vehicle applications Analyst Comment Near Eastern delegation personnel were likely attempting to acquire the schematics and learn about the assembly processes to provide insight into the functioning of the specified technology Collecting entities likely sought to obtain such technical know-how to strengthen their country’s indigenous development and production capability and decrease the vulnerabilities inherent in relying on foreign sources for military equipment Confidence Level Moderate In FY11 aeronautics systems technology remained a noteworthy Near Eastern collection target accounting for 10 percent of industry-reported incidents even though the category experienced a relatively “low” 45 percent increase in number of reports NEAR EAST Analyst Comment Border security and terrorist threat concerns have likely heightened Near Eastern nations’ interest in enhanced surveillance capability leading to attempts to acquire U S -developed mini-UAVs to strengthen their security presence along their borders Confidence Level Moderate Based on industry reporting Near Eastern entities targeted space systems technology in FY11 at eight percent of the total but with a 210 percent increase in number of cases Powers within the region that are investing heavily in space programs have plans to launch several indigenous satellites for military and civilian use over the next several years In a space systems-related trend Near Eastern students also demonstrated significant interest in conducting research related to rad-hard electronics which are necessary to withstand the high levels of radiation encountered during space flight see the Special Focus Area section In one case a national of a Near Eastern country attempted to acquire a free trial of a cleared contractor’s version of M S software which satellite programs require by creating a fictitious web-based email account using the name of a U S cleared employee The attempt failed only because an employee of the cleared contractor recognized the name and asked the cleared employee whether he had sent the email Analyst Comment For any country within the Near East having a successful space program would be a substantial source not only of military benefit but also of national pride Interested collectors likely target U S space technology through a variety of means Collector attempts to acquire satellite and M S software are likely linked to aspiring national satellite programs Confidence Level Moderate 41 NEAR EAST Examples of attempts against LO S include a Near Eastern research company contacting multiple cleared contractors in FY11 requesting detailed technical information regarding U S naval radar platforms In other cases Near Eastern delegations visiting cleared contractors conducted entire facility visits in a mode of aggressive attempts to gain unauthorized access to particular technology assembly processes Unmanned aerial systems were a primary target including associated technologies and short-range unmanned aerial vehicles UAVs normally used for surveillance purposes NEAR EAST Armaments and energetic materials technology increased from being the subject of five percent of total industry reports related to the Near East in FY10 to seven percent in FY11 representing an increase of over 152 percent in number of reports Near Eastern government and governmentaffiliated entities attempted to leverage official facility visits to gain access to U S classified or export-restricted technology information and data including U S missile defense technology and technical data and source codes of missile defense systems Analyst Comment Near Eastern governments are likely concerned with countering missile attacks They probably sought to enhance their missile defense platforms’ capability to withstand rocket and missile threats by correcting deficiencies in missile defense capabilities leading to their active attempts to address these deficiencies through system upgrades Confidence Level Moderate Electronics technology also received substantial interest from Near Eastern collectors representing seven percent of the year’s reports a rise in number of over 150 percent Near Eastern collectors focused their efforts on various microwave radar antenna and other specialized electronics systems and components OUTLOOK The Near East contains several countries that harbor hostility toward each other and perceive threats against their safety and security to be immediate Some are on good terms with the United States others are not These countries strive not only to counter any regional attack by one another and in some cases from the United States as well but also to achieve regional dominance in the Middle East All Near Eastern collectors will likely remain reliant on acquiring U S information and technology to enhance their defensive and offensive capabilities and 42 support their own military industrial bases so will almost certainly continue to target U S technology Confidence Level Moderate The Near East includes countries that are or strive to be technologically competitive with U S defense industries and even to establish and maintain a global economic advantage in the field of defense exports Stable economic success can come to rely heavily on indigenous manufacturing entities successfully collecting against equivalent rival U S technologies Technologies targeted by Near Eastern interests in FY12 will likely include a wide variety of U S systems and equipment in pursuit of modernization and enhancement of their own forces as well as their likely goal moving forward of dominating specific defense markets for economic gain Confidence Level Moderate Near Eastern collector affiliations will likely settle into the new pattern established in FY11 Government-affiliated entities will likely remain the top category largely due to the number of Near Eastern students and professors requesting some sort of association with cleared contractors which requires them to provide some identifying information In contrast individual and unknown collectors will likely remain noteworthy as some near Eastern entities strive to provide minimal or no information linking them to their home countries Confidence Level High Commercial firms will very likely contribute a noteworthy share of overall reported Near Eastern collection attempts again in FY12 Governments will likely continue to attempt to exploit official facility visits so as to gain unauthorized access to U S information and technology Perceptions of success in employing this tactic will likely result in the continuation of its use from FY11 into FY12 Other Near Eastern commercial entities TA R G E T I N G U S T E C H N O L O G I E S 2 0 1 2 will very likely continue to use companies located outside of the region to request U S technology Confidence Level High Near Eastern MOs will also likely remain stable in the near future Numbers of reported academic solicitations will almost certainly remain at high levels as students continue to seek entry into cleared research programs and request technology under the guise of academic cooperation Recent changes in U S visa requirements will very likely continue to make U S research programs a prime target for Near Eastern collection activity Confidence Level High Given various Near Eastern governments’ desires to strengthen their border security a revived focus on aerial and underwater autonomous vehicles for surveillance purposes will likely reemerge in FY12 leading to continued targeting of U S manufactured unmanned systems Confidence Level Moderate Any country within the Near East desiring to launch indigenously produced satellites will likely continue to target U S -derived rad-hard electronics Confidence Level Moderate NEAR EAST In their attempted acquisition of U S technology and information from cleared contractors some Near Eastern collectors will probably take very direct approaches combining this MO with RFIs official foreign visits solicitation or marketing exploitation of relationships conferences conventions and trade shows and targeting U S travelers overseas Other collectors will likely continue to use a variety of circuitous methods to procure technologies relying heavily on front companies procurement agents and brokers located abroad As more of these procurement networks are exposed Near Eastern acquisition methods will likely evolve even further in the direction of advanced techniques to attempt to delude U S companies such as the use of western-style aliases and company names from non-threatening countries Confidence Level High rocket and missile threats Collection attempts against cleared contractors will likely target missile technologies and radar components Confidence Level High Current events and the need to defend their countries against the aforementioned perceived threat of military strikes within the region or by the United States will almost certainly continue to focus Near Eastern technology collection efforts in FY12 These would likely be aimed first toward addressing any previously identified limitations in indigenously produced missile defense systems then on further enhancing missile defense platforms’ capability against NEAR EAST 43 CASE STUDY PERMUTATIONS The following case demonstrates the convoluted mechanisms by which some Near Eastern entities seek to acquire U S export-controlled technology During FY11 a suspected procurement agent for a Near Eastern regime was seeking various radar microwave and electronic components He contacted several cleared contractor facilities and U S businesses using various company names and email addresses in his requests NEAR EAST In June 2011 the a g e n t p u r p o r t e d ly repres enting a N e a r E a s t e r n c o mp a n y contacted a New Yo r k - b a s e d c le a r e d contractor facil it y s e e k in g t h e p r ic e a n d av ailability of two it e ms o f a n e x p o r t controlled techn o lo g y O n t h e s a me day another indiv id u a l r e p r e s e n t in g a commercial en t it y in a n o t h e r r e g io n contacted the cle a r e d c o n t r a c t o r f a c ilit y regarding the ac q u is it io n o f t wo it e ms o f t h e ex port-controlled t e c h n o lo g y a s we ll a s o t h e r electronic compo n e n t s T h e it e ms r e q u e s t e d by both procureme n t a g e n t s h a d t h e s a me s pecifications A c c o r d in g t o t h e c le a r e d contractor s pec if ic a t io n s f o r t h e it e ms we r e uncommon as no n e wit h t h o s e s p e c if ic a t io n s had been s old be f o r e Analy s t Commen t C o n s id e r in g t h e u n u s u a l s pecifications of t h e r e q u e s t e d it e ms combined w ith t h e s imila r it y o f t h e t wo reques ts DSS a s s e s s e s t h a t t h e t wo s us picious conta c t s we r e lik e ly r e la t e d T h e out-of-region fi r m wa s p r o b a b ly s e e k in g t o procure ex port- c o n t r o lle d it e ms o n b e h a lf o f Near Eas tern en t it ie s Confidence L ev e l Mo d e r a t e 44 In December 2010 the same Near Eastern procurement agent contacted the same cleared contractor facility this time claiming to represent a company located in a different Near Eastern country He requested a quote for six amplifiers of an advanced type IC reporting revealed that he had made multiple previous solicitations as well In December 2010 the agent—purportedly representing both the same company and yet another company in yet another Near Eastern country—contacted U S businesses seeking a variety of exportcontrolled advanced amplifiers An avai l abl e busi ness di r ect or y cl assi f i es t he pr ocur em ent agent ’s com pany as t r adi ng in t ext i l es cl ot hi ng and f oot w ear H ow ever D SS r ecor ds r eveal i t i s l i nked t o m ul t i pl e r equest s f or U S el ect r oni c com ponent s w i t h w ar f ar e appl i cat i ons Anal yst C om m ent R epor t i ng f r om cl ear ed in dust r y cont i nues t o i l l ust r at e N ear East er n col l ect or s’ use of com pl i cat ed net w or ks consi st i ng of t hi r d- par t y i nt er m edi ar i es f r ont com pani es br oker s and pr ocur em ent agent s t o at t em pt t o i l l i ci t l y acqui r e U S t echnol ogy D SS assesses t hat t he i ndi vi dual in quest i on i s al m ost cer t ai nl y a pr ocur em ent agent f or hi s gover nm ent speci al i zi ng i n r adar and m i cr ow ave com ponent s t hat coul d be used f or el ect r oni c w ar f ar e oper at i ons H e pr obabl y uses var i ous com pany nam es em ai l addr esses and l ocat i ons t o f aci l i t at e at t em pt s t o i l l egal l y acqui r e U S expor t cont r ol l ed t echnol ogy I t i s l i kel y t hat N ear East er n ent i t i es al so use br oker s or in t er m edi ar i es based i n ot her r egi ons t o f ur t her t hei r acqui si t i on of U S t echnol ogy C onf i dence Level H i gh TA R G E T I N G U S T E C H N O L O G I E S 2 0 1 2 EUROPE AND EURASIA OVERVIEW Europe and Eurasia was the third most active region in fiscal year 2011 FY11 in terms of reports from industry concerning collectors attempting to obtain illegal or unauthorized access to sensitive or classified information and technology resident in the U S cleared industrial base Yet as significant as that is it might seem less consequential when compared to the approximately 75 percent increases by the two most active regions East Asia and the Pacific and the Near East and a 129 percent increase by the fourth-ranking South and Central Asia In this context industry reports on collection attempts originating in Europe and Eurasia increased by only 60 percent in FY11 0 r'T l 2 r'T l c2 Yet some factors serve to heighten concerns about Europe and Eurasia The region contains some of the most advanced technological and economic competitors to the United States as well as some of the most skillful and clever human and cyber intelligence collectors It is likely that even industry reporting and other counterintelligence contributions combined underestimate the totality of the ongoing Europe and Eurasia efforts to gain illicit access to U S industrial secrets EUROPE AND EURASIA 45 industry reporting commercial entities and government-affiliated institutions often involved in research and education were the top two Europe and Eurasia collector affiliations at 45 and 19 percent of the total with individuals and government following From FY10 the number of reported contacts by entities with unknown affiliation decreased and the proportion of the total accounted for by that category went from second position at 28 percent to fifth position at ten percent This could reflect collectors greater willingness to disclose association with government-affiliated research organizations due to deepening economic ties between the United States and Europe and Eurasia Attempted acquisition of technology was the method of operation MO Europe and Eurasia entities used most as reflected in industry reporting accounting for over a third of the FY11 total followed by the request for information RFI at 29 percent The relative prominence of these categories is consistent with the previous year's data New Defense Security Service DSS categorization guidelines require that a contact formerly considered an RFI now be identified as an attempted acquisition of technology if it solely sought to purchase the technology Based on industry reporting Europe and Eurasia collectors targeted aeronautics systems and lasers optics and sensors almost equally followed closely by information systems IS technology and electronics technology They were all clustered within a narrow range each accounting for 10 to 16 percent of the FY11 total The implied continuity in Europe and Eurasia collection emphases is attributable to the ongoing efforts to upgrade military technology Europe and Eurasia countries seek to accomplish a variety of goals whether reducing dependence on natural resource exports decreasing dependence on foreign supply sources and thus foreign influence boosting domestic production of 46 military goods for both domestic use and export and or creating indigenous high- technology sectors COLLECTOR AFFILIATIONS Collector affiliations reflected in industry reporting linked to Europe and Eurasia became ever more concentrated in FYI I on commercial collectors Whereas in FY10 reports were fairly well distributed between the five categories from 31 percent for commercial down into the teens in FY11 the commercial category accounted for 45 percent of the total with no other category exceeding 19 percent COLLECTOR AFFILIATIONS FIG 14 PERCENT 2011 FY2010 COMMERCIAL GOVERNMENT GOVERNMENT INDIVIDUAL UNKNOWN AFFILIATED Beyond this basic observation there was some interesting movement within the statistics In numbers of reports during the most recent year the unknown category decreased by 43 percent while the other four all increased two of them by around 50 percent and two by over 100 percent In terms of change from FY10 in percentage of the total in addition to a decrease in the share accounted for by unknown collectors from 28 to ten percent the individual collectors' share also decreased while the government collectors' share was unchanged at 12 percent This left the government-affiliated collector category to increase from 13 to 19 percent TARGETING U S TECHNOLOGIES 2012 and the commercial category from 31 to the aforementioned 45 percent Consistent with the previous year’s reporting commercial entities remained the primary affiliation of collectors associated with Europe and Eurasia in FY11 with the number of reported cases more than doubling year over year Many Europe and Eurasia commercial entities identify neither end users nor specific technologies in their requests Analyst Comment Some ostensibly commercial and individual Europe and Eurasia collectors demonstrated a level of knowledge about technologies that was consistent with that of intelligence officers IOs DSS assesses that the continued increase in reported activity by Europe and Eurasia commercial collectors likely reflects an effort to upgrade military technology Certain aspects of the effort to modernize civilian economies likely dovetail with military requirements for improved technology Confidence Level High Analyst Comment Economic ties between the United States and most countries in Europe and Eurasia are close and in some cases are growing closer The significant increase in reports linked to governmentaffiliated entities likely reflects a greater willingness by collectors to disclose association with government-affiliated research centers in light of these closer economic ties Simultaneously multiple EUROPE AND EURASIA METHODS OF OPERATION Regarding the MOs that collectors linked to Europe and Eurasia were reported by industry as using attempted acquisition of technology at 34 percent and RFI at 29 percent combined to account for even more of the total in FY11 63 percent than they did in FY10 55 percent In the interim DSS changed its accounting methodology such that many collection attempts that would previously have been labeled as RFIs are now categorized as attempted acquisition of technology The increase in these two categories might seem to make all the other MO categories relatively unimportant with each of them accounting for only one to eight percent of the total But if the two most common MOs represent the simplest most straightforward method of attempting to obtain illegal or unauthorized access to sensitive or classified information and technology it should still be noted that the wide range of other MOs recorded in industry reports represent all the “Plan B” methods In other words one may not succeed in gaining the desired information or technology by buying it or asking about it outright In that case the next-most-likely-to-succeed method is to somehow get someone close to a cleared contractor then seek opportunities to gain illegal or unauthorized access to the desired materials Whether at a conference convention or trade show via a delegation visiting a cleared contractor in the United States by targeting a U S traveler overseas or by obtaining a job or academic placement or setting up a marketing arrangement collectors seek to insinuate themselves into a position or relationship they can exploit 47 EUROPE AND EURASIA Interest by Europe and Eurasia commercial entities in developing business ties to the United States is increasing and contacts by collectors affiliated with them are as well Simultaneous with the 14 percentage point increase in the share of contacts made by commercial collectors government-affiliated collectors became the second most common category with the number of such cases in FY11 more than doubling over FY10 The share of contacts from unknown collectors decreased by almost half and those from individuals slightly countries within Europe and Eurasia almost certainly intend to remain competitive in the world arms market with the United States Intelligence Community IC reporting indicates that such countries view the United States as a market competitor for the sale of military equipment Confidence Level High LLJ METHODS OF OPERATION FIGURE 15 to their benefit Success for them almost certainly results in harm to the interests of cleared contractors as well as the larger military technological and economic well- being of the United States All of these lesser MOs together accounted for a not inconsiderable one-third of the year's reported collection attempts originating in Europe and Eurasia The exception to this discussion is the suspicious network activity SNA MO By definition it involves attempts to work through computers and networks not human beings directly and at a distance not in person In FY11 industry reports of collection activities categorized as SNA decreased markedly in number from FY10 amounting to a drop of over 70 percent As a category SNA went from being the second most common in FY10 at 17 percent to only three percent of the total in FY11 The worrisome possibility is that this change did not occur because industry D88 and 48 - ACADEMIC - REQIESTS FOR SOLICITATION I ATTEWTED SEEKING ACQUISITION EMPLOYNENT OF TECHNOLOGY - CONFERENCES I SOLICITATION CONVENTIONS OR MARIETING TRADE SHOWS - CRIMINAL I SUSPICIOUS ACTIVITES NETWORK ACTIVITY EXPLOITATION OF I TARGET ING U S RELATIONSHIPS TRAVELERS OVERSEAS I OFFICIAL FOREIGN VISITS 81 TARGETING OUTER RING FY 2011 INNER RING FY 2010 'Includes potential espionage indicators and cases not otherwise listed others in the IC got better at detecting and defeating SNA from Europe and Eurasia but that the region's cyber collectors already highly skillful got even better at concealing their illicit activities The M0 that Europe and Eurasia collectors were most commonly reported as using in FY11 was the attempted acquisition of technology accounting for 34 percent of total contacts Attempted acquisition of technology is defined as expressing interest in purchasing or actually placing an order for export-controlled technology comprised 29 percent of FY11 Europe and Eurasia contacts reported by industry often target technical specifications of sensitive military systems but stop short of attempting to purchase an export-controlled item Receipt of such an RFI could mean that an intelligence service has already obtained a restricted piece of technology and is seeking information on its use TARGETING U S TECHNOLOGIES 2012 A possible example occurred in January 2011 when a Europe and Eurasia national contacted a cleared contractor claimed to possess one of its export-controlled transceivers and requested the data transfer protocol for use with the module The transceiver is a component in several military applications including bombots and other unmanned vehicles The individual did not reveal how he obtained the transceiver but it may have been lost or stolen in a combat zone Conferences conventions and trade shows rose to be the third most used MO in the reporting data for the year Such venues continued to be used to solicit information and technology in FY11 IC reporting noted that government representatives and civilian journalists from Europe and Eurasia who questioned unmanned aerial system UAS industry experts at military expositions and conferences frequently asked questions beyond the scope of their responsibilities and showed an unusual breadth of knowledge In their simplest manifestation and deployment collectors find electronic methods of contact such as unsolicited emails and phone calls to be attractive as they can be conducted inexpensively with a low risk of adverse consequences combined with the potential for high gain Yet the more advanced types of Europe and Eurasia cyber espionage against U S cleared contractors essentially represent a current intelligence gap for DSS In EUROPE AND EURASIA Analyst Comment Such cyber espionage may cause malicious activity targeting cleared contractors that is conducted by Europe and Eurasia collectors to be incorrectly attributed to actors in a different country or region Confidence Level Low Some Europe and Eurasia countries may attempt insider-enabled network attacks which prevent the observation of suspicious indicators normally associated with network attacks Additionally such attacks may enable the compromise of computer networks that are sufficiently hardened to withstand attacks originating over the Internet but remain vulnerable to subversion by a malicious employee or contractor constituting a significant insider threat Confidence Level Low TARGETED TECHNOLOGIES The top four targeted technologies in FY11 industry reports were the same as in FY10 aeronautics systems LO S IS and electronics However they became much more bunched at the top with the share accounted for by the former top category IS cut in half from 26 to 13 percent leaving aeronautics systems unchanged at 16 percent and tied with LO S at the top of the list electronics accounted for ten percent No other individual technology section accounted for more than five percent of the total Aeronautics rose to the top of the list of Europe and Eurasia-targeted technologies at 16 percent of all reports Some Europe and Eurasia countries that do not have the resources to produce all the weapon systems and technologies they consider vital to their national interest seek out U S -developed UASs to support their armed forces 49 EUROPE AND EURASIA Together the solicitation or marketing services and the exploitation of relationships MOs accounted for 13 percent of reported Europe and Eurasia collection attempts in FY11 Reporting from cleared contractors suggests that collectors attempt to exploit government cooperation agreements and legitimate business exchanges to collect intelligence Throughout 2010 and 2011 DSS received several reports that Europe and Eurasia commercial delegations visiting cleared contractors included government IOs FY11 several cyber attacks against cleared contractor networks such as those using the Zeus Trojan banking malware were linked to criminal hacking Thus even when contacts are categorized as SNA incidents cannot necessarily be attributed to foreign intelligence entities deployed in various spots around the globe In FY11 there was some focus on long- endurance unmanned aerial vehicles accounted for 16 percent of the reported total On one occasion Europe and Eurasia government collectors questioned a cleared contractor employee working at an exhibit booth at the Euronavale Trade Show in Paris about operating frequencies used in tactical missile defense systems Last year's top technology category IS was FY11's third most targeted sector accounting for 13 percent of industry reporting Most of the contacts involved invitations to conferences or foreign visits to cleared contractors specializing in thus targeting of specific items was difficult to verify Optical communications technology with civilian and military applications was a specific focus identified in several reports with one collecting entity withdrawing its request after the cleared contractor insisted on end user information Analyst Comment The consistent collection emphasis on the IS sector probably reflects the priority of Europe and Eurasia militaries to upgrade their communication technologies Con dence Level Moderate Radiation-hardened rad-hard circuits see the Special Focus Area section of this publication for space-based applications have been a consistent target of some Europe and Eurasia collectors for several years Within the last decade a company from the region proposed to a cleared contractor a joint venture to create a facility in its country to produce rad-hard circuits but this did not transpire Subsequently Europe and Eurasia entities sought rad-hard circuits from cleared contractors at least 11 times from FY08 to FY11 as reported by industry to DSS Four of those requests made to three separate cleared contractors occurred in FY11 Most of these requests for rad-hard circuits requested between 20 and 42 pieces although one sought 3 200 TARGETED TECHNOLOGY HGURE16 PERCENT 30 25 2o 15 FY2011 1 FY2010 5 0 AERONAUTICS LASERS ELECTRONICS ARMAMENTS POSITIONING SPACE MARINE MATERIALS INFORMATTM SYSTEMS OPITCS AND SYSTEMS AND ENERCETIC NAVIGATION SYSTEMS SYSTEMS AND SECURTTY SENSORS MATERIALS AND TIME PROCESSES Figure illustrates the top ten most targeted technology categories In compared With the reporting statistics for the same categories from FY10 50 TARGETING U S TECHNOLOGIES 2012 Historical reporting shows that elements within Europe and Eurasia have pursued alternative means to develop or acquire desired technology including operating facilities to reverse-engineer any Western technology acquired additional attention to LO S will probably continue Collectors will likely continue to emphasize microelectronics including the rad-hard variety due to their importance in bringing militaries in the region into the 21st century Confidence Level Moderate Analyst Comment Those seeking the radhard circuits were likely unable to establish an indigenous capability to produce technology that met a desired standard DSS cannot rule out the possibility that Europe and Eurasia entities are still seeking radhard components for reverse-engineering Confidence Level Moderate The U S IC will likely face continuing challenges in attempting to attribute cyber attacks against cleared contractors to identifiable Europe and Eurasia entities Most such SNA will likely appear to support criminal activity but may occasionally address information falling within the scope of technology requirements set by governments in the region Confidence Level Moderate OUTLOOK Several Europe and Eurasia countries view the United States as their foremost economic competitor and will likely continue to seek information to help them compete politically economically and militarily in world affairs One way in which Europe and Eurasia entities are likely to continue to be a significant threat to U S information and technology resident in cleared industry in the coming years is by some companies from the region attempting to purchase U S companies Their likely intent in doing so would be to appropriate U S technologies that can then be legally used in Europe and Eurasia exports Confidence Level Moderate Europe and Eurasia entities’ targeting of U S information and technology will likely continue to focus on aeronautics systems and IS with emphasis on UASs and the Joint Tactical Radio System DSS assesses that EUROPE AND EURASIA CASE STUDY “WON’T YOU COME INTO MY PARLOR… ” Between November 2010 and February 2011 a U S cleared contractor employee received three email invitations to an international science conference to be held in Europe and Eurasia The invitations were sent to the employee’s work email address EUROPE AND EURASIA DSS assesses that Europe and Eurasia collectors will likely continue to emphasize legitimate commercial exchanges to upgrade their military technology and those requirements will in turn likely draw upon commercial ties to foreign businesses Cleared contractors conducting business in Europe and Eurasia will likely be subject to unabated aggressive collection efforts via all means available Confidence Level Moderate I C r epor t i ng show s t hat i n 2010 em pl oyees f r om t w o separ at e cl ear ed cont r act or s r ecei ved i nvi t at i ons t o t he pr evi ous conf er ence hel d t he year bef or e al so i n Eur ope and Eur asi a Such conf er ences host ed i n Eur ope and Eur asi a m ay have i ndi r ect connect i ons w i t h Eur ope and Eur asi a i nt el l i gence ser vi ces al t hough t he f ul l ext ent of t he r el at i onshi p i s unknow n Analyst Comment Scientific conferences present opportunities for foreign intelligence services to spot and assess persons with access to technology intelligence The successive iterations of this Europe and Eurasia conference may be used to elicit technology information that is responsive to government collection requirements Confidence Level Low 51 EUROPE AND EURASIA THIS PAGE INTENTIONALLY LEFT BLANK 52 TA R G E T I N G U S T E C H N O L O G I E S 2 0 1 2 SOUTH AND CENTRAL ASIA SOUTH AND CENTRAL ASIA OVERVIEW South and Central Asia made the most noteworthy change from fiscal year 2010 FY10 to FY11 in an unfortunate direction as far as US cleared contractors are concerned This region more than doubled year over year in number of reports ascribed to it for attempts to obtain illegal or unauthorized access to sensitive or classified information and technology resident in the U S cleared industrial base In so doing it increased its share of the world s larger total for FY11 from nine percent to 12 percent Increased regional instability and conflicts counterterrorism efforts and defense modernization initiatives continue to impact South and Central Asia defense industries driving efforts to obtain U S information and technology These attempts to maintain and upgrade military capabilities can be accomplished through the purchase of new technologies as well as the upgrading or replacing of older systems Any sensitive or classified U S information and technology acquired could assist greatly with such modernization efforts 53 mm 20 0 4 2 EU SOUTH AND U O p LLJ South and Central Asia government entities that experience difficulty in obtaining the licenses and paperwork necessary to purchase dual-use technology are able and willing to exploit their relationships with the US government and commercial entities to circumvent export-restriction laws South and Central Asia entities still on U S export- restriction lists remain a threat to attempt to illicitly acquire U S technology Commercial companies remained the top South and Central Asia collector category in reported attempts in FY11 The private sector often contacted us cleared contractors in an attempt to win contracts with government agencies in their countries Intelligence Community IC reporting indicates that South and Central Asia intelligence and security services likely work closely with these government agencies on certain matters however no evidence suggests that commercial companies have contacted cleared contractors on behalf of or at the urging of intelligence services As reflected in FY11 industry reporting on South and Central Asia the combination of commercial entities using the attempted acquisition of technology and request for information RFI methods of operation MO accounted for the majority of suspicious contacts These commercial entities were largely procurement agents who identified military and other government agency end users for the materials sought In 1 South and Central Asia commercial companies commonly used direct contact methods primarily email to attempt to acquire technology from cleared contractors FY1 1 industry reporting showed that South and Central Asia entities targeted technologies across the Militarily Critical Technologies List MCTL most notably in the sections encompassing information systems lasers optics and sensors aeronautics systems and electronics systems 54 COLLECTOR AFFILIATIONS Given the large overall increase in number of industry reports ascribed to collectors from South and Central Asia it is not surprising that the number of reports went up in all five affiliation categories from FY10 to 1 However the top category in both years commercial decreased in share of the total from nearly two-thirds to under one-half The shares for the government and unknown categories varied by only a percentage point year over year The significant changes were in the government- affiliated and individual categories which rose from 11 to 18 percent and from five to 18 percent respectively of the more recent year s total now tying them for a distant second place behind the commercial category's 47 percent COLLECTOR AFFILIATIONS FIGURE 17 PERCENT 2010 COMMERCIAL GOVERNMENT GOVERNMENT INDIVIDUAL UNKNOWN AFFILIATED Although the percentage share of the year s totals accounted for by commercial entities decreased the number of reports nonetheless increased by over 60 percent The majority of the commercial entities making requests for US technology in FY1 1 were procurement agents acting on behalf of or in response to requirements from elements of South and Central Asia governments including military security and intelligence services TARGETING U S TECHNOLOGIES 2012 The dominant pattern practiced by governments in South and Central Asia for procuring defense technology consists of state-run organizations issuing tenders to secure military equipment both systems and subcomponents Such tenders are often accessible to the public on official government websites and frequently include specifications for the requested technologies Procurement agents respond to the tenders attempting to fill the requirements by contacting companies discovered through open-source research that market products matching the tender specifications Analyst Comment The Defense Security Service DSS assesses it is very likely that the majority of the suspicious contacts reported by cleared contractors represented efforts to respond to South and Central Asia government tenders and meet government requirements Confidence Level High Typically once a South and Central Asia commercial entity identifies a U S company producing technology responsive to the tender requirements it seeks to contact the company The commercial agent either attempts to acquire the system outright or requests information on the technology Most South and Central Asia requests for information or technology received by U S cleared contractors identified a military service or other government entity as the end user Several of the commercial collectors that did not identify an end user have ties to the military or are procurement agents with a history of making requests on behalf of the government Open- SOUTH AND CENTRAL ASIA Analyst Comment Considering the similarities between the commercial requests and the government tenders it is likely that South and Central Asia government agencies were the intended end users for the technologies requested in a majority of the cases in the commercial category Confidence Level Moderate Some governments within the region are promoting policies to encourage involvement by a wider array of private commercial companies in defense procurement including the bidding on government tenders issued by defense agencies Analyst Comment This policy probably contributed to the rise in the number of reported acquisition attempts by South and Central Asia commercial entities Furthermore it was also likely responsible for a rise in the overall number of firms and procurement agents that contacted U S cleared contractors as more firms and procurement agents became active in the market Confidence Level Moderate Government-affiliated entities followed commercial entities in reported suspicious requests to cleared contractors constituting 18 percent of the FY11 South and Central Asia total The number of reports from government-affiliated entities rose by 280 percent over FY10 figures South and Central Asia collecting entities in this category in FY11 included governmentowned companies and government-affiliated technological institutes other universities and research organizations From such entities students researchers engineers and others initiated numerous unsolicited contacts to cleared contractors 55 SOUTH AND CENTRAL ASIA Analyst Comment Queries regarding a technology in question likely constituted attempts to determine whether it could ultimately meet the needs of the South and Central Asia end user however DSS cannot rule out that such RFIs represented attempts to obtain sensitive or classified information from the cleared contractor Confidence Level Moderate source searches provide evidence that in many such cases South and Central Asia companies were referencing tenders put out by specific government agencies as their requests to U S cleared contractors cited specific technologies sought by those tenders They requested jobs internships research positions and other assistance with research such inquiries often sought information on the pricing or availability of sensitive or classified U S technology as well According to IC reporting some of the governmentaffiliated entities in question encourage South and Central Asia students studying in the United States to transfer information and or technology back to their homelands SOUTH AND CENTRAL ASIA Analyst Comment Many South and Central Asia students who initiate contacts to cleared contractors likely have a working relationship with defense agencies in their countries which sometimes fund research and development R D programs at the government-affiliated institutions then use students and resources from them Confidence Level High While the individual category of collector like government-affiliated at 18 percent accounted for a considerably smaller share of the total than commercial the number of reports on individuals soared by over 600 percent since FY10 Entries in the individual category include student requests that DSS counterintelligence analysis connected to independent South and Central Asia universities rather than government-affiliated ones or cases in which no affiliation with a specific university could be determined The largest part of these individual requests consisted of résumé submissions to cleared contractors soliciting employment or to U S universityaffiliated research centers seeking researchrelated positions The small FY11 amount of cyber activity that could be traced to South and Central Asia but no farther is represented in the individual category as well The remaining individual contacts consisted of RFIs or attempted acquisitions including requests during which individuals provided no affiliation with a specific company or organization but their email addresses mailing addresses and or telephone 56 numbers traced back to South and Central Asia While these requests sought disparate technologies they tended to mirror requests made by commercial entities Analyst Comment For South and Central Asia collectors in the individual category DSS could not connect the person to any company However there is an even chance that these individuals were independent or new procurement agents responding to government tenders Confidence Level Moderate When South and Central Asia government entities themselves contacted cleared contractors the requests were largely in pursuit of technology systems that are of interest to researchers for space and satellite systems or consisted of military officers making inquiries about military platforms METHODS OF OPERATION There was a real contrast between FY10 and FY11 in the reported MOs collectors linked to South and Central Asia used in their attempts to obtain illegal or unauthorized access to sensitive or classified information and technology resident in the U S cleared industrial base Partly this was due to a change in the statistical accounting method used by DSS which resulted in many contacts that had previously been categorized as RFIs now being labeled attempted acquisitions of technology the latter category went from no reports in FY10 to ranking first in FY11 with nearly onethird of the total Mostly this was at the expense of the RFI category which went from 78 percent of the total in FY10 to 29 percent in FY11 But the South and Central Asia statistics concerning other MOs experienced change as well Academic solicitations which had registered a negligible one percent of the total in FY10 rose to nine percent of the FY11 total and seeking employment went from three percent to ten percent of the year’s total In comparison solicitation or TA R G E T I N G U S T E C H N O L O G I E S 2 0 1 2 marketing services remained stable within the listing with only a percentage point increase in share from eight to nine percent Attempted acquisition of technology was the most common MO South and Central Asia entities used in FY11 comprising 32 percent of reported collection attempts associated with the region Generally South and Central Asia entities sent unsolicited emails to cleared contractors requesting to purchase specific technology usually in a specific quantity as well While not all of the unsolicited emails referenced a particular government tender some cited the exact specifications and quantities listed in such tenders Closely following attempted acquisitions of technology were RFls at 29 percent of reported South and Central Asia-originating collection attempts Commercial entities used unsolicited emails as the primary mechanism to submit purchase requests METHODS OF OPERATION FIGURE 18 SOUTH AND CENTRAL ASIA ask technical questions and or gather information about specific technologies Analyst Comment More South and Central Asia entities are now attempting to develop business relationships with cleared contractors It is likely that the attempted acquisition of technology MO surpassed reported RFIs in part because of the more amicable relationships between the United States and some South and Central Asia countries which encourage technology transfer Con dence Level Moderate Although the attempted acquisition of technology and RFI categories are separate for the purposes of increasingly discriminating reporting the means by which these two MOs are employed are very similar In both methods an entity contacts a cleared contractor requesting certain sensitive components or platforms or asking for information such as pricing or technical specifications The entities INNER RING FY 2010 'lncludes potential espionage indicators and cases not othermse listed 57 I ACADENIC I REQUESTS FOR SOLICITATION INFORMATION I ATTEWTED SEEKNG ACQUISITION OF TECHNOLOGY - CONFERENCES I SOLICITATION CONVENTIONS OR MARKETING TRADE SHOWS - CRIMINAL I SUSPICIOUS ACTIVITIES NETWORK ACTIVITY EXPLOITATION OF I TARGETNG U S RELATIONSHIPS TRAVELERS OVERSEAS - OFFICIAL FOREIGN VISITS 8 TARGETING OUTER RING FY 2011 making these requests mostly appear legitimate inquiries only occasionally reveal a nefarious or suspicious end user The difference between the MOs is that in the case of attempted acquisition the suspicious entity is more likely to be aware that it is not an authorized recipient Analyst Comment Most South and Central Asia procurement agents very likely view RFIs and attempted acquisitions of technology as legitimate and potentially successful means of obtaining sensitive or classified U S information and technology Confidence Level Moderate SOUTH AND CENTRAL ASIA FY11 saw the emergence of academic solicitations by South and Central Asia actors totaling nine percent of reported collection attempts linked to that region in comparison to one percent the year before Governments within the region are engaged in expanding institutions of higher learning in number and enrollment to more closely parallel enrollment of students in Western countries University requirements of an internship for students—a majority of whom seek to fulfill their internship requirement at a U S company— contributed to the number of academic solicitations made to cleared contractors Analyst Comment In addition to the creation of additional South and Central Asia universities better awareness among cleared contractors concerning foreign students likely contributed to the increase in the number of student résumés job applications and inquiries reported by cleared industry in FY11 Confidence Level Moderate While solicitation or marketing was only the fifth most common MO South and Central Asia collectors used in FY11 as reflected in industry reporting it remains noteworthy Although it represented eight percent of the reporting last year and nine percent in FY11 due to the overall increase in reporting related to South and Central Asia the number of cases in this category 58 more than doubled year over year In most suspicious contact incidents reported by cleared industry involving this MO a South and Central Asia company offered to act as the cleared contractor’s agent or distributor in a particular country or the region Analyst Comment While South and Central Asia entities’ attempts to form business partnerships may be legitimate it is likely that they are intended more to promote an additional avenue to access sensitive or classified U S information and technology Were cleared contractors to enter into such agreements the South and Central Asia entity would likely request an exchange of personnel or even access to controlled U S information and technology as a condition of the deal either situation could result in unauthorized access to sensitive or classified U S information and technology Confidence Level Moderate TARGETED TECHNOLOGIES The top of the list of technologies most frequently reported by industry as having been targeted by collectors from South and Central Asia was fairly stable from FY10 to FY11 Just as in FY10 in FY11 the IS and LO S sections were tied at the top at 19 percent Aeronautics in third place with ten percent increased only one percentage point from the year before Last year’s fourth-place technology positioning navigation and time slid to seventh place in the new listing now at five percent allowing electronics to move up one spot from last year with nine percent of the total Industry reporting shows that South and Central Asia entities continue to seek a wide and diverse range of dual-use technologies from cleared contractors The IS technologies South and Central Asia collectors targeted in FY11 included modeling and simulation M S software used for range-testing of aircraft and missiles Existing South and Central Asia missile systems may lack radar and testing equipment adequate to track review and improve test results TA R G E T I N G U S T E C H N O L O G I E S 2 0 1 2 FIGURE 2011 10 I FY 2010 5 0 INFORMATION LASERS AERONAUTTCS ELECTRONICS ARMAMENTS AND ENERGETIC SENSORS MATERIALS SYSTEMS OPTICS AND SYSTEMS MATERIALS POSITIONING GROUND PROCESSING AND MARINE AND NAVIGATION SYSTEMS MANUFACTURING SYSTEMS PROCESSES AND TIME Figure Illustrates the top ten most targeted technology categories In FY11 compared 'mth the reporting statistics for the same categories from FY10 accurately To achieve a competitive military and economic edge in the region with regard to radar capabilities and products collectors seek enhanced tracking capability Analyst Comment It is likely that acquisition of more advanced software would improve South and Central Asia entities' radar capabilities which would likely assist in correcting deficiencies in a multitude of areas including missiles surveillance systems and training programs Confidence Level Moderate Additionally in a large number of cases South and Central Asia students sent r sum s requesting positions in the information technology IT field including programming software development and network systems engineering any of which could facilitate access to cleared contractors IS-related materials software and technologies SOUTH AND CENTRAL ASIA Analyst Comment While some of the requested positions do not directly involve classified material they may allow access to proprietary and or export-controlled information When students in such positions complete their internships or employment they possess the potential to either knowingly or unknowingly transfer sensitive information back to their home countries There is an even chance that relationships opened by such student contacts with U S cleared contractors are exploited by the students home countries Confidence Level Moderate Technology areas within the and electronics systems sections of the MCTL that South and Central Asia entities specifically targeted in FY11 included thermal imaging cameras South and Central Asia is characterized by security concerns from perceived threats both within and outside the region Persistent and continuous requests for thermal imaging 59 GNV 2 4 0 r systems considered in the context of IC and open-source reporting indicate that South and Central Asia actors are probably continuing to build their surveillance technology base for application to border security and in response to a growing threat of missile deployment along those borders from either ship or coastal installations Their targeting of U S UAVs almost certainly reflects an effort to support force modernization plans and upgrades Confidence Level High Other systems targeted within the LO S section of the MCTL included fire control radar airborne warning radar medium wave infrared cameras and battlefield surveillance radar BSR The volume of requests from South and Central Asia for BSR technology reported by industry combined with 2010 IC reporting indicates that some South and Central Asia militaries have a limited BSR capability but are seeking to upgrade it including to achieve systems networking capability DSS assesses that South and Central Asia entities almost certainly perceive an enduring need for foreign in particular U S technology Ongoing and intensifying conflicts in the region border issues with neighbors within and outside the region frictions with the United States and internal security concerns are likely to motivate South and Central Asia countries As neighbors and rivals continue efforts to collect and advance upon multiple technology platforms countries desire to counter with capable technologies of their own To counter perceived threats South and Central Asia collectors will almost certainly continue to attempt acquisition of and collection against U S information and technology Confidence Level Moderate SOUTH AND CENTRAL ASIA Analyst Comment South and Central Asia nations likely view BSR systems as crucial to protecting their borders There is an even chance that many South and Central Asiaconnected attempts to acquire U S BSR systems are a response to similar efforts by their neighbors to improve their own BSR systems Confidence Level Moderate To further support goals regarding border security as well as intelligence surveillance and reconnaissance ISR weapons mobility deployment and the conduct of terrain studies South and Central Asia companies and agencies targeted unmanned aerial vehicles UAVs Entities continued to request not only whole UAV systems but also increased their requests for UAV components as defense industries and laboratories in the region worked toward self-production of complete UAVs Some in the region have developed indigenous unmanned aerial systems UASs but have experienced difficulties in developing advanced systems Analyst Comment South and Central Asia entities have made multiple attempts to acquire U S long-range ISR-capable UAVs including those that can be launched 60 OUTLOOK Given the perceived imperative to improve military capabilities there is an even chance that South and Central Asia entities that encounter what they perceive as delays in acquiring desired technology including dual-use systems through legitimate avenues will turn to illicit methods There is an even chance that South and Central Asia agencies’ and companies’ motivations to protect their own interests will outweigh their inclination to follow U S export laws especially if they risk compromising security within the region hampering defense industry development and reducing their own revenue In order to obtain illegal or unauthorized access to sensitive or classified information and technology resident in the U S cleared industrial base some South and Central Asia entities will likely attempt to exploit relationships with the United States Confidence Level Moderate If successful at illicitly acquiring U S information and technology from cleared TA R G E T I N G U S T E C H N O L O G I E S 2 0 1 2 contractors some South and Central Asia entities are likely to share such materials with intra- and interregional allies Such alliance relationships are likely to continue to develop and the out-of-region parties involved would thereby gain illicit access to U S military technology even that which was legally acquired originally Confidence Level Moderate There is also an even chance of increased exploitation attempts from South and Central Asia cyber actors The region’s active and growing IT sector produces and employs individuals capable of hacking computer systems According to industry reporting from FY11 such individuals contacted cleared contractors to establish business relationships with their companies While no reporting indicates these South and Central Asia IT companies are acting as intelligence collection sources at this time their capabilities are likely advanced enough for them to be exploited as a collection tool Confidence Level Moderate most such approaches will almost certainly be made by legitimate entities it cannot be discounted that disreputable actors will attempt to obscure the illicit nature of their acquisition attempts amid the increasing volume of reports from commercial entities Confidence Level High DSS assesses that South and Central Asia entities will very likely continue their collections against U S cleared contractors’ LO S systems software testing materials infrared and surveillance technologies and UAS components Much of this effort will very likely be the result of force modernization requirements and upgrades but will also likely reflect the perceived need to maintain parity with or even outpace neighbors’ capabilities in these areas Confidence Level Moderate SOUTH AND CENTRAL ASIA The existing and expanding technical institutes that graduate those with such capabilities are likely to produce an increase in student requests to U S cleared contractors Government initiatives will probably enhance R D partnerships between South and Central Asia training institutes and government agencies which are then likely to increase their combined outreach to U S cleared contractors Confidence Level Moderate DSS assesses that South and Central Asia collection efforts will probably continue to rely heavily on commercial entities acting as government procurement agents to acquire U S technology These entities will almost certainly continue to use RFIs and attempted acquisitions of technology to obtain sensitive or classified U S information and technology for their defense industries By and large such requests will very likely continue via email and web card with occasional in-person contact While SOUTH AND CENTRAL ASIA 61 CASE STUDY GROUND RADAR ATTACK T he f o llo win g is a n e x a mp le o f S o u t h a nd C ent r al Asi a use of a pro c u r e me n t a g e n t t o o b t a in in f o r ma ti on r egar di ng a sensi t i ve U S tec h n o lo g y T h is c o lle c t o r h a s a h is t o r y of m aki ng i nqui r i es on behal f of t h e milit a r y In D e c e mb e r 2 0 1 0 a r e p r e s e n t a t iv e of a Sout h and C ent r al Asi a comp a n y v is it e d t h e b o o t h o f a c le a r e d cont r act or at t he D ef ence Sec u r it y a n d E q u ip me n t I n t e r n a t io n a l conf er ence i n London and f o llo we d u p wit h a n e ma il r e q u e s ti ng t o m ar ket t he cl ear ed con t r a c t o r ’s g r o u n d s u r v e illa n c e r a d a r G SR and ot her t echnol ogi es to h is c o u n t r y The individual in question had previously used the same MO at a 2010 Washington D C conference visiting the booth of the same cleared contractor and following up with an email to inquire about m a r k e t i n g G S R t o h i s c o u n t r y ’s a r m y I C r e p o r t i n g i n d i c a t e s t h a t h e i s a p r o c u r e m e n t a g e n t f o r h i s c o u n t r y ’s i n t e l l i g e n c e s e r v i c e a n d t h e c o u n t r y ’s m i l i t a r y O v e r t h e l a s t f e w y e a r s h e h a s a t t e n d e d various defense shows attempting to procure equipment for his c o u n t r y ’s m i l i t a r y SOUTH AND CENTRAL ASIA Ana ly s t C o mme n t B a s e d o n t h e a g e n t’s t i es t o hi s gover nm ent DSS a s s e s s e s t h a t h e p r o b a b ly c o n d u ct s hi s at t em pt s t o acqui r e s en s it iv e o r c la s s if ie d in f o r ma t io n a n d t echnol ogy at t he behest of his c o u n t r y ’s milit a r y a n d in t e llig e n c e est abl i shm ent s D SS assesses tha t t h e r e is a n e v e n c h a n c e t h a t h is gover nm ent uses hi m and hi s comp a n y t o le v e r a g e t h e p r o c e s s o f le gi t i m at e i nqui r y t o obt ai n info r ma t io n a n d t e c h n o lo g ie s f r o m U S busi nesses Con f id e n c e L e v e l Mo d e r a t e 62 TA R G E T I N G U S T E C H N O L O G I E S 2 0 1 2 OTHER REGIONS Entities originating from the Western Hemisphere and Africa accounted for just seven percent of the collection attempts targeting U S information and technology reported by cleared industry in fiscal year 2011 FY11 This was a marginal decrease from previous years in the share of overall reported collection attempts down from representing eight percent of all attempts in FY10 and ten percent of all attempts in FY09 DSS attributed a larger number of suspicious reports to entities from both of these regions in FY11 than previously However the increase in reports linked to these regions was far lower than the overall increase in reporting from FY10 to FY11 which increased by 75 percent while reporting attributed to the Western Hemisphere increased by just 49 percent and that from Africa by just six percent OTHER REGIONS Based on industry reporting in FY11 entities from the Western Hemisphere most actively targeted information systems IS aeronautics systems electronics technology and lasers optics and sensors LO S in that order These four categories accounted for 40 percent of the collection attempts attributed to the region Similarly entities from Africa favored information pertaining to aeronautics systems IS LO S and armaments and energetic materials technology in that order Collection attempts targeting those four categories accounted for over two-thirds of those attributed to Africa Analyst Comment The number of attempts to target U S technologies originating from these two regions will likely continue to increase albeit at a slower pace than those from the other four regions Countries in the Western Hemisphere and Africa largely possess smaller armed forces and less developed defense industrial bases than those in East Asia and the Pacific the Near East and Europe and Eurasia Confidence Level Moderate OTHER REGIONS Commercial entities from both of these regions were the most active at attempting to collect U S technologies as reported by industry Commercial entities from Africa conducted over half of the collection attempts attributed to this region while commercial entities accounted for 35 percent of the attempts originating from the Western Hemisphere Government entities were the second most common affiliation for entities from Africa accounting for over a fifth of all reported attempts from this region In contrast individual was the second most common affiliation for entities from the Western Hemisphere tallying one-third of all reported collection attempts linked to it Entities from both of these regions relied heavily on the request for information followed by attempted acquisition of technology as their primary methods of operation 63 CONCLUSION Technologies resident in U S cleared industry remain highly sought after Foreign intelligence entities FIEs continue to expand their collection networks and activities These networks are growing like a malignant vine This ongoing theft— FIEs’ pilfering of U S technologies from cleared industry—could reduce or even end advantages in military capabilities the United States possesses over potential adversaries thereby adversely affecting U S battlefield dominance It also could strangle U S economic growth vitiating the nation’s economic health The overall number of reports submitted by cleared industry to the Defense Security Service DSS in FY11 increased by nearly 65 percent over FY10 and the number that actually became suspicious contact reports SCRs increased by 75 percent likely due in large part to increased awareness and reporting by industry Many of the attributes of the entities targeting U S technologies remained constant from FY10 through FY11 The order of the regions linked to the most prolific collectors of U S information and technology remained unchanged from FY10 commercial remained the most common collector affiliation and the top four most targeted technology categories remained the same A modest change in the favored method of operation MO occurred with attempted acquisition of technology becoming the most common MO This largely reflected a change in terminology in that DSS would have classified many incidents of attempted acquisition of 64 technology as a request for information RFI in previous years In FY11 RFI became the second most common MO Constancy of the order of the regions represents the most enduring trend Over the past five years the only change in the order occurred in FY07 and FY09 when South and Central Asia was the third most prolific and Europe and Eurasia the fourth the other three years Europe and Eurasia has been the third most prolific East Asia and the Pacific and the Near East have remained the first and second most prolific collector regions throughout the five years responsible for at least 56 percent of all reported collection attempts each year As previously noted entities linked to East Asia and the Pacific remained the preeminent attempted collectors of U S technology Over the past five years entities from this region accounted for 42 percent of all collection attempts reported to DSS Entities from the Near East consistently represented the second most active collectors but accounted for just slightly over 18 percent of all reporting Analyst comment East Asia and the Pacific features many areas with a permissive environment in which collectors can operate In some areas collection efforts even those by commercial and individual entities have government sanction or at least tacit approval in some cases collection is conducted at government direction In other areas lax export controls provide collectors a permissive environment from which to acquire technology and subsequently forward TA R G E T I N G U S T E C H N O L O G I E S 2 0 1 2 it to entities in other areas of East Asia and the Pacific or beyond to other regions Confidence Level Moderate In FY11 foreign entities identified as commercial made that affiliation the most common one in industry reporting for collectors targeting U S information and technology Commercial entities have constituted the most common affiliation in each of the past five years accounting for over 36 percent of all the reported collection attempts during that period In FY11 commercial entities were the most common affiliation in five of the six regions the only exception being government-affiliated entities in the Near East region In FY11 the individual affiliation accounted for the second most reported attempts to collect U S technology as reported by industry This was a significant shift from previous years Over the five-year period FY07 through FY11 the individual affiliation accounted for just over 13 percent of all collection attempts the fifth most common From FY07 through FY09 entities identified as individuals accounted for no more than nine percent of the attempts to collect U S technologies and was consistently the fifth most common affiliation In FY10 the individual affiliation was the fourth most common for attempted collectors and accounted for 12 percent of the collection attempts In FY11 the number of collection attempts attributed to individuals increased by more than 160 percent over the total from FY10 and accounted for 18 percent of the total collection attempts This may be related to the increase in academic solicitation CONCLUSION The third and fourth most common affiliations government-affiliated and government both significantly increased in number of reported attempts to target cleared industry Government-affiliated experienced a 100 percent increase and reported attempts conducted by government entities increased by 165 percent in FY11 over FY10 Much of the increase in attempts attributed to government reflects better reporting and attribution which reduced the number of attempts credited to unknown entities Over the past five years attempts by unknown entities accounted for over 17 percent of all reported collection attempts and was the second most common affiliation over that period However in FY11 unknown was the fifth most common affiliation accounting for 14 percent of the collection attempts Consistently throughout the past five years the most frequently applied MOs for collectors have been to directly request information or attempt to acquire technology Attempted acquisition of technology and request for information RFI were the two most common MOs Together in FY11 they accounted for 43 percent of reported collection attempts A redefinition of attempted acquisitions led to DSS attributing many cases in FY11 to that category that would have been considered RFIs in previous years Thus reported efforts via attempted acquisition of technology jumped from less than one percent in FY10 to 23 percent in FY11 Consequently RFIs plummeted over the same period from representing 48 percent of reported attempted collections to 20 65 percent Collectively these MOs represent direct overt contact with cleared industry in an attempt to receive information or acquire technology by asking for it Suspicious network activity SNA continued to be a growing phenomenon in FY11 The number of reported SNA collection attempts increased by 36 percent in FY11 over FY10 Better detection and reporting by industry has contributed greatly to improved identification of SNA and the ability to attribute it to particular regions In FY11 SNA was the most prevalent collection MO for entities originating from East Asia and the Pacific This is the only region identified as leveraging SNA so heavily SNA figured no more prominently than fifth in any other region However in reports for which the region of origin is unknown SNA was again the most prominent MO Due to the nature of SNA it is difficult to attribute some collection attempts to an entity or even to a region of origin The most sought after technologies in FY11 remained largely the same The top four most targeted technology categories— information systems IS lasers optics and sensors LO S aeronautics systems and electronics—remained unchanged Armaments and energetic materials replaced marine systems as the fifth most targeted category of the Militarily Critical Technologies List MCTL The top five in FY11 were the most commonly targeted technologies for the last five years A trend for the past three years is an apparent broadening of the targeting of 66 technology the focus of collectors seems to be diffusing In FY07 the top five targeted technologies accounted for 67 percent of all reported collection attempts In FY09 these technologies continued to represent over 66 percent of reported collection attempts However in FY10 the top five targeted technology categories accounted for 57 percent and this dropped further in FY11 with the top five categories accounting for just over 51 percent of reported collection attempts This apparent broadening of interest in technology has made space systems processing and manufacturing and directed energy systems more common targets for collectors In FY09 collectors targeted space systems in fewer than two percent of reported collection attempts whereas in FY11 collectors targeted space systems in almost five percent of reported attempts In the same period collection attempts aimed at directed energy systems went from onesixth of one percent to over two percent of all reported collection attempts Analyst Comment If this diffusion of interest continues in FY12 and beyond it may signify that some competitor countries now consider themselves peers to the United States in those technologies that formerly were the most highly sought after such as IS technology Such countries may further turn the focus of their collection efforts to other technology categories such as space systems in which the United States retains an advantage Confidence Level Low TA R G E T I N G U S T E C H N O L O G I E S 2 0 1 2 OUTLOOK Access to and application of the latest technologies is a vital component of being victorious on the battlefield and competitive economically The technologies resident in U S cleared industry represent the latest and greatest advances But this technological advantage is under perpetual attack from foreign intelligence entities FIEs representing political adversaries and economic competitors This onslaught of espionage targeting U S technologies is constant and unwavering In fact this year’s reporting suggests this persistent attack on U S technologies continues to grow A technological advantage can be devastating on the battlefield providing one side with a decisive victory while it suffers limited losses In 1991 Coalition forces led by the United States and armed with the most advanced weapons systems crushed an Iraqi army that had established itself in defensive positions in Kuwait and southern Iraq The Iraqi army deployed aging equipment most of which was a generation older than that wielded by the United States and its NATO allies in the coalition Coalition soldiers sailors airmen Marines and Coast Guardsmen used stealth technology precision weapons systems and superior battlefield surveillance technology to their advantage helping to lead to a decisive victory Conversely conflict between opponents sharing technologic parity can lead to bloody costly and enervating conflagrations On July 1 1916 to relieve the pressure on the French army fighting near Verdun the British army initiated an offensive against OUTLOOK German lines near the Somme River During the week prior to the offensive the British fired over 1 7 million artillery rounds against the German lines On the first day of the battle the British advanced with over 100 000 men—and suffered an estimated 60 000 casualties including 20 000 deaths The Battle of the Somme would last until November of 1916 and cost the British 420 000 the French 200 000 and the Germans 500 000 casualties 4 The Battle of the Somme featured opposing forces largely armed with the same generation of weaponry It also demonstrated that the offensive tactics of the day could not match the modern firepower wielded by the defense Advances in technology are equally important to the economic health of a country The fortunes of a country can hinge upon an advantage in industry In 1789 Samuel Slater 1768-1835 emigrated from England to a young and newly independent United States Prior to leaving England while working in the textile industry he had memorized the design and workings of the water mill designed by Richard Arkwright At that time England strictly restricted the export of textile machinery or technology Slater claimed to be a farmer when leaving England fearing he would not be allowed to leave if authorities knew his true profession After arriving in the United States Slater was instrumental in establishing the first water-powered cotton-spinning mill in the country 5 This violation of export controls along with Slater’s ability to replicate the mill machinery greatly accelerated the industrial revolution in America Furthermore this story demonstrates that it can often be as 67 important to obtain information and design details of a given technology as the actual piece of equipment The battlefield and economic advantage enjoyed by the United States is precarious and the loss of the advantage on the battlefield would likely have disastrous results for U S forces Concurrently the continuing invasive collection of U S technologies would likely further erode the U S technological advantage and cause severe repercussions to the U S economy Confidence Level Moderate Those who attempt to collect U S technologies will almost certainly continue to target a wide variety of them spanning the entire spectrum delineated in the Militarily Critical Technology List MCTL Collectors will very likely target to some extent technologies in all 20 MCTL sections in addition to sensitive and classified information held in cleared industry Confidence Level High Collectors will likely continue to focus greater attention on particular technology sections of the MCTL Overall information systems IS lasers optics and sensors LO S aeronautics systems and electronics technology will very likely experience the most targeting attempts from foreign entities Confidence Level High IS technology will almost certainly remain the most sought after category of technology by foreign collectors The category encompasses a wide range of enabling technologies that can provide military and commercial advantage Collectors will 68 likely continue to target command control communications computers intelligence surveillance and reconnaissance technologies modeling and simulation software and advanced radio technologies Confidence Level High LO S technology has held its position as the second most sought after category for the last two years and will very likely remain a highly targeted MCTL sector In fiscal year 2009 FY09 the Defense Security Service treated LO S as two separate categories which if combined would have been the most targeted technology category Confidence Level Moderate While IS LO S and aeronautics systems technology will likely remain the most targeted FIEs will probably increase their targeting of information and technology relating to space systems technology as well as technologies in other MCTL categories with application to the space industry including radiation-hardened integrated circuits Confidence Level Moderate Although the methods of operation MOs used by collectors will very likely continue to evolve it is almost certain that attempted acquisition of technology and request for information will continue to be the most prominent MOs Confidence Level High Cyber-based collection characterized as suspicious network activity SNA will almost certainly continue to increase as adversaries apply new malicious programs to target the vulnerabilities inherent in systems connected to the Internet Confidence Level High TA R G E T I N G U S T E C H N O L O G I E S 2 0 1 2 Academic solicitation will likely remain a common MO for entities originating in East Asia and the Pacific and the Near East Confidence Level Moderate In FY11 reporting commercial entities were the most common attempted collectors of U S technologies in all but one of the six regions It is very likely that commercial will continue to be the most common collector affiliation overall in reporting data Some companies seek U S sensitive and classified information and technology to develop and sell their own products for profit But commercial entities can also provide a layer of separation between the collector and the foreign government This affords the foreign government the ability to deny involvement in the targeting of U S information and technology In addition collectors likely employ commercial entities in third countries to target U S technology in order to hide the identity of the intended end user and circumvent export controls Confidence Level Moderate Outside the continued predominance of commercial entities as collectors the number of government entities identified as collecting will likely increase with improved reporting of SNA by industry Government entities identified as targeting U S technology especially via SNA will likely continue to most frequently originate in East Asia and the Pacific Confidence Level Moderate In the other regions government-affiliated entities such as academic and research institutions or individuals will probably OUTLOOK be the next most common type of entities targeting U S technologies after commercial Confidence Level Moderate Entities from East Asia and the Pacific will almost certainly remain the most prolific in collection attempts reported by cleared industry This region features contentious boundaries and encompasses economic rivals of the United States The perceived need within this region for modern militaries combined with growing economies will very likely fuel the continued targeting of U S technologies as an efficient and effective method of abbreviating research and development of new and emerging technologies Confidence Level High The Near East will probably continue to account for the second most reported collection attempts targeting cleared industry Adversarial forces in the region seek the latest in technology to enhance their security to re-package and re-sell for commercial gain and to circumvent international sanctions Confidence Level Moderate Persistent and pervasive foreign collection attempts to obtain illegal or unauthorized access to sensitive or classified information and technology resident in the U S cleared industrial base will almost certainly continue unabated in the future FIE MOs will likely evolve and the specific technologies targeted will probably change but the constancy and aggressiveness of the campaign of collection attempts will almost certainly not subside Confidence Level High 69 EXPLANATION OF ABBREVIATIONS AND ACRONYMS ALL ARE U S UNLESS OTHERWISE INDICATED OMITTED FOREIGN ACRONYMS THAT APPEAR IN ONLY ONE PLACE BSR battlefield surveillance radar IT information technology C4ISR command control communications computers intelligence surveillance and reconnaissance LO S lasers optics and sensors MCTL Militarily Critical Technologies List CI counterintelligence MO method of operation CPI critical program information M S modeling and simulation CV curriculum vitae NISPOM DoD Department of Defense National Industrial Security Program Operating Manual DRAM dynamic random-access memory PROM programmable read-only memory DSS Defense Security Service RAD-HARD radiation-hardened ERC End-User Review Committee R D research and development FAVA-RE failure and vulnerability analysis and reverse-engineering RFI request for information SCR suspicious contact report FIE foreign intelligence entity SEE single-event effect FY fiscal year SNA suspicious network activity GSR ground surveillance radar SRAM static random-access memory IC Intelligence Community TAA trade assistance agreement IO intelligence officer UAS unmanned aerial system IS information systems UAV unmanned aerial vehicle ISR intelligence surveillance and reconnaissance 70 TA R G E T I N G U S T E C H N O L O G I E S 2 0 1 2 AFRICA EAST ASIA AND THE PACIFIC EUROPE AND EURASIA NEAR EAST SOUTH AND CENTRAL ASIA WESTERN HEMISPHERE Angola Australia Albania Algeria Afghanistan Antigua and Barbuda Benin Brunei Andorra Bahrain Bangladesh Argentina Botswana Burma Armenia Egypt Bhutan Aruba Burkina Faso Cambodia Austria Iran India Bahamas The Barbados Burundi China Azerbaijan Iraq Kazakhstan Cameroon Fiji Belarus Israel Kyrgyz Republic Belize Cape Verde Indonesia Belgium Jordan Maldives Bermuda Central African Republic Japan Bosnia and Herzegovina Kuwait Nepal Bolivia Chad Kiribati Bulgaria Lebanon Pakistan Brazil Comoros Korea North Croatia Libya Sri Lanka Canada Congo Democratic Republic of the Korea South Cyprus Morocco Tajikistan Cayman Islands Congo Republic of the Laos Czech Republic Oman Turkmenistan Chile Cote d’Ivoire Malaysia Denmark Palestinian Territories Uzbekistan Colombia Djibouti Marshall Islands Estonia Qatar Equatorial Guinea Micronesia European Union Saudi Arabia Costa Rica Cuba Eritrea Mongolia Finland Syria Dominica Dominican Republic Ethiopia Nauru France Tunisia Gabon New Zealand Georgia United Arab Emirates Ecuador Gambia The Palau Germany Yemen El Salvador Ghana Papua New Guinea Greece Grenada Guinea Philippines Greenland Guatemala Guinea-Bissau Samoa Holy See Guyana Kenya Singapore Hungary Haiti Lesotho Solomon Islands Iceland Honduras Jamaica Liberia Taiwan Ireland Madagascar Thailand Italy Mexico Malawi Timor-Leste Kosovo Netherlands Antilles Nicaragua Mali Tonga Latvia Mauritania Tuvalu Liechtenstein Panama Mauritius Vanuatu Lithuania Paraguay Mozambique Vietnam Luxembourg Peru Macedonia St Kitts and Nevis Namibia Niger Malta St Lucia Nigeria Moldova St Vincent and the Grenadines Rwanda Monaco Suriname Sao Tome and Principe Montenegro Trinidad and Tobago United States Senegal Netherlands Seychelles Norway Uruguay Sierra Leone Poland Venezuela Somalia Portugal South Africa Romania Sudan Russia Swaziland San Marino Tanzania Serbia Togo Slovakia Uganda Slovenia Zambia Spain Zimbabwe Sweden Switzerland Turkey Ukraine United Kingdom 71 REFERENCES 1 Source redacted Available upon request from DSS 2 BBN Technologies Internet Security Glossary May 2000 Accessed on June 6 2012 tools ietf org html rfc2828 3 U S Attorney’s Office Eastern District of Virginia September 20 2011 press release Chinese Nationals Sentenced to 24 Months for Illegally Attempting to Export Radiation-Hardened Microchips to PRC http www justice gov usao vae news 2011 09 20110930chinese nr html News Unclassified 4 Open source website History Learning Site Battle of Somme http historylearningsite co uk somme htm Background UNCLASSIFIED 5 Open source website Public Broadcasting Service Who Made America – Samuel Slater http www pbs org wgbh theymadeamerica whomade slater_hi html Background UNCLASSIFIED 72 TA R G E T I N G U S T E C H N O L O G I E S 2 0 1 2