Printer Friendly

Developing a counterintelligence mind-set.

MODERN CORPORATIONS ARE becoming eager consumers of business intelligence. A majority of Fortune 500 companies now have full-time staff assigned to developing intelligence on their competitors. Companies lacking either the funds or the inclination for an in-house staff can call on one of the growing number of business intelligence consultants to do the job for them.

The number of new business intelligence books has grown substantially in recent years as has the number of journal and magazine articles devoted to this subject. One example is the journal published by the Society of Competitor Intelligence Professionals. Its first issue was a simple, four-page leaflet. One of its most recent issues was more than 15 pages long.

Intelligence collection is a fact of modern business life. Collection efforts pose a substantial risk to a company's operations despite the fact that they are legal and center mainly on open sources.

Used effectively, intelligence methods can expose confidential strategies, identify important process changes, or provide a clearer picture of proprietary technologies. For the target company, this might translate into lost lead time, lower market share, and lower revenues.

That is the bad news. The good news is that it is possible for a company to counter collection efforts effectively. Doing so requires a company to develop a mind-set that understands the nature of business intelligence activities, know common collection targets, recognize business intelligence strategies and tactics, and be ready to respond when the collector calls.

WHILE THE TERM INTELLIGENCE conjures up a number of shadowy images, it is more realistic to view it as a systematic search for valid, relevant information bearing on a particular problem or question. An executive at 3M Company puts it more succinctly by stating the intelligence is "value-added information."

What gives intelligence its added value of the process by which raw information becomes hard intelligence. The process begins when a decision maker asks a question. Those changed with finding the answer must decide what information they will need and where they will get it. After they obtain the information they must evaluate it to determine whether it is reliable and valid.

The next step is to collate all newly gathered data will any previously held information in preparation for analysis. In this critical stage all relevant data is weighed, sifted, and tested to determine what is true and significant, what is true but insignificant, and what is false. To interpret the data that survives this phase, the information gatherer must ask the following question: What does this mean to the question or decision under consideration?

The final step in the process is disseminating the finished product to the decision maker, who must decide what action to take in light of intelligence findings.

Companies have traditionally collected information for reasons such as market research, industry analysis, or more recently, benchmarking. While these efforts are systematic, they differ from the kind of collection represented in the intelligence process.

Traditional efforts are broad and focus on whole market segments or industries. By contrast, intelligence collection is narrow, usually focusing on individual companies. In addition, intelligence efforts tend to center on specific questions regarding target companies.

For instance, a collection effort on a manufacturing organization may center on its processes and product formulations. Another effort may examine the management structure of a target company to identify key executives or track personnel deployment. Still another approach might be to uncover an overall marketing strategy by analyzing a target's pricing practices, distribution channels, and sales force deployment.

A collection effort may focus on these target areas as a means to answering larger intelligence questions, such as the nature of a competitor's plans and intentions, new product introduction plans, process innovations, or strengths and weaknesses.

Aside from having information of value, a company may be a target simply because of the industry in which it participates. Industries that are fast-paced, highly dependent on research and development, and highly innovative are likely to be the target of more collection efforts, because companies are likely to think they must closely track competitors to keep from falling behind.

Even more mature industries not normally known for innovation may experience an upswing in collection efforts if the competitive balance shifts for someone reason. Examples may be the emergence of a new competitor, the development of a new process that will dramatically cut costs, or a sudden grab for market share by an old-line competitor.

While no one can predict whether a company will become a collection target, several indicators may warn a company to keep up its guard. For instance, industry leaders are sure to have other companies curious about how they manage to stay ahead. Corporations that take actions that impact whole industries, that perform better than any other, or that know technologies or information that no other corporation know are certain to have their share of interested observers.

The primary task in any intelligence effort is to map out what information is needed and where to get it. A collector must ask the questions, Who knows what I want to know? Where is this information located? In what form is it?

Depending on the answers, collection efforts may either be passive, such as literature searches and observations, or involve direct contact with an manipulation of data holders.

Literature searches involve examining regulatory filings under the Freedom of Information Act, reviewing court records, reviewing publications, and searching data bases. However, in most cases literature searches are only a preliminary step and serve mainly to direct collectors to human sources. The best source of information invariably tends to be an employee who works in the target area.

Several ways are available to identify human sources. One well-known consultant has observed that wherever money changes hands, so does information. He looks for firms that either pay or receive money from his target and zeroes in on them for up-to-date information.

Another well-known consultant advises collectors to find a smaller company that is dependent on the large target for its existence. Because this firm's survival depends on how much it knows about the target it could be a fruitful source of information. This same consultant also counsels collectors to break up each large question into a number of small, innocuous questions that will not raise any suspicions.

When contacting human sources, collectors count on the fact that most people do not know any better than to discuss sensitive matters with unknown parties. People who work with sensitive information daily may forget that the rest of the world does not know what they know. They may also be unaware that information is an asset with real value and can harm a business if misused. Finally, collectors know that people can fall prey to friendly voices and cleverly applied flattery.

Once a human target has been identified, collectors will use a variety of tactics. The safest is to tell the truth about who they are but with proper shading.

For instance, information collectors may call and say they represent XYZ Research and request information for a "process survey." Up to that point they have been truthful but not entirely. What they omitted was that the company itself was the focus of the survey, and that it was commissioned by the company's chief competitor.

Collectors may resort to pretexts, posing as journalists, regulatory officials, students, and even executives from target companies. No matter what approach they use, collectors will portray unshakable confidence, enviable persistence, and a high level of craft.

The discussion to this point has examined the nature of intelligence and the targets and tactics of business intelligence practitioners. It it is evident that these efforts are effective and can damage the operations of target companies, it begs the question of whether it is possible to stop them.

In two words, it's not. A corporation today sometimes has to release sensitive information to comply with federal and state regulations. These filings are open to the public with few limitations, and business intelligence collectors are adept at locating and exploiting them. They also glean useful information from media releases, publicity, and executive speeches that provide insights into corporate operations.

None of this is illegal, and as long as collectors focus on open source material no one can do anything to stop them from gathering it.

IT IS POSSIBLE TO REDUCE THE SUCCESS ratio of business intelligence collectors. Doing so requires developing a mind-set throughout a company that asks what competitors want to know, how they might try to get it, and what steps will reduce their chances of getting it.

The first step has been stated before, but it bears repeating. Employee awareness is the key to preventing information loss. Employees must understand that information has value and that they have an obligation to protect it. But in the case of competitor intelligence, awareness must go a step further and give employees the tools not only to recognize collection attempts but also to know how to counter them effectively.

Employees should know that their contact with a collector may begin as an innocent-sounding phone call from someone asking for information about the company. Callers may make only vague references to who they are and why they want the information.

Employees should also be instructed never to give information over the phone to anyone they do not know. If they receive such a request, they should obtain a phone number and attempt to verify the caller's identity. Employees should never transfer these callers, as this provides more access to potential sources.

The next important counterintelligence step is to control information releases. It is safe to assume competitors will read whatever a target company releases. Appropriate managers should review and approve copy for internal publications, especially when copy deals with sensitive subjects. All media releasing should go through the public relations department to ensure they do not disclose information on sensitive subjects.

If information changes hands along with money, then it stands to reason that the counterintelligence mind-set should carry over into business relationships. Personnel dealing with vendors should remember that these firms sell to other companies. This makes it prudent to limit disclosures to what vendors must know to meet present needs. Similarly, while customers need to now how a product works, they don't need detailed information about how the manufacturer go it to work.

Companies involved in partnerships should bear in mind that these arrangements are not mergers. Participants should be counseled to reveal only enough to abide by any agreements and avoid giving away vital information that will go with the partner when the arrangement ends.

The final step toward developing a counterintelligence mind-set is to be ready to respond when collectors call. Indications that a company is under study may start with a company learning that its filings have been requested from various regulatory agencies. This may be accompanied by reports of suspicious phone calls going to different departments of the company. Business contacts may also advise that people have been asking about the company.

When this occurs, the first and most important step is to advise company employees of the situation. They should have details of names used, questions asked, and any other tactics identified. Someone should be designated to receive inquiries, and all suspicious phone calls should go to this person.

Phone calls and other incidents should be logged to track the date, time, and place of occurrence. The log should also note the collector's name and the specific questions asked. If it appears that inquiries focus on a particular issue or aspect of the company, personnel working in that department should be briefed. Corporate legal Counsel should be apprised of the situation, especially where anything arises that may violate the law.

Although intelligence collection is legal and focuses mainly on open sources, failing to address this issue can bring harm to a company's strategic direction, market share, or revenue growth. This discussion has treated the various aspects of business intelligence activities in order to lay a foundation for countering these efforts.

It is possible to reduce the effectiveness of intelligence collectors. However, this will come through using any one countermeasure or security system. Rather, it will require that a company know its competitors, understand its competitors' targets, recognize collection techniques, and respond to them effectively. Larry Pavlicek is a security specialist at 3M Company in St. Paul, MN. He is member of the ASIS Standing Committee on Safeguarding Proprietary Information.
COPYRIGHT 1992 American Society for Industrial Security
No portion of this article can be reproduced without the express written permission from the copyright holder.
Copyright 1992 Gale, Cengage Learning. All rights reserved.

Article Details
Printer friendly Cite/link Email Feedback
Title Annotation:Information Security
Author:Pavlicek, Larry
Publication:Security Management
Date:Apr 1, 1992
Previous Article:Extra eyes and ears.
Next Article:Computing a successful system.

Related Articles
Is the secret out?
FBI program expands.
The spy who came to work.
Stephen H. Rhinesmith, Ph.D Partner, CDR International.
Police detectives in history, 1750-1950.
Meeting consumer demand.
Future trends and mindsets: John Naisbitt is often called the global philosopher among futurists. In his latest book he introduces 11 frameworks he...

Terms of use | Copyright © 2017 Farlex, Inc. | Feedback | For webmasters