Trending: Defense firms form counterintelligence units

The U.S. defense industry is increasingly turning to its own corporate counterintelligence units to uncover and prevent foreign espionage campaigns targeting sensitive military data and technologies.

The Defense Security Service, which is responsible for overseeing and protecting classified information in the hands of cleared industry contractors, receives tens of thousands of suspicious contact reports every year. But those reports are declining in number and in their counterintelligence value, according to DSS. Since 2009, the proportion of cleared industry suspicious contact reporting has fluctuated between 15 and 22 percent. The most recent data, however, shows that only 6 percent of cleared industry provides reports with counterintelligence value.

But DSS has fostered a close working relationship with many of the biggest contractors in the defense industry in an effort to improve reporting. And one of the side effects of that improved cooperation seems to be a recognition by industry that internal counterintelligence programs are not only important to their government business but are critical to fighting the onslaught of foreign intelligence efforts seeking to steal U.S. trade secrets.

“I see more and more big industry is actually standing up counterintelligence components,” said Rich Naylor, senior cyber advisor at DSS. According to Naylor, who spoke May 12 at the BDNA IT Security Crisis conference in Washington, D.C., at least a dozen of the largest U.S. defense contractors now have some sort of formal counterintelligence organization in place.

DSS counterintelligence operations received 34,213 suspicious contact reports from industry and identified 989 possible collectors for investigation last year — a substantial increase over the 717 identified in fiscal year 2013, according to Naylor. Based on these numbers, DSS estimates there are 1,400 known or suspected collectors exploiting their access and 11,000 vulnerabilities annually.

Cyberspace is playing an increasingly important role in uncovering foreign spies targeting defense contractors. But understanding the cyber component of those suspicious contacts remains a difficult challenge, Naylor said.

“Every [chief information security officer] . . . is essentially part of a sensor array that is informing law enforcement and informing counterintelligence and that is defeating spooks,” he said. But the importance of the cyber aspects to the counterintelligence challenge doesn’t come through clearly just by looking at the statistics.

Out of the thousands of suspicious contacts investigated last year, only 14 percent of activity directed at cleared contractors occurred purely in the cyber domain, said Naylor. “Yet 70 percent had some blended aspect … it could be something as simple as beginning via email contact or social media contact and then the heavy effort is on the human side,” he said. The cyber activity foreign intelligence agencies carryout is often a precursor to human contact or an effort to confirm information obtained through human contact, Naylor said.

The size and scope of the counterintelligence challenge for the defense industry is startling. According to the latest DSS biennial report to Congress, there are approximately 940,000 contractors who hold clearance eligibility and 13,114 facilities cleared under the National Industrial Security Program. In addition, there are 701 cleared facilities with current precautions in place specifically designed for companies under foreign ownership or influence.

Defense Security Service counterintelligence statistics. (Defense Security Service)

Lockheed Martin stood up its own counterintelligence operations in 2011 in response to the increase in foreign intelligence targeting of corporate America.

“We recognized early on that cases of economic and industrial espionage and theft of trade secrets were growing at concerning rates, and that directly impacted the economic stability and security of our nation,” said Douglas Thomas, director of counterintelligence operations and corporate investigations.

FedScoop reached out to several leading defense contractors, but only Lockheed agreed to describe their counterintelligence program.

Lockheed Martin’s counterintelligence effort has grown significantly since 2011. “We now have a full staff of professionals with extensive backgrounds in national security, counterintelligence, and law enforcement, providing dedicated counterintelligence support across the corporate enterprise, including representation at each of the company business areas,” Thomas said. “We also work closely with our information security, human resources, legal and ethics teams to ensure that our counterintelligence program adheres to Lockheed Martin’s core principles.”