TSCM - Technical Surveillance Counter Measures

Technical Surveillance Countermeasures (TSCM), is the Government and Military term that refers to; techniques and measures to detect, neutralize, and/or exploit a wide variety of hostile and foreign penetration technologies and tactics that are used to obtain unauthorized access to your sensitive information. Many times, these same collection tactics are used against corporations and business entities to gain access to trade secrets, IP, contacts, etc.

ComSec’s Expert TSCM services are tailored to combat these collection attempts based on the level of threat and potential vulnerabilities. ComSec’s TSCM services are categorized as “recurring” or “special.” Recurring TSCM services are conducted on a schedule that provides the highest protection standards for highly sensitive information. Special TSCM services are conducted on a non-recurring basis or for a unique reason. The following TSCM services below are available to your organization through ComSec:

A1. TSCM Survey–A TSCM Survey, which includes anomaly resolution and penetration investigations, is the most comprehensive of the TSCM services offered. The TSCM Survey includes thorough instrumented, physical and visual examinations by the ComSec TSCM Team to identify the presence of technical surveillance devices, technical security hazards, weaknesses, and physical security weaknesses, used to exploit your corporation, executive residence, yacht, aircraft, etc.

A2. TSCM Inspection–A TSCM Inspection is a limited “sweep” to address specific concerns. A TSCM inspection evaluates the changes to the operating environment and ensures that no vulnerabilities were created as a result of modifications to the area of concern. Inspections also are required to assess the technical integrity of furnishings, electronic equipment, proposed or completed construction, gifts or installation of items not previously examined by the ComSec TSCM Team.

A3. TSCM In-Conference Monitoring–A TSCM In-Conference Monitoring is a limited service, normally provided in conjunction with sensitive briefings, conferences, corporate board meetings, and seminars. This is primarily a limited inspection of the technical attributes of the facility, boardroom, yacht, aircraft etc., before, during, and as necessary, after the activity/meeting has been concluded.

A4. TSCM Advice and Assistance–TSCM Advice and Assistance is a service conducted before and/or during construction or renovation of a new or existing area to ensure that appropriate physical and technical security standards or vulnerabilities are addressed prior to procurement to avoid costly modifications. This service is also appropriate prior to the purchase, replacement, installation and going “live” with electronic systems i.e. Video Teleconferencing Systems, Telephone Systems, etc.

A5. Special TSCM Services–These TSCM services occur on an infrequent basis or are required in order to meet unforeseen circumstances or protection needs in accordance with conditions of local threat or vulnerabilities, and are usually event driven.

Mr Big’ of UK cyber-crime among gang of eight arrested over £1.3million Barclays computer hijack plot in carbon copy of Santander scam

Fake computer engineer sent into Swiss Cottage branch to install ‘bug’

The device transmits what’s on a computer desktop to a remote viewer

‘One is a significant arrest. He is the Mr Big of UK cyber crime,’ Met says

Another gang tried same audacious heist on Santander branch last week

The suspected ringleader and seven members of a gang behind a £1.3million cyber raid on a leading bank were arrested yesterday. Scotland Yard detectives say the 47-year-old Mr Big led the operation that siphoned off cash from the accounts of Barclays customers. One of the gang posed as an IT engineer at the bank’s branch in Swiss Cottage, north London, to install a device that hacked into its computer systems. The Met Police has said a device similar to this was used by criminals, which when plugged into a computer transmits screen contents to a remote PC But staff spotted the fraud and tipped off police. Following a lengthy surveillance operation, the trail led to a flat in nearby Marylebone, which was crammed with hi-tech equipment. Eight men, including Chinese and Romanians, were in custody last night. Thousands of credit cards and financial records were seized at addresses across the capital. The gang is thought to be linked to the criminals behind last week’s raid on a London branch of Santander using an identical spying device.Detective Superintendent Terry Wilson, who is a specialist in electronic crime, said: ‘This was a highly-organised criminal network with each individual filling a specific role.

There is a common misconception about corporate espionage: many view the practice as a concern for only businesses with sensitive, government-related intelligence dealings. But this could not be further from the truth.

Small businesses, large corporations and even some individuals are victims to such stealthy acquisition of information. It is projected that American companies as a whole lose anywhere from billion to 0 billion annually due to corporate espionage. This loss is extreme, but easily preventable. A general lack of acknowledgement coupled with small oversights leads to the all-too-easy theft of critical information. Corporate espionage is rarely publicized when it occurs, but that doesn’t mean it’s nonexistent.

Below are five of the biggest instances of corporate espionage that may have you re-thinking how your business operates:

Proctor & Gamble vs. Unilever: This 2001 incident occurred when P&G stole information from their competitor, Unilever. They did this by going through trash searching for documents, and there have been allegations that they sent in employees posing as market analysts. These allegations have been denied by P&G, but still serve to emphasize the ease of trade secret theft. Being aware of threats such as this, as well as making sure that employees are informed and well-versed in potential security threats is an integral part of successfully maintaining a business.

Starwood vs. Hilton: In 2009, a different aspect of corporate espionage was exploited when Hilton employed 10 executives and managers that had been previously employed at Starwood. Accusations were made that these employees left Starwood for the better-known Hilton, bringing numerous confidential documents and plans regarding Starwood’s luxury brand ideas. A settlement was reached in 2010 that required Hilton to make payments to Starwood, as well as abstain from creating a competing luxury hotel brand until 2013.

Eastman Kodak Corporation vs. Harold C. Worden: In this corporate espionage scheme, Harold C. Worden took 30 years of knowledge and experience from his time at Eastman Kodak after he retired and set up a consulting firm. Utilizing the skills of over 60 other retired former employees, Worden’s firm used information from several thousand confidential documents as well as information about a film machine that was in production by Kodak at the time. The Economic Espionage Act of 1996 protects trade secrets of corporations, but only if the information was obtained illegally (or if a nondisclosure document was signed). It’s important for business owners to understand these practices so that the appropriate measures may be taken if espionage is encountered.

Microsoft vs. Oracle: In these allegations of corporate espionage, the head of Oracle, Larry Ellison, utilized covert methods to monitor Bill Gates and activities at Microsoft. Ellison is alleged to have made over 2000 attempts to steal information, from using a private detective to bribing cleaning staff. Ellison made efforts to steal classified documents, as well as expose Microsoft’s funding of various public interest groups. Regardless of the level of income your business earns, you may always encounter competitive forces bidding for your failure. This is why it’s vital to ensure your protection against vulnerabilities that can be exploited by the competition.

DuPont vs. Michael Mitchell: This example of corporate espionage began in 2006, when Michael Mitchell was terminated from the marketing and sales department of Kevlar for DuPont. His subsequent actions included contacting Kolon Industries Inc, a top competitor in the industry from Korea, and offering them his services. He provided Kolon with classified knowledge he had garnered during his time at Kevlar, then went and contacted his former colleagues for further information. His plan was foiled, however, when executives at DuPont became aware of his scheme. Keeping employees informed of what they can and cannot disclose is always vital, and getting an agreement in writing is even wiser.

As you can see from these examples, corporate espionage is a very real aspect of business. Since corporations do their best to downplay their various scandals, this issue doesn’t receive the amount of attention and concern it deserves. The experts at ComSec, on the other hand, have a wealth of knowledge regarding past incidents and will utilize this information to help you secure your information against those that would exploit it. Make sure that your business is properly secure, or you may be leaving yourself open to vulnerabilities.