The Washington Post reported today that a confidential report from a Pentagon advisory group indicated that Chinese hackers had obtained sensitive military plans for a number of defense systems, including the Patriot Missile PAC-3, the F/A-18 fighter jet, the V-22 Osprey, the Black Hawk helicopter and the Navy’s new Littoral Combat Ship. The report did not specify whether these plans had been obtained by hackers from computers operated by the U.S. government or by the defense contractors involved.

So with this blockbuster revelation in hand, think for a moment about the ITAR-controlled technical data sitting on your computer system. You’ve gone to all the trouble to secure these files and prevent access by persons in your company who aren’t U.S. nationals. Then you’re hacked and this data is exfiltrated to China. What now?

Well, for starters, consider this: the definition of “export” in section 120.17 of the International Traffic in Arms regulations does not have a carve out for data hacked out of your system by foreign nationals. In fact, it covers “transferring technical data to a foreign person, whether in the United States or abroad,” without specifying how that transfer occurs. And make no mistake about it: when your system has been hacked by the People’s Liberation Army, it has transferred technical data to foreign nationals.

“But I didn’t mean for that data to be shipped to China!” you protest. Well, that may mean you lack the necessary scienter for a criminal prosecution, but civil penalties do not require intent. That also means it is probably time to think about a voluntary disclosure. And of course, one of the mitigating factors will be that you did not intentionally transfer the data to the PRC.

But here is the rub. Maybe you did not send the PLA an engraved invitation asking them to come hack your system, but maybe you also did not really have robust systems in place to prevent hacking. Often hackers get control of systems by sending infected links to employees. What protections do you have in place to prevent employees from clicking links in emails from outside the system? What systems do you have in place to monitor outbound traffic from your computers? And if you say, well, we have X or Y antivirus installed, you are going to hear the sad trombone because hackers can get around commercial antivirus software faster than Lindsey Lohan can sneak out of rehab.

Consider the Washington Post story a warning. It’s time to take a hard look at your security systems so that you either do not have to file a voluntary disclosure that you’ve been hacked or,  if you do have to make such a disclosure, you can honestly say you took every reasonable precaution.

Permalink