Economic Cyber Espionage and International Law: Controversies Involving Government Acquisition of Trade Secrets through Cyber Technologies

Introduction

In late February 2013, a controversy erupted after a U.S. cybersecurity company released a report alleging that the Chinese military was using cyber technologies to obtain trade secrets from foreign companies.[1] The Chinese government rejected the allegations, but the report resonated with U.S. concerns about Chinese economic cyber espionage. After the report's release, the Obama administration issued a new strategy to counter theft of trade secrets from U.S. companies.[2] This Insight examines the international legal issues this controversy about economic cyber espionage raises.

Economic Espionage and Cybersecurity

Espionage comes in different forms. Traditional espionage encompasses a government's efforts to acquire clandestinely classified or otherwise protected information from a foreign government. Economic espionage involves a state's attempts to acquire covertly trade secrets held by foreign private enterprises. “Corporate espionage" or "industrial espionage" describes a company's illegal acquisition of another company's trade secrets with no government involvement. Many countries have long considered economic espionage important to national security and economic development.

States engaged in economic espionage prior to the use of cyber technologies. The United States adopted the Economic Espionage Act (EEA) in 1996, before the Internet became a global means of communication. As societies became dependent on cyber technologies, experts identified economic cyber espionage as a growing threat. U.S. cybersecurity policy included economic espionage as a problem.[3] However, economic cyber espionage continued to metastasize, with U.S. leaders arguing that it was contributing to the "greatest transfer of wealth in history."[4]

U.S. officials and cybersecurity experts have accused China of engaging in economic cyber espionage. In October 2011, the Office of the National Counterintelligence Executive (ONCIX) labeled China a "persistent collector" of U.S. economic secrets accomplished through cyber means.[5] However, attributing cyber intrusions to the Chinese government has proved difficult. The ONCIX admitted that "the [Intelligence Community] has not been able to attribute many of these private sector data breaches to a state sponsor."[6]

In late January 2013, the New York Times reported it had been hacked from China, and allegations followed that other newspapers had similarly been hacked.[7] On February 10, 2013, a National Intelligence Estimate “concluded that the United States is the target of a . . . cyber-espionage campaign that is threatening the country’s economic competitiveness,” with China identified “as the country most aggressively seeking to penetrate the computer systems of American businesses and institutions to gain access to data that could be used for economic gain.”[8]

On February 19, 2013, Mandiant, a cybersecurity company, released a report in which it claimed to have evidence linking Unit 61398 of the People's Liberation Army in Shanghai to a global cyber espionage campaign against nearly 150 companies from 20 economic sectors "designed to steal large volumes of valuable intellectual property."[9] Mandiant's report garnered widespread press coverage, prompted angry responses from China, and catalyzed the Obama administration's release of a new strategy to combat theft of U.S. trade secrets on February 20, 2013.

International Law and Economic Cyber Espionage

International Law, Espionage, and Economic Espionage

The desire to combat economic cyber espionage confronts a lack of international law on espionage and economic espionage. Although a victim country could assert that spying violates the principles of sovereignty and non-intervention, state practice has accepted state-sponsored espionage such that these appeals are not serious claims. Although cyber espionage is sometimes described as "cyber attacks" and "cyberwar," no government regards cyber espionage of any kind as a prohibited use of force. Other bodies of international law under which espionage issues arise, such as rules on armed conflict and on diplomatic relations in peacetime, do not prohibit or seriously constrain espionage or economic espionage.[10]

Thus, participation in, and tolerance of, spying indicates that espionage and economic espionage do not constitute wrongful acts triggering state responsibility under international law. Persons caught and accused of being spies can be punished, but international law contains protections for spies captured during armed conflict or covered by diplomatic immunity. The United States could not prosecute a Chinese diplomat caught engaging in economic cyber espionage unless China waived the immunity and, absent a waiver, could only declare the Chinese national persona non grata, triggering that person's return to China.[11]

International Law, Criminal Law Enforcement Cooperation, and Economic Espionage  

Many countries prohibit economic espionage under national law. However, enforcement confronts difficulties because the offense’s elements include foreign government participation. Using extradition or mutual legal assistance treaties proves ineffective when the requested state is accused of sponsoring criminal acts.[12] The U.S.-China mutual legal assistance treaty[13]

is unlikely to be helpful to U.S. efforts to apply the EEA to perpetrators of economic cyber espionage linked to the Chinese government.

International Law, Protection of Intellectual Property and Trade Secrets, and Economic Espionage

Some experts have argued that the United States should use international trade law's protections for intellectual property against countries engaged in economic cyber espionage.[14] In trade and investment agreements, states have used international law to protect intellectual property rights of private-sector enterprises. The Agreement on Trade-Related Aspects of Intellectual Property Rights (TRIPS) of the World Trade Organization (WTO) requires each WTO member to protect certain types of intellectual property rights, including trade secrets, within its territory.[15]

However, WTO members have, to date, shown no interest in addressing economic espionage within the WTO despite mounting worries about this practice.  

One reason why WTO members have not used the WTO is the difficulty of formulating claims that economic espionage violates WTO agreements. WTO rules create obligations for WTO members to fulfill within their territories and do not generally impose duties that apply outside those limits. WTO members that covertly obtain intellectual property of nationals of other WTO members operating in their territories could violate WTO obligations to protect such property. However, the economic espionage of greatest concern—and especially acts of remotely conducted economic cyber espionage—involves governments obtaining information from private-sector companies located outside their territories.

Even if a WTO member could construct a claim that economic cyber espionage violates a WTO rule, it would have to establish that another WTO member's government is responsible for the infringing acts. Usually, establishing governmental responsibility for challenged acts is not difficult, but WTO cases have not involved accusations against government-sponsored espionage. It is not clear that a WTO member could satisfy this burden by relying on evidence from private-sector entities (e.g., Mandiant's report) and without revealing counter-intelligence means and methods.

Another strategy proposed by experts is for the United States to impose trade sanctions on countries engaged in economic cyber espionage and justify the sanctions under national security exceptions in WTO agreements.[16] This approach admits that unilateral trade sanctions would violate WTO obligations and require an exception to justify them. Whether a WTO member’s invocation of a national security exception could be successfully challenged remains controversial.

Other proposals focus on U.S. law rather than international law. For example, experts have argued that the United States should (1) impose sanctions on foreign nationals and companies that engage in, or benefit from, economic espionage, and (2) permit civil claims in U.S. courts against foreign governments that steal U.S. trade secrets under the Foreign Sovereign Immunities Act.[17] These proposals borrow from other contexts, such as countering terrorism and transnational crime.[18]

The Obama Administration's New Strategy

Arguing that trade secret theft threatens U.S. national security, the Obama administration's strategy contains five strategic actions:

• Focus diplomatic efforts to protect trade secrets overseas;
• Promote voluntary best practices by private industry to protect trade secrets;
• Enhance domestic law enforcement operations;
• Improve domestic legislation; and
• Public awareness and stakeholder outreach.

Although the administration considers trade secret theft a serious matter, its strategy does not assert that economic espionage violates international law. Nor does it contain a blueprint for international legal changes that would directly address economic cyber espionage. The strategy seeks "improved legal frameworks, stronger enforcement of existing laws and strong and efficient remedies for trade secret owners,"[19] but its focus is at the national level, as evidenced by the domestic-centric content of four of the action items.

Internationally, the strategy aims to raise trade secret protection as a priority in diplomatic processes and legal agreements. The administration will use "formal cooperative agreements or arrangements with foreign governments" in investigations that require law enforcement cooperation (e.g., mutual legal assistance treaties; INTERPOL).[20] The U.S. government will also emphasize trade secret protection in trade and intellectual property forums, including the TRIPS Council at the WTO and the Asia-Pacific Economic Cooperation process.[21]

More specifically on trade, the strategy includes using "trade policy tools to increase international enforcement against trade secret theft to minimize unfair competition against U.S. companies."[22] This approach will involve deeper cooperation with like-minded trading partners, seeking "new provisions on trade secret protections" in trade negotiations (e.g., the Trans Pacific Partnership Agreement), and using the Special 301 "priority watch list" process "to gather and . . . act upon information about the adequacy and effectiveness of trade secret protection by U.S. trading partners."[23]

None of the strategy's trade-related initiatives mention potential legal claims against other WTO members. Under WTO rules, any trade-restrictive measures imposed by the United States based on information gathered in the Special 301 process cannot be taken unilaterally and must be authorized by the WTO dispute settlement process—unless the United States relied on a national security exception to justify unilateral sanctions.

Conclusion

Through its strategy, the Obama administration seeks international change on attitudes about trade secret theft, including that undertaken through cyber technologies, and is putting increased pressure on China on this issue.[24] Whether the administration can achieve change and translate it into international law on economic cyber espionage remains to be seen, but obstacles exist.

Many countries, including China, do not consider economic espionage different from traditional espionage and will not cooperate when they perceive the United States to be a pervasive practitioner of cyber espionage. In addition, focusing on national criminal laws and law enforcement cooperation appears ill-suited to economic cyber espionage, especially given the lack of international law regulating economic espionage, the ability to conduct economic espionage remotely, the way cyber technologies exacerbate the attribution problem, and the problems cooperation confronts when economic espionage is the crime in question.

The flare-up between the United States and China over economic cyber espionage also intensifies geo-political competition over cyberspace and cybersecurity. Chinese perspectives on the accusations leveled against China emphasize the extent of U.S. cyber espionage and Chinese perceptions of American attempts to impose its interests and values on other countries through political and military cyber dominance.[25] In this deteriorating climate, espionage of all kinds is only likely to increase in the foreseeable future.

About the Author:

David P. Fidler, an ASIL member, is the James Louis Calamaras Professor of Law at the Indiana University Maurer School of Law. He is also a Fellow at the Indiana University Center for Applied Cybersecurity Research.

Endnotes: