Co-opting Former Employees: Who Do They Work For?

Introduction

The Defense Security Service (DSS) has received several reports that highlight a modus operandi (MO) in which formerly cleared U.S. employees go to work for a foreign company or institute, where their work concerns a project or technology similar to what they were working on for a cleared U.S. company. They may be recruited for employment by a foreign national and may be expected to use their U.S. contacts to obtain additional information. These reports clearly indicate foreign entities are attempting to collect classified, sensitive, or proprietary information using this MO. Foreign entities may view former U.S. employees as excellent prospects for collection operations because they consider these former U.S. employees less likely to feel obligated to comply with U.S. Government or corporate security requirements once their U.S. employment has ended.

The Technique

As a variation of the modus operandi, the use of a visit by a formerly cleared U.S. employee is a good method to collect export-restricted and perhaps classified technical information from unwitting former coworkers. The export of defense articles and services (which includes both classified and unclassified technical data) is controlled under the International Traffic in Arms Regulations (ITAR). U.S. citizens, working for foreign companies or institutes, may wittingly or unwittingly take advantage of their former U.S. coworkers by incorrectly convincing them that "unclassified" technical discussions are appropriate or authorized.

Case Studies

Most countries, especially those that are our political and military allies, have active research and development programs for many of the 18 different technology categories listed on the Department of Defense Militarily Critical Technology List (MCTL). As such, some countries may also have an interest in acquiring this equipment or technology as previously described. The following two illustrations are classic examples of this MO:

  1. A formerly cleared U.S. citizen, who was an engineer specializing in a militarily critical technology related to sensors, resigned from a cleared U.S. company, moved to a foreign country, and began working for a foreign university on the same technology in an effort to obtain a foreign government research grant. While employed by this foreign institution, the engineer made arrangements to come back and visit the cleared company and former coworkers in the U.S. in an attempt to obtain specific information related to the militarily critical technology. The information was clearly covered under the ITAR as export-controlled. Fortunately, the employees of the U.S. company recognized the solicitation by the former coworker and U.S. citizen as a "foreign request for export-controlled information" and refused to discuss or release any information.
  2. In another incident, a cleared U.S. citizen who worked on a major U.S. defense program for approximately three years for a cleared U.S. company went to work for a company in a foreign country. The former employee returned to the U.S. and visited the cleared company and coworkers several times each year. Each time she visited, she would go to dinner with a group of coworkers prior to leaving the United States. Although the nature of these relationships may have been completely innocent, the foreign country where the former employee lives and works does not have an Industrial Security Agreement with the U.S. and has a history of technology diversions and exploiting Data Exchange Agreements (DEAs) to gain access to otherwise restricted technology and equipment. Because of these circumstances, related security countermeasures in place at the company were readdressed as appropriate.

Lessons Learned

Security professionals should ensure their company employees are educated to recognize the possible co-opting of a former employee. Indicators of such an MO include living in a foreign country; working for a foreign company; working on the same technology; and frequently returning to their company of previous employment. If an individual encounters a situation similar to those described above, he or she should report the incident to their supporting DSS Industrial Security Representative and local FBI. The lesson learned here is a cleared or formerly cleared U.S. citizen is not automatically entitled to classified or unclassified export-controlled information.

Public Release #981210-02