Control Engineering

Peter Welander

Cyber security from within
December 4, 2007

If you've looked at the Cyber Security Supplement with our November issue, I wrote an article on the topic of the human side, and how real security depends both on technical solutions and training people.

If I were writing the article again, I might add this example: Information Week has watched the story of a DuPont scientist who was systematically removing technical information to take with him to a new job at a competitor. In November, Gary Min was sentenced to 18 months in prison and a combined $44,500 in fines and restitution to Dupont, after he had downloaded 22,000 abstracts and 16,000 full-text documents from DuPont's Electronic Data Library. After beginning work for Victrex (a competitor of DuPont's) in January 2006, Min transferred 180 of those documents to his new company computer, but the FBI was already on his trail. The investigation was in process when Min left DuPont and agents pursued him to his new job. Once Victrex understood the situation, company officials turned the computer over to the FBI.

There was one very critical quote from the article worth repeating: "Stacey J. Mobley, senior VP and general counsel at DuPont, in a statement on Tuesday expressed support for the sentence. 'As a science company, DuPont takes aggressive measures to protect its unique and confidential technologies,' she said. 'Although we are troubled that Mr. Min violated the trust placed in him, the criminal and civil actions brought against him demonstrate the actions that we will take to preserve the integrity of our proprietary science and technology for the benefit of DuPont shareholders and customers. Judge Robinson underscored the importance of those actions by sentencing Mr. Min to federal prison and sent a clear signal to others who might consider committing similar crimes.'"

Tomorrow at 11:00 am EST, Control Engineering is offering a Webcast on the topic of cyber security, and one of the panelists is Thomas Good of DuPont. While he doesn't address this case specifically, he does discuss the processes of involving people in the larger security issue. Join us tomorrow, or listen on-demand once the Webcast is posted on our Website.

Posted by Peter Welander on December 4, 2007 | Comments (0)