Theft and "Dumpster Diving"
This discussion of theft focuses on theft by outsiders, not by insiders, although such theft may be aided by information provided by an insider. Principal targets for theft are laptop computers (stolen for the information on them as well as for the value of the computer), sensitive papers taken from waste baskets, trash containers or dumpsters (often called "dumpster diving"), and sensitive equipment (stolen or diverted briefly so that it may be copied),
Laptop computers are a prime target for theft from your office, your home, or at airports, hotels, railroad terminals and on trains while you are traveling. They are an extremely attractive target for all types of thieves, as they are small, can be carried away without attracting attention, and are easily sold for a good price. They are also a favorite target for intelligence collectors, as they concentrate so much valuable information in one accessible place.
Safeware, the largest insurer of personal computers in the United States, paid claims for the theft of 319,000 laptop computers during 1999.1 Of course, most laptops are not insured, so this is only a small fraction of the total number of laptop computers that were stolen during that year.
See Security of Laptops in the Computer Vulnerabilities module for a complete discussion of laptop security, including measures you can take to protect your laptop from theft and to protect the information on your laptop from authorized access.
The risk of having your laptop stolen is especially high while you are traveling. Two incidents at separate European airports demonstrate the modus operandi of thieves operating in pairs to target laptop computers:
All travelers, both domestic and international, should be alert to any sudden diversions when traveling, especially when transiting transportation terminals. If victimized, travelers should report the thefts immediately to the authorities and be able to provide the make, model information, and serial number of their laptop computer or any other item of value. 2
There is an old saying that "one man's trash is another man's treasure." That is certainly true in the intelligence world.
In 1991 a guard observing the home of a senior executive of a defense contractor in Houston, Texas, observed two men in an unmarked van take trash bags that had been put out for routine trash collection. The guard obtained the van's license number and later identified one of the men as the consul general from a friendly Western European country that collects economic intelligence in the United States. When confronted, the consul general claimed that he and an assistant were simply trying to collect bags of grass cuttings for filler -- to fill a hole dug at the consulate compound for a swimming pool that could not be completed because of a zoning dispute.
Stealing trash is not illegal. The Supreme Court ruled in 1988 that once an item is left for trash pickup, there is no expectation of privacy or continued ownership.
Strict procedures govern the disposal of classified information. For disposal of sensitive unclassified waste, however, each government office or private company sets its own regulations. These procedures depend upon the sensitivity of the information and the likelihood that a foreign group or domestic interest may want to obtain that information. If unclassified documents need to be destroyed prior to disposal, a commercially available cross-cut shredder should be used. A cross-cut shredder cuts the paper both vertically and horizontally. Destruction should not be entrusted to paper recycling vendors.
Sensitive equipment may be stolen so that it can be copied through reverse engineering. For some purposes, it may be sufficient to only gain access to the equipment for a brief period.
Lesson learned: The company did not really need to take the entire radar assembly to the air show. A mock-up without the internal mechanisms could have been set up along with photographs of the internal components.3