Methods of Stealing Information

Why This Topic Matters

Information is frequently a company's most valuable asset. Customer lists, pricing strategies, formulas, source code, research data, merger plans and manufacturing processes can be worth far more than the physical assets on the balance sheet. When this information is stolen, a company can lose its competitive advantage overnight, and the loss is often permanent because stolen information cannot be recovered in the way that stolen cash sometimes can.

For a Certified Fraud Examiner, understanding how information is stolen is essential for three reasons. First, you cannot investigate a theft of trade secrets or intellectual property unless you understand the avenues an intelligence gatherer or corporate spy would use. Second, you cannot design or evaluate preventive controls without knowing the attack methods. Third, the ACFE exam in the Investigation section (Theft of Data and Intellectual Property) tests this material directly, often through scenario questions where you must recognize the method being described.

What It Is: Defining the Landscape

The ACFE material distinguishes between competitive intelligence and corporate espionage. Competitive intelligence is the legal and ethical collection of publicly available information about competitors through open sources such as annual reports, press releases, trade publications, websites, court filings and patent applications. Corporate (or industrial) espionage is the use of illegal, unethical or clandestine methods to obtain confidential, proprietary or trade secret information. The line is crossed when the collector misrepresents identity, breaches a duty of confidentiality, trespasses, bribes, steals, or uses electronic intrusion.

Intelligence gatherers typically target departments that hold the richest information: research and development, marketing and sales, manufacturing and production, human resources and finance. Attackers also target the people who support those departments, such as administrative assistants, IT staff, cleaning crews and vendors, because they often have broad access with less scrutiny.

How It Works: The Major Methods of Stealing Information

1. Insider Theft and Recruitment of Insiders
The single greatest threat to proprietary information is the insider. Employees, former employees, contractors and temporary workers already have authorized access and knowledge of where valuable data resides. Insiders steal information because of financial pressure, revenge, ideology, ego, or because they are leaving to join a competitor or start their own business. Outside spies also deliberately recruit insiders. The classic recruitment cycle is spot, assess, develop, recruit: the spy identifies someone with access, evaluates vulnerabilities (debt, dissatisfaction, grievances), builds a relationship, and then makes the pitch using money, flattery, blackmail or appeals to loyalty. Common insider methods include emailing files to personal accounts, copying data to USB drives or cloud storage, photographing screens or documents, printing and removing hard copies, and simply memorizing information.

2. Social Engineering
Social engineering is the manipulation of people into revealing confidential information or performing actions that compromise security. It exploits human tendencies to be helpful, to trust authority and to avoid conflict. Key techniques include:
- Pretexting: inventing a plausible scenario or false identity (posing as an IT technician, auditor, vendor, new employee or executive) to obtain information.
- Phishing: fraudulent emails that appear legitimate and trick recipients into revealing credentials or clicking malicious links. Spear phishing targets specific individuals; whaling targets senior executives; vishing uses voice calls; smishing uses text messages.
- Baiting: leaving infected USB drives or offering free downloads to tempt a victim.
- Tailgating / Piggybacking: following an authorized person through a secured door.
- Shoulder surfing: observing someone entering passwords or reading screens and documents.
- Reverse social engineering: creating a problem, then posing as the person who can fix it so the victim voluntarily hands over access.
- Fake job interviews, survey calls, and posing as journalists, students or researchers to extract details from talkative employees.

3. Trash Scavenging (Dumpster Diving)
Searching through a target's discarded trash for memos, drafts, printouts, organizational charts, phone lists, sticky notes with passwords and discarded media. In the United States, under California v. Greenwood, trash left for collection in a public area generally carries no reasonable expectation of privacy, so dumpster diving is often legal unless trespass or local ordinances are involved. This is why shredding (preferably cross-cut) and secure disposal of media are fundamental controls.

4. Physical Infiltration and Surveillance
Spies may gain physical entry by posing as a contractor, repair technician, delivery person, cleaning crew member or job applicant. Once inside, they can read documents on desks, photograph whiteboards, plant listening devices or copy files from unlocked computers. Physical surveillance includes observing facilities, deliveries, employee movements, and following key personnel. Visual surveillance may use telephoto lenses and cameras aimed through windows at screens and documents.

5. Electronic Surveillance and Eavesdropping
This includes wiretapping telephone lines, planting bugs (covert listening devices) in offices, boardrooms, hotel rooms and vehicles, intercepting cell phone and wireless communications, and exploiting unsecured Wi-Fi networks. Eavesdropping also occurs in public places such as airports, restaurants, trains and trade shows where employees discuss business openly.

6. Computer Intrusion and Malware
Hackers gain unauthorized access to networks through weak or stolen passwords, unpatched software, misconfigured systems and malicious code. Tools include keyloggers (record keystrokes), spyware, Trojans, remote access tools, ransomware that also exfiltrates data, and packet sniffers that intercept network traffic. Attackers also target mobile devices, cloud storage accounts and third party vendors with weaker security as a path into the primary target.

7. Exploiting Trusted Relationships and Open Channels
Information leaks through vendors, suppliers, consultants, law firms, joint venture partners and outsourcing providers who have legitimate access. Spies also collect intelligence at trade shows and conferences where employees are eager to impress, through plant tours, through reverse engineering of products legally purchased, through hiring away employees from competitors, and by mining social media where employees post about projects, travel and job responsibilities.

8. Bribery, Blackmail and Coercion
Where persuasion fails, spies may pay employees outright, threaten exposure of personal secrets, or use romantic relationships (sometimes called a honey trap) to compromise a target.

Why These Methods Succeed

Most information theft succeeds not because of sophisticated technology but because of weak human and procedural controls: no information classification scheme, no clean desk policy, no shredding, careless conversation, excessive access rights, lack of security awareness training, poor visitor controls, and failure to monitor downloads and email transmissions. The CFE should recognize that the human element is both the most exploited vulnerability and the most effective line of defense.

Exam Tips: Answering Questions on Methods of Stealing Information

Tip 1 - Know that insiders are the greatest threat. If a question asks who poses the most significant risk to an organization's proprietary information, the answer is current or former employees and other trusted insiders, not external hackers.

Tip 2 - Distinguish competitive intelligence from espionage. Reading a competitor's annual report, attending a public presentation, or analyzing a product purchased on the open market is legal competitive intelligence. Misrepresenting identity, trespassing, bribing an employee, or hacking is espionage. Watch for questions that test whether a described activity is lawful.

Tip 3 - Master the social engineering vocabulary. The exam often gives a scenario and asks you to name the technique. Memorize the distinctions: pretexting (false scenario or identity), phishing (fraudulent email), spear phishing (targeted), vishing (voice), smishing (text), baiting (tempting object or download), tailgating (following through a door), shoulder surfing (observing). Read the scenario carefully for the medium used (email, phone, physical presence) because that usually determines the correct label.

Tip 4 - Remember the legal status of dumpster diving. A frequently tested point is that trash placed in a public area for collection is generally not protected, so retrieving it is usually legal in the United States. The correct control response is shredding and secure disposal, not reliance on the law.

Tip 5 - Recognize the recruitment cycle. If a scenario describes a competitor befriending a dissatisfied employee over several months before making an offer, identify it as the spot, assess, develop and recruit process used to turn an insider into a source.

Tip 6 - Think about departments and targets. Questions may ask which areas are most attractive to spies. R&D, marketing, manufacturing and HR are classic answers because they hold formulas, strategies, processes and personnel data.

Tip 7 - Pair every method with its countermeasure. The exam frequently flips the question to ask which control would best prevent a given method: security awareness training against social engineering, shredding against trash scavenging, visitor escorts and badges against physical infiltration, encryption and access controls against computer intrusion, sweeps for listening devices against bugging, nondisclosure agreements and exit interviews against insider theft, and clean desk policies against shoulder surfing and casual observation.

Tip 8 - Eliminate answers using the fact pattern. Many wrong options describe real methods that simply do not fit the facts given. Identify the key clue in the scenario (a phone call, an email, a badge, a trash bin, a USB drive) and select the method that matches that clue exactly rather than the one that sounds most serious.

Tip 9 - Do not overestimate technology. When a question asks for the most common or easiest way information is compromised, favor low tech answers such as careless conversation, social engineering, or employees walking out with documents, rather than sophisticated hacking.

Tip 10 - Read for the word legal versus ethical. Some methods, such as hiring a competitor's employee or dumpster diving, may be legal but raise ethical or contractual issues. The exam may ask about one dimension and not the other, so answer precisely the question posed.

Summary

Methods of stealing information range from the mundane (reading documents left on a desk, rummaging through trash, chatting up an employee at a conference) to the sophisticated (planting malware, wiretapping, running a long term insider recruitment). The common thread is the exploitation of trust, carelessness and weak controls. For the CFE exam, focus on correctly identifying each method from a scenario, knowing that insiders are the primary threat, separating lawful competitive intelligence from unlawful espionage, and matching each method to the control that defeats it. With this framework, you will be able to handle both the direct recall questions and the applied scenario questions this topic generates.