Capital Thoughts
analysis and commentary on critical business and legal issues
Cybersecurity
Don't Wait for a Cyber-9/11
By Tim McKnight, Northrop Grumman Corp.
It's time to invest in people who can protect our vulnerable information assets
McKnight
What would we do if the lights went out…cellphones stopped working…public water systems ceased functioning…and the Internet crashed?
In other words, what would we do if the nation suffered a massive cyber-attack? The prospect isn't unrealistic. And because we're all increasingly interconnected, the consequences would be far-reaching and catastrophic. After 9/11, the nation focused its attention on attacks on our physical infrastructure. Now there's a need to address another critical vulnerability by focusing on cyber-attacks.
The number of coordinated, sustained and well-funded cyberthreats is growing. The solution is to invest in highly trained cybersecurity personnel who are uniquely qualified to understand those threats and protect against them.
When most of us think of information security, we think about authentication, anti-malware, firewalls and so on. Those measures are not nearly sufficient. To start with, the typical software developer isn't trained in security coding, so security technologies can be delivered with inherent vulnerabilities. In addition, it can be difficult to scale security across a large infrastructure, and challenging to implement security without interrupting process flow.
More significant, for some time now we've seen attacks that circumvent the technologies we have in place. Some of these are highly sophisticated and well-resourced, with volumes of people behind them. They represent less than 5 percent of all attacks, but they're the ones that could bring down critical systems and infrastructures.
In my previous job as an FBI agent, I dealt with all sorts of threats, but the greatest threat today is what I call "cyber competition." Many of our enemies or potential enemies recognize that they can't compete with us on land, sea and air. But cyberspace is the soft underbelly. So they're constantly probing our systems, analyzing our weaknesses, trying to embed malware that can later be brought to life.
We've seen this cyber competition move from the military to the defense industrial base to the commercial sector. During the past year, several Fortune 100 companies saw advanced, persistent attacks on their infrastructures. While these companies invest millions of dollars in protections, they don't necessarily have the personnel to defend against that level of threat.
In fact, no one does. There are only about 1,000 highly qualified cybersecurity professionals in the U.S. today, according to the Center for Strategic & International Studies. We likely need 10,000 or 20,000 to truly protect military, government and business. Compare that to China, which reportedly has already trained some 60,000 "information troops."
The good news is that this is a solvable problem. And people are beginning to take action.
At Northrop Grumman, for example, we know that even if you spend millions of dollars on security technology, you still need people who can deploy and maintain the technology and understand what it can and can't do. As a consequence, we've worked hard to assemble a specialized team of scientists, analysts and experts from government, academia and elsewhere.
We're also the presenting sponsor for the Air Force Association's CyberPatriot program, a national cyberdefense competition for high school students. The program gives students hands-on, practical knowledge that prepares them for careers in fields such as engineering, mathematics and especially cybersecurity. For those already pursuing such careers, the National Board of Information Security Examiners is developing rigorous cybersecurity exams and certifications.
I'd also like to see our universities shift their curricula from focusing only on defenses to considering attacks. In China, students are trained in cyberwarfare and system exploitation. We need to learn from that, because only by understanding both sides of the equation—defense and attack—can we adequately protect our information assets. A significant change in the way we teach is required now in order to have an impact in the near future.
Finally, government needs to invest more in developing the scientists, engineers and technologists we'll need to compete in the future. We're beginning to see language to this effect in emerging bills on Capitol Hill. President Barack Obama's National Cybersecurity Initiative is a great start, but it needs to reach a level of implementation that can scale for industry, where we currently face the greatest risk.
It would appear that we're reliving the past. In 1957, the launch of Sputnik rattled the United States' belief that it was the world leader in space technology. Is the "cyberspace race" here today? How will we respond?
In the past, we've enjoyed great success when industry, government and academia have come together to respond to a common threat. The post-Sputnik era provided five decades of prosperity driven through scientific and technological education.
Cybersecurity is an issue that will have to be addressed over the long haul. We're now at a crossroads. Are we going to invest today in training and motivating the highly qualified cybersecurity personnel we'll need tomorrow? Or will we have to wait for a cyber-9/11 to spur us to action?
International Investment Protection
Safer Passage
By Kenneth B. Reisenfeld, Patton Boggs LLP
Three ways to protect your overseas investments
Today's global economic and political uncertainty might understandably prompt some to consider retreating to the relative predictability of domestic operations and investments. And yet, there is growing consensus that most of the global economic growth over the next several decades will occur in the developing world (that is, the BRIC countries and beyond). For businesspeople who are justifiably concerned about risk but still want to take advantage of this trend, the good news is there are several effective means of protecting investments and joint ventures in emerging markets. Here is a look at three of them.
Reisenfeld
Bilateral investment treaties: Just as investors routinely structure international deals to take advantage of the most favorable tax treatment, they should also structure their investments abroad to take advantage of the growing matrix of trade pacts known as bilateral investment treaties (BITs) and free trade agreements (FTAs). The U.S. has entered into investment agreements with more than 44 countries. from Albania to Uruguay. What's more, U.S. and foreign companies can take advantage of the larger network of more than 2,500 investment treaties in force between other countries by making their investments in emerging countries through a holding company that qualifies for protection under a BIT.
In general, BITs protect qualifying foreign investments from discriminatory actions by the host government through guaranteed treatment not less favorable than that accorded to nationals of the host country (so-called "national treatment") or to investments from any third country (so-called "most favored nation" protection). Foreign investments are also protected from uncompensated expropriation and from other unfair or inequitable treatment by the host government.
A BIT also gives investors the right to bring claims directly against the host government in an international tribunal, and they are doing so at a dizzying rate. Fifty-seven percent of the known treaty-based investor-state disputes have been commenced during the past five years.
Political risk insurance:BITs do not cover every country, nor do they cover every risk. That is why political risk insurance (PRI) is an important way to offload some of the uncertainty involved in investing in a developing country. What happens if local insurgents take over your plant, the host government nationalizes your industry, the local currency becomes incontrovertible or the government fails to pay an arbitral award rendered in your favor? These losses may be covered by PRI. For an American company, the Overseas Private Investment Corporation, an arm of the U.S. government, is often the best option for obtaining political risk insurance. Depending on the size of the claim, a policyholder may have to engage in an arbitration process to prove its case. But once a policyholder prevails, OPIC has a strong track record of paying claims. As of late 2009, OPIC had made more than 290 claim settlements totaling almost $1 billion.
A number of capital exporting countries—such as Australia, the United Kingdom, France, Belgium, Canada, Germany, China and Japan—offer insurance products for overseas investments similar to OPIC. For companies based in countries without these programs (or for American companies investing in countries where OPIC does not operate), a good alternative is the World Bank's Multilateral Investment Guarantee Agency. Some private insurers, such as Chartis (formerly AIG) and Lloyd's, also offer political risk insurance, but they generally lack the leverage of OPIC or MIGA to work directly with host governments to prevent threatened expropriations or similar harmful measures from being implemented.
International arbitration: Disputes are a material risk in any overseas investment. In emerging markets, litigation in local courts is usually not an acceptable option. In many developing nations court dockets can be backed up 20 to 30 years. There is often favoritism toward local parties or a requirement to translate all documents into the local language, as well as a complete lack of confidentiality. In some countries, courts may appoint "experts" to decide your case who lack any relevant expertise. And even if you prevail, the judgment may be unenforceable outside of that country.
All of this speaks to the importance of including carefully drafted arbitration provisions in your international commercial agreements. Arbitration can be more efficient than court litigation because the parties can structure the decision-making process, choose their own impartial and expert decision makers, and limit appeals on the merits. Arbitration can also be confidential and less adversarial, which goes a long way toward preserving your business relationship in the event of a dispute. And awards are enforceable in the 140 countries that are signatories to the New York Convention on Recognition and Enforcement of Foreign Arbitral Awards.
That said, investors will not fully reap the benefits of arbitration unless their arbitration clause is thoughtfully designed for each transaction. For example, choosing the right seat of arbitration, arbitral institution and procedural rules is crucial to maximizing the effectiveness of an arbitration process. There are three major international arbitral institutions and a host of regional ones, each with its own unique attributes. An arbitration clause could also tailor the cost and timing of the process to the scale of the likely dispute.
Investing in emerging markets is inherently a risky venture, but the potential benefits are too attractive to ignore. If effectively employed, these investment-protecting mechanisms will significantly mitigate your company's risk exposure.
Patents
The Law as a "Living Thing"
By Ananda Chakrabarty, University of Illinois College of Medicine
Faster oil spill cleanups? More effective drugs? Credit a court decision that illustrates why patent law must evolve with the times.
As technology progresses at an astonishing rate, the relation between humans and nature changes at a similar pace, but laws, regulations and perceptions tend to lag behind. I had the privilege of helping to close that gap when I found myself at the heart of a legal case that led to a landmark decision by the U.S. Supreme Court. At issue was the right to obtain patents to protect the successful results of millions of dollars and thousands of hours of laboratory research.
In the early 1970s I was working for General Electric on ways to clean up oil spills—a question that remains quite relevant today. Oil is a mixture of many different chemicals, and, while there are many bacteria known to devour it, no bacterium is capable of doing the job by itself. Logic might suggest that we let different bacteria occurring in nature work together to take care of the problem. The reality is that they compete with one another.
My job was to study the DNA and the genes responsible for hydrocarbon degradation in bacteria. Then, I removed those genes from a variety of bacteria and put them into a single bacterium, rendering it capable of doing the oil-eating by itself.
Here's where the controversy arose. To be a commodity, a scholarly academic or industrial invention must be shielded by the Intellectual Property Rights system. In the case of scientific and technological innovations, that usually means patenting. I believed that my work met all of the statutory criteria for a patent. There was no dispute about its utility or its novelty, and it was clearly not something that would be "obvious" to anyone working in the field. The restriction against being able to obtain a patent for a "living" thing was another matter entirely.
Chakrabarty
I suspect that most non-scientists would consider a bacterium, fungus or anything else that can reproduce and show some of the characteristics of life to be a "living" thing.
Bacteria can grow and multiply—a very important characteristic of living things. Non-living things like stones and rocks don't reproduce. Since bacteria were known to be living, it was assumed until the early 1970s that they were solely products of nature. Because the patent laws said that there must be human intervention for something to be patentable, products of nature were generally considered to be ineligible for patent protection unless they had been somehow manipulated by human hands.
When we applied for a patent back in 1972, we explained that we were not trying to patent an original bacterium, but instead one that had been manipulated so that it had inherited capabilities that no natural microorganism had. It might be alive, but it was no longer a product of nature. The Patent and Trademark Office turned us down, as did the Patent Office Board of Appeal. Then we went before the Court of Customs and Patent Appeals, which agreed with us, ruling in part that "…the fact that microorganisms, as distinguished from chemical compounds, are alive is a distinction without legal significance."
"As with Fulton's steamboat 'folly' and Bell's telephone 'toy,' new technologies have historically encountered resistance," added the Court. "But, if our patent laws are to achieve their objective, extra-legal efforts to restrict wholly new technologies to the technological parameters of the past must be eschewed."
Finally, in 1980, the U.S. Supreme Court ruled that "Anything under the sun that is made by Man is patent-eligible in the United States." The patent was issued the next year.
Diamond v Chakrabarty has been credited with opening up the field of biotechnology so that all kinds of living forms—plants, animals, human stem cells, human genes—can be patented. It is one of the reasons why U.S. biotechnology is such a thriving industry. A perfect illustration of its impact is a comparison between the pharmaceutical industries in India—which is the second- or third-largest drug-exporting nation in the world—and the United States, which is first. India's entire industry is valued at only $15 billion, while just one U.S. company, Genentech, was sold last year for $45 billion. Researchers in this country have created an extraordinary number of new drugs, while India has focused on manufacturing generic copies.
Presently, I am researching new types of drugs that may result in a revolutionary way to combat cancer, HIV-AIDS and malaria, among others. To protect my work, my university has filed and received 10 patents to cover the potential marketing of these drugs.
What was appropriate in 1793, when Thomas Jefferson argued for the right of citizens to obtain patents, was not necessarily appropriate 100—much less 217—years later.
For that reason, it is in the best interest of every individual and business that stands to gain, or lose, in the patent arena to be constantly vigilant and proactive when it comes to understanding the patent legal system and the evolution of patent law.
Home | Cover Story | Privacy Policy | Feedback | Subscribe | Past Issues