Renault's electric spy scandal

Reuters

PARIS – As Carlos Ghosn stepped onto the stage at the Paris motor show to unveil the near-street-ready version of the Zoe electric car last September, the Renault CEO knew investigators at his company were already probing an attempt to steal its secrets.

Digital displays on giant screens counted down to zero, pumping music rose to a crescendo and curved doors opened to reveal the small white vehicle, which will go on sale next year as the showpiece of the company's high-profile electric vehicle program.

Earlier this month, the French automaker, which is 15 per cent owned by the state, went public with its suspicions. It sacked three senior staff with more than half a century of service between them and has filed a legal complaint against "persons unknown" over organised theft, aggravated breach of trust and passing intelligence to a foreign power. The case swiftly took on wider geopolitical implications as French prosecutors looked into what one government source called a "China link" as part of their initial probe. China has emphatically denied involvement; the three Renault executives say they have done nothing wrong.

However the drama at Renault turns out, intelligence and security experts expect government-linked corporate espionage and data theft to increase in coming years. They say a lack of dividing lines between the state and corporations in countries such as China or Russia, coupled with the fact that digital technology makes stealing huge volumes of information so much easier, increase the risks companies face. In France, a country which has its own Economic Warfare School, companies like Renault may have even seen this coming years ago. France's industry minister Eric Besson, while careful not to point the finger at any country, underlined the case's importance to Paris by calling it a victim of "economic war".

Companies have always tried to steal secrets from each other. Carmakers and other manufacturers regularly buy up new models from rivals so they can study technical advances, a process known as reverse engineering. Sometimes they go further, poaching staff or persuading them to come across with key intellectual material, buying corporate secrets from third parties, even infiltrating their own spies into rival companies. In most cases, incidents of espionage stay hidden; victims don't want to let on that they've been duped. But such tricks happen "more commonly than people like to believe," says Dane Chamorro, North Asia managing director for security consultancy Control Risks.

Western firms, some with their own history of stealing secrets and uncomfortably close relationships with state spy agencies, face a particular threat from China and Chinese companies, security experts say. Many firms in Europe and the United States already deal with regular cyber attacks and other attempts at intelligence gathering, many of which appear to begin in China. Not every attack or infiltration is government-backed, the experts say. But some believe the threat is big enough that western firms will inevitably seek their own state protectors, raising the stakes again.

"It's structural," says Ian Bremmer, president of political risk consultancy Eurasia Group. "We're going to hear a great deal more about it. Multinationals most susceptible to intellectual property theft will increasingly align themselves with their own governments."

That's what makes the Renault case so important. The company, which together with its Japanese partner Nissan is investing some €4 billion ($US5.5 billion) in electric vehicles, says it has uncovered misconduct detrimental to its "strategic, technological and intellectual assets". If French prosecutors prove that spying occurred and can pin the blame on a foreign power, then the "economic war" will get a whole lot more serious. The case resonates inside France, a former French official told Reuters on condition of anonymity, because "Renault is known to take security very seriously. They are not given to panicky or exaggerated gestures in matters of industrial espionage."

ANONYMOUS TIPOFF

As usual, Paris was all but shut down for summer last August when Renault's compliance committee received an anonymous "ethical alert". CEO Ghosn, who also serves as chief executive of Nissan, says he was immediately informed. The tipoff alleged two senior executives had received bribes, a lawyer for one of the accused men said. The suspected involvement of the third, his client, arose during the subsequent internal investigation.

On the surface, the trio -- Michel Balthazard, senior vice president for advance engineering, his deputy Bertrand Rochette, and Matthieu Tenenbaum, deputy head of the electric vehicle program -- seem loyal company men and unlikely corporate traitors. Balthazard, 56, began his career at Renault in 1980, and Rochette, 50, has worked for the company for 22 years.

Tenenbaum, 33, was a rising star at Renault. According to a profile in his name on the LinkedIn business networking website, he had worked as an engineer for Renault and Nissan in North America and South Korea before moving on to the fledgling electric vehicle program in 2007. Electric vehicles seemed to supercharge his career. He found himself at the forefront of the development of the tiny futuristic-looking Twizy -- a two-seater designed for urban drivers and part of Renault's electric vehicle range alongside the Fluence sedan, Kangoo small van, and Zoe four-seater. "Jumping in this challenge is the best decision I ever made," he wrote about his move to the electric vehicle project on LinkedIn.

According to a former military police officer who now runs his own security agency and is familiar with the security set-up at Renault, the most surprising thing about the case is the seniority of the men who have been charged. Balthazard in particular was "on the management committee, he earns a good living, people have confidence in him -- it's hard to see how he would betray that. Normally it's not people of this level who betray -- it's engineers, technicians who can be bought off with sums of money. It's not executives -- in companies like that, executives at that level are committed to the company."

"LIVING A REAL NIGHTMARE"

After Renault received the tipoff, its own security team, which includes former military police, or gendarmes, launched an internal investigation. French media have reported that Renault also hired a private detective who may have broken the law by tapping the men's phones and hacking their bank accounts. The company has refused to confirm or deny those reports, though Ghosn has said the company's actions during the investigation were "irreproachable with regard to the law". The three accused are all taking legal action against Renault, either for defamation or for slanderous accusation -- a charge that carries a heavier penalty under French law.

In early January, domestic intelligence agency the DCRI began initial checks, as it waited for Renault to lodge a formal complaint.

On the afternoon of January 11, the three men were summoned separately to Renault's headquarters. They were read short statements. In dismissal letters, dispatched to the men 48 hours after the meetings to conform to French law, the men were confronted with a range of allegations including leaking information and receiving bribes. "It emerges... that you received sums of money from a foreign source leading to the conviction, given your responsibilities in an essential area for the future of the company, that you gave strategic information for the company in exchange," read the letter sent to Rochette. According to Rochette's lawyer, his client is alleged to have threatened key national economic interests.

"These extremely serious acts, which reveal an intention to harm the company, constitute a serious and flagrant failing in your duties of confidentiality and loyalty with regard to the company as set out in the ethics code," the letter said.

The men say they are still in shock at the charges they face. "I have been chucked out of the door of this company like a piece of rubbish. It's a company where I've worked with fantastic people, who I think respect me, who have confidence in me," Rochette, who has three children, told a Paris news conference on January 24. "I would like to reaffirm that I have never had a Swiss bank account. I have never received any money. I have always been loyal to this company and I am determined not to be a scapegoat in this matter."

Lawyers for the men say Renault has so far refused to provide detailed information on the allegations in its legal complaint, including the contents of the anonymous tipoff, what bribes it believes had been paid and what information was released. Ghosn told TF1 television the suspected espionage appeared to have been aimed at uncovering Renault's investment model for electric vehicles rather than copying the technology.

Rochette says he feels "betrayed" and is still waiting for the proof against him. He says he accompanied Renault investigators to Switzerland to prove to them that he did not have an account there -- but that the trip was cut short. "It's now been three weeks and I have nothing concrete on what my dismissal is based on, what could explain it," he told the news conference.

Security has always been tight at Renault's Technocentre, a secluded complex on the outskirts of Paris where the men worked. Visitors must be escorted at all times and staff are routinely kept out of areas in which they don't work. The company regularly reminds staff of the sensitivity of the material they work with -- and the possible consequences if they leak it to others. Sources inside Renault, who would not be named because they are not authorized to talk publicly about the case, say the three executives have already been replaced. As one put it, "life goes on". "I haven't really had any serious discussions about it," says another employee working at the center in a different division. "It's more jokes than anything."

A CHINA LINK?

The DCRI's preliminary investigation could take up to six months. In the meantime French diplomats and senior officials face a quandary: how to handle the reported China link. France-China relations stumbled after President Nicolas Sarkozy met the Dalai Lama in 2008, but since then Paris has worked hard to boost trade. Sarkozy needs Beijing's support to make a success of the G20 presidency this year.

So far, the Elysee has not publicly mentioned China in relation to the scandal. Asked on France Info radio on January 7 about a possible Chinese connection, Industry Minister Besson said: "I am not authorized to tell you anything whatsoever on the matter." Ten days later, talking to France 2 television, Besson, asked again about China, said: "I will be careful not to point the finger without proof, especially when we are talking about a country with which we have extremely close trade relations."

Renault's Ghosn is also cautious. "Renault is in no way associated with any hypothesis," he told Reuters Insider. "It's not up to us to make the enquiry about who is behind the scenes so I would be very careful," he said, adding he would wait "patiently" for the justice system to reach its conclusion.

At the same time French officials have anonymously pointed the finger at Beijing. Given that the official investigation is just getting underway, such comments are risky. "It is something staggering to me, which is going to create shockwaves if it is true," says Francois Godement, senior research fellow for the European Council on Foreign Relations, of the case. "If it is not true, and it's a premature reaction... then that would be a mistake and would hurt Chinese-French relations."

American and European carmakers have long complained that Chinese companies routinely copy their designs and trample on their intellectual property rights. According to U.S.-based political risk consultancy Stratfor, 11 China-linked corporate espionage cases were prosecuted in the United States in 2010. They involved a range of cases, including trade secrets: insecticide formulas from the Dow Chemical Company, paint formulas from Valspar, and vehicle design specifications from Ford.

Last July, Detroit couple Shanshan Du and Yu Qin were charged with conspiring to steal trade secrets related to hybrid vehicles from General Motors. The couple, the U.S. attorney alleged, attempted to pass the information on to Chery Automobile, a Chinese manufacturer. Du was accused of copying thousands of GM documents to an external hard drive in January 2005, five days after GM offered her a severance agreement. The couple then approached Chery with a proposal for a joint venture on hybrids. Chery has said it knew nothing about the offer.

Four years ago, a Chinese student on a work placement at French car parts maker Valeo was given a prison sentence for obtaining confidential documents. A French tribunal stopped short of an industrial espionage verdict, instead finding that she had "abused trust".

In 2009, European plane maker Airbus reportedly thwarted a number of industrial espionage attempts shortly after opening an assembly plant at Tianjin near Beijing. Facing a potential diplomatic row, Airbus parent EADS recently denied it was particularly worried about keeping its secrets from China.

China has adamantly denied any involvement in the Renault case. "We have noticed the relevant reports," Foreign Ministry spokesman Hong Lei told a regular news briefing on January 11. "We think that some people saying China is behind this case is totally baseless and irresponsible. China cannot accept it."

Chinese media suggest that some in the west are simply struggling to accept the rise of Beijing's international economic and political clout. "China's growth not a result of espionage," proclaimed a headline in the Global Times, a popular tabloid run by Communist Party mouthpiece the People's Daily. "Surely, China's modernization includes some imitation of the west," it wrote. "It is natural for western society to feel proud and the occasional cheap shot is even understandable. However, it is ludicrous to cast China as a thief that grabs any technology it can by illegal means to try and take a shortcut to power."

Chinese automakers who spoke with Reuters say the scandal is "Renault's internal business" and that Chinese companies are capable of doing their own research and development without stealing ideas. A spokesman for automaker Changan, which has partnerships with Renault's French rival PSA Peugeot Citroen as well as Ford's China arm, said it is investing 4.5 percent of its annual sales in RΔand already has several of its own electric vehicle models in production. Automaker Geely and others have all unveiled electric and hybrid models over the past couple of years. "I really have nothing to say on this. I'd suggest (they) strengthen their internal control so as to prevent it from happening again," says a Geely spokesman.

Security experts such as Control Risks say that proving the involvement of a state intelligence agency, whether acting through moles or by computer hacking and cyber attacks, would be difficult. Many firms face an increasing onslaught of cyber attacks, often from servers that appear to be located within China. But pinning an attack on Beijing itself is all but impossible.

Defense firms are most at risk, followed by resource and energy companies and software firms. One corporate security consultant said he was advising clients in East Africa that they should pay at least as much attention to Chinese risk as dangers from local politics, rebel groups or more traditional African dangers. "If you only worry about one thing, worry about China," he said, warning that a Chinese rival could have access to local intelligence -- including hacked e-mails -- supplied by intelligence officers attached to the Chinese embassy.

"Most estimates say that more than half of corporate espionage cases have a Chinese link," says Sean Noonan, a Stratfor analyst specializing in Chinese espionage, referring to U.S. cases. Stratfor advises a wide range of companies including many in the energy sector and believes China has a policy of sending out a "human wave" of hundreds or thousands of agents into the wider world, aiming to gather useful intelligence as well as furthering their own business interests.

"China's intelligence services focus more on business and technology intelligence than on political intelligence," Stratfor said in a 2010 report. "And Chinese companies have no moral qualms about engaging in business espionage whether they take orders from the government or not."

TECHNOLOGY AND TACTICS

The same can be said of some western companies -- and capitals. During the Cold War, western intelligence agencies often tried to steal Soviet secrets for delivery to their own defense firms, and had no qualms about spying on allies. Even today, continental European governments suspect Britain and the United States sometimes use their powerful signals intelligence networks to spy for business ends.

A European parliamentary report in 2000 outlined the existence of a powerful U.S.-UK surveillance network called Echelon which had the potential for industrial espionage. It reported cases where European firms had their telephones tapped, most likely by intelligence agencies. The report also noted the difficulties of gauging the scale of the problem -- not least because private security consultants had a vested interest in talking up the threat. Still, European government and defense firm officials sometimes avoid using BlackBerry smartphones because their traffic passes through servers in Britain and the United States.

"As long as the technology has been available, I think it is fair to say governments have at least sometimes used it for commercial ends," says Alastair Newton, one-time British Foreign Office lead official for cyber warfare and now a senior political analyst for Japanese bank Nomura. "In the past, the French have accused the British of spying on their defense industry and vice versa. They were probably both justified."

One veteran corporate security investigator said he simply took it as given that almost all governments would at least occasionally spy for corporate ends, at least in the military industry. "Sometimes it's looking for technology, sometimes it's tactics," he said, asking not to be named for fear of jeopardizing commercial relationships. "Understanding the differing sales methods a French defense firm might use versus an Italian defense firm would be useful for a British company, for example."

Security consultancies such as Stratfor say that if the Renault theft were carried out by China, and did target investment strategy rather than technological know-how, that would represent a shift in China's state espionage tactics. Stratfor's Noonan says state spy agencies such as those of China, Russia and Israel tend to go after technology, while corporate spies for western firms tend to be looking for strategic and business related secrets -- such as costings, overheads, and sales strategies.

This leads the consultancy to doubt that the Renault theft was perpetrated by the Chinese. "The leak suggesting otherwise was likely an assumption based on China's frequent involvement in industrial espionage," it said. "Still, it could be a sign of new methods in Chinese spycraft... If China is responsible for the Renault penetration, the case would represent a change in the Chinese espionage MO, one aiming at a higher level and willing to spend more money."

"ECONOMIC WARFARE SCHOOL"

Perhaps no western country has forged closer links with the intelligence services as France, whose "Economic Warfare School" describes itself as an alternative to business schools built on the American model. Based in the embassy- and museum-filled 7th arrondissement of Paris, the school is a stone's throw from the vast, imposing Ecole Militaire training complex that was founded in 1750 by Louis XV.

One of the Economic Warfare School's founders, Christian Harbulot, says a decade's experience in the martial arts helped him see the scope for western business to absorb what he termed the more combative approach to strategy he saw in east Asia.

"When countries that are behind want to catch up, there is no alternative but to go looking for others' knowledge," Harbulot says in his office, which is decorated with the school's logo of an arrow piercing a chess piece. "It's impossible to catch up if one is behind industrially without taking what we call short-cuts."

The school was founded in the 1990s, just as French intelligence was increasing its focus on business. A decade earlier, Paris had recruited Russian KGB official Vladimir Vetrov, who shared details of Soviet efforts to steal scientific and technical data from the west.

According to the CIA's Center for the Study of Intelligence, France shared Vetrov's material -- known as the "Farewell Dossier" after his codename -- with other western powers, alerting them to the scale of Soviet technical espionage. Vetrov himself was arrested in Moscow after an unexplained stabbing incident in a city park. He was later executed, but his work allowed U.S. intelligence to continue to feed Russia false technical information, particularly in military technology, for some years.

In a bizarre twist, the CIA website says French President Francois Mitterrand then became convinced Vetrov had been a CIA plant all along, in a test to see if France would pass on the information to the United States.

In another famous case, in the early 1970s, western airplane manufacturers widely believed that corporate espionage played a role in the development of the Soviet Union's Tu-144 supersonic airliner, dubbed "Konkordski" after the Anglo-French Concorde. An early version of the airliner crashed at the 1973 Paris air show, killing 14. Assorted theories about the crash continue to circulate, including the idea that flawed plans were deliberately leaked to the USSR, or that a French Mirage fighter jet contributed to the crash by flying too close while trying to photograph the airliner in flight.

CLOSE RELATIONS

French intelligence links with Renault strengthened in the late 1980s after the assassination of the carmaker's chief executive Georges Besse, who was gunned down by killers riding a motorcycle. Members of the Maoist militant group Action Directe were convicted of the killing, but theories persist linking it to Iran, the French nuclear industry, or Soviet Bloc intelligence agencies angry at Renault's weakening of Communist-dominated trade unions.

European security sources say French intelligence agencies enjoy particularly close relations with major companies, with officers able to offer weekly, daily or even hourly briefings to firms at times of heightened danger. Intelligence information tends to pass directly from spy agency officials to firms, experts say. In the case of automakers, this has bypassed the industry and transport ministries, seen as periodically vulnerable to Communist infiltration.

The proportion of French intelligence personnel with an engineering background within the military is high compared with other European spy services, which gives them an additional edge in technical matters.

"It's actually quite rich for France to be accusing any other country of commercial espionage given the French state's own long and less than edifying efforts in this regard," said one former British senior intelligence official on condition of anonymity. "Of the major European powers, France is the only one which historically has devoted significant intelligence resources to collection against foreign commercial corporations."

The former British official said the leap into corporate espionage was essentially a "philosophical decision" an intelligence agency makes. Penetrating private firms, he says, is definitely "at the easy end of the spectrum". "If you can get inside the protected places of nation states, especially inside authoritarian states who are doing all they can to prevent you, getting inside a western corporation... ought not to be much of a challenge," he said.

"With so many people on Facebook and other social networking sites, it is also a lot easier to find out about people in the target organization, identify their motivations and vulnerabilities and initiate contact in a low-risk environment."

STOLEN "CROWN JEWELS"

The difference now is the scale of the threat. That's driven in part by the rise of new powers such as China, but also by the fact that anyone can now download vast amounts of data onto a small -- and very portable -- storage device. Western officials -- present and former -- and other experts say data theft from corporations is becoming a national security threat in its own right. As well as risking the loss of sensitive military technologies, they say it risks imperiling western firms' profitability and economic growth.

"Chinese cyber espionage and intellectual property war may swing the balance of power in the world away from America," wrote former White House cyber security adviser Richard Clarke in his 2010 book "Cyber War". "We need to make protecting this information a much higher priority, and we need to confront China about its activities... America's real crown jewels are not our government secrets but our intellectual property."

According to Clarke, secure databanks containing plans for the next-generation F-35 Stealth fighter were hacked several times between 2007 and 2009, with the amount of data downloaded equivalent to several multivolume editions of the "Encyclopedia Britannica". "If a Cold War spy wanted to move that much information out of a secret, classified facility, he would have needed a small moving van and a forklift," he wrote.

The School of Economic Warfare's Harbulot says that if China is found to be behind the Renault espionage, France on its own would not be able to use the case to send a warning. "I think that France on its own does not have the capacity to stand up to China. If the United States decides to use this matter and indirectly back up France, that would be a different story."

BLURRED NATIONAL IDENTITIES

At the United States Naval War College in Rhode Island, mid-ranking U.S. naval officers are now trained to think about economic risks -- including espionage -- as much as conventional military conflict. "We are making the first shifts," says college professor of national security studies Nikolas Gvosdev. "There is more attention being paid to the economic dimension of national security, but there is somewhat of a disconnect between the U.S. government and the private sector."

Britain faces similar problems. The head of its signals intelligence agency Government Communications Headquarters (GCHQ) Ian Lobban described in a speech earlier this year how the screens in his operations room showed almost continuous cyber attacks on firms and websites around the world, often aimed at extracting data. "There is certainly plenty of evidence that there is increasing interest in acquiring information of commercial value," says David Omand, a former GCHQ chief and national intelligence coordinator, and now a professor at King's College London. Joint ventures and mergers are blurring the national identities of companies, making security even more complex.

Omand believes state security agencies should increase their support to private firms by providing advice on cyber security, personnel vetting and other issues. But with the emphasis now on countering militant attacks, there is a reluctance to do what is often seen as the private sector's job. "There is the question of who pays," says Omand. "The government would expect the private sector to put its own money into its own protection, and to make sure they employ the right kind of specialists in IT security and carry out sensible personnel checks on staff with access to their information and systems."

One of the most reliable ways of improving security, the veteran corporate security investigator says, is to keep senior staff happy and well paid -- giving them less of an incentive to either trade secrets or look at jumping ship to a rival. Keeping track of data access is also important, particularly in an era when WikiLeaks has shown how swiftly one individual can download hundreds of thousands of sensitive documents.

Sometimes in a suspected case, though, security experts can find no evidence at all of any data theft, angering the client who cannot believe that a rival has produced a product without spying on their research. "Sometimes people just can't believe someone else could have come up with a product on their own," says the corporate investigator. "Then all you can do is tell them there's just no evidence anything was taken. They tend to shout at you, fire you and try and find someone who will tell them what they want to hear."

(Peter Apps and William Maclean reported from London. Additional reporting by Ben Blanchard, Don Durfee, Yan Fang and Sui-Lee Wee in Beijing, Chang-Ran Kim in Detroit, Gilles Guillaume, Daniel Flynn, Thierry Leveque and Tim Hepher in Paris; Editing by Simon Robinson and Sara Ledwith)