A Corporate Security Fail at Ford

Ford's corporate security isn't "built Ford tough" like the company's slogan suggests. Earlier this month, a former employee at Ford, Mike Yu, pleaded guilty to the theft of $50 million in trade secrets from the auto company. Yu copied approximately 4000 documents from Ford onto an external hard drive that he took with him after completing his last shift. The documents that Yu stole didn't even relate to his job. Unfortunately, this story is all too common for many companies. We need to take the lessons learned from the incident at Ford and make changes to ensure trade secrets and other corporate data stay within the company.

A Guilty Plea

Yu was arrested in China last year, but stole the design documents from Ford in 2006. The Wall Street Journal article "Ex-Ford Engineer Pleads Guilty in Trade-Secrets Case," reports that:

"In November 2008, Mr. Yu began working for Beijing Automotive Company. Upon his arrest in October 2009 in the U.S., the FBI discovered that 41 Ford design documents had been copied to Mr. Yu's Beijing Automotive Company work computer. It was unclear from court documents whether Beijing Automotive directly benefited from the stolen designs or even knew about their theft."

What does all of this mean for Yu?  According to the Teach Herald article "Former Ford Employee Admits to $50 Million Theft," Yu is currently held in custody in the US and faces fines up to $150 000 (USD) and a maximum prison sentence of 6 and a half years. His sentencing hearing is scheduled for February 2011.

Lessons Learned

One company's failure is another company's lesson. In this case, Ford demonstrated that corporate security can't be overlooked. No matter how much you trust your employees, you still need to protect trade secrets and other private company information. Here are some of the many tips for preventing trade secret theft within your company:

1. Access Controls

Yu had easy access to information that didn't pertain to his position at Ford. If an employee doesn't need certain information to do their job, don't let them have access to it- especially if the information is product or client related. Examine the organizational chart and job responsibilities to determine who requires access to different systems and documents. This also helps reduce the possibility of information landing in the wrong hands. When employees have (relatively) unlimited access to company information, it's hard to control who sees what and where documents end up.

2. Training and Awareness

Yu stole the data from Ford on purpose. He knew what he was doing, it wasn't a mistake. Peter Abatan's article "Hold On A Minute! - Did I Miss the Point?," took the words right out of my mouth when it comes to protecting trade secrets through training and awareness:

"Organizations must endeavor to make sure that the protection of confidential information becomes a deep ingrained culture of the organization. If properly implemented there should be no reason for an employee to take corporate data with them when they hand in their resignation letter."

3. Employee Departure/ Termination

Yu accepted a transfer near the end of 2006 and was still going in to work each day before moving to China to begin a mew position. This gave Yu ample time to figure out how he was going to take the information with him when he left. When an employee announces they are leaving the company or they are terminated, immediately bar them from accessing company information. In order to do this though, you'll need to have access controls already in place. If an employee has company devices such as laptops, key/ swipe passes, cell phones and other wireless devices, have them handed over immediately.