Lost iPhone just 1 headache for Apple security

[September 19, 2011]  SAN FRANCISCO (AP) -- Wanted: experienced security professional. Must have plan to thwart Chinese counterfeiters, protect secret blueprints from spies and keep workers from leaving super-secret unreleased smartphones behind in bars.

A day after a recent report surfaced that an Apple employee had lost a prototype for a new but unreleased iPhone at a Northern California watering hole, two job listings appeared on Apple's website for managers of "new product security."

Such workers would join a team at the $350 billion company that has included ex-FBI agents and other highly trained pros with backgrounds in intelligence and law enforcement.

While a private security force might not seem in keeping with its user-friendly image, Apple and other companies in its league need the best protection they can buy, corporate security experts say. And lost iPhones likely don't come near the top of the list of anxieties.

"Corporate espionage, that's big money. Billion-dollar money. The paranoia is justified," said Jim Stickley, co-founder of corporate security consulting firm TraceSecurity "Whatever they're trying to do, their competitors want to know. Everybody wants to know."

Apple declined to discuss its security operations in detail with The Associated Press, in keeping with the company's longstanding reputation for secrecy. Nor has the company confirmed the existence of the iPhone 5, the rumored latest model, much less a lost prototype.

But San Francisco police have said that four officers recently went to a home in the city's Bernal Heights neighborhood with two Apple employees, who met with the resident and searched the home for an iPhone prototype.

Apple watchers say the company is known for creating many test versions of its new devices before they're released to see how they work in the real world. The reportedly lost iPhone likely would have been far from the only one in circulation.

Losing just one such device is perhaps more of a marketing headache than a serious security breach, as was the case for Apple last year when the tech blog Gizmodo posted photos of what turned out to be the then-unreleased iPhone 4 lost by an employee at a San Francisco Bay area beer garden.

Once a new device has reached the point where employees are field-testing it, a competitor who obtained one wouldn't have enough time to analyze it and do anything to take advantage of that insider knowledge, Stickley said.

Even so, sheriff's deputies seized Gizmodo blogger Jason Chen's computers as part of an investigation into whether the blog's $5,000 payment to acquire the lost phone amounted to a crime. No charges were filed.

Such tactics might seem heavy-handed. But for Apple and other tech companies, the issue amounts not just to a publicity problem, but a fiduciary obligation to shareholders to secure the company's valuable assets, said longtime Apple analyst Tim Bajarin.

Companies also have an obligation to try to prevent such a loss from happening again, he said: "If they fail, it's the system that failed as much as the individual."

Despite the blogosphere frenzy surrounding the lost iPhone prototypes, experts say the security threats to tech companies are far more serious in China, where thousands of workers labor to manufacture Apple's products.

According to a 2008 diplomatic cable released by Wikileaks, Apple had only a modest security presence in China until March of that year, when the company hired a team from Pfizer that led a crusade against fake Viagra.

Under the leadership of Donald Shruhan, whose LinkedIn profile lists him as a Hong Kong-based senior regional director for Apple in security and investigations, the company began taking steps to reign in the country's trade in counterfeit iPhones, iPods and MacBooks.

"Early evidence suggests nearly 100 percent of Apple products in unauthorized mainland markets are knockoffs," according to the unclassified cable from the U.S. Embassy in Beijing.

The job of keeping such counterfeits off the shelves, to keep blueprints for new products from leaking and to otherwise secure vital trade secrets falls under the field of information assurance.

For information assurance professionals, securing computer networks is only part of the job. They also make sure companies remember to lock their actual doors.

"Social engineering" also remains a constant threat in the tech industry, said Gary Kessler, director of the information assurance program at Norwich University, a private military college in Vermont that has trained security personnel at Apple and other high-profile companies. From e-mail scams seeking sensitive personal information to Cold War-style cloak-and-dagger subterfuge, human weakness can be easier to exploit and harder to protect against than digital vulnerabilities.

"This stuff has been going on for decades, just in a different guise," Kessler said. "The Internet has just given us a new vector for attack."

And in the end, he said, even the best-trained security team in the world can only do so much to protect against someone in a bar who may have been drinking and may have been showing off the most sought-after secret product in the world.

Said Kessler: "I'm guessing that Apple probably did everything that anybody could do, and they probably did it right."

[Associated Press; By MARCUS WOHLSEN]

Follow Marcus Wohlsen on Twitter at http://twitter.com/marcuswohlsen.

Copyright 2011 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.