How can we help you ?

Data breaches, ransomware, IP theft - most of us are fully aware of the pervasive and heightened risks posed by cybercriminals.

In 2021, the total cost of worldwide cybercrime was approximately $6 trillion USD. To put this number into perspective, the 500 corporations that make up the Fortune 500 List (including Apple, Amazon, Google, Exxon Mobil, etc.) together generated $13.8 trillion USD in revenue last year. So, it comes as no surprise that more than two thirds of business leaders feel their cybersecurity risks are increasing.

Despite this, organizations continue to exhibit dissonance between their perception of cyber-attacks as a top risk and their approach to managing it, with even fewer recognizing the value to be found in cyber readiness.

Today the savviest leaders understand that incorporating cyber security best practices into their operations not only provides added protection, but it gives them an edge, whether it is at the level of fund raising, securing the value chain, or increasing market access.

In this webinar, cyber security expert Iva Tasheva, co-founder of Brussels-based cybersecurity consulting firm CyEn, will share examples, tips and best practices to show what value can be gained from cyber security readiness, including:

Securing the deal in Mergers & Acquisitions

Obtaining partnerships and locking in the value chain

Increasing market access through compliance

Register for Vaultinum's next webinar on Unlocking Business Value Through Cybersecurity Best Practices

Upcoming Webinar: Unlocking Business Value Through Cybersecurity Best Practices

Although electronic timestamping is mostly used when electronically signing documents, as you will see today, it is useful in many other areas for proof and traceability purposes. Vaultinum, a trusted third party, regularly provides support to its customers through its reliable, adaptable and secure timestamping system.

I developed a software. How can I protect myself against possible appropriation by a third party? How can I prove that I developed it before a third party?

According to article L111-1 of the Intellectual Property Code, “the author of a work of the mind shall enjoy in that work, by the mere fact of its creation, an exclusive incorporeal property right which shall be enforceable against all persons.” In other words, and subject to fulfilling certain conditions such as originality, copyright protection exists from the moment a work is created and does not require any additional formality, contrary to a trademark or an invention. This remains true throughout the 179 signatory countries of the Berne Convention. 

In the absence of compulsory registration with an office, it can, however, be difficult to provide proof of the existence and the content of a digital creation on a specific date, that is to say before that claimed by a possible infringer.  It is therefore recommended to create a so-called “evidentiary repository” with a trusted third party such as a bailiff, a notary, or Vaultinum. 

Due to its technology involving the use of symmetric and asymmetric encryption algorithms, hash functions/fingerprint creation and electronic timestamping guaranteeing the integrity of the transmitted elements, the deposit made with Vaultinum: 

 materialises the content of the digital creation;

All preparatory documents necessary to file a patent application can also be filed.  Indeed, the procedure for filing a patent with a patent granting authority (such as the European Patent Office, the Federal Institute of Intellectual Property in Switzerland, the National Institute of Industrial (INPI) in France, the National Intellectual Property Office in China or the United States Patent and Trademark Office) is a long and complex procedure which very often responds to the rule of "first come, first served".  In this context, the evidentiary repository presents several advantages:

It limits the risks of appropriation of an invention by partners and/or third parties;

It affixes a date certain to ideas, projects, preparatory documents, etc. pending validation of a patent application;

It records the results of research (especially laboratory notebooks) as and when discoveries are made so as to preserve prior rights and ensure a fair distribution of rights between employees;

It proves that an invention kept secret was developed before a third party filed a patent on it, allowing the inventor to continue to use it (right of prior personal possession). 

In accordance with the GDPR, I use the email addresses of prospects to send them offers if I have their prior consent. I also delete this data three years as from the last contact with the individual concerned. In the event of a CNIL control, how can I prove my compliance with the GDPR?

In cases where the legal basis for processing is consent, the data controller must be able to demonstrate that the data subject has given consent to the processing of personal data concerning them.[1] 

In practice, compliance with this obligation can be complicated as the text does not specify how this evidence can be reported. It is therefore essential for the data controller to be equipped with a tool ensuring the conservation and traceability of the following elements: 

the information communicated at the time of consent; and

if applicable, the date of withdrawal of consent. 

On this point, the French Data Protection Authority (CNIL) indicated, in March 2017, that "the digital timestamping of the indication of consent (by means of a click or a ticked box) and the implementation of a procedure for obtaining consent, duly documented, must be considered as a valid means of establishing proof of consent”.[2] 

Vaultinum offers a reliable, adaptable and secure solution for timestamping and automated archiving thanks to its API. In addition, Vaultinum is a partner of CMP (Consent Management Platform) and as such, ensures the timestamping and, if necessary, the archiving of consent records. 

As a businessperson, I offer discounts on certain items sold on my e-commerce site. Regulations require me to justify the reference price from which the reduction is applied. How can I do this?

The authenticity of discounts offered during promotional operations is assessed with regard to unfair commercial practices (Article L. 121-2 to L. 121-5 of the Consumer Code). Price reduction announcements to consumers are governed by the decree of 11 March 2015.[3] Under article 2 of this decree, sellers are required to indicate, in addition to the announced price reduction, the reference price on the basis of which the announced reduction is calculated. 

Although professionals are free to determine the reference price of their choice (for example, regular price, competitors’ price, recommended price), they must be able to "justify the reality of the reference price on the basis of which the price reduction is announced”.[4]  To do this, they may use notes, slips, order forms, sales receipts, catalogues, advertising leaflets or any other documents; all the means of proof first set out in the circular of 7 July 2009 specifying the provisions of the decree of 31 December 2008 (repealed)[5].  However, these means are costly and difficult to execute, especially when price reductions are offered online and repeatedly. They also necessitate tremendous data collection and evidence-based archiving. 

With a view to limiting the impact of these regulations and simplifying the application of price reductions, professionals are recommended to use an automated timestamping tool to ensure the preservation, traceability and integrity of the following elements:

the chosen reference price (example: price applied by a competitor);

the location of the chosen reference price (example: a website page);

the date of application of the chosen reference price. 

The implementation of reliable and recognized means of proof to justify the reference price is all the more important as the General Directorate for Competition, Consumption and Fraud Control (DGCCRF) has for several years now, been closely monitoring online sales and particularly misleading price reduction announcements, as can be seen from its recent surveys.[6] 

Vaultinum provides support to e-commerce companies by offering them a turnkey solution for timestamping and archiving proof related to the applied reference price. Through this adaptable, reliable and secure solution, the e-merchant can connect to an API and thus manage thousands of data at a time, in an automated manner. 

An employee repeatedly logged on to sites expressly prohibited by the company’s IT charter. How can I prove this in a reliable way?

Whether human or technical, each action taken in an IT system is likely to leave tracks which must be recorded. These could be: 

successful connection to an application; 

attempted intrusions into the information system;

The National Information Systems Security Agency (ANSSI) emphasizes that event logs are an essential technical component to manage the security of information systems. However, these can serve as evidence only if the log files reliably connect certain events to a particular point in time. 

To ensure this reliability, events cannot be timestamped through sole use of the computer's internal clock, as this is easily falsified and deviates naturally over time. The ANSSI first recommends synchronizing the clocks of IT equipment with several internal time sources that are coherent with each other, themselves synchronized with several reliable external sources.[7] Secondly, a logging system must be set up in accordance with applicable regulations and the recommendations of the CNIL insofar as the main objective of logging is to allow the person or the equipment causing an event to be identified directly or indirectly. Finally, logs must be signed and timestamped as soon as they are created so as to ensure their integrity. 

As a large-scale distributor, I would like to ensure the traceability and transparency of some of my products of animal origin. How can I do this?

Following a number of scandals that testified to a lack of supply chain transparency in the food industry, regulation no. 178/2002 of 28 January 2002 introduced a requirement for food traceability at all stages of production, processing and distribution[8] in order to identify sources of contamination more quickly. 

The same question arises with regard to environmental protection.  Soon, food and product traceability will allow for the display of information on the environmental footprint of a product. 

 In terms of supply chain (agro-food, luxury goods, wine, pharmaceutical industry), electronic timestamping and, more generally, timestamping applied to "blockchain" technology (a chain of records allowing to keep track of a set of information, in a decentralized, transparent and secure way), has a real potential to ensure timestamping, traceability and control of the origin of a product.  

At every stage of the supply chain (producer, processor, distributor), a certain amount of information (dates, origin) concerning a food product, from its manufacture to its sale, will be recorded in a timestamped blockchain register. Depending on the case, the recording on the register could be done either by means of human intervention such as a photograph of the items, or automatically, through the use of connected sensors.[1]  Each actor in the supply chain can access the blockchain register to learn the identity of the person who first entered the information, the content of information itself (the integrity of which is guaranteed), and the date of registration of this information.  

And yet, blockchain has its limits.  Distributors and other importers need to protect their commercial networks and other trade secrets. The transparency of blockchain prevents this protection, but another solution exists. It consists of validation by a trusted third party by virtue of the presence of secure, timestamped register systems at each stage of the supply chain. 

In practice, a leading European brand has already chosen blockchain timestamping for its chicken industry. Each actor in the supply chain can enter and timestamp traceability information which is of interest to them, and which will, for the most part, be communicated to the consumer by means of a QR Code[2]. 

Vaultinum provides support to its clients in setting up a timestamping system to date the events registered throughout the supply chain. Using the Vaultinum API, client or blockchain systems can interface with Vaultinum’s timestamping solution and continuously and automatically timestamp thousands of events in a reliable, secure and adaptable manner.

6. Quality assurance and monitoring of document versions

To play it safe, my service provider has put in place a business continuity plan ("BCP") to manage force majeure or crisis situations. This BCP is essential for my business. It is updated every year. How can I be sure that the plan I have is the latest version and that it has not changed?

Business continuity plans (BCPs) have long been required by buyers of products and services.  These plans are generally tested and updated annually.  They are essential because they provide information on the measures taken to avoid service interruptions on the supplier's side, for example, in the event of unforeseeable events or natural disasters and, and in turn, on the buyer's side. As such, it is essential that tests and updates are timestamped and securely archived in order to maintain documentary evidence over time and ensure the legal protection of all parties concerned.

Vaultinum provides secure and reliable archiving and timestamping services.

Data and information are often submitted online and are sometimes used to generate positions, offers or assessments. In order to avoid any dispute related to the content of the information submitted and its date of submission, and to guarantee that requests are dealt with properly and within a given timeframe, content should be archived securely and with a timestamp token.

Vaultinum supports banks and insurance companies by offering them a turnkey solution for timestamping and secure archiving of online requests.  This adaptable, reliable and secure solution enables the automation of certified timestamping and secure archiving, thanks to the Vaultinum API. 

Invoicing has a number of consequences, particularly in terms of payment deadlines but also with regard to deadlines for taxes and other fees. How can I make sure that I can provide proof of electronic invoicing and the date it was issued/sent? 

The digitalization of invoicing processes promises significant efficiency gains and cost reductions. At the tax level, article L 102 B of the French Tax Procedure Code, amended by article 16 of the Amending Finance Law for 2016 allows taxpayers to digitize their paper invoices received and issued and to keep them in digitized format for the fiscal retention period of 6 years. The regulations specify that digitized invoices must meet two conditions; they must be secured to ensure their integrity, and they must be timestamped. Although the timestamp can be internal, a timestamp certified by a trusted third party or a qualified timestamp process is essential to avoid disputes, especially since the timestamping of invoices is also used to enforce payment deadlines and calculate late payment penalties. 

Vaultinum has developed an API to which clients can connect to obtain an automated certified timestamp of each document with the additional possibility of secure archiving.

With the digitalization of entire sectors of the economy, certified timestamping will become increasingly important in commercial relations since it will be the best way to demonstrate that an action has been taken. In addition, electronic timestamping does not only affix a date to a document, it also attests to the integrity of the content of the document it dates, which is a definite evidential advantage.

If you would like more information on the services offered by Vaultinum in the area of timestamping, you can contact the legal department at the following address: legal@vaultinum.com.

[1] Regulation (EU) 2016/679 of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC, art. 7.

[2]Commission nationale de l’informatique et des libertés, Consultation publique sur le règlement européen, mars 2017.

[3] Decree of 11 March 2015 relating to price reduction announcements to consumers.

[5] Circulaire du 7 juillet 2009 concernant les conditions d’application de l’arrêté du 31 décembre 2008 relatif aux annonces de réduction de prix à l’égard du consommateur, p. 6.

[6] Communiqué de presse, Pratiques commerciales des enseignes de vente en ligne : la DGCCRF a transmis à l’autorité judiciaire les conclusions de ses investigations concernant le site vente-privee.com, 10 janvier 2019.

[7] Agence nationale de la sécurité des systèmes d’information, Note technique – Recommandations de sécurité pour la mise en œuvre d’un système de journalisation, 2 décembre 2013.

[8] Regulation (EC) No 178/2002 of the European Parliament and of the Council of 28 January 2002 laying down the general principles and requirements of food law, establishing the European Food Safety Authority and laying down procedures in matters of food safety, art. 18.

[9] Etude réalisée par Blockchain Partner, Supply Chain, Traçabilité & Blockchain, 10 juillet 2017.

[10] Dalila BOUAZIZ, Carrefour lance la première blockchain alimentaire d’Europe, E-commerce mag, 6 mars 2018.

With the digitalization of entire sectors of the economy, certified timestamping has become increasingly important in commercial relations as it is one of the best ways to demonstrate that an action has been taken.  This article will explore the many areas where electronic timestamping is useful for proof and traceability purposes.

8 different situations where electronic timestamping is useful for proof and traceability purposes in commercial relations

8 good reasons to use electronic timestamping

Digital technologies ranging from artificial intelligence and the Internet of Things to data availability and blockchain continue to evolve at breakneck speed.  Not to be outpaced, cyber risks are evolving even faster.  The global cost of cybercrime in 2020 reached $945 billion, nearly double the 2016 figures.[1]  According to the research organization Cybersecurity Ventures, global cost is expected to grow by 15% annually, reaching $10.5 trillion per year by 2025.[2]

Companies must prepare for the new challenges brought about by the evolving targets, techniques and impacts of cyber crimes. This article will focus on the growing risks related to: the increase in ransomware incidents, the prospect of more disruptive and expensive business interruptions, the consequences of more robust regulation and litigation risks, the pervasive theft of intellectual property, as well as new impediments to successful mergers and acquisitions.

 The scale and scope of ransomware attacks are increasing at an unprecedented rate.  This is due to a combination of factors including the rapid rise of digitalization, growing use of cryptocurrencies, increased geo-political tensions, the extraordinary environment created by the pandemic, and improved schemes which have made ransomware even more profitable.  

Ransomware is a malware that infects computer devices and can lock down access to entire computer networks, effectively holding a business hostage until a ransom is paid.  

The malware often infiltrates a system’s servers by means of an innocuous email (‘phishing’) sent to an employee of the targeted company. The human layer is often the weakest link in cyber defense and is thus a ripe target for cyber criminals.  It is estimated that anywhere between 50% and 90% of data breaches are caused or abetted by employees.[3]  

The price of ransom is growing alongside the rise in use of ransomware.  The average ransom paid by companies based in Europe, the US and Canada nearly tripled from $115,123 to $312,493 in just over a year.[4]  This increase is due, in part, to new tactics employed by the cyber hackers that combines data captivity with threats to leak the data on public sites, a dual threat that leaves businesses with little to no recourse but to pay the ransom.[5] 

It is also due in part to the shifting of targets. Rather than targeting individual personal computers, cyber criminals are targeting public and private sector organizations of various size which enables an increase in both the ransom requested and the probability of successful payment.[6]

The threat of a ransomware attack is forecasted to only get worse with the growing use of the “franchise” model adopted by cyber criminals, whereby malware is leased on the dark net to so-called affiliates in a ransomware-as-a-service scheme with the lessors earning a royalty, thus making sophisticated ransomware more widely available and profitable.[7] 

Whether or not a cyber incident leads to a ransom payment, the costs associated with any resulting business disruption far exceeds the amount demanded.  In fact, these costs can be anywhere from five to 100 times greater than the cost of a ransom itself, often inciting businesses to pay the ransom just to avoid the costs of disruption.[8] 

Business disruption is the income lost when a resource cannot be used or a service cannot be provided leading to lost sales, reduced efficiency, increased spending related to the cyber incident (recovery of IT systems, damages paid out to clients, etc.)  and reputational damage.  

While larger companies are usually better positioned to sustain the losses brought on by business disruption, it is small to medium enterprises (SMEs) that suffer disproportionately when they find themselves the victims of a cyber attack.  

It is estimated that 45% of online attacks target SMEs.[9]  Unlike larger companies, SMEs have limited or even non-existent cyber defenses or hygiene.  For businesses of all sizes, the average cost of disruption is around $200,00o; for SMEs this cost can be insurmountable, with 60% of SMEs going out of business after being victimized.[10]

As for paying a ransom to avoid the costs of business disruption - paying doesn’t guarantee full recovery and it certainly doesn’t eliminate all the business disruption costs associated with ensuring that every machine is infection free. Moreover, the payment of ransom does not guarantee that a company’s data will be returned whole.  The cybersecurity firm Sophos found that ransom-payers got back only 65% of the encrypted data on average, leaving more than a third inaccessible.[11] And even if the data is returned, there is no guarantee that it has not been copied for future use, sale and/or blackmail.

While many businesses rely on business interruption and property insurance to help offset the costs of cyber incidents,  increasingly insurance companies are relying on the “act of war” clauses to shield them from payouts.  The high profile NotPetya ransomware attack and the resulting lawsuit against Zurich American Insurance for its denial of coverage under it’s ‘act of war’ exclusion policy demonstrates that cyber insurance cannot be considered a replacement for cyber security.[12]

In addition to the risks related to business disruptions and ransom payments, companies also are confronted with increasing potential liability if they are found to not have complied with the laws and regulations in force in the countries in which they operate or if they are found to have been negligent, not exercising due care to limit cyber risk.  

In Europe, the General Data Protection Regulation (GDPR) implements fines for businesses if they do not follow data protection guidelines or data breach reporting requirements.  Businesses risk being fined, the greater of, up to 4% of their annual global revenue or 20 million Euros if they violate the regulation.[13]  

The implementation of the GDPR has already led to an increase in claims notifications. According to the law firm Pinsent Manson, between March 2019 and May 2020, a total of 190 GDPR fines were issued by European data protection authorities, with a value of almost $500 million.[14] Notable large fines for violations include $57 million for Google in France  and $41 million for H&M Germany.[15]

From Europe, to the US, and to the world over, data privacy regulations and mandatory breach disclosure laws vary widely, making legal due diligence across markets essential for businesses, and in particular, multinationals.  The hotel group Marriott and credit score agency Equifax suffered highly publicized data breaches in 2018 and 2017 respectively, and were subject to numerous lawsuits and regulatory actions in multiple jurisdictions with Marriott facing a $130 million fine in the UK alone for the breach.[16]   

Given the pervasiveness of  data breaches, companies are treating them more and more as another cost of doing business.  This, however, is not at all the case with data theft concerning intellectual property (IP), which is seen as one of the greatest threats companies yet face.  

While the theft of IP has been around as long as IP itself, the latest developments in cyber espionage and theft should have companies worried.

Cyber hackers are increasingly relying on Advanced Persistent Threats (APTs), where access to a system can remain undetected for an extended period of time with the goal of stealing data or penetrating a network.  APT attacks are often intended to steal sensitive intellectual property or data for political or economic gains.[17]

In the early months of the pandemic, hackers targeted the World Health Organization by infiltrating its networks with the APT known as ‘Dark Hotel’; an effort to steal sensitive information relating to Covid-19.[18]  The health care industry and more recently, vaccine research, are highly targeted because ultimately their IP is highly valued. 

Yet, in some cases the theft of IP is meant to steal a competitive advantage, hijack new technology and trade secrets and cause hundreds of millions of dollars in R&D investments to be lost.  This was the case for chip-maker AMD, where attackers stole and leaked the Xbox Series X graphics source code.

In all cases, the impact on revenue streams from IP theft by cyber intrusions may lead to reduced R&D efforts and an increase in the cost of capital if the IP is seen by investors as not sufficiently protected.[19]  

RISKS TO MERGERS & ACQUISTIONS      

Mergers and Acquisitions (M&A) are fertile ground for cyber criminals providing them with both short and long term opportunities.  

In the short term, with business operations in transition, data is more vulnerable and at higher risk of being targeted.  In the long term, M&A transactions serve as a prime opportunity to infiltrate the merging or acquired company’s networks, often by the employ of APTs, in an effort to ultimately gain access to the targeted company’s environment and information over an extended period of time.

The threats facing M&A highlights the importance of conducting cyber due diligence at the pre-acquisition phase.  Indeed, more than 50 percent of companies surveyed by IBM wait until due diligence is completed before they perform cybersecurity assessments of M&A transactions.[20]  

While a company may have state of the art cyber security, if it acquires a company with weak security or existing vulnerabilities it could be liable for any damage from incidents that occurred prior to the merger, as seen in the data breach of the hotel group Marriott.Although the data breach was discovered in 2018, it was traced to a cyber intrusion that occurred in 2014 at Starwood, a hotel group that it acquired in 2016.[21] Had Marriot conducted cyber due diligence during pre-acquisition, this vulnerability could have been discovered and/or measures could have been taken together with a revised valuation.Further, acquiring a company that may have vulnerabilities may amount to integrating a trojan horse.

BUILDING CYBER RESILIENCE: KNOW YOUR SOFTWARE

Despite these challenges and the fact that being a victim of cyber crime is becoming more a question of when rather than if, most organizations do not have a plan in place to both prevent and respond to cyber security breaches.[22]  

Figure 1. Proportion of organizations that have a plan to prevent and respond to IT security incidents. Source:  McAfee, “The Hidden Costs of Cyber crime”

The importance of having a solid cyber risk management program cannot be underestimated.  Every day new technical and security breaches are discovered.  Every business change can create unintended vulnerabilities.  Every new employee, consultant or contractor is a new risk that needs to be managed. A hacker only needs to be successful once, while a company’s security measures must be successful 100% of the time -  in an ever-changing threat landscape.  The regular undertaking of cyber security audits, evaluating their results and researching and implementing improvements is thus an essential, and never-ending, process that should be adopted by all organizations that take cyber risk seriously.  

Vaultinum, a Swiss based digital solutions company, has developed an intelligent auditing tool that enables companies to conduct their own due diligence in cybersecurity, examining an organization’s security risk management program, data protection procedures, security certifications,  and office, equipment and infrastructure protections.  The Know Your Software solution is a self-assessment questionnaire developed by leading experts in cyber security with the aim of helping companies improve their cybersecurity awareness, mitigate risks and put in place recommended policies and procedures based on industry standards in order to help prevent cyber incidents from occurring and building resilience in the face of one.

[1] Smith, Z.M., Lostra, E., Lewis, J.A. (2020). The Hidden Costs of Cybercrime. McAfee.

[2] Morgan, Steve. “Cybercrime To Cost The World $10.5 Trillion Annually By 2025”. Cybercrime Magazine, 13 Nov. 2020

[3] Dobie, G., Whitehead, J. (2020). Managing the impact of increasing interconnectivity: Trends in Cyber Risk. Allianz Global Corporate & Specialty.

[4] Sroxton, Alex. “Average ransomware cost triples, says report”. Computer Weekly.com, 17 Mar. 2021

[5] Singleton, C. (2021). X Force Threat Intelligence Index 2021. IBM Corporation.

[6] (2020). Internet Organized Crime Threat Assessment 2020. Europol. 

[7] Morgan, Steve. “Cybercrime To Cost The World $10.5 Trillion Annually By 2025”. Cybercrime Magazine, 13 Nov. 2020

[8] Riley, Tonya. “The Cybersecurity 202: Global losses from cybercrime skyrocketed to nearly $1 trillion in 2020, new report finds”. Washington Post, 7 Dec. 2020

[9] Steinberg, Scott. “Cyberattacks now cost companies $200,000 on average, putting many out of business”. CNBC, 13 Oct. 2019

[10] Steinberg, Scott. “Cyberattacks now cost companies $200,000 on average, putting many out of business”. CNBC, 13 Oct. 2019 

[11] Bajak, Frank. “Ransomware gets paid off as officials struggle for fix”. Associated Press, 22 June 2021 

[12] Garrie, Daniel; Rosen, Peter. “'Act Of War' Questions In Cyberattack Insurance Case”. Law 360, 23 April 2019

[13] EU General Data Protection Regulation (GDPR): Article 83, Section 6. 

[14] Dobie, G., Whitehead, J. (2020). Managing the impact of increasing interconnectivity: Trends in Cyber Risk. Allianz Global Corporate & Specialty.

[16] Dobie, G., Whitehead, J. (2020). Managing the impact of increasing interconnectivity: Trends in Cyber Risk. Allianz Global Corporate & Specialty.

[17] Adam, M. “Cyber Risk in a new era: insurers can be part of the solution”. S&P Global Ratings, 2 Sep 2020

[18] Seals, T. “Hackers amp up Covid-19 IP Theft Attacks”. Threat Post, 28 Dec 2020 

[19] Smith, Z.M., Lostra, E., Lewis, J.A. (2020). The Hidden Costs of Cybercrime. Center for Strategic and International Studies.

[21] Brewster, T. “Revealed: Marriott's 500 Million Hack Came After A String Of Security Breaches”. Forbes, 3 Dec. 2018

[22] Smith, Z.M., Lostra, E., Lewis, J.A. (2020). The Hidden Costs of Cybercrime. McAfee.

Despite more global recognition of the magnitude of cyber risks, such as the increase in frequency and cost of ransomware incidents and the consequences of more robust regulation and litigation risks, many organizations have not taken the necessary steps to create and/or adapt their cybersecurity policies in the face of these new threats.  Companies must prepare for the new challenges brought about by the evolving targets, techniques and impacts of cyber criminals. 

Find out more about the importance of cyber security audits to protect your company from the dangers of cyber criminals.

All across Europe, we are witnessing astonishing levels of growth within the tech sector, thanks to business decision makers increasingly making this area a priority for their investments. In fact, the UK is one of only three nations worldwide to have created more than 100 tech unicorns (1) – private companies valued at over $1bn. 

This means that there is no time like the present for investors and businesses to stop and reconsider their approach when it comes to reducing investment risk in tech deals.

When it comes to risk prevention, it’s a common practice for investors to concentrate their efforts on financial, legal, and operations throughout their due diligence processes, but they leave a lot to be desired when it comes to protecting themselves from software risks. Given that software is a primary asset of almost every investment in the tech sector, this is an area of focus that should be much more of a priority for investors in their overall due diligence process. 

More often than not, when tech due diligence is carried out, it tends to be implemented manually by non-experts, which then leads to an analysis which is far from comprehensive. As a result, a thorough assessment of the use of open source software of the company is lacking, which can then pose some significant risks.

In this article, we will outline exactly how inadequate open source vulnerability management can put your investments at risk and how investors can mitigate these risks in the most efficient way- through the use of an open source vulnerabiltiy scanner.

Vaultinum’s Tech Due Diligence Checklist

Open source software is software that developers can inspect, copy, modify and redistribute. This is different from application software, which is designed for end-users and does not allow developers to adapt it in any way (such as Skype or the Microsoft suite).

A huge part of the open source community is how it operates on shared values when it comes to collaboration, and it is because of these values that popular software developing website GitHub witnessed a 35% increase in the number of code repositories created in 2020 compared to the previous year. The reality is that the use of open source software can almost be considered a necessity for developers in this day and age, as fast development is essential for businesses to achieve an increased market share and gain a competitive edge.

For reasons such as these, there are many benefits to integrating open source code within the code repositories of commercial software, so let us reiterate that it certainly should not be viewed with fear by business leaders and investors.  For starters, open source code is less likely to become obsolete than in-house developed code, as developers can always rely on the support of the strongly connected open source community when it comes to the need for updates or bug fixes. That very same community can also enable organisations to overcome hiring complications and save money, as they can always work with open source developers as an alternative. 

But there’s one catch: investors will not be able to take advantage of these benefits on a long term basis if their open source vulnerability management is not thorough enough- which is often the case. 

Intellectual Property Licence Restrictions- a Threat to your Investments? 

Open source licencing can be complex, but when looking at the intellectual property side, investors need to be particularly aware of highly restrictive licencing that can come with particular code. Copyleft, or ‘non-permissive' licences, require that the redistribution of the software must be done under the same terms as stated in the original open source licence. The most commonly used copyleft licence that you must look out for is the GNU General Public Licence (GPL). 

This licence is considered as strong copyleft as it applies to modifications made to the open source code originally licenced under the GPL and also to any work that is then derived from GPL code. As a result, even if a developer uses a few lines of this GPL code, it means that their entire code base is then bound by GPL terms. If organisations choose to use code bound by restrictive licences like the GNU GPL, they must do so with the understanding that their intellectual property could in fact be at risk. 

Software Copyright Infringement- Hancom Office

In 2013, they built an open source PDF interpreter called Ghostscript into their word-processing software. Unbeknown to Hancom, Ghostscript was bound by the GNU GPL, so according to the licence's terms Hancom should have made its entire app suite open source and in effect lose its IP rights. Hancom did not provide the source code to their product (and did not elect to purchase a commercial license), which then put them in conflict with the license that Ghostscript is distributed under.)

In 2017 Artifex filed a lawsuit (2), which resulted in the US District Court ruling in Artifex's favour (3). The exact terms of this settlement of course remain confidential, but it is fair to assume that Hancom will have suffered significantly in terms of finances, reputation and its intellectual property rights. Had they have used an open source vulnerability scanner prior to implementation, this would have been reported and the situation could have been avoided.

Let’s Talk Open Source Software Licencing

Even when not as strict as the GNU GPL, all open source licences need to be carefully reviewed by businesses, so that they are fully aware of the restrictions that they must comply with. All open source licences share common principles inscribed in the ‘essential freedoms' of the open source movement, meaning that they are free to use, run, study, modify and redistribute open source software for any and all purposes. But there are so many different types of licences out there, so one piece of open source software can be very different from another. 

Differing from the hard copyleft of the GNU GPL licence, there also exists permissive licenses such as the BSD licence, the MIT licence, and Apache Licence v2.0. These licences maintain the ‘essential freedoms' of the open source community, but do not demand that these are upheld in derivative works. This means that with a permissive licence, developers are free to integrate open source software into their wider codebase without any consequences and can distribute the full software under separate licencing terms- something that is not possible with more restrictive licences. 

Due to the wide diversity of open source licencing out there, it’s standard practice that businesses should continuously monitor and assess the various open source code that is used by their developers, as part of their open source vulnerability management., in order to make sure they do not run into any unwanted non-compliance issues. 

DISCOVER VAULTINUM'S TECH DUE DILIGENCE SOLUTIONS

How to Improve Open Source Vulnerability Management.

In the pre-acquisition phase investors must ensure that they implement comprehensive software due diligence which includes an analysis of the open source licencing restrictions that come with a piece of software.  The most in-depth audits tend to use a open source vulnerability scanner, which is able to scan every line of code, combined with a review by experts, to ensure that any use of open source software is identified and assessed accordingly. 

Vaultinum's Open Source Vulnerability Scanner    

Vaultinum’s Know Your Software Tech Due Diligence offers a source code scan which acts as an open source vulnerability scanner. This reviews both the code itself as well as the business’ internal operational and development processes (such as their open source management strategy) in order to reduce and avoid any possible risks in the future.

Secondary to this, users also receive a self-auditing series of questionnaires that offers Cybersecurity, Intellectual Property, Operations, and Third-Party Software assessments.

The results of the online assessment and code audit are then reviewed by our IT experts, who adapt the recommendations to the context of the business. The report includes clear findings, illustrations, an estimated time of fix.

Speak to us today and find out more about how Vautinum’s Know Your Software Tech Due Diligence assists investors with their open source vulnerability management, giving them the reassurance needed to make informed decisions.  

(1) https://technation.io/news/tech-unicorns-dont-appear-by-magic

(3) https://www.linux.com/topic/open-source/artifex-v-hancom-open-source-now-enforceable-contract

All across Europe, we are witnessing astonishing levels of growth within the tech sector, thanks to business decision makers increasingly making this area a priority for their investments. This means that there is no time like the present for investors and businesses to stop and reconsider their open source vulnerability management.

Discover the importance of an in depth vulnerability scan when it comes to OSS risks

Reduce Your Investment Risk With an Open Source Vulnerability Scanner

It’s a cautionary tale for investors everywhere.  

The case of Theranos and its founder  Elizabeth Holmes— who at one point was named the world’s youngest billionaire- has been examined numerous times in books, podcasts and documentaries.

The Silicon Valley start-up raised $945 million during its lifespan from various investors, despite having a blood-testing technology that did not perform as promised. When Theranos eventually shut down in 2018, the investor money of course disappeared along with it.  

With the Biotech start-up now featuring as the subject of new Hulu series "The Dropout”, questions around the technological due diligence have started to circulate again. Did investors perform sufficient due diligence? Did they not know what to look for? Or was it normal for Theranos to keep their cards so close to their chest when it came to their technology and data? 

In recent years, the pace of technological innovation has unquestionably been transforming entire sectors of the economy at a rate never seen before. Indeed, in global M&A deals, technology continues to ‘eat the world’ as shown through a record breaking 133% increase in 2021. With the technology sector now making up 20% of M&A deals, with private equity backed M&A reaching $839.6 billion, 2021 was the biggest year for private equity since record keeping began. 

With deals getting bigger and heightened competition causing them to move faster, the time for thorough IT due diligence can often slip away from investors. In fact, it was during a boom time for VC back in 2014 that Theranos quickly raised $633 million from investors who were keen to get a piece of what US President Joe Biden claimed to be ‘the laboratory of the future’.  

Theranos was a consumer healthcare technology start-up that promised a revolution in blood testing by claiming that with one simple drop of blood, their technology could derive 100s of diagnostics and offer fast results at the fraction of regular lab costs. Naturally, this Silicon Valley “unicorn” started to get everyone talking and its founder Elizabeth Holmes was labelled as the next Steve Jobs and named by TIME magazine in 2015 as one of the “Most Influential People in the World”. 

During a time when technological innovation was beginning to unquestionably transform entire sectors of the economy at a rate never seen before, Theranos exemplified that dynamic. The company soon had investors falling at their feet and indeed raised $945 million from famous venture capitalists including Tim Draper, Donald Lucas and Dixon Doll as well as from powerful tech and media moguls such as Larry Ellison and Rupert Murdoch. 

Furthermore, US grocery store giants who had recently moved into prescription drugs and vaccine provisions saw Theranos’ offering as a golden ticket. What could be more convenient for their customers than to come into the store, do a finger-prick blood test, buy their groceries, and pick up their results on the way out? For Safeway and Walgreens, this was a sure-fire way to boost sales and profits. Safeway soon signed a contract with the blood-testing start-up and spent nearly $400 million on the deal. Around the same time, Walgreens also invested $140 million in Theranos, $100 million of which was an “innovation fee.” 

At the time, Walgreen’s chief financial officer Wade Miquelon spoke to the supermarket giant’s CEO about how he thought they “may have found the lead pony” among companies that offer diagnostic tests. However, both companies did little to vet the technology for reliability or accuracy and these kits, that promised to deliver results in 20 to 30 minutes, would in reality take three to five days. 

Despite the rush to get a piece of Theranos, it was revealed that many top venture capital firms actually turned down opportunities to invest because of the company’s insistence on secrecy. Claiming that it was due to intellectual property concerns, Theranos never shared proof with investors that its technology worked or indeed that the results that it produced were accurate.  

So here raises the question around investor due diligence: Could the investors have avoided disaster if they had simply done better due diligence into the technology being proposed by the blood-testing start-up?

Performing Effective Investor Due Diligence 

Actual falsehoods around the claims of a technology, like demonstrated in the case of Theranos, are rare. But underlying issues and weaknesses within the technology of a company are not. This is why behind every successful M&A tech deal, there needs to be in-depth evaluations of the technologies and frameworks in place.  

This kind of due diligence is imperative, because with the promise of innovative change, investors find themselves faced with new and emerging risks that come with the technology, such as software failure, software copyright infringement, data breaches, privacy disputes, widening regulation, open-source software Intellectual Property issues, cyber-threats, among a myriad others.  

Given many recent high-profile losses connected to seemingly careless start up investments, technology due diligence seems to be on everyone’s radar right now. However, it has been around for a while, just usually in the form of traditional audit firms sending in experts to interview IT departments to review the softwareThis may have been acceptable practice 10 years ago, but today, when one single smart car requires over 150 million lines of code compared to just 7 million lines for the 787 Dreamliner, it is simply impractical to review all the lines of code, time intensive and the risk of human error is too high. 

Performing Technology Due Diligence with Vaultinum 

As a trusted third party, specialised in the protection and audit of digital assets, Vaultinum’s tech audits have already saved investors time, money and potential reputational damages. In our experience, more often the issue is less about ‘technology that isn’t there’ but more about the quality of the technology itself. This is why we created the Know Your Software Tech Due Diligence solution. 

Vaultinum’s Know Your Software Tech Due Diligence is an online solution for software due diligence that helps businesses and tech investors mitigate risk, gain crucial knowledge of a firm’s technology and increase the value of the software asset.

More about Know Your Software Tech Due Diligence

Know Your Software Tech Due Diligence is a tool that reviews both the actual code and the internal operational and development processes to help investors reduce and avoid risks. This is done through the following combination: 

1. The Know Your Software Online Assessment 

An online self-audit which analyses Intellectual Property, Cyber Security and Resilience, Third-Party software management, Software development, Product operations & Environment.  

An in-depth software source code scan providing a thorough risk analysis of the software asset, which is then evaluated by our IT experts. 

With Vaultinum’s Tech Due Diligence solution, investors receive a report that includes actionable recommendations made by our IT and Legal experts, giving them the in-depth information needed to decide whether to invest, to walk away from an investment or to negotiate better terms. Furthermore, these recommendations for improvements can help increase the value of the software, thereby increasing the value of the newly acquired company in the long-term. 

What can we learn from the Theranos case? 

In conclusion, for companies seeking investments, it’s integral that they are open to validation in the form of a technology audit with a trusted third party, in order to provide data that proves that their technology has been checked and verified. 

But ultimately, technological due diligence remains the responsibility of investors, as without the correct approach, they’re relying solely on the credibility of the organisation and in turn, risk investing in products or technology that could ultimately be proven unsound. 

Speak to us today to find out how we can assist you in your technical due diligence. 

Theranos promised to revolutionise blood-testing with it's breakthrough technology and at one stage, the company was valued at $9 billion. However, this technology wasn't all it promised to be and investors collectively lost $700 million.  Could they have avoided these consequences if they had simply done better due diligence into the technology being proposed?

Discover the importance of an indepth technology due diligence as we delve into the case of Theranos.

Theranos: A Reminder of the Importance of Technical Due Diligence

Industry Reports

Download an example of our Know Your Software - Tech Due Diligence Report and learn how our technology due diligence solution works in practice.

Know Your Software Tech Due Diligence Report Sample

Click the button below to download your copy.

Download a real example of our full tech due diligence report

FAQ