Theresa Campobasso and Clinton West on Insider Risk, IP Theft and Investor Diligence

A former U.S. Marine Corps intelligence officer and a former CIA supply chain risk leader returned to Open Door Salon together. They talked about how research walks out of life sciences companies, and what boards and investors miss before it does. Theresa Campobasso is chief strategy officer of Reinaert, a veteran-owned security and logistics firm, and Clinton West is its president of supply chain security and logistics operations. With host Lori Ellis they worked through an alleged insider case, why stolen-research lawsuits so rarely succeed, the diligence most deals skip, and what a breach at a venture firm exposes.

What does the Beam Therapeutics lawsuit allege?

In September, Beam Therapeutics sued YolTech Therapeutics, a Shanghai gene-editing company, and its U.S. partner Serapha Bio. Beam alleges that a former scientist opened dozens of records outside her normal work, at night and on weekends. She then left, and about five months later filed patent applications in China that Beam says were built on its trade secrets. Serapha Bio has denied the claims, and YolTech’s chief executive has said the company built its technology through its own research. Nothing has been decided in court. Lori asked the guests what that pattern looks like from a counterintelligence seat, and when a company should notice it.

Which signals could catch insider risk earlier?

Campobasso framed the case as a research security problem: the collaborative culture of science makes it hard to set the right security posture without slowing the work. She described three places where an intervention could have come sooner:

What we’re looking at right now is we see maybe three different aspects of insider risk behavior where an intervention could have caught it a little bit early.

The first is personnel vetting: knowing the network of relationships and affiliations of everyone with access to your systems and facilities. The second is the digital pattern of behavior, the online version of the badge records a security team already reads:

If somebody’s accessing files that they don’t really have a need to know, or they’re accessing files outside of the typical hours, just like we can do with badge records and their physical activities, we can look at that digital pattern of behavior as well.

None of these is a smoking gun on its own, she said. Each is a chance to ask the question and act before a loss happens.

Why does the patent race matter?

The third signal is the patent filing itself. Campobasso estimated that the U.S. patent process can take about two years and is heavy with compliance, while some other countries move faster:

So if you have that access and you’re able to take it through another country’s patent process quicker and get to the finish line quicker, then you technically win that patent race.

Our earlier post on the routes intellectual property usually takes out of a company, drawn from her first conversations on the show, covers the patent route alongside two others.

West reached for the question his former agency asks first:

In my world of almost 30 years in the agency, if somebody gets access to information that they probably shouldn’t have, or there was a misstep, the first question somebody asks is, did that person have the need to know?

Why are IP theft cases so hard to win?

Because the evidence is rarely conclusive and the case can cost more than it recovers. Campobasso said damning-looking indicators can have ordinary explanations, such as a manager approving weekend work. In counterintelligence cases, some evidence is too sensitive to argue in open court:

Oftentimes they can’t even make it to court because … the content of the case is either so sensitive or in some cases classified and you can’t actually litigate it openly.

Private companies face a version of this, she said, because proving theft can expose more proprietary work. Then there is valuation:

A lot of times folks we see do not want to engage in open litigation because they’re afraid that their startup value or their research value will be reduced to near zero depending on the outcome of that litigation.

She credited Beam for going public, because a named case teaches others what to look for. West added that a government investigation may already be running:

Tipping your hand too early can be a bad thing.

He also pointed to cost:

Some of these small biotech companies don’t have the money to go after litigation and they just have to eat that cost and they’re not going to bring that up and they’re just going to move along.

West said reporting a cyber breach to the government once felt like an admission of failure; today the government thanks a company and offers help, and biotech is heading the same way. Our earlier post on why smaller biotechs hold the science attackers want covers the same exposure from the cyber side.

What diligence do deals skip?

Lori asked what diligence an investor or acquirer skips when licensing an asset from a Chinese developer. West started with the objective. Vetting one person is a hub with a few spokes, he said; vetting a company turns those spokes into hundreds or thousands of information assets. Then he would examine the existing process, add a tool that fits it and drive the mitigation.

Lori then raised a case she had heard more than once. A Minnesota medtech company said its lead investor, a Hong Kong-listed pharma company, held back promised capital and blocked U.S. investors, then partnered with a Chinese competitor. Campobasso called the pattern economic statecraft:

This is very much a behavior that we see in what we would consider kind of economic statecraft leveraging capital to perhaps achieve political or geopolitical ends.

She noted that the behavior is not unique to China, and that the United States uses capital the same way at times. Her fix is a wider diligence frame:

For years and years and years, mergers and acquisitions, corporate investment, anybody who was doing corporate diligence really only looked at four categories. It was like legal, financial, reputational, regulatory.

Beyond those four, she would look at the network of entities that could influence a company’s behavior, including its board, its hiring and its past conduct:

How has this company behaved in the past? Maybe who’s on their board of directors and what affiliations do those individuals have?

West’s advice for a company that does not know where to start is to keep the first step small:

One of the things that we’ve seen to be something that companies can swallow early on is just doing what we call a sprint.

A sprint looks at a company’s top 10 or 15 first. Some findings take a week to fix; some take years. Mapping risk below the first tier is the subject of Campobasso’s earlier guide to mapping sub-tier supply chain risk.

What does a breach at a venture firm expose?

Lori raised a risk she rarely hears discussed: a breach at a venture firm or one of its portfolio companies can expose the diligence files on every company the firm reviewed. Campobasso said companies rarely share what left the building unless the law requires it:

Once that data has left your control, there’s really nothing you can do to get it back, right?

An attacker can use it to tailor the next approach, such as a spear phishing campaign.

West’s first steps are to lock the systems down and rebuild the diligence process, then tell the investors:

The only way to stop that is one, to be upfront with your investors, really have a threat-based approach.

He would brief them on what happened, how it will be prevented and the mitigation options. Our earlier post on what an attacker can do with a venture firm’s diligence files goes further into that exposure.

How should companies read the mixed signals from Washington?

Lori noted that the House Select Committee on China has catalogued risks from China while Treasury reports suggest it may allow some of those assets in. West called that tension between the branches healthy. Campobasso said a company’s time is better spent on what it can act on now:

I think what’s better to do is focus on things like 1260H compliance.

Section 1260H requires the Defense Department to publish its list of Chinese military companies. West said the 2027 defense authorization bill, which he hopes passes soon, carries additional safeguards.

What did these careers ask of them?

Campobasso began as a Marine Corps intelligence officer drawn to counterintelligence, which at the time meant people:

I never really envisioned getting into the emerging technology side of the house.

West traced his own path from moving cargo in Somalia to a field that is now built around telematics, drones and cyber threats:

However, if you go 30 years to today, it becomes much more tech heavy.

Campobasso’s earlier episodes cover the regulatory wave reshaping China biotech deals and why the BIOSECURE Act will not protect pharma from China. West’s earlier episode covers cyberattacks and a closed Strait of Hormuz.

This page is drawn from the recorded, on-the-record conversation on Open Door Salon; quotes are lightly edited for clarity, and the full episode is the record.