Information and Knowledge Leakage in Supply Chain

Abstract

The current world of post industrial value generation sees companies increasingly analyzing their internal operations against their external organizations to identify supply/demand fluctuations along the supply chain. Within these integrated relationships between internal and external parties in the supply chain, knowledge and information have become very important production resources. The existence and success of an increasing number of organizations strongly depend on their capabilities to utilize knowledge and information for profit generation. By managing more efficient information sharing, the volume of company confidential information passing through the supply chain increases, and this brings about more incidences of knowledge leakage and information leakage. A survey by PricewaterhouseCoopers in 2014 shows information security spending over the next 12 months would increase 60.27 % in Asia and 48.98 % in all regions. This emphasizes the importance of information privacy and therefore the necessity to study the information and knowledge leakage in integrated supply chain. The objectives of this study are to investigate the factors triggering information and knowledge leakage and create a mitigation framework to soften the impact of leakages on performance. The above objectives will be met by formulating and examining several hypotheses of a conceptualized information leakage (IL) and knowledge leakage (KL) framework. A case study derived from a structured interview is adopted as a methodology in this research. As a result, this paper contributes a novel theoretical model that characterizes information and knowledge leakage in an integrated supply chain. Therefore, it also adds new knowledge of managing information and knowledge leakage to supply chain management.

1 Introduction

Businesses in the past decade have been experiencing rapid globalization due to extensive global sourcing, outsourcing and business diversification, and such revolutionary development have intensified supply and demand uncertainties which directly raise business operating costs. Shorter product life cycles and escalated customers’ expectation adds complexity to the business environment (Arushanyan et al. 2014). In many cases, the ability of businesses to survive such upheavals depends on an efficient material and information flowing from upstream to downstream of the supply chain in the rapid exchange of crucial information. Without an efficient supply chain management, organisations could be marginalised by dominant market players. Therefore, many companies have placed great emphasis to enhance the integration and collaborative efforts with different supply chain counterparts to increase visibility across their businesses.

In overcoming emerging problems from the changing business structures, several supply chain strategies have evolved. These range from improved information and knowledge sharing network (Bian et al. 2014; Sicari et al. 2014; Barkataki and Zeineddine 2013; Gao et al. 2013; Tse and Tan 2011; Davenport and Prusak 2000) through strategic supply chain integration practices (Frohlich and Westbrook 2001; Zhao et al. 2008; Flynn et al. 2010) to the extended enterprise (Owen et al. 2008; Spekman and Davis 2004). In adopting these collaborative strategies to support businesses, companies might however become exposed to greater supply chain risks. With more efficient information and knowledge sharing among firms, the volume of company confidential information passing through supply chains increases which would bring about greater incidences of knowledge leakage. In addition, Anand and Goyal (2009) discovered that the necessity to exchange proprietary information with others compromises the organizations’ ability to contain information.

Information leakage is defined as data that is leaked intentionally or unintentionally to an unauthorized party (CWE 2008). Leakages of confidential information from organizations are frequent fodder for the media. Negative media coverage can hurt the reputation and financial performance of businesses. Putting the unavoidable published news aside, the reality is, many organizations have unwittingly leaked confidential information. Similarly, these information and knowledge leakages are causing firms to lose competitive advantage in their respective fields. For businesses that thrive through inter-firms information and knowledge flows, their lack of awareness and skills in handling information and knowledge leakages, or even the inability to identify the causes of the problem is downright distressing.

Information leakage in real world occurs in a variety of situations. Some companies are highly dependent on a specific group of knowledgeable workers to achieve company objectives. Organizations doing research and development (R&D) and those in software development are particularly dependent on these talented people for breakthrough inventions. The movement of this niche group of experts from one company to another potentially causes knowledge leakage. These employee migrations could severely disrupt business daily operations if no substitutions are available (Mohamed et al. 2006). The use of temporary and contract workers also increases the possibility of unintentional knowledge transfer to third parties and makes them attractive in the market. Businesses could gain superior competitive advantages with the critical knowledge leaked from their service providers. Literature is filled with the importance of information and knowledge sharing in integrated supply chains in their effort to cope with globalization. Most researchers have reported on the positive impact of information (Nonaka and Takeuchi 1995; Lee 2004; Ryu et al. 2009; Flynn et al. 2010) and knowledge sharing (Easter-Smith et al. 2008; Yang 2011). Frohlich and Westbrook (2001), for instance, conducted an excellent study on the effect of different arcs (degree) of integration on firms’ performance and Flynn et al. (2010) acknowledge that strategic integration measures and inter-firms interactions could boost the firms’ operational and business performances.

However, when integration measures are not implemented appropriately, information and knowledge leakage could occur in the supply chain (Li et al. 2002; Zhao et al. 2002; Dye and Sridhar 2003; Anand and Goyal 2009) with recipient firms benefitting from such crucial information and knowledge from business rivals. The objective of this paper is to conceptualise an information and knowledge leakage theoretical model and formulate hypotheses relating supply chain integration to information leakage (IL) and knowledge leakage (KL). These hypotheses will be evaluated using evidence gathered from the multiple interviews described in the later part of this paper. This paper will also investigate the factors triggering IL and KL and suggest mitigation measures to soften the impact of leakages on performance. The findings from this paper are particularly beneficial to the area of information management (IM) and knowledge management (KM) in the supply chain management (SCM) field.

This paper will proceed in the following manner. The next section reviews the literature of the variables in this study followed by the development of hypotheses. The third section presents the methodology; the fourth section presents the data analysis. The discussion section is presented in the fifth section and the final section presents the conclusions.

2 Literature review

In this section, we discuss the literature for information and knowledge leakage (IKL), followed by the development of hypotheses for testing in this research.

IKL can occur intentionally or unintentionally according to past research (Frishammar et al. 2015; Ahmad et al. 2014; Nouh et al. 2014; Creese et al. 2015; Hernandez et al. 2014). In unintentional leakages, proprietary information and knowledge are accidentally or forcibly transferred to any unauthorized parties either through verbal or written communications. Under such circumstances, the companies might not notice the leakages and hence, are ignorant of the impact that IKL exerts on their daily operations. On the other hand, IKL could happen intentionally for specific purposes. The impact caused by intentional leakages could surface and be detected, and then counteracted. The different types of factors that cause IKL are discussed in the following subsections.

2.1 Intentional leakage

2.1.1 Organizational incentives

Organizations tend to leak crucial and confidential information to external parties to gain certain organizational incentives. Such incentives include monetary benefits, technology acquisition, reputational gains, exploitation of better competitive advantage and securing higher trade volume.

Zhao et al. (2002) revealed that distorted vertical information sharing has a positive effect on the manufacturers’ profit but retailers would suffer negative outcomes from it. The manufacturer in this case might have disclosed information to gain further benefits. Research has also suggested that information leakage arises from an unbalanced information sharing. In Li et al. (2002), their model shows such incidents might deter retailers from sharing crucial information with the manufacturers unless both parties provide assurances the shared information will be strictly confined to contracted purposes.

The reference (Dye and Sridhar; 2003) found that when a firm seeks external sources (e.g. consultants and bankers) in making a strategic decision, chances are the information related to the decision could be leaked to competitors. Such situations would diminish the significance of the project as competitors could utilize such information to reconfigure their strategies to compete with covert advantages in the market. In the context of customers who are aware of the firm’s future plans, they might decrease their current orders in anticipation of better features in new product launches.

Anand and Goyal (2009) introduced the terms ‘information dissemination game’ (IDG) and ‘information acquisition game’ (IAG) where suppliers would leak market information obtained from existing to new customers. They developed a model whereby a common supplier and two downstream competitors are included to test the effect of organizational incentive on information leakage. In IAG, when the experienced firm places an order with the supplier, there is a possibility where the information acquired by the supplier might be leaked to the new entrant. This information allows the new entrant to justify its order quantity placed with the supplier for the latter to gain greater benefits. On the other hand, only the experienced firm has access to the actual demand information in the IDG. This situation has allowed the researchers to study the consequences of information leakage and derived incentives when the experienced firm transfer information to the supplier who leaks the acquired information to the new entrant (Anand and Goyal 2009).

Furthermore, two studies (Lee 2002; Zhao et al. 2002) have developed models on information leakage in vertical information exchange in a supply chain. They emphasized that vertical information sharing – that is a few downstream firms in the supply chain sharing information with a common upstream member - with the existence of horizontal competition could trigger information leakage to benefit the upstream organizations. After obtaining the demand information, the common upstream supplier would “pass” it to its downstream members to gain higher sales volume (Lee 2002).

Researcher (Zhang 2011) evaluated IL caused by inferences in the supply chain through a conceptual model. Companies may have their confidential information or knowledge leaked when they are referred to by other parties in the supply chain. Another separate study establishes a model to test the correlation between buyer-supplier relationship and the effect of knowledge leakage (Bonte and Wiethaus 2007). It is found that when more than one buyer is involved in knowledge sharing network with a common supplier, the supplier could have the incentive to leak the knowledge to another party benefitting another competitor as well as the supplier itself (Bonte and Wiethaus 2007). Hence, organizations should only disclose their confidential information only if the information can be kept within permitted boundaries. Research has also indicated that some firms will intentionally reveal their proprietary information on innovation to manufacturers and other competitors (Harhoff et al. 2003). The researchers added that when manufacturers received leaked innovation information, they would continuously refine and promote the innovation. As such, the inventor could reap benefits from such information.

The subject of information and knowledge leakage has been viewed through various perspectives. The intentional leakage situation described in this research focuses on leakage issues that are viewed from the point of origin where the initial information and knowledge are first exposed to external parties. Consider a scenario that involves two retailers, retailer A and B, and a common supplier in a supply chain. Retailer A has a more sophisticated demand forecasting technology and shares confidential demand information with the supplier. The supplier then intentionally leaks the information to retailer B to gain higher sales volume. However, when this situation is viewed from Retailer A’s position, the information is considered to be unintentionally leaked to retailer B. Figure 1 provides a clear illustration on the scenario above.

Fig. 1

Scenario illustrating information leakage in a supply chain

2.1.2 Individual incentive

Another factor that triggers IKL was found rooted in individual incentives. However, the academic literature fails to provide a detailed study on this matter. A report suggested that internal employee fraud produces one of the most significant information leakage risk faced by organizations (Faisal et al. 2007). Employees might leak the organizations’ confidential information to outsiders when incentives are offered (Faisal et al. 2007). As a result, rivals in the market could manipulate employees from a different organization to divulge crucial trade secrets. These trade secrets are particularly useful for SMEs to gain further competitive advantage and advancing rapidly in their respective field.

2.2 Unintentional leakage

2.2.1 IKL through interactions in outsourcing activities

Several studies (Ho 2009; Baccara 2007) found that outsourcing activities, especially R&D outsourcing, expose organizations to significant leakage of valuable company secrets to outsiders. Outsourcing providers or contractors in R&D are in a position to manipulate and sell the innovation developed in their business to other competitors which would affect the competitiveness of the incumbent firm. Ho (2009) highlighted that non-disclosure agreement or contract is vitally useful in protecting the intellectual property of any firm involved in strategic outsourcing activities. A leakage-free R&D contract model is proposed by Ho (2009) to protect the confidentiality of the information associated to any new inventions.

In addition, both studies argued that there is a great potential for organisations to lose their critical skills and competitive advantage to competitors when collaborating extensively in supply chain management and forging strategic outsourcing (Bonte and Wiethaus 2007; Faisal et al. 2007). In addition, traditional cost consideration in strategic outsourcing is no longer the main concern because the measures needed to retain a firm’s competitiveness principally to protecting its ability to compete in the rapidly evolving market conditions are more important to them (Bonte and Wiethaus 2007). Faisal et al. (2007) reported that the greater the uniqueness of the competence of a firm, the greater the stringent measures required to protect it.

Hoecht and Trott (2006a and 2006b) claimed that legal contracts may only offer short-term protection to a firm’s information and knowledge. Baccara (2007) stressed that close relationships with external contractors and service providers could result in unintentional information leakage. Hence, unless deep trust and strong social ties are established between firms, those companies with unique competence should limit their involvement in any outsourcing activities to prevent losing valuable knowledge and information to external parties (Hoecht and Trott 2006a, b).

Faisal et al. (2007) stated that IT outsourcing is widely practised to enhance performance. A survey shows there is a trend to increase internet outsourcing (Amaratunga et al. 2002), thus affirming the claim made by Faisal et al. (2007). Nevertheless, there are several risks associated with IT outsourcing e.g., information security and loss of control. Since IT in this modern day is advancing rapidly, the risk of information leakage is alarming. Such rapid advancement in IT has made it difficult for practitioners to detect the occurrence of information leakage.

2.2.2 Employees’ movements/ people interaction

Some organizations are very much dependent on their employees for certain knowledge and experience. A case study was conducted on knowledge leakage by people in SMEs (Mohamed et al. 2006). They found that when employees migrate from one company to another, there is a high possibility that knowledge acquired from the former company may be leaked to another. They also classified knowledge leakage via people into ‘intentional leakage’ and ‘unintentional leakage’. The former describes knowledge transfer involving employees in business strategy planning while the latter refers to the leakage of knowledge through employee movements or collaborative effort between employers. These types of knowledge leakage methods could result in a positive or negative outcome to the firm. However, the authors only explore the cause and effect of knowledge leakage in the manufacturing and design sector and neglected other sectors (e.g. consulting and R&D) which require knowledge intensive workers.

On the other hand, Kovach et al. (2004) identified that an organization which possesses trade secrets face significant threats in leaking the information and knowledge to external parties when key employees migrate to another firm. These employees could bring along specific knowledge of a product/service and information on the organizational strength and weakness to the next company. When such employee movements occur within a supply chain, the impact of knowledge leakage would be significant. However, the occurrences of these leakages are relatively difficult to detect as these usually happen under the roof of another organization. It is also rather challenging to quantify the benefits to the recipient organization from the leaked knowledge or information.

From literature, it is learnt that information and knowledge leakages are triggered by these factors: Organizational and Individual Incentives, Outsourcing Risk, and Employees’ Movement. Table 1 provides a summary of the main findings reported by numerous scholars.

Table 1 Summary of main findings

From the literature, we identified that both academics and practitioners paid little attention to information and knowledge leakage management. IKL may represent a major loss to any firm if it is not managed properly. Hence, it is the aim of this paper to conceptualise an information and knowledge leakage theoretical model and formulate hypotheses relating supply chain integration to information leakage (IL) and knowledge leakage (KL). These hypotheses are then evaluated using evidence gathered from the responses in multiple case studies described in the later part of this paper.

2.3 Research questions

The research questions for this research are as follows.

• RQ1: How do different arcs of integration relate to the degree of information and knowledge leakage?

• RQ2: How are information and knowledge leakage triggered in integrated supply chains?

• RQ3: How does information and knowledge leakage affect SMEs’ performance in their respective industries?

• RQ4: What are the managerial approaches that SMEs can adopt to mitigate such phenomenon?

In order to assess whether all assumptions and expectations sit on solid foundations, we have translated most of the aforementioned questions into a set of hypotheses that could be experimentally evaluated.

Frohlich and Westbrook (2001) categorised supply chain integration into 5 distinct patterns: 1) Inward-facing, 2) Periphery-facing, 3) Supplier-facing, 4) Customer-facing and 5) Outward-facing. Figure 2 illustrates the different arcs of integration.

Fig. 2

The different arcs of integration developed by Frohlich and Westbrook (2001)

Both Frochlich and Westbrook (2001) and Flynn et al. (2010) acknowledged that companies which are fully integrated with both suppliers and customers will have significant improvements in overall performances. Among these integration types, companies with the outward-facing arc of integration are found to have the greatest interactions and communications with the supply chains counterparts. On the other hand, companies featuring inward-facing arc have limited collaboration with their suppliers and customers. As a result, companies implementing intensive integration measures will need to constantly share relevant information and knowledge among supply chain members to produce optimal performance.

To answer our research questions, we propose the following hypotheses.

• Hypothesis 1a: The largest arc of integration has the highest frequency of information and knowledge leakage.

• Hypothesis 1b: The smallest arc of integration has the lowest frequency of information and knowledge leakage.

Service providers and sub-contractors could manipulate the pool of information gathered from various organizations and pass it to other clients to gain beneficial incentives, either in direct monetary gains or securing future contracts. Hence, when a firm outsources the majority of its operations or services to third party providers, the risk of leaking valuable information and knowledge is significantly elevated (Faisal et al. 2007). As a result, our next hypothesis is as follows.

• Hypothesis 2: Outsourcing of processes and services to common third party providers have direct effects on information and knowledge leakage.

Li et al. (2002), Zhao et al. (2002) and Anand and Goyal (2009) found that distorted information sharing is one of the major factors that trigger information leakage. Such an incident is normally activated by either organisational or individual incentives. This incident leads to the next hypothesis.

• Hypothesis 3: Imbalance and dishonest information and knowledge sharing between firms have positive effects on information and knowledge leakage.

Research question (RQ1) is answered by testing with hypothesis 1a and 1b. Similarly, research question (RQ2) is explored with hypothesis 2 and 3 and other evidence gathered from the case companies. Also, the impact of information and knowledge leakage on SME’s performance (RQ3) is responded using evidence from the case study. Finally, the managerial approaches in mitigating the negative impacts (RQ4) are proposed in this paper.

In what is to follow the analysis of the above RQs is the field research using the case study approach. In-depth case studies to investigate how companies in Malaysia mitigate information and knowledge leakage in supply chain were carried out. The liberalization of manufacturing and services industries, especially the commitment of Malaysia in WTO and FTA requires the review of policy and regulations in facing mounting competition. Industry practices such as “supply chain excellence” and “information/knowledge management” that demand accurate and timely information as well as the integration of the various supply chain players to provide a seamless connection have changed the industry landscape. These changes can influence performance and spur innovation for greater productivity within the supply chain industry.

3 Methodology

This study employs an interpretative qualitative methodology to investigate the cause and effect of IL/KL and management approach to mitigate leakages . Case study can be extremely useful in answering questions to the “how” or “why” phenomena (Yin, 2014) or relationships between variables observed in supply chain management (Voss et al. 2002). The case study approach has been extensively acknowledged for theory generation and testing (Eisenhardt 1989; Yin 2014), especially in the operations management division (Voss et al. 2002). The use of case study allows the researcher to focus on real-life circumstances and the dynamics present within each situation (Eisenhardt 1989). The case study approach could also stimulate creative perceptions on a particular topic and enrich the researchers themselves (Voss et al. 2002).

For the above reasons, we chose to carry out in-depth case studies to investigate how manufacturing companies in Malaysia develop strategies to mitigate IKL to survive in a competitive and dynamic environment. Malaysia provides a particularly interesting setting for this study because of its rapid economic growth. With the ever changing global economic landscape (Bank Negara Report, 2013) and with Malaysia’s relentless pursuit and its desire to improve its global 10^th competitive ranking (Tenth Malaysia Plan, 2011-2015), the manufacturing infrastructure in Malaysia like other nations requires the use of information technology and information system to manage the vast and dynamic information of world markets. Towards that end, the government will also aggressively promote the use of ICT in all industries parallel to the development of the ICT sector. The advantages of local and global outsourcing (Stanley et al. 2007) have data sharing rapidly gaining traction in the manufacturing operations. This global market outreach and outsourcing brought along a host data and information security issues. In the Global State of Information Security Survey 2015, it cited cyber threats in the form of information security incidents which have been detected and on the rise since 2009 with an average of 117,339 incidents per day and have caused millions of dollars in financial losses. The survey also reported breaches of data security at high levels by organised crime especially in Malaysia, India and Brazil. Against this backdrop of the Malaysian economic development and cyber threats, this research is timely to identify and highlight the risks of data loss in companies and its effects on company performance. This will also create greater awareness to research into factors that bear upon data security and firm performances.

The selection of companies for this case study follows the recommendations by Eisenhardt (1989) and Closs et al. (2008 ). Before the start of the data collection process, boundaries for this research is set to ensure that the candidate’s attributes are directly linked to the research questions (Closs et al. 2008). The selection process began with the identification of industries which are relevant to this research. The selection criteria include the companies’ (1) dependency on innovative or novelty ideas, (2) dependency on knowledge and information acquisition and (3) nature of business (i.e., project/contract base or long life cycle). All three criteria also serve as the sample controlling attribute. After the analysis of each industry, it is found that manufacturing and design industries (especially those involving innovations and IT) are extremely vulnerable to IKL. It also noted that most manufacturing and design companies are involved with more complex supply chains or supply network. These companies tend to extend their collaboration to second-tier suppliers and customers. Companies in this sector gain competitive advantage mainly through breakthrough innovations and thus, knowledge and proprietary information associated with the products or process are exceptionally important and valuable. Consulting firms which are heavily dependent on knowledgeable labour in providing business advice and problem solving are also chosen as the target candidates. Companies in the construction industry, where project-based approach is common, were found facing considerable risk in IKL as interactions between sub-contractors, clients and suppliers are extensive and essential.

Our sample of manufacturing companies categorized under the industries identified previously was obtained from Federation of Malaysian Manufacturers (FMM) 2013 Directory. As FMM is the biggest trade organization in Malaysia, the proposed sample is representative of the population. As case study methodology normally involves only a small number of samples (Done et al. 2011) and after a meticulous analysis of the companies, five most appropriate and relevant companies to this research were identifed. These five companies were then contacted to for an in-depth study. We visited these five different manufacturing companies and carried out semi-structured interview. The details of each company are described in the following section.

3.1 Companies profiles

Company A is a professional service provider with rich experience in unified security solutions that provide end-users with supreme control over their security systems. The company manufactures a wide range of security products which include physical access control, elevator access control, car park control, online guard-tour, CCTV integrated module, and biometric technologies. Company A has its own R&D facility near its headquarters. It has 31 permanent employees with several operations centers across different countries in South East Asia (SEA).

Company B designs and manufactures a broad range of polypropylene products. It has over 60 permanent employees with distinctive expertise in customizing specific products according to customers’ needs. It has strong R&D teams which constantly refine its production methods and product designs. Company B is dependent on its product designers to deliver superior quality products. The company practice close integration with suppliers (including MNCs) and customers. Inter-department integration is strongly encouraged within the company especially on information and knowledge sharing between departments with the ultimate aim of cost reduction.

With its main focus on innovative chemical product design and smooth production lines, Company C has established a reputation in water proofing materials. The company strongly encourages cross-functional integration on key internal supply chain activities.

Company D is a knowledge-based business consultancy firm with a small group of 6 full time workers. In the consultancy industry, individual knowledge is the key to every successful project. Therefore, the company frequently holds internal discussions to enhance information and knowledge flow. This internal communication system is vital to produce creative and innovative problem solving skills. The company works closely with all its clients in order to offer the best solutions. Hence, the company focuses on integrating customers’ needs rather than their suppliers.

The fifth company is a building contractor with 50 full-time employees. Company E typically runs their business on a project basis which often requires collaborating with several other sub-contractors. Apart from that, company E has to manage a wide range of raw materials suppliers in order to deliver its project on time. Hence, the company has taken strategic integration measures with both its suppliers and subcontractors/outsourcing providers to enhance its performance. Confidential information such as business planning and resource allocation is shared with the suppliers and clients throughout the whole project life cycle.

3.2 Data collection method

An important characteristic of building theory from case studies research is the data analysis often overlaps with the data collection. Furthermore, such overlapping situation allows researchers to conduct flexible data collection (Eisenhardt 1989). Consistent with this, a log book is used to record on-going activities throughout the entire data collection process to achieve this overlap. Eisenhardt (1989) and Voss et al. (2002) recommended that written records are necessary for future analysis and may prompt the researcher to reflect critically on the gathered information. This research utilizes multiple sources of evidence to access wider data scope and to increase data reliability (Yin 2014). Data sources for this study include semi-structured interview and companies’ printed documents. Both types of data allow the cross-verification of concepts and findings. In addition, data collected from the questionnaires earlier are adopted to further enrich the data.

3.2.1 Semi-structured interview

Semi-structured interviews were conducted to gather information on information and knowledge leakage in integrated supply chains which was adopted from various research articles on information leakage (Bennett-Curry et al. 2013; Baresel-Bofinger et al. 2011; den Uijl et al. 2013). In most cases, prior appointments were made before paying a visit to the companies. A list of sample questions was also provided for the companies before the interview sessions. This offers the participants to have a clear understanding of the questions and organize the required documents. At least two interviews were conducted in each firm, where the duration of each session ranged from 30 to 90 min. The pool of interviewees includes directors, managers and other senior employees from different departments. In addition, a former employee from one of the case company was approached for interview as well. This ex-employee was forced to resign from the company after the company’s proprietary information was found leaked. Hence, the data obtained from the former employee could add further integrity to the study. During each session, the interviewees were asked to describe their job nature to understand their responsibilities. Besides that, interviewees were encouraged to deviate from the preset questions to facilitate the discovery of new concepts. Besides face-to-face interviews, phone interviews and followed-up emails were made to refine and to fill in the gaps in the gathered information.

Company	Interviewees’ Position	Duration (minutes)
A	Director/Co-owner Former employee	90 35
B	Marketing Manager Chief Product Designer Technician	60 30 30
C	Executive Director Operations Director	45 80
D	Director/ Co-owner Senior Consultant	30 45
E	Executive Director General Manager Project Manager	75 40 30

3.2.2 Printed documents

Apart from face-to-face interviews, printed documents were gathered to supplement the information obtained from the interviewees. These documents ranged from confidential documents, standard operating procedures, promotional materials (company’s brochure and catalogues), and company profiles to other publicly available information. Data and information extracted from these documents were compared with the information obtained from the semi-structured interviews to ensure information consistency. Any conflict between the collected data is resolved by seeking further advice from the relevant participants.

Data and information gathered from the questionnaires, semi-structured interviews and printed documents are organized and presented. The items of the questionanires are found in Appendix A. The main focus was to seek answers to the following: 1) how and who do companies integrate with in the supply chain; 2) what are the information and knowledge management strategies implemented; 3) how do information and knowledge leakage (IKL) occur in the integrated supply chain; 4) how does IKL affect the companies and 5) how do the companies mitigate IKL.

4 Data analysis

4.1 Interview: Company A

In the security business, company A requires intensive R&D knowledge and technology expertise to cope with products of relatively short life cycle and therefore high obsolescence. With the rapidly evolving and demanding market requirements, company A collaborates and integrates closely with MNCs, local suppliers, distributors, retailers/dealers as well as its customers. The company implements intensive training and information sharing platform to all trading partners to ensure all are equally skilled and knowledgeable. The company also invested a major portion of resources into knowledge and technology transfer program. The director explained that:

‘Our company has invested huge resources to develop an effective knowledge transfer program. This program could provide trading partners with sufficient knowledge to meet our expectations. However, I dare not preclude such program does not suffer information or knowledge leakage.’

The company also reported that part of the company’s proprietary information (including business plans) and knowledge bases are shared between supply chain counterparts to enhance the collaboration between firms. As such, the company is considered as having an ‘outward-facing’ arc of integration.

One of the directors of the company mentioned that they faced considerable information and knowledge leakage issues. He pointed out that internal employees’ fraud¹ cases are the major cause of leakages. Some employees in the firm disclosed company’s confidential information such as business solutions and product costing to external parties to receive personal benefits As a result, one of the trading partners, which now directly competes against company A, was found to possess similar working solutions. In addition, former employees who resigned were also identified as a source of information and knowledge leakage. The interviewee cited an incident where a director resigned and started a new company using similar business strategy. Furthermore, a former employee recounted that:

‘The company was so furious with me when I accidentally leaked product costing to unauthorized parties, I was coerced into quitting my job.’²

Such an unwelcomed event has caused minor disruptions to their business and eroded its competitive advantage in the market. However, the director acknowledged that it is unlikely that its trading partners, with the leaked information or knowledge, could overwhelm and substitute company A in the industry because of its unique market position.

Preventive measures include tightening contractual agreements and R&D operational procedures, and securing strategic information/knowledge storage platforms are implemented to mitigate IL and KL.

4.2 Coding for information and knowledge leakage

Internal employees’ fraud¹, employees’ negligence²

4.3 Interview: Company B

The company practises close integration with suppliers (including MNCs) and customers. Inter-department integration is strongly encouraged within the company especially on information and knowledge sharing between departments with the aim of cost reduction.

“We strongly encourage all departments in the company to work together. Such internal integration with knowledge exchange could hasten all internal operations to solve challenging problems” – Marketing manager of Company B.

Hence, company B can be characterized as practising the ‘periphery-facing’ arc of integration with intensive internal integration.

The interviewees from company B pointed out that trust is one of the major essence in sharing key information and knowledge among supply chain partners. They suggested that unequal information and knowledge sharing could invite free-riders where the company would absorbed all important aspects of the shared information without reciprocating. The chief product designer revealed that information leakage is not a major issue for the company. This is because the immobile tacit knowledge of the employees, is more important to deliver high-quality products.

“I am not worried about leaking product design or any design related information to others because these are explicit knowledge. However, subordinates and co-workers who have left the company for better jobs with competitors are more worrisome as tacit knowledge within them can allow the rival company achieve rapid growth’ – chief product designer”

On the contrary, the general manager mentioned that frequent information and knowledge leakage could affect the company’s position in the market. External parties would use the leaked information and knowledge to enhance their competitive capabilities. The manager also found that although employees’ migration³ from one company to another is common and uncontrollable, enhanced contractual documents are needed to contain company’s confidential information and knowledge. Former employees would leak vital information to the new company for a variety of personal incentives which include promotion and monetary rewards. Such phenomenon would encourage ‘pinching’ in the market. He however, suggested that government policy and regulations would be useful to overcome such issues.

4.4 Coding for information and knowledge leakage

Employees’ migration³

4.5 Interview: Company C

Two of its directors acknowledged that open communication of relevant information within the company could solve problems systematically. One of the directors added that:

“Interactions and communications among workers promote transparency within the organization. Therefore, it is easier for us to identify the root cause of most problems. We discovered leakages occured in a number of circumstances especially contract breaching⁴ by employees or suppliers.”

Company C practises moderate integration measures with its customers/distributors while intensive integration measures are implemented with most of their suppliers. Hence, we characterize company C as functioning under ‘supplier-facing’ integration.

Meetings and discussions among supply chain members are common for exchanging information and knowledge. The company revealed that such communication channel could foster closer relationships between trading partners to facilitate excellent information flow.

The company classified their information and knowledge into confidential and general. Only authorized senior management has access to the company’s confidential information. Hence, the board of directors could trace the root causes when leakages occur. Next, the company fosters a trustworthy collaborative culture with its trading partners and promotes transparency along the supply chain. This measure could provide a sense of mutuality to their business associates along the supply chain. Also, the company practised reward and reprimand on a team basis. Thus, each team member would monitor their colleagues’ behavior and performance as an individual mistake could affect the team as a whole.

4.6 Coding for information and knowledge leakage

Contract breaching⁴

4.7 Interview: Company D

According to the senior consultant, the company and its clients/customers integrate their knowledge and database to improve their operations. The knowledge sharing among partners and joint-venture members occurs daily. As such, the company admitted to have suffered from knowledge leakage. However, the negative effects from the leakages are minimal because of its strategic knowledge codification platform and that the nature of each project differs from ech other and typically also has a relatively short time span.

4.8 Coding for information and knowledge leakage

Leakage happens very infrequently.

4.9 Interview: Company E

The general manager and project manager revealed that information leakage occurs almost daily. For example, the financial information is often leaked to the suppliers and sub-contractors. This causes company E to experience occasional lost of bargaining power with their raw material suppliers and with its trading partners. As a consequence, the company suffered a much lower profit margin in some of its projects.

‘When our confidential information was leaked to rivals in the industry, it could affect our competitive advantage to secure job tenders. Competitors could realign their strategies putting greater competitive pressures to rivals. Documents like order receipt, payment slip carries confidential information⁵’ – Executive director

Although company E frequently suffers from knowledge leakages to trading partners, it is less concerned on the negative impact. The director of the company emphasized that small and medium-sized contractors operates with common procedures and each individual project requires similar knowledge and expertise.

4.10 Coding for information and knowledge leakage

Employee negligence⁵

5 Discussion

A high degree of integration (outward-facing, periphery-facing arc of integration) generally involves rigorous interactions with both suppliers and customers. These highly integrated companies often exchange proprietary information and transfer important knowledge to their supply chain counterparts to achieve results par excellence. When the information sharing and knowledge transfer platform are designed with flaws and vague boundaries, there is a high possibility that critical information and knowledge will be leaked to external parties. This is because companies usually have limited resources in monitoring and controlling the information and knowledge sharing platforms.

From the interviews, company A, B, C and E revealed that information and knowledge leakage occurs frequently in their supply chains. Trading partners were found to have produced imitation products, operated with similar processing/service techniques or implemented comparable management styles. Company D on the other hand, commented that information and knowledge leakage seldom take place in their daily operations. This could be due to the limited integration measures with their customers/clients. The company maintains transactional relationship with the majority of their suppliers while information and knowledge are only shared with a few partners.

By comparing and contrasting the different degree of integration of the case companies, it can be deduced that the larger the arc of integration, the higher the frequency of information and knowledge leakage and vice versa. Hence, hypothesis 1a and 1b are validated with and supported by the interview evidence.

5.1 Factors that trigger IL & KL

The analysis of the gathered information shows two major factors to be the root cause of information and knowledge leakage. They are: 1) natural factors and 2) human factors. Natural factors are factors that could not be controlled by any party in the supply chain while human factors involve the disclosure of critical information and knowledge to external parties because of unethical human behaviour or intentions. Figure 3 shows the factors that lead to information and knowledge leakage.

Fig. 3

Factors that trigger information and knowledge leakage

The findings here are inline with the literature and suggested both information and knowledge leakage could be classified into two major types: intentional and unintentional. Furthermore, outsourcing activities, employees’ migration (or upward mobility) and incentives offered by external parties contributed to the two types of leakages. Our evidence suggests that imbalance and dishonest information and knowledge sharing among supply chain members have positive effect on information and knowledge leakage.

5.2 Effects of IL & KL on performances

While information and knowledge leakage benefited some firms along the supply chain, companies which have their proprietary and crucial information/knowledge leaked would suffer negative impact to their performances. Information can be classified into general information and confidential information (or company secrets) while knowledge can be categorized into tacit and explicit knowledge. From the case studies, it is also found that both information and knowledge have two distinctive life cycles: short life cycle where the life span of both elements is no greater than 6 months and long life cycle where its life span lasted more than 6 months.

Among all types of information and knowledge, the interviewees suggested that short life cycle explicit knowledge leakage leads to the greatest negative impact to the firm. For example, company C pointed out that it is easy for foreign firms to imitate explicit knowledge and this could increase significant competition in the market. Similarly, company B discovered it suffered slower growth due to explicit knowledge, that of product design skills, being leaked to external parties. However, company E argued that explicit knowledge leakage in the construction industry has less impact on performance. This is because typical construction projects involve execution of standardized procedures.

Tacit knowledge leakage on the other hand, will only cause little harm to the firms’ overall performance unless the tacit knowledge has a relatively long life cycle.

‘I think we have to acknowledge that knowledge is constantly leaked to external parties. However, I think the effect of explicit knowledge leakage on the construction industry is less severe as most of the companies in this industry operate with similar procedures and techniques.’ – Project Manager from company E.

However, the director of company E mentioned that certain individual skills in building constructions are important for the business. He lamented that when the employees left the company triggering tacit knowledge leakage, that seriously hurt their ability to win new project tenders. Company D also highlighted that tacit knowledge leakage is critical for a consulting firm as the business is heavily dependent on tacit knowledge to resolve the problems of its clients. Moreover, interviewees from company C emphasized that certain tacit skills such as negotiation abilities are important to the company’s operations. They consensually agreed that when a person with strong abilities and skills leaves the company, chances are the rival firm will benefit while the company suffers considerable losses.

Apart from knowledge leakage, company confidential information leakage could also weaken the competitive advantage of the company. Company A and C admitted losing bargaining power with suppliers when their product pricing information was leaked causing higher materials costs when sourcing.

‘When product pricing information was leaked to suppliers,it was difficult for us to negotiate for lower material prices. They would use such information to counteract our price requests.’ –Director from company C.

In the mean time, company B revealed that they encountered future business plans leaked to external parties. Hence, rivals in the market have the chance to realign themselves to compete. In some instances, future plans that were exposed to customers could impede rapid growth to the company as well. Company C pointed out that customers would decrease orders for current projects in anticipation of new products. These untoward events could bring a negative impact to their sales.

With the above negative outcomes, it can be concluded that both information and knowledge leakage would generate uncalled for stiffer competition in the market. Participants in this research suggested that certain negative impact lingers longer than others. Firms that encounter higher frequency of leakages will cause negative impact to their business growth. Hence, appropriate measures are required to mitigate the effects of leakages on company performance.

5.3 Managerial approaches in mitigating the impact of IKL

After conducting the case study and analyzing the responses from the interviews, this section will propose some managerial approaches to mitigate the negative impacts. In other words, research question RQ4 will be addressed here.

The analysis of the results from the case study shows that the effects resulting from certain leakages are more difficult to determine and quantify depending on the type of information or knowledge (i.e., explicit or tacit knowledge.) In our five cases, the approaches they use to mitigate information and knowledge leakage can be categorized as contain, contract, control and cultivate. Figure 4 shows the corresponding approach used by the case firms in association with the type of information/knowledge.

Fig. 4

4C’s Information and Knowledge Leakage Mitigation Framework

Following is the explanation for each approach.

5.4 4C’s information and knowledge leakage mitigation framework

5.4.1 Contain

Short life-cycle explicit information and knowledge is the most vulnerable to leakages as they could be imitated very easily and rapidly (e.g. product design and product ingredients.) As short life-cycle products and services usually generate high profit margins within a short span of time, the leakages of such knowledge can give other supply chain members, especially those in direct competition, significant market advantages. As a consequence, the incumbent’s competitive advantage weakens.

Therefore, it is crucial for companies to contain short life-cycle explicit information and knowledge for its entire life-cycle. One approach could be restricting the flow of knowledge within the company. For example, only key individuals in the company should be granted access to company secrets. Additonally, companies should take appropriate precautions while sharing explicit knowledge with trading partners. Unless agreements include appropriate terms and conditions, explicit knowledge should only be confined within the company’s boundary.

5.4.2 Control

Short life-cycle tacit knowledge is those that are difficult to be imitated by others within a short period of time. These information and knowledge generally have a critical period of 6 months or less. Hence, the leakages of such knowledge do not have significant impact on a company’s performance because competitors are unlikely to benefit from product with short life-span or service imitation. Therefore, it is sufficient for companies to monitor and control short life-cycle tacit knowledge. Internally, appropriate power delegation to senior management would help in controlling information and knowledge flow within the company. Externally, to ensure that trading partners would not leak shared knowledge to other businesses, a ‘mutual pooling system’ could be practised. This system puts all trading partners under the same rewards and reprimands system. A ‘mutual pooling system’ could serve as an effective means of controlling information and knowledge outflow as the act of either party deviating from this agreement will result in losses for all.

5.4.3 Contract

The contract approach generally applies to long life-cycle explicit knowledge. Long life-cycle explicit knowledge is those that will remain relevant for a long period of time and can be easily codified and transferred to others. The leakage of this knowledge usually occurs through employee migration and wider interaction networks. The fact that these are natural processes makes the containment and control of long life-cycle explicit knowledge relatively difficult. For example, it would be tricky for a firm to restrict the exposure of knowledge from its former employees to their new employers.

To mitigate the leakages of such knowledge, companies could prepare appropriate contracts that restrict the leaking of information or knowledge to third parties. Contracts or other official documents are identified as the best methods to protect long life-cycle explicit knowledge as they allow drastic actions to be taken against individuals or organisations that breach them.

Interviewees from company C revealed that they have implemented ‘bonded contract’ to prevent retired or leaving employees from leaking confidential information to their new employers. This ‘bonded contract’ typically prohibits former employees from starting his/her new career within a stipulated time frame by compensating them.

5.4.4 Cultivate

Long life-cycle tacit information and knowledge are those that are relevant over a prolonged period and are difficult to be codified into printed documents. The three methods (contain, control and contract) described earlier are not deemed sufficiently effective in mitigating the effects of long life-cycle tacit information and knowledge leakages, and with information and knowledge embedded in human minds, it is impossible to prevent employees from utilising them in other companies in the not-so-distant future.

To mitigate the effects of long life-cycle tacit information and knowledge leakages, a more implicit approach is recommended. It is suggested that companies cultivate a trusting and knowledge sharing culture within the company. This type of information and knowledge should be codified and transferred across the organisation. This structure ensures that employee migration and retirement would not affect the company’s operations. In addition, employees within the organisation should be made aware of leakages issues and the consequences of such occurrences towards the company. A sense of ethical responsibility should be instilled in employees to discourage them from leaking company information attributed to human factors. Thus, sufficient and proper training and education are important to inculcate such ethical behaviour in employees.

Externally, an interdependent culture among supply chain counterparts should be cultivated. Again, this could be achieved through ‘mutual pooling system’. A cooperative culture could promote mutualism in supply chain collaboration and integration efforts, which in turn, could reduce the frequency of IKL and their negative effects. The different approaches suggested in the 4C’s framework are by no means exclusive to any particular groups of knowledge. In most cases, a combination or two or more of the Cs should be implemented simultaneously to achieve optimal outcome. Apart from that, the 4C’s information and knowledge leakage framework is developed based on the data and information collected from the five case companies in this research. Following the establishment of the 4C’s framework, two of the case companies were presented with these new mitigation approaches. Their opinion and feedbacks were sought to validate the effectiveness of this 4C’s framework. Overall, the two companies expressed interest to implement the framework in their operations and provided suggestions to improve the framework. They suggested that external factors such as government policies and regulation could be added to enhance the framework. As these two factors play a role in addressing leakages problem in supply chain, a stringent government regulation and policies could reduce the occurences of such leakages.

In sum, our results show that hyphothesis 1a, 1b, 2 and 3 are supported. In hypothesis 1a and 1b, companies with large arcs of integration (i.e., companies A, B, C and E) are found to suffer from high occurrences of IKL; while companies with small arcs of integration (i.e. company D) are less afflicted by IKL. Our findings from the case studies also show that companies that shared common outsourcing/service providers or sub-contractors are more likely to have their information and knowledge leaked to outsiders (this supports hypothesis 2). Evidence from the case study supports hypothesis 3, which is, imbalance information and knowledge sharing will result in higher occurrences of IKL. Lastly, a managerial framework is proposed to help companies mitigate the impact of IKL and the mitigation framework was successfully validated by two of the companies.

6 Conclusion

As the modern businesses are marching towards global sourcing and strategic outsourcing, organisations are shifting their main focus to global supply chain collaboration and integration. An essence of success in supply chain collaboration and integration lies in information and knowledge sharing, making it one of the most popular research subjects among academics. Most researches focus solely on the positive side of these developments where emphases are placed on the implementations and benefits of SCI (Supply Chain Integration), SCC (Supply Chain Coordination), information and knowledge sharing but neglecting the negative outcomes on these improvement strategies: information and knowledge leakage (or lost) to unauthorised parties. The contributions of this research are three-fold.

Firstly, this study has characterized the relationship between the arcs (degree) of integration and frequency of information and knowledge leakage in supply chain. It has determined that the higher the arc of integration, the higher the occurrences of information and knowledge leakage (IKL) in the supply chain. In observing that a supply chain is constantly expanding, the need for strategic collaboration and interactions with each supply chain member increases with greater exposure to information and knowledge leakage. Secondly, this research also attempted to investigate factors triggering IL and KL. These factors are categorised into natural factors and human factors. Natural factors are more difficult to determine as companies have weaker controls over them. Contrarily, IL and KL due to human factors are easier to detect. The effects on leakages of companies’ performances were also studied. It was found that proprietary information and explicit knowledge leakages have significant adverse effects on firm’s performances. Thirdly, managerial approaches in mitigating such effects are proposed. The 4Cs (Contain, Control, Contract and Cultivate) framework in mitigating knowledge leakage is suggested to counteract unfavourable situations. In short, this research has provided academics and practitioners with the understanding on the significance of IL and KL in integrated supply chains.

Although this study has made sound contributions to both academic and industries, there are still limitations that require attention. We suggest that competitors of the case companies should be approached for further details when extending this study in the future. This would allow the researcher to compare and contrast the performances of several companies that engaged in direct rivalry and could offer readers new insights into information and knowledge leakage. In addition, factors such as contractual measures, governmental policies and regulations could be investigated in the future because they also could play an important role in stemming leakage problems in supply chain.

Appendix A- Questionnaire Sample

1.1 Items/ Variables

Internal Integration

Item	Measurement items
SCII 01	We encourage cross-functional integration on key internal supply chain activities such as manufacturing, procurement, marketing, accounting, and logistics.
SCII 02	We practise such internal integration to prevent and solve problems
SCII 03	Open communication of relevant information occurs among all internal employees

External Integration

Item	Measurement items
SCEI 01	We integrate closely with suppliers (including direct and indirect suppliers)
SCEI 02	We integrate closely with distributors/retailers
SCEI 03	We integrate closely with customers (including direct and indirect customers)
SCEI 04	Our organisation collaborate intensively with Multinational Corporations (MNCs)
SCEI 05	We outsource most of our operations to external parties
SCEI 06	We cooperate with external parties in new product development (NPD)
SCEI 07	We cooperate with external parties in developing new process technologies
SCEI 08	We practise such external integration to prevent and solve problems

Integration measures

Item	Measurement items
SCIM 01	We enable external parties to access our planning systems
SCIM 02	We share our production plans with external parties
SCIM 03	We implement joint EDI access/networks with external parties
SCIM 04	We perform packaging customization with external parties
SCIM 05	We share common use of third-party logistical services
SCIM 06	We share common outsourcing providers/sub-contractors with trading partners and/or other external parties

Information Sharing and Leakage/Lost

Item	Measurement items
ISL 01	We share our business units’ proprietary and/or confidential information with trading partners and/or external parties
ISL 02	Our trading partners and/or external parties share their proprietary and/or confidential information with us
ISL 03	We and our trading partners and/or other external parties exchange information which helps business planning.
ISL 04	We experience issues with information leakage/lost to external parties
ISL 05	We experience issues with information leakage through technological related incidents (ie: company’s data bases being hacked)
ISL 06	We experience issues with information leakage through internal employees’ fraud (i.e., theft or unauthorized information acquisition by employees)
ISL 07	We encounter issues of information leakage through the collaboration efforts with external parties.
ISL 08	We encountered issues with information leakage through the movement of employees to other organisations
ISL 09	There is a high possibility that external parties would benefit from the leaked information.
ISL 09	Severe disruptions to our daily operations and supply chain have taken place due to information leakage/lost

Knowledge leakage/Lost

Item	Measurement items
KLL 01	We and our trading partners and/or other external parties integrate our knowledge bases to further enhance our operations.
KLL 02	We experience issues with knowledge leakage/lost to external parties.
KLL 03	We experience issues with knowledge leakage through the movement of employees to other organisations.
KLL 04	We encounter issues with knowledge leakage through fraud cases (i.e., unauthorised transfer of your organisation’s operational knowledge)
KLL 05	Severe disruptions to our daily operations and supply chain have taken place due to knowledge leakage/lost.

Mitigation/Prevention methods on Information knowledge leakage

Item	Measurement items
MPM 01	We have established procedures to mitigate and/or prevent the event of information leakage.
MPM 02	We have established procedures to mitigate and/or prevent the event of Knowledge leakage.
MPM 03	Our organisation has effective strategies in storage information.
MPM 04	Our organisation has effective strategies in codifying and storing knowledge.

Open ended questions:

• a. How dependent is your company on a single person for certain knowledge and experience?

• b. What mitigation and/or prevention measures are taken by your organisation to counteract the issues of information/knowledge leakage

• c. Do you see any risks in global supply chain integration process? (please specify any risks associated with it.)

• d. What is the risk and possibility of outsourcing providers, suppliers and/or sub-contractors becoming competitors arising from supply chain integration?