An F1 team's data is a gold mine that needs to be exploited and protected.

As is the case for so many industries in recent years, Formula 1 has been transformed by data. Each team designs and tests its cars in silico, with vast server farms competing with onsite wind tunnels to see which can use more electricity. Up to 300 sensors per car constantly measure every parameter, beaming that info back to the garage—and in turn to home base—each lap. It's a far cry from the garagiste days of drawing boards and pens or even the active suspension era and its rugged 286 laptops. It's a highly competitive sport, for the financial rewards for success are many, and so that data represents a gold mine for each team.

Under CIO Greame Hackland, Williams Martini Racing provides an illuminating example of how an F1 team can use that data and the steps it has to take to protect it. And while some of the challenges are unique to Formula 1, many of them might be familiar to anyone working in a large IP-heavy organization.
"When I joined Williams in 2014, 70 percent of our race strategists' time was spent getting data and putting it into spreadsheets, whether that was at the track or back at the factory," Hackland told Ars. To help find a way around this, the team started working with Avanade (a joint venture between Microsoft and Accenture), which brought fresh viewpoints to bear on old problems. "The last year and half has been a huge transformation. We can't allow an engineer who's been in F1 for 25 years to dictate how the tools we use look," Hackland told us.

Some of that has been outreach to find a more diverse pool of young engineers along with changes to make Williams a more appealing workplace in the 21st century, like providing the ability to telework—something many of us take for granted. Some of the changes have meant leveraging all the data that pours off the cars to make the engineers' lives easier, like managing the degradation of grip from each set of tires, a key aspect of F1 strategy these days. In just five weeks leading up to the start of the 2015 season, Avanade wrote an app for Williams that analyzes real-time sensor, weather, telemetry, and other data feeds from the team's trackside servers to isolate the impact of tire status on performance.

Protecting your treasure

Obviously every team wants to make the best use of its own data. What each team doesn't want is for that data to leak to any of its rivals, something that is not unheard of in the sport. (McLaren was found guilty of possessing stolen Ferrari IP in 2007, and allegations have been made about similarities between Ferrari's 2003 and Toyota's 2004 F1 cars.) A number of companies—including Symantec and Thales—have been working with Williams to safeguard its crown jewels.

According to Darren Thomson, Symantec's CTO & vice president of technology services, "It's fair to say so far—having been in partnership for a year—that we focused on security basics with the team. There's lots we could help them with over future years, but some of the basics needed to be put right first."

That involved running Williams' leadership through a risk assessment and needs analysis, asking the question: "what should a Formula 1 team look like from a security and compliance perspective?"

"Information is king for an F1 team," Thomson told us. "Unlike other organizations, it's not personally identifiable information or customer info, but telemetry from the cars and also design IP. A threat actor is likely to be after those crown jewels." Thomson told us that protecting Williams from threats coming from e-mail and the Web has been the first step. "Endpoints in the organization were something that concerned Williams. We were seeing a lot of attacks that got as far as the endpoint, resulting in malware popping up here and there," he said. Positive IT security changes included a roll-out of Symantec's Endpoint Protection service with a heavy emphasis on encryption. "Williams has now gone to whole disk encryption across the entire business, and it's already had dividends with regard to laptops being lost or stolen," Thomson explained.

A particular concern—and one that is possibly unique to an F1 team versus a bank or biotech—was protecting the remote servers that travel along with the cars and team to each of the 21 races on the calendar.

"A few months back we started working with Williams around some issues they were concerned about with regard to data privacy," said Peter Galvin, VP of global strategy at Thales e-Security. "We provide them with mechanisms to protect that data. Essentially Williams has to move a mobile data center to a new location [at each race] with no overall control; in a typical enterprise location you'd normally control access to a building where servers sit, and so on. What's interesting about Williams is the challenge they face is unlike other enterprise companies. You have to go into a "hostile environment" to put in place a mobile data center and then protect the data while it's being used."

Thales has provided the team with encryption technology on top of its communications links (which run from the factory in Grove, UK to wherever the race is being held), as well as encryption for the car-to-pits telemetry feeds.

"It's truly a preemptive measure; one of the biggest challenges is going into places where you don't know how well you can trust the overall environment," Galvin told us. "Who knows what government agencies or hackers have access to networks in the countries they visit? The other challenge is that hackers are getting better at covering their tracks, so you don't discover an intrusion for several months. You really need to focus on the areas you think are most vulnerable. Here's its communications in a place where you don't own or have full control over them."