Espionage: Not Someone Else’s Problem
Why Australian organisations need to understand the commercial face of foreign intelligence activity
For many Australian organisations, espionage remains something associated with classified documents, intelligence officers, defence establishments and government secrets. It belongs to the world of spy agencies rather than boardrooms, research laboratories, universities, technology companies or commercial supply chains.
That perception is increasingly difficult to sustain.
The Australian Government assesses espionage and foreign interference as among the principal security concerns facing the country. The Department of Home Affairs warns that espionage and foreign interference are at “extreme levels” and expected to intensify, while ASIO has consistently identified foreign intelligence services and their proxies as actively seeking advantage in Australia. [homeaffairs.gov.au]
The threat is therefore not hypothetical. Nor is it confined to government.
The contemporary intelligence target may be a senior executive, engineer, researcher, scientist, technology company, critical infrastructure operator, university, professional services firm or member of a strategically important supply chain. The information sought does not necessarily need to be classified. Indeed, ASIO specifically warns that foreign intelligence services target government, defence, academia and business, and that information which appears innocuous in isolation may become valuable when combined with other information. [nitro.asio.gov.au]
For Australian organisations, the security question is changing.
It is no longer sufficient to ask:
“Why would anybody spy on us?”
A better question is:
What do we possess, know, influence, enable or provide access to that could give another state a strategic advantage?
Espionage has a commercial face
Foreign intelligence activity does not always resemble espionage.
The person seeking information may not present as an intelligence officer. The approach may occur through a legitimate business relationship, employment opportunity, research collaboration, professional conference, investment proposition, consultancy, supplier engagement or personal relationship.
The intermediary may themselves be a legitimate businessperson, academic, recruiter, consultant or professional contact. In other circumstances, an individual or organisation may knowingly act as a proxy for a foreign state. This distinction matters.
The Australian Federal Police describes foreign interference as activity undertaken by or on behalf of a foreign government that may be coercive, threatening, deceptive or clandestine. Australian law expressly recognises the role of a foreign government's proxy or foreign actor, rather than limiting the threat to formal government officials or declared intelligence personnel. [afp.gov.au]
The Department of Home Affairs similarly warns that foreign governments and their proxies may seek to steal valuable research and innovation, manipulate decision-making, monitor communities or otherwise advance foreign-state interests. [homeaffairs.gov.au]
Consequently, the operational environment for espionage can look remarkably like normal commercial activity.
That is part of what makes it difficult to recognise.
The target may be access, not a secret
One of the most important misconceptions is that an organisation needs to possess sensitive government information before it is attractive to a foreign intelligence service.
It does not.
ASIO explicitly warns that information does not have to be highly classified to be valuable. Apparently innocuous information can be aggregated with other material to fill intelligence gaps or identify individuals for future targeting.
Moreover, information may only be one objective.
Foreign intelligence activity can reasonably seek several forms of advantage:
Information. Commercial plans, intellectual property, research, technology, vulnerabilities, negotiations, intentions or strategic assessments.
Capability. Access to technology, infrastructure, computing capacity, specialist expertise, manufacturing processes or other resources that are difficult to obtain directly.
Access. Relationships with people who can provide introductions, information, technical access or proximity to more valuable targets.
Influence. The opportunity to shape how an important person perceives an issue, organisation, government policy or strategic decision.
Positioning. Establishing access to networks, infrastructure, systems or people that may become valuable during a future crisis or period of strategic competition.
Seen this way, the intelligence value of an Australian organisation may bear little relationship to the classification of the documents it holds.
Its value can instead lie in what the organisation enables.
The proxy problem
Contemporary espionage also challenges traditional ideas about who constitutes the threat. A foreign intelligence service does not necessarily need to deploy one of its own officers against every target. Commercial organisations, intermediaries and individuals can provide access and legitimacy. Some may act knowingly. Others may simply occupy a useful position that can be exploited.
A legitimate business relationship can provide repeated contact with a decisionmaker. A research collaboration can provide insight into emerging technology. A supplier can acquire knowledge of critical dependencies. A recruitment process can identify personnel with valuable access. A professional relationship can gradually create familiarity and trust.
None of these activities is inherently suspicious. That is precisely the point.
Effective intelligence activity can exploit the normal architecture of commercial and professional life. The challenge for protective security is therefore not to treat international engagement as inherently threatening. Australia depends heavily on international investment, research, trade and collaboration. Rather, organisations need sufficient security maturity to recognise when otherwise legitimate activity begins exhibiting indicators inconsistent with its stated commercial purpose.
ASIO's public counter-espionage guidance identifies behaviours including attempts to elicit information beyond what is appropriate, unusual interest in sensitive matters, inappropriate removal of information, unexplained access requirements and exploitation of personal vulnerabilities. [nitro.asio.gov.au].
Cyber operations are only one part of the problem
The growing emphasis on cyber security can unintentionally narrow organisational thinking. Cyber compromise undoubtedly provides foreign intelligence services with an efficient means of collecting information. The Australian Signals Directorate's 2025-26 threat reporting states that Australia continues to be targeted by state-sponsored actors seeking to steal information, conduct espionage and position themselves for future malicious activity. ASD also assesses that the boundary between state-sponsored espionage, sabotage and cybercrime is becoming increasingly blurred.
However, cyber security does not replace counterintelligence.
Technical controls may protect a network while leaving the organisation vulnerable through its people, commercial relationships, supply chain, physical access or decision-making processes.
The contemporary threat is better understood as multi-vector.
A hostile state can potentially combine cyber collection, open-source research, human relationships, commercial intermediaries, insiders, technology partnerships and proxies. ASIO has publicly acknowledged disrupting hostile intelligence activity across both HUMINT and cyber vectors in Australia.
Security architecture therefore needs to account for the same breadth of approaches.
Preparedness Matters as Much as Prevention
A capable protective security posture must also recognise an uncomfortable reality: prevention cannot be guaranteed.
Australia's crowded places strategy explicitly acknowledges that, despite the capability of Australia's law enforcement and intelligence agencies, it will not always be possible to prevent every terrorist attack. Its objective therefore extends to improving the resilience of crowded places.
That distinction is significant.
Security planning should consider what happens before, during and after a serious incident. Before an event, organisations can focus on deterrence, detection, access management, threat recognition and early intervention.
During an event, priorities shift towards immediate protective actions, communication, emergency response and the protection of life.
After an event, command arrangements, business continuity, stakeholder communication and organisational recovery become increasingly important.
Preparedness therefore extends beyond guards, cameras, barriers and access control systems. It encompasses whether people understand what to do when normal assumptions no longer apply.
Australian business is part of the national security environment
This is perhaps the most important change in mindset. Foreign intelligence collection is not solely an issue for Canberra.
Australia's national capability increasingly resides outside government:
universities conduct strategically important research;
private companies operate critical infrastructure;
technology companies hold valuable intellectual property; professional services firms advise government and industry; contractors support Defence; and
commercial organisations operate supply chains upon which national resilience depends.
The Australian Federal Police identifies political systems, military capability, trade and economic interests, intellectual property and community safety among the Australian interests threatened by espionage and foreign interference. [afp.gov.au]
Australian counterintelligence activity consequently extends well beyond protection of classified government information. ASIO describes the threat as involving foreign intelligence services and proxies seeking to exploit Australian institutions and interests, and the Commonwealth's Counter Foreign Interference Taskforce undertakes investigations and disruptive actions, many of which never become publicly visible.
That last point deserves emphasis. The relatively small number of publicly visible espionage prosecutions should not be interpreted as evidence that espionage is rare. In August 2026, the AFP explained that most Australian Government actions taken to mitigate espionage and foreign interference threats are not publicly visible. ASIO's Director-General has characterised espionage and foreign interference as being at extreme levels.
The public record therefore represents only part of the threat environment.
From security compliance to counterintelligence awareness
Australian organisations do not need to turn employees into amateur intelligence officers. Nor should legitimate engagement with international businesses, researchers or communities become grounds for suspicion.
The requirement is considerably more practical. Protective security needs to become threat-informed rather than merely control-focused.
Executives and security leaders should understand which aspects of the organisation could provide strategic value to a foreign state. This should extend beyond sensitive documents to intellectual property, research, data, specialist personnel, supply-chain access, technology, infrastructure, strategic relationships and decision-making authority.
Personnel in positions of particular access should understand elicitation and cultivation techniques. International partnerships and suppliers associated with sensitive technology should receive proportionate due diligence. Unusual requests for information or access should have an escalation pathway. Cyber, personnel, physical and supply-chain security should be considered collectively rather than as separate disciplines.
Moreover, organisations should know what constitutes a reportable concern. Suspected foreign interference can be reported through Australia's National Security Hotline on 1800 123 400, while suspicious cyber activity can be reported through the Australian Signals Directorate's Australian Cyber Security Centre or 1300 CYBER1 (1300 292 371).
The question every organisation should ask
Espionage has always involved obtaining access to things another state cannot readily acquire for itself. What has changed is the breadth of things capable of providing strategic advantage.
Technology, intellectual property, research, data and specialist knowledge matter. Increasingly, so do computing capability, supply-chain position, commercial relationships and influence over strategically important decisions.
The target may therefore not be a secret.
The target may be access.
For boards and executives, this produces a deceptively simple security question:
If a foreign state wanted to obtain strategic advantage from our organisation, what would it want access to, who could provide that access, and how would we recognise the approach?
An organisation that cannot answer that question does not yet understand its espionage risk.
Montane Protective Security provides intelligence-informed protective security, risk assessment and security advisory services to organisations operating in complex environments.
Comments