Columns

On Security

The combination of desperate workers in strategic industries and decreasing security budgets represents a golden opportunity for hostile intelligence agencies.

Editor&#39;s Note: This On Security represents a milestone for long-term Stratfor lead security analyst Scott Stewart, who is leaving the company after 16 years of leadership and trenchant analysis. We thank him for his many years of loyal service, and wish him the best in his future endeavors.I&#39;ve seen a number of news reports discussing how the lockdowns and travel bans resulting from COVID-19 are hindering the ability of intelligence officers to do their jobs by preventing them from being able to conduct in-person source meets. The topic has also been discussed heavily in my social media feeds, and I&#39;ve discussed the matter privately with friends who are former intelligence officers and have expressed similar concerns. &nbsp; Certainly, the inability to conduct face-to-face source meets, and to make personal contact with recruitment targets to develop relationships with them, is a valid concern. I would like to suggest, however, that the economic crisis resulting from COVID-19 will also provide intelligence officers a golden opportunity to spot and recruit new agents.

The Big Picture

COVID-19

Aside from banning public meetings, closing bars and restaurants and severely curtailing travel, one of the other impacts of the response to the COVID-19 crisis has been widespread unemployment, with millions of people now out of work. And it is not just restaurant workers who are out of work: Among the unemployed are tens of thousands of workers in industries being targeted by hostile intelligence agencies, such as tech, aerospace, energy, and oil and gas. (Oil and gas companies are also being heavily impacted at the current time by the ongoing price war between Saudi Arabia and Russia.) For example, GE Aviation, a company <a href="/article/sting-operation-lifts-lid-chinese-espionage">repeatedly targeted by a Chinese intelligence campaign</a> to steal engine manufacturing technology, announced it was laying off 10 percent of its workforce in March, and in April announced that it was laying off 50 percent of its engine manufacturing workforce.

Priority Sectors of Russia and China

Blue-collar workers are not the only ones impacted by the crisis: Executives, engineers and other white-collar employees are also being laid off or taking pay cuts. For example, at the Canadian defense firm CAE, the executive team has taken 50 percent pay cuts, vice presidents 30 percent, managers and directors 20 percent and all other remaining employees 10 percent. The impact on these firms and employees is arguably the greatest since the 2007-2009 global financial crisis &mdash; and this all comes during a time when I believe <a href="/article/era-unparalleled-corporate-espionage-risk-upon-us-security-cybersecurity-threat">the corporate espionage threat is direr than ever</a>. &nbsp; COVID-19 has not dampened the appetite of the Chinese or Russian intelligence services (or of others, including competing companies) for corporate secrets. If anything, that appetite might increase during these hard economic times, because it remains cheaper and quicker to steal technology than it does to develop it independently. While it does make it more difficult to meet prospective agents face to face, lack of personal contact has not been a significant problem in past cases. In fact, as I have previously written, we have seen a number of cases in which&nbsp;<a href="/article/linkedin-cybersecurity-recruitment-hostile-intelligence-agency">LinkedIn was used to spot and then establish contact with espionage targets</a>. LinkedIn allows intelligence officers to quickly search for employees at a particular company they are interested in targeting. In many cases, people helpfully list the programs or technologies they are working on, along with any security clearances they may have. Many times people will also indicate that they are out of work, or otherwise looking for a job on their LinkedIn profiles. This kind of information makes the spotting phase of the recruitment cycle very easy.

The Human Intelligence Recruitment Process

But as we have seen in past cases, such as the aforementioned GE Aviation case or<a href="/article/former-cia-officer-possibly-responsible-compromised-sources-china"> the recruitment of former CIA case officer Kevin Mallory</a>, LinkedIn was not just used for spotting. It was also used to establish contact and begin to develop a relationship with the targets.&nbsp;By offering ruse &quot;work at home for pay&quot; projects to unemployed people who have access to desired technologies, it is not hard to see how an intelligence officer could establish a solid relationship and at the same time set a &quot;little hook&quot; in a person. The intelligence officer merely needs to help the target financially during this crisis only to use that aid later as leverage after the person returns to work at his or her current firm, or finds employment at another firm working in a similar position with access to the desired technologies or information. This can all be done remotely over LinkedIn or other social media apps. It would not be difficult to make a wire transfer to an employee&#39;s bank account via a shell company, or perhaps to send him or her some cryptocurrency.&nbsp; &nbsp; Many examples exist of Russian and Chinese intelligence officers being extremely patient in their intelligence efforts, often waiting years before their investment in an agent begins to pay off. Shelling out a little seed money and then waiting for this current economic crisis to end and for the employee to return to work would not be a long wait at all for them.They may not even have to wait: While most companies presumably cut off the access laid-off employees have to sensitive or proprietary information residing on company-owned systems, how much of that information do they possess in their own devices and storage media, how much could they obtain from friends and colleagues still at the company, and how much resides in their own heads? In this vein, we saw Chinese intelligence recruit Mallory despite the fact he was a former CIA case officer and did not have the same access to agency intelligence he did as an active employee. &nbsp; In terms of recruitment strategies, obviously money would be the No. 1 approach to use for a laid-off employee caught in a desperate financial situation due to a mortgage and other bills to pay, and perhaps with a child or two in college. A financial approach could be especially effective combined with a little hook approach as described above that could later be used for blackmail if they decided not to cooperate with future taskings. We saw the Chinese use this approach in the Mallory case, the GE Aviation case and in <a href="/article/unlocking-secrets-momint">the recruitment of State Department employee Candace Claiborne</a>. But if the employee is angry over being laid off, an intelligence officer who plays to the employee&#39;s ego, and perhaps thirst for revenge could also have a fairly easy time with recruitment. This holds true even if recruitment is done remotely over social media via chats and voice apps, similar to how we&#39;ve seen terrorists overseas remotely recruit grassroots operatives living in the West.<h3>The Security Paradox</h3>Fred Burton and I <a href="/article/security-implications-global-financial-crisis">noted the following in 2009 during the global financial crisis</a>:<blockquote>During times of financial hardship, companies often have to make cuts like the aforementioned layoffs. When companies plan cuts, they often focus on eliminating those corporate functions that do not appear to be contributing to the company&#39;s profitability. And one of the first functions cut during tough times often is corporate security. A security department typically has a pretty substantial budget (it costs a lot for all those guards, access control devices, cameras and alarms), and security is usually viewed as detracting from, rather than contributing to, the company&#39;s bottom line. The &quot;fat&quot; security budget is seen as an easy place to quickly reduce costs in an effort to balance the profit-and-loss statement.</blockquote>This principle holds true today. One of the first places companies and organizations cut is security, which can serve to make them even more vulnerable to corporate espionage &mdash; especially if insider threat programs and other functions that protect against the theft of proprietary information are cut or curtailed just as the threat of corporate espionage involving laid-off employees is increasing. Also, even if the security programs are not cut or curtailed,&nbsp;<a href="/article/security-programs-employees-can-be-biggest-threat-and-asset-insider">the&nbsp;insider knowledge of security programs, policies and procedures</a> that recently fired employees bring along with them could serve to make company facilities more vulnerable to black-bag jobs and other security threats.&nbsp; &nbsp; <a href="/article/contingency-plans-covid-19-pandemic-disasters">As I noted a few weeks ago</a>, because of the COVID-19 crisis, &quot;the next few months are going to be extremely difficult for anyone attempting to conduct operations &mdash; especially transnationally. In fact, for many of us, this period may very well prove the most challenging of our careers.&quot; The corporate espionage threat arising from these layoffs is just one more factor adding weight to that Herculean challenge.

<ul><li>While the measures to combat COVID-19 have impacted the ability of intelligence officers to meet with sources and recruitment targets, the number of unemployed people represents a rich universe of potential targets.&nbsp;</li><li>The crisis has done nothing to decrease the appetite of hostile intelligence services and competing companies for corporate secrets. If anything, that appetite might increase during these hard economic times.</li><li>All this is happening during a time when security budgets are likely to be slashed, leading to an incredible challenge for those charged with protecting company secrets.</li></ul>

Highlights

United States

China

Russia

Environment, Science & Technology

Cyber

Military & Security

I've seen a number of news reports discussing how the lockdowns and travel bans resulting from COVID-19 are hindering the ability of intelligence officers to do their jobs by preventing them from being able to conduct in-person source meets. The inability to conduct face-to-face source meets, and to make personal contact with recruitment targets to develop relationships with them, is a valid concern. I would like to suggest, however, that the economic crisis resulting from COVID-19 will also provide intelligence officers a golden opportunity to spot and recruit new agents.

Filters

Search Tools

Forecasts

ANALYSES

SECTIONS

Explore

Subscribe

Help & Support