The Director-General of Security at the Australian Security Intelligence Organization (ASIO) has lamented the fact that many people list their work in the intelligence community or on sensitive military projects in their LinkedIn profiles.

In a [1]speech delivered on Thursday, Director-General Mike Burgess observed that “Nation states are spying at unprecedented levels, with unprecedented sophistication. ASIO is seeing more Australians targeted – more aggressively – than ever before.”

“Foreign intelligence services are proactive, creative and opportunistic in their targeting of current and former defence employees: relentless cyber espionage, in-person targeting and technical collection,” he added, before sharing some examples of their work.

[2]

“An Australian defence contractor invented, manufactured and marketed a world-leading innovation,” he explained, and enjoyed booming sales before a sudden collapse.

[3]

[4]

“Customers began flooding the company’s repair centre with faulty products. While the returns looked genuine, closer examination revealed they were cheap and nasty knock offs,” Burgess said.

ASIO investigated and learned that one of the contractor’s staff “attended a defence industry event overseas and was approached by an enthusiastic local. She insisted on sharing some content via a USB, which was inserted into a company laptop. The USB infected the system with malware allowing hackers to steal the blueprints for the product.”

LinkedIn lurkers

Another case ASIO considered saw an Australian company create what Burgess described as “an expensive and highly sophisticated military capability, only for another country to unveil a prototype with unmistakable similarities shortly afterwards.”

“While I cannot categorically say espionage was involved, spy chiefs do not believe in coincidences,” Burgess said. In this case, ASIO was aware that an intelligence service from the other country "tried to cultivate relationships with the company’s employees” and had an easy time of it because “more than 100 individuals on LinkedIn” said they worked on the project.

[5]

Others involved in the project posted “specifications and functionality on open discussion forums.”

“All of this created a cumulative and comprehensive set of information, people and opportunities for foreign powers to target and exploit,” Burgess lamented.

The intelligence chief lamented that “On just one professional networking site, the profiles of more than 35,000 Australians indicate they have access to sensitive and potentially classified information.” Around 7,000 of those profiles mention work in the defence sector, “including the specific project they are working on, the team they are working in, and the critical technologies they are working with.”

[6]

“Nearly two and a half thousand publicly boast about having a security clearance and thirteen hundred claim to work in the national security community,” Burgess added, and over 400 mention work on [7]AUKUS , the US/UK/Australian defence pact that involves joint operation of nuclear submarines, plus collaboration on cyber capabilities, artificial intelligence, and quantum technologies.

“While these numbers have fallen since I first raised the alarm two years ago, this still makes my head spin,” Burgess said. “Surely these individuals, of all people, should understand the threat and recognise the risk?”

“I get that people need to market themselves, but telling social media you hold a security clearance or work on a highly classified project is more than naïve; it’s recklessly inviting the attention of a foreign intelligence service,” he said, because “Spies from multiple countries routinely and relentlessly trawl professional networking sites, seeking to identify, target and cultivate Australians with access to privileged information.”

“The spies pose as consultants, head-hunters, local government officials, academics and think tank researchers, claiming to be from fictional companies.”

Bad jobs

Burgess shared an example of this form of spying in action, involving a foreign intelligence service that “used a professional networking site to identify an Australian with access to security clearance holders.”

The foreign spies “cultivated the individual over an extended period, offering payment in exchange for written reports.”

Fighting back with old tools? In his speech, Burgess said ASIO has detected and disrupted “24 major espionage and foreign interference disruptions in the last three years alone – more than the previous eight years combined.”

A report published this week by the Australian Strategic Policy Institute (ASPI) suggests Intelligence agencies did so despite using outdated tools.

The [8]report , titled “ Match-fit for the global contest?” claims that Australian intelligence community has fallen behind in use of technology.

“One example of such erosion is a limitation on mobile technology usage within … high-security work environments both for personal use but also for professional uses now common to workplaces in the broader community,” the report asserts. “This extends beyond access to mobile devices to include security-required lags in the take-up of other technologies, including generative AI.”

ASPI’s analysts quoted a former senior intelligence official who said “Even when we pull tech tools into classified spaces—they’re lesser versions because they don’t have the connections and data required to work to their full potential. [This] has become more acute in the last 5–10 years. Especially as cloud computing, neural networks, machine learning have become the norm for tech.”

“At first the requested topics were general in nature – broad insights into bilateral relations and Australia’s strategic policy directions. But over time, the requests turned into demands, the topics became more specific and the sort of information required grew more sensitive, such as Australia’s intelligence priorities.”

ASIO learned of the effort and intervened before the target shared sensitive material.

In another case, Burgess said “A particularly aggressive and creative intelligence service expanded this sort of operation to employment sites. It started creating fake online job ads, advertising well-paid, part-time roles for people with expertise in geopolitics or defence.”

One such campaign used what Burgess described as “a popular employment website” and offered $500 for “reports on international politics”. “An Australian sent in a CV, and quickly received a return email requesting information on AUKUS and the Indo-Pacific,” Burgess said. “The firm said it was particularly interested in ‘exclusive information’ and requested the applicant share the names of his AUKUS-related professional contacts.”

The applicant suspected something was amiss, and reported it to ASIO, which investigated and found the consultancy “was a cover company for a foreign intelligence service.”

Burgess’ speech coincided with the launch of a report on the cost of espionage to Australia – estimated at AU$12.5 billion ($8 billion) – that includes another couple of juicy case studies:

Spies hacked the network of a major Australian exporter and stole commercially sensitive information later used to inform contract negotiations, costing Australia hundreds of millions of dollars;

An overseas delegation visited an Australian horticulture facility and snapped branches from a rare and valuable fruit tree, allowing the thieves access to a plant that represented decades of research.

Do the basics

Burgess said most organizations can defend against espionage with the same techniques they use to manage other foreseeable organisational challenges like criminal theft, fraud, workplace accidents and equipment failures – such as acknowledging the threat and creating “a coherent, connected security strategy across your whole enterprise – your people, places, technology and information.”

He added that those who fall victim to spies usually make simple mistakes.

“Building a high tech fence isn’t much help if you use PASSWORD as a password; and great cyber security isn’t much help if you can’t control access to your premises,” he said, before suggesting managers need to pay more attention to their teams.

“The people piece is most often overlooked,” he said. “I’m not suggesting managers need to conduct mass surveillance of their staff, but they do need to continuously educate them and stay alert to anomalous behaviour.”

Burgess also urged organizations to do the basics.

“Simple steps can make a major difference. The vast majority of cyber compromises involve a known vulnerability with a known fix – it just wasn’t addressed,” he said. “And when we identify an individual as a security problem, almost always the person’s manager says they’re shocked but not surprised. The signs were there but, again, the vulnerability wasn’t addressed.

“So good security is achievable, and good security works. Businesses and organisations don’t need to be spy catchers – that’s ASIO’s job – but they can, at the very least, make spying more difficult.” ®

Get our [9]Tech Resources



[1] https://www.asio.gov.au/26th-annual-hawke-lecture-counting-and-countering-cost-espionage

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aIyQOUQhL9a1kkOpVVZoaAAAAAE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aIyQOUQhL9a1kkOpVVZoaAAAAAE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aIyQOUQhL9a1kkOpVVZoaAAAAAE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aIyQOUQhL9a1kkOpVVZoaAAAAAE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aIyQOUQhL9a1kkOpVVZoaAAAAAE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[7] https://www.theregister.com/2021/09/16/aukus_defence_pact/

[8] https://www.aspi.org.au/report/match-fit-for-the-global-contest-innovation-leadership-culture-and-the-future-of-australias-national-intelligence-community/

[9] https://whitepapers.theregister.com/