Foreign intelligence entities and persons are prowling around to illegally access U.S. classified information and U.S. critical technology; to illegally purchase U.S. export-controlled technology and to cajole talented U.S. persons with knowledge around emerging technology or classified information to start talking or to take their talent outside the U.S.
The Defense Counterintelligence and Security Agency’s (DCSA) 2026 annual report, Targeting U.S. Technologies: A Report of Threats to Cleared Industry informs on how U.S. adversaries and even U.S. friendly nations have attempted to gain access to U.S. classified information or U.S. controlled technology in 2025 Interestingly, they are not employing sophisticated intelligence gathering tradecraft but rather quite mundane tools: emails or web forms to buy products, applying for jobs, or engaging with U.S. companies at tradeshows, for example.
DCSA is required by a specific Department of Defense Instruction 5200.39, Critical Program Information Identification and Protection Within Research, Development, Test, and Evaluation to develop a report on efforts to exploit people holding U.S. clearances or to illegally access U.S. classified information or U.S. export-controlled technologies.
The Statistics
According to the report, DCSA received around 22,000 reports from contractors who are required to file suspicious activity reports under the National Industrial Security Program Operating Manual located at 32 CFR Part 117. Of these reports, roughly 2,900 involved foreign entities actively fishing for sensitive information or technology. This includes trying to evade U.S. export-control regulations to access controlled technologies. Almost 50% of the threats to U.S. were out of the East Asia – Pacific region, making the region the most prolific.
DCSA reports that the demand for U.S. technology and classified information depends on the specific geo-political situation of those seeking to get the information.
- Indo-Pac Drivers: The need to demonstrate military capabilities, military competition and U.S. export controls that are squeezing access to technology drove demand for U.S. advanced electronics, AI, and telecommunications technology in this region.
- Middle East: Armed conflict, instability, geopolitical tension and the need for a secure defense infrastructure drove nations in this region to look for U.S. air and defense systems, autonomous weapons, software and hypersonic-related technology.
- Europe: The Russia-Ukraine war drove demand for information and products related to U.S. aerospace, communications, munitions, missiles and the technology that supports these items.
- Western Hemisphere: In the West, bad actors wanted to get around international and U.S. sanctions and export controls to obtain aeronautic, software, electronics, and space related technology.
Tactics
Tactics used included front companies, networking, fake identities, scholarship sponsors, journal editorial boards, opportunities to collaborate on research and simply trying to buy export-controlled products. The main approach – making the request look like a legitimate business opportunity, job opportunity, or an academic research or collaboration.
Those using tactics to try and collect the sensitive information were from industry, from organizations affiliated with governments, were individuals, or were governments. In some instances, it was not clear who was trying to collect the information was affiliated with.
Depending on the region, the tactics used were different. In the Asia – Pacific region those attempting to access sensitive information were from industry – 63%, 17% were affiliated with governments, 14% were individuals, 3% were governments and 3% were unknown.
Asia and the Middle East: Entities from these regions used résumé-based approaches to try and exploit cleared persons in both the defense industrial base and in academics to get the sought-after information.
Europe: Entities in Europe used expert network outreach, cyberactivity, tradeshows, and business transactions to seek access to defense-related technologies and information.
Western Hemisphere: Entities from the region used commercial companies and individuals, networks of subject matter experts, interns looking for jobs, cyberactivity, and technology-related requests to purchase, obtain or access sensitive U.S. information and technology.
Attempts to approach cleared businesses and academics occurred by seeking employment and by simply trying to purchase the controlled technology using these tactics primarily:
- Resumes
- Web Forms
Efforts to purchase U.S. export-controlled items often included falsifying who the end-user of the products or software would be.
Exploiting experts accounted for 28% of the incidents by foreign entities looking to engage cleared subject matter experts for their knowledge. U.S. experts were sought by recruiting them for positions, inviting them to attend conferences, offering to publish their research all in an effort to gain access to technical knowledge or to field critical military capabilities and emerging technologies.
Bad actors also used trade shows and supplier relationships under a pretense of legitimacy to build business relationships or to engage in commercial transactions to gain access to the military capabilities and technology.
Cyber exploitation was also prevalent with actors attempting to or actually breaching public websites, cleared contractors’ networks, for example.
Some specific examples cited in the report:
- An East Asia and Pacific Ministry of Defense representative approached a U.S. cybersecurity engineer working for a U.S. defense contractor at a conference. The representative tried to get information related to U.S. fighter aircraft and repeatedly invited engineer to get dessert – just the two of them.
- At an electrical and electronic conference, a researcher from the Near East approached an employee of a cleared U.S. contractor the employee presented on research for a U.S. Government agency that could be publicly shared and asked the employee detailed questions about specific classified work related to the presentation.
- A representative from a foreign defense contractor tried to use a telephoto camera to take photographs an ITAR-controlled ground vehicle on display at a tradeshow outside of the U.S. When the U.S. defense contractor employees attempted to interact with the person, they concealed their badge and avoided engaging with the U.S. defense contractor employees.
- A foreign individual contacted an employee of a cleared U.S. defense contractor on a professional networking plat form and offered the cleared employee paid consulting opportunity to discuss their employer’s and other companies’ technologies.
- A retired military officer from a foreign government working for a foreign defense contractor submitted a web form requesting a quote for ITAR-controlled products to a U.S.-based microelectronics cleared contractor.
- For Africa, the primary method was African individuals and commercial companies simply submitting requests to U.S. defense contractors for information to access restricted satellite imagery.
What To Do With This Information
Since the efforts to exploit or access classified information and controlled technology are mundane, cleared contractors need not sink a lot of time and money into mitigating the risk of having controlled technology or classified information exploited. Instead, use just as mundane procedures to blunt this risk:
- Be suspicious of résumés and RFIs. Train recruiters and those handling requests for export-controlled products to be alert to and to be able to identify suspicious persons and transactions.
- Experts beware. Employees with knowledge, experience and education related to cutting-edge technologies or doing research in innovative areas also need to be trained so they can stay alert for: reach outs on professional networks, engagement at conferences, offers to be a consultant or speaker, opportunities for collaborative research or to draft articles.
- Be discrete with announcements. Public reveals about new, sensitive technologies or a big defense contract will be a green light for those looking to gather information and make you a target. Be a bit more discrete when awarded a defense contract dealing with sensitive information or about developments with export-controlled technologies.
- Conduct robust due diligence. Front companies, fake end-users, and proxies are out there. Make sure due diligence research is extensive looking at your customer and business partners: ownership, business relationships, customers and who can influence them. Screen against all U.S. prohibited party lists: Treasury’s sanctioned entity list; debarred and suspended lists; Department of Commerce entity lists, and Department of Defense’s list of Chinese Military Companies – for example. Make sure you have legal support to make the judgement call if there is a match between a customer or business partner and the name on the list since it’s not always an obvious match.
- Tradeshow Practices. At tradeshows, in the U.S. and overseas stay alert for attempts to photograph technology or presentations, to steal badges, products or devices.
- File suspicious activity reports. Be sure to file required suspicious activity reports even when it seems like it is nothing significant. Let DCSA make that determination.
DCSA’s report reminds that U.S. national security requires a secure defense industrial base. Those in the defense industrial base are part of that mission especially those with access to classified information and export-controlled technology. Stay alert to secure the DIB.
