A Spy Among Friends: Be Careful What and to Whom You Speak

Have you ever encountered a person at a business meeting, networking event, or official trip who asks strange questions, digs a little too deeply for information about your business, while avoiding answers about themselves and their work? Or have you perhaps noticed that one of your employees or colleagues expresses unusual interest in confidential information such as business plans, research and development, and finances? You may have come across a spy.

Amid all the risks and challenges that entrepreneurs have faced and battled in recent years, such as crises, wars, inflation, and hacking attacks, corporate espionage may be one of the least noticeable yet very present and dangerous threats to business. Additionally, due to digital transformation, companies are at risk of key information, intellectual property, and confidential data easily falling into the wrong hands. The main actors – spies – do not always employ sophisticated tactics or advanced technology; sometimes they infiltrate companies unnoticed.

Threat to National Interests

Espionage, or foreign intelligence activity, was most intense in Croatia during the Homeland War, and the Security and Intelligence Agency emphasizes that it is still present today. As an example of foreign intelligence activity in Croatia, it is stated on its website that there is an ‘effort to obtain classified data that could jeopardize the national interests of the Republic of Croatia, e.g., in areas such as economic activities or international negotiations in which the Republic of Croatia participates.’ Spies pose as diplomats, scientists, journalists, or entrepreneurs, so individuals who come into contact with them – employees in public and private companies – may unknowingly become sources of information. Since joining NATO and the European Union, Croatia has become a subject of intelligence interest for certain countries that NATO and the EU consider a security challenge or threat, and spies collect data on Croatia’s policy towards the countries of the Western Balkans.

Similarly, SOA states that spies ‘may seek to influence the Croatian public by disseminating (dis)information that serves their goals.’ The mentioned disinformation is hybrid threats, i.e., foreign interference in democratic processes and disruption of national decision-making, which Western countries are increasingly facing. Behind such threats are often state actors from Russia and China, who frequently hide behind so-called useful idiots, influential individuals who do not realize that they are being exploited by foreign countries to spread disinformation online.

Given the specificity of their work and legal restrictions, SOA could not respond to Lider’s inquiry about the specific number and frequency of espionages in Croatia, where they come from, and how to recognize them. The detection of such activities does not happen in the public eye, nor are they often found in the media. However, they referred us to their reports on foreign intelligence activities and counterintelligence work published since 2014. In that first report, SOA mentions an increase in the trend of accepting radical interpretations of Islam in Southeast European countries and warns of the security challenge of ‘jihadists,’ who remain a threat in Europe today.

On the other hand, Željko Cvrtila, a security expert and consultant, and owner of the Analytics company for business security and ISO standards, says that he does not know of specific examples of espionage in Croatia after the war, and often states that there are obviously no foreign agents in Croatia.

– But I think that is not true; rather, it will be that our services are unable to locate them or manipulate them to disseminate the data they want to be forwarded – emphasizes Cvrtila, adding that such spies seek to learn secrets from entrepreneurs, politicians, and generally people they come into contact with.

—

Željko Cvrtila

photo Analytics.com

—In general, data that is not publicly available based on which they can undermine the functioning of the company or state. By weakening the company, competitors can come into a position to take over its business or take over the entire targeted company, which has happened in Croatia by domestic and foreign predators. When it comes to weakening the state, such a state weakens economically, institutionally, and supervisory, making it easier to install their employees in various positions who will work in the interest of the foreign state. For example, they will praise the work of the foreign state, its culture, strength, military, suppress domestic identity, disseminate various disinformation within the state and around the world, and based on the data available to them, be a step ahead in business, security, and diplomatic negotiations. Initiating corruption and ‘unfortunate’ situations for officials for their blackmail and subjugation to the wishes and interests of the foreign state – states Cvrtila, who has been dealing with security for over 30 years.

Cyber Threat

It is extremely important to keep in mind that espionage today also exists in the virtual world. Spies obtain information through cyber attacks such as phishing and malware, and of course, there are also phone tapping and reading unencrypted messages. Cyber espionage is a growing problem in the world, including in Croatia. In its 2020 report, SOA speaks of foreign intelligence work in the information, especially in the cyber space.

‘Along with classic intelligence activities and data collection, there has been an increasing use of cyber attacks on the information infrastructure of state bodies for espionage and data theft in recent years,’ states SOA’s 2020 report.

In the latest public report from SOA in 2022, there is mention of an increase in the number of state-sponsored cyber attacks on state bodies and critical infrastructure operators in the Republic of Croatia. Namely, in the first half of this year alone, more than ten advanced state-sponsored cyber attacks targeting carefully selected targets were recorded, carried out by organized hacker groups linked to the intelligence systems of certain states. Cyber attacks particularly target protected systems and communications of state bodies in the areas of foreign affairs, defense, finance, and economy. Let us recall the cyber attack on the Zagreb Clinical Hospital. Last year, 31 such attacks were recorded, and the year before, nineteen.

As SOA warns, the consequences of espionage ‘can be economic losses, increased costs or dependencies of the state, destabilization of security conditions, hindering the free making of political decisions, and even endangering the physical safety of Croatian citizens.’ Thus, through the implementation of the EU’s NIS2 Directive via the new Cybersecurity Act, which comes into force on October 17 of this year, SOA will become the central state body for cybersecurity as well.

Warning Signs

A warning sign of a spy can be any attempt to access confidential information or intellectual property without a specific need, states Tapio Pyysalo, head of international relations at the European Centre of Excellence for Countering Hybrid Threats, of which Croatia has been a member since 2021.

—

Tapio Pyysalo

photo Ratko Mavar

—Cyber espionage is even harder to detect, but it often requires social engineering or gathering information from private individuals to access systems with restricted access. Therefore, one should always be suspicious of any attempts to obtain your personal data or login information, and sometimes your click on a link is all hackers need to gain access to sensitive information – explains Pyysalo, adding that in some cases, for example in politics, spies seek to achieve long-term influence.

Thus, a recent case where the Chinese government has long bribed Linda Sun, a former deputy governor of New York, for espionage activities has shed light on the trend of receiving money and gifts from foreign governments among high public officials in the United States.

Pyysalo also makes a distinction between legal and illegal spies.

– Legal spies, or intelligence officers, operate under the official cover of a national embassy and are protected by diplomatic immunity. They are recognized by the host government and officially accredited in the same way as diplomats. If they are involved in illegal activities, they can be expelled from the host country, but not prosecuted due to diplomatic immunity. Illegal spies or ‘illegals’ operate without official cover or diplomatic immunity. They usually operate under false identities, and if caught, they can be prosecuted and usually face severe penalties – explains Pyysalo.

– There is growing concern about Russian espionage in Europe since the Russian illegal invasion of Ukraine in 2022, and in March 2022, several European countries decided to expel about 600 Russian diplomats due to suspicions of espionage. This disrupted Russian espionage efforts in Europe, and it now seems that Russia is trying to recruit national illegal spies to fill its thinned network of legal spies. There is increasing concern about recent sabotage and cyber attacks across Europe, and even NATO has discussed options for responding to this with ‘stricter limitations on Russian intelligence personnel across the Alliance,’ while the EU is considering options to limit the movement of legal spies within the Union – adds Pyysalo.

As specific cases, he mentions that Germany in 2023 accused two German citizens of treason for spying for Russia, and in the spring of 2024, a German official in the European Parliament was arrested on suspicion of spying for China.

– The actions of legal spies are usually not made public, but they are quietly expelled if caught in illegal activities. Most countries have legal spies or intelligence officers, but the latest concern, at least in Europe, is related to Russian and Chinese spies – concludes Pyysalo.

‘Cola Wars’

In business circles worldwide, perhaps one of the most famous cases of espionage is the one from 2006 between Coca-Cola and Pepsi, the two largest competitors in the soft drink industry, when Joya Williams, then assistant marketing manager at Coca-Cola, dissatisfied with working conditions, attempted to provide confidential information to Pepsi in exchange for money. Specifically, it was about the secret formula for new drinks that Coca-Cola was developing at the time (and it is important to emphasize that the original formula for real Coca-Cola is one of the most guarded secrets in the world, stored in a vault worth millions of dollars, whose recipe is known only to two people on Earth, who therefore never fly on the same plane in case of an accident). In short, Pepsi did not accept such an (immoral) offer but maintained business integrity and informed Coca-Cola, its biggest rival, about the espionage, even cooperating with the FBI to catch the employee and her accomplices in their attempt to commit fraud.

This is an example that clearly illustrates how industrial espionage can potentially harm a company’s business, not only through loss of revenue or market share but also through damage to reputation and customer or client trust, which is harder to repair than financial losses. It also emphasizes the importance of protecting confidential information and ethical conduct in a competitive environment. However, no business or system is immune to foreign intelligence activities. All smart states have espionage, warns Cvrtila.

– Some states have based or still base their economic growth on this, such as Japan, North and South Korea, China… Also, many companies invest more in espionage, i.e., copying other products than in developing their own, as it is far more profitable. In the end, it should be noted that only about ten percent of Croatian companies have some form of business (corporate) security, while, for example, 90 percent of companies in the USA and the 500 largest Swiss companies have excellently organized business security. Is it a coincidence that their companies are at the top of the world economy? – asks Cvrtila.

Difficult to Identify

How a person in business circles, or in any other situation, could notice that they are talking to a potential spy and what statements, questions, or behavior patterns might raise suspicion that a person is a spy is hard to say.

– The average person does not even think about spies, nor do they have any knowledge of how that system works, so they can hardly identify a foreign agent who usually has well-structured legends. For this reason, it is also difficult for counterintelligence to identify foreign agents. Often, foreign agents are legendary from childhood. Here, it is necessary to distinguish agents from recruiting informants who work for foreign agents for various motives: patriotism towards the state that engages them, money, disappointment with their state or company, thinking of the right that belongs to them, and so on… When it comes to business entities, it is usually about industrial (business) espionage that can be initiated by competing companies or foreign states. The most common way is actually inserting one’s person into a job function in a particular company. If a company does not have established mechanisms to protect its data, for example, ISO 27001 or another adequate method of data protection, it becomes an easy target – explains Cvrtila, noting that if a person suspects that they are dealing with a foreign agent, they can certainly report it anonymously to SOA.

For all the above reasons, it is important to remember that protection against corporate espionage also involves raising awareness and building a culture of security within the organization. The general advice is to reassess security practices within your organizations, remind employees to safeguard business secrets, and consult experts as needed. Finally, be careful what you say about your company and business and to whom, whether in person or online, because you never know who is listening. A well-known song says that spies are ‘among us’ – and that is, unfortunately, true.