Business Travel Security and Trade-Show Counterintelligence: Why Trips and Conferences Are Prime Collection Opportunities

Empty airport terminal at night, representing business travel security — Trips and conferences put people, devices, and information outside the company’s walls. Photo: Envato.

A company’s most valuable people leave its building all the time. They fly to customer sites, speak at universities, staff booths at trade shows, and sit through long dinners with friendly strangers. For anyone trying to collect a company’s technology or plans, that is the easiest moment to reach them: away from the security team, tired, on unfamiliar networks, and in places where conversation is the whole point. The FBI’s guidance for business travelers is blunt: “In most countries, you have no expectation of privacy in Internet cafes, hotels, airplanes, offices, or public spaces” (FBI, Safety and Security for the Business Professional Traveling Abroad). Several of the best-documented trade secret prosecutions of the past decade began with a trip, an invitation to speak, or a meeting on a show floor.

This page explains why business travel and trade shows attract collection, what public government guidance in the United States and the United Kingdom recommends, how border device searches work, and what court-verified cases teach. It is one of three spokes on corporate counterintelligence. It is general guidance drawn from public sources, not legal or security advice for a specific trip or case; companies with a particular destination, product, or legal question should talk to counsel.

Business travel security at a glance

The core risk: travel puts people, devices, and conversations in places the company does not control. The FBI warns that “business and government travelers have reported their hotel rooms and belongings were searched while they were away” and that “hotel safes are not adequate protection” (FBI).
The main methods: elicitation in conversation, access to unattended devices, compromised Wi-Fi and charging points, paid invitations to speak abroad, and visitors who photograph or question exhibitors (FBI; DCSA).
Trade shows by the numbers: the Defense Counterintelligence and Security Agency reported that conference, convention, or trade show attendance figured in about nine percent of cleared industry’s suspicious-contact reporting in 2019 (DCSA).
Border searches: U.S. Customs and Border Protection searched travelers’ devices more than 55,000 times in fiscal 2025, a record but roughly 0.01 percent of travelers (Statista, from CBP data). China and other countries assert their own inspection powers.
Official guidance: FBI, the National Counterintelligence and Security Center (NCSC), CISA, the State Department, and the UK National Protective Security Authority (NPSA) all publish travel guidance, and it is consistent.

Why travel and conferences are prime collection opportunities

Intelligence officers and commercial collectors both prefer access that looks ordinary. A dinner invitation, a question after a panel, a paid guest lecture, or a delegation touring a facility are normal parts of business, which is exactly why they work as cover. Public guidance highlights a few recurring openings:

Elicitation: “the strategic use of conversation to extract information from people,” which rarely feels like an interview (FBI).
Hotel rooms and devices: NCSC’s advice is blunt: “A hotel safe is never ‘safe’” (NCSC).
Networks: in 2018 the Justice Department charged Russian military intelligence officers with breaching targets through hotel Wi-Fi; the defendants have not been tried, so these remain allegations (DOJ).
Invitations and online approaches: a flattering, fully paid invitation to speak abroad, or a fake recruiter online (GOV.UK).
Trade-show floors: warning signs include photography where it is prohibited and questions beyond the event’s scope (DCSA). Most visitors are exactly who they say they are.

What official guidance recommends

Government guidance on business travel is public and consistent. The FBI’s business travel brochure, NCSC’s travel tips, CISA, the State Department’s travel advisories, and the Five Eyes Secure Innovation guidance (MI5) all start from the same idea, in NCSC’s words: “If you can do without the device, don’t take it.” The FBI adds a principle that applies everywhere: “Know what information should not be shared” (FBI). Employees cannot protect what nobody has told them is sensitive, which ties travel security to the reasonable measures a company takes to protect its trade secrets.

Border device searches: what the law allows

Border searches are lawful government inspections, and travelers should treat them that way. The concern for companies is that a device examined out of the traveler’s sight may hold client data, privileged material, or export-controlled technology.

Trade show booth with visitors, where business travel security and counterintelligence meet — Trade shows invite questions; some visitors are collecting. Photo: Envato.

United States. Under CBP Directive 3340-049A, a basic search needs no suspicion, while an advanced search, in which an officer connects external equipment, generally requires reasonable suspicion or a national security concern (CBP). Courts continue to litigate the limits.

China. Rules in force since July 1, 2024 allow state security officers to collect electronic data from devices (Radio Free Asia); the ministry has said checks target people connected to counter-espionage cases, not every traveler (Reuters, via The Star).

Everywhere else. Many countries assert broad inspection authority, so public guidance converges on traveling with the minimum data a trip requires. Technical data leaving a country can also raise export control questions; see enforcement risk. Companies moving highly sensitive data should get specific advice from counsel.

Cases that show the risk

Mo Hailong and DuPont Pioneer (2016): alert staff in the field

Mo Hailong, director of international business at Beijing Dabeinong Technology Group, whose subsidiary Kings Nower Seed sold corn seed, admitted to a long-running conspiracy to steal inbred corn seed from DuPont Pioneer and Monsanto fields in Iowa and elsewhere for shipment to China. On October 5, 2016, he was sentenced to 36 months in prison, and the court ordered forfeiture of two farms bought and used in the conspiracy. The case began when DuPont Pioneer security staff noticed suspicious activity and alerted the FBI (DOJ). Lesson: collectors travel to where the asset is, and the people who notice an odd visitor are part of the security program.

Wei Sun and Raytheon (2020): the company laptop on a personal trip

Wei Sun, an electrical engineer with Raytheon Missiles and Defense in Tucson, took a personal trip to China from December 2018 to January 2019 with a company computer holding technical data on an advanced missile guidance system controlled under the Arms Export Control Act and ITAR. He pleaded guilty to an export control felony and on November 18, 2020, was sentenced to 38 months in prison. An FBI assistant director said, “This isn’t about a laptop mistakenly taken on a trip” (DOJ). Lesson: what is on a device when it crosses a border can itself be the violation.

Yanjun Xu and GE Aviation (2022): the paid invitation to speak

In March 2017, people working with Yanjun Xu, an officer of China’s Ministry of State Security, invited a GE Aviation employee to give a report at a Chinese university. The employee traveled to China in May 2017, presented, and was introduced to Xu, with travel and a stipend paid. GE Aviation then cooperated with the FBI, which took over communications in the employee’s name. Xu asked for a directory of the employee’s computer files and arranged to meet in Europe; he was arrested in Belgium in April 2018, convicted by a jury on November 5, 2021, and sentenced on November 16, 2022, to 20 years in prison (DOJ). The Sixth Circuit affirmed in 2024 (DOJ). Lesson: a flattering, fully paid speaking invitation is a classic approach, and a company that hears about it early can turn it around.

Klaus Pflugbeil and a U.S. electric vehicle maker (2024): the trade show as marketplace

Klaus Pflugbeil and Yilong Shao, former employees of a Canadian battery-assembly manufacturer acquired by a U.S. electric vehicle maker, ran a China-based business marketed as a replacement for the victim company’s products. On September 11, 2023, undercover FBI agents posing as buyers met Shao at a packaging and processing trade show in Las Vegas; Pflugbeil later emailed them a 66-page proposal containing the victim company’s trade secret drawings. Pflugbeil pleaded guilty on June 13, 2024 (DOJ) and was sentenced on December 16, 2024, to 24 months in prison (DOJ). Shao remained at large. Lesson: trade shows are where stolen technology gets sold as well as collected, so watch for your own designs in someone else’s booth.

Linwei Ding and Google (2026): the badge scan and the Beijing investor conference

Linwei Ding, a Google software engineer, was charged in 2024 with stealing artificial intelligence infrastructure trade secrets while secretly affiliated with two China-based companies. According to the indictment as reported by CBC News, Ding traveled to China for investor meetings, another employee scanned his access badge so he appeared to be at work while he was in China, and Google learned he had presented as chief executive of a Chinese startup at a Beijing investor conference days after he resigned (CBC News). A jury convicted him on January 29, 2026, of seven counts of economic espionage and seven of theft of trade secrets (DOJ). In August 2026, Judge Vince Chhabria vacated the economic espionage counts, finding the evidence insufficient to show Ding knew or intended his conduct would benefit the Chinese government, and on September 1, 2026, sentenced him to just under a year in prison on the theft counts, plus more than $189,000 in restitution and a $25,000 fine (KQED). Lesson: travel records, access logs, and public conference appearances together tell the story; no one of them alone does.

What it means for companies

Business travel security works when it is routine, proportionate, and grounded in what public guidance already says. Travelers should know what is sensitive, carry no more than the trip requires, and know whom to tell about an unusual approach, without fear of blame. Exhibitors should decide in advance what goes on display and what staff may discuss. And travel security should connect to insider risk and trade secret protection, so an approach reported after a trip reaches people who can act on it. Suspicion based on nationality is unfair, often unlawful, and poor security; attention belongs on behavior.

Laptop on a hotel room desk, a business travel security risk — Government guidance treats hotel rooms and safes as not private. Photo: Envato.

How intelligence and foresight help anticipate who will target you

Public guidance tells every company the same things. It cannot tell a company which of its people, products, and trips are most likely to draw attention, or from whom. That depends on where the company sits in a rival’s or a state’s priorities: which technologies a foreign industrial plan names, which competitors are racing to close a gap, and which events will gather the people who hold the answers. Seeing that in advance is a strategic intelligence question, and it is what separates a generic travel policy from protection aimed at the risks a company actually faces.

Frequently asked questions

Can U.S. border officers search my company laptop or phone?

Yes. Under CBP Directive 3340-049A, officers may conduct a basic search without suspicion; an advanced search with external equipment requires reasonable suspicion or a national security concern and supervisory approval. Officers may request passcodes, and privileged material triggers a special review process. Companies with specific concerns should talk to counsel before travel.

Does China search the phones of all foreign visitors?

Not as stated policy. Rules in effect since July 1, 2024, let state security officers collect electronic data from devices, but the Ministry of State Security said in May 2024 that the powers target people linked to counter-espionage matters, not all arrivals. FBI and NCSC guidance recommends traveling with minimal data wherever you go.

Are hotel safes and hotel Wi-Fi really a risk?

The FBI and NCSC both say so. The FBI says hotel safes “are not adequate protection,” and NCSC advises avoiding Wi-Fi where possible. A 2018 Justice Department indictment alleged that Russian military intelligence officers compromised the network of a hotel hosting an international conference.

What should booth staff do when a visitor asks detailed technical questions?

Public guidance says to decide in advance what may be discussed, to answer within that scope, and to refer detailed technical questions to a follow-up through proper channels. Most questioners are legitimate; the goal is to notice when questions go past what a booth is meant to share, and to report it.

Is an invitation to speak at a foreign university a red flag?

Not by itself; most invitations are genuine. But in the GE Aviation case, a paid university invitation was the opening move of an intelligence officer’s approach. Reporting such invitations to the security team before accepting lets the company make an informed decision.