Corporate Counterintelligence: How Companies Protect Their Secrets From Competitors and Foreign Services

Padlock on a glowing chain, representing corporate counterintelligence protecting company secrets — Corporate counterintelligence protects what a company knows, not just its networks. Photo: Envato.

Companies are now targets of the same tradecraft that states use on each other. A criminal gang offers a factory worker half a million dollars to install malware. A foreign intelligence officer invites an aerospace engineer to give a paid lecture. A remote “developer” turns out to be working for a sanctioned government. U.S. law defines counterintelligence as “information gathered, and activities conducted, to protect against espionage, other intelligence activities, sabotage, or assassinations conducted by or on behalf of foreign governments or elements thereof, foreign organizations, or foreign persons” (50 U.S.C. § 3003). Corporate counterintelligence applies that defensive logic to a business: knowing who wants what you have, how they are likely to try to get it, and how to make the attempt fail.

This page explains who the collectors are, how the threat works, what public guidance says, how trade secret law rewards protection, and what recent cases teach. It is the pillar of a short series; insider risk, travel and trade-show security, and trade secret “reasonable measures” each have their own page. It is general guidance drawn from public law, court records, and government publications, not legal or security advice for a specific situation. Anyone facing a live incident should talk to counsel first.

Corporate counterintelligence at a glance

What it protects: the information that makes a company valuable, including trade secrets, source code, manufacturing know-how, deal plans, customer data, and negotiating positions, along with the people who hold that information. Federal law treats information as a trade secret only if “the owner thereof has taken reasonable measures to keep such information secret” and it “derives independent economic value” from not being generally known (18 U.S.C. § 1839(3)).
How it differs from IT security: cybersecurity protects systems; corporate counterintelligence starts with the adversary and every route, human, commercial, or technical, it might use.
How it differs from competitive intelligence: competitive intelligence gathers lawful, public information about rivals; counterintelligence is its defensive mirror, denying others what they should not have.
Who targets companies: competitors and their recruiters, criminal groups, private investigators and hack-for-hire operators, activist and short-seller researchers, and foreign intelligence services and the “non-traditional collectors” who help them (NCSC, April 2026).
Public guidance: the U.S. National Counterintelligence and Security Center publishes “Safeguarding Our Future” bulletins on specific threats (NCSC); the FBI publishes business guidance including “China: The Risk to Corporate America”; the UK’s National Protective Security Authority publishes Secure Innovation guidance and the Think Before You Link campaign.
Legal stakes: the Defend Trade Secrets Act gives owners a federal civil claim, with exemplary damages of up to two times actual loss for willful and malicious misappropriation (18 U.S.C. § 1836). A company that cannot show reasonable measures may find it has no trade secret to defend.

Who targets companies, and why

Competitors. In the Sinovel case, a Chinese turbine maker persuaded an engineer at an Austrian subsidiary of American Superconductor to switch sides, and AMSC “lost more than $1 billion in shareholder equity and almost 700 jobs” (Justice Department).

Chart of scale figures from corporate counterintelligence cases, from the Sinovel theft to North Korean IT worker laptop farms — One opening, many victims: scale figures from public records. Chart: Competitive Futures.

Criminal groups and hired hackers. Ransomware crews sometimes try to buy access from employees, as the Tesla case below shows, and information about companies is a commodity: an Israeli hack-for-hire operator was sentenced in 2023 to 80 months for campaigns against activists, financial firms, and thousands of others (Justice Department).

Activists and short sellers. Most of their research is lawful (WilmerHale), but it is intensive, and it can cross multiple legal lines. In June 2026, a federal jury convicted short seller Andrew Left of securities fraud for publishing sensational commentary about companies and trading quickly against it (AP). Consider this to be similar to Russian intelligence active measures, applied to the corporate world.

Foreign intelligence services. Governments collect commercial technology to advance their economies and militaries. The U.S. National Counterintelligence and Security Center names China, Iran, and Russia, and warns of “non-traditional collectors” who acquire technology for a foreign government without a direct relationship to its intelligence service (NCSC, April 2026). North Korea’s remote IT worker schemes reached more than 100 U.S. companies (Justice Department).

How the threat works: the main vectors

Collectors rarely need a sophisticated hack. Public guidance from the FBI, NCSC, CISA, and the UK’s National Protective Security Authority describes a familiar set of openings:

Insiders: people with authorized access who are recruited, careless, or aggrieved (CISA). See the insider risk page.
Online approaches: fake recruiters and consultants on professional networks; the UK said more than 10,000 of its nationals were targeted this way (UK Government).
Travel and events: trips, trade shows, paid invitations, and pitch competitions (ODNI). See the travel security page.
Deals and investors: joint ventures and investors seeking sensitive data before a deal closes (FBI). See the investment screening page.
Suppliers and cyber intrusion: a trusted vendor or a network breach, often one part of a wider effort (UK NCSC on SolarWinds).

How the law rewards protection

Trade secret law rewards companies that protect their information, because protection is part of the definition: information qualifies only if the owner has taken “reasonable measures to keep such information secret” (18 U.S.C. § 1839(3)). Courts weigh that case by case, as the trade secrets page explains.

Laptop on a desk in a dark room, representing cyber intrusion as a corporate counterintelligence threat — Cyber intrusion is often just the collection method; the target is what a company knows. Photo: Envato.

The Defend Trade Secrets Act of 2016 gives owners a federal civil claim (18 U.S.C. § 1836), and the Economic Espionage Act makes trade secret theft a federal crime. Their history and leading cases are on the Economic Espionage Act page and the competitive intelligence in court page.

What a corporate counterintelligence program covers

Public guidance from the FBI, NCSC, CISA, and the Five Eyes Secure Innovation campaign (ODNI) points to the same broad areas: understanding who might target the company, knowing what matters most, managing insider risk, preparing for travel and events, vetting partners and investors, and planning a response with counsel. The right mix depends on a company’s size, sector, and what it holds.

Two cautions run through the guidance. Counterintelligence is not only an IT problem, and it is never a matter of nationality: threat guidance concerns governments and conduct, and profiling by origin is unfair, often unlawful, and points attention the wrong way (NCSC).

Cases that show the risk

Sinovel and AMSC (2018)

A Wisconsin jury convicted Sinovel Wind Group in January 2018 of stealing American Superconductor’s wind turbine control software with help from a former employee of an AMSC subsidiary in Austria. In July 2018 the court imposed the maximum $1.5 million fine, and Sinovel agreed to pay AMSC $57.5 million (Justice Department). More is on the Economic Espionage Act page. Lesson: one insider at a foreign subsidiary can cost a company more than half its workforce.

Egor Kriuchkov and Tesla (2020–2021)

A Russian national offered an employee at Tesla’s Nevada battery plant $500,000 to install malware so that his associates could steal data and demand a ransom. The employee reported it, the FBI stepped in, and the network was never breached. Kriuchkov pleaded guilty in March 2021 to conspiracy to intentionally damage a protected computer and was sentenced in May 2021 to time served and deportation (CBS News/AP). Lesson: a workforce that knows how and where to report an approach is a control in its own right.

Yanjun Xu and GE Aviation (2018–2022)

In March 2017 a GE Aviation employee received an invitation to speak at a Chinese university, traveled with expenses paid, and was introduced to Yanjun Xu, an officer of China’s Ministry of State Security. When Xu later asked for design information, the employee sent a document “with the cooperation of the company, who was working with the FBI,” and prosecutors credited “the integral cooperation of GE Aviation” (Justice Department). Xu was convicted in November 2021 and sentenced to 20 years in November 2022; he contested the charges (Justice Department). Details are on the Economic Espionage Act page. Lesson: a flattering invitation is a classic opening, and a company that works with authorities early can turn an approach into a prosecution.

Klaus Pflugbeil and Tesla’s battery technology (2023–2024)

Two former employees of a Canadian company that Tesla acquired in 2019 set up a China-based business selling battery assembly lines built on its proprietary technology, prosecutors said. After undercover agents met one of them at a Las Vegas trade show in 2023, Klaus Pflugbeil sent them a proposal containing the victim company’s drawings. He pleaded guilty in June 2024 and was sentenced in December 2024 to 24 months; his co-defendant, Yilong Shao, remains at large and is presumed innocent (Justice Department; plea). Lesson: acquisitions bring in people and know-how that need protecting from the first day, and trade shows cut both ways.

Christina Chapman and the North Korean “laptop farm” (2023–2025)

Christina Chapman hosted laptops shipped by U.S. employers in her Arizona home so that North Korean IT workers using false identities appeared to be in the United States. The scheme placed workers at 309 U.S. companies, including Fortune 500 corporations, and generated more than $17 million. Chapman pleaded guilty in February 2025 and was sentenced in July 2025 to 102 months; the U.S. Attorney said, “Corporations failing to verify virtual employees pose a security risk for all” (Justice Department). Lesson: hiring is a security process, and remote work has made identity a counterintelligence question.

What it means for companies

The cases share a pattern: the loss rarely began with a sophisticated hack. It began with a person, a relationship, or a transaction no one treated as a security question. Companies that fare well tend to give the problem an owner, treat deals, hires, and trips as moments of exposure, make it easy for employees to report an approach, and put their legal protections in place before they need them. Free public guidance from NCSC, the FBI, and the Five Eyes is a good starting point, shaped with counsel to each company’s facts.

Handshake over a contract, representing due diligence on partners and investors in corporate counterintelligence — Partners, investors, and joint ventures can be a path to a company’s secrets as well as its markets. Photo: Envato.

How intelligence and foresight help anticipate who will target you

Targeting follows strategy. Published industrial priorities, a rival that has fallen behind, an opaque investor, or sanctions that cut a country off from components all create predictable demand for what a company holds. Watching those signals tells a company where collectors are likely to come from before they arrive, the discipline discussed on the strategic foresight and enforcement risk pages, turned inward. Assumptions about who “would never” target you deserve the scrutiny described on the cognitive bias page.

Frequently asked questions

What is corporate counterintelligence?

It is the set of activities a company uses to identify and defeat efforts by competitors, criminals, private investigators, and foreign intelligence services to obtain its secrets, influence its people, or disrupt its plans. It applies the logic of government counterintelligence to commercial assets.

How is corporate counterintelligence different from cybersecurity?

Cybersecurity protects systems and data from technical attack. Corporate counterintelligence starts with the adversary and covers every route to the company’s secrets, including insiders, recruitment, travel, partnerships, investors, and suppliers, of which cyber intrusion is one.

Do only large or defense companies need counterintelligence?

No. U.S. and allied agencies have specifically warned startups, academic spin-outs, and emerging technology firms, and the Five Eyes Secure Innovation guidance is written for companies without large security teams. The North Korean IT worker cases reached hundreds of ordinary employers.

Is it legal to monitor employees for insider threats?

Often yes, within limits that vary by country, state, and employment relationship. Privacy, labor, and anti-discrimination laws apply, so design any monitoring with employment and privacy counsel.

When should a company contact the FBI or other authorities?

That is a judgment for leadership and counsel, but public guidance encourages companies to build a relationship before an incident and to report suspected foreign targeting. The FBI advises reporting suspicious activity to the company’s security officer or local field office without alerting the person under suspicion. Companies elsewhere should look to their national authorities, such as the UK’s NPSA.