The draft principles represent a necessary effort to translate the series’ analytical findings into policy-ready language. However, the current draft requires substantial revision to narrow the principles.

Cyber espionage encompasses a broad range of intelligence-gathering activities conducted through digital networks, spanning multiple domains. While these various forms share technological methods, they differ significantly in targets, perpetrators, and strategic objectives.

NATO is no longer tiptoeing around its enemies. The alliance now speaks and acts with a clear and distinct intention.

States spend a lot of time worrying about spies, and a lot of money trying to protect themselves from espionage. They construct multilayered personnel policies to keep untrustworthy individuals from government jobs that involve handling classified information. They invest heavily in complex information systems to block access to sensitive communications.

What are the costs of cyber espionage? And how do they differ from those of operations designed to prepare for attack?

In 2010, Stuxnet, a stealthy, sophisticated computer worm widely attributed to the United States and Israel, infiltrated Iran’s Natanz uranium enrichment facility and sabotaged its industrial controls, delaying Iran’s nuclear program without a single bombing raid or overt military strike. A few years later, Russian operatives hacked into U.S. political organizations in 2016, stealing and leaking emails in an effort to sway the presidential election. At the same time, Chinese state-sponsored groups quietly penetrated foreign government and corporate networks to siphon off military technology and industrial secrets over many years. These incidents, though bloodless and often deniable, had clear strategic stakes.

Russia has been repeatedly accused of employing non-state cyber proxies to conduct sophisticated cyber-attacks and information operations aimed at influencing US elections. These allegations, notably around the contentious 2016 US presidential election, have attracted substantial global attention, underscoring critical vulnerabilities within democratic institutions.

Economic cyber espionage represents an ongoing threat to both nations and markets, yet unlike other cyber threats, it remains largely uninsured. This does not have to be the case. The underinsurance for economic cyber espionage is more of a mechanical problem, with coverage gaps hinging on proving damage to intangible assets. In fact, this protection gap persists even when attackers are “incompetent” (i.e., unable to use the IP they steal), since victims still incur measurable, indemnifiable costs.

The security of open source software (OSS) has morphed from a niche technical concern to a central cybersecurity policy challenge. High-profile incidents have led to suggestions for governments to help strengthen the OSS ecosystem, including calls for funds built to support open source projects and their maintainers, such as a proposal for an EU Sovereign Tech Fund. This research examines the argument that unconditional funding—namely, financial support without specific requirements for the recipient—causally improves the security posture of OSS projects.

Supply-chain decoupling doesn’t stop rival nations from hacking each other and can make it worse. A cyber-espionage expert explains what does work.

Cyber espionage is the use of cyber tools and techniques to gather intelligence or steal sensitive information from targeted entities. This form of espionage poses significant risks to national security, economic stability and corporate integrity. Given the complex and often hidden nature of cyber espionage activities, accurately measuring their costs presents a significant challenge.

As cyber threats become increasingly central to international politics, state-sponsored cyber attacks have become an instrument of geopolitical leverage. 

The Mythical Beasts project addresses this meaningful gap in contemporary public analysis on spyware proliferation, pulling back the curtain on the connections between 435 entities across forty-two countries in the global spyware market. These vendors exist in a web of relationships with investors, holding companies, partners, and individuals often domiciled in different jurisdictions.

In September 2001, operatives for Procter & Gamble were caught diving in dumpsters outside a Unilever facility in Chicago in search of documents and other discarded items containing confidential information about Unilever’s hair care products business. To avoid litigation and the negative publicity that often accompanies such disputes, the companies quietly reached a negotiated settlement where Procter & Gamble agreed to not use any of the information obtained. This early example illustrates the ongoing vulnerability companies face regarding data security. In today’s corporate environment where digital data storage is the norm, companies now have to be wary of not only paper documents but also discarded storage devices like hard drives, USBs, and even old office equipment that might store digital data.

Traditional conceptions of state-sponsored cyber economic espionage suggest that countries with different product profiles should experience high levels of espionage between them. However, this is not what we observe empirically. This article offers new insights into the strategic calculations that underpin state-sponsored cyber espionage and challenges scholars and policymakers to rethink the dynamics of international economic competition and security in the digital age.