The cost of espionage

Wooden puppet hanging on strings
Abstract

Espionage has become one of the most significant national security threats to Australia, impacting government, businesses and the university sector. The highly secretive nature of espionage makes it extremely difficult to measure. In this study we estimated, for the first time, the actual and prevented costs of espionage. Building on the Australian Institute of Criminology’s method for measuring the costs of serious and organised crime, we estimated the mitigation and response costs and the direct costs of espionage impacting Australia. We also estimated the preventable costs associated with a number of possible scenarios. The numbers are conservative and an underestimate of the true cost, given the challenges in identifying and measuring espionage activity and its consequences.

In 2023–24, espionage cost Australia at least $12.5 billion. This includes the direct costs of the consequences of known or probable espionage activity – primarily losses due to state or state-sponsored cyber attacks, insider threats and intellectual property theft – as well as the public and private sector response, remediation and mitigation costs. There are also tens of billions in additional costs that Australia may have prevented by countering potential espionage. For example, in just one week, a single incident of espionage-enabled sabotage from a large-scale cyber attack could cost the Australian economy nearly $6 billion. These prevented costs are significant, and highlight the importance and benefit of investing in efforts to reduce the threat of espionage and minimise the harm in high-risk settings.
 

Prepared by the Australian Institute of Criminology for the Australian Security Intelligence Organisation.

Contents

  • Figures
  • Tables
  • Acronyms and abbreviations
  • Acknowledgements
  • Abstract
  • Executive summary
    • Actual costs from espionage
    • Prevented costs from espionage
    • Total actual and prevented costs from espionage
  • Introduction
    • Previous attempts to measure the cost of espionage
    • Our approach
    • Scope
    • Challenges
    • Assumptions
    • Limitations
  • Espionage impacting Australia
    • Targets
    • Vectors
    • Impacts
  • Mitigation and response costs
    • Public sector expenditure
    • Cyber security expenditure by government, businesses and universities
    • Mitigation costs to businesses, critical infrastructure and universities
    • Additional costs
  • Direct costs of known or suspected espionage
    • Cyber security incidents (excluding intellectual property theft)
    • Insider threats
    • Intellectual property theft
  • Prevented costs from espionage
    • Disruption to critical infrastructure
    • Sophisticated cyber attacks against multiple sectors
    • Decline in share prices following public reporting of espionage
    • Decline in share prices following public reporting of cyber attacks
    • Decline in foreign investment
    • Decline in international student revenue
    • Decrease in US Government funding for Australian research
  • References