Indicators of espionage are the observable patterns — in someone’s work habits, finances, computer activity, and personal life — that suggest they may be collecting sensitive information for a foreign government or a competitor. Counterintelligence professionals group these signs into four broad categories, and a single indicator alone rarely means much. It’s the overlap that matters: an employee pulling late-night access to systems outside their role, after an unreported overseas trip, with an unexplained lifestyle upgrade, is a very different picture from any one of those facts standing alone.
Workplace Behaviors That Should Raise a Flag
Insider threats almost never begin with a dramatic breach. They begin as small deviations from routine.
Working odd hours without a project reason is one of the earliest signs. The Center for Development of Security Excellence, part of the Defense Counterintelligence and Security Agency, specifically identifies anomalous or suspicious access to facilities or systems during non-work hours as a potential risk indicator.1Center for Development of Security Excellence. Insider Threat Potential Risk Indicators Weekend badge-ins and late-night logins become opportunities when supervision is thin.
A second sign is curiosity that doesn’t match the job. When someone in accounting starts probing a classified engineering project, or a marketing employee tries to open restricted research folders, the mismatch between role and interest is the point. It gets more concerning when curiosity turns into actual access attempts.
Removing sensitive material is one of the most concrete indicators. That includes carrying out physical documents, downloading files to personal devices, or forwarding proprietary data to personal email. The usual cover story is catching up on work from home, but the effect is to route information around the controls designed to contain it. The CDSE guidance flags unauthorized collection, retention, and storage of protected information, along with misuse of information security privileges, as standalone risk indicators.1Center for Development of Security Excellence. Insider Threat Potential Risk Indicators
Declining performance, friction with management, and open disillusionment with an employer also belong on the list. Not because unhappy employees are spies, but because foreign intelligence services actively look for people who feel wronged. Someone passed over for promotion who suddenly stops caring about security protocols has become more vulnerable to recruitment, not less.
Financial Warning Signs
Money sits at the center of most espionage investigations because foreign services almost always pay for access, and payments almost always leave a trail.
The red flags split in two directions. The first is financial distress: overwhelming debt, wage garnishments, loan defaults, bankruptcy, or a gambling problem. These do not indicate espionage on their own, but they signal vulnerability. A person drowning in debt is far more susceptible to a cash offer. Security Executive Agent Directive 3, which governs clearance holders, requires reporting of these financial problems, including bankruptcies, garnishments, and liens.2Office of the Director of National Intelligence. Security Executive Agent Directive 3 – Reporting Requirements for Personnel with Access to Classified Information or Who Hold a Sensitive Position
The second is the opposite problem. Unexplained wealth. A sudden lifestyle upgrade, luxury purchases, or the rapid payoff of large debts without a corresponding raise, inheritance, or other legitimate source draws scrutiny. Investigators look specifically for unexplained affluence and sudden increases in net worth or cash flow.1Center for Development of Security Excellence. Insider Threat Potential Risk Indicators These shifts often arrive alongside the behavioral changes described above.
Technical and Digital Red Flags
Digital systems log nearly everything, and espionage usually requires copying, transferring, or transmitting information. Each of those actions leaves traces.
Common technical signs include attempts to use USB drives on systems where removable media is prohibited, repeated access attempts to databases beyond a person’s authorization, and requests for elevated privileges without a clear work reason. Triggering access-denied alerts repeatedly, or trying to disable logging and monitoring tools, reflects a deliberate effort to reach information the person knows is off-limits and to cover the tracks.
Remote work widens the surface. Logins from unusual locations, connections through unauthorized VPN services, and large downloads of sensitive data outside normal patterns all warrant attention. The warning becomes serious when categories overlap: a 2 a.m. download spike after a recent overseas trip and a new, unexplained financial windfall is a much louder signal than any single piece.
Personal Life, Travel, and Foreign Gifts
Some of the strongest indicators show up outside the workplace. Undisclosed foreign travel, especially to countries with aggressive intelligence services, is a major red flag. These trips may involve recruitment meetings, information handoffs, or training by a handler. Concealing or misrepresenting travel on background checks and clearance renewals is itself a serious indicator.
Ongoing personal relationships with foreign nationals or diplomatic officials outside any professional context also raise concern, particularly when unreported. Some people take hidden consulting or advisory roles with foreign companies that compete with their domestic employer, which creates both a channel for moving data and a cover story for extra income.
Foreign gifts carry specific rules. Federal employees cannot solicit gifts from foreign governments, and gifts above a “minimal value” threshold must be reported and turned over. For 2026, that threshold is $525.3General Services Administration. Foreign Gifts Employees may keep gifts at or below that amount as souvenirs; anything above it is treated as accepted on behalf of the United States and must be deposited with the employing agency within 60 days.4Office of the Law Revision Counsel. 5 USC 7342 – Receipt and Disposition of Foreign Gifts and Decorations A pattern of unreported gifts from foreign sources signals a relationship that has moved beyond casual contact.
How Recruitment Actually Works
The indicators are easier to spot once you understand the approach. Recruitment rarely starts with a direct pitch. It starts with target identification and relationship building over weeks or months.
Counterintelligence professionals use the acronym MICE for the four primary motivations foreign services exploit. Money is the simplest: cash or financial relief for someone struggling with debt. Ideology covers genuine sympathy with a foreign government’s goals or resentment of one’s own. Compromise means leveraging mistakes, embarrassing information, or legal exposure to force cooperation. Ego targets people who feel undervalued or overlooked. In practice, a recruitment often begins with one lever and shifts to another; someone first drawn in by flattery may end up controlled through compromise once they have already handed something over.
Day to day, operatives pull information out of people through casual conversation, not overt requests. The Defense Counterintelligence and Security Agency identifies several elicitation techniques. Flattery gets people talking about their expertise. A deliberately false statement works because most people instinctively correct inaccuracies and give up real information doing it. Feigning ignorance invites the target to explain or teach. Operatives also offer information first to create a sense of obligation, encourage complaints about workplace frustrations, and use “bracketing” by proposing a high and low estimate so the target narrows it down. In research settings, requests to peer review papers can serve as cover for getting cleared employees to apply classified knowledge to foreign research gaps.5Defense Counterintelligence and Security Agency. Elicitation None of this feels threatening in the moment, which is what makes it work.
Who Gets Targeted
Foreign collection is not limited to defense contractors. The federal government maintains a Critical and Emerging Technologies list, most recently covering 18 priority areas including artificial intelligence, quantum information, semiconductors, biotechnologies, hypersonics, advanced computing, space technologies, and clean energy generation.6GovInfo. Critical and Emerging Technologies List Update Anyone working in these fields should assume foreign services view their work as a collection target. Agriculture, financial technology, and advanced manufacturing have also moved into scope as AI tools and digital infrastructure spread across every sector. A government contract is not required; proprietary technology or data a foreign competitor would value is enough.
What Clearance Holders Must Report
Anyone with a security clearance or in a sensitive position is legally required to report a wide range of events under SEAD 3. The directive is broader than espionage itself; it covers anything that could create vulnerability to exploitation.2Office of the Director of National Intelligence. Security Executive Agent Directive 3 – Reporting Requirements for Personnel with Access to Classified Information or Who Hold a Sensitive Position Mandatory reporting categories include:
- All planned foreign travel, and any previously unreported travel as soon as possible after return.
- Continuing relationships with foreign nationals involving personal bonds, any contact with someone suspected of intelligence collection, and any contact involving an exchange of personal information that could create leverage.
- Bankruptcy filings, wage garnishments, judgments, liens, and any sudden unexplained increase in wealth.
- Any arrest regardless of whether charges were filed, and any charge or conviction including traffic offenses involving alcohol or drugs.
- Changes in personal status such as marriage or divorce, unauthorized media contacts, drug use, and any loss or compromise of classified information.
Failing to report is not a minor oversight. It can lead to suspension or revocation of a clearance, disciplinary action, and termination.7U.S. Department of State. 12 FAM 270 – Security Reporting Requirements For contractors, it can mean permanent removal from classified work. Investigators treat concealment as its own red flag, because hiding reportable information looks very much like the early stages of an espionage operation.
How to Report Suspected Espionage
The FBI is the primary federal agency for reports of suspected espionage or trade secret theft. Tips can be submitted through the FBI’s electronic tip form or by contacting a local field office.8Federal Bureau of Investigation. Electronic Tip Form The FBI publishes a dedicated checklist for companies that believe they have been victims of economic espionage or trade secret theft.9Federal Bureau of Investigation. Checklist for Reporting an Economic Espionage or Theft of Trade Secrets Offense The National Counterintelligence and Security Center leads broader counterintelligence work across the intelligence community and publishes guidance for sectors that are frequent collection targets.10Office of the Director of National Intelligence. Safeguarding Academia
Protections for People Who Report
Fear of retaliation keeps people quiet. Federal law addresses that fear directly, though protections vary by setting.
The Intelligence Community Whistleblower Protection Act lets intelligence community employees and contractors raise “urgent concerns” to Congress through the Inspector General of the Intelligence Community. Urgent concerns include serious violations of law, executive orders, or deficiencies in intelligence activities involving classified information.11Office of the Law Revision Counsel. 50 USC 3033 – Inspector General of the Intelligence Community
Presidential Policy Directive 19 prohibits any personnel action taken as reprisal for a lawful disclosure, including actions that affect eligibility for access to classified information. If retaliation happens, the employee can seek review through the agency inspector general; if that doesn’t resolve things, an external panel of three inspectors general can review the case and recommend corrective action, including reinstatement, back pay, and attorney’s fees.12U.S. Department of State Office of Inspector General. Presidential Policy Directive PPD-19
For federal employees generally, taking adverse action against someone for cooperating with an inspector general, disclosing information to the Special Counsel, or refusing an order that would require breaking the law is a prohibited personnel practice.13U.S. Merit Systems Protection Board. Prohibited Personnel Practice 9 – Protection Against Retaliation for Employees Who Engage in Protected Activity Most organizations also run internal reporting channels that aim to protect the identity of the person raising the concern, though strength varies.
What the Underlying Offenses Carry
Federal penalties scale with who benefits and what was taken. Stealing trade secrets for the benefit of a foreign government, agency, or agent exposes an individual to up to 15 years in prison and fines up to $5,000,000; organizations face fines up to the greater of $10,000,000 or three times the value of the stolen secret, including avoided research and development costs.14Office of the Law Revision Counsel. 18 USC 1831 – Economic Espionage Trade secret theft for ordinary commercial advantage, without foreign-government involvement, carries up to 10 years for individuals,15Office of the Law Revision Counsel. 18 US Code 1832 – Theft of Trade Secrets and trade secret owners can bring civil suits for injunctions, damages, and in extraordinary cases emergency seizure.16Office of the Law Revision Counsel. 18 USC 1836 – Civil Proceedings
National defense information falls under separate statutes. Gathering, transmitting, or losing defense information carries up to 10 years in prison.17Office of the Law Revision Counsel. 18 USC 793 – Gathering, Transmitting, or Losing Defense Information Delivering defense information directly to a foreign government is punishable by death or any term of years up to life, with the death penalty reserved for offenses that led to the identification and death of a U.S. agent or that involved nuclear weapons, military satellites, early warning systems, war plans, or cryptographic information.18Office of the Law Revision Counsel. 18 USC 794 – Gathering or Delivering Defense Information to Aid Foreign Government