Espionage can rob a start-up of its future

The Finnish start-up ecosystem has produced several international success stories. Success requires an enormous amount of work from the entrepreneurs: the struggle for funding is hard, profit and growth expectations are high, and they face pressure from many directions. Start-ups, working countless hours under the pressure of merciless competition, must focus their limited resources on their core operations. This usually means refining the start-up's actual product at the expense of support functions, such as protection against security threats. 

Unfortunately, the intelligence agencies of authoritarian states, such as Russia and China, have also noticed this and are targeting growth companies. The Finnish Security and Intelligence Service (SUPO) surveys and combats national security threats, such as state-sponsored espionage and influencing, targeted against Finnish business ecosystems.

SUPO is aware of numerous successful cyber espionage cases in recent years, in which state actors have penetrated the systems of small Finnish businesses. As a result of espionage, intellectual property of companies has been stolen, which can seriously affect their chances of succeeding in the market. Companies are also exposed to threats through investments and human intelligence. 

You can only lose customer trust once

In the start-up world, matters like protection against cyber espionage may feel like just another minor concern among many other priorities, but at worst, security deficiencies could be fatal to the company. Following a successful espionage operation, a start-up may lose both its product and the trust of its customers. Both entrepreneurs and Finland’s national interests suffer from espionage.

The risk of state-sponsored espionage is particularly high for companies that develop high-tech products. These relate to, for example, space technology, artificial intelligence, defence technology, semiconductors or quantum technology. 

Adversial state intelligence activities are mostly run by Russia or China, which compete for technologies and have no restraints on engaging in hostile intelligence-gathering. Russian intelligence services strive to obtain information especially on companies developing products related to military support for Ukraine and on defence technology in general. China has a wide-ranging interest in high-tech products. It uses espionage not only to develop its own technological know-how but also to improve its economic competitive position.

Foreign investments may lead to technology transfers

In addition to cyber espionage, companies also face risks through foreign funding and human intelligence. 

Major powers are currently on the look-out for European high-tech companies, which are developing technologies they are aiming for but whose financial position is weak. The operating model of state sponsors includes providing funding on fairly good financing terms but under strict conditions set for the ownership of data or restrictions on its use. In practice, accepting funding leads to technology transfers to another country. 

Corporate acquisitions are another method governments use to acquire technological expertise by legal means. Through corporate acquisitions, authoritarian states can take over companies operating in the Western countries, which may also create opportunities for circumventing sanctions. Many high-tech products are dual-use items, i.e. they can also be used for military applications, but they are not necessarily subject to any export control restrictions.

Governments can also use human intelligence against companies. Rapid international growth and large recruitment campaigns can increase the insider risk. In this context, insider refers to an employee of a company or its subcontractor who intentionally and fraudulently compromises the company’s information security and data for the benefit of a third party. The third party may be, for example, a foreign country.

Turning security into a competitive advantage

The risk of espionage can be reduced with a systematic security culture and good information security. The key to successful security measures is identifying the company’s most important security interest to be protected. For many start-ups, it may be a product or a new innovation, for others, a services production process. Security measures are implemented in layers round the key interest.

Every company must build a security culture best suited for them. Using resources for security may require determination, as the funding models of start-ups often place short-term growth above the security culture. Although the time perspective of the sponsor is different from that of the company’s owner, investing in security is worth the effort. It will ensure that the company can continue to operate also in the future. It is also cheaper and easier to create an appropriate security culture right in the early stages of the company’s journey than to implement it later. 

Security can also be turned into a competitive advantage for the company. In the current world situation, there is a demand for security-oriented solutions. Central governments are buying defence and security products at a frantic pace. Joining NATO has also opened up new markets for Finnish companies. From the perspective of Finland’s national security, it is also important to have Finnish companies operating in the high-tech sector.  

SUPO also promotes economic security in Finland 

Finland needs successful export companies. What we do not want is giving, for example, Russian or Chinese intelligence actors opportunities for weakening the potential of emerging Finnish companies. Combating threats to the economy and business requires cooperation between companies and authorities.

The Finnish Security and Intelligence Service can help growth companies improve their security in different ways, depending on the development phase of the company. This may mean, for example, conducting security clearance vettings, in which case SUPO examines the backgrounds of the company’s own employees or its subcontractors’ employees. Cooperation also includes developing other security measures.

During the past year, the Finnish Security and Intelligence Service has discussed security threats with several emerging technology companies. Information received from companies helps the authorities improve their situational picture and thus better support companies in combating security threats. Through cooperation, we have succeeded in preventing cyber espionage operations targeted against Finnish companies.