The openness and international co-operation of Norwegian education and research is exploited by other countries' intelligence services.

Intelligence services collect pieces of information that they use directly, or put together into a larger picture. This applies to areas such as research, education, technology, politics, economics, and military development.

The purpose of espionage is to exploit and influence assets and to promote the interests of their country at the expense of Norwegian interests.

What they are interested in and how it can hurt us

Espionage can target many different areas within our sector, for example:

• General mapping of academic and research environments, including their expertise, networks, projects, and laboratory facilities
• Sensitive technologies that are important to Norway’s capacity for development and national security interests, which may be protected by the export control regulations (regjeringen.no)
• Research and education in areas that are particularly controversial or prohibited in certain countries, and which are subject to influence, interference, or censorship
• Knowledge about society, the population, and individuals that may have intelligence value
• Knowledge development through the use of advanced laboratory resources
• Research and education that contributes to policy development, where researchers serve on expert committees or conduct studies and assessments for the authorities
• Research and education concerning Norway’s civil security, total defence, emergency preparedness, and critical infrastructure
• Research collaboration with the Norwegian Armed Forces and industry partners, involving patents and trade secrets

The overall impact of espionage has many consequences for our society:

• Public trust in and the reputation of academia are weakened
• Knowledge and technology may be misused for military purposes by states with which we do not have security-policy cooperation
• Norway’s civil and military emergency preparedness systems are weakened Norway’s position in international negotiations is weakened
• Our democracy may be weakened when political decisions are influenced through means other than democratic channels and in ways that conflict with Norwegian interests
• The competitiveness of Norwegian businesses is weakened, for example through the theft of ideas or the influencing of individuals
• The mapping of, or relationship-building with, students and others who may go on to hold influential positions in politics, society, or business
• The mapping, influencing, and coercion of foreign nationals in Norway who are critical of the regime in their home country, thereby restricting their freedom of expression

How they work

In authoritarian regimes, intelligence services have far broader mandates and greater freedom of action than is common in democracies such as Norway. Typical characteristics are that they operate over the long term, covertly, and indirectly.

Long-term

Intelligence services take a long-term approach to mapping, influence operations, information gathering, source recruitment, and the infiltration of computer networks. Small pieces of information from many different sources are collected and combined over time to build a comprehensive picture of various circumstances that may potentially be exploited at some point in the future.

Covert

Intelligence services operate in secret. They conceal their presence within human networks, for example at conferences, in professional communities, or during embassy visits. Information, knowledge, and laboratory equipment are also accessible digitally. Intelligence services actively seek to break into digital networks and may maintain an invisible presence through covert activity. This represents a major threat today.

As long as they remain undetected, they can continue their covert activities undisturbed.

Indirect

To conceal traces of their activities, intelligence services operate indirectly when gathering information and influencing decisions. They therefore rarely approach the person they ultimately want information from or seek to influence directly.

• More people than just the Minister of Education and Research have knowledge of Norway’s strategic technology priorities. University and university college staff and management also have such knowledge.
• More than just industry stakeholders have information about patents and technological innovation. Research institutions that collaborate with industry also have knowledge of their secrets and valuable assets.
• More than just the professor has insight into sensitive research processes. Master’s students and PhD candidates supervised by the professor may also have such insight.
• Others may also gain indirect access to sensitive information through their work, including administrative staff, cleaners, security guards, and maintenance workers.

On the inside

When intelligence services gain access to sensitive knowledge, information, and technology from within an organisation, this represents an insider threat.

By placing their country’s most talented individuals in master’s and doctoral programmes, or in research positions abroad, they can gain access from within. They may also recruit researchers, students, and other employees who are already part of a research environment.

Some individuals become insiders as a result of influence, inducement, or pressure. Most, however, become insiders because they do not consider—or understand—who they are actually sharing information with, or how the knowledge they share may be exploited.

What we should we be aware of

Espionage can be difficult to detect because it can take many different forms. It is therefore impossible to create clear and exhaustive checklists of what to look out for.

A “gut feeling” that something seems strange, unusual, or out of the ordinary can be a signal that something is not quite right. Here are some situations where it may be worth paying extra attention:

• Someone shows unexpected interest in you, your field of expertise, or equipment you have access to, without any obvious explanation
• You or others receive disproportionate gifts or access to benefits
• A colleague changes their behaviour or work patterns without any obvious reason
• Someone asks who is working on what, and what each individual has access to
• Research partners who:
  • have unusual or unclear sources of funding
  • require research results to be kept confidential without any obvious reason
  • provide unclear or incomplete information about who commissioned the research
• Someone uses a laboratory without an agreement, or in ways that have not been agreed upon
• You discover that someone is gathering information about people who express criticism of totalitarian regimes
• You or others are subjected to threats or pressure

Who I should tell and what happens when I do?

The Norwegian Police Security Service (PST) has primary responsibility for preventing espionage in Norway. They rely on tips from the public. Even minor observations and unusual incidents can be highly valuable to PST when considered in conjunction with other information they have.

It is safe to report concerns to PST. Reporting a concern will not have consequences for innocent people, or for you as the person making the report.

Why should you report concerns to PST?

Because the combined information they receive enables them to detect and prevent espionage that could harm our society.

They therefore need anyone who experiences or observes something suspicious, unusual, or out of the ordinary to report it. They want you to feel comfortable reporting observations and concerns that may potentially be of value to them.

PST’s own advice is: If you see something, say something—but use common sense.

What happens when you report something to PST?

They record the information you provide and assess it in conjunction with other information they have.

When you report something to PST, you can leave the uncertainty with them. They are responsible for any further follow-up, but you will not be told what, if anything, your report leads to.

You can choose whether to provide your identity, but they would like to be able to contact you if they have questions about your report. They will never disclose who submitted a report.

How to report a concern 

• Call PST on 23 30 50 00 (available 24/7)

• Submit a report here: Report a concern

• If it is an emergency, call 112 (the Norwegian emergency number)

Remember: It is better to report one concern too many than one too few.

How to mitigate espionage

To prevent espionage, it is essential that we understand the fact that it is happening.

What can you do?

Everyone should consider how espionage could be relevant to their own work or studies. Ask yourself—and feel free to discuss with a colleague or your supervisor:

• What do I have access to that could be of interest to foreign intelligence services?
• How could I provide an entry point to information, knowledge, and technology?
• In which activities might I be vulnerable and therefore need to be particularly alert?
• What can I do to protect the assets and values I am responsible for?
• Who can I discuss concerns with, or report them to?

What can managers do?

Managers are responsible for managing risk within their own unit. They are also responsible for ensuring that the working environment promotes safety, trust, openness, and dialogue.

• Managers should facilitate reflection and discussion about espionage
• Managers must be able to conduct preventive security conversations and follow-up conversations when needed
• Managers should have an understanding of the assets and values managed by their unit, and of vulnerabilities that could be exploited
• Managers are responsible for ensuring that the organisation’s security procedures are known and followed
• Managers should ensure that everyone knows where to report concerns

 

What can organisations do?

Organisations in the higher education and research sector must take the threat of espionage seriously by:

• assessing which assets they hold that may be targeted by foreign intelligence services, and how the organisation may be vulnerable
• incorporating personnel security into HR processes and as part of comprehensive risk management and security governance
• establishing sound procedures for international cooperation and activities abroad, as well as for access control and access management