Safeguarding against foreign interference in the critical minerals sector

What is foreign interference?

Foreign interference and espionage is the main security concern facing Australia. It occurs when an activity carried out by, or for, a foreign power is: 

• coercive
• corrupting
• deceptive
• clandestine
• contrary to Australia’s sovereignty, values and national interests. 

It involves foreign powers trying to secretly and improperly interfere in Australian society to advance their strategic, political, military, social or economic goals at our expense.

Foreign interference in the critical minerals sector

Australian critical minerals companies are a target for a range of foreign actors seeking to gain a commercial, technological or strategic advantage. The sector’s geostrategic importance places it at particular risk of foreign interference that aims to disrupt Australia’s efforts to diversify global supply chains and build onshore capabilities. Foreign actors can target people, information and infrastructure to gain intellectual property (IP) and sensitive information. They can seek to influence or gain control over businesses and their decisions. 

Examples of how foreign interference can appear for critical minerals include, but are not limited to:

• Covert financing: foreign actors can use people as proxies to conduct illicit financing activities. This includes evading the Foreign Acquisitions and Takeovers Act 1997 to improperly influence company decisions.
• Disinformation campaigns: foreign actors can influence public opinions and behaviours, including to damage the reputation of people, companies or projects.
• Cyber-attacks: to disrupt systems and operations or to collect information to support other foreign interference activities.
• Improperly leveraging relationships with key personnel: to manipulate targets into sharing sensitive information or making decisions contrary to a business’s best interests.
• Harassment and intimidation: to silence dissent or coerce decisions. This can take the form of blackmail or threats, and is one of the most aggressive forms of foreign interference.

Anyone with access to your information, data, premises or systems can pose a risk. This includes employees, business or research partners, investors and visitors. 

Foreign interference can have serious negative impact on critical minerals companies, including:

• reputational damage
• project delays
• loss of competitive or strategic advantages, including IP
• loss of financing or financing opportunities
• damage to business operations and profits.

Identifying foreign interference

It can be difficult to identify foreign interference. Many activities used in foreign interference attempts are also a natural part of business interactions. Because of this, it can be difficult to tell when people are acting for a foreign power. It is important to remember that foreign interference is usually non-transparent and is at Australia’s expense. 

Potential warning signs of foreign interference could include:

• Leveraging obligation or indebtedness: foreign actors can work to create a sense of personal connection and obligation from a person they seek to influence. This includes giving gifts or donations, helping with access to investors, government officials or business partners, or providing paid travel. 
• Reduced transparency: requests to move to less open or more informal forms of communication or to reduce potential public oversight of an engagement. Withholding data, information or attempts to hide a relationship or interaction could be signs of a foreign interference attempt. 
• Applying pressure or influence: foreign actors may seek to craft exclusive or privileged relationships with key personnel. These personnel can influence decisions or access sensitive information. 
• Abnormal financial activities: suspicious or unusual financial activities may be warning signs of foreign interference. For example, seemingly unrelated share purchases with the same listed address or recurring non-business costs on company accounts. 
• Suspicious social media activity: persistent or reoccurring posts containing misinformation or disinformation from dubious sources can be a sign of foreign interference. 
• Cyber interference: intrusion events, unplanned outages or other irregular cyber activity can indicate a cyber-attack by a foreign actor.

When you are assessing your business for specific foreign interference risks, first look for parts of your business that are critical to your operations. This could include assets like specialised high-tech equipment, technology systems, intellectual property or even key relationships with investors, suppliers or partners. This will help you understand where the greatest risks are to your company and your vulnerabilities. 

It is also helpful to engage across your sector on potential foreign interference risks or incidents. Staying across developments will help you understand existing and emerging threats.

How to protect yourself and your business

You can protect your organisation through protective security and due diligence measures that will reduce the risk, and mitigate the impacts, of foreign interference. 

Security governance

Risk management processes and building a positive security culture in your business will help identify, mitigate and respond to the risk of foreign interference.

• Identify someone in your business to manage security risks. This could include creating and regularly updating a risk register to ensure protection of your essential assets.
• Make sure staff are aware of their security needs and encourage staff to report incidents.
• Regularly update shareholder information in your share register.
• Review your supply chains to find any security vulnerabilities.

Personnel security

As a growing industry, critical minerals companies frequently interact with new domestic and international partners, grow their workforce and bring on new collaborators. To operate securely, your company should manage the risks that employees, partners and collaborators bring. 

• Conduct due diligence and background checks to know who you’re working with. The ASIO Due Diligence Integrity Tool, available to eligible subscribers, has guidance for Australian businesses considering engaging with foreign entities.
• Take a strategic approach to what you share with partners and investors.
• Include legal protections for assets and data in contracts. 
• Ask employees, partners and collaborators to declare potential conflicts of interest.

Information security

Critical minerals companies have been the targets of cyber-attacks and information theft. Protecting information that is critical to your business will help mitigate this risk.

• Adopt robust IT systems and practices. The ACSC website has step-by-step guides, quizzes and exercises to test and improve your business’ cyber security practices.
• Keep sensitive systems or data independent of those accessible by external parties.
• Keep your IP confidential and use non-disclosure agreements and contracts to be clear about who owns and can use IP with contractors and partners. IP Australia has more information on protecting your IP.

Physical security

Anyone who has access to your premises poses a potential security threat. It is recommended businesses adopt appropriate workspace security measures to safeguard sensitive information, staff and physical assets.

• Store sensitive physical information in safe or secure areas.
• Conduct due diligence checks on visitors and consider restricting access to sensitive areas. 
• Consider restrictions on electronic devices in sensitive areas.

Reporting foreign interference

It’s important to report all suspicious behaviour or incidents that might indicate foreign interference – even if you think it could be nothing. Foreign interference is a complex problem, and it can be hard to know what might be important. The smallest piece of information can be valuable. Information given when making a report is kept in confidence. It is only shared with law enforcement and security agencies for further analysis where needed and permitted by law.

You can report possible incidents by calling the 24/7 National Security Hotline or making a report through the ASIO Notifiable Incidents, Threats, or Reportable Observations (NITRO) Portal. 

If your business has experienced a cyber-attack or for advice to improve your cyber hygiene, visit cyber.gov.au or call the Australian Cyber Security Hotline.

For more advice and support on foreign interference, you can contact your local CFICC outreach officer.

Further guidance

• Cyber security guidance for businesses
• Protective Security Policy Framework (PSPF)
• Risk management for businesses
• ASIO Outreach portal