IC Workforce & Counterintelligence — 2026-10-18

DCSA Annual Report Warns Foreign Adversaries Exploiting Federal Hiring as Top Counterintelligence Vulnerability

BLUFForeign intelligence services are embedding collection efforts inside routine professional interactions, making unsolicited job applications and expert consultations the frontline screening challenge for security and vetting teams.

The Defense Counterintelligence and Security Agency released its 2026 annual report on September 17, covering fiscal year 2025, in which it received more than 22,000 suspicious contact reports and identified roughly 2,900 incidents involving foreign entities seeking sensitive information or technology 1. Exploitation of experts was the most frequently reported method of operation at 28 percent of incidents, and email was the most common contact method at 30 percent 1. East Asia and the Pacific accounted for 48 percent of reporting and the Near East for 19 percent 1. The report lists employment-related approaches, talent recruitment and résumé submissions among the channels used 1. Government Executive on October 15 reported on the findings with a focus on federal hiring as a possible counterintelligence vulnerability 2.

Analysis
Foreign services are using ordinary professional channels, including job applications, paid consultations and conference invitations, to reach cleared personnel, so security offices should treat unsolicited contact as the primary entry point. Because expert-exploitation approaches and email dominate reporting, defenders face contacts that look routine and arrive at volume. The regional concentration points hiring and vetting teams toward applicants tied to East Asia and the Pacific and the Near East. Government Executive extends the concern to federal hiring, but the DCSA report documents only cleared industry. Confidence is low: the evidence is one primary document and one secondary article, with no independent confirmation that hiring channels placed foreign-directed applicants. The totals may instead mostly reflect better reporting discipline in cleared industry, with most of the 22,000 contacts being routine solicitations rather than intensified targeting.

2 sources

DCSA Report Details Foreign Efforts to Exploit Experts and Business Ties to Access Sensitive U.S. Technology and Information - Defense Counterintelligence and Security Agency
The next counterintelligence threat may be hiding in federal hiring - Government Executive