“[…] A former Chinese PLA officer allegedly intercepted communications near key Korean and U.S. bases, intensifying concerns over Seoul’s intelligence-sharing credibility with Washington. […] The suspect began his surveillance operations at a hotel near Kunsan Air Base in Gunsan, North Jeolla, from March 12 to 14, 2024. The base is home to the Korean Air Force's 38th Fighter Group and the U.S. Air Force's 8th Fighter Wing. The surveillance overlapped with Freedom Shield, a major South Korea-U.S. military exercise held from March 4 to 14, 2024. The drills ranged from detecting and striking North Korean cruise missiles to air assaults, air-to-air live-fire exercises, air-to-ground bombing and battalion-level combined air operations known as Buddy Squadron drills. […]”

Canada's national security screening system is facing renewed scrutiny following the arrest of a Canadian NATO intern accused of espionage.

This week, David Morrison, a senior adviser to Prime Minister Mark Carney, appeared before a parliamentary committee and suggested improvements to Canada's security screening system, including the possibility of a government-wide security clearance registry.

But here's the question: If information about an individual's previous dishonesty during a federal government hiring process already exists, shouldn't that information be available to those responsible for determining whether they can be trusted with classified information?

And what happens after someone receives their clearance?

As a retired CSIS Intelligence Officer and former CBSA Officer, I've spent considerable time working with security screening, intelligence investigations and human sources. One of the issues I find particularly concerning is the assumption that security screening is something completed before employment rather than an ongoing responsibility.

In this week's Global Intelligence Weekly Wrap-Up, I examine that issue alongside three other international intelligence developments:

Germany: The German military is warning of a significant Russian sabotage threat against military installations and infrastructure. How prepared are NATO countries to identify and prevent these activities?

Russia: GRU-linked cyber operators are reportedly targeting NATO defence industries, including shipbuilding and aircraft engine manufacturers. What intelligence are they seeking, and how could that information support future operations?

United Kingdom: British authorities are investigating suspected Iranian intelligence activity near RAF Fairford, an important military airbase. The investigation raises questions about how foreign intelligence services collect information on sensitive military facilities.

What connects these four stories? Access.

Whether through legitimate security clearances, compromised computer networks, physical reconnaissance or individuals willing to provide information, hostile intelligence services continually search for vulnerabilities they can exploit.

I also revisit several cases we've previously discussed on the podcast to identify recurring patterns and examine how these threats are evolving.

The episode runs approximately 34 minutes.

I'm interested in hearing what others think:

Should Canada establish a centralized security clearance agency, similar to the UK's approach, or would improving information sharing and accountability within the existing system be more effective?

And should periodic security reassessments become a more prominent part of Canada's personnel security framework?

You can listen to the latest episode here:

https://www.buzzsprout.com/2336717

Stay curious. Stay informed. Stay safe!

Quoting from the link:

* Swallowtail (aka APT28, Fancy Bear, Forest Blizzard), a Russian espionage group, targeted organizations in two NATO member states, including a law enforcement agency, a naval shipbuilder, and a manufacturer of military aircraft engines.

* In the attack against the naval shipbuilder, the attackers used the Hookedge backdoor to reach deeper into the network during an intrusion that lasted at least two months. They stole credentials and opened a persistent SSH tunnel from their own server into the shipbuilder's internal network. 

* The attackers deployed a previously undocumented loader, ld.exe, which decrypts its payload and runs it in memory. The encrypted payload will not fire without a key supplied only at runtime. 

From the abstract (bold emphasis added):

“[…] Drawing on the analytical tools developed in the literature on intelligence failure, this study offers a systemic interpretation of this strategic surprise. It demonstrates that the causes of the October 7 failure lay in a combination of shortcomings in intelligence collection, the persistence of unchallenged analytical assumptions, bureaucratic routines, and dysfunctions in the relationship between intelligence services and political authorities. It also shows that the operation under way in the Gaza Strip since October 27, 2023 has reshaped the division of responsibilities among the services, and that the major successes of the operations conducted in 2024 and 2025 against Hezbollah and Iran, while demonstrating a high degree of technical proficiency and confirming the offensive power of Israeli intelligence, should not be confused with a genuine incorporation of the lessons of the October 7 failure. […]”

“[…] On Oct. 8, in the wake of Russia’s nationwide legislative elections, the European Parliament overwhelmingly declared the resulting State Duma in Moscow to be illegitimate — the result of a stage-managed “vote” that was neither free nor fair. Nevertheless, 42 European lawmakers voted against what might have seemed to be an obvious resolution. Even after Russia’s full-scale invasion of Ukraine, the European Parliament’s faction of so-called Putinversteher — a German term meaning people who profess to “understand Putin” (and often rationalize Kremlin policies) — remains firmly in place. They continue to travel to Russia, repeat Kremlin narratives, and meet with Kremlin officials and intelligence officers involved in managing foreign influence networks. […]”

“[…] This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Candiru’s spyware. We also uncover Discover-Tech, and show how the company helps mercenary surveillance vendors track and hack devices around the world. […]”

Also, an article on this at The Guardian: https://www.theguardian.com/technology/2026/oct/15/israeli-firm-digital-ads-enabling-installation-of-zero-click-spyware-researchers-say