NZSIS · SECURITY THREAT ENVIRONMENT 2026 · 13 AUGUST 2026

The Offer That Knew Too Much

In two real cases, NZSIS describes how a well-paid job can open a relationship with a foreign state actor. One person carried on after suspecting the recruiter was not legitimate. Another shared perspectives shaped by government work.

A job can buy judgement before it asks for documents.

Follow the offer

THE CENTRAL IDEA

The value of information does not begin with the word "classified."

An insider can share the way they see a problem. What seems important. What may happen next. How an institution works. NZSIS says that, in one case, a government employee supplied perspectives and information partly informed by their official role. The report does not record classified documents being passed on.

That changes the question. A document can leave an institution. So can the judgement of someone who works there, if someone buys it from outside.

PUBLIC FACT

NZSIS says the two cases are real and that it worked with employers to reduce the risk.

OUR READING

In both accounts, value grows as the relationship gains a rhythm. NZSIS does not phrase the conclusion this way. It is our reading.

THE FILE'S LIMITS

The service does not name the people, platforms, cover companies, state, payments, duration or precise information.

TWO CASES, ONE OPENING

A plausible offer can hide access inside a job.

The accounts describe different operations. Read together, they show two forms of risk and where the public record ends.

CASE 1 · PUBLIC CLEARANCE

They saw the signal. They stayed for the offer.

A New Zealander had advertised their security clearance on a social-media profile. A foreign-state actor offered a lucrative contract through a cover company. The person suspected the recruiter might not be legitimate. The salary and role kept them in the relationship. NZSIS worked with the employer to reduce the risk. There is no evidence that the recruitment produced intelligence.

DESCRIBED BY NZSIS

CASE TRACE

  1. 01ProfileThe security clearance was public
  2. 02OfferA lucrative contract through a cover company
  3. 03DecisionSuspicion does not stop the relationship
  4. 04InterventionThe employer is helped to reduce the risk

CASE 2 · SIDE JOB

They took the job. They supplied perspective.

A New Zealand Government employee responded to an online job advert and unknowingly agreed to work for a foreign state. They did not tell their employer about the secondary employment. Basic checks would have shown that the company was illegitimate. NZSIS says the person supplied perspectives and information partly informed by their government role. The report does not record classified documents being passed on.

DESCRIBED BY NZSIS

CASE TRACE

  1. 01AdvertThe offer appears online as an external job
  2. 02CompanyBasic checks would have shown it was illegitimate
  3. 03RelationshipThe secondary employment is not disclosed
  4. 04ValuePerspectives shaped by government work are supplied

EXPLANATORY DIAGRAM

Follow the offer, not the movie plot.

The two cases are not the same operation. This trace puts common elements from the NZSIS report and the Five Eyes bulletin in order. A public profile can become a signal, the offer can look like a job and the relationship can reach insider judgement.

THE TEXT HEREThe trace explains the pattern. It does not reproduce a real recruiter's message.
FACT IN CASE 101 / 06

The public profile

Security clearance, role and professional history become visible to recruiters. In Case 1, NZSIS explicitly says the person displayed their clearance on a social profile.

WATCH FOR SELECTION

FACT IN BOTH CASES02 / 06

The offer

The contract looks like an external job. It has a role, a salary and a deliverable. When the form is familiar, the first question may be about money rather than intent.

WATCH FOR MOTIVATION

PUBLIC NZSIS DETAIL03 / 06

The cover

In one case there is a cover company. In the other, NZSIS says a basic check would have shown the company was illegitimate.

WATCH FOR PLAUSIBILITY

OUR READING04 / 06

Normalisation

Secondary employment creates a rhythm and a reason to continue. "Normalisation" is this page's reading, not NZSIS wording.

WATCH FOR RHYTHM

FACT IN CASE 205 / 06

Perspective

The questions reach for what the person knows from their role. How does the problem look from inside? What matters? What direction seems possible? NZSIS says this kind of perspective was supplied in Case 2.

WATCH FOR VALUE

FACT IN BOTH CASES06 / 06

Intervention

NZSIS works with the employer and warns about the trap. The intervention comes after the relationship has taken shape. It does not look like a clear recruitment scene.

WATCH FOR BRAKE

WHAT WAS ACTUALLY SUPPLIED?

Three kinds of information, three levels of certainty.

If you put everything under the label "secrets", you miss the mechanism NZSIS describes. The report does not say what precise information was supplied. It does say that perspectives tied to a role had value.

CLASSIFIED DOCUMENT

We have no public evidence.

In Case 2, NZSIS says no classified documents were reported as passed on. For Case 1, the service says there is no evidence that the recruitment produced intelligence.

NON-PUBLIC FACT

It can matter without a stamp.

A fact can stay non-public without being classified. The report does not tell us what precise information was supplied.

INSIDER JUDGEMENT

Here the report is clear.

NZSIS says the government employee supplied perspectives and information partly informed by their official role.

LIMITED CONCLUSION

Insider perspective is not a document leak. It can still change the questions that come next.

THE ATTRIBUTION LINE

What NZSIS says about the cases and what Five Eyes says about the method.

This is where it is worth slowing down. Two true pieces of information can produce a false claim when joined without a boundary.

THESE TWO CASES

The state remains unnamed.

The 2026 report refers to a foreign-state actor and to an employee who unknowingly agreed to work for a foreign state. The people, platforms, companies and payments remain anonymous.

THE BROADER METHOD

China is named in a separate bulletin.

The Five Eyes bulletin warns that China's military intelligence services use professional networks and job platforms to look for people with privileged access.

LIMIT THE CLAIM

The second statement describes a documented pattern. It does not identify the state behind the two cases.

WHAT YOU CAN CHECK

A five-minute check can change the rhythm.

NZSIS warns about unsolicited offers and recommends caution when questions move toward military affairs, international relations or government decision-making. If you receive an offer, the questions below help you slow down. They are not an investigation recipe.

01
IDENTITY

Who is the company, who is the end client and what can you verify about them from public sources?

A well-written profile is not proof.
02
MOTIVE

Why do they need your experience now? What happens if the questions move close to your official role?

Notice when the subject turns toward your institution.
03
TRANSPARENCY

Have you checked your employer's rule on secondary employment and disclosed the relationship before it starts?

A second contract does not remove your first set of obligations.
A PRUDENT STEP

If an offer asks about military affairs, foreign policy or government decisions, pause. Ask your employer or a competent authority for advice.

THE QUESTION THAT REMAINS

Do not ask only "Did I see a classified document?"

Also ask what this work relationship is buying.

  1. 01

    Look at what you have made public about your role, access and professional history.

  2. 02

    Check who pays, who the end client is and why they chose you.

  3. 03

    Stop the exchange if the role starts to depend on access to, or judgement from, your official work.

Questions for caution, not verdicts about intent.

SOURCES AND METHOD

Each source has a different job.

The NZSIS report is the primary source for the two cases. The Five Eyes bulletin provides context for the broader method and for the attribution to China. The trace, comparison and questions belong to this page. They are not quotations from the sources.

PRIMARY SOURCE

NZSIS · Security Threat Environment 2026

The public report describes the two real cases, the service's intervention and the limits it keeps anonymous.

Open source
PRIMARY SOURCE

NZSIS · New Zealand's Security Threat Environment

The official page explains the annual assessment and links to the 2026 edition.

Open source
FIVE EYES CONTEXT

NZSIS · Joint Five Eyes bulletin

The 4 June 2026 bulletin names China when warning about the broader method on professional platforms. It does not identify the state behind the two cases above.

Open source
CONTEXT

NZSIS · Security Threat Environment 2026

The section on recruiting people with inside access describes job adverts, recruitment firms and requests that reach privileged information.

Open source

What remains unknown

  • the identity of the people involved and the state behind the two cases
  • the platform, cover company, payments and duration of the relationship
  • the precise information supplied by the government employee
  • the classified material behind the NZSIS assessment

How to read this page

Public fact means the claim appears in an accessible document. NZSIS assessment means a conclusion by the service without the classified material behind it. Editorial link means we join public elements to explain the pattern and say when we do it. Unknown means we do not fill the gap with a guess.

Sources checked for the edition published on 14 August 2026. Update if NZSIS publishes a correction or new information about these cases.

These links go to official NZSIS documents and pages.