# The Offer That Knew Too Much In two real cases, NZSIS describes how a well-paid job can open a relationship with a foreign state actor. One person carried on after suspecting the recruiter was not legitimate. Another shared perspectives shaped by government work. ## The value of information does not begin with the word "classified." An insider can share the way they see a problem. What seems important. What may happen next. How an institution works. NZSIS says that, in one case, a government employee supplied perspectives and information partly informed by their official role. The report does not record classified documents being passed on. **PUBLIC FACT.** NZSIS says the two cases are real and that it worked with employers to reduce the risk. **OUR READING.** In both accounts, value grows as the relationship gains a rhythm. NZSIS does not phrase the conclusion this way. It is our reading. **THE FILE'S LIMITS.** The service does not name the people, platforms, cover companies, state, payments, duration or precise information. ## A plausible offer can hide access inside a job. The accounts describe different operations. Read together, they show two forms of risk and where the public record ends. ### They saw the signal. They stayed for the offer. CASE 1 · PUBLIC CLEARANCE. A New Zealander had advertised their security clearance on a social-media profile. A foreign-state actor offered a lucrative contract through a cover company. The person suspected the recruiter might not be legitimate. The salary and role kept them in the relationship. NZSIS worked with the employer to reduce the risk. There is no evidence that the recruitment produced intelligence. - Profile. The security clearance was public - Offer. A lucrative contract through a cover company - Decision. Suspicion does not stop the relationship - Intervention. The employer is helped to reduce the risk ### They took the job. They supplied perspective. CASE 2 · SIDE JOB. A New Zealand Government employee responded to an online job advert and unknowingly agreed to work for a foreign state. They did not tell their employer about the secondary employment. Basic checks would have shown that the company was illegitimate. NZSIS says the person supplied perspectives and information partly informed by their government role. The report does not record classified documents being passed on. - Advert. The offer appears online as an external job - Company. Basic checks would have shown it was illegitimate - Relationship. The secondary employment is not disclosed - Value. Perspectives shaped by government work are supplied ## Follow the offer, not the movie plot. The two cases are not the same operation. This trace puts common elements from the NZSIS report and the Five Eyes bulletin in order. A public profile can become a signal, the offer can look like a job and the relationship can reach insider judgement. **THE TEXT HERE.** The trace explains the pattern. It does not reproduce a real recruiter's message. - 01. The public profile. Security clearance, role and professional history become visible to recruiters. In Case 1, NZSIS explicitly says the person displayed their clearance on a social profile. [FACT IN CASE 1] - 02. The offer. The contract looks like an external job. It has a role, a salary and a deliverable. When the form is familiar, the first question may be about money rather than intent. [FACT IN BOTH CASES] - 03. The cover. In one case there is a cover company. In the other, NZSIS says a basic check would have shown the company was illegitimate. [PUBLIC NZSIS DETAIL] - 04. Normalisation. Secondary employment creates a rhythm and a reason to continue. "Normalisation" is this page's reading, not NZSIS wording. [OUR READING] - 05. Perspective. The questions reach for what the person knows from their role. How does the problem look from inside? What matters? What direction seems possible? NZSIS says this kind of perspective was supplied in Case 2. [FACT IN CASE 2] - 06. Intervention. NZSIS works with the employer and warns about the trap. The intervention comes after the relationship has taken shape. It does not look like a clear recruitment scene. [FACT IN BOTH CASES] **THE ATTRIBUTION LINE.** In 2026, NZSIS does not say which state was behind the two cases. A separate Five Eyes bulletin names China's military intelligence services when warning about the broader method on professional platforms. The bulletin does not let us attach that method automatically to these two cases. ## Three kinds of information, three levels of certainty. If you put everything under the label "secrets", you miss the mechanism NZSIS describes. The report does not say what precise information was supplied. It does say that perspectives tied to a role had value. ### CLASSIFIED DOCUMENT. We have no public evidence. In Case 2, NZSIS says no classified documents were reported as passed on. For Case 1, the service says there is no evidence that the recruitment produced intelligence. ### NON-PUBLIC FACT. It can matter without a stamp. A fact can stay non-public without being classified. The report does not tell us what precise information was supplied. ### INSIDER JUDGEMENT. Here the report is clear. NZSIS says the government employee supplied perspectives and information partly informed by their official role. **LIMITED CONCLUSION.** Insider perspective is not a document leak. It can still change the questions that come next. ## What NZSIS says about the cases and what Five Eyes says about the method. This is where it is worth slowing down. Two true pieces of information can produce a false claim when joined without a boundary. ### THESE TWO CASES. The state remains unnamed. The 2026 report refers to a foreign-state actor and to an employee who unknowingly agreed to work for a foreign state. The people, platforms, companies and payments remain anonymous. ### THE BROADER METHOD. China is named in a separate bulletin. The Five Eyes bulletin warns that China's military intelligence services use professional networks and job platforms to look for people with privileged access. **LIMIT THE CLAIM.** The second statement describes a documented pattern. It does not identify the state behind the two cases. ## A five-minute check can change the rhythm. NZSIS warns about unsolicited offers and recommends caution when questions move toward military affairs, international relations or government decision-making. If you receive an offer, the questions below help you slow down. They are not an investigation recipe. ### 01. IDENTITY Who is the company, who is the end client and what can you verify about them from public sources? _A well-written profile is not proof._ ### 02. MOTIVE Why do they need your experience now? What happens if the questions move close to your official role? _Notice when the subject turns toward your institution._ ### 03. TRANSPARENCY Have you checked your employer's rule on secondary employment and disclosed the relationship before it starts? _A second contract does not remove your first set of obligations._ **A PRUDENT STEP.** If an offer asks about military affairs, foreign policy or government decisions, pause. Ask your employer or a competent authority for advice. ## Do not ask only "Did I see a classified document?" Also ask what this work relationship is buying. 1. Look at what you have made public about your role, access and professional history. 2. Check who pays, who the end client is and why they chose you. 3. Stop the exchange if the role starts to depend on access to, or judgement from, your official work. _Questions for caution, not verdicts about intent._ ## Each source has a different job. The NZSIS report is the primary source for the two cases. The Five Eyes bulletin provides context for the broader method and for the attribution to China. The trace, comparison and questions belong to this page. They are not quotations from the sources. ### NZSIS · Security Threat Environment 2026 PRIMARY SOURCE. The public report describes the two real cases, the service's intervention and the limits it keeps anonymous. [Open source](https://www.nzsis.govt.nz/our-work/new-zealands-security-threat-environment/security-threat-environment-2026/view/3752) ### NZSIS · New Zealand's Security Threat Environment PRIMARY SOURCE. The official page explains the annual assessment and links to the 2026 edition. [Open source](https://www.nzsis.govt.nz/our-work/new-zealands-security-threat-environment) ### NZSIS · Joint Five Eyes bulletin FIVE EYES CONTEXT. The 4 June 2026 bulletin names China when warning about the broader method on professional platforms. It does not identify the state behind the two cases above. [Open source](https://www.nzsis.govt.nz/news/joint-five-eyes-bulletin-safeguarding-our-secrets) ### NZSIS · Security Threat Environment 2026 CONTEXT. The section on recruiting people with inside access describes job adverts, recruitment firms and requests that reach privileged information. [Open source](https://www.nzsis.govt.nz/our-work/new-zealands-security-threat-environment/security-threat-environment-2026) ### What remains unknown - the identity of the people involved and the state behind the two cases - the platform, cover company, payments and duration of the relationship - the precise information supplied by the government employee - the classified material behind the NZSIS assessment ### How to read this page Public fact means the claim appears in an accessible document. NZSIS assessment means a conclusion by the service without the classified material behind it. Editorial link means we join public elements to explain the pattern and say when we do it. Unknown means we do not fill the gap with a guess. Sources checked for the edition published on 14 August 2026. Update if NZSIS publishes a correction or new information about these cases. --- Conceived and edited by Marius Comper. [Marius Comper](https://mariuscomper.uk/en/).