In late May, a shipment of F-35 stealth fighter jet parts heading for the United States from Australia was misrouted to Hong Kong and into Chinese hands. Since 2007, Chinese intelligence operatives and their proxies had been stealing data to do with the F-35. Now, some of the jet’s closely guarded components, including a cockpit canopy and weapons-bay door, had landed on Chinese soil—handing Beijing stealth technology that only the United States and its allies have access to. China will surely attempt to reverse-engineer the technologies it was lucky to acquire. U.S. officials do not believe there was foul play here and they think the delivery was likely an accident: the result of a shipping delay and a missed email. But even without active foreign interference, the mere logistics of coordinating F-35 production and delivery among Washington, Canberra, Lockheed Martin, and a third-party shipping company exposed defense secrets to the greatest U.S. rival.
The U.S. defense industrial base—the network of domestic and international companies and organizations responsible for the research, production, delivery, and maintenance that undergird American military operations—is growing at a pace not seen in decades, as Washington seeks to place arms manufacturing back on a “wartime footing,” in the words of U.S. Defense Secretary Pete Hegseth. The United States is working with allies, notably in the Indo-Pacific, to expand military production and make supply chains resilient to shocks. South Korea has begun performing maintenance and repairs on U.S. naval vessels, Japan is set to quadruple its production of vital antiballistic missiles, and American Precision Strike Missiles will soon be rolling off assembly lines in Australia.
Although this expansion is sensible and necessary, it also carries significant risks. As the U.S. defense base spreads, it becomes more exposed to espionage, theft, and sabotage.
Since the Cold War, U.S. adversaries have targeted the research and infrastructure that give the United States its military advantage. Now, the likes of Russia, China, and North Korea can also learn about American capabilities by mounting espionage campaigns against U.S. allies. Because the U.S. military is more dependent on supply chains that snake around the world, it has become more vulnerable to the disruptive actions of hostile powers.
If the United States fails to safeguard its deepening military partnerships, adversaries will have more opportunities than ever before to at once undermine American defenses and improve their own militaries. Washington must help its partners raise their security standards, share intelligence and best practices more widely, and fortify monitoring programs. If pursued judiciously, this emphasis on security will not hinder cooperation between the United States and its allies but rather strengthen it. But if the United States does not address this threat, one of the country’s great advantages will become a perilous weakness.
BACK ON BASE
In the 1990s, the United States began working more closely with allies to bolster defense production and supply chains amid post–Cold War cuts to military spending. Washington established the National Technology and Industrial Base in 1993, a policy framework that institutionalized cooperation between U.S. and Canadian defense companies. In the following decades, the United Kingdom, Australia, and New Zealand were added to the agreement. But until recently, a number of legal, bureaucratic, and cultural barriers among the five countries hampered this partnership, keeping it from fulfilling its potential.
Over the last five years, however, Washington’s efforts to expand its defense base have begun to speed up. In 2021, the trilateral AUKUS security pact between the United States, the United Kingdom, and Australia—in which the three countries pledged to work together to produce advanced military technologies, including nuclear-powered submarines—was a milestone for defense industrial cooperation. In the 2023 National Defense Industrial Strategy, Washington outlined its commitment to further collaboration with allies, arguing that “the global activity of pacing threats increasingly requires a global approach to defense industrial relationships, concerns, and competition.”
The next year, the United States helped launch the Partnership for Indo-Pacific Industrial Resilience, a forum that brings together some Western and Asian countries to coordinate defense manufacturing and protect important supply chains. Washington has supplemented these multilateral initiatives with bilateral defense production agreements, including pacts with Australia, Japan, South Korea, and Taiwan to partner on critical defense systems, missile production, and shipbuilding. The United States is also planning to accelerate collaboration with India, Indonesia, and the Philippines. Washington has a growing appetite for defense industrial cooperation in the Indo-Pacific, and its partnerships there can thrive—as long as they can be adequately secured.
SPY HEAVEN
States have long used espionage to gauge enemy weaknesses and steal cutting-edge technologies. They have also executed sabotage operations to disrupt opponents’ supply chains and hinder their battlefield performance. The Soviet Union, for instance, gained nuclear weapons in part by penetrating the Manhattan Project; more recently, China stole secrets related to the F-22 and F-35 stealth fighter jets and the C-17 cargo plane. Galloping advances in technology invite subterfuge and theft. New breakthroughs in artificial intelligence and quantum computing could have strategic implications on par with the atomic bomb, and U.S. rivals are tenacious in seeking to acquire such technologies themselves.
Today, the American defense base is “under a state of constant, multivector siege” in cyberspace, according to a February report by the Google Threat Intelligence Group. U.S. adversaries are working to steal sensitive information, trade secrets, and intellectual property at every possible level, from recruiting individual employees to hacking manufacturers’ IT networks.
In addition to staging digital attacks, foreign governments such as China and North Korea are cultivating sources inside firms and research institutions focused on defense and dual-use innovation. Governments hostile to the United States, notably China, have sought to establish seemingly legitimate business and academic relationships to gain access to proprietary information. A September 2025 report from the U.S. House Select Committee on China found more than 100 academic partnerships between American universities and Chinese entities that pose a national security risk. State-sponsored actors have also embedded themselves inside American firms and research departments; for instance, North Korean remote IT workers in 2024 infiltrated a U.S. defense contractor and stole data about export-controlled technology. Perhaps most strikingly, U.S. adversaries have used foreign investment, mergers, and even the acquisition of entire companies—sometimes using subsidiaries to mask their involvement—to gain control of critical dual-use technologies. The Times reported that the 2008 buyout of the British-based Dynex Semiconductor by a subsidiary of a Chinese state-owned railway company, for example, gave the Chinese navy access to technology crucial to developing rail guns and electromagnetic launch systems for aircraft carriers.
As the U.S. defense base spreads, it becomes more exposed to espionage, theft, and sabotage.
As the United States has deepened its defense cooperation efforts in the Indo-Pacific, China and North Korea have increasingly targeted U.S. allies in the region. In 2024, South Korea’s National Police Agency revealed that North Korean hackers had mounted all-out cyberattacks against South Korean defense companies for over a year, breaching their networks and stealing technical data. Last January, the agency reported a 40 percent increase in illegal technology transfer cases—that is, of insiders leaking proprietary information on critical technologies to do with semiconductors, batteries, and shipbuilding. Many of those leaks were connected to China.
Japan, which the KGB nicknamed “spy heaven” during the Cold War, remains a hub for espionage. A July New York Times investigation found that members of a Tokyo-based Russian military intelligence unit called the 20th Directorate have spent years posing as diplomats and businesspeople to help Moscow acquire defense technologies that it is banned from importing. This equipment—which includes Japanese components used to guide Russian Kh-101 cruise missiles—has been essential to Russia’s war effort in Ukraine. From 2019 to 2024, the Chinese hacking group MirrorFace conducted over 200 cyberattacks against Japanese defense, national security, and advanced technology targets. And in February 2025, the Japanese military discovered that some of its members had unknowingly circulated for over a year USB sticks that carried malware used by Chinese hacker groups.
In Australia, U.S. adversaries have worked to infiltrate AUKUS in a number of ways. Last year, the Iranian-backed Cyber Toufan hacker group mounted a series of cyberattacks on Israeli defense contractors that gave it access to sensitive material on Australian weapons programs, including the multibillion-dollar Redback infantry fighting vehicle. Mike Burgess, the director general of Australia’s domestic intelligence service, has repeatedly warned that Australia has become a priority espionage mark where “defense personnel are being targeted in person and online.” In 2024, Burgess revealed that a spy ring run by an unspecified foreign government, referred to as “the A-team,” had cultivated and recruited a former Australian politician to assist them. In one scheme, the A-team invited Australian academics and political figures to an all-expenses-paid overseas conference to build intelligence relationships—a tactic often associated with China. The group also offered to pay Australian defense sector employees for information on AUKUS and sensitive technologies such as submarines and missile systems.
American rivals also use sabotage to weaken the broader U.S. defense base. Since 2022, Russian military intelligence has targeted European weapons manufacturers, transportation, and logistics. Moscow even planned to assassinate Armin Papperger, the CEO of the German defense giant Rheinmetall, to undermine the continent’s support for Ukraine. American security services worry adversaries may introduce malicious products into U.S. and allies’ supply chains to steal or alter data, disrupt operations, or interrupt communications. In a wartime scenario, when the defense industrial base is needed most, compromising American production lines or weapons systems could provide opponents with enormous advantages.
WEAK LINKS
The United States and its allies have systems in place to protect against spying and sabotage, but these systems are not always successful. Within the United States, the Defense Counterintelligence and Security Agency is the lead organization for implementing the National Industrial Security Program, which protects the domestic defense industry by governing security clearances, cybersecurity safeguards, and the detection of espionage. But even domestically, many of the most vulnerable parts of the military supply chain—notably, smaller companies that provide specialized software, parts, or services—operate beyond the government’s field of vision and often cannot afford to install sufficient cybersecurity protections. Outside the United States, these problems are magnified.
Although bilateral security agreements establish standards for safeguarding classified military and industrial information, U.S. partners still have vastly different legal regimes, security cultures, and capabilities. Australia is arguably Washington’s most capable Indo-Pacific ally: it is part of the Five Eyes Alliance, an Anglosphere intelligence-sharing agreement; works closely with the American and British militaries through AUKUS; and has a robust, albeit relatively new program focused on securing the defense industry. Still, Burgess has cautioned that the country faces “unprecedented levels of espionage” that will only increase as AUKUS collaboration grows.
South Korea and Japan, while both technologically advanced and capable U.S. partners, have long-standing legal and counterintelligence vulnerabilities that they are only belatedly addressing. Until South Korea passed an expanded espionage statute last February, a loophole in the country’s law meant its government could generally bring espionage charges only in cases related to North Korea, forcing it to rely on different laws to prosecute spies from other countries. As a result, South Korean security services have long been operating with one hand tied behind their back in dealing with Chinese subterfuge; most Chinese nationals caught filming sensitive installations in recent years, for instance, have faced little or no punishment. For its part, Japanese law still does not explicitly prohibit individuals from serving as clandestine agents for a foreign power or accepting payment from a foreign intelligence service, creating a permissive environment for foreign spies to operate in Japan.
Japan is aware of these problems and is reforming its security architecture: Tokyo recently established two bodies to oversee its intelligence agencies and is pursuing a new “anti-spy” law that will finally give authorities an appropriate set of tools to counter espionage. Still, these measures face domestic opposition and will take time to come into effect. Although American allies and partners in the Indo-Pacific are making meaningful progress, regional security standards still lag behind those of the United States.
MAKING THE GRADE
The United States needs its Indo-Pacific allies to support its military goals in the coming years. But weaknesses in one country’s security architecture create vulnerabilities for all. Washington must help its allies better protect their defense industries. Although the United States has acknowledged this need before, it has not treated it with sufficient urgency and has focused too narrowly on cybersecurity. To be sure, absolute security is impossible, and too rigidly enforcing U.S. standards on allies would slow technological cooperation. Still, the United States must ensure that allies’ security programs are comparable to its own and that any glaring gaps are filled as swiftly as possible.
To launch these efforts, the United States should develop a comprehensive grading system for defense industrial security—a framework that assesses allies’ ability to safeguard critical technologies and identifies areas for improvement. The State Department already uses such a system to evaluate global efforts to counter narcotics and human trafficking. A grading system for defense industrial security would gauge the strength of the entirety of allies’ security apparatuses—including the efficacy of their legal frameworks, cybersecurity, personnel vetting, protection of classified information, foreign investment screening, and supply-chain security—and their resilience against foreign interference and espionage.
At the operational level, Washington should expand existing programs that oversee international defense industrial security. Counterintelligence special agents from organizations such as the Naval Criminal Investigative Service and the Air Force Office of Special Investigations already enforce security standards at home and abroad by guarding critical infrastructure, strengthening cybersecurity, and neutralizing foreign intelligence threats in collaboration with host-country partners. As the defense industrial base expands internationally, more resources will be needed to sustain these operations at scale and ensure that security standards keep pace with joint manufacturing and innovation.
True burden sharing is possible only if U.S. partners can keep critical technologies secure.
The United States should also expand its information-sharing efforts to alert allies about potential threats and vulnerabilities. Foreign partners currently have limited access, for instance, to Department of Defense cybersecurity information-sharing programs. The United States should consider allowing international defense organizations to access these programs, or else work with allies to develop similar, multilateral information-sharing platforms focused on securing defense production.
Finally, Washington should use the Partnership for Indo-Pacific Industrial Resilience to develop a work stream dedicated to defense industrial security, which would provide a forum for regional partners to establish common security standards and share intelligence best practices. Although nonbinding, policy recommendations from this collaboration would provide authoritative guidance on how to strengthen defense industrial security.
The F-35 parts debacle is a reminder of the inherent vulnerabilities of globalized supply chains, which U.S. adversaries are increasingly eager to exploit. The United States must rely on international partnerships to revitalize its defense industrial base—but true burden sharing is possible only if U.S. partners can keep critical technologies secure. The United States and its allies must strive to stiffen the security of their military research, production, and supply chains. Only with those protections can they realize the gains that come from working together.
Loading…
