Overview of state espionage and influencing

Russia views Finland as an unfriendly country

Russia is the principal intelligence and influencing threat to Finland in the short and long term. The Russian intelligence services take a particular interest in how foreign and security policy is formulated in Finland with respect to such as matters as NATO policy, and also in critical infrastructure, military defence capabilities, and the defence industry. Russia applies both human and cyber intelligence methods when seeking information from Finland.

Even though influencing has always been an activity of the Russian intelligence and security services, its targets and level of activity have varied according to global political conditions. NATO members that border the Russian Federation are of particular interest to its intelligence service. As relations between Russia and the West have cooled, Russian influencing has grown more severe. Russian sabotage operations in Europe may be viewed as one aspect of this.

Russian intelligence services have applied traditional influencing methods in Finland, including information influencing or contact with policymakers and journalists. Russia uses various information influencers to reinforce narratives against Western countries and Finland, and to distort history.

Methods of influencing Russian speakers abroad include compatriot policies and the use of traditional and social media and instant messaging channels that attract a Russian speaking audience. While such efforts are not excluded in Finland, the ability of Russia to influence Finland's Russian-speaking population is limited.

Russia currently views Finland as an unfriendly country, meaning that Finnish people must be prepared for increasingly active and hostile influencing. Russia nevertheless remains a country at war whose main focus is elsewhere than Finland.

Russian cyber intelligence has increased and sharpened in Finland

Even though Russian intelligence operations targeting Finland in the cyber environment have already been highly active for years, they have recently increased and become more precisely focused. The cyber operations of Russian intelligence services against Finland mainly concentrate on state administration, and on foreign and security policy targets.

Cyber espionage is a cost-effective and replicable means of acquiring information that is independent of time or location. Russia also uses Finland as a cyber transit country, meaning that Russian intelligence services regularly use the information network infrastructure located in Finland for cyber operations that target third countries.

The risks of direct and indirect impacts of Russian cyber operations have increased. Russia actively uses cyber influencing in its war against Ukraine to disrupt and paralyse the functioning of Ukrainian society. Targeting cyber influencing in a digitalised world is nevertheless not a straightforward process, and so the unintentional targeting of cyberattacks and information operations against Finland or other third countries is increasingly likely.

The most evident phenomenon over the past year has been denial-of-service attacks against Finland and other Western countries promulgated by pro-Russian cyber-hacktivist groups. Cyber-hacktivist operations are congruent with cyber-influencing that serves Russian interests. The Russian state at least tacitly approves, or even directs such activities.

While Russia has, within certain limits, provided favourable conditions for cybercriminal and hacktivist groups for some years, the associated coordination and cooperation may have increased recently. The use of proxy operators in cyber influencing enables Russia to deny its own involvement.

Recent denial-of-service attacks may be considered to send a message that specifically targets the general public. Their primary goal is to spread mistrust and to intimidate.

Russian human intelligence has become more difficult in Finland

The Russian security and intelligence services have traditionally maintained a standing presence in Finland and other countries, with intelligence service representatives mainly operating under diplomatic cover.

The presence of Russian intelligence officers has nevertheless been significantly reduced in Finland and elsewhere in Europe due to expulsions of those operating under diplomatic cover in response to the invasion of Ukraine. Operating conditions are also hampered by travel restrictions, and by a growing unwillingness of people in Finland to have dealings with Russian operators due to the ongoing war.

The long-term threat of Russian human intelligence has nevertheless not diminished, as Russia still needs to procure information.

The change in operating conditions has forced the Russian intelligence and security services to modify their approach. While Russia increasingly seeks to employ intermediaries and to find non-diplomatic forms of concealment, these will neither substantially nor swiftly compensate for the loss of diplomatic cover. Russia is also still seeking to place intelligence officers in diplomatic positions.

Russian intelligence operators are increasingly forced to operate from bases on Russian soil. Intelligence gathering may target Finnish residents who travel to Russia or spend any time there, and may also involve the use of inappropriate methods.

Finland is a target of Chinese influencing and intelligence

China has a continuous and long-term intelligence interest in Finland that is implemented through both human intelligence and cyber espionage operations. Superpower competition, growing criticism of China in the West, export restrictions and the internal situation in China all affect the targets of Chinese interest.

The Chinese intelligence services target foreign and security policy decision-making, Arctic issues, cutting-edge technology, and groups that the government of China views as a threat. NATO membership and its impact on Finland's attitude towards China have also increased interest in Finland.

Chinese influencing is global and Finland is also a target. It is implemented by several organisations that are linked to the Chinese state and its Communist Party. Chinese influencing and intelligence operations are often closely linked, with efforts also made to engage in influencing covertly.

The aims of influencing in Finland include guiding policymaking and debate concerning China in a direction that is congruent with Chinese objectives, and avoiding any discussion of topics that are undesirable from the perspective of China. The targets of influencing include policymakers, public opinion and people of Chinese origin living in Finland.

China also practices refugee espionage in Finland, meaning that it gathers information on, monitors and seeks to control its former and current citizens who live in Finland. The targets of refugee espionage are typically individuals who represent a group that the Chinese regime views as a threat. Such individuals or their relatives living in China may be harassed by the Chinese authorities.

Chinese cyber operations focus on critical infrastructure targets and exploiting consumer network devices

China targets Finland with cyber operations and actively uses the Finnish cyber infrastructure in operations against third countries. These capabilities and targeting of these operations are now increasingly focused on Western critical infrastructure. China is seeking to create opportunities for cyber influencing against Western countries.

The growing threat of cyber influencing and intelligence targeting critical infrastructure in Western countries is increasing the threat to Finland's national security.

Chinese cyber threat operators are increasingly exploiting poorly protected and compromised consumer network devices. In the systematic intrusion into these devices and the construction of the operational infrastructure, Chinese private IT companies are also widely utilised.

This shift is driven by both a lower risk of exposure and a significantly large number of vulnerable devices. The growing number of consumer devices now connected to the Internet, and particularly the proliferation of home routers that are either unsecured or have outdated firmware currently pose a significant risk to national security.

China seeks cutting-edge expertise and technology from abroad

China is striving for global leadership in key disruptive technologies, including artificial intelligence and quantum technology. It seeks to acquire technology from abroad to support its own economic development, including through investments, other commercial partnerships and research cooperation.

China is also acquiring expertise and technology from abroad for military purposes. Several dozen universities in China have links to the Chinese armed forces, with efforts ongoing to transfer required expertise to China through academic cooperation.

The restrictions on exports of semiconductors and their manufacturing technology imposed by the USA on China have also increased the need for China to acquire information by applying intelligence methods. Finland also has a wealth of technological expertise that is of interest to China.

Finland is also an espionage target for certain other countries

Finland holds special interest not only for the intelligence services of Russia and China, but also for those of certain other countries, such as Iran. Authoritarian states often target their espionage and influencing operations at individuals who are members of the political opposition in their country of origin, or at other groups that their governments view as a threat.