ASIO says espionage cost Australia $12.5 billion last year. But that figure relies on assumptions, speculative scenarios and opaque data that raise serious questions about credibility.

Mike Burgess’s claim that espionage cost Australia $12.5 billion in 2023-24 are, to quote Paddy Gourley as “woolly as Shaun the Sheep” - the figures are so rubbery they could bounce.

This eye-watering sum, delivered with characteristic flourish in his 26th annual Hawke lecture, comes courtesy of a report commissioned by ASIO itself from the Australian Institute of Criminology. It’s a neat arrangement: ASIO commissions the research, provides the data, and then trumpets the results as a vindication of its billion-dollar budget.

One might call it a “return on investment”, as Burgess himself suggested in a nonsensical flourish that wouldn’t survive five minutes in Cabinet’s Expenditure Review Committee.

The problem is that the methodology underpinning this $12.5 billion claim is so riddled with uncertainties, assumptions and outright speculation that treating it as reliable borders on the fanciful. The AIC researchers themselves acknowledge as much, if one reads beyond the executive summary.

The report’s ‘Challenges_’_ section admits espionage is “a highly secretive and covert activity” and “espionage that has been disrupted represents a small fraction” of the total threat. Yet they assume this small, unrepresentative fraction reflects regular espionage activity.

More troubling is the attribution problem. The report acknowledges it is “difficult to verify” state involvement and that “most detected cyber-attacks are attributed to non-state actors” - criminals and hacktivists, not foreign spies. Yet the entire $12.5 billion figure depends on distinguishing state-sponsored espionage from ordinary cybercrime. How did the researchers make these distinctions? The report doesn’t say.

The researchers admit that security measures address “a range of interrelated threats, including espionage, foreign interference, terrorism, sabotage and supply chain disruption”, making it “difficult to apportion out the cost”. Their solution? Include all the costs anyway. It’s convenient, but hardly rigorous.

Then there are the “prevented costs” - tens of billions Australia supposedly avoided through ASIO’s vigilance. These are entirely hypothetical. The report admits “the consequences of more severe scenarios involving espionage remain hypothetical rather than based on real-world observable impacts.” One scenario posits a week-long cyber-attack costing $5.9 billion. Another imagines $10 billion in lost foreign investment. Claiming credit for preventing hypothetical harms could justify unlimited security spending.

Intellectual property theft is similarly speculative. Burgess cites overseas visitors who allegedly pulled branches from a rare fruit tree, which “almost certainly” allowed foreign scientists to “reverse engineer two decades of Australian research”. The report estimates IP theft costs “up to $1.9 billion”. That “up to” means the researchers took the maximum possible value and presented it as actual cost.

The researchers claim their estimates are “conservative” and an “underestimate”. Yet they use maximum values (“up to”), include hypothetical scenarios that never occurred, and assume detected espionage is representative despite acknowledging it’s only “a small fraction”. This is not conservative methodology – it’s maximalist.

Most concerning is what the report doesn’t disclose. “Several calculations were based on sensitive and classified data” and “are not itemised”. Translation: a significant portion cannot be verified or scrutinised. For an organisation that prides itself on careful assessment of evidence, this lack of transparency is troubling.

The report fails to acknowledge a fundamental conflict: ASIO is both client and primary data source. The three main sources are ASIO experts, ASIO cases, and limited published research. There is no independent verification. It’s a closed loop that invites confirmation bias.

The AIC researchers’ ‘Challenges’ section is remarkably candid about methodological difficulties. But these difficulties are so fundamental – inability to detect most espionage, impossibility of reliable attribution, speculative prevented costs, lack of independent data – that the figure should be treated with extreme caution. Instead, Burgess has seized upon it as definitive proof, using it to justify ever-greater security spending.

Burgess would do well to recall the studied reticence of his predecessors, who understood that intelligence work is characterised by uncertainty, ambiguity and incomplete information. Where evidence is fragmentary or speculative, that should be clearly stated, not papered over with confident assertions and headline-grabbing figures. The public and the government are entitled to reliable assessments, not advocacy dressed up as analysis.

Ministers relying on ASIO’s advice should interrogate this $12.5 billion claim closely. How much is based on confirmed versus suspected incidents? What confidence level attaches to the attribution of state involvement? How were mitigation costs apportioned between espionage and other threats? What probability was assigned to the hypothetical scenarios that generate the “prevented costs”? These are basic questions that any rigorous cost-benefit analysis would address.

In the end, the $12.5 billion figure tells us more about ASIO’s appetite for public attention than it does about the actual cost of espionage. It’s a number designed to shock, to justify, to advocate – not to inform. The real cost of espionage to Australia remains, as the report itself admits, largely unknowable. That’s an uncomfortable truth, but it’s more honest than pretending we can measure the unmeasurable with false precision. As Paddy Gourley observed: “it’s sometimes better to have people suspect your limitations than to open your mouth and prove them.”

The views expressed in this article may or may not reflect those of Pearls and Irritations.

Please support Pearls and Irritations with your tax deductible donation

This year, Pearls and Irritations has again proven that independent media has never been more essential.

The integrity of our media matters - please support Pearls and Irritations

For the next month you can make a tax deductible donation through the Australian Cultural Fund

Please click here to add your donation.