corporate

There has been a shift in the way sensitive information is sought, gathered, and used within the world of global commerce.

The covert acquisition of confidential records (on individuals, on rivals, on critics) is no longer a fringe activity. It has become an increasingly visible part of high-stakes commercial life.

The behavior is enabled by a growing market of private intelligence firms, former law enforcement personnel, and technically sophisticated operators working in the legally ambiguous grey area between competitive intelligence and illegal conduct.

Courts from multiple jurisdictions are beginning to reveal the scale of the problem. The pattern they reveal is a striking one.

In March 2025, a Paris court convicted Bernard Squarcini, the former head of France's domestic intelligence service, of using his security contacts for private gain, including by allegedly obtaining confidential information on behalf of a major corporate client after leaving his government post. The court found that state resources had been misappropriated to satisfy what it described as the private commercial concerns of that client. The court also found that a system of surveillance had been organised targeting a journalist critical of the company.

The case illustrates a pattern that is becoming harder to ignore: former state intelligence operatives moving into private commercial roles and leveraging their former contacts, tradecraft, and institutional networks to gain an unfair advantage in their new roles.

A separate matter in the United States points to a similar dynamic. A federal court found that a major technology company had hired unlicensed private investigators to conduct covert personal investigations of a litigation adversary and their legal counsel, using false pretences. They even communicated through a self-deleting messaging application. The broader dispute, which ran to hundreds of millions of dollars in settlement value, also surfaced allegations that contractors with intelligence backgrounds had been engaged to gather sensitive commercial information on rivals. No court produced a definitive finding of a coordinated espionage programme, but what emerged was partial visibility into how close a major corporation was willing to operate to the legal line.

What is changing is not merely that the line is being approached. It is how far, allegedly, it is being crossed, and the seniority of the institutions involved when it is.

In another, more recent matter, in Milan, Italy, the Public Prosecutor's Office has issued 81 notices of conclusion of preliminary investigations, bringing 101 charges altogether alleging that Enrico Pazzali - owner of Milan-based private intelligence firm Equalize- was running an illegal dossier operation.

While we should presume the innocence of all named individuals and entities until proven otherwise, the far-reaching case narrates that firms like Eni - one of Europe's largest oil and gas groups - and their Director of Legal Affairs Stefano Speroni illegally hacked into government computer systems in the process of trying to assemble an intelligence dossier against oil executive Francesco Mazzagatti. Italian prosecutors allege the dossier sought to portray Mazzagatti as a member of the 'Ndrangheta' without any credible documentation.

The Deeper Issue Uncovered: When Private Operations Touch State Infrastructure

What distinguishes the Equalize case from a conventional data breach is the alleged nature of what was accessed.

Prosecutors have raised the prospect that foreign actors may have exploited the same system to access Italian state databases. The allegation, if borne out, would concern not opportunistic hacking but further emphasise what's become a prevailing trend of systematic misuse of public infrastructure for private commercial ends with potential national security consequences as a by-product.

This reflects a trend that is becoming visible across multiple jurisdictions: private intelligence operations, often staffed by former state officials with extensive institutional contacts, operating at the boundaries of what is legally permissible and, according to prosecutors and courts in some cases, beyond them.

Moreover, the rise in these matters should be a trigger point warning to governments that their current guardrails and firewalls on sensitive data are proving insufficient, compared to the resources well-endowed corporate boardrooms now have at their disposal, and that should be enough of a flag to warrant systemic security restructuring at the government level.