Italy probes stolen NATO project files

A secure vault can fail without a broken door. One credential, one copied file, one trusted person can be enough. Italy’s probe into alleged stolen identities, sensitive files and NATO-project material offered for sale matters because Europe is speeding up joint defence work while many of the files still sit in national ministries and contractor systems.

The public record does not show a NATO breach. n-tv’s account describes an arrested former Italian intelligence figure and alleged unauthorised access to military-linked secret information. That supports a narrower finding: shared defence projects depend on how well each country and each cleared company guards the paperwork.

Where The Files Actually Sit

The phrase “NATO project material” sounds conclusive, but it is not. It could mean NATO-classified information, Italian classified material tied to an alliance programme, company files with procurement value, or documents that merely mention NATO. Those are different problems, with different legal damage.

That is the custody chain: who held the file, who could open it, who moved it, and who noticed. Italian prosecutors decide what they can charge. National security officials check whether clearances or handling rules failed. Defence firms must show whether access to sensitive material was controlled. If NATO-originated information was involved, NATO’s security rules rely on allies to protect it through their own national systems.

That design makes sense for sovereign governments. It also creates weak points. A Brussels rule does not check an access log in Rome. A procurement clause does not stop a trusted insider from copying a file. The EU’s defence procurement directive lets buyers demand safeguards for sensitive defence contracts, but the real test sits with ministries, contractors and subcontractors.

Faster Buying, Same Security Gaps

The EU is adding volume to this system. The Commission’s defence agenda pushes more industrial capacity and joint purchasing. The EDIRPA regulation and the EDIP proposal move in the same direction: more cross-border defence buying and production.

They do not create a central EU counterintelligence service. That matters because speed increases exposure. More joint projects mean more people with access, more firms handling sensitive requirements, and more partners depending on each other’s security habits.

The cost of failure is not abstract. Contractors can lose access to programmes. Governments can face delays while investigators check what was exposed. Partners may become more cautious about sharing technical requirements, personnel details or supplier information. In a defence market built on trust, a leak can slow work even before anyone proves operational harm.

The Rheinmetall-Leonardo venture shows the kind of industrial exposure at stake, without proving any link to the Italian case. Rheinmetall and Leonardo describe their combat-vehicle cooperation as a European industrial project. If protected Italian material revealed suppliers, requirements or interoperability assumptions, partners would have reason to worry. The public evidence does not show that happened.

Germany’s current threat picture explains why this will be read beyond Italy. Officials there already treat Russian espionage and data theft as a risk to strategic sectors. NRW interior minister Herbert Reul warned in Zeit about energy, defence and logistics, while the Kölner Stadt-Anzeiger reported concerns around defence firms, transport routes and executives. That context makes the Italian file legible to Berlin, even if it does not show German firms were hit.

Belgium matters only as the alliance setting, not as an investigator. NATO’s archives place the headquarters in Brussels, and Belgium’s National Security Authority handles classified-information and clearance functions in its own system, according to the foreign ministry. If alliance information escaped, the key European question is how quickly partners were told.

The case has not proved a NATO compromise. It has shown that Europe’s defence build-up depends on custody systems that remain national, uneven and partly invisible. Italian authorities owe the clearest lawful account of what the files were and where they went. NATO and partner governments owe assurance that they checked the damage if protected alliance information was involved.