When the Supply Chain Is the Target
How activist campaigns are mapping and attacking Australia's defence industry — and what intelligence can do about it.
The F-35 Lightning II is the most capable fighter aircraft Australia operates. It is also, deliberately, the product of international collaboration — nineteen nations contributed to its development, fifteen percent of its components are manufactured in the United Kingdom, and its global supply chain passes through ports, airports, and industrial facilities across three continents. That global footprint is a strategic asset. It is also a strategic vulnerability.
In November 2023, Danish activists launched coordinated actions against the Terma Group, a manufacturer of F-35 components. Within months, similar campaigns had spread to the United Kingdom, the United States, Australia, and across Europe. By mid-2024, a clearly organised, internationally coordinated movement was targeting the F-35 supply chain at every node it could identify — ports that handle component shipments, airports that move parts between facilities, manufacturers with contracts in the programme, and the logistics companies that connect them.
This is not a future threat scenario. It is a documented, ongoing campaign that activist organisers have explicitly described as a long-term effort to “chip away” at defence production capacity. And critically — they have done the supply chain mapping. They know which ports handle which components, which shipping companies move parts between manufacturers, which airports process outbound shipments.
Are you watching for this threat with the same systematic attention that the people planning it are applying to you?
The Anatomy of a Supply Chain Attack Campaign
Understanding how these campaigns operate is the foundation of understanding where intelligence can intervene.
Three Phases — All Visible in Open Source
The mapping phase. Before any physical action, activist networks conduct systematic open-source research into the supply chain they intend to disrupt. In mid-2024, at a New York City event titled “Logistics of Empire,” a presenter affiliated with the Palestinian Youth Movement walked attendees through the F-35 supply chain in detail — identifying the specific shipping company responsible for nearly all maritime component movements, the specific ports involved, and the role of each logistics node. This was public, recorded, and circulated. None of it required access to classified information.
The coordination phase. Campaign coordination happens in public. Social media platforms, event pages, published campaign materials, and open coordination forums document the targets, the tactics, the dates, and the participant networks. Campaigns like “Mask Off Maersk” operate with explicitly published objectives and organise actions across multiple countries through publicly accessible channels.
The action phase. Physical actions have included factory blockades, gate-ramming, rooftop protests at manufacturing facilities, port and airport disruptions, and in some cases vandalism and sabotage. In the United Kingdom, Palestine Action conducted a series of escalating actions against F-35 component manufacturers between October 2024 and March 2025, including property damage that disrupted production.
It Has Already Happened in Australia
At Rosebank Engineering in Bayswater, Victoria — an aerospace manufacturer producing F-35 components — activists from the Whistleblowers, Activists and Communities Alliance (WACA) climbed onto the factory roof at 6am and refused to come down for over twelve hours. Eight people were charged with criminal trespass and being disguised with unlawful intent. Victoria Police required a cherry picker to bring them down safely. The group publicly called on workers to refuse to manufacture F-35 parts and demanded the cancellation of all weapons export contracts. The action was coordinated, publicly announced, and preceded by weeks of openly published campaign communications on social media.
The escalation pattern is consistent. Campaigns begin with lawful protest activity and, in some cases, escalate toward direct disruption of physical facilities, production, and logistics. The intelligence to distinguish these trajectories is present in open-source data throughout the process.
The Multi-Node Problem
A conventional security program for a defence industry supplier is designed around a single facility: monitor access, manage the perimeter, respond to incidents. This model is inadequate for supply chain attack threats for a specific reason: the attackers are not targeting a single facility. They are targeting the network.
The F-35 supply chain in Australia involves multiple entities — tier one suppliers with direct programme contracts, tier two suppliers providing components and materials, and logistics providers that move parts through ports, airports, and freight corridors. A campaign that has mapped this network can apply pressure at whichever nodes are currently most vulnerable, and can coordinate simultaneous actions across multiple sites to overwhelm security responses sized for single-site incidents.
This tactic is explicitly described in activist campaign communications. One organiser — speaking publicly at a national DSA meeting — explained that the goal was to “identify local targets, whether that's a port, whether that's an airport, and then organise workers around those targets,” seeding simultaneous campaigns through local and national trainings across the country.
CRIMP's monitoring does not operate site by site. When the same campaign network is discussing multiple Australian programme participants, ports, and logistics nodes simultaneously, that pattern is visible as a whole — not fragmented across separate security teams each looking at their own piece.
What CRIMP Can See
The systematic research and coordination that precede supply chain attacks leaves a rich trail in publicly accessible data. CRIMP monitors the online environments where this coordination occurs — social media platforms, campaign pages, political forums, public event records — against watchlists of your programme, your facilities, and the entities in your supply chain.
This includes early-stage signals: a campaign account beginning to post about a specific manufacturer. Mid-stage signals: logistics research appearing in activist forums referencing your ports or shipping routes. Late-stage signals: participant mobilisation and action coordination naming specific facilities and dates. Link analysis maps the connections between accounts, organisations, and their targets — so when the same activist network that previously targeted facilities in the UK and US begins researching Australian programme participants, that connection is visible as part of a mapped campaign network with a documented history of escalation.
Geospatial Signals Confirm What OSINT Predicts
Physical supply chain attacks require physical presence at the target facility. Activists staging factory blockades, gate approaches, or rooftop actions need to pre-position near the facility and scout access points in advance. CRIMP monitors geospatial signals entering and exiting the boundaries of your defined asset areas. When unknown devices begin appearing at the boundary of a supplier facility in the days before a publicly announced campaign action, that signal — correlated with the online intelligence picture — confirms that an operation is moving from planning to execution.
The Intelligence Advantage
The organisations behind these campaigns openly acknowledge that their advantage lies in information. They have mapped the supply chain. They have identified the logistics nodes. They have built networks capable of simultaneous coordinated action across multiple jurisdictions. The information asymmetry they have established is the foundation of their operational effectiveness.
CRIMP addresses that asymmetry directly. An operator who can see the campaign planning, the target selection, the coordination, and the physical approach signals in real time has eliminated the information advantage that makes these campaigns effective. That visibility cannot be achieved through a conventional security posture oriented around perimeter response. It requires intelligence — continuous monitoring of the online environments where these threats are planned, correlated with the physical signals that confirm an operation is underway.
Working with Programme Security and Law Enforcement
Supply chain attacks targeting a sovereign defence programme are not ordinary security incidents. They involve entities and tactics that intersect with national security interests, and the response framework requires coordination with relevant programme security authorities.
When a credible threat to a programme participant is identified, CRIMP's reporting workflow produces a structured briefing ready for the relevant state or federal law enforcement agency. That briefing documents the campaign network, the specific threat signals, the timeline, and the link analysis connecting actors across multiple jurisdictions. A phone call reporting suspicious activity the morning of an incident is not an intelligence product. A structured briefing delivered days before the action date is. That difference determines whether law enforcement can mount a prepared response or a reactive one.
SOCI Act Obligations
Defence industry entities that are responsible entities under the SOCI Act carry Critical Infrastructure Risk Management Program (CIRMP) obligations across physical security, personnel security, supply chain, and cyber hazard domains. Coordinated campaigns targeting the physical integrity of supplier operations and logistics nodes fall squarely within the physical hazard domain. The threat to Australia's defence supply chain is not merely foreseeable — it is documented, ongoing, and publicly described by its organisers in terms that make clear they intend to continue and escalate. CRIMP's OSINT and geospatial monitoring provides both the capability and the documentation that a compliant, defensible CIRMP requires.
What CRIMP Monitors
Geospatial Boundary Signals
Device and vehicle presence at supplier facilities, ports, and logistics nodes — confirming when campaign planning is transitioning to physical execution.
Online Behaviour
Campaign coordination, supply chain mapping research, participant mobilisation, and target identification — monitored across social media, forums, and public event platforms from the earliest planning stage.
Dark Web Monitoring
Programme-related information and operational data appearing in closed environments — an additional layer for higher-risk scenarios where threat actors move beyond public coordination.
See CRIMP Protecting Defence Supply Chains
Request a demo to see how CRIMP monitors the threat environment across your programme's supply chain — from early campaign signals through to physical approach confirmation.