A quotation printed for a meeting, a diary left at reception, an envelope bearing a client's name. Taken separately, these may seem like minor details. Together, they can reveal contacts, routines and negotiations. For business leaders, protecting information also means following the path of paper documents and deciding what may be disclosed to people making enquiries from outside.
On 30 October 2026, Quotidiano Nazionale published an account of the Milan investigation into alleged surveillance and intimidation of Chinese dissidents in Italy. The episodes described include searching for information in rubbish and asking people present in buildings. The newspaper dates one such episode in Turin to 28 October 2024: the article's publication date is therefore different from the date of the events. According to the same source, the notice concluding the investigation was signed on 23 October 2026. [1]
On 28 October, ANSA had reported the conclusion of investigations into ten people, with allegations concerning stalking and, for four suspects, criminal association. These are allegations to be examined in the proceedings, not established findings of responsibility. The case concerns people targeted for their political activity: it does not document the theft of industrial secrets. It nevertheless provides a concrete reason to consider information that can be accessed without entering a computer system. [2]
Follow a document until it leaves the premises
A useful check can start with an ordinary but confidential document: a commercial proposal, a customer list or a draft contract. Who prints it? Where are spare copies left? Who empties the bins? Where is paper kept before collection? The least visible stage is often the interval between deciding to discard a sheet and its actual destruction.
The UK Information Commissioner's Office guidance on records management recommends locked containers for paper containing personal data, secure storage of material awaiting destruction and verifiable assurances when an external provider is involved. This is a British operational reference, not an Italian requirement to apply automatically. The useful principle is to check the entire path, including collection and the wait for removal. [3]
Before disposing of documents, businesses must still check whether they may be destroyed: retention periods, contractual needs and litigation may require them to be kept. A security procedure should not become indiscriminate deletion of the archive. Decisions should be shared with those responsible for company records and obligations.
A polite answer can reveal too much
The same care is needed with seemingly harmless requests: whether an executive is present, who manages a client, when the courier arrives or which room will host a meeting. Not every unusual question is a hostile attempt. To avoid improvised decisions, reception staff and external personnel should know which information they may provide and where to refer other enquiries.
A simple rule is to take the caller's contact details and arrange a return call from the appropriate department, without immediately confirming confidential details. If someone claims to work for a partner, verification can take place through an established contact. These are organisational measures proposed by the article, not company practices described in the investigation.
Cleaning, maintenance and waste disposal also deserve attention because of the areas and materials they provide access to. The criterion concerns the assignment and actual authorisations, without treating external personnel as a suspect category. It is useful to check who authorises entry, where documents are left and to whom an unusual request should be reported.
If an anomaly emerges, reconstruct the facts before drawing conclusions
An open container or a persistent question does not, by itself, demonstrate information theft. Record what was observed, when and by whom, separating observations from interpretations. Preserving available evidence and involving the responsible manager allows the episode to be assessed without circulating accusations or launching improvised checks on individuals.
The first practical decision can be narrowly focused: assign someone to check the path of confidential documents, from printing to collection, and correct any stages left without secure custody or instructions. The intended outcome is to know who is responsible at each stage and which anomalies require further enquiry.
GRISK can support investigative enquiries into possible theft of business information and unfair competition, based on the available evidence and the mandate received.
Sources and editorial note
The conclusion of the investigation was reported on 28 October; the recent starting point is QN's detailed report of 30 October. The investigative facts are drawn from journalistic sources: the original procedural document was not obtained. ANSA corroborates the core case, but does not independently verify the rubbish-search episode. The business guidance represents the article's operational assessments; the ICO guidance is a British methodological reference. No connection is asserted between the suspects and any business-related case.
- Alessandro Da Rold e Francesco Floris, Quotidiano Nazionale, «“Ti taglierò la testa”. La rete cinese che spia i dissidenti in Italia rovistando nei rifiuti: la vittima zero è l’influencer anti-Pechino», 30 ottobre 2026.
https://www.quotidiano.net/cronaca/rete-cinese-spionaggio-dissidenti-in-italia-rovistando-nei-rifiuti-la-vittima-zero-e-influencer-anti-pechino-cb1lcy0r - ANSA, «‘Spionaggio e repressione sui dissidenti cinesi a Milano’, 10 indagati», 28 ottobre 2026, 12:17.
https://www.ansa.it/lombardia/notizie/2026/10/28/spionaggio-e-repressione-sui-dissidenti-cinesi-a-milano-10-indagati_ad9e52f9-270d-4086-aa4b-d2959f01d5c4.html - Information Commissioner’s Office, «Records management and security», data non indicata; consultato il 31 ottobre 2026. Fonte primaria metodologica britannica.
https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/records-management-and-security/