The masterminds behind covert supply chain operations aim to hide their activities from government agencies and society at large, often for illegal gains or to intentionally cause harm. This conceptual article outlines a research agenda for future studies by framing covert supply chain activities and the countermeasures used to disrupt them.
Secondary data were collected from various news sources (observation) and analyzed to understand the nature of covert supply chain operations and efforts to identify and disrupt them (conceptualization).
To date, covert supply chain operations and counter-operations categories have been scarcely scrutinized in the supply chain literature, and our framework presents many fruitful avenues for further research.
Policymakers may aim to enhance the visibility of covert supply chains to achieve strategic objectives. Our framework enables logistics providers, network orchestrators, and shippers to identify vulnerabilities and detect covert infiltration by hostile actors within customer supply networks.
The mainstream supply chain literature has viewed supply chains of illegal goods and disruptive counter-operations as piecemeal. This conceptual article addresses the topic holistically to create a framework for guiding future research.
1. Introduction
In September 2024, a coordinated explosion of pagers and walkie-talkies in Beirut, Lebanon, sent hundreds of Hezbollah members, a militant group, to the hospital for emergency treatment and killed at least 12 people, including non-combatants (BBC, 2024a; FT, 2024). Soon after, Israeli Prime Minister Netanyahu took credit, announcing that he had launched the pager operation despite contrary advice from his country's security establishment (CNN, 2024). Later, on the US TV program 60 Minutes, masked men claiming to be Mossad agents described using a covert supply chain and shell companies, including the Hungary-based BAC, to trick Taiwan-based Gold-Apollo into allowing them to use their brand for over ten years to sell pagers and walkie-talkies to Hezbollah with explosive material under the control of Israeli forces (CBS News, 2024).
The seriousness and covert nature of these actions have caught the attention of the supply chain community, especially regarding the safety of consumer-facing supply chains. While the supply chain risk management (SCRM) literature mainly focuses on natural disasters (Tang, 2006; Sodhi, 2016), financial crises (Blome and Schoenherr, 2011), or geopolitical tensions (Roscoe et al., 2022; Duong et al., 2025), limited focus has been given to covert activities by actors aiming to disrupt supply chains. The supply chain literature discusses covert operations in a fragmented manner across issues like counterfeiting (Stevenson and Busby, 2015), cybercrime (Melnyk et al., 2022), industrial espionage (Carnovale et al., 2022), drug smuggling (Basu, 2013; Skilton and Bernardes, 2022), or wildlife trafficking (Duensing et al., 2023). Media reports highlight that both government and non-government actors conduct covert supply chain operations to cause disruptions, generate illicit profits, or inflict harm. Criminal organizations may operate their own supply chains for illegal drugs or arms trafficking. Alternatively, criminals might infiltrate legally established supply chains to smuggle contraband, conduct surveillance, or engage in cybercrime, often without the knowledge of legitimate supply chain operators. Law enforcement agencies have multiple teams dedicated to detecting and stopping such covert activities by disassembling them and disrupting the flow of materials, products, information, and capital.
Current research on covert supply chain activities—whether legally sanctioned or not—is scattered across various fields and lacks a solid foundation for further study despite its increasing importance. Therefore, this paper aims to develop a comprehensive understanding, vocabulary, and framework for these activities, providing supply chain scholars with a strong basis for their research. As a result, we pose the following question: How can we frame covert supply chain operations?
We gathered, examined, and cross-checked secondary information on events related to covert supply chain operations from various news outlets, including the BBC, New York Times, Financial Times, CNN, and The Economist. We used the first two stages of the four-stage research process, namely, observation and conceptualization, to create a framework that helps us classify observed events (Sodhi and Tang, 2014). Observing events associated with covert supply-chain phenomena is suitable for this emerging research area, as it prompts questions about “what,” “how,” or “why” certain events happen.
In doing so, we contribute to the existing OSCM literature by framing covert supply chain operations and efforts to disrupt them. We also highlight key areas for future research concerning covert supply chain activities and the countermeasures used to disrupt or prevent them.
2. Literature review and conceptual background
Supply chain management (SCM) coordinates material, information, and financial flows through partnerships between organizations, using vertical integration and contractual obligations to manage these flows (Ellram, 1991). An implicit assumption in much of the literature is that a supply chain operates within the legal boundaries, rules, and regulations of all the countries where it functions. However, not all supply chains involve legally sanctioned products or activities. Additionally, not all supply chain activities may be transparent to stakeholders from start to finish (Meehan and Pinnington, 2021), which can enable illegal activities.
Managers seek supply chain visibility to understand the status of upstream operations within their supply chains (Sodhi and Tang, 2019). Modern global supply chains are complex due to the presence of many suppliers worldwide at the first tier or even further upstream, with many involved in subcontracting (Marques et al., 2024a; Meehan and Pinnington, 2021). This complexity, along with supplier reluctance to share information about sub-tier suppliers, creates a barrier for managers trying to gain better supply chain visibility (Sodhi and Tang, 2019). Additionally, companies often hide how they handle illegal activities in their corporate reports (Davenport and Leitch, 2005). For example, many companies do not report cyber-hacking incidents and instead pay ransom to criminals (Handfield et al., 2025). The lack of standardization in reporting, regulations, and implementation further obstructs visibility for downstream buyers and decreases overall supply chain transparency for other stakeholders (Marshall et al., 2016).
Suppliers and focal companies can also disengage — in this sense, “decouple” — from the supply chain, which can disrupt information flow and create conditions and incentives for illicit activities within the supply chain. Under ongoing price pressure from buyers and fluctuating demand, suppliers may claim to have limited control when responding to requests for information about non-compliant or illegal activities (Nath et al., 2020). A focal company may appear to comply with regulations (Marques et al., 2024b) but shift responsibility to suppliers in the event of negative reports, thereby splitting claims in corporate compliance reports from actual operational practices (Meehan and Pinnington, 2021; Marques et al., 2024b). They might also avoid adopting technologies like blockchain, which provide visibility, to maintain deniability about possible illegal upstream activities in the supply chain (Marshall et al., 2016). The consequent limited visibility in the supply chain for downstream buyers and stakeholders creates opportunities for covert activities to occur within legal supply chains.
2.1 Overt and covert supply chain operations
While any supply chain crossing multiple borders is subject to legal obligations from different national laws and enforcement levels, our focus here is on supply chains that attempt to bypass these obligations. A “legitimate supply chain” is designed to produce and deliver products and services from source to end user, with all businesses involved registered with and reporting to their respective regulatory agencies (Mueller et al., 2009). In contrast, an “illegitimate supply chain,” such as one for illegal drugs like fentanyl, operates secretly to avoid detection by legal authorities and law enforcement (Basu, 2014). Although legality and legitimacy are not the same, we are using the terms interchangeably here.
Scholars from different fields have examined legitimate and illegitimate supply chain interference in some depth. These studies include the covert movement of illicit or illegitimate items within legitimate supply chains, and the disruption of supply chain flows to prevent criminal activities or harm (e.g. Basu, 2013; D'Amato and Papadimitriou, 2013; D'Amato et al., 2019; Duensing et al., 2023; Pullman et al., 2024; Sánchez-Pérez et al., 2023; El Baz et al., 2025).
Zsidisin (2024) cautions against using terminology such as “legitimate” or “illegitimate” supply chains, as legitimacy depends on social norms and the perspective from which it is viewed. He gives the example of the Underground Railway (e.g. Still, 2019), which helped enslaved people of African origin escape from the Confederacy. While it was considered an illegitimate supply chain by the Confederate government, it was viewed as legitimate by the governments of the Northern states to which they were escaping. Also, institutional logics and social norms change over time or differ across regions, even within the same country, as with the sale of marijuana in the US.
Because of these discrepancies, we categorize operations in supply chains as either overt or covert. We characterize these operations in a supply chain as “overt” if they comply with the legal frameworks, rules, and regulations of each country where the supply chain operates; therefore, there is no need to hide these operations, at least not from legal authorities. Overt supply chains are likely to seek legal protection from government authorities to counter external threats such as cybercrime, counterfeiting, or industrial espionage.
Conversely, operations in a supply chain are considered “covert” if they are deliberately hidden or disguised from government authorities, legitimate organizations within the supply chain, and the general public (Zsidisin, 2024). Such operations can expect to face prosecution by legal authorities unless the authorities themselves are involved in these covert activities. An entire supply chain may be deemed covert if all its operations from source to sale are hidden. However, covert operations can also occur in overt supply chains when there is insufficient visibility for the focal company throughout the supply chain.
We also define counter-operations as actions or strategies used to partially or fully disrupt supply chain operations, whether covert or overt. The same descriptors, overt and covert, characterize counter-operations, which help us frame real-life supply chain operations and counter-operations within a 2 × 2 overt-covert framework, as discussed in Section 3. Counter-operations can vary in intensity and duration, such as occasionally intercepting drug shipments. Law enforcement authorities might choose to end or permit the operations of a covert supply chain involved in illegal narcotics using their own overt or covert operations.
2.2 Covert operations in covert and overt supply chains: infiltration
One way to keep covert operations hidden is by piggybacking on overt supply chains. For instance, the supply chain for fentanyl involves secret activities to produce and distribute the drug using visible supply routes. The precursor chemicals for fentanyl are usually manufactured in unmarked factories in China and India (DEA.gov, 2020). These chemicals are then shipped to Mexico, disguised as dog food or motor oil, to avoid detection (DEA.gov, 2020; FT, 2024). Drug cartels operate hidden labs across Mexico to produce the final product, which they pack alongside pharmaceutical goods or deceptively label as legitimate medicine. This covert method allows cartels to utilize legitimate pharmaceutical supply chains to ship to the US, thus avoiding detection by border patrol, customs agents, and end users (FT, 2023).
Wildlife trafficking operates in a similar way. Animals are illegally poached, and their bodies or parts are secretly transported through legal supply chains, mostly using maritime container shipping (South and Wyatt, 2011; TRAFFIC, 2020). An example is traffickers moving elephant tusks, pangolin scales, and animal skulls along with cut timber in containers. Malaysian officials intercepted one such shipment containing illegal items worth over US$18 million (The Independent, 2022). Wildlife poaching at the beginning of these hidden supply chains often occurs in areas with weak government oversight or poor legal enforcement (Duensing et al., 2023).
The term “supply chain infiltration” refers to piggybacking on shipments that move through visible supply chains. D'Amato and Papadimitriou (2013: p. 998) define supply chain infiltration as covert actions involving an “unauthorized actor inserting (illegal) products or engaging (illegal) operations into a legitimate supply chain.” Infiltration occurs when actors within the supply chain have inadequate accountability or when government oversight is limited. Such actors have little incentive before the fact and face no accountability afterward to proactively stop illegal activities, despite eventually being impacted as stakeholders (Duensing et al., 2023). The reputational risk for cargo shipping companies, terminal operators, and logistics providers is minimal when it comes to detecting wildlife trafficking (Duensing et al., 2023). In reality, criminals operating covertly and their enablers within infiltrated supply chains share the motive of ensuring quick and uninterrupted transfer of trafficked animals or their parts for economic reasons (Duensing et al., 2023).
Counterfeiting is another method used by covert actors, driven by financial motives, to exploit supply chains and smuggle illegal goods. It involves trademark infringement and passing off a product as someone else's (Stevenson and Busby, 2015, p. 112). Covert actors produce counterfeit pharmaceutical products that imitate the original manufacturer's trademarks, often using the same contract manufacturers and transportation networks as major pharmaceutical companies (Trott and Hoecht, 2007). Luxury goods, including high-end handbags and clothing, are especially vulnerable to counterfeiting because these items are sometimes produced in the same factories as genuine designer products and travel through the same supply chains, but are ultimately sold at discounted prices (Wang et al., 2020).
While our conceptual article mainly focuses on physical products, supply chain infiltration can also occur in the digital realm through cybersecurity breaches or industrial espionage. In 2020, covert actors hacked into SolarWinds, a major American information technology (IT) company, embedding malicious code (malware) into the company's software system. This code created a backdoor to customer IT systems, which hackers then accessed to install more malware (Melnyk et al., 2022). State-sponsored cyberattacks have also been conducted to steal military secrets or gather sensitive information. In 2024, Chinese government agents reportedly sponsored a cyber actor, known as Volt Typhoon, to breach US government IT systems and compromise multiple critical infrastructure sectors in cyberspace, including communications, energy, transportation, and water (CISA.gov, 2024). Cyber-hijacking is also increasing, with notable incidents including a cyberattack on the shipping company Maersk in 2017, which disrupted shipments, and a fake broker scam in the US in 2020 (Sharp Blue, 2025).
Also in the digital world, companies engage in industrial espionage by exploiting vulnerabilities in a competitor's supply chain to steal intellectual property (IP) and proprietary knowledge (Carnovale et al., 2022). In 2021, Fiat Chrysler accused General Motors of corporate espionage, alleging that GM agents impersonated former Fiat Chrysler employees in emails to gather information about a bribery scandal (Reuters.com, 2022).
There are some empirical studies on supply chain infiltration, but they are rare due to the secretive nature of these activities and the reluctance of perpetrators to self-incriminate (Naylor, 2004). Duensing et al. (2023) present a notable exception with interviews involving government officials, NGOs, and shipping companies that unintentionally took part in wildlife trafficking. They introduce the concept of “societal supply chain risk,” defined as “hazards that originate from or occur within supply chains, and which mainly affect actors in the supply chain—and possibly even humanity as a whole” (p. 23). A study by Keskin et al. (2023) on wildlife trafficking highlights the difficulties in collecting primary data on illegal supply chains due to the fragmented efforts among government agencies and NGOs worldwide. They point out that most data come solely from successful seizures by enforcement agencies, which can lead to biased conclusions. Gathering primary data can be difficult when no detections or seizures occur (Keskin et al., 2023). Consequently, most research relies on secondary data to develop conceptual models (e.g. Basu, 2014) and classify activities (e.g. D'Amato and Papadimitriou, 2013). Therefore, literature reviews on the topic do not provide empirical insights into the infiltration of these networks (e.g. Anzoom et al., 2021).
While useful as a starting point, D'Amato and Papadimitriou's (2013) definition of supply chain infiltration is too narrow in our view because it focuses only on covert products or persons operating within overt supply chains. They do not consider counter-operations where covert actors operate unseen within covert supply chains, gathering intelligence to disrupt the operation later. For example, law enforcement agencies insert their covert agents or coerce embedded informers into covert drug smuggling or human trafficking rings to collect intelligence for future disruption. Similarly, secret services like the US Central Intelligence Agency (CIA) and the UK Secret Intelligence Service (MI6) covertly use information systems and satellite imagery to digitally infiltrate the overt supply chains of other countries (Smith, 2022), thereby gathering information about both covert and overt supply chains.
It is therefore essential to consider covert actors who infiltrate: (1) overt supply chain operations to secretly move people, products, or capital; and (2) covert or overt supply chains to gather information, possibly for future disruption. In both cases, the actors' aim is to stay hidden and ensure supply chain continuity, at least in the short or medium term. We can now present a more comprehensive definition.
Supply chain infiltration by covert actors is the insertion of products and actors into a supply chain, whether covert or overt, without the knowledge of its operators. These actors maintain the continuity of the infiltrated supply chain while using it to move their illicit products or collect information without authorization.
While infiltration maintains the continuity of the target supply chain, in the short or medium term, the ultimate aim may be to disrupt the infiltrated supply chain or cause harm to other stakeholders.
2.3 Counter-operations to disrupting covert or overt supply chains: interdiction
The goal for supply chain managers is to maintain supply chain continuity, defined as “the minimization of disruption to the supply of products, services, and information” (Autry and Bobbitt, 2008: p. 57). However, other actors may seek to disrupt this continuity. An example is when explosive devices were hidden inside massage units and shipped internationally via DHL, a third-party logistics provider (WSJ, 2024). Two of these devices detonated during transit at DHL distribution hubs in Germany and the United Kingdom (UK) (WSJ, 2024). Western security officials claimed that these devices were part of a covert Russian government operation intended to disrupt, or at least threaten, transportation routes across the Atlantic, particularly given the ease with which these devices were discovered (WSJ, 2024).
There have also been accusations that certain governments were involved in the explosion of the Russian Nord Stream 1 and 2 gas pipelines supplying Europe (The Atlantic, 2023), following US President Biden's threat to “bring an end” to the second pipeline (NBC, 2022) and Germany's subsequent indictment of some Ukrainian nationals as a minor individual matter (BBC, 2024b). The disruption negatively impacted not only Russian exports but also European imports, leading to higher energy prices in the UK and the European Union (EU) (New York Times, 2022). Russia's share of pipeline gas dropped from over 40%–8%, while the US tripled its gas exports to Europe. As a result, the US became the continent's largest supplier of liquefied natural gas, fulfilling President Biden's goal to reduce European imports of Russian energy (European Council, 2024), albeit at a significantly higher cost for European consumers and industry.
Samsung Electronics provides an example of efforts to prevent the supply chain from being disrupted by competitors. The firm mitigates competitor risk by acquiring a significant stake in sole supplier companies, thereby securing a seat on their boards of directors. This prevents Apple or other competitors from gaining control of the supplier, which could disrupt Samsung's supply chain (Sodhi and Lee, 2007). The Biden (and later, Trump) administration's effort to “impede China's ability” to produce advanced chips and “ability to develop large language models” is another example of interdiction (FT, 2025). Related measures blocked Chinese companies, especially Huawei, from purchasing the latest chip-making equipment from the Dutch firm ASML or advanced chips from Nvidia. However, Nvidia sales restrictions were later eased after China threatened retaliation by withholding supplies of rare earth magnets (Reuters, 2025).
Military analysts use the term “interdiction” to describe delaying, disrupting, or destroying supply lines (Bingham, 1996), as a long-term warfare strategy (Chen and Evers, 2023). In this context, management scholars define supply chain interdiction as “a strategy where an organization competes by taking supply-side actions to prevent rivals from acquiring, moving, or converting critical resources to gain a market advantage” (Bell et al., 2015: p. 90).
This definition of supply chain interdiction as a preemptive strategy carried out by one organization against another to achieve a competitive edge is too narrow in two ways. First, it does not account for counter-operations aimed at disrupting covert or overt supply chains. Government agents may infiltrate a covert supply chain, maintain supply chain continuity for some time, and then interdict the movement of narcotics across international borders. We refer to this action as “infiltrate to interdict”. Government agencies may also employ surveillance techniques and informants to detect illegal activities and then interdict the offending supply chain by arresting key actors or seizing contraband—an action we term “detect to interdict”.
Second, a revised definition of supply chain interdiction should include both supply- and demand-side disruptions. Examples of supply-side interdiction include arrests of key individuals or seizures of illegal narcotics aimed at disrupting covert drug supply chains. Demand-side interdiction includes government agencies implementing public policy measures, such as awareness campaigns warning users that street drugs may be laced with fentanyl to reduce consumption (Tang and Choi, 2024). In July 2024, the White House issued a memorandum prioritizing the strategic disruption of fentanyl and synthetic opioid supply chains through a coordinated approach (Whitehouse.gov, 2024). We therefore suggest a more comprehensive definition of supply chain interdiction:
Supply chain interdiction is the intentional disruption, either covert or overt, of the movement of materials, products, information, people, or capital by targeting up- or downstream supply chain operations and/or personnel within a supply chain.
This definition includes actions by covert or overt actors, whether private groups or government agencies, aimed at disrupting either upstream or downstream operations of the supply chains of target companies, industries, or countries.
3. Observation and conceptualization
As a first step, we aimed to classify ten examples reported in the mainstream US and UK media (Table 1), some of which we have already discussed in earlier sections. For each example, we identified the operators and counter-operators. Based on the literature and our extended definitions, we also considered whether infiltration or interdiction was used by either party. Finally, we examined the nature of operations and counter-operations—whether covert or overt—drawing on the literature and the conceptual background from the previous section (Table 1).
Examples of observations classified with our framework of operations and counter-operations
| # | Observation/Year | Supply chain operators | Counter-operators | Counter-operation | Direct target//others affected indirectly | Nature of supply chain operations | Nature of counter-operations |
|---|---|---|---|---|---|---|---|
| 1 | US sanctions on Chinese companies from accessing equipment to produce semi-conductors, 2022 | Chinese electronic chip manufacturers | US government | Interdiction | Chinese chip manufacturing//US and other consumers worldwide | Overt | Overt |
| 2 | US sanctions of Russian petroleum exports and trade in general, 2023 (ongoing) | Russian exporters of oil | US government | Interdiction | Russian government//Russian exporters of grain and fertilizer, negatively affecting developing countries in Asia and Africa | Overt | Overt |
| 3 | US DEA seizure of fentanyl being brought into the US, every year | Private operators in many countries (China, India, Mexico) | US Drug Enforcement Agency (DEA) | Detect to interdict, and Infiltrate to interdict | Private operators//beneficial for preventing fentanyl-related deaths in the US | Covert | Overt Covert |
| 4 | Exploding pagers and walkie-talkies in Lebanon, 2024 | Israeli secret service agents | Israeli secret service agents | Infiltrate to interdict | Hezbollah fighters//Hezbollah social service workers for infrastructure, health-care facilities, schools, and youth programs | Covert | Covert |
| 5 | ANOM network for “secure” communication, 2018–2021 | US FBI and the Australian Federal Police (AFP) | US FBI and the Australian Federal Police (AFP) | Infiltrate to Interdict | Criminal drug-running networks | Covert | Covert |
| 6 | Blowing up Russian gas pipelines to Europe, 2022 | Gazprom (Russian state) | Ukraine, possibly US | Interdiction | Russian economy//UK and EU consumers affected by increased prices; massive impact on the environment | Overt | Covert |
| 7 | Ransom cyber-attack on Colonial Pipeline-US, 2021 | Colonial pipeline | Russia-based hacker group, DarkSide | Interdiction | Pipeline users//US consumers and downstream companies | Overt | Covert |
| 8 | Planting incendiary devices in massage units at DHL centers, 2024 | DHL | Russian operatives suspected | Interdiction | US//could cause devastation if successful on a commercial flight | Overt | Covert |
| 9 | Blowing up of Iranian centrifuges using a computer virus, 2010–2011 | Iranian government | US and Israel joint operations | Interdiction | Iranian nuclear development//other countries using the targeted Siemens equipment (India, Mexico, others) | Overt | Covert |
| 10 | Severing internet cables in the Baltic Sea, 2024 | Private companies operating these cables | Chinese or Russian ships suspected of anchor-dragging | Interdiction | Telecom users in Europe, particularly in Finland and Germany | Overt | Covert |
Synthesizing these examples, we classified each into a 2 × 2 framework to categorize the nature of the supply chain operations and the counter-operations. The framework shows that counter-operations are conducted by covert or overt actors, ultimately aiming to disrupt material, products, services, or financial flows within overt or covert supply chains. Counter-operations include actions taken in response to or in opposition to supply chain activities. The intensity and duration of these counter-operations depend significantly on the intent and the strategy adopted (Figure 1).
The horizontal axis is labeled “Supply Chain Operations” and the vertical axis is labeled “Counter-Operations”. The horizontal axis has two markings: “Overt” on the left and “Covert” on the right. The vertical axis has two markings: “Overt” on the bottom and “Covert” on the top. From the midpoint of the horizontal axis, a vertical line is drawn that extends to the top of the vertical axis. From the midpoint of the vertical axis, a horizontal line is drawn that extends to the end of the horizontal axis. The lines intersect at their respective midpoints, dividing the graph area into four quadrants. Each quadrant has a title and a list of points. The details for each quadrant are as follows: The first quadrant at the bottom left (Overt, Overt) is titled “Roman numeral one Interdict”, with the following points listed: “1. U S sanctions on Chinese companies from accessing equipment to produce semi-conductors, 2022”, and “2. U S sanctions of Russian petroleum exports and trade, 2023 (ongoing)”. The second quadrant at the top left (Overt, Covert) is titled “Roman numeral four Interdict”, with the following points listed: “6. Blowing up Russian gas pipelines to Europe, 2022”, “7. Ransom cyber-attack on Colonial Pipeline-US, 2021”, “8. Planting incendiary devices in massage units at DHL centers, 2024”, “9. Blowing up of Iranian centrifuges using a computer virus, 2010-2011”, and “10. Severing internet cables in the Baltic Sea, 2024”. The third quadrant at the top right (Covert, Covert) is titled “Roman numeral three Infiltrate to Interdict”, with the following points listed: “3. U S D E A seizures of fentanyl being brought into the U S, every year”, “4. Exploding pagers and walkie-talkies in Lebanon, 2024”, and “5. ANOM network for ‘secure’ communication, 2018-2021”. The fourth quadrant at the bottom right (Covert, Overt) is titled “Roman numeral two Detect to Interdict”, with the following points listed: “3. U S D E A seizure of fentanyl being brought into the U S”.A framework for understanding the type of counter-operations for disruption based on the nature of the supply chain operations and the counter-operations. Infiltration and interdiction can also be cyber-operations. Source: Authors’ own creation
The horizontal axis is labeled “Supply Chain Operations” and the vertical axis is labeled “Counter-Operations”. The horizontal axis has two markings: “Overt” on the left and “Covert” on the right. The vertical axis has two markings: “Overt” on the bottom and “Covert” on the top. From the midpoint of the horizontal axis, a vertical line is drawn that extends to the top of the vertical axis. From the midpoint of the vertical axis, a horizontal line is drawn that extends to the end of the horizontal axis. The lines intersect at their respective midpoints, dividing the graph area into four quadrants. Each quadrant has a title and a list of points. The details for each quadrant are as follows: The first quadrant at the bottom left (Overt, Overt) is titled “Roman numeral one Interdict”, with the following points listed: “1. U S sanctions on Chinese companies from accessing equipment to produce semi-conductors, 2022”, and “2. U S sanctions of Russian petroleum exports and trade, 2023 (ongoing)”. The second quadrant at the top left (Overt, Covert) is titled “Roman numeral four Interdict”, with the following points listed: “6. Blowing up Russian gas pipelines to Europe, 2022”, “7. Ransom cyber-attack on Colonial Pipeline-US, 2021”, “8. Planting incendiary devices in massage units at DHL centers, 2024”, “9. Blowing up of Iranian centrifuges using a computer virus, 2010-2011”, and “10. Severing internet cables in the Baltic Sea, 2024”. The third quadrant at the top right (Covert, Covert) is titled “Roman numeral three Infiltrate to Interdict”, with the following points listed: “3. U S D E A seizures of fentanyl being brought into the U S, every year”, “4. Exploding pagers and walkie-talkies in Lebanon, 2024”, and “5. ANOM network for ‘secure’ communication, 2018-2021”. The fourth quadrant at the bottom right (Covert, Overt) is titled “Roman numeral two Detect to Interdict”, with the following points listed: “3. U S D E A seizure of fentanyl being brought into the U S”.A framework for understanding the type of counter-operations for disruption based on the nature of the supply chain operations and the counter-operations. Infiltration and interdiction can also be cyber-operations. Source: Authors’ own creation
In the four quadrants I–IV, we identify traditional supply chain operations in quadrant I, which could be disrupted by counter-operations from competitors or malicious actors (e.g. cybercriminals). Quadrant II involves covert supply chain activities, such as those involving illegal drugs or counterfeit goods, where legal authorities use overt (and legal) methods to disrupt them through counter-operations. In quadrant III, however, legal authorities or competitors may employ covert agents to infiltrate the supply chain, either for surveillance or with the goal of disruption. Lastly, in quadrant IV, competitors or legal authorities of one country secretly attempt to disrupt the supply chains of a company or those of another country.
The framework in Figure 1 can serve as a starting point for developing a shared understanding of how companies' supply chain operations are vulnerable to infiltration and interdiction. When using this framework, it's helpful to remember that the same party may perform both operations and counter-operations, rather than different ones. For example, joint efforts by Australia, Europol, and the FBI led to the creation of the ANOM network, which infiltrated drug supply chains and also carried out counter-operations, resulting in the arrest of over 800 people worldwide to disrupt these supply chains (BBC, 2021). In other cases, counter-operations to interdict will necessarily be carried out by the opposing party, in line with interdiction strategies supported by military analysts.
Table 1 also shows the direct target and indirect “collateral damage” in terms of its impact on others or the environment in the rightmost column, indicating potential for expanding the framework. Indeed, we demonstrate these nuances through the interaction between supply chain operations and counter-operations (Figure 2). Figure 2 illustrates supply chains that have all operations as (A) covert or (C) overt, and also (B) where covert operations infiltrate overt supply chains. Supply chain operations of all three types can be disrupted anywhere in the supply chain by targeting the source, distribution, and demand itself. Harm can also be inflicted on others besides the target of covert supply chain operations or covert counter-operations, resulting in “collateral damage.”
The figure shows two oval arrows vertically on the left, labeled “Covert Source” and “Overt Source”. On the right side, a circle is shown with a central label “Collateral Damage”. On the left side of the circle, two smaller circles arranged vertically are shown, labeled from top to bottom as “Target” and “Overt Demand”. On top of the “Covert Source”, a thunderbolt icon is shown, labeled “Interdiction at the source of supplies of covert operations”. Similarly, on top of the “Overt Source”, a thunderbolt icon is shown, labeled “Interdiction at the source of the overt supply chains with legal products”. From the “Covert Source”, a thick black arrow labeled “(A) Covert supply chain” extends upward and points to “Target”. On this arrow, a thunderbolt icon is shown, labeled “Interdiction of transportation or storage links in covert supply chains”. Also, at the point where this arrow reaches the “Target”, another thunderbolt icon is shown, labeled “Interdiction of demand for illicit products from covert operations”. From the “Covert Source”, a grey arrow labeled “(B) Covert operations infiltrating an overt supply chain” extends downward and points to “Target”. On this arrow, a thunderbolt icon is shown, labeled “Detection and interdiction of the covert operations in the overt supply chain”. From the “Overt Source”, a thick grey arrow labeled “(C) Overt supply chain” arises upward and points to “Overt Demand”. On this arrow, a thunderbolt icon is shown, labeled “Interdiction of legal products in processing, transportation, or storage (for example, sanctions on transportation or payments)”. Also, at the point where this arrow reaches “Overt Demand”, another thunderbolt icon is shown, labeled “Interdiction of demand for legal products (for example, tariffs)”.Covert operations in (a) independent covert supply chains and (b) having infiltrated (c) overt supply chains with legal operations and products; interdiction can occur at different points in overt and covert supply chains. Collateral damage can result from covert operations or the interdiction of such operations. Source: Authors’ own creation
The figure shows two oval arrows vertically on the left, labeled “Covert Source” and “Overt Source”. On the right side, a circle is shown with a central label “Collateral Damage”. On the left side of the circle, two smaller circles arranged vertically are shown, labeled from top to bottom as “Target” and “Overt Demand”. On top of the “Covert Source”, a thunderbolt icon is shown, labeled “Interdiction at the source of supplies of covert operations”. Similarly, on top of the “Overt Source”, a thunderbolt icon is shown, labeled “Interdiction at the source of the overt supply chains with legal products”. From the “Covert Source”, a thick black arrow labeled “(A) Covert supply chain” extends upward and points to “Target”. On this arrow, a thunderbolt icon is shown, labeled “Interdiction of transportation or storage links in covert supply chains”. Also, at the point where this arrow reaches the “Target”, another thunderbolt icon is shown, labeled “Interdiction of demand for illicit products from covert operations”. From the “Covert Source”, a grey arrow labeled “(B) Covert operations infiltrating an overt supply chain” extends downward and points to “Target”. On this arrow, a thunderbolt icon is shown, labeled “Detection and interdiction of the covert operations in the overt supply chain”. From the “Overt Source”, a thick grey arrow labeled “(C) Overt supply chain” arises upward and points to “Overt Demand”. On this arrow, a thunderbolt icon is shown, labeled “Interdiction of legal products in processing, transportation, or storage (for example, sanctions on transportation or payments)”. Also, at the point where this arrow reaches “Overt Demand”, another thunderbolt icon is shown, labeled “Interdiction of demand for legal products (for example, tariffs)”.Covert operations in (a) independent covert supply chains and (b) having infiltrated (c) overt supply chains with legal operations and products; interdiction can occur at different points in overt and covert supply chains. Collateral damage can result from covert operations or the interdiction of such operations. Source: Authors’ own creation
4. Avenues for future research
Our observations and evaluations, based on recent supply chain disruptions, suggest that extensive research is still needed to understand both covert and overt operations involving supply chain interdiction and infiltration within both legitimate and illegal supply chains. Most existing literature on covert supply chains and their operations is either theoretical (Anzoom et al., 2021) or depends on secondary data (for example, Basu, 2014). Researchers who gathered primary data through stakeholder interviews (e.g. D'Amato and Papadimitriou, 2013; Duensing et al., 2023) have made valuable contributions, proposed well-informed strategies, and developed hypotheses for preventing illegal infiltration into legitimate supply chain activities.
Although the existing scholarly work and our paper serve as a starting point, further empirical and conceptual research is needed to understand the infiltration and interdiction of supply chain operations and their impact on stakeholders. Our framework, illustrated in Figure 1 and further enhanced by Figure 2, prompts a range of questions that form a research agenda encompassing supply- and demand-side factors, government coordination mechanisms, intermediaries and technology, the motivations of various actors, and methodological approaches. These questions often span across the quadrants of Figure 1 and the relationships within Figure 2. Therefore, we propose a research agenda that examines the nature and dimensions of key concepts (“what and where”) regarding contextual and environmental conditions at locations within the supply chain, the actors (“who”), and the process or development aspects (“how”).
Table 2 provides a comprehensive overview of significant opportunities to deepen our understanding of covert supply chain operations and counter-operations.
A research agenda with potential research-guiding questions for supply chain operations and counter-operations
| What and where? | Who? | How? |
|---|---|---|
Supply-side
|
|
|
4.1 What and where?
We hope that exploring questions of what and where in the future will enhance understanding of different aspects related to supply- and demand-side factors. Reducing consumer demand for illegal goods and strengthening regulatory frameworks are crucial for intercepting illegal supply chains, as is uncovering them through demand-side interdiction. Alternatively, decriminalizing the consumption and distribution of certain goods like drugs could potentially provide better oversight without the collateral damage of negatively affecting communities and individuals. On the supply side, we face a new era where any supply chain operation can be targeted or infiltrated by actors seeking to cause harm. Insights from managing overt supply chains could help guide efforts to disrupt covert ones through governance, visibility, and transparency.
We need to examine the “what” and “where” aspects of supply chain counter-operations. International business scholars have extensively discussed how tariffs and trade barriers can disrupt global trade flows (Beaumier and Cartwright, 2024; Miller, 2022). Global value chain (GVC) theory (Gereffi et al., 2005; Phillips et al., 2022; Roehrich et al., 2025) plays a crucial role in identifying the coordination mechanisms within the supply chain, power asymmetries, and the development of governance structures. GVC theory demonstrates how policy tools (tariffs, trade agreements) and geopolitical tensions (trade wars) can disturb international trade. Global production networks (Coe et al., 2008; Henderson et al., 2002) also provide a solid framework for analyzing supply chain interdiction and infiltration activities. Based on GVC analysis and actor-network theory, the global production network framework includes relevant actors in the production system (internal and external stakeholders). This perspective helps understand the intentions of actors within a supply network and explains why some actors are motivated to disrupt or infiltrate supply chain operations.
Within these contexts, questions also arise about the acceptance of overt or covert practices in the supply chain. Classifying and assessing covert and overt actions and responses will likely draw on institutional and legitimacy theory (e.g. Busse et al., 2016). Institutional logics and their dynamism may offer insights into these various interdiction and infiltration activities. These issues also connect to the stakeholders involved, and stakeholder theory can help deepen the understanding and guide responses.
4.2 Who?
Governments can disrupt the movement of illicit materials by promoting international cooperation, using policy incentives, and improving information sharing among relevant agencies. Coordinated efforts across governments, supply chains, and key stakeholders like companies and suppliers (at various levels) are essential for strengthening security, ensuring compliance, and protecting legitimate trade flows.
Examining the questions of “who” from a theoretical perspective, Actor-Network Theory (ANT) extends phenomenology by treating non-human actors (e.g. technology, documents, or policies) as equally important as human actors in shaping outcomes (Hald and Spring, 2023). Incidents in supply chains, for example, are viewed as the result of interactions within a network of actors. Material phenomenology examines how objects, tools, or non-human entities contribute to experiences and results (e.g. how a damaged product “experiences” its journey through the supply network). Systems phenomenology focuses on understanding the interconnectedness and emergent properties of systems (Iliopoulos, 2016). Coordination mechanisms and power relationships are involved in both the “who” and “how” sections. These perspectives can also be analyzed using the relational view (Dyer and Singh, 1998) and resource dependence theory (Pfeffer and Salancik, 1978). These theories have been extensively explored in traditional supply chain research (Handfield, 1993) and can be adapted to this environment. New theoretical insights are likely to emerge for existing theories within this non-traditional supply chain context.
4.3 How?
To address the “how” questions, as noted earlier, modern supply chains are complex and involve many intermediaries. These intermediaries can play a role in using technology to share information. Technology, such as the use of blockchain in supply-chain traceability and transparency (Babich and Tang, 2022), can be crucial in preventing physical infiltration of supply chains.
After conceptualization, the next step is to develop relevant measurement approaches and methodologies. Multiple theories and methods can be used to understand and evaluate supply chain interdiction and infiltration events, leading to the creation of theories, frameworks, and methodologies for effective supply chain interdiction and infiltration.
Data for theory-building and testing. Building and testing theories requires collecting empirical data on covert or illegal supply chain activities. However, gathering primary data is challenging because these activities are secretive and may be illegal. These supply chains are intentionally concealed, often decentralized, and involve actors actively trying to avoid detection, making direct observation or standard data collection methods nearly impossible. Additionally, ethical and legal restrictions limit researchers' access to sensitive information, and the reliability of available data is often questionable due to its association with criminal or unregulated environments. Despite these obstacles, potential data sources include law enforcement records, court documents, investigative journalism, customs seizure reports, and declassified intelligence. Moreover, reports from NGOs and watchdog organizations—often based on field investigations or whistleblower disclosures—can provide valuable, though partial, insights into illegal supply chain activities. Insider accounts and corporate whistleblowers can also expose hidden practices. Furthermore, dark web scraping and blockchain transaction analysis are emerging methods for tracing illicit trade. While each source has limitations, combining data from multiple sources can provide essential insights into the structure and behavior of covert supply chains.
Methodology. Innovation in approach will likely be crucial, especially in covert supply chain operations. Such innovation could involve how researchers collect information from governments and businesses, sharing their analyses to protect supply chains without revealing insights to malicious actors. Military tactics, approaches, and methods used for interdiction and infiltration might offer valuable insights for examining various non-military supply chains. Most cases of covert supply chain interdiction and infiltration are complex to evaluate empirically, but scholars should try to do so. Utilizing latent and observational methods could enhance understanding of supply chain interdiction and infiltration activities. Partnering with government counterintelligence agencies could also grant access to proprietary datasets for simulation models, allowing comparison of different interdiction strategies.
We could consider phenomenology, which methodologically emphasizes exploring and understanding lived experiences—especially with those affected, such as the destruction of entire community fabrics through the “war on drugs” (e.g. Reagan, 1990; Boyd, 2002). Although commonly used in fields like healthcare (Neubauer et al., 2019), this approach could be expanded to supply chain research by examining the lived experiences of stakeholders—ranging from customers, including both intended and unintended victims, to manufacturers and suppliers, as shown in case studies (Towers et al., 2020). Additionally, criminology also offers innovative methodological approaches to investigate covert and illegal phenomena in greater detail, including the use of legal documents and other archival data (Gadd et al., 2011).
Another possible area of theory is that illegal actions can stem from criminological theories. An example is Routine Activity Theory (Miró, 2014), which states that a crime happens when three conditions are met: (1) a motivated offender; (2) a suitable target; and (3) a lack of a capable guardian, addressing the questions of who, what, and where. Additionally, drawing from sociology and criminology, Rational Choice Theory can be a useful perspective for analyzing illicit behavior (e.g. Gul, 2009; Carson et al., 2020).
Another aspect to consider when studying supply chain interdiction and infiltration is the intersection of political science and global trade policy. Political scientists argue that supply chains can be weaponized to disrupt international trade, especially when governments control critical resources or the means of transforming resources into essential products (Farrell and Newman, 2022). For example, the US government has required American companies to block the sale of high-bandwidth memory chips and chipmaking tools to Chinese firms (Drezner, 2024; FT, 2025). Political scientists use concepts such as economic coercion and statecraft (related to institutional theory) to analyze how sanctions can prevent a major power from accessing advanced technologies. A game-theoretic approach can reveal the intentions of supply chain operators and intervention actors during interdiction and infiltration, as well as their responses to these actions. An example is modeling how governments could disrupt terrorist activities through subsidies (Shan and Zhuang, 2014).
Finally, when examining “how” from a theoretical standpoint, resource- or knowledge-based views and resource orchestration theory can be used to understand which resources within a supply chain are most vulnerable and to identify ways to detect and prevent counter-operations in the supply chain. These views can also determine who controls specific resources and how these resources can be managed in both open and covert supply chain activities.
5. Conclusion
The existing OSCM literature mainly focuses on producing and transporting “normal” goods through overt supply chains that follow the regulatory and legislative frameworks of the countries where the operations take place. These overt supply chains aim to either “maximize profit” in commercial activities or “maximize service” when providing public goods. In contrast, limited research has explored the structure of covert supply chains and the roles of governments and other stakeholders in combating such illegal activities. Notably, incidents like the “exploding pagers and walkie-talkies” have set concerning precedents that could encourage other covert actors. As geopolitical tensions rise, international agreements weaken, and malicious parties gain more resources and become more sophisticated, studying covert operations in supply chains will become even more essential.
This paper is an invited contribution that has undergone a thorough peer-review process. The discussion was started in September 2024 after the events of the pager and walkie-talkie explosion in Beirut, Lebanon. Based on a lively LinkedIn discussion started by Martin C. Schleper, this joint project was started and eventually resulted in this paper.
