Clients instruct people, not websites.

The practice

Risk3 Consulting Limited is a private limited company registered in Hong Kong, company registration number 0781250. The practice has operated in Asia since 1992 and does one category of work: protecting the confidentiality of the spoken word, through Technical Surveillance Countermeasures, electronic privacy audits and counter-espionage investigation.

The name carries the method. The superscript in RISK³ stands for the tagline the practice has worked under for three decades: Detect. Defeat. Nullify. Detect the surveillance. Defeat the operation behind it. Nullify the advantage it sought. Behind the tagline sit three working principles: discretion, enforced by compartmentalisation; independence, enforced by our refusal to sell hardware; and evidence, enforced by a methodology built to survive cross-examination.

Our consultants

The practice is led by Alan Jeffries, Principal Consultant, whose work spans Technical Surveillance Countermeasures, digital forensics and eDiscovery across Hong Kong and Asia-Pacific. Fieldwork teams are drawn from technical intelligence, counter-intelligence, forensic and investigative backgrounds. What we state publicly, and can evidence to qualified enquirers:

• The consultant who scopes your engagement leads it in the field. We do not subcontract sensitive work.
• Our practitioners have given expert evidence in court and arbitral proceedings, and prepare every report to that standard.
• The practice works alongside affiliated specialist practices in digital forensics, eDiscovery and expert witness services, so a technical finding can move to attribution, legal action and testimony without briefing a second firm.
• Consultant credentials, prior forum experience and references are made available, under confidentiality, to clients and their counsel during engagement.

Both are on LinkedIn: Risk3 Consulting · Alan Jeffries.

Governance on the record

• Conflict checks. Every enquiry is conflict-checked before any matter detail is taken. If we act for a party whose interests could touch yours, we decline, and we do not tell either side who asked.
• Vetting. Consultants and support staff are background-checked, engaged under enforceable confidentiality obligations that survive their tenure, and re-vetted periodically.
• Insurance. The practice maintains professional indemnity insurance. Certificate details are provided to clients on request during engagement.
• Data handling. Engagement material is held on segregated, encrypted systems and destroyed or returned at conclusion, per the terms of engagement. This website stores nothing about its visitors. See the privacy policy.
• Complaints. Concerns about any engagement are handled by the practice principal and, where appropriate, an independent reviewer. The procedure is included in every engagement letter.

What we will not do

Refusals define a practice as much as capabilities. Risk3 does not conduct surveillance of any kind. We do not sell, install or take commission on equipment. We do not accept engagements that require unlawful access to premises, devices or data in any jurisdiction. We do not act against existing clients, and we do not accept instructions from sanctioned parties. Where an enquiry asks for any of these, we say no and we say why.