content: Surveillance would fall under offensive. Not only broad measures but also attacks on individuals - you might remember released papers 25+ years after the dead of famous people along the lines of "we though he was dangerous so we surveiled him" - that needs people and that costs. Also industry spionage is most likely included here - just as the US is victim to chinese industry spionage. Attacking back is actually easier and more effective than trying to be watertight yourself so it makes sense to put most money there.