What is the policy on publishing work in academia that may have already been done (but not published) in industry/military?
It is fully acceptable to work on, and to publish, results on topics als researched in secret by companies or security agencies. From an academic point of view, there is nothing wrong with that, and neither from the point of view of stealing intellectual property. (But I'm not a lawyer!)  Whether those companies or agencies would be unhappy with you publishing some great new technique for breaking cryptosystems - probably not, but unless you believe in conspiracy theories, this is likely not be an issue.  (They might try to hire you, though.)
There have been precedents, e.g., on the best algorithms to factor numbers, or some cryptographic algorithms.  (I'd have to dig out references for that.)