Cold War Architecture · Part 6 of 11 · Patreon members only

Counterintelligence: The Defensive Game

Reading time: ~15 minutes

What Counterintelligence Is — and Is Not

Counterintelligence is formally defined in Executive Order 12333 as “information gathered and activities conducted to identify, deceive, exploit, disrupt, or protect against espionage, other intelligence activities, sabotage, or assassinations conducted for or on behalf of foreign powers, organizations, or persons, or their agents.” That definition covers three distinct operational functions that practitioners distinguish carefully.

Defensive CI is the function most people associate with the term: identifying and stopping foreign intelligence services from penetrating your own organization. This includes personnel security programs, polygraph examinations, access controls, insider threat monitoring, and the investigation of suspected espionage cases. Defensive CI is fundamentally reactive — it responds to a threat that already exists or is suspected.

Offensive CI — sometimes called “CI operations” — goes further. Rather than simply stopping an adversary’s intelligence officer, offensive CI attempts to identify, assess, recruit, or manipulate that officer to work for your side. A foreign intelligence officer who has been identified, approached, and turned becomes a source on his own service’s collection priorities, methods, and personnel. This is among the highest-value intelligence an agency can acquire, and it is also among the most operationally complex to handle safely.

CI analysis synthesizes reporting from both defensive and offensive operations to produce strategic assessments: which foreign services are most active against which US targets, what collection methods they are using, where previous penetrations may have occurred, and what the indicators of future operations might look like. CI analysis is what connects individual cases to the broader threat picture.

How US Counterintelligence Is Organized

Unlike the collection mission — which is divided relatively cleanly among the CIA (HUMINT), NSA (SIGINT), and NRO (IMINT) — the counterintelligence mission is fragmented across multiple agencies with overlapping jurisdiction and a history of institutional friction.

The FBI is the lead CI agency for domestic operations. Its National Security Branch, and within it the Counterintelligence Division, is responsible for investigating foreign intelligence activities on US soil, running double-agent operations against foreign services operating in the United States, and protecting US persons and organizations from foreign intelligence threats. The FBI’s CI jurisdiction is domestic; it does not run operations overseas.

The CIA’s Counterintelligence Center (CIC), now part of the Directorate of Operations, is responsible for CI operations overseas and for protecting CIA personnel, sources, and methods from foreign penetration. The CIA’s CI function also includes managing the liaison relationships with foreign intelligence services — relationships that are themselves potential vectors for penetration.

The Defense Counterintelligence and Security Agency (DCSA), formerly DISA’s security arm, manages personnel security and insider threat programs across the defense industrial base. The military services each maintain their own CI organizations — the Army’s Counterintelligence Command, the Air Force Office of Special Investigations (AFOSI), the Naval Criminal Investigative Service (NCIS) — that handle CI investigations within their respective services.

The National Counterintelligence and Security Center (NCSC), established under the Office of the Director of National Intelligence, is supposed to coordinate all of these efforts across the IC. Whether it succeeds at that coordination is, charitably, a work in progress.

The Major Cases: What Penetration Actually Looks Like

The history of US counterintelligence is substantially a history of failure — of foreign services running long-term penetrations of US intelligence agencies that went undetected for years or decades. Each major case produced a post-mortem identifying systemic vulnerabilities. Most of those vulnerabilities were structural, not individual, and several appeared in multiple agencies across multiple decades.

Aldrich Ames — CIA, 1985–1994

Aldrich Ames was a career CIA case officer who began spying for the Soviet KGB in April 1985. Over the next nine years he compromised virtually every Soviet and Eastern European asset the CIA was running, resulting in the execution of at least ten CIA sources and the imprisonment of others. The damage to US intelligence collection against the Soviet Union during the final years of the Cold War was catastrophic and is still not fully quantifiable.

The failure to detect Ames was not primarily an analytical failure — there were clear indicators as early as 1986 that a penetration had occurred. Sources were being rolled up at a rate that defied coincidence. The failure was institutional: the CIA’s CI staff was too small, its analytical tools too limited, and its organizational culture too resistant to the conclusion that a case officer was the source. Ames spent freely, drove an expensive car, and bought a $540,000 house in cash on a government salary. No one formally investigated his finances for years. When investigators finally ran a financial analysis in 1993, the case broke quickly.

Robert Hanssen — FBI, 1979–2001

Robert Hanssen was an FBI special agent who sold intelligence to Soviet — and later Russian — intelligence services for twenty-two years across three separate espionage periods. He revealed to Moscow the identities of Soviet officials who had been recruited by US intelligence (at least three of whom were subsequently executed), disclosed the existence of a classified tunnel the NSA had built under the Soviet Embassy in Washington, and betrayed the existence of a classified continuity-of-government program — directly relevant to this series — along with nuclear war planning and defensive measures.

Hanssen was an FBI counterintelligence officer. He understood exactly how he would be investigated and structured his communications with his handlers to minimize the evidence trail. He never met his handlers in person. He communicated through dead drops. He refused to provide his true name. He was caught not by FBI investigation but by CIA officers who acquired a KGB file containing Hanssen’s fingerprints and a sample of his DNA in 2000 — after more than two decades of operation.

Jonathan Pollard — Navy, 1984–1985

Jonathan Pollard was a US Navy intelligence analyst who passed classified material to Israel — a formal Five Eyes-adjacent partner — over an eighteen-month period. The damage assessment, portions of which remain classified, indicated he had provided an extraordinary volume of material: satellite imagery, signals intelligence collection methods, the identities of US intelligence sources in the Arab world, and NSA reports on Soviet weapons systems. Pollard’s case is significant not just for its damage but for what it revealed about CI gaps in allied intelligence relationships: the assumption that close allies do not conduct collection against each other is operationally naive. Every intelligence service collects against every target it deems valuable, including allies.

Ana Montes — DIA, 1985–2001

Ana Montes was a senior Defense Intelligence Agency analyst specializing in Cuba who had been working for Cuban intelligence since before she joined the DIA. For sixteen years she passed classified assessments, intelligence methods, and the identities of four US intelligence assets in Cuba — at least one of whom was executed — while producing DIA analytical products that shaped US Cuba policy. She was arrested in September 2001, ten days after the 9/11 attacks, based on an investigation that had begun the previous year. Montes’s case illustrates a CI problem distinct from the Ames and Hanssen cases: she was not a walk-in who volunteered to a foreign service for money. She was ideologically motivated, recruited before she had access, and then placed inside the target agency. The CI defense against that threat model is significantly harder than detecting financial anomalies in a mid-career officer.

How Foreign Services Actually Recruit

Understanding what CI is defending against requires understanding how foreign intelligence services actually develop and recruit sources. The Hollywood model — the midnight approach by a shadowy figure with a briefcase of cash — describes a small fraction of actual recruitment operations. The real process is slower, more methodical, and considerably more difficult to detect.

Recruitment typically follows a sequence intelligence professionals call the MICE framework — Money, Ideology, Compromise, and Ego. Each element represents a different motivational pathway that a foreign service can exploit.

Money was the dominant motivation in the Ames case — he needed cash for his wife’s family financial obligations and calculated that his access was worth selling. Financial stress, lifestyle inflation, and debt are among the most reliable indicators of recruitment vulnerability, which is why security programs track financial anomalies. Ames passed two polygraphs while actively spying. Financial analysis caught him.

Ideology drove Montes and, in a different form, Pollard. True believers are among the most damaging penetrations because their motivation is not correctable by financial improvement and they may not show behavioral indicators that security programs are designed to detect. Ideological recruitment often happens before the target has access — the foreign service is patient enough to wait.

Compromise — coercion based on real or fabricated damaging information — has been less common in US cases but is a documented recruitment method in adversary services, particularly against targets with exploitable personal vulnerabilities.

Ego is underestimated in the public picture. The sense that one’s expertise is undervalued, that one’s assessments are being ignored, that the organization does not deserve one’s loyalty — this is a recruitment pathway that foreign services actively cultivate through flattery, apparent professional respect, and the carefully constructed impression that the adversary service would appreciate what the target’s own organization does not. Several recruitment operations against cleared US personnel have begun with nothing more sinister than a professional conference and a foreign intelligence officer who was an unusually good listener.

The Current Threat Picture

The CI threat has not diminished since the Cold War ended. It has diversified. The Soviet KGB’s successor services — the FSB (domestic) and SVR (foreign) — continue to run aggressive human intelligence operations against US government and defense industry targets, with an operational tempo that has increased noticeably since 2014. Chinese intelligence services, primarily the Ministry of State Security (MSS) and the People’s Liberation Army’s Intelligence Support Force, run the largest and most systematic foreign intelligence collection operation currently directed against the United States, with a particular focus on technology transfer, defense programs, and long-term penetration of government and academic institutions.

The Chinese approach differs structurally from the Soviet model. Rather than recruiting a single high-access agent like Ames or Hanssen, Chinese intelligence services have been documented running what CI professionals call “thousand grains of sand” operations — collecting from large numbers of lower-access sources simultaneously, each providing a small piece of a mosaic that becomes strategically significant in aggregate. This approach is harder to detect because no single collection event is significant enough to trigger investigation, and harder to prosecute because each individual source may be providing material that appears marginally classified or commercially sensitive rather than obviously damaging.

Cyber intrusion has transformed the CI threat in a way that the 1947 architecture was not built to handle. A foreign intelligence service that penetrates a cleared contractor’s network does not need a human source inside the agency — it can collect the product of that source’s work directly. The OPM breach of 2014–2015, attributed to Chinese state actors, exfiltrated the personnel records of approximately 21.5 million current and former federal employees, including the detailed security clearance investigation files of four million cleared individuals. The CI damage from that single operation — identifying every cleared US government employee, their foreign contacts, their financial history, and their personal vulnerabilities — will take decades to fully assess.

Double Agent Operations: Turning the Threat

The offensive side of CI — running double agents against foreign intelligence services — is among the most operationally complex activities the IC undertakes, and among the most valuable when it succeeds. A well-run double agent operation provides continuous insight into a foreign service’s collection priorities, methods, and personnel; allows the US side to feed false or misleading information to the adversary; and may ultimately enable the identification and neutralization of the adversary’s entire US operation.

The FBI’s Double Agent Program has been running since the Cold War, typically with the FBI providing the controlled source and the CIA providing foreign intelligence context. The program’s results are largely classified, but documented successes include operations that identified KGB officers operating under diplomatic cover in the US, mapped Soviet collection priorities during critical periods of the Cold War, and allowed the US side to control what Moscow believed about specific US capabilities and programs.

The risk in double agent operations is significant. A poorly controlled double may actually be a triple — working for the foreign service while appearing to work for you, feeding you what the adversary wants you to believe while reporting your actual CI methods back to his real handlers. Angleton’s obsessive mole hunt at the CIA was partly driven by his belief — shared by his KGB defector source Anatoli Golitsyn — that several prominent CIA defectors from Soviet intelligence were themselves controlled provocations designed to mislead US CI efforts. Whether Angleton was right, partly right, or entirely wrong about specific cases remains disputed among historians and former practitioners.

What This Means for the Prepared

Counterintelligence is not a subject that applies only to cleared government employees and intelligence professionals. The principles that govern effective CI at the national level apply directly to organizational and personal security at every level.

The insider threat is the hardest threat to defend against. Every major penetration case in this article involved someone with authorized access. External attackers — foreign intelligence officers trying to collect from the outside — face access barriers that insiders have already cleared. The CI lesson is that security programs which focus primarily on external threats while treating internal access as inherently safe are structurally incomplete. Anomaly monitoring, financial review, behavioral indicators, and a culture that normalizes reporting concerns are not bureaucratic overhead — they are the primary defense against the threat that has historically caused the most damage.

Access is the target. Foreign intelligence services do not recruit people randomly. They identify individuals with access to material they want and develop them over time. The implication: access to sensitive information, systems, or facilities creates a recruitment profile whether the individual recognizes it or not. Understanding that you are a potential target — because of what you know, who you work for, or what systems you can reach — is the precondition for taking appropriate protective measures.

MICE is a pre-screening tool, not just a history lesson. The motivational pathways that produced Ames, Hanssen, Montes, and Pollard — financial stress, ideological grievance, perceived disrespect, personal compromise — are identifiable in advance. Personal security hygiene includes honest self-assessment of financial vulnerabilities, awareness of foreign contacts and their potential intelligence affiliations, and recognition that flattery from unexpected sources in high-access contexts is a recruitment vector, not a compliment.

The digital attack surface dwarfs the human one. The OPM breach produced more CI damage than most human penetrations of the previous thirty years combined. Network security, access controls, and endpoint monitoring are not IT concerns that sit outside the CI mission — they are the primary terrain on which the current generation of foreign intelligence collection is occurring.

See Also

• Founding the Watchers: CIA, NSA, NRO and the 1947 Architecture (Part 5)
• The UKUSA Agreement: How Five Eyes Actually Works (Part 4)
• OPSEC: Don’t Become the Target
• Human Intelligence (HUMINT)
• Communications Intelligence (COMINT)
• Communications Security (COMSEC)
• How We Watch: The FFTP Intelligence Collection and Production System

Bibliography & Further Reading

1. Executive Order 12333, “United States Intelligence Activities” (as amended). dni.gov
2. National Counterintelligence and Security Center. “Foreign Economic Espionage in Cyberspace,” 2018. dni.gov
3. Senate Select Committee on Intelligence. “An Assessment of the Aldrich H. Ames Espionage Case and Its Implications for U.S. Intelligence,” November 1, 1994. intelligence.senate.gov
4. Department of Justice. “Robert Philip Hanssen Espionage Case.” Press release and supporting materials, February 2001. justice.gov
5. Office of the Inspector General, Department of Defense. “Review of the Actions Taken to Deter, Detect, and Investigate the Espionage Activities of Ana Belen Montes,” August 2005. Partially declassified.
6. Office of Personnel Management. “OPM Cybersecurity Incidents.” opm.gov
7. Wise, David. Spy: The Inside Story of How the FBI’s Robert Hanssen Betrayed America. Random House, 2002.
8. Earley, Pete. Confessions of a Spy: The Real Story of Aldrich Ames. Putnam, 1997.
9. Waller, Douglas. Disciples: The World War II Missions of the CIA Directors Who Fought for Wild Bill Donovan. Simon & Schuster, 2015.
10. Angleton, James Jesus. Oral history interviews, declassified. Available through the CIA Historical Collections. cia.gov
11. Stein, Jeff. “How China Stole the Keys to the US Personnel Kingdom.” Newsweek, March 2015. (On the OPM breach.)
12. National Counterintelligence and Security Center. “Know the Risk, Raise Your Shield: Awareness Materials.” dni.gov