Introduction
You live in a world where a quiet shadow war targets Western democracies every day. Modern Russian intelligence combines deep-cover sleepers, cyber operations, and aggressive state influence to subvert your institutions without firing a single shot. You face a persistent threat that blends traditional Cold War tradecraft with digital subversion.
Gordon Corera reveals how Russian intelligence operates through illegals, cyber networks, and political co-optees. You will discover the inner workings of Directorate S, major counterintelligence investigations, high-level defections, and the historic 2010 Ghost Stories spy swap.
How do deep-cover agents integrate into foreign societies for decades? What causes operatives to betray their missions? How did Russian tradecraft evolve from physical sleepers to modern cyber warfare and political influence?
1. The World of Directorate S and Deep-Cover Illegals
Directorate S manages deep-cover Russian agents who assume entirely false nationalities and live abroad as sleepers for decades.
You find Directorate S located on floors fourteen to twenty in the main Yasenevo tower. Unlike traditional spies with diplomatic or commercial cover, SVR illegals take on foreign identities such as German, Canadian, or American to burrow deep into target societies. This method provides a sense of reassurance and an edge to Moscow leadership. Yuri Drozdov led Directorate S until his retirement, returned briefly during the August 1991 coup, and handled historical exchanges such as trading Rudolf Abel for U2 pilot Gary Powers.
Tombstoning and False Identities
KGB officers used a technique called tombstoning to create completely authentic false identities for their illegals by exploiting the deaths of young children. Officers walked through foreign cemeteries looking for the graves of children who died young, particularly those born in the country but who died elsewhere or had few relatives. After confirming the death and destroying documentary evidence where possible, they requested a new birth certificate to use as a stepping-stone for genuine documents, creating an iron legend.
Donald Heathfield and Tracey Lee Ann Foley were resurrected as illegals after KGB officers stole the identities of a Canadian boy and a Montreal girl who both died as infants in 1962. The real Donald Heathfield was born on February 4, 1962, and died on March 23, 1962. Tracey Lee Ann Foley was born on September 14, 1962. Training an illegal required a massive investment of time and resources, focusing heavily on native-level language acquisition, cultural habits, and psychological endurance.
Unlike standard intelligence officers trained over months, an illegal underwent a piecemeal, one-on-one training process lasting around four years and costing roughly one million dollars. Recruits learned tradecraft, brush-pass contacts, martial arts, polygraph evasion, and precise daily lifestyle habits of their target countries. Recruits were tested to see if they could seamlessly adopt foreign behaviors, such as how to fill out post office forms or eat with cutlery like a native Englishman.
The Psychological Strain of Spying
Deep-cover illegals must completely suppress their original language, culture, and memories to survive the extreme psychological strain of their double lives. Agents undergo strict behavioral discipline, such as never speaking Russian in the house or car, and building false personal histories to prevent slips under stress. Ann Foley attended prenatal classes and refused anesthetics during childbirth to maintain mental control and avoid crying out in Russian.
The primary mission of illegals in the United States was not immediate espionage, but the long-term spotting and assessing of potential American targets against the main adversary. Illegals built broad professional and academic networks to gather names and background details on individuals in power circles. Moscow Center used these dossiers to research personal vulnerabilities and create targeting packages for future recruitment. Donald Heathfield attended seminars and founded a company called Future Map to approach figures like former national security adviser Leon Fuerth.
To conduct these operations, you must follow specific procedures:
- identify potential agents who might be vulnerable targets in power circles;
- collect all available details on their background, current position, habits, contacts, and opportunities;
- send the information back to Moscow Center to research personal weaknesses or shared interests;
- build relationships and get close to targets based on gathered insights.
2. Counterintelligence Surveillance and FBI Investigations
The FBI patiently monitored deep-cover sleeper networks for years, exploiting operational mistakes and unauthorized meetings to build a comprehensive case.
You maintain a delicate counterintelligence balance by monitoring deep-cover illegals closely while preventing them from accessing classified information. FBI agents often intervened by moving targets away from them to protect operational security instead of immediately arresting or exposing them. Agents focused on the long-term threat of these illegals cultivating sources who might become penetration agents years later.
FBI agent Derek Pieper and his team monitored Donald Heathfield and Richard Murphy, listening to encrypted messages and sales calls while ensuring no classified secrets were compromised.
Covert Searches and Tradecraft
You utilize highly sensitive and risky covert searches of suburban homes to gather intelligence on Russian illegals without alerting them. Teams entered targets' residences in the middle of the night to place listening devices, photograph tradecraft, and copy electronic media while ensuring everything was left untouched to avoid suspicion.
FBI agents Maria Ricci and Derek Pieper participated in a middle-of-the-night covert search of the Hoboken, New Jersey apartment belonging to the Murphy family in 2005. A property like the Murphys' would be searched about twice a year. Richard Murphy studied international affairs part-time at the New School in New York from 2002 to 2005.
The FBI used intelligence from Moscow to uncover physical proof and identity discrepancies of deep-cover illegals. Agents conducted covert searches of safety deposit boxes belonging to suspects, discovering foreign birth certificates and other items that contradicted their assumed identities.
On January 23, 2001, the FBI covertly searched a safety deposit box in Cambridge and found a birth certificate for Donald Howard Graham Heathfield, matching it years later with the June 23, 2005 death of Howard William Heathfield.
Steganography and Communications
Russian illegals used digital steganography to secretly communicate with Moscow Center by hiding encrypted messages inside ordinary image files. Agents utilized bespoke software provided by the SVR to insert picture disks and message disks, enabling them to upload innocent-looking images containing hidden, unbreakable text files onto public blog sites.
During the 2005 Hoboken search, the FBI discovered floppy disks and notebooks in a shoe box, which eventually unlocked the illegals' covert steganography system after deciphering a 27-character password containing a Russian-style number one. The FBI spent 5 years to understand the steganography communication technique starting from 2000.
Illegals relied on outdated, pre-digital communication methods like invisible ink and radiograms to communicate with Moscow. Bringing illegals back for modern digital training would jeopardize their cover, so they continued using legacy methods established decades prior, such as one-time pads and chemical writing pads.
Juan Lazaro wrote messages using invisible ink chemical contact paper, while the FBI picked up irregular clicking sounds on bugs linked to shortwave radiograms. On November 23, 2002, a bug captured Lazaro reading a radiogram about Chechnya, and in January 2003, a conversation about invisible ink took place before a trip.
To execute this communication method, you follow specific procedures:
- write a normal-sounding letter to a fictitious friend;
- place a chemically treated contact paper sheet over the letter;
- use a pencil to add a hidden message on top of the letter;
- destroy the extra papers carefully and mail the letter to a foreign address or deliver it by hand.
3. Defectors and Inside Betrayals
High-ranking insiders within Russian intelligence defect to the West, providing critical evidence that exposes active deep-cover networks and moles.
The Defection of Alexander Poteyev
Alexander Poteyev was born on March 7, 1952. He joined the KGB in 1975, fought in Afghanistan, and completed elite paramilitary training. In 1995, Poteyev joined a posting to New York as a Line N officer. At the time, about 60 SVR officers operated in New York, running around 150 sources. Denied a tour extension and disillusioned with his agency, he was recruited by the FBI in June 1999.
Poteyev returned to Moscow and became deputy head of Department 4, managing illegal operations. Over a decade of clandestine meetings and passing secrets, he shared deep intelligence regarding illegals across the Americas and globally. His disclosures exposed high-value assets like Herman Simm. Alexander Poteyev was the exact reason Donald Heathfield was followed at his graduation from Harvard.
As Putin's internal spy hunt intensified, pressure mounted on the SVR. Poteyev left Moscow on a Friday, taking a train to Minsk and sending a text message to his wife. This 434-mile journey from Moscow to Minsk took the best part of nine hours. He was exfiltrated via Belarus, Ukraine, and Frankfurt to the United States using a CIA-provided false passport. His flight served as a hard trigger for the FBI to conclude the Ghost Stories investigation.
Historical Betrayals and Retribution
Vasili Mitrokhin secretly copied and buried large chunks of KGB operational history at his dacha. After offering his notes to the British embassy in Riga, MI6 exfiltrated him. The operation yielded 3,500 counterintelligence reports sent to 36 countries, producing 200 leads for Britain and 800 pages in the US file alone. These files led directly to the identification of Jack Barsky, a KGB man living on the American East Coast under deep cover.
Former SVR officer Alexander Zaporozhsky cashed in 2 million dollars for providing the tip-off that pointed to Aldrich Ames. He retired to the United States and foolishly ignored American warnings about traveling back to Russia. As soon as Alexander Zaporozhsky got off the plane in Moscow in November 2000, he was arrested by the FSB in an operation masterminded by Sasha Zhomov. He was later sentenced to eighteen years of hard labor.
Alexander Poteyev's betrayal of the illegals triggered a massive SVR crisis, resulting in his in-absentia trial and harsh warnings from Russian officials regarding retribution against traitors.
Poteyev fled just before the arrests, exposing Directorate S operations. In a secret military court, he was convicted of high treason. Anna Chapman provided written testimony identifying Poteyev from a photo and confirming he had access to the special password used by the FBI agent. The court handed down a twenty-five-year prison sentence to Alexander Poteyev. SVR head Fradkov publicly cited the ninth and last circle of hell where Dante placed traitors, warning of ultimate retribution.
4. The 2010 Arrests and Vienna Spy Swap
The Obama administration fiercely resisted the immediate arrest of Russian spies to protect the diplomatic reset with Russian President Dmitry Medvedev. During a heated Oval Office Situation Room meeting on June 18, 2010, President Obama angrily compared the spy case to a Cold War throwback out of John le Carré that threatened bigger diplomatic goals.
Faced with hard operational stops and presidential diplomacy, Western authorities coordinated mass arrests and executed a historic spy swap in Vienna.
The June 27 Takedowns
On June 27, the FBI executed coordinated arrests of deep-cover Russian illegals living ordinary suburban lives across the United States. In Boston, FBI agents entered the Trowbridge Street house with weapons drawn while the suspects' sons watched their parents handcuffed in front of them. Donald Heathfield and Ann Foley were arrested at their home in Boston while celebrating family birthdays, while the Murphy family was detained during dinner in New Jersey.
The FBI used a false flag operation involving an undercover agent posing as a foreign intelligence contact to trap Anna Chapman in Manhattan. On June 26, 2010, Anna Chapman met the undercover agent at a downtown Manhattan coffee shop, where she accepted instructions to hand over a fake passport at the World Financial Center using a magazine and postal stamp recognition signals.
You must handle operational security through strict protocols:
- Hold a magazine in a specific way as a recognition signal during the meeting.
- Respond to the prompt about meeting in California by saying, "No, I think it was the Hamptons."
- Place a postal stamp upside down on the side of a city map while looking at it.
Negotiating the Exchange
The CIA leveraged its comprehensive evidence to force the Russian SVR to acknowledge that the arrested illegals belonged to them, opening the path for a spy swap. When Leon Panetta stated over the phone that the arrested people were theirs, Mikhail Fradkov paused before replying, "Yes, they are my people," prompting a silent celebration among CIA staff.
The 2010 swap broke historical precedent by trading captured Russian illegals not for Westerners, but for Russian citizens imprisoned for spying for the US and UK. The US and UK demanded the release of Alexander Zaporozhsky, Gennady Vasilenko, Sergei Skripal, and Igor Sutyagin, while rejecting repeated Russian demands to release American traitor Aldrich Ames.
The actual physical exchange took place swiftly on a remote airport tarmac in Vienna, keeping the two opposing groups of prisoners completely separated. Igor Sutyagin described the rapid transition: "It took 40 seconds. We stepped on the ladder and we were aboard the American plane."
5. From Physical Sleepers to Cyber Warfare and Influence
Following the exposure of traditional illegals, Russian intelligence shifted toward cyber espionage, social media manipulation, and political co-optees.
The Gerasimov Doctrine and Hybrid Warfare
Valery Gerasimov published a speech in a military newspaper in February 2013 outlining a new era of warfare where the distinction between war and peace is blurred. Russian military leadership viewed Russia as a besieged fortress already subjected to Western subversion, prompting them to adopt hybrid warfare strategies. These measures deployed information as a weapon to destabilize adversary states short of traditional military force.
During the seizure of Crimea in 2014, Russia road-tested its new hybrid doctrine by combining propaganda, cyber campaigns, and uniformed soldiers without insignia known as Little Green Men.
Russian intelligence agencies transitioned from traditional espionage to disruptive cyber operations and destruction. They utilized advanced persistent threat groups to infiltrate critical infrastructure and political organizations. While criminal hackers focused on theft, Russian state spy agencies like the FSB and GRU executed sophisticated espionage campaigns and destructive cyberattacks designed to test weapons and erode trust in democratic processes.
- Moonlight Maze campaign to steal American military secrets in 1996
- Buckshot Yankee incident when an infected USB breached the US military in 2008
On April 8, 2015, GRU hackers from APT 28 attacked the French TV network TV5Monde under the false flag of the Cyber Caliphate. The attack took all twelve channels black at 8:40 p.m. while attempting to destroy operational hardware.
Project Lakhta and Election Interference
The Kremlin established the Internet Research Agency under Project Lakhta in St. Petersburg in July 2013 to operate a mass-scale social media influence machine. Staff members worked in shifts with an annual budget of roughly a million dollars a month to manufacture false American identities on platforms like Facebook, Twitter, and YouTube. The primary objective was not promoting Russia, but setting Americans against their own government and provoking social unrest.
IRA staff created polarizing social media groups such as Secured Borders, Blacktivist, United Muslims of America, and Army of Jesus, which grew to hundreds of thousands of followers. A fake Tennessee GOP Twitter account reached 100,000 online followers, while other operatives used trucks to drive around West Palm Beach in August 2016 featuring a cage and a caged Hillary Clinton impersonator.
During the 2016 US presidential election, Russian military intelligence combined social media agitation with a hack-and-leak campaign targeting political organizations to amplify divisions and damage specific candidates. GRU hackers infiltrated political party committees, stole tens of thousands of emails, and funneled them through front websites and WikiLeaks.
On March 19, 2016, Clinton campaign chairman John Podesta clicked on a phishing link giving GRU hackers access to his emails. Other units breached the DNC and DCCC, leading to the publication on July 22, 2016, of damaging DNC emails suggesting bias against Bernie Sanders.
The arrest of Maria Butina demonstrated a shift in Russian operations toward utilizing co-optees and influencers rather than traditional deep-cover illegals. Butina built a network of contacts among American conservatives and gun-rights advocates under the guise of informal diplomacy and promoting better bilateral relations. Although her communication resembled spotting-and-assessing reports used by intelligence handlers, she was not a traditional trained spy.
Maria Butina, a young Russian student and founder of Right to Bear Arms, cultivated ties with the NRA and Republican leaders before being arrested by the FBI in July 2018 and pleading guilty to acting as an unregistered agent of a foreign government. She had requested a budget of $125,000 to participate in upcoming Republican Party events, backed by a well-connected Russian oligarch with a net worth of $1.2 billion.
10 Key Ideas
- Directorate S manages deep-cover Russian agents who assume entirely false nationalities and live abroad as sleepers for decades using authentic identities stolen from deceased infants.
- Deep-cover illegals must completely suppress their original language, culture, and memories while using legacy communication methods like one-time pads, invisible ink, and radiograms.
- The FBI patiently monitored deep-cover sleeper networks for years through covert searches and audio surveillance, exploiting operational mistakes to build a comprehensive case.
- Alexander Poteyev defected to the United States after a decade of managing illegal operations, exposing high-value assets and triggering a massive SVR crisis.
- Faced with hard operational stops and presidential diplomacy, Western authorities coordinated mass arrests of deep-cover agents across the United States.
- The United States and United Kingdom executed a historic spy swap in Vienna by trading captured Russian illegals for Russian citizens imprisoned for Western espionage.
- Following the exposure of traditional illegals, Russian intelligence shifted toward hybrid warfare strategies that deployed information as a weapon to destabilize adversary states.
- Russian military intelligence utilized advanced persistent threat groups to execute disruptive cyber espionage campaigns and destructive attacks against critical infrastructure and political targets.
- The Kremlin established the Internet Research Agency under Project Lakhta in St. Petersburg to operate a mass-scale social media influence machine designed to provoke social unrest.
- The arrest of Maria Butina demonstrated a modern shift in Russian operations toward utilizing co-optees and influencers rather than traditional deep-cover illegals.