Trust, Then Verify
A clip going around cites a British officer who ran MI6’s anti-Soviet unit in the 1940s and turned out to be a Moscow agent, to argue that the public cannot judge what is hidden. The history is documented. This brief reads it, and CISA’s new insider-threat guide, as an access-review lesson for public projects where many firms touch the work.
As of October 16, 2026. Every figure below was checked against its source, and anything we could not verify is labeled.
Read the text version of the graphic
Sticky notes.
- Big Picture: A clip cites a spy who ran MI6's anti-Soviet unit but worked for Moscow.
- What Just Happened: Sept. 9: CISA updated its insider threat guide and names contractors and vendors.
- Why It Matters: Titles and trust are not controls. Access and verification are.
- Who It Affects: Program managers, public owners, primes and every vendor with site or system access.
- What Comes Next: Add access reviews and handover terms to vendor scopes before the next award.
- GOTB Angle: Same written process for every firm, large or small. Least-privilege access.
Study guide.
- The History: A British officer ran MI6's anti-Soviet counterintelligence unit from 1944 while spying for Moscow. (BBC History; CIA review)
- The Fallout: He left MI6 under suspicion in 1951, was cleared in 1955, and defected after a 1962 confrontation. (CIA, Studies in Intelligence)
- The Twist: Moscow itself doubted its agents, suspecting British plants. Trust failed on both sides. (BBC History)
- The Guide: CISA's 2026 guide: third-party threats come from contractors or vendors with granted access. (CISA, 9/9/26)
- The Catch: Insider threats can be unintentional or intentional. Same written process for all; an access-review lesson. (CISA guide, 9/2026)
Key takeaway. Trust a title less and verify access more. Same standard for every vendor.
The numbers
The dates are as summarized by a CIA reviewer of two biographies and by a BBC historian. Details and limits are below.
What the three sources say
A trusted insider at the center
A CIA reviewer’s summary says the officer was recruited by the Soviets in 1934, joined MI6 in 1940, and in June 1944 was selected to run the newly created Soviet counterintelligence section. He left MI6 under suspicion in 1951, was cleared publicly in 1955, and defected in 1962 after a confrontation. The reviewer describes him as charming, smart and a professional success.
Source: CIA, Studies in IntelligenceMoscow doubted its own agents
A BBC History essay adds that Soviet files show Moscow doubted its British agents, suspecting they were British plants, and tested them and distrusted their information. Trust failed on both sides. The essay notes the story could only be told after the Cold War, when files opened.
Source: BBC History, Cambridge SpiesContractors and vendors are a category
CISA’s updated Insider Threat Mitigation Guide (Sept. 9, 2026) defines third-party threats as those associated with contractors or vendors who are not formal members of an organization but have been granted some level of access. They can be direct (individuals) or indirect (flaws in systems). It also says insider threats can be unintentional or intentional.
Source: CISA release, Sept. 9, 2026; CISA guide (PDF)Reading it fairly
One case is not a rule
One Cold War case does not show the public can never judge anything. CISA also says insider threats can be unintentional, so most controls are about access and process, not suspicion of people.
Source: CISA guideWhere many firms touch every project
On airport, rail and water programs, many firms touch every project. The useful question is not whom to doubt. It is which access each firm has, who granted it, and when it was last reviewed.
Screening people is a separate question
This brief is about reviewing access to sites and systems. Any screening of individual workers is a separate question for counsel and HR, and nothing here is advice on it.
What this means for public projects
- Name each access. List every vendor’s access to sites, systems and data, and who granted it.
- Least privilege. Give each firm only the access its scope needs, and write it into the scope and contract.
- Review at the edges. Review access when a firm onboards, when scope changes and when it offboards.
- Write the handover. Put handover terms in the contract, including return of credentials and documentation.
- Same process for all. Apply one written process to every firm. Fair rules help small and local firms compete.
What we could not verify
- Publication date of the CIA review. The PDF text we read gives no date. We report it as a CIA reviewer’s summary of two biographies.
- Historical detail. We rely on the CIA reviewer and a BBC historian. We did not consult the underlying biographies or archives.
- What the viral clip said. We read only its caption, did not watch it, and use it for nothing but the question it raised.
- Fit to your project. CISA’s guide is general. How it applies to a particular contract needs your own review.
Sources, checked on October 16, 2026
- CIA, Studies in Intelligence, review of two biographies of a Cold War double agent (PDF)
- BBC History, “The Cambridge Spies” (last updated Feb. 17, 2011)
- CISA, “CISA Releases Updated Insider Threat Guide With New Insights to Mitigate Physical and Cyber Threats” (Sept. 9, 2026)
- CISA, Insider Threat Mitigation Guide, 2026 (PDF)
What is ours. The plain-words boxes and the points on contracts and procurement are GOTB’s interpretation, labeled as such. Everything else is quoted or counted from the sources above.
Claims and findings. This brief uses one documented historical case as a teaching example. It does not suggest that any vendor, firm or worker is a risk.
This page is general information, not legal, engineering, security or investment advice, and it does not promote any product or company. Figures are as reported by the sources linked, as of October 16, 2026.
About
Meet Michael E. Brown
President and Managing Partner, GOTB Consulting, LLC · Chicago
Michael E. Brown has 20+ years of governmental and municipal consulting and lobbying experience. He was lead contract negotiator on the $8.5B O’Hare 21 program and the $800M O’Hare rail extension, and lead lobbyist and contract negotiator on the $400M Chicago Department of Water Management lateral redevelopment. (Dollar figures are program sizes, not GOTB fees.)
He has worked with the Illinois legislature and public officials on public-private partnership (P3) policy, and has consulted to the Cook County Commission on reducing duplicative administrative offices. He is a frequent speaker at governmental and municipal functions, focuses on good government and healthier social and economic solutions for safe, successful neighborhoods, lives in Chicago, and serves on the Board of the March of Dimes.
- M.S., Psychology (1997), University of Iowa
- B.S., Psychology (1995), University of Iowa
About
Meet Richard Butler
Partner, GOTB Consulting, LLC · Chicago
Richard (Rich) Butler is a partner at GOTB Consulting and a 38-year veteran of Chicago city government. From August 2019 to February 2020 he served as First Deputy Commissioner and Chief Administrative Officer of the Chicago Department of Aviation (CDA), responsible for day-to-day administration and operations of O’Hare and Midway, including finance, contracts, operations, legal, human resources, workforce development, concessions, real estate and vehicle services. CDA manages the two airports with a federally funded budget of $8.5 billion. (Dollar figures are budget and program sizes, not GOTB fees.)
Before that, Rich was First Deputy Procurement Officer at the City’s Department of Procurement Services and Chief Administrative Officer of the Chicago Park District, where he oversaw procurement, audit, finance, warehousing and general administrative services on an estimated annual budget of $385 million and established district-wide policies and procedures. His City career began at the Department of Aviation as Director of Contracts Administration, and he also served as General Superintendent of the Department of Streets and Sanitation.
He completed the Chicago Accounting and Purchasing System Training Program and the City of Chicago Executive Management Program, was a key team member on the design and implementation plan for the City’s new eProcurement system, and is a member of the National Institute of Governmental Purchasing and the Purchasing Management Association of Chicago. He has served on the board of the Chicago Municipal Employees Credit Union and on the US Communities board, representing the City of Chicago, and traveled to South Korea to represent Chicago in the Kotra Alliance to bridge contracting opportunities. A native of Englewood, he attended De La Salle High School.
- B.S., Northern Illinois University
Fictional characters from GOTB’s original stories. Real-world facts always link to public sources.