Not so risky after all: bilateral consequences of compromised intelligence operations

It’s a staple of screenwriters and novelists, stock news footage and a spectre haunting ambassadors’ dreams: a spy unmasked; riots outside embassies, flags and effigies alight; newspaper headlines blaring outrage; and the chilling words persona non grata. Another intelligence operation compromised, another delicate diplomatic relationship ruined. To what extent, however, are such fears borne out?
For all the nervousness about diplomatic risks of espionage, offensive counterintelligence and covert action, it turns out that exposure rarely creates much of a significant mess in relations between countries.
Where consequences have been significant they have correlated to particular features of those operations. That’s the conclusion of my research, recently published by the Harvard Kennedy School’s Belfer Center for Science & International Affairs.
When foreign intelligence activities are compromised and exposed, it’s easy to assume there will be profound negative impacts on the bilateral relationship. Foreign intelligence professionals—and the policy-makers and envoys they serve—are, indeed, preoccupied by possible consequences of compromised operations, which may include sanctions, expulsions or other adverse actions directed at the perpetrating state. Anticipating these consequences informs intelligence planning and risk assessment in capitals across the world.
I systematically analysed 174 historical cases of compromised intelligence operations from 1985 to 2020 (supported by an updated sample of cases in the following four years) and their real-world impact on bilateral relations. The study reveals not only how common espionage is but that the bilateral consequences for states caught have actually been much less serious than might have been expected.
Catastrophic consequences, where a bilateral diplomatic relationship drastically changed, were simply not evident in the results. Critical consequences, involving major damage and pervasive deterioration of a relationship, appeared in only 10 cases. Significant consequences, with moderate but recoverable impacts, occurred in only 16. All other cases demonstrated minor or negligible consequences.
It should be noted that the study focussed on bilateral consequences and not on other costs the exposed party might face, including loss of intelligence capabilities and insights, actual danger to people involved, and negative impacts on broader international policy objectives.
The research also identifies the factors that best explain outcomes. Most significantly, the nature of the compromised operation—namely, its egregiousness—correlated strongly with negative bilateral outcomes. These include operations involving: violence, intentional or unintentional, such as the French sinking of the Rainbow Warrior in 1985 or Russia’s attempted assassination of Sergei Skripal in 2018; material damage, including cyber effects; covert influence or interference, such as Russian interference in the 2016 US election; or personal effects on national leaders, such as several instances exposed by Edward Snowden.
Less closely correlating but still noteworthy was where the target country of the operations was historically or culturally predisposed to be unusually sensitive to actions by the perpetrator or to intelligence activities more generally.
Pre-existing relations also influenced outcomes. Spying on allies was risky, although not as risky as might be supposed, while, surprisingly, transgressing on adversaries proved less damaging than doing so to neutrals.
Perpetrators’ responses played an important and counter-intuitive role in the consequence: a strategy of unrepentance often proved safer than vociferous denial.
The effect of timing was more ambiguous. Compromise at politically or diplomatically inopportune moments could prove problematic. But on some occasions inopportunity also generated mutual incentives to downplay incidents. On other occasions it was difficult to separate the influence of timing from the circumstances of timing precipitating the activity itself: for example heightened tensions might exacerbate fall-out, but those tensions may have also precipitated the intelligence operation.
Interestingly, the power dynamic between perpetrator and target had significantly less explanatory power. Stronger consequences correlated closely with the degree of publicity, but publicity was almost always a function of consequence, rather than vice versa.
This analysis suggests risk assessments used in intelligence operational planning should consider the egregiousness of the operation, with particular sensitivity to prospects for violence and loss, effects on national leaders, and international norms.
Even though timing is a somewhat ambiguous factor, prudent consideration should be given to prospective events which might worsen possible consequences. This reinforces the need for continuous risk assessment. Efforts should be made to regularly review risk assessments to consider prospective developments.
Finally, the research reinforces that the fundamentally dynamic nature of intelligence should not be ignored, including in academic study. Intelligence activities are a covert contest of capabilities and wills—and risk calculations and appetites—between states carried out for decision and action advantage, and as an expression of contest in itself.
This detailed and comprehensive study reflects how states actually interact when the lights are off, with consequences that are not always what one would expect.