Russia’s Spies Are So Bad We’re Declassifying Stories About Them While the War Is On

Russia’s spy war has gotten so sloppy, we are declassifying cases of catching their spies immediately rather than wait decades. An astonishing new article about Putin’s espionage cluster fail and what it means is up next on Game Theory Today. Guys, it’s time for some game theory. In 1985, the FBI arrested John Walker Jr. for selling Navy cryptographic secrets to the KGB. Walker had been on their payroll since 1967. The full unclassified history of that case, the sources, methods, and trade craft the KGB used to run him for 18 years, wasn’t declassified until 2016. Aldrich Ames, legendary traitor. He was a CIA officer who turned to the Soviets in 1985 and was finally arrested in 1994. The operational history of how Moscow ran him, which officers he burned, what dead drops he used, how the payments moved, that took until roughly 2014 to land in public form.

Robert Hansen, the Russian spy in the FBI, a counter inelligence officer who started working for the Russians in 1979 and who wasn’t arrested until 2001. Operational details from the Hansen file were still being declassified in 2021, 20 years after the arrest. That’s how long it normally takes to write the unclassified history of a state-on-state intelligence operation. And the reason is not that the historians are slow. The reason is that competent counter intelligence operations contain things that need to stay protected. Sources are still alive. Methods are still in use. Cover infrastructure is still operational. Safe house addresses, deadrop locations, recruitment patterns. All of it has to be sanitized before it goes into the public record because the public record is being read by the very adversary you’re still tracking.

And you want them to keep using stuff that you’ve busted so that they stupidly walk into your traps. That’s why top secret information about traders stays top secret for so long. It’s still essential. Sure, we’d love to discuss it openly. It would help in so many ways, but the value of catching new spies still outweighs it. That’s how it’s worked since the founding of the modern intelligence services around the 1940s. But the Russians have recently led us to a strange new um innovation. In October 2025, a Polish academic at Yagyonian University named Arcadius Nisio published a 22-page peer-reviewed article in Security Journal that does for the current Russian intelligence campaign in Central and Eastern Europe what historians normally take a quarter century to do for one case.

He covered seven countries, several dozen operations, statute level legal detail, named units, named operations, named platforms, and identified a potential theory about the pattern suggested by this counter intelligence information. And Nizio wrote it while the war is still going on. Today on Game Theory Today, we’re going to ask a simple question. How is that even possible? Why did NATO’s intelligence agencies go along with this? And what does the answer tell us about who’s actually winning this war? Mizio’s article describes how Russia has been operating since invading Ukraine in 2022 using barely trained assets, dudes they found on the internet, paying them via cryptocurrency, tasking them over consumerra devices, and getting them to commit crimes in NATO countries that still have counter intelligence services trained to find actual KGB type agents and who don’t find it all that difficult to catch dudes with no training who are getting paid for espionage in discount Taco Bell coupons.

This is mind-bendingly novel for three reasons of intelligence tradecraft. Reason one, cryptocurrency on a public blockchain is the worst tradecraftraft choice that Russian intelligence has made in a century. In the Cold War, the KGB paid Walker, Ames, and Hansen in cash. They paid all their agents in cash, prefer preferably nonsequential unmarked bills. Cash dropped in plastic bags at coordinated locations. The exchange happened once. There was no electronic record. 25 years later, when historians sit down to reconstruct the money flow, they have to interview retired officers and read declassified audit trails because that’s the only record available. Cryptocurrency inverts every property of cash.

It is the worst way to pay for anything illicit. And somehow we managed to convince every 11th rate spy and mobster goon to use this system that can be centrally surveiled by the US intelligence services. I think this might be the biggest sign of Russia’s defeat since they replaced tanks at their May 9th victory parade with widows. Putin is a spy spy and is almost impossible to conceive of why he would want to pay operatives this way. Every transaction is a permanent public ledger viewable by anyone and everyone. Sure, Tumblr and Mixers raise the cost of attribution, but they’ve been busted for years. Bitcoin fog and tornado cash have been prosecuted by the Department of Justice. And that’s without imagining what the NSA and Fininsen have done with the system.

The dead drop in 1985 produced exactly one forensic event the moment Walker or whoever was caught with the bag. The crypto payment in 2024 produces a forensic event every time anyone ever queries the blockchain. It’s like Putin engaged a Manhattan project for getting your spies caught and he came up with cryptocurrency. As such, historians don’t have to wait 25 years to analyze how Russia’s spies got paid. The chain is already public. It’s literally not top secret at all. So why delay a good laugh? Reason two, the recruits have no field discipline. A cold war KGB agent was the product of years of investment, tradecraftraft training, surveillance detection routes, brush passes, cutout protocols, compartmentation, and most importantly, the psychological preparation to withstand interrogation.

A trained asset rolled up by the counter intelligence agency of a country is a hard target. Actually, he’s been prepared for that moment of arrest. A 19-year-old recruited on a Discord server 3 weeks ago is prepared to smack talk you about your skills on Call of Duty and to confess as soon as he is inevitably caught. According to Nizio citing Estonia’s CAPO intelligence agency, the Estonian recruits did not employ even basic counter surveillance measures as evidenced by the fact that their image was captured multiple times by both public and private security cameras. The Colombian national who attempted to set fire to a Prague bus station in 2024 was photographed repeatedly by CCTV while he staked the place out.

These guys haven’t even watched the wired YouTube videos about how to do the quick change thing to avoid surveillance. They haven’t even mastered like the trucker hat with a fake mullet and sunglasses trick. These are not operatives. These aren’t even rodeo clowns. These are target practice. These are the chunks of Wagyu beef going into the piranha tank of NATO counter intelligence officers. And here’s the consequence. When a trained intelligence asset gets caught, the principal loses the asset, but the counter intelligence services gain relatively little. The asset has been compartmented, he doesn’t know much. He’s been trained not to talk. The handler severs contact. The network adapts. When a disposable spy gets caught, and they get caught constantly because they have no trade craft, the counter intelligence service gains the recruiter’s Telegram handle, the paym’s wallet, the phone with all its metadata, the geotag photos, the names of every other person that that spy tried to involve or knows at all because he was never trained in compartmentation.

Also, 3 weeks before, he was a disaffected teenager playing Overwatch 2 who thought it might be fun to throw throw something at a building. Now he’s being called an enemy of the state. He’s probably not going to sacrifice himself for mother Russia. As such, the value proposition has to be flipped for Putin. Each failed operation produces more usable intelligence for the defending side than a successful one would have produced for Moscow. Russia is paying for the privilege of mapping its own networks for Western counter intelligence. Reason three, the intelligence services of the seven affected countries have been publishing the case materials themselves. Nisio’s bibliography reads like a who’s who of European counter intelligence.

Lithuania’s state security department, the VSSD, Latvia’s Constitution Protection Bureau, the SAB, Latvia’s State Security Service, the VDD, Estonia’s Internal Security Service, the CAPO, the Czech Republic’s BIS, Germany’s BFV, Finland’s, Sweden’s SAPO, Norway’s NSM and NIS. All of these services publish annual public threat reports. All of them publicly name Russian operations, publicly identify the units running them, and in many cases publicly attribute specific cases to unit 29155, the GU, or to the SVR. The Czech BIS report attributing the 2014 ammunition depot explosion to unit 29155 is what Nizio cites as his footnote on page 10. You might notice that I’m using the term publicly a lot because if there’s one thing you don’t do that often in counter intelligence, it’s take stuff public.

In the Cold War, MI5 and the FBI did not publish annual reports naming KGB officers. The traditional posture was to protect the attribution until the prosecution, which sometimes never came. Now, Western counter intelligence services have made a deliberate choice to attribute publicly in writing while the operations are still ongoing. That choice is not an accident, and it’s one that started in the United States with the Mueller investigation. Lots of people thought that it was noteworthy because it involved a sitting president. The real blockbuster part of that investigation was that it happened out in the open and reported to the public on the evidence right down to the full names of the GRU intelligence officers behind it.

Public attribution constrains the adversar’s operational space. It informs allied services. It feeds the case files in the next prosecution. that generates the academic literature like Nizio’s article that locks the attribution into the historical record before Moscow can rewrite it. Now, here’s the analytical question. What does it mean that all three of these conditions are true at the same time? Crypto on a public chain, amateur recruits with no interrogation resistance, counter intelligence services publishing in real time. It means Russia has nothing left to protect. In a competent intelligence operation, the things have to wait 25 years for declassification are the sources, the methods, and the cover infrastructure.

The Russian campaign in central and eastern Europe post 2022 has none of those. The sources are recruited on Telegram in the open. The methods are the methods of a public app and a public blockchain and some idiot instructions to firebomb something out in the open. The cover infrastructure already lives in. There is no agent network to protect because there are no agents per se. There are gig workers. There’s no method to protect because the method is documented in every telegram log and there’s no training. There’s no cover to protect because there’s no cover at all. The amateur character of the operation has stripped away every category of information that traditionally requires the 25-year delay.

And that in turn tells you something about the strategic character of this war with Russia. Sabotage when it’s done by special forces is an act of war. the use of incendiary devices on westernbound aircraft. The severing of undersea cables in the Baltic, the plot to derail trains carrying NATO equipment to Ukraine, the attempt to assassinate the president of a co-belligerant. These are acts of war. The fact that the operatives doing them can’t do sit-ups doesn’t change the legal character. It just means that the war is being prosecuted incompetently and the West has made a deliberate choice in how to respond. Not article 5 courts sanctions prosecutions under 18 US code 951-956 2332 public attribution by BIS capo VSSD SAB multilateral intelligence cooperation through the NISU report architecture continued material support to Ukraine that is what fighting a sabotage war the smart way looks like against an adversary too degraded to fight it competently Russia’s producing case files faster than its own services can absorb the losses.

The West is converting those case files into law, into sanctions, and through scholars like Nizio into the historical record. In the Cold War, the historians waited 25 years to write the book because the operation was good enough that the protection still mattered. In this war, the historians are writing the book now because the operation is bad enough there’s nothing left to protect. That’s not a sign of Russian reach. That is the sound of a degraded service feeding its own indictment into the academic literature in real time. So the next time somebody tells you that Russia’s intelligence services are everywhere and dangerous and have limitless reach, ask them this. If that were true, if the operation were any good, would Springer Nature be publishing the afteraction report while the war is still on?

I’m Eric Garland. This is Game Theory Today. The case files are open. The blockchain is public. The teenagers are confessing and our enemies are in trouble. No results found TAP TO RETRY