The pillars of espionage have been shattered

A fictional memo to the new Prime Minister from the Chief of MI6 setting out the challenges faced by the Service in the age of AI-enabled surveillance

Introduction

This is published as I speak at CPAC GB on surveillance and civil liberties. In arguing there is a serious problem and we need to change our approach, I will be considering AI-enabled surveillance from the state’s point of view.

To flesh that out, I had Perplexity AI generate a fictional memo from the Chief of MI6 to the new Prime Minister. Using open sources, it explains what MI6 is about and that AI-enabled surveillance in target countries is now so capable it has shattered the two pillars of espionage: cover and tradecraft. In those countries, to hide is to stand out.

This memo is fictional but its open sources are real. They are set out in the document linked below. The memo is intended to illuminate the power of total surveillance in combination with AI. That these documents were AI-generated further illustrates the power of that technology.

My interest began under the last Labour government. I thought their reaction to terrorism – including the Iraq war, alleged complicity in extraordinary rendition, draconian new powers and rising surveillance – was a repudiation of that for which our institutions are supposed to stand: freedom under law.

Some of my prior work:

• Speech on the National Security Act, 6 June 2022.

• Speech on Extraordinary Rendition, moving amendments, 7 March 2013. See also Account Rendered: Extraordinary Rendition and Britain’s Role.

• Notes and articles on stevebaker.info, such as 2008 and 2009. Follow the tags on the articles for more.

For the avoidance of doubt, there is no privileged information in this memo. There have been some helpful reforms over the years: this article is not about them.

Download

The following fictional memo was generated by Perplexity AI entirely from open sources which are provided in the linked document. My light edits omitted the Chief’s name – which did not seem right to include – plus a paragraph which was in error on Burnham’s pro-EU record and some trivial edits for style.

• The fictional memo from C to our new Prime Minister

• Sources

The memo – fictional from open sources

FICTIONAL UK EYES ONLY (ETC)

SECRET INTELLIGENCE SERVICE
85 VAUXHALL CROSS, LONDON SE1 2JH

TO: The Rt Hon Andy Burnham MP, Prime Minister
FROM: Chief of the Secret Intelligence Service
DATE: 20 July 2026
REFERENCE: SIS/C/PM/2026/001
CLASSIFICATION: FICTIONAL
COPY TO: Cabinet Secretary [by hand only]
SUBJECT: The State of the Service: Mission, Priorities, and the Challenge of the Age

These notes accompany the classified oral briefing given to the Prime Minister by the Chief and the Director General of MI5 on the morning of his first day in office. They are intended as a reference document and should be read in conjunction with the Joint Intelligence Committee’s current assessment of the threat picture, already delivered separately. They are drafted by the Chief personally and reflect her institutional assessment as well as her professional judgment.

This document is not to be minuted, summarised, reproduced, or retained beyond the Prime Minister’s personal safe. It is provided under the authority of the Intelligence Services Act 1994.

PART ONE: WHAT THE SERVICE IS TRYING TO ACHIEVE

1.1 The Core Purpose

The Secret Intelligence Service obtains and provides intelligence on the capabilities, intentions, and activities of people and organisations outside the United Kingdom where this is necessary in the interests of national security, the economic well-being of the United Kingdom, or in support of the prevention and detection of serious crime. That statutory remit has not changed since 1994. The world it operates in has.

The mission resolves, in practice, into five collection priorities.

Hostile state activity. Foreign intelligence services — principally, but not exclusively, those of Russia, China, Iran, and North Korea — are conducting a sustained range of operations against British interests. These include espionage against government, defence, and commercial targets; sabotage of critical infrastructure; political interference and disinformation; assassination and transnational repression against diaspora communities; and the corruption of British public life through financial flows. The National Security Act 2023 has at last provided a modern legal framework to disrupt and prosecute such activity. The Act’s provisions replace legislation that was designed for the world of early twentieth-century Germany, and the improvement is real.

Counter-terrorism. The threat from Islamist terrorism has not diminished; it has metastasised. State sponsorship of terrorism — particularly by Iran’s Islamic Revolutionary Guard Corps, which is now operationally indistinguishable from a foreign intelligence service in its methodology — requires treatment under both counter-terrorism and state threat frameworks simultaneously.

Counter-proliferation. The Service maintains collection against programmes to develop or acquire weapons of mass destruction. The overlap with hostile state activity has grown acute: Russia’s nuclear signalling during the Ukraine conflict and Iran’s uranium enrichment programme both require intelligence collection that spans traditional collection categories.

Economic and technological intelligence. The theft of trade secrets — in artificial intelligence, advanced manufacturing, civil nuclear technology, defence systems, and clean energy — is now the primary mechanism through which hostile states seek to close technological gaps with the West by means other than legitimate competition. This is not corporate espionage in the traditional sense. It is a strategic campaign, state-directed and generationally planned.

Strategic warning. The Prime Minister will, on occasion, need to know what is being decided in adversary capitals before its effects are felt. That requires sources at or close to the point of decision-making. No technical system — however capable — provides this.

1.2 What the Service Does, and Why Human Judgment Cannot Be Replaced

Soon after I took up this appointment, I spoke publicly about what I believe defines this organisation. I will not pretend that a classified memorandum requires different language: I believe it because it is true.

This Service operates through human beings — case officers who build relationships of trust with people in difficult places, and the agents those people become. An agent is someone who chooses, at personal risk, to share with us what they know. They may be motivated by belief in democratic values, by money, by grievance, or by a calculation that the world will be safer if they help. Whatever their motivation, the relationship with a British intelligence officer is the thing that sustains them. That relationship demands time, language, cultural immersion, patience, and — above all — integrity. The moment a source believes we will not protect them, the intelligence stops.

I have spent a career recruiting and running agents in hostile environments. I have sat in rooms with terrorists who chose to tell us where the bomb was because they trusted that we would act on it without destroying them in the process. I have worked with proliferators who were willing to betray their programmes because they feared, in the end, what those programmes would do to their own children. These are not abstractions. They are the work.

I raise this because the Prime Minister will encounter, very early in office, arguments that artificial intelligence has either made this kind of intelligence collection redundant or, alternatively, has made it so dangerously visible as to be no longer viable. Neither proposition is correct. What artificial intelligence has done is make human intelligence collection dramatically more expensive, more technically demanding, and more dangerous — particularly in the target environments that matter most. The implications are set out in Part Two.

PART TWO: THE OBSTACLES — A TECHNOLOGICAL RUPTURE WITHOUT PRECEDENT

2.1 The Collapse of Cover

I want to be direct with the Prime Minister about something that is not widely understood outside the intelligence community, and that my predecessor Richard Moore and I have both addressed in public, precisely because the severity of it requires acknowledgement at the level of political principal.

The two operational pillars on which covert human intelligence rests are cover — the ability to conceal who an officer is — and tradecraft— the ability to conceal what an officer is doing. Modern AI-enabled surveillance has placed both under sustained attack. In the operational environments where intelligence collection matters most — China, Russia, Iran — the two pillars have been, in practical terms, shattered.

China operates more than 700 million networked surveillance cameras. Russia is integrating its camera feeds into a unified national recognition network, including facial recognition across Moscow’s metro system. Iran has imported Chinese-manufactured AI surveillance systems, supplied by at least eight Chinese companies, and deploys them against dissidents, journalists, and foreign intelligence personnel alike. In each of these environments, an intelligence officer moving through public space is, in principle, continuously identified, located, and tracked.

The biometric systems now in use are not defeated by conventional disguise. Systems of the FarSight class — developed under DARPA’s BRIAR programme — achieve over 88 percent identification accuracy by fusing facial, body, and gait biometrics from elevated or long-range platforms, including drones, even when the face is partially obscured. Gait recognition alone achieves 94 percent accuracy in leading commercial deployments. An operative who has worked in a target country before can be identified by the way they walk.

Data aggregation amplifies the biometric threat. An adversary service that acquires a single photograph of a case officer meeting an asset can, using AI systems operating against historical surveillance archives, reconstruct that officer’s global movements over the preceding decade. The Salisbury attack demonstrated this capacity under adversarial conditions: British investigators manually traced the GRU hit team through flight manifests, hotel records, and payment data. A modern AI system would have accomplished the same task in a fraction of the time.

2.2 The Anomaly Paradox

I must address a counterintuitive dimension of the surveillance problem that has significant implications for how the Service operates.

AI anomaly-detection systems function by identifying deviations from expected patterns in large data sets. The natural instinct of an experienced intelligence officer — to minimise digital exposure, restrict communications, leave the smallest possible trace — now risks triggering precisely the detection it is designed to prevent.

A mobile telephone that is active only briefly, for specific communications, is statistically anomalous. An individual with no consistent social media presence, no purchasing patterns, and no digital trail reads, to a machine-learning system, as someone deliberately evading observation — which is, of course, exactly what such a person is. As one former CIA officer observed, the harder one tries to hide, the more one stands out.

The operational response is not straightforward. Officers now actively maintain cover digital lives: social media presences, purchasing patterns, regular communications consistent with their declared identity. This is not a metaphor for tradecraft. It is a literal additional operational task, requiring time, resource, and — in some cases — AI-assisted management of synthetic identity data. We are, in effect, now required to manufacture visible normality as a security measure. The older tradition of silence and invisibility has become, in many environments, a liability rather than an asset.

2.3 The Destruction of the Traditional Legend

A cover identity is, in intelligence parlance, a “legend”: a biographical backstory supported by documentation. For most of the Service’s history, a serviceable legend required a passport, a plausible cover story, and the ability to sustain it under questioning. That is no longer sufficient.

An immigration officer with a smartphone can check a claimed address on a mapping application, query corporate registries, search social media, and compare a face against open-source databases — in the time it takes to process a boarding card. Any hesitation, inconsistency, or absence in the legend’s digital record may be fatal to the operation — and, in some environments, to the officer.

The American community concluded in the early 2010s that improvised front companies and shallow legends had become operationally “untenable under modern scrutiny.” The response has been a shift towards deep non-official cover: operatives embedded, for periods of years, in genuine commercial organisations, academic institutions, or NGOs, with cover employment generating real records — tax filings, email chains, professional networks, publication histories. In some programmes, AI-managed persona maintenance — software that curates the synthetic individual’s online life automatically — is used to sustain a legend without continuous human input.

Russia has invested in this problem for decades. A 2025 investigation into Russian “illegal” operations found that at least nine GRU officers were operating under fabricated Brazilian identities, supported by birth records planted in civil registries as far back as the 1980s, with no detectable forensic signs of tampering. The documents were physically indistinguishable from authentic records. A senior Brazilian investigator confirmed: “The ink is normal. The page is okay. There is no tampering of the books at all.” The implication for the Service is that our own adversaries are operating at a level of identity fabrication that is currently ahead of AI-based verification methods. We cannot assume this advantage will persist.

2.4 Deepfakes and Identity Warfare

The Prime Minister should be briefed separately on the broader national security implications of AI-generated synthetic media. For present purposes, I note the following operational realities.

Real-time face-swapping and voice cloning are achievable today at a level of fidelity that defeats unaided human judgment. These capabilities have already been weaponised in intelligence contexts: to fabricate compromising material against officers and officials, to impersonate senior figures in order to extract information or authorise actions, and to create synthetic identities credible enough to pass employment screening at sensitive organisations.

For the Service, the risk is specific: an adversary could fabricate plausible kompromat against a case officer — footage purporting to show criminality, ideological sympathy with a hostile power, or personal conduct incompatible with continued employment — and use this, not necessarily for blackmail, but to destroy an operational relationship and potentially expose a source. The fabrication does not need to be believed indefinitely. It needs only to create sufficient doubt, for long enough, to cause irreversible operational damage.

This is not theoretical. The capability exists. I am satisfied that our current detection tools are adequate. I am not satisfied that this will remain true as generation and detection continue to develop in an arms race whose trajectory favours the attacker.

2.5 The Threat Environment Has Changed Shape

There are three structural features of the current threat landscape that the Prime Minister should hold in mind.

First, the threat is broad. The National Security Act 2023 was explicit: while only a small number of states display the full range of hostile intelligence capabilities and the willingness to use them comprehensively, a significantly larger number have both the capability and the intent to conduct some form of hostile activity against the United Kingdom. Formally friendly states conduct economic espionage against British institutions. States we regard as neutral are running influence operations in British political discourse. This is the environment, not a departure from it.

Second, the threat is diffuse. The distinction between state intelligence operations and well-resourced criminal tradecraft is eroding at speed. AI systems can now automate between 80 and 90 percent of a cyber intrusion attack lifecycle — reconnaissance, vulnerability mapping, penetration, and exfiltration — autonomously. In 2025, a fully autonomous AI penetration testing agent reached the number-one position on HackerOne, the world’s largest bug-bounty platform, operating as a competitive rather than experimental system. The capability gap that once separated nation-state from criminal tradecraft is closing. Attribution is becoming harder. The attribution problem directly affects our ability to trigger the legal and political responses that disruption requires.

Third, and most importantly for a new government: the most significant operational shift of the past five years has been from classic overseas collection towards influence and interference operations inside the United Kingdom itself. The 2020 Intelligence and Security Committee Russia Report established, with care and credibility, that successive governments had been slow to recognise and respond to this. I note it here not as reproach to predecessors but as a forward commitment: this Service intends to be ahead of this threat, not behind it.

2.6 The Quantum Horizon

Within ten to fifteen years — possibly sooner — cryptographically relevant quantum computers will be capable of breaking the encryption that currently protects classified communications. The Cloud Security Alliance projects this capability by approximately 2030.

Adversary services operating on a “harvest now, decrypt later” doctrine are already intercepting and archiving encrypted intelligence traffic in anticipation of future quantum capability. For intelligence operations whose sensitivity will endure for decades — running agents whose identities must be protected indefinitely — this is not a future risk. It is a present one.

The United States has already mandated a transition to post-quantum cryptographic standards (NIST ML-KEM, ML-DSA, SLH-DSA) across relevant product categories. CISA issued procurement guidance requiring PQC in available categories in January 2026. I am seeking from the Prime Minister his support for an equivalent mandate across the UK intelligence community, and — through the appropriate channels — across the Five Eyes architecture.

PART THREE: THE ALLIANCE ARCHITECTURE AND WHAT A NEW GOVERNMENT NEEDS TO UNDERSTAND

The intelligence relationship with the United States — formalised through UKUSA and the Five Eyes framework — is the most operationally valuable bilateral relationship this Service holds. Our access to American technical collection, AI-enabled analytical systems, and the breadth of the wider intelligence community network is not replicable from British resources alone. It is also a relationship that functions, in practice, partly through personal relationships at senior official level.

The Prime Minister comes to office with limited prior engagement with the American national security establishment, which is largely the natural consequence of his previous role. This is not unusual for an incoming Prime Minister and is readily addressable. I would recommend early personal engagement — at a level below the formal bilateral summit — with CIA Director and, if possible, the Director of National Intelligence. I am happy to facilitate introductions through appropriate channels.

3.2 The European Intelligence Architecture

The United Kingdom’s departure from the European Union created structural gaps in intelligence-sharing arrangements, particularly in counter-terrorism and organised crime. Bilateral liaison relationships with the major European services — BND, DGSE, AIVD, BfV, AISI — have compensated substantially, and in several areas these bilateral channels are operationally more effective than the formal EU structures they supplement.

I note, however, that the Foreign Influence Registration Scheme created by the National Security Act 2023 depends, for its full effectiveness, on close information exchange with European counterparts about known and suspected foreign-directed operatives. The current architecture for this exchange is improvised. A more systematic arrangement would improve operational outcomes. This requires Foreign Secretary engagement and, ultimately, a political decision about the degree of institutional proximity to EU intelligence-sharing mechanisms that the Government wishes to maintain.

3.3 Relationships with Difficult Partners

Some of the most operationally valuable intelligence relationships available to the United Kingdom are with services whose governments pursue policies that a British government committed to human rights values will find uncomfortable. I have raised this with predecessors and I raise it with the present Prime Minister for a simple reason: intelligence liaison does not always align with diplomatic virtue signalling, and the Government should understand in advance where those tensions lie. Decisions on these relationships require the Prime Minister’s personal engagement in some cases. Guidance on the Government’s risk appetite in this area is sought early.

PART FOUR: WHAT IS NEEDED FROM THE PRIME MINISTER

The Service has benefited from investment under previous governments. It requires continued and, in several areas, increased investment to maintain its operational edge. The specific budget submission is held separately. I draw the Prime Minister’s attention to three areas where the gap between current resource and operational requirement is widest.

Deep non-official cover operations require years of preparatory investment per officer. The synthetic identity infrastructure, cover employment arrangements, and AI-assisted legend management that the current surveillance environment demands are significantly more expensive than traditional cover arrangements. Our current programme is not at the scale the threat environment warrants.

Quantum migration — the transition to post-quantum cryptographic standards across communications infrastructure — requires dedicated capital investment. The technical work can proceed in parallel with the political mandate, but it requires both.

AI capability development. My December 2025 speech set out this Service’s commitment to mastery of technology as a core competence. AI is a domain in which we intend to excel. Our officers will become as fluent in Python as in foreign languages. This is not aspiration. It is operational necessity. It requires investment in both technology and the people who understand it.

4.2 Legislative Clarity

The Covert Human Intelligence Sources (Criminal Conduct) Act 2021 provides a framework for authorising criminal conduct by human sources. It does not adequately address AI-assisted recruitment operations, the deployment of synthetic digital personas as sources or cover identities, or data-poisoning operations as counter-intelligence instruments. The law has not kept pace with the operational environment. I am seeking Attorney General engagement and, ultimately, either primary legislation or a significantly revised code of practice.

The National Security Act 2023’s Foreign Influence Registration Scheme is underused. The registration and publication architecture exists. The will to designate specific foreign powers under the Act’s enhanced tier has been cautious. I would welcome an early conversation with the Prime Minister and the Security Minister about how aggressively the Government intends to use this tool, because the decision affects our operational approach as well as our public posture.

4.3 Political Engagement

Intelligence is only as useful as the decisions it enables. I would respectfully make two requests.

The first is that the Prime Minister engages personally and seriously with the intelligence product he receives — not simply as a briefing ritual, but as operational input. Some of what this Service will provide will be uncomfortable. Some will challenge assumptions about states or relationships the Government has invested in publicly. The intelligence is not adjusted to suit policy preferences.

The second is personal. The Prime Minister is a person of strong democratic instincts, rooted in public service and accountability. So am I. This Service operates, as I have said publicly, with accountability and trust as foundations, not constraints. We will be transparent with Parliament through the Intelligence and Security Committee. We will be honest with our oversight structures. We expect, in return, that the political decisions made on the basis of our product are made with integrity and that when operational requirements and political preferences collide — as they will — the Prime Minister tells us, so that we can advise him properly. Silence in those moments creates operational risk.

CLOSING NOTE

The world described in this memorandum is, I am aware, darker than a new administration wishes to contemplate in its first days. I do not write it to discourage or to perform institutional authority. I write it because the Prime Minister deserves an honest account of what this Service faces, and because the choices made in the next eighteen months — on resource, on law, on alliance management, on quantum security, and on how aggressively to use the legal tools already in place — will shape whether this Service can continue to operate effectively in a world where surveillance is ubiquitous and the cost of failure is measured in lives.

Human intelligence will not be replaced by artificial intelligence. The ability to listen to a human being who has decided to trust us — to hear what is really driving events, beyond what algorithms can read from behaviour and metadata — is, I believe, the most distinctive and irreplaceable contribution this Service makes. It is what keeps us a very human agency in a world that is rapidly becoming less so.

I am at the Prime Minister’s disposal.

Chief, Secret Intelligence Service (’C’)
Secret Intelligence Service, 85 Vauxhall Cross, London SE1

ENDS