The CIA Discovers It Has A Mole

The arrest of former CIA case officer Jerry Chun Shing Lee sheds light on a shadowy counterintelligence drama that has been playing out for nearly eight years. 

Starting around 2010, the Central Intelligence Agency saw some of its most valuable spies inside China go down. This does not mean “going down” in a perp-walk-to-the-courthouse sort of way. This is China: They were executed. 

One was reportedly shot right outside the government building where he worked, just to make sure his coworkers got the message. The lucky ones were imprisoned. According to The New York Times, 18 to 20 CIA sources were blown, making it one of the most damaging counter intelligence losses in agency history. The story of Lee’s arrest is still developing, but much is already clear. 

First of all, Jerry Chun Shing Lee wasn’t some back-room paper-pushing bureaucrat at Langley. He was a “case officer” whose job was helping to recruit foreign spies to spill secrets to the United States. He was supposed to create moles, not become one.

It also appears the Chinese government probably gained access to highly classified information about US assets through electronic means, a mole, or both

According to press reports, intelligence officials have been sharply divided about how exactly all of this valuable intelligence got into Beijing’s hands. News of Lee’s arrest suggests that a mole was involved but certainly does not rule out other possibilities or people.

The FBI has not yet run this case to ground. According to the affidavit by FBI Special Agent Kellie R. O’Brien released recently, FBI agents searched through Lee’s belongings while he stayed at hotels in Hawaii and Virginia in August 2012. 
Those searches found two little books filled with big secrets that included the true names of Chinese assets, operational notes from clandestine meetings, as well as covert CIA facility locations. Now, more than five years later, Lee has been arrested only for unlawful retention of national defense information, not for handing that information over to a foreign government. If there’s another shoe, it hasn’t dropped yet.

It’s also clear that the damage done is big. In addition to blown assets, which take years to develop, and compromised information, which likely revealed American intelligence tradecraft, the organisational aftershocks for the CIA will be significant. 

Counter-intelligence failures are the ultimate betrayal, when one of the agency’s own, someone inside the circle of trust who swore an oath and promised to serve, turns against country and cause. Lee’s coworkers and others are undoubtedly asking themselves what they could or should have known. 

Investigations are undoubtedly exploring what early warning indicators might have been missed and what more could have been done. The heat will be on to learn the right lessons for the future and to tighten security protocols. All of these steps are important and necessary. But it’s a delicate thing, dealing with betrayal. 

Counter intelligence taken too far can create a debilitating, distrustful culture where suspicions run wild, careers can be destroyed, and truth can get lost.  

How do we know? Because we have seen this before. For 20 long years, CIA counter intelligence efforts were led by a boozy paranoid named James Angleton who was seared by the discovery that one of his dearest friends in British intelligence, Kim Philby, was actually a Soviet mole. Philby was eventually sacked and fled to Moscow. Angleton was convinced the Russians had more Philbys in the United States, and he spent his life on a relentless quest to find them, trusting no one, suspecting everyone, and ruining the lives of many. 

At the end of his career he was widely viewed as cagey, uncontrollable, isolated, and drunk. Decades later, the CIA’s own historian charitably described Angleton as someone whose “negatives outweighed his positives.”

The final pages of Lee’s spy story haven’t been written yet. But history suggests some useful lessons about how they should not end.

DefenseOne

You Might Also Read: 

CIA Chief - Trump Picks Pompeo:

US Intelligence Agencies Fear Insiders As Much As Spies:

Secret Arrest Of A National Security Agency Contractor:

 

 

« How To Handle A Cyber Crisis
Insiders Are Behind Most Business Cybersecurity Incidents »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

Cyber Future Foundation (CFF)

Cyber Future Foundation (CFF)

CFF was established to create a cyberspace where digital commerce and innovation can thrive based on trust and respect to individual privacy.

Simeio Solutions

Simeio Solutions

Simeio is a complete Identity and Access Management (IAM) solution provider that engages securely with anyone, anywhere, anytime.

Khipu Networks

Khipu Networks

Khipu Networks is an award winning Cyber Security Company delivering a wide range of network, wireless and security solutions, technologies and services across multiple sectors.

National Cyber Summit (NCS)

National Cyber Summit (NCS)

The National Cyber Summit is the preeminent event for cyber training, education and workforce development aimed at protecting our nation's infrastructure from the ever-evolving cyber threat.

Phew

Phew

Phew are New Zealand cyber security specialists with expertise and experience forged in global financial markets, IT&T, management consulting and SME business management.

MrLooquer

MrLooquer

MrLooquer provide a solution to automatically discover the assets of organizations on the internet, determine the level of exposure to attacks and help to manage risk accurately.

Zercurity

Zercurity

Zercurity is on a mission to build the ultimate cybersecurity operations platform for businesses. To help protect against a growing number of internal and external threats.

Cognyte

Cognyte

Cognyte is a global leader in investigative analytics software that empowers a variety of government and other organizations with Actionable Intelligence for a Safer World.

Cyber Tzar

Cyber Tzar

Cyber Tzar is a new approach at dealing with an old problem; assessing and managing risks to your IT estate.

Information Systems Security Association (ISSA)

Information Systems Security Association (ISSA)

ISSA is the community of choice for international cybersecurity professionals dedicated to advancing individual growth, managing technology risk and protecting critical information and infrastructure.

Castlepoint Systems

Castlepoint Systems

Castlepoint Systems is a pioneer in information governance, risk and compliance as a service. An all-in-one solution offering powerful risk management, built in compliance, cybersecurity and audit.

JLS Technology

JLS Technology

Since 2007, JLS Tech has been recognized as one of the world’s most innovative cybersecurity and technology operations leaders.

Lansafe

Lansafe

Lansafe stands as a leading managed service provider in the UK, seamlessly integrating IT, Telecoms, Security, Electrical and Cyber Security solutions.

Silence Laboratories

Silence Laboratories

Silence Laboratories is a cybersecurity company that focuses on the fusion of cryptography, sensing, and design to support a seamless authentication experience.

SixMap

SixMap

SixMap is a continuous threat exposure management platform that automatically provides comprehensive enterprise visibility, contextual threat intelligence, and a suite of remediation actions.

Secure Cyber Management

Secure Cyber Management

Secure Cyber Management provides industry-leading cloud security advice, guidance and services.