I spend an extraordinary amount of time in airports. Between keynote speeches, book events, and the occasional flight that seems determined never to leave the gate, I’ve become something of an expert in airport survival.

So imagine my delight when I discovered that some American airports have secret bars hiding in plain sight.

According to The Washington Post, Denver International Airport has a speakeasy concealed behind a bookcase. JFK has a hidden bar tucked inside a duty-free shop. Portland has one with a secret entrance.

As a former FBI spy hunter, I find this irresistible. Hidden doors, secret passwords, clandestine meetings. All that’s missing is a dead drop and a suspicious gentleman reading a newspaper upside down.

Now I have a new mission between flights.

And unlike most of my former assignments, this one comes with a cocktail menu.

For years, August Hanning occupied one of the most powerful positions in German intelligence. As president of the Bundesnachrichtendienst (BND), Germany’s foreign intelligence service, he was entrusted with protecting the country’s most sensitive secrets.

Now German prosecutors allege he was secretly buying some of those secrets from an insider at the very agency he once commanded.

On October 6, German authorities arrested Hanning and another man identified as Manfred D., a former senior BND official. The allegations describe an extraordinary arrangement in which a former intelligence chief allegedly turned his professional connections into a private pipeline for classified information.

According to Germany’s federal prosecutor, the arrangement began in the spring of 2010, when Hanning allegedly agreed to pay Manfred D. for valuable information from inside the BND.

The payments and disclosures allegedly continued for twelve years, until June 2022.

Manfred D. was no ordinary employee. According to prosecutors, he served as bureau chief for successive BND presidents from March 2012 until March 2026. That placed him close to the leadership of one of Europe’s most important intelligence organizations.

An intelligence agency can spend billions defending its networks against foreign penetration. It can deploy sophisticated monitoring systems, background investigations, compartmentalized access controls, and counterintelligence officers trained to recognize suspicious behavior.

But what happens when the person seeking sensitive information is someone who once ran the organization? Someone who knows the culture, understands the bureaucracy, and has relationships that extend into the agency’s highest offices?

That’s a counterintelligence nightmare.

Prosecutors allege that Hanning used information obtained through the arrangement in his private consulting activities. In one instance, he allegedly prepared an analysis for an employee of a foreign intelligence service.

Authorities have not publicly identified that foreign service, and the allegations do not establish that Hanning was operating as a foreign intelligence agent. The case remains under investigation, and both men are presumed innocent.

Nevertheless, the alleged conduct illustrates a vulnerability that has haunted intelligence agencies for generations.

The most dangerous insider is often the one nobody thinks to question.

I learned that lesson hunting Robert Hanssen.

Hanssen was an FBI agent, a veteran counterintelligence officer, and a man who understood the Bureau’s methods, vulnerabilities, and investigative procedures. He used that knowledge to betray his country for more than two decades.

He knew where the secrets were buried because he had helped protect them.

The parallels to the German allegations are striking, although the two cases involve different conduct and vastly different evidentiary records.

In the intelligence business, relationships are currency. Trust opens doors. Reputation provides cover. And access can survive long after someone leaves an official position.

That’s why insider threats are so difficult to detect. Organizations spend enormous resources keeping adversaries outside their walls while sometimes overlooking the dangers posed by people who already belong.

The German investigation raises a disturbing question: How effectively can an intelligence agency protect its secrets when the people who once controlled those secrets may still have privileged relationships with those who guard them?

The answer will depend on what prosecutors can prove.

But the warning is already clear.

A security clearance can expire. An official title can disappear. The relationships that made someone powerful may last a lifetime.

And in espionage, access is everything.

The FBI knows a thing or two about investigating hackers. Unfortunately, that doesn’t make the Bureau immune to getting hacked.

According to recent reporting, a contractor (believed to be Accenture) responsible for maintaining a third-party-managed FBI platform failed to install a critical security patch.

Attackers the exploited the unpatched vulnerability and the FBI subsequently removed the contractor.

The implications extend beyond an embarrassing security failure.

Systems supporting government personnel and administrative operations can contain information of considerable value to foreign intelligence services and cybercriminals. Depending on what was accessed, such data could support identity theft, targeted phishing, recruitment attempts, or counterintelligence operations.

The full scope of the compromise remains unclear, but the underlying failure is painfully familiar.

A vulnerability was identified. A patch was issued. Someone was responsible for installing it. Then somewhere between responsibility and execution, the system remained exposed.

For an agency charged with investigating some of the world’s most sophisticated cybercriminals, that’s a particularly uncomfortable lesson.

Most organizations have a process for installing security updates. Fewer have a reliable process for verifying that those updates actually worked.

When your IT department or outside provider reports that a critical vulnerability has been patched, ask for confirmation that the update was successfully deployed across every affected system.

A closed service ticket is not proof of a secure computer.

For business leaders, the questions are simple:

Security failures often occur in the gap between what an organization believes has been done and what actually happened.

An 18-year-old Minnesota man allegedly planned to massacre dozens of people at the Mall of America during a crowded cultural celebration. Fortunately, the FBI made sure the rifle he obtained couldn’t fire.

Federal prosecutors charged Sheikhdoon Abdullahi Mohamud after an investigation that allegedly uncovered plans for an ISIS-inspired mass shooting at the shopping center in Bloomington, Minnesota.

According to the Justice Department, Mohamud discussed attacking the mall during an October 24 event and allegedly contemplated killing between 30 and 60 people.

Investigators say he researched previous mass shootings, discussed possible targets, and ultimately moved toward acquiring a weapon.

On October 6, an undercover FBI employee posing as an ISIS associate provided him with an AK-47-style rifle that agents had rendered inoperable.

He was arrested shortly afterward.

The investigation illustrates a critical challenge in counterterrorism: distinguishing extremist rhetoric from genuine operational intent. People can say terrible things without committing crimes. Investigators must establish evidence that a suspect intends to act and has taken meaningful steps toward carrying out a threat.

Here, prosecutors allege that the suspect moved beyond words toward a specific target, timeline, and weapon. Those allegations have not been proven in court, and Mohamud is presumed innocent.

The public record also does not establish that ISIS leadership directed the alleged plot.

The FBI’s undercover operation prevented the supplied weapon from posing a danger to the public. Whether prosecutors can prove the charged offense will ultimately be decided through the judicial process.

Watch Eric discuss the FBI investigation and the alleged Mall of America plot on CNN

If you enjoyed this week’s newsletter, you’ll find even more inside my new book, SPIES, LIES, AND CYBERCRIME. Drawing on my years hunting spies for the FBI, it reveals how espionage, cybercrime, and AI-powered deception intersect—and what you can do to stay one step ahead.

Ready for the next mission?

Already read the book? A quick review on Amazon or Goodreads helps more readers discover it. Thank you for your support.

Please support my sponsors. It only takes a click - no purchase necessary!

Everyone wants a marketing hack that makes growing their business easier.

But according to business guru @MarketingMax (9 figures in attributable revenue delivered to clients), one of the best no-cost marketing hacks is finding the one angle that makes people foam at the mouth wanting what you sell.

Lucky for you @MarketingMax put together a quick 2-page Google Doc breaking down how to find yours in 10 minutes, with 20+ real examples you can steal from.

Steal his marketing hack here→

If someone forwarded you this newsletter, join more than 4,500 readers every Tuesday for practical lessons from the worlds of espionage, cybercrime, artificial intelligence, and the human stories behind them.

This week’s stories share a familiar theme.

A former intelligence chief allegedly exploited trusted relationships to obtain government secrets. An FBI contractor failed to install a critical security patch. And an undercover investigation exposed an alleged terrorist plot before it could become a massacre.

Different threats. Different circumstances. Different consequences.

But each illustrates how security depends on understanding who has access, what they intend to do with it, and whether the safeguards we rely upon are actually working.

Trust is essential. Verification is indispensable.

And sometimes the greatest danger comes from the person who already knows how to open the door.

Until next week, stay safe out there and keep thinking like a spy hunter.

Praemonitus Praemunitus!

Forewarned is Forearmed!

~Eric