The Illegals
Russia's Most Audacious Spies and Their Century-Long Mission to Infiltrate the West
By Shaun Walker, reviewed by Major Christian P. Woo
Article published on: June 1, 2026 | Army Lawyer, 2026 Issue #2
Read Time: < 14 mins
We are engaged in war with the Soviet Union. This war does not for the moment involve men in arms; it involves information.1
Beginning in ancient times, countries have utilized spies and saboteurs to secretly gather intelligence and obtain advantages over their adversaries.2 British journalist and author Shaun Walker provides a timely, in-depth look into how Russia, one of America’s greatest strategic competitors,3 has employed spies against the United States in his book, The Illegals: Russia’s Most Audacious Spies and their Century-Long Mission to Infiltrate the West.4 Released on 17 April 2025, The Illegals is not just a must-read for fans of The Americans,5 Bridge of Spies,6 or any other book, film, or TV series of the spy-fiction genre. It offers judge advocates (JAs) entering U.S. European Command (USEUCOM), the Intelligence Community (IC), or Special Operations Forces (SOF) a comprehensive history of Russia from the early 1900s to the present day, as well as a glimpse into the types of complex legal issues that are inherent to the practice of intelligence law in great power competition.
Based on hundreds of interviews that he personally conducted with former Russian spies, their descendants, and members of the American IC,7 Walker provides a riveting account of Russia’s “illegals” directorate, which he describes as “the most secret part of one of the world’s most secretive organizations.”8 The term “illegal” was first used by Vladamir Lenin, Soviet Russia’s first head of state, in the lead-up to the Bolshevik Revolution.9 During that time, Lenin differentiated “legal” work that could be done overtly by individuals using their real names, from illegal work, which—in this context—refers to clandestine activities executed by Russians who “disguised their real purpose and often their real identities too.”10
From start to finish, The Illegals provides a comprehensive history of Russia through anecdotes of select illegal operatives employed in various capacities throughout the country’s history.11 Assuming that the illegals program is still active today, its operatives undergo years of training12 and are, at times, assigned a prearranged spouse.13 Once they are deemed ready for the field, these individuals are then sent into foreign countries under deep cover to extract intelligence from sources;14 report on current events and the political climate;15 seduce or blackmail individuals for information or placement and access;16 and, at times, assassinate perceived political rivals.17
Ultimately, Walker questions whether the benefits of Russia’s secretive program are worth the costs considering the resources needed, the toll it takes on operatives, and the program’s failures.18 Since Russia often embellishes operatives’ successes19 and all the reports are heavily classified, it is unlikely anyone outside of the highest levels of Russian government will ever truly know. Nevertheless, The Illegals provides several takeaways for JAs who will advise clients within the Department of War (DoW) on secretive intelligence operations (INTOPS).20 First, the book serves as a case study on the “logistical marathons”21 required to successfully employ deep cover today. Second, the book illustrates how countries like Russia have adapted to today’s new virtual environment.22 Finally, the book highlights several legal and risk-based issues that JAs should be aware of when advising in this area of the law.
Deep Cover: “Logistical Marathons”23 Required
First, if there is any takeaway from The Illegals, it is that there is an immense amount of training and supporting infrastructure required to successfully conduct deep cover operations.24 Despite years of preparation by the Russian government and individual operatives, many illegals were ultimately caught, put on trial, and deported back to Russia.25 Given significant advances in ubiquitous technical surveillance (UTS) technologies that have occurred following the major events described in The Illegals, Walker’s point that “logistical marathons”26 are required to deploy a deep-cover operative will only become more true over time.
While Walker highlights a number of illegal operatives throughout the program’s history, the last two he covered extensively were Andrei Bezrukov and Elena Vavilova.27 Andrei and Elena were two illegals who secretly lived in the United States as “Don Heathfield” and “Ann Foley,” respectively.28 Well before “Don” and “Ann” arrived in the United States, Russia conducted extensive research to discover that the real Don Heathfield and Ann Foley were Canadian citizens born close in time to Andrei and Elena, but died as infants—making them prime identities for the spies to assume.29
In order to effectively “become” Don and Ann, Andrei and Elena underwent years of training where they “mold[ed] their language, mannerisms, and identities into those of an ordinary Canadian couple.”30 Once their training was complete, Andrei and Elena staged a meeting in Canada, “wed” as Don and Ann, and eventually had two sons—neither of whom knew their parents were secretly spies.31 In spite of all of this, Don and Ann were eventually arrested by the Federal Bureau of Investigation (FBI)32 after the United States flipped a Russian illegal support officer who gave them up.33 Based on the support officer’s tip, the FBI subsequently bugged Don and Ann’s phones, went through their trash, and found a set of photographic negatives in a safe-deposit box at a local bank that linked them to the Soviet Union.34
Don and Ann’s arrest occurred in 2010.35 Since then, many countries’ surveillance capabilities have significantly improved, due in large part to the rise of UTS.36 This UTS threat is perhaps best articulated in a U.S. Department of Justice (DoJ) Office of the Inspector General (OIG) report, in which the FBI defines UTS as “the widespread collection of data and application of analytic methodologies for the purpose of connecting people to things, events, or locations.”37 A prominent example of an adversary’s UTS capability is China’s facial recognition software and extensive closed-circuit television (CCTV) network,38 which Chinese state media claims is capable of “scanning the faces of China’s 1.4 billion citizens in just one second.”39 Another is Russia’s new biometric data collection procedures for individuals entering the country.40
Despite only a few mentions of U.S. intelligence agencies, The Illegals should nevertheless be required reading for JAs assigned to USEUCOM, the IC, and SOF, as it illustrates to the difficulty of employing deep cover today and presents several legal and non-legal issues to consider when advising commanders and staff on these high-risk, low-visibility operations against strategic competitors.
Given the new, pervasive ways to track individuals and the increased scrutiny on travelers today, it is likely that Don, Ann, and some of the other illegals in Walker’s book would have been caught much sooner in today’s UTS environment. It is also likely that the James Bond-esque practices of donning disguises and using alias passports are now relics of the past. The takeaway for JAs is that the employment of deep cover by the United States and its adversaries will inevitably become more difficult and require more resources as UTS capabilities continue to rapidly evolve and improve over time.
The Rise of Virtual Illegals41
Following his recounting of the arrest of Don and Ann, Walker briefly dedicates one chapter to Russia’s use of virtual illegals (fake online personas and social media accounts) to influence American elections.42 Although never explicitly stated by Walker, the virtual illegals are a natural consequence of decades’ worth of failures of Russia’s deep-cover illegals program. Given the “logistical marathons”43 required to deploy a deep-cover operative today, as well as the increased use of smartphones and social media,44 the United States may continue seeing more of these online personas in the virtual domain, and perhaps less of the traditional illegals in the future.
If the “logistical marathons”45 required for deep cover are the first takeaway from The Illegals, a close second is the continued failures of the program—which were largely due to the emotional and psychological tolls that living a double-life took on individual operatives.46 While Walker does highlight some early success stories,47 the book is replete with examples of operatives who abandoned their posts,48 became double-agents who turned on Russia,49 morally struggled with infidelity and lying,50 and questioned whether their sacrifice had been worth it after returning to Moscow.51 Even Dmitry Bystrolyotov, who was deemed the “greatest of the Great Illegals,”52 once said, “Working in intelligence not only disfigures your life and soul; it does the same to strangers who are forced to become involved in it.”53 In a plea to Moscow while actively serving in the field, Dmitry separately wrote, “I no longer have any joy in successes or love for the work; I just have the recurring thought that it would be good to go to bed at night and never wake up again.”54
Although Walker does briefly note that the Internet made it “easy to create virtual illegals,”55 the deeper conclusion is that the virtual illegals program utilized in 2016 was a natural evolution away from the troubles of traditional illegals. Because virtual illegals are just ordinary Internet “trolls” operating out of Russia,56 they do not have to complete the years-long training pipeline or endure any of the heartache or stress that deep-cover illegal operatives in the field do. As a result, these online trolls are at significantly less risk of alcoholism, burnout, depression, divorce, and otherwise succumbing to the pressures of being a spy that was the undoing of so many illegals who operated exclusively in the shadows of the human domain before them.
The use of virtual illegals is not without tradeoffs. Regarding effectiveness, Walker fairly notes that “[m]easuring the real-world impact of these troll-illegals is difficult”57—a similar criticism of DoW military information support operations (MISO) andinformation operations (IO) writ large.58 However, Walker claimed that many modern-day illegals like Andrei and Elena were simply reporting back on potential leads or the political climate in the United States;59 they were not carrying out any assassination attempts or elaborate sabotage missions like their predecessors were. If it is true that Russia’s deep-cover illegals truly “were not up to much that would trouble U.S. national security interests”60 and were only engaging in activities that could be done just as effectively in the online domain (i.e., spotting and assessing bloggers who take pro-Russian positions or monitoring American discourse on social media platforms), then perhaps America may see a continued rise of these virtual illegals and less of a reliance on traditional illegals in the future. For JAs serving at the U.S. Army Counterintelligence Command (USACIC) who are involved in the prosecution of U.S. espionage cases, an understanding of this new virtual threat is critical.
Legal (and Non-Legal) Considerations for JAs
Although The Illegals predominantly focuses on Russia’s Directorate S and only sparingly mentions U.S. agencies such as the Office of Strategic Services (OSS),61 the Central Intelligence Agency (CIA),62 and the FBI,63 it is impossible for JAs not to wonder about the legalities and inherent risks involved if these operations were carried out by DoW personnel. JAs who are new to the practice of national security law or intelligence law may wonder if the DoW possesses the capability to conduct these types of secretive operations, and if so, which agencies are responsible for doing so. Moreover, they may wonder what authorities would be needed, and whether they would be able to effectively advise commanders and staff on these types of activities.
At the outset, it is crucial for JAs to know that a number of DoW entities, such as the Defense Intelligence Agency (DIA),64 National Security Agency (NSA),65 and elements within U.S. Special Operations Command (USSOCOM), conduct secretive operations.66 Of note for JAs, these operations are generally executed under either Title 1067 or Title 5068 of the U.S. Code. The authorities used will ultimately drive the approval process.69 To the extent that Title 10 authorities are utilized, specific pots of money are tied to these types of operations. These include Defense Intelligence and Counterintelligence Expense (DICE) funds,70 Clandestine Operational Preparation of the Environment (COPE) funds,71 and programs specific to the use of sources and surrogates to conduct irregular warfare (IW).72 These activities are also generally coordinated and deconflicted with relevant stakeholders within the IC.73 JAs entering an intelligence assignment must understand the various authorities that can be utilized, as well as “who’s who” in the IC, to ensure unity of effort against strategic competitors like Russia.
Finally, it is important for JAs to be able to identify risk areas and assess how much risk a commander may be assuming. To highlight just a few of the risks presented in The Illegals, there is always the possibility of operatives being arrested or captured and turned into a double agent for employ against the United States.74 With regard to the former, JAs must know which status of forces agreements (SOFAs) are in place in the event of an incident involving U.S. personnel in another country. Moreover, if an individual is caught spying in another country and put on trial for espionage, this would inevitably erode trust between the two states and potentially lead to increased scrutiny on U.S. tourists traveling abroad. In addition to requiring a mastery of the law, Army Field Manual 3-84, Legal Support to Operations75 directs Army JAs to provide principled counsel to commanders.76 Doing so requires effectively advising on legal and non-legal risks. JAs must be able to properly distinguish between legitimate legal issues and decisions on risk that are within the purview of the commander’s decision space and advise accordingly.
Conclusion
In closing, The Illegals provides readers with a unique history of Russia through accounts of several illegal spies operating “in the grey” during pivotal moments in the country’s history. While Walker’s skepticism of the illegals program is supported by many of the program’s failures, only the Russian government knows the true extent of the program’s successes and whether those successes warrant its continuation. Despite only a few mentions of U.S. intelligence agencies, The Illegals should nevertheless be required reading for JAs assigned to USEUCOM, the IC, and SOF, as it illustrates to the difficulty of employing deep cover today and presents several legal and non-legal issues to consider when advising commanders and staff on these high-risk, low-visibility operations against strategic competitors. TAL
Notes
1. Bridge of Spies, Prime Video (DreamWorks Pictures 2015).
2. See Sun Tzu, The Art of War ch. XIII (Lionel Giles trans., Luzac & Co. 1910) (n.d.).
3. See generally U.S. Dep’t of War, 2026 NDS: National Defense Strategy 18–19 (23 Jan. 2026) (describing the threat posed by Russia).
4. Shaun Walker, The Illegals: Russia’s Most Audacious Spies and Their Century-Long Mission to Infiltrate the West (2025).
5. The Americans (FX, 2013–2018).
6. Bridge of Spies, supra note 1.
7. Walker, supra note 4, at 11.
8. Id.
9. Id. at 18.
10. Id.
11. See generally id. (telling the history of Russia from before the Bolshevik Revolution to a recent prisoner swap that occurred in 2024).
12. See id. at 153–72 (describing the recruitment and training of Yuri Linov, an “illegal” operative).
13. .See id. at 173–81 (describing Yuri’s prearranged marriage to his wife, Tamara).
14. See id. at 36–37 (describing how Dmitry Bystrolyotov, the “greatest of the Great Illegals,” was engaged to a twenty-nine-year-old secretary at a French embassy to exploit her for information, only to dump her once his handlers no longer needed what she was supplying).
15. See id. at 329 (describing a request for information from the “Center” on “[then-President] Obama’s goals as well as for intel on what arguments or enticements his team planned to use to ‘lure’ Russia into cooperation”).
16. See id. at 44–45 (describing how Dmitry was “prepared to give Ernest Oldham another nasty shock,” but later slept with Ernest’s wife, Lucy).
17. See id. at 80–86 (describing how an “illegal” infiltrated Leon Trotsky’s villa in Mexico City and killed him with an ice pick).
18. Id. at 350–51 (“But the available evidence suggests that, for all the ambition, the program routinely failed to deliver. For every illegal who achieved something useful for Moscow, there were a dozen living frustrated lives that bore little espionage fruit.”).
19. Id. at 349 (“In the new environment of forced patriotism, these inconvenient historical facts were simply rewritten. All illegals were now portrayed as heroes, and their achievements wildly exaggerated, whether they were long since retired or more recent returns.”).
20. Joint Chiefs of Staff, Joint Pub. 2-0, Joint Intelligence, at GL-15 (26 May 2022) (C2, 5 July 2024) (defining “intelligence operations” as “[t]he variety of intelligence and counterintelligence tasks that are carried out by various intelligence organizations and activities within the intelligence process.”).
21. Walker, supra note 4, at 351 (“The logistical marathons required to conjure illegals into life were often wildly at odds with the modest returns the operatives provided after deployment.”).
22. Id. at 337–45 (describing the use of “virtual illegals” during the 2016 U.S. presidential election).
23. Id. at 351.
24. Id. at 153–72.
25. Id. at 332–36 (describing the arrest of Andrei and Elena and how they pled guilty with eight other illegals before being returned to Russia).
26. Id. at 351.
27. Id. at 283–336 (describing the recruitment, training, and eventual arrest of Andrei and Elena).
28. Id.
29. Id. at 292.
30. Id. at 5.
31. Id. at 332 (“Alex was sure this was a case of mistaken identity . . . he remained certain it was all a terrible mistake.”).
32. Id.
33. Id. at 314–18.
34. Id. at 317–18.
35. Id. at 6.
36. See Ubiquitous Technical Surveillance Demands Broader Data Protections, Glob. Cyber Sec. Rep. (July 25, 2025) [hereinafter Global Cyber Sec. Rep.], https://globalcybersecurityreport.com/strategy-threats/2025/07/25/ubiquitous-technical-sur-veillance-demands-broader-data-protections [https://perma.cc/7HJG-2FTX].
37. Off. of Inspector Gen., U.S. Dep’t of Just., 25-065, Audit of the Federal Bureau of Investigation’s Efforts to Mitigate the Effects of Ubiquitous Technical surveillance 1 (June 2025) [hereinafter DoJ OIG Report].
38. Global Cyber Sec. Rep., supra note 36.
39. Dave Davies, Facial Recognition and Beyond: Journalist Ventures Inside China’s ‘Surveillance State,’ NPR (Jan. 5, 2021, 12:50 ET), https://www.npr.org/2021/01/05/953515627/facial-recognition-and-be-yond-journalist-ventures-inside-chinas-surveillance-sta [https://perma.cc/Z7BR-J7ML].
40. Global Cyber Sec. Rep., supra note 36.
41. Walker, supra note 4, at 337.
42. Id. at 337–45.
43. Id. at 351.
44. Fabio Duarte, Time Spent Using Smartphones (2026 Statistics), Exploding Topics (Jan. 9, 2026), https://explodingtopics.com/blog/smartphone-usage-stats [https://perma.cc/P3QJ-SDUG].
45. Walker, supra note 4, at 351.
46. Id. at 347–48 (stating that the “toll that illegal work took on so many operatives was simply glossed over,” describing a specific instance where one illegal operative and his wife were “forced to leave their newborn baby at home with a grandparent when they set out for their first mission abroad,” and that his wife soon began having “terrible headaches” and was “withdrawn from service”).
47. Id. at 118–37 (describing the successes of Iosif Grigulevich, an illegal who successfully maintained a cover as “Teodoro Castro,” a Costa Rican diplomat).
48. Id. at 302 (“Some [illegals] decided to pack up and go home. . . . In 1991, they had simply gone dark, and the agency, consumed with reorganization, had forgotten all about them.”).
49. Id. at 314–36, 335 (describing how Alexander Poteyev’s betrayal of Russia “decimated the SVR’s illegal networks, and not only in the United States”).
50. Id. at 53 (stating “how the cheating and lying gnawed at [Dmitry Bystrolyotov’s] conscience”).
51. Id. at 63 (stating that Dmitry was subsequently imprisoned in Russia for being a “double illegal,” and “sentenced to twenty years of hard labor. When he was eventually released, in 1954, he emerged disillusioned and broken . . . .”).
52. Id. at 32–53.
53. Id. at 53.
54. Id.
55. Id. at 342–43.
56. Id. at 342.
57. Id.
58. See Christopher Paul Jessica Years, Colin P. Clarke, & Miriam Matthews, RAND, Assessing and Evaluating Department of Defense Efforts to Inform, Influence, and Persuade (Apr. 17, 2025), https://www.rand.org/pubs/research_reports/RR809z1.html [https://perma.cc/9259-Q89B].
59. See Walker, supra note 4, at 323 (describing Andrei sending reports back to Moscow on potential sources).
60. Id. at 330.
61. Id. at 110 (briefly noting that the Office of Strategic Services (OSS), “America’s first dedicated foreign intelligence agency,” collected intelligence and executed covert operations).
62. Id. at 415–16 (listing all mentions of the Central Intelligence Agency (CIA) throughout the book).
63. Id. at 417–18 (listing all mentions of the Federal Bureau of Investigation (FBI) throughout the book).
64. See The Role of Intelligence in the Department of Defense: Hearing Before the Subcomm. on Intelligence, Emerging Threats and Capabilities of the H. Comm. on Armed Servs., 113th Cong. 15 (2013) (statement of Lieutenant General Michael T. Flynn) (“DIA gains vital information from our highly specialized overt and clandestine human intelligence (HUMINT) activities.”).
65. Joanna Walters, NSA ‘Hacking Unit’ Infiltrates Computers Around the World – Report, The Guardian (Dec. 29, 2013, 2:41 PM ET), https://www.theguardian.com/world/2013/dec/29/der-spiegel-nsa-hacking-unit-tao [https://perma.cc/23BT-R9G9].
66. The Future of U.S. Special Operations Forces: Ten Years After 9/11 and Twenty-Five Years After Goldwater-Nichols, Hearing Before the Subcomm. on Emerging Threats and Capabilities of the H. Comm. on Armed Servs., 112th Cong. 62 (2011) (statement of Michael D. Lumpkin, Assistant Sec’y of Def.) (“USSOCOM and the CIA currently coordinate, share, exchange liaison officers and operate side by side in the conduct of DoD overt and clandestine operations and CIA’s covert operations.”).
67. See, e.g., 10 U.S.C. § 164 (describing authorities of combatant commanders).
68. See, e.g., 50 U.S.C. § 3093 (describing approvals for covert action; often referred to as the “Covert Action Statute”).
69. Contrast id. (requiring a presidential “finding” for each covert action), with 10 U.S.C. § 164 (providing combatant commanders with the authority to carry out missions assigned to their respective commands).
70. 10 U.S.C. § 429a.
71. Id. § 127f.
72. Id. § 127d.
73. See Intel. Cmty. Directive 304, Human Intelligence (9 July 2009) (partially redacted copy on file with author).
74. Walker, supra note 4, at 314–36 (describing how Poteyev’s betrayal as a double-agent led to Andrei and Elena’s arrests).
75. U.S. Dep’t of Army, Field Manual 3-84, Legal Support to Operations (1 Sep. 2023).
76. Id. para. 1-4.
Authors
MAJ Woo is an LL.M. candidate at Georgetown University Law Center in Washington, D.C.