The Lawfare Podcast: National Security, Counterintelligence, and Counterespionage – A Guide for the Perplexed

Date: March 18, 2026
Host: Michael Feinberg (Lawfare Senior Editor)
Guest: Derek Piper (Former FBI Assistant Special Agent in Charge, Counterintelligence, Washington Field Office)

Overview

This episode explores the distinctions and overlap between counterintelligence (CI) and counterespionage (CE) within U.S. national security and law enforcement. Against the backdrop of recent high-profile events—including the abrupt firing of an entire FBI counterespionage squad and subsequent U.S.-Iran hostilities—the discussion delves deeply into operational realities, evolving threats, recruitment and investigative skill sets, and the consequences of a politicized counterintelligence environment.

Key Discussion Points & Insights

1. Distinguishing Counterintelligence and Counterespionage

• Definitions and Scope

  • Counterintelligence (CI): Focuses on identifying, monitoring, and disrupting foreign intelligence operations inside the U.S.
    • “Counterintelligence is…identifying foreign spies in the United States, and…figuring out what they’re up to.” – Michael Feinberg (10:59)
  • Counterespionage (CE): Centers on investigating Americans who have been recruited (or volunteered) to work for foreign adversaries, often culminating in criminal cases.
    • “Counterespionage is looking at individuals…who have access to classified material…who have been recruited by those foreign spies…” – Feinberg (10:59)

• Expanding Missions

  • Initially, CI focused narrowly on classic recruitment and spying but has grown to address economic espionage, technology theft, and especially foreign influence.
    • “By the time both of us left…the universe of what counterintelligence entails had probably expanded quite a bit.” – Feinberg (11:39)
    • “I think as technological advances were made…you start walking down that path, it's dangerous because you're going to anger somebody. But how do you not look at this?” – Piper (14:41)

2. The Impact of Technology and Foreign Influence

• Changing Methods:

  • Foreign powers increasingly exploit cyber means for espionage and influence, shifting the landscape for CI professionals.
    • “Back in the day, you had to rely upon those spies who were already here…now they’re doing it over the Internet.” – Piper (13:17)

• Institutional Responses:

  • Establishment and later disbanding of FBI and ODNI foreign influence task forces highlighted evolving priorities and new vulnerabilities.
    • “The Foreign Influence Task Force at the FBI has been disbanded…if they're not being made, we're going to have a natural experiment in what happens.” – Feinberg (16:41)

3. CI vs. Counterterrorism: Nature of Failures

• Consequences Differ:
  • Counterterrorism failures have immediate, visible consequences; CI/CE failures often manifest years later, yet can be hugely consequential for national security.
    • “If you drop the ball in counterterrorism, people are going to die then and there…Counterintelligence…might not be clear for a decade.” – Feinberg (17:35)

4. Recruiting and Handling Sources – CI Skill Sets

• Specialization in Skill Sets:

  • Some agents excel at recruiting human sources; others are better at ‘handling’ them for intelligence.
    • “Handling is not the first date. It’s the living with them.” – Piper (24:07)
    • “All about the recruiting is building that initial trust, handling is keeping that trust…” – Piper (24:35)

• Training Gaps:

  • Quantico and early-career training often leave agents unprepared for CI/CE realities; most learning is on-the-job and mentorship-based.
    • “Quantico…doesn't do a real good job of preparing agents for counterintelligence work.” – Piper (07:58)
    • “You could do all the simulations…there’s nothing that is a substitute for real life experience.” – Feinberg (27:46)

5. Transitioning From CI to Counterespionage

• Different End Goals:

  • “A really successful counterintelligence case…ends in a recruitment. A real successful counterespionage case probably ends in an arrest.” – Feinberg (28:41)

• Hybrid Operational Approach:

  • CE merges intelligence work with criminal procedure, often requiring ‘alternate predication’—that is, developing evidence that can be used in open court even when sources or methods are highly classified.
    • “You may not be able to even use the predication for that case…you better rebuild that in a different way that you can use in court.” – Piper (29:43)
    • “That’s where…having a CI background helps, because you understand the nuances of why information might be more sensitive…” – Piper (30:44)

• Maturity Required:

  • Successful CE agents require emotional maturity, discretion, and common sense; many investigations clear innocent subjects, and not every suspicious lead is espionage.
    • “I always felt like the role of counter-espionage agent should be to understand that there’s huge risks letting that case go on any longer than it needed to go…clear them as fast as you could so they could go back and not have a career that’s…goes down the toilet…” – Piper (34:00)

6. Politicization and Its Consequences

• Politically Sensitive Targets:

  • Many high-profile CI/CE investigations involve politically exposed persons due to the nature of government and international travel, not due to bias.
    • “Once it becomes known that the Bureau is looking at them…the knee jerk reaction is just to label it as…political. You know, and it never was in my experience.” – Piper (40:53)

• Morale and Recruitment Risks:

  • When agents are punished for working legitimate cases, morale plummets and future investigations are jeopardized.
    • “If you worked those cases, you're going to be fired for something as simple as…it was the support staff who…got fired. That just sours the morale of the entire office…” – Piper (45:02)

• Chilling Effects:

  • Public criticism and internal retribution (e.g., after the Crossfire Hurricane FISA fallout) have led to fewer agents volunteering for sensitive assignments and fewer surveillance applications being filed.
    • “If you look at…the DOJ Inspector General…after Crossfire Hurricane, and then you look at…the publicly released numbers for how many FISAs were sought the year after…It's a cliff.” – Feinberg (47:19)

Notable Quotes & Memorable Moments

• On the Timelessness of Espionage:

  • “Espionage is what, the second oldest profession…The technology is different, but…the goals and the aims are really the same—to get an advantage over your global adversary.” – Piper (00:35, 13:21)

• Dichotomy of Failures:

  • “Every single one of those [WWII] deaths is a counterintelligence failure because we didn’t get ahead of figuring out what the Japanese or the Germans were trying to do to us.” – Feinberg (18:06)

• CI/CE Investigations and Justice:

  • “The presumption of innocence actually is real…work it hard, work it fast, figure out if it’s real, but the assumption can’t be this is the next Hanson; then you’re thinking about the outcome as opposed to following the evidence and the facts.” – Feinberg (39:12); Piper (39:17)

• On Professional Detachment:

  • “I went through my 21 years, and I don’t think anybody could tell you how I voted, if I voted… I would vote A for adult.” – Piper (44:39)

• Workforce Consequences:

  • “When we had…special counsels…the agents who were brought in to those cases got so slammed that you couldn’t get them to volunteer or even assist with other legitimate cases…” – Piper (45:02)

Important Timestamps

• 00:35 – Espionage as a timeless profession and its core goals
• 03:17 – 08:00 – Derek Piper’s career overview and firsthand context
• 10:52 – Core definitions and distinction recap between CI and CE
• 13:14–16:41 – Evolution of CI focus: Foreign influence, cyber, economic espionage
• 17:35 – Comparing consequences of CI and CT failures
• 22:42 – Source recruitment vs. handling skills
• 28:32–30:44 – Transition from CI to CE and legal/reputational impacts
• 34:40 – Realities of most CE investigations: false leads, emotional maturity
• 39:43 – The elephant in the room: politicization claims
• 45:02 – Consequences of punishing investigators
• 47:19–49:54 – Declining use of key investigative tools post-controversy

Conclusion

This episode offers a nuanced, insider perspective on the real work of American counterintelligence and counterespionage—contrasting public perceptions with operational reality, and highlighting the dangers of politicization and institutional retrenchment. Listeners gain a clear understanding of roles, risks, and the stakes for national security—from human sources in the field to headline-grabbing political cases and beyond.