Can A Computer Catch A Spy?

Dec 8, 2019
Originally published on January 7, 2020 1:46 pm

Thirty years ago finding a traitor required intuition, a kind of sixth-sensy feeling that something wasn't quite right. Before the Internet, widespread GPS and Google, it required paper trails, human intelligence and gumshoe investigations. Sandy Grimes experienced that firsthand, though almost by accident: She lost a source.

Sandy Grimes joined forces with a small task force to try to find a mole at the CIA. They called the search Operation Playactor.
Olivia Fields for NPR

"Working in this kind of business you have a personal relationship with those people who when they agreed to work for the United States government put their lives in our hands," she said, which is why she may have taken it so personally when one of the spies she was running, a KGB official in Lagos, Nigeria, disappeared.

"He didn't appear for the first re-contact, didn't appear for the second re-contact," she said. It turned out he had been arrested, the first in a roster of Soviet double agents who were discovered to be working for the West. "One after another we were losing them," Grimes said, "And you couldn't cut it any other way: We failed them."

The big mystery was whether the agency was dealing with a spy in the ranks or a code breaker in Moscow. Had today's analytics existed back then, it might have sped up the process of discovery. Modern algorithms would have racked and stacked employee locations, found suspicious patterns in their work habits and tracked their movements.

But back then, in the late 1980s as the Cold War was drawing to a close, all the CIA could really count on were seasoned intelligence professionals like Grimes. So, in 1991, the agency launched an investigation called Operation Playactor. It largely comprised a small task force with Grimes, a young Office of Security employee named Dan Payne, a longtime CIA analyst named Jeanne Vertefeuille, and two FBI agents, Special Agent Jim Holt and a Soviet analyst named Jim Milburn. ("We called them Jim Squared," Grimes said.)

Sandra "Sandy" Grimes, who worked at the CIA from the late 1960s, at home in Great Falls, Va. As one of the investigators in Operation Playactor, Grimes created a chronology that was instrumental in identifying Ames as a spy.
Nikki Kahn/The Washington Post via Getty Images

The investigation was one that required spreadsheets, paper files and interrogations, and after months of chewing through all those analog tools the team managed to narrow its list down to about 150 CIA employees — far too many people for a small team to suspect or investigate. So they came up with an incredibly unscientific solution: They asked each other to list the names of five or six people at the agency who made them uneasy and then ranked them.

While some of the names on the team lists overlapped, for Grimes there was really only one suspect: someone she had known for years and with whom she'd actually carpooled; someone who had just recently returned from a posting overseas: a man named Aldrich Ames.

A CIA archival portait of Ames. As a member of the agency's Department of Operations responsible for Soviet counterintelligence he became one of the highest-ranking and most damaging spies in U.S. history.
Jeffrey Markowitz/Sygma via Getty Images

The name might ring a bell. As a member of the CIA's Department of Operations responsible for Soviet counterintelligence he became one of the highest-ranking and most damaging spies in U.S. history. And Grimes suspected him for a reason no algorithm would have divined: He just seemed different. "When he came back from Italy in 1989, he was a different human being, truly a different human being," Grimes said, explaining why he topped her list. "It was as if he were surveying his property and it was almost this attitude, 'I know something you don't know.' "

A fishy inventory problem

Around the same time that the Playactor team began its search for a traitor, a data scientist named Jeff Jonas began a new job in Las Vegas. Months earlier he had received a phone call from The Mirage Casino asking if he could build some special software for it. "They said, 'We have an inventory problem,' " Jonas recalled. "And I said, 'Oh, I'm good at inventory systems.' And then they said, 'Good, it's for fish.' "

The Mirage had just opened and already was having a problem it hadn't anticipated: Its landmark 20,000-gallon fish tank was becoming a financial drain. It contained thousands of expensive and rare tropical fish that could not be accounted for. "I think they were spending like a million dollars a year to maintain the fish tank," Jonas said, "and they were trying to keep track of what's eating what."

Jonas ended up creating something that we would now consider one of the early data analytics programs. His software not only tracked the fish but allowed the casino to make better decisions about how it stocked the tank. "I didn't really know at the time that was going to turn into my life's work," Jonas said. Jonas' specialty is matching identities. It began with fish and then moved to people. "Matching identities just happens to be a hard problem," he said.

After Jonas helped the Mirage with its fish program, casinos along the strip began asking him if he could help them modernize their security systems. In the early 1990s, the state of the art for tracking people in Vegas was, literally, a 3-by-5-inch index card. "They were making cards of employees and they would sort it by name and they'd have another set of cards for the same employees sorted by address," Jonas recalled. "It was just like the library but instead of subject, title, author, it would be name, address, phone."

Jonas began by digitizing all those cards, and then he created a system he called Non-Obvious Relationship Awareness, or NORA. "And it kind of earned that name because I started finding stuff that you didn't expect it to find," he said. The system would flag someone at a gaming table who might have had the same phone number as an employee. If someone listed more than one birth date in a lifetime, NORA would identify that, too. "A lot of times data lands and it's no big deal," Jonas said. "But sometimes as data lands it is important." NORA was creating systems that would help focus human attention on those important bits.

Jeff Jonas sits at a computer, creating software that not only tracked the fish from The Mirage but allowed the casino to make better decisions about how it stocked the tank. Eventually, this system would become known as Non-Obvious Relationship Awareness — NORA.
Olivia Fields for NPR

Among other things, NORA focused human attention on a group of college students who seemed to be incredibly lucky at the blackjack tables. They weren't cheating, it seemed. But it was odd that so many young players were doing so well. NORA eventually figured out that those young people were counting cards — and were members of the MIT Blackjack Team. (Card counting isn't illegal, but card counters are typically asked to leave the casino. The team created an "investment" company to spot players cash and then distributed their winnings. Eventually its leading players were banned from most casinos.)

Had Grimes and the CIA team known about NORA, it might have been just the thing they needed to help them find and convict their own suspect.

A very analog system

What Grimes had instead was a kind of human NORA equivalent. Among other things, she had had a long personal interaction with Ames. She observed his behavior, up close, long before he ever fell under suspicion, and she could assess what she considered out of the ordinary behavior for a CIA agent. "During the carpool days, he was always late," she said. "He'd come running out of the apartment, the shirt would be hanging out, different-colored socks on. He was a slob."

An episode involving his wife, Rosario, also gave her pause. Rosario had asked a CIA colleague to send her prenatal vitamins when she and Ames were posted in Rome back in 1988. When Grimes ran into the helpful colleague who had sent the vitamins months later, she was wearing a beautiful Gucci scarf. "Where did you get that?" Grimes asked her. The colleague said Ames' wife had sent it to her after receiving the vitamins. "I said, 'Well, that's quite a gift.' "

In isolation, these things would have meant little, but the NORA system in Grimes' head kept pinging at her as the Playactor team interviewed other suspects. One of the questions they asked everyone on their long list — regardless of their ranking on that list — was this: If you were going to spy, or volunteer, how would you do it? Most of the people they talked to saw the question as a mental exercise; Ames was flummoxed by the question. "He was tongue-tied," Grimes said. "Of course we're not saying anything, right? We're sitting there listening. But afterwards we were just in total shock that he found that question uncomfortable."

It became a data point in a very analog system the team had been creating on its agency computers. Payne, the young FBI agent, started getting warrants for Ames' financial statements and bank deposits. Grimes started pulling together a chronology, listing Ames' various CIA assignments, whom he had reported meeting in Italy, the cases he was working on in America. She added other random data points: When did he come in and out of the office? When did he badge out for a smoke?

She put all this into a word processing document on her computer, which in itself presented some challenges. Every single morning when she would log in she would have to wait 20 minutes for it to load to where she had left off. "Every day it was a frustration," she said. "It was mind-numbing."

Grimes had to build a chronology following her prime suspect's every move. But she had to do it from the bottom up. No spreadsheets. No databases. Just a word processing document that grew to be hundreds of pages long. She had to wait 20 minutes some mornings just for the document to load.
Olivia Fields for NPR

One of the issues was that for the document to be useful and searchable, it needed to be absolutely consistent. You couldn't write March 7 on one day and then write 03/07 the next. There couldn't be any typos or stray spaces. "At the end of the day, I had to go back and review everything I had typed," Grimes said. "And it could be that little piece of information that makes all the difference."

That attention to detail eventually paid off one morning when Payne arrived in the office with an envelope full of financial statements. He fished some deposit slips out of the folder and then started adding the information to a spreadsheet on his computer. And then, as was their habit, he passed the slips over the cubicle wall to Grimes, who would then scroll down to the correct date in the chronology and add them in.

"I just happened to glance at the line above and I went, 'Oh, my gosh, the day before, lunch with Chuvakhin," Grimes said. "And I thought, what a strange coincidence." Sergei Chuvakhin was a Soviet diplomat stationed in Washington. "The second deposit slip comes over the cubicle wall to me." It was a $5,000 deposit in cash made on July 5. Three days earlier the chronology read: Lunch with Chuvakhin. Grimes knit her brow and grabbed the last deposit slip. It was for $8,500 in cash, deposited on July 31. And the chronology showed that on the very same day — Ames had had lunch with Chuvakhin.

"That was it for Sandy," Grimes said, referring to herself by name. "I said, 'You guys won't believe it, this is it — you won't believe it." She ran down the hall to tell the head of the CIA's counterintelligence division, Paul Redmond. "I closed the door and I didn't wait for him, I just said, 'It doesn't take a rocket scientist to see what's going on here: Rick is a goddamn Soviet spy." (Grimes said she and Redmond are still arguing over her exact words. He says she used a more colorful word, one that Grimes said is one of his favorites.)

"The finest case of insubordination I ever met"

The FBI opened a formal investigation into Ames a short time later; but to build the case the bureau depended on what would seem today to be some incredibly analog things: phone taps, listening devices, stakeouts, airplanes, even trash operations.

"Sometimes you have to drill into the wallboard to put the microphones in," said Robert "Bear" Bryant, who would become deputy director of the FBI and who supervised the Ames investigation. "If you have to go into the drywall, you've got to hook up an electric line, but the hardest thing is to get the drywall to match."

This is the first time Bryant has talked publicly about the Ames case. "We put microphones in his car, in his house; we covered the guy almost from the time he left for work." They even had an airplane in the air following him as he drove from his house in Arlington, Va., not far from Langley. "You had one guy with a set of binoculars and he sits there and he looks at the subject when they're moving," Bryant said. "It's the best way not to lose somebody."

FBI agents found this note in Ames' trash in 1993; it refers to a meeting with his KGB contact in Bogotá, Colombia.
The Life Picture Collection via Getty Images

But it was something that Bryant had specifically asked the agents not to do that led them to a break in the case: They did what's known as a "trash cover." "When a person puts their trash out, if it's on public property you can seize that trash and make a search of it," says Bryant. "They did it against my orders."

Then in the fall of 1993, Bryant recalls one of his agents waving a plastic bag with a piece of yellow paper at him as he walked into the office. "I said, 'What the hell is that?' He said, 'We got it out of the trash.' "

It was a note Ames had written to himself about a meeting he was supposed to have with a KGB handler in Bogotá, Colombia. "It was the key to the case, and a big key because we knew where he was going to make a drop. Later, I was asked about it and I said it was the finest case of insubordination I ever met."

A folder in your head

Jonas' non-obvious relationship program in Vegas decades ago has been replaced with something known in the insider threat industry as Entity Resolution. It is an attempt to teach a computer to make the same associations that, without our being fully aware, our brains make almost instantaneously.

Consider the musician Prince. That symbol he used for his name might be one of the first things that came to mind. We don't know how to explain that we associate that symbol with Prince — we just know we do. Then other connections are made: the song "Purple Rain," a purple guitar, a velvet suit.

"All those things you've picked up over time about Prince live in a folder in your head," Jonas explains. "And they came at different times and they were described differently but Entity Resolution rubber-banded [them] together."

Our brains are very good at making connections. "All things you've picked up over time about Prince live in your head," Jonas explains."And they came at different times and were described differently" but you brought them together just the same. Entity Resolution is trying to teach computers to do the same.
Olivia Fields for NPR

What makes Entity Resolution different from traditional algorithms is that instead of chewing through huge datasets to see what it can find, it tries to organize things more like the brain does. It asks: How is a Social Security number like a vehicle identification number or like a serial number on a router? How is a date of birth like a car's make or model? And the way they are the same is they generally all identify a single, discrete thing.

If you find the identical VIN on a roster of cars, the computer notices that and flags it as an anomaly. As the algorithm develops, it might find other things that don't compute. In the case of Ames, it might see that he just paid $400,000 cash for a house but that he makes less than $70,000 a year. The algorithm might flag that as odd, so it probably requires another look.

"Probably the fanciest thing in our algorithm is that it can change its mind about the past," Jonas said. In other words, it can go back in time to see whether a new piece of information suggests a new way to think about what you're analyzing. You see that there is lunch with a Soviet diplomat in D.C. at the end of July; does that raise any questions about those kinds of meetings in the past? Was there a pattern we might have missed?

When Grimes added the deposit slip information to her chronology she happened to glance at the line above and then saw the lunches with the Soviet diplomat. That's an analog version of what Entity Resolution now tries to do.

"That's the story of data finds data," Jonas said. "The thing that gets me about the Ames case ... is you have to wait for humans to have questions; you have to wait for bad things to happen. Today what you would do is take a copy of everything on his personal laptop and once they could peek into his bank account, new data emerges."

Humans need lots of time to process that information. Computers don't. No unwieldy, hand-typed chronologies. And critically, Jonas says, there is little reliance on gut feeling or intuition. "[Making] a list of people we have a hunch about, that's not always going to work," he said. Entity Resolution may be the technology that bridges that gap.

For years before Ames' arrest, it didn't occur to anyone to notice that his work patterns had changed. There were no algorithms that might have put together that he was drinking, had gone through a costly divorce, paid cash for his house, was driving a new car and arrived at the office early and left late. Those were things that Ames himself admitted should have tipped off authorities. It was only something they saw in hindsight.

Ames was arrested Feb. 21, 1994, on charges of espionage. He pleaded guilty in April of that year and was sentenced to life without parole.
Jeffrey Markowitz/Sygma via Getty Images

"What the algorithm has zero insight into is, did that person change their pattern because maybe they had a baby and now they come in at different hours, or maybe they were sick so they've been doing a series of physical therapy in the morning," said Yael Eisenstat, a former CIA analyst who is now a visiting fellow at Cornell Tech. Eisenstat studies the effect of algorithms and technology on society. "There are so many actual human things that could make that abnormality in the pattern, the algorithm isn't going to know," she said.

Which is why algorithms still need humans to put two and two together, like Grimes did. In retrospect, her spidey-sense was more effective than any algorithm could be. Even much later she said that it was Ames' hubris that helped her figure out that he was their man. He thought he was smarter than everyone else and even gave Grimes and Vertefeuille advice on what the Playactor investigation should look for.

"He told me, 'You look at the good cases and you look at the bad cases and see what's different,' " Grimes said. She remembers thinking to herself at the time, "It's a good thing you think I'm so stupid. You know, he thought we were two dumb broads."

Two dumb broads who caught a spy.

Copyright 2020 NPR. To see more, visit https://www.npr.org.

DINA TEMPLE-RASTON (HOST): This is I'LL BE SEEING YOU from NPR, a four-part series about the technologies that watch us. I'm Dina Temple-Raston, and on the show today, how today's algorithms are changing the way we find insider threats. But first, an old-fashioned spy story.

SANDY GRIMES (FORMER CIA OFFICER): Hello. I'm Sandy Grimes.

TEMPLE-RASTON: And do you want to say what you used to do?

GRIMES: And let me see. What did I do for a living? I worked for CIA, was recruited out of college, got married, had a kid. That's sort of the story of my life.

TEMPLE-RASTON: And the reason why we're coming here to talk to you today is...

GRIMES: To talk about catching a spy.

TEMPLE-RASTON: Imagine for a minute how much harder it would be to find a double agent 30 years ago before everyone had the Internet or GPS...

COMPUTER GENERATED VOICE: Turn left.

TEMPLE-RASTON: ...Before Google. Back then, people relied on a kind of sixth sense-y (ph) feeling that something wasn't quite right, balancing suspicion with common sense - something Sandy Grimes, as it turns out, was very, very good at.

Did you ever think you'd describe yourself as a spy catcher?

GRIMES: Did I ever think that I would - no. I didn't catch spies. I was responsible for handling spies.

TEMPLE-RASTON: When you think of a spy catcher, Grimes might not be who you imagine. She has short blonde-gray hair, piercing blue eyes and is bone-thin. She looks almost birdlike. Other CIA agents I've met talk about God and country. Grimes seems more focused on the human element of this, something more touchy-feely.

GRIMES: Working in this kind of business, you have a personal relationship with those people who, when they agree to - as I always say, agree to work for the United States government, they put their lives in our hands.

TEMPLE-RASTON: If I were a spy, I'd trust her, which, of course, is exactly the point. That's what made her so good. Grimes had been working for the CIA for nearly 20 years when one of the spies she was running - a KGB officer in Lagos, Nigeria - went home to Moscow on leave in 1985.

GRIMES: He didn't appear for the first recontact, didn't appear for the second recontact.

TEMPLE-RASTON: He seemed to have disappeared. Then word came down that he'd been arrested in Moscow.

GRIMES: And then we knew.

TEMPLE-RASTON: He was the first one to fall.

GRIMES: One after another, we were losing. They put their lives in our hands, and you couldn't cut it any other way. We failed them.

TEMPLE-RASTON: For years, whatever it was that caused the Soviets to kill those spies remained a mystery. Some were convinced that a mole was in the agency and had betrayed them. Others thought that the Soviets were intercepting secret communications. Then, in 1991, Sandy Grimes was put on a small team and asked to do one thing - find a spy. The operation was given a codename, Play Actor.

GRIMES: There was myself, and there was a young Office of Security employee, Dan Payne.

TEMPLE-RASTON: And a woman named Jeanne Vertefeuille and two FBI agents, Special Agent Jim Holt and a Soviet analyst named Jim Milburn.

GRIMES: They'd call themselves Jim Squared.

TEMPLE-RASTON: And they started with spy catching 101. Which Soviet agents had gone missing, and who knew they'd been working for the Americans? Today, that'd be a pretty simple thing to do. You'd open a spreadsheet, load the files, do a keyword search and then you'd be done. Back in 1991, it required Grimes to go through the case files by hand.

GRIMES: We've got everybody - right? - who had access.

TEMPLE-RASTON: There were more than 150 CIA employees who might have crossed paths with the missing double agents.

GRIMES: There's no way we can investigate 150 people without an army. It's an impossibility.

TEMPLE-RASTON: So they did something incredibly unscientific.

GRIMES: What we did is we ask all four members of our little task force to please list the names of five or six people who made them uneasy and whom they believed we should take a close look at.

TEMPLE-RASTON: What was the definition of uneasy?

GRIMES: We never gave a definition. We all knew what that meant.

TEMPLE-RASTON: And then they were asked to go further.

GRIMES: We ask everybody to put the names in rank order with the one they were most concerned about in first place and so on down.

TEMPLE-RASTON: So if you were working Operation Play Actor three decades ago, you would have compiled a list of suspects and then assigned each of those people a numerical value based on how uneasy they made you. Anyone at the top of the list got six points. Second got five points and so on.

GRIMES: This wasn't a contest you wanted to get the most points.

TEMPLE-RASTON: The team now had a new shortlist of suspects, though for Sandy, there was a clear winner - someone she had carpooled with and had known for years, someone who had just recently returned from a posting overseas.

Why did you put him first?

GRIMES: Because when he came back from Italy in 1989, he was a different human being, truly a different human being. It was as if he were surveying his property, and it was almost this attitude - I know something that you don't know.

TEMPLE-RASTON: People at the agency will tell you the best spies are people who can blend into the background. They're friendly enough, but at the end of the evening, they work to be forgotten. Grimes' top suspect was nothing like that. He seemed to draw attention to himself for all the wrong reasons.

GRIMES: During the carpool days, he was always late, and he'd come running out of the apartment. You know, the shirt would be hanging out, different colored socks on. He was a slob.

TEMPLE-RASTON: And he was miserable at recruiting foreign intelligence sources. Grimes said he just didn't have that extra something that it took to convince someone to betray their country.

GRIMES: You know, to ask anybody the big question, will you work for us, you have to present yourself in such a way that the individual across from you knows they can trust their lives. He doesn't exude that kind of trust.

TEMPLE-RASTON: Which is why she noticed that he seemed so different when he came back from Italy in 1989. She thought about the time his wife Rosario asked a colleague of Grimes' to send her prenatal vitamins in Rome. The two had been posted there. It was in 1988, about three years after the agents first started disappearing. Grimes ran into the colleague about four months later.

GRIMES: And she has a beautiful Gucci scarf - gorgeous. I said, where did you get that? She said, well, Rosario gave it to me, you know, thanking me for sending her the vitamins. I said, well, that's quite a gift.

TEMPLE-RASTON: Again, it was something Grimes just filed away. All on their own, these things didn't mean anything. The team kept interviewing other suspects, and one of the last questions Sandy Grimes and her colleagues asked during the interviews was always the same.

GRIMES: If you were going to spy or volunteer, how would you do it?

TEMPLE-RASTON: Some people were shocked.

GRIMES: Oh, my gosh, you're asking me that? I would never be a traitor.

TEMPLE-RASTON: Others saw the question as a mental exercise. So they'd say hypothetically speaking...

GRIMES: You know, I knew Igor Ivanov (ph) in Jakarta. I'd check to see if he's abroad. If he is, you know, make the contact that way.

TEMPLE-RASTON: But Grimes' friend from the carpool, when he got the question, he looked a little stricken.

GRIMES: He was tongue-tied. Of course, we're not saying anything, right? We're sitting there listening. But afterwards, we were just in total shock that he found that question uncomfortable.

TEMPLE-RASTON: But still, that meant that Grimes didn't have much more than a tingly sense that he might be their man. There were puzzle pieces, but she didn't know how they fit together. So they began to build a timeline, a chronology. It listed his every assignment, his every move. Who had he met with in Italy? Which cases did he work on? When did he come to the office? When did he badge out for a smoke? It was all there in a Word document that Grimes had compiled on her computer.

GRIMES: The worst part was once I got into, you know, maybe 100 pages or 150 pages on the chronology, every single morning when I would log in, you'd like to go to where you left off, right? No, no, no, no, no. That's not how it worked. It started at the very beginning and you sat there. It could be 20 minutes, could be a half an hour.

TEMPLE-RASTON: Before it loaded.

GRIMES: Before it loaded to where you were - yes, where you - yeah, yeah. Every day - it was a frustration. The chronology was mind-numbing.

TEMPLE-RASTON: For a document like that to work, for it to be searchable, it needed to be absolutely consistent. You couldn't write March 7 on one day and then write 03/07 the next. If you did that, you could miss something when you searched.

GRIMES: And you can't have any typos, and spaces have to be perfect. At the end of the day, I'd say the last hour and a half I had to go back and review everything I had typed. And it could be that little piece of information that makes all the difference.

TEMPLE-RASTON: Now, data that's not cleaned up is called fuzzy data, and we'll get to that a little later in the show. The day that everything changed began just like any other. Dan Payne, the young agent we mentioned before, was looking through an envelope filled with financial papers.

GRIMES: Dan had received a package in from one of the Virginia banks where Rick had a checking account.

TEMPLE-RASTON: And Dan fished copies of some deposit slips out of the envelope, and then he started adding the information onto a spreadsheet on his computer.

GRIMES: He passed it over the cubicle wall to me, and I simply added it to the chronology.

TEMPLE-RASTON: She'd scroll down, find the right page.

GRIMES: I just happened to glance at the line above and I went, oh, my gosh, the day before, lunch with Chuvakhin. And I thought, what a strange coincidence.

TEMPLE-RASTON: Sergey Chuvakhin - he was a Soviet diplomat stationed in Washington.

GRIMES: Second deposit slip comes over the cubicle wall to me, and this one is July 5, and it was for $5,000 in cash. OK. I glance at the line above July 2 - lunch with Chuvakhin. The final deposit slip was 31 July, and on this occasion, he deposits - I don't know but a sizable amount.

TEMPLE-RASTON: It was $8,500.

GRIMES: And that very same day, he had lunch with Chuvakhin. Well, that was it for Sandy. I said, you guys won't believe this. This is it. You won't believe it.

TEMPLE-RASTON: Grimes ran down the hall to tell the head of the CIA's counterintelligence division, Paul Redmond.

GRIMES: So I walk in Redmond's office and...

TEMPLE-RASTON: And are you calm and collected or are you kind of excited?

GRIMES: I walked in. I just said, it doesn't take a rocket scientist to see what's going on here. Rick is a [expletive] Soviet spy.

TEMPLE-RASTON: From NPR, this is I'll Be Seeing You, a four-part series about the technologies that watch us. Coming up, we introduce you to one of America's most notorious spies and look at a special kind of computing that experts say can teach computers to think like humans but faster.

UNIDENTIFIED PERSON: It started finding stuff you didn't expect it to find.

TEMPLE-RASTON: I'm Dina Temple-Raston. Stay with us.

TEMPLE-RASTON: This is I'LL BE SEEING YOU from NPR. I'm Dina Temple-Raston, and on the show today, we're looking at how computers are beginning to use human-like intuition and common sense to discover insider threats. It's all premised on the idea that computers can learn to find patterns of behavior that are outside the norm.

The analog version of this has been the standard in spy catching for years, and on today's show, we're looking at one of the most famous of those cases. It started back in the late '80s and early '90s when the Soviets started rolling up double agents who had been working for the West. There were so many agents compromised, the CIA became convinced that there was a mole inside the agency, a traitor in their midst. And they were right. You may remember the story. The head of one of the CIA's Soviet sections, a man named Aldrich "Rick" Ames, had offered himself up to the Soviets in a way that went something like this.

(SOUNDBITE OF TV SHOW, "THE ASSETS")

PAUL RHYS (ACTOR): (As Aldrich Ames) I was supposed to meet one of your attaches 45 minutes ago. My name is Aldrich Ames. I work for the CIA.

TEMPLE-RASTON: That's from a 2014 miniseries called "The Assets."

RHYS: (As Aldrich Ames) I think you'll want to meet with me after he reads this.

TEMPLE-RASTON: And that's pretty close to what happened. Aldrich "Rick" Ames was the man in the office carpool from earlier in the program, he was the one who was tongue-tied when he was asked how he would volunteer to spy for the enemy, and he was the one having lunch with a Soviet diplomat shortly before depositing huge amounts of cash into his bank in Virginia. He was Sandy Grimes' damn spy.

The day he marched into the Soviet Embassy in Washington with a list of Soviet spies working for the West was the day he became one of the highest-ranking and most damaging spies in U.S. history. When officials at the KGB saw his list, they were stunned to see how deeply the Americans had penetrated their ranks.

GRIMES: The KGB had no idea the CIA had so many KGB officers who were traitors to the Soviet Union, so they've got to get them back to Moscow.

TEMPLE-RASTON: That's CIA spy catcher Sandy Grimes, and that's what Moscow did. It started calling suspects back to headquarters. At least 10 double agents were dead within a year. Looking back on it, building a criminal case against Ames required some incredibly analog things - phone taps, listening devices, stakeouts, airplanes. The stuff of today's investigations - long email chains, mirroring hard drives, digital surveillance - they barely existed back then. So the FBI turned to 1990s equivalents, and often, it involved power tools.

BEAR BRYANT (FORMER DEPUTY DIRECTOR, FBI): Sometimes, you had to drill in wallboard and put it in, and then you had to get batteries or get wires so you had power.

TEMPLE-RASTON: That's Bear Bryant. He used to be the deputy director at the FBI, and he was in charge of the Ames investigation. And as a general matter, when you are using analog methods of surveillance, things go wrong - sometimes really wrong, like the time Bryant forgot some tools on the job.

BRYANT: A long time ago, in a land far, far away - no. We were doing a surreptitious entry to put in a microphone in a criminal's home, and all of a sudden, we were getting over the microphone - over the radio, it says, red bird's returning. That meant the bad guy's coming home. We scramble around there, put all our tools and stuff in a bag and we leave.

We got out, and we started counting our tools, and we realized that we were missing one red Craftsman screwdriver. Then, all of a sudden, over the mic about an hour or so later, this lady, who is the subject's wife, says, why do you keep leaving your tools out here on the floor? Get them out of here. And so he picked it up, put it in his toolbox and we listened for another 30 days (laughter). That really happened.

TEMPLE-RASTON: Doing all this was an incredibly time-consuming process. You'd get into the house with keys, you'd have a team, and every job was different.

BRYANT: If you have to go in the drywall, you've got to hook up to an electric line, but the hardest thing is to get the drywall to match.

TEMPLE-RASTON: This is the first time Bear Bryant has talked publicly about what the FBI did to catch double agent Aldrich Ames, and in his telling, it's the kind of stuff you see in the movies.

(SOUNDBITE OF JOHN BARRY & ORCHESTRA'S "JAMES BOND THEME")

TEMPLE-RASTON: OK, maybe it wasn't quite 007 material. Maybe this is better.

(SOUNDBITE OF TV SHOW, "THE F.B.I.")

UNIDENTIFIED ANNOUNCER: "The F.B.I."

TEMPLE-RASTON: That's from a very popular television show in the 1970s called "F.B.I."

(SOUNDBITE OF TV SHOW, "THE F.B.I.")

UNIDENTIFIED ANNOUNCER: Tonight's episode, "The Spy-Master."

TEMPLE-RASTON: And the real-life spy master the FBI was targeting was under every kind of surveillance.

BRYANT: We put microphones in his car, in his house. We covered the guy almost from the time he left for work. We always had coverage on him.

TEMPLE-RASTON: Even an airplane to track him - a small FBI Cessna like this one, flying low over the neighborhoods of Arlington, Va.

BRYANT: We call it the Flying Screw. You had one guy with a set of binoculars, and he sits there, and he looks at the subject. And when they're moving, it's the best way not to lose somebody, but it's dangerous. We flew a lot of hours, and you're always dependent on weather and traffic patterns and so forth and - but it's an effective way, and it works.

TEMPLE-RASTON: Works until someone wonders, what's that plane doing up there?

BRYANT: One Sunday afternoon, I got a phone call from Smoky Burgess, who was the chief of police in Arlington, a dear friend of mine. And I picked up the phone. He said, Bear, your ***damn airplane's too low. I'm getting citizen complaints about your g*****n airplane. Get it up or get it out of here.

TEMPLE-RASTON: So there was an airplane in the air, agents sitting in cars in inconspicuous places. They were watching him at work, listening to him at home. They had human coverage just about everywhere Ames was.

BOB WALLACE (FORMER CIA CASE OFFICER): The house looks very much like it did when he bought it.

TEMPLE-RASTON: We met former CIA case officer Bob Wallace outside Ames' old house, the one that Bear Bryant's team had wired up with microphones. Wallace has written a book on spy sites around Washington, and sometimes he actually does tours of famous places in spy history.

WALLACE: The house is really standard for the neighborhood. What would have been interesting at the time, when he bought the house, his - it was probably about 10 times his government salary at that time.

TEMPLE-RASTON: Wow.

And in the end, it was here, right in front of this gray clapboard with red shutters, that the FBI finally got that piece of the puzzle that gave them what they were looking for - proof that Ames was working for the Russians. It was here that they found buried in the trash the little yellow Post-it note that cracked the case. This is Bear Bryant again.

BRYANT: What happens is, when a person puts their trash out, if it's out on public property, you can seize that trash and make a search of it. And they did it against my orders.

TEMPLE-RASTON: Bryant was sure Ames would spot them or a neighbor would call the police if they were rummaging around in the trash. But agents decided to do it anyway, though they were extra careful. Bob Wallace explains.

WALLACE: In the early hours of the morning, the FBI van would bring by an identical trash can and set it out front, take that trash down to a nearby location, dump out the trash and then bring back the real trash can and make another quick change. They did that several times, until one one day in September, October of 1993, they found a note.

TEMPLE-RASTON: One of Bryant's agents brought the Post-it to the office the next morning.

BRYANT: And he's waving this plastic with this yellow piece of paper in it. I said, what the hell is that? He said, we got it out of the trash. I said, what's on it?

TEMPLE-RASTON: It was a note with details for a meeting Ames was supposed to have with a KGB handler in Bogota.

BRYANT: It was the key to the - really, the case and a big key because we knew where he was going to make a drop. And so later I was asked about it, and I said, it's the finest case of insubordination I ever met.

(LAUGHTER)

JEFF JONAS (CEO, SENZING): The thing that gets me about the Ames case and many others is that the amount of time it takes - you sense something's wrong because you can tell by the things that are happening in the real world that there's a leak.

TEMPLE-RASTON: That's Jeff Jonas. He's a data scientist, and he's known as the wizard of big data.

JONAS: Only the National Geographic called me that.

(LAUGHTER)

JONAS: But they're a respectable source, I'd say.

TEMPLE-RASTON: Jonas founded a big data company called Senzing. And when he talks about things in the real world that should have tipped off the CIA, he means all those Soviet agents who were turning up dead.

JONAS: The problem is - is if you have to wait for humans to have questions, you have to wait for bad things to happen.

TEMPLE-RASTON: By then, though, it was too late.

JONAS: You want systems where, when - as the data's landing, it didn't just put that information in another pile and hoped that somebody someday would ask.

TEMPLE-RASTON: So instead of Grimes scrolling down to the right spot in her chronology to add the deposit slip entry, what if a computer did that for her and, on top of that, noticed that there was a lunch with a Russian diplomat just a day before? This is the kind of thing Jonas is working on now - something called contextual computing or context aware computing. It teaches computers to automatically collect and analyze data about particular surroundings so it can present useful information before you've even asked for it. If you think about it, that's the basis of common sense; it puts something in context so you can make a decision about it. And where did all this contextual computing get its start? It happened in Vegas.

Now, it stands to reason that Las Vegas wants to keep bad people out of its casinos, and that's because if casinos get caught with the wrong people on their gaming floors, they could lose their license.

JONAS: So they really have to understand who is who.

(SOUNDBITE OF FILM, "OCEAN'S ELEVEN")

GEORGE CLOONEY (ACTOR): (As Danny Ocean) This is the vault at the Bellagio. We're going to rob it.

TEMPLE-RASTON: You've seen "Ocean's Eleven."

(SOUNDBITE OF MUSIC)

TEMPLE-RASTON: Half the people in Danny Ocean's heist team shouldn't have even made it through the doors of the casino. Jeff Jonas was asked to write computer systems that would use data, tons and tons of data, to try to spot these kinds of people - people who try to fool the slots, others at the tables who mark cards with chemicals.

JONAS: Here, you know, wearing contact lenses so only you can see the marked cards, that'll get you a felony charge. Those are crimes.

TEMPLE-RASTON: And then there are the less obvious people they need to keep track of - people on Treasury Department money laundering lists, people who might be related to one of the dealers and just so coincidentally start winning big. And before Jonas came along, the systems casinos used to do all that, well, they weren't too different from the analog way Sandy Grimes tried to look for spies. Grimes had to sort through piles and piles of paper files. The casinos had 3-by-5 cards.

Like a physical card?

JONAS: Yeah.

TEMPLE-RASTON: Wow. OK.

JONAS: They were making cards for their employees, and they would sort it by name. And they'd have another set of cards they would - for the same employees and sort them by address. It was just like the library. Instead of subject, title, author, it'd be like name, address, phone.

TEMPLE-RASTON: And then they'd make a new card for every bad guy.

JONAS: In fact, we actually had to send all these little white 3-by-5 cards through a scanner to take off the name and the address and the date of birth to turn them into digital data.

TEMPLE-RASTON: And that digital data was fed into something Jonas called NORA.

JONAS: Non-Obvious Relationship Awareness. It kind of earned that name because it started finding stuff that you're, like - you didn't expect it to find.

TEMPLE-RASTON: If someone at the roulette table happened to have the same phone number as an employee, NORA would flag that. If you were listed with more than one birthdate in your lifetime, NORA would find that, too.

JONAS: A lot of times data lands, it's no big deal. Is it important? No. No reason to tell anybody. But sometimes, as data lands, it's important, and that creates these systems that help focus human attention.

TEMPLE-RASTON: And Jonas is trying to teach computers to do what humans do. We're not aware that we do it, but our brain makes leaps to find connections, and sometimes, those connections aren't something you can really explain.

JONAS: If I said The Artist Formerly Known As Prince, maybe in your mind, it would render up the symbol. That's entity resolution. Entity resolution is recognizing it's the same thing despite having been described differently. I could say the artist that did the song "Purple Rain."

(SOUNDBITE OF SONG, "PURPLE RAIN")

PRINCE (MUSICAL ARTIST): (Singing) I never meant to cause you any sorrow.

JONAS: I could say the Artist Formerly Known As Prince or I could show you that symbol, and each of those will drive you to, maybe, a memory of his face.

TEMPLE-RASTON: Or just a purple guitar.

JONAS: Or a purple guitar - fancy-looking, sexy...

TEMPLE-RASTON: Velvet suit.

JONAS: Velvet suit.

(SOUNDBITE OF SONG, "PURPLE RAIN")

PRINCE: (Singing) Purple rain, purple rain...

JONAS: All those things that you've picked up over time about Prince lives in a folder in your head. And they came at different times, and they were described differently, but entity resolution rubber-banded those cards together.

TEMPLE-RASTON: And what makes it different from traditional computer searches is that instead of training a computer to take a long swim in a pool of information, entity resolution organizes things more like the brain does.

JONAS: I sat there and started thinking more about - how does biology do it? Does the brain more generalize it? That caused me to think about it more horizontally. How is a social security number like a VIN number, like a serial number on a router? How is a date of birth kind of like a make or model? I realized that all these attributes across all these things generally relate to a single entity.

TEMPLE-RASTON: So if you find a vehicle identification number on a bunch of cars, the computer notices that and essentially tells the human, this is weird. Look at this. To put it in terms of Aldrich Ames - wow. He just paid cash for a house, and he makes less than $70,000 a year. Maybe you should take another look at this. And then it goes a step further. The computer goes back in time to see if this new piece of information suggests a new way to think about something.

JONAS: Probably the fanciest thing in our algorithm is that it can change his mind about the past.

TEMPLE-RASTON: Jonas' company is starting to use code to help computers make those kinds of intuitive connections using messy data, the fuzzy data we referred to earlier.

JONAS: You're using the natural variability, the fuzziness, to benefit you. And it really came to me late, by the way, that messiness in data is actually kind of your friend.

TEMPLE-RASTON: And the messiness can make you ask the question, is this a clerical error, or is something else going on?

JONAS: Do you have three people each with three bank accounts, or is it one person? We saw this for a big global bank. They got rid of a money launderer out of Hong Kong, but they didn't realize they turned right back up in India, changed one letter in their last name and they used a different passport. And the bank is celebrating their new customer. It's the same money launderer.

TEMPLE-RASTON: This is the kind of computing that would flag a spy or someone who was stealing from you or someone who was lying about who they are. When Sandy Grimes added the deposit slip information to her chronology, she happened to glance at the line above and then saw the lunches with the Russian diplomat. That's an analog version of what Jonas is creating now. Having lunch with a diplomat in a bank deposit isn't something computers have been able to put together as having a relationship before now.

JONAS: That's the story of data finds data.

TEMPLE-RASTON: Bear Bryant, the former deputy director of the FBI we talked to before - he knew that computers had to be married to analysis. The FBI always had the data. That wasn't the problem. The problem was finding that key piece of information at the right time and fast enough, and speed is always a problem if you're working with a human being on this kind of thing. Humans need time to chew through information, to think about it and then to put two and two together - something that tests the limits of someone who has the patience have a cup of coffee.

BRYANT: I have the patience have a cup of coffee, and we would never have found Ames if it hadn't been for somebody pursuing what they thought was a correct lead. And that was - they took a whole lot of information that came down. Then somebody took it forward. You've got to have that person out there asking questions. If you don't, you're going to flounder.

TEMPLE-RASTON: And that person out there asking those questions with Sandy Grimes. Today's algorithms may have been able to alert the whole team to things about Rick Ames that didn't seem quite right to Sandy Grimes.

So are you one of these guys who thinks algorithms will fix everything?

JONAS: No. I think for the most part, algorithms have really come a long way. I think in a lot of cases now, it's having the right data for the algorithms. One of the problems, though, that people are seeing, especially with the new machine learning, is you have to have so much data and so much training data that it's impractical for most organizations, and that's a defect in the current methods that's going to have to be solved.

TEMPLE-RASTON: We'll have more to say about machine learning in just a minute. This is I'LL BE SEEING YOU from NPR, a four-part series about the technologies that watch us. When we come back, we'll take a hard look at algorithms and how they've developed a very human trait - bias.

CATHY O'NEIL (AUTHOR): That's a false positive problem, and false positives tend to land on certain populations more than others.

TEMPLE-RASTON: And we'll hear some old tape of Aldrich Ames himself. I'm Dina Temple-Raston. Stay with us.

(SOUNDBITE OF MUSIC)

TEMPLE-RASTON: This is I'LL BE SEEING YOU from NPR. I'm Dina Temple-Raston. So for a long time, algorithms have been seen as a silver bullet, the thing that would magically sort through tons of information and miraculously find an answer. It's both simpler and more complicated than that.

Can you explain, in the simplest terms - what's an algorithm?

O'NEIL: Yes, I can. My youngest son is now in fifth grade. Every morning he uses an algorithm to decide what to get dressed for. You know, it's like, well, how cold is it going to be? Was I comfortable or not? You're asking questions to try to predict whether you'll be successful with your outfit based on historical patterns of data.

TEMPLE-RASTON: So that's Cathy O'Neil. She's a mathematician, data scientist and author. She wrote a book about the dark side of math called "Weapons Of Math Destruction."

O'NEIL: And when we talk about algorithms in the big world with, you know, big data, AI stuff, the historical data is digitized, usually in a database. But we're doing the same thing, which is we're trying to predict the future based on past patterns of success.

TEMPLE-RASTON: And she's come to believe that algorithms can be dangerous. O'Neil has had a variety of data science jobs. She worked on Wall Street. She's helped companies target ads.

O'NEIL: And then I sort of saw the dark side of everything I was doing. I wrote...

TEMPLE-RASTON: The dark side of algorithms. When Cathy's son was trying to figure out what he wanted to wear to school, he was unconsciously bringing together millions of data points. Computers need even more data to replicate that. That's the defect in algorithms that data scientist Jeff Jonas was talking about before.

(SOUNDBITE OF MUSIC)

TEMPLE-RASTON: So broadly speaking, you need to show a computer about 80 million pictures of kitty cats to get it to recognize a cat. And if that huge data set of kitty pictures didn't include pictures of some rare hairless cat from Persia, the computer will have no idea that that's a cat. Interesting thing about humans, though - we are very good at making those kinds of inferences. So if you show a 4-year-old six pictures of kittens, they'll recognize every cat on the planet.

(SOUNDBITE OF CAT MEOWING)

TEMPLE-RASTON: Computers need a mathematical definition to know that something is similar, a mathematical equation that says, this is a cat, and this is a cat, and this is a cat. So if you're trying to define and find a spy - which is a bit harder than identifying a cat - you have to figure out a mathematical way to do that. I asked O'Neil how an algorithm might find a spy.

O'NEIL: I will tell you that it sounds like fraud detection, in general, and I do know a little bit about fraud detection. And what it does, basically, is it says here's what normal behavior looks like - what does it mean to be normal? What does it mean to be abnormal? Because fraudulent behavior often looks abnormal.

TEMPLE-RASTON: O'Neil says the danger is that the human who writes the algorithm may not know what normal is or may have a biased view of normalcy. You'd think, because it's based on math, that an algorithm is completely neutral; O'Neil says it isn't.

O'NEIL: And of course, the trick is to define normal and abnormal in ways that actually are associated with fraud or with insider threats, rather than are just abnormal for other reasons. What is suspicious behavior in this case? What is - like, give me 10 things that you would say raise a red flag for you. And then we would put all those 10 things together, and we would sort of start trying to observe people along those 10 dimensions and then define normal versus abnormal among those 10 dimensions.

TEMPLE-RASTON: The problem is that those definitions can be wrong or biased. When I was counterterrorism correspondent for NPR, law enforcement was always talking about the perfect algorithm, the one that would identify the terrorist before the attack. The problem was nearly every indicator they chose to identify a terrorist turned out to unfairly target specific groups.

Terrorist training camps, for example, usually lasted for six weeks, so one idea was to do a data sweep through visa and passport records to see who had gone to Pakistan or Afghanistan for six weeks. That meant they were essentially also capturing people who might have gone to those places to visit relatives for six weeks. They were targeting a certain kind of person.

O'NEIL: That's exactly what I mean. You sort of mark them as, you know, suspicious, but they end up not being suspicious at all. And that's a false positive problem, and false positives tended to land on certain populations more than others.

TEMPLE-RASTON: We have the same problem with espionage - the data sets aren't big enough; there isn't enough information to teach a computer what to look for, at least not yet.

O'NEIL: Algorithms don't, like, magically get good at stuff. That's almost never true. And the examples where you hear, it seems like magic, are never magic.

TEMPLE-RASTON: Much as law enforcement would love to think that the right data fit into the right algorithm will solve the problem of finding spies or terrorists or any other small select group of bad guys, algorithms can't do that yet. Humans are still better at it.

(SOUNDBITE OF MUSIC)

TEMPLE-RASTON: Rick Ames, in the nine years he was working for the Soviets, betrayed dozens of the best secret agents working for the U.S. from inside the Soviet Union. Red flags, data points - they were there, but no one really put them together. In retrospect, there were plenty of dots to connect. Ames was a drinker. He'd gone through a costly divorce. He had remarried a woman with expensive tastes. He paid cash for his house. He was driving a new car. All this at a time when he had access to some of the agency's most sensitive information about its spying operations in the Soviet Union.

And what may be the most perplexing thing about the case is that Ames wasn't lured into spying by some wily Soviet agent; he volunteered. People said he did it for the money, but David Charney, a psychiatrist who has become an expert in the psyche of spies, says it's never just the money.

DAVID CHARNEY (PSYCHIATRIST): The way that I like to explain that is, oh, you know why people go to football games? Because there's air to breathe. You know, everybody who goes to a football game is breathing air, and that explains why they're there. Well, wait a minute. Air is always there. Money is always there. That's insufficient as an explanation.

TEMPLE-RASTON: Charney does work with the intelligence community, and he's talked to quite a few spies over the years. And he thinks it's really all about failure.

CHARNEY: An intolerable sense of personal failure as privately defined by that person. Why do I add the last part? Because you may look at a person's life, and it doesn't matter what you think, it matters what the guy thinks.

TEMPLE-RASTON: Charney says Aldrich Ames saw himself as a failure. He couldn't recruit spies. His career at the CIA seemed to be slowing. He wasn't making enough money to keep his wife happy. He had toyed with leaving the agency, but because he was a lifelong agency man, he had no idea what he would do. Ames, Charney says, was in a psychological perfect storm.

CHARNEY: They're thrown into a situation they've not faced before, and their confidence in themselves gets shaken. And things start to slip between their fingers, and more and more piles on. And they're not thinking straight anymore. And it's when they're not thinking straight then they start to reach for extreme solutions that will rescue them.

TEMPLE-RASTON: Because so many variables go into such a tailspin, it's unclear how you would teach an algorithm to look for something like that. Our human intuition, Sandy Grimes's intuition, is what made Ames such an obvious suspect. And then there was one more measurable thing - the fact that Ames liked the sheer thrill of being a double agent, of living an intriguing double life. How do you get a computer to recognize that?

CHARNEY: I'll never forget one talk that I gave inside CIA at the beginning of my work with spies. After the talk, one guy from CIA and the technical department, he said, I don't care what sort of a barrier or clever solution you come up with, if I wanted to, in a few hours, I could defeat it. I don't want to, but if I had to do it, I could do it. The missing link in all of this is human psychology and, I have to say, brilliance.

(SOUNDBITE OF ARCHIVED RECORDING)

UNIDENTIFIED REPORTER #2: What made you think you could get away with it, Mr. Ames?

TEMPLE-RASTON: The FBI arrested Aldrich Ames not far from his house on Presidents Day 1994, almost three years after the CIA put together the PLAYACTOR team.

WALLACE: Now, we came out from the house, and we took a right.

TEMPLE-RASTON: We're retracing what happened that morning with former CIA agent Bob Wallace.

WALLACE: And we're going down the street for about 150 yards or so. Turn right.

TEMPLE-RASTON: Now? (Laughter).

WALLACE: Then we're turning right on Quebec Street.

TEMPLE-RASTON: Ames had left his Soviet-financed house and was driving his Soviet-financed Jaguar on the way to the agency he had betrayed.

WALLACE: This would have been the normal route that Rick Ames would have taken to Langley every day. If you'd pull over here...

TEMPLE-RASTON: On this side?

WALLACE: Right here. Right here. We're now at a stop sign at the junction of Quebec and Nellie Curtis.

TEMPLE-RASTON: There's no one else around. The neighborhood is quiet, just like it was that morning.

WALLACE: There was an FBI car that had been positioned here. Aldrich Ames pulled up behind the FBI car. Another FBI car pulled up immediately behind Ames' Jaguar he was driving.

TEMPLE-RASTON: There were no flashing lights, no sirens. This was a quick and quiet operation.

WALLACE: And the FBI special agents approached the car. Get out, and you are under arrest. Ames got out of the car and was frisked, handcuffed, arrested and then taken off to a predetermined site where the FBI began the interrogation.

BRYANT: And the interrogation process went for some time, and there was a lot of negotiation.

TEMPLE-RASTON: Here's former FBI Deputy Director Bear Bryant again.

BRYANT: They didn't want to indict Rosario at first, and we just raised hell. And in order to protect her and their son, he pled to life sentence without parole. And she got - I don't know - five, six years.

TEMPLE-RASTON: And why were you so insistent about indicting her, too?

BRYANT: Because she was an integral part of his espionage. I mean, she would ask him about the money. And she would - I mean, she was no Christmas angel.

TEMPLE-RASTON: The microphones in the house, the wiretaps on their phones - it sealed their fates. While Ames claimed he had concealed everything from Rosario until 1992, after that, she was a very willing participant.

Remember that Bogota meeting that was described on the yellow Post-It note they found in the garbage? In the fall of 1993, just before he left for Colombia, Ames and his wife started talking about how he would get the money his Russian handler gave him back into the U.S. The FBI was listening as Rosario started to tell Ames how he should smuggle the cash back. This is from the surveillance tapes.

(SOUNDBITE OF ARCHIVED RECORDING)

MARIA DEL ROSARIO CASAS DUPUY (WIFE OF ALDRICH AMES): The other thing that we have to do is - if you do get the money and you think it might be advisable, I would - what I would do would be to leave in cash - (unintelligible). I guess it's better. You got the money in dollars, right?

TEMPLE-RASTON: Ames traveled to Bogota the next day, though there was a bit of a hiccup. His suitcase - the big one he thought he would carry all the money home in - it didn't show up in Colombia. The airlines said they'd lost it. The FBI had actually grabbed it to make sure there were no classified documents inside. And the FBI heard their reaction to that, too. This is from the tapes again.

(SOUNDBITE OF ARCHIVED RECORDING)

DEL ROSARIO CASAS DUPUY: I just don't know if - I'm sorry. It's just that I'm very, very nervous.

ALDRICH AMES (FORMER OFFICER, CIA): I know. You had the suitcase (unintelligible).

DEL ROSARIO CASAS DUPUY: OK.

TEMPLE-RASTON: Rosario was worried that Ames had classified documents in the back and hadn't told her.

(SOUNDBITE OF ARCHIVED RECORDING)

DEL ROSARIO CASAS DUPUY: You didn't have anything that shouldn't have been in that bag in that bag?

AMES: No, honey.

TEMPLE-RASTON: The suitcase they were both so worried about showed up at the hotel the next day, and the rest of the trip seems to have gone pretty much according to plan. Ames came home with a suitcase filled with $130,000 in cash, and he had a plan on how he would continue to provide secrets to the Russians the following year, 1994. He was still convinced, even though he knew an investigation was going on, that no one knew he was working for the enemy. He was arrested a short time later. Ames did an interview with NPR from jail about a year after his arrest.

(SOUNDBITE OF ARCHIVED NPR BROADCAST)

AMES: In that split second, you know, one's life is altered forever. You think back. I mean, you just kind of review everything. Everything - you know, your whole past is just there.

TEMPLE-RASTON: In the end, Ames was undone by hubris. He assumed that he was smarter than the people who were looking for him.

(SOUNDBITE OF ARCHIVED NPR BROADCAST)

AMES: I thought the investigation maybe hadn't gone anywhere, even though I didn't know much about it. There's no question there was a recklessness in how I handled so many things that is striking.

TEMPLE-RASTON: He was so sure that he had fooled everyone. He even started giving Sandy Grimes advice on how to conduct the investigation.

GRIMES: And he proceeded to give me a lecture. I called it counterintelligence 101. This is what you do, Sandy.

TEMPLE-RASTON: What did he tell you to do?

GRIMES: He told me, you look at the good cases and you look at the bad cases and see what's different.

TEMPLE-RASTON: And did you find that a little...

GRIMES: I just - I was gracious. I was always...

TEMPLE-RASTON: Was it off-putting, though?

GRIMES: Well, it was a little, but it was off-putting in the sense - it's a good thing you think I'm so stupid. You know, he thought we were two dumb broads.

TEMPLE-RASTON: Twenty-five years after arresting one of the agency's most damaging spies, Bryant and Grimes still remember exactly where they were when he was taken into custody.

BRYANT: And they said, we got the package. And so we broke out a bottle of Russian vodka and drank it (laughter).

TEMPLE-RASTON: Sandy Grimes was with the other team at CIA.

GRIMES: It was just total relief. We looked at one another, and we couldn't believe it. Now what do we do? We don't have a job to do - right? - because you lived with that for so many years. And then we did open the bottle of champagne. I think we each had a sip.

TEMPLE-RASTON: She said they just didn't feel much like celebrating.

Aldrich Ames is still serving a life sentence at a medium security prison in Terre Haute, Ind. We did ask to interview him, but the request was denied. In a letter, the warden said that coming to talk to Ames would jeopardize security and disrupt the orderly operation of the institution. They said we couldn't call him, either. I sent Ames numerous letters, asking if he'd be willing to talk about the new role of Russia in the world. They went unanswered. Ames is 78 years old now.

His wife Rosario returned to Colombia after a stint in prison for her role in all of this. Sandy Grimes left the CIA not long after the Ames case wrapped up. She lives in Virginia with her husband in a beautiful house that has a big American flag out front. Bear Bryant, he quietly retired from the FBI in 1999 after 31 years of service. He now raises beef cattle on a farm in West Virginia. And in case you thought it was harder to spy these days with all that digital dust and surveillance we have now, back in May of this year, it was deja vu all over again.

(SOUNDBITE OF MONTAGE)

UNIDENTIFIED REPORTER #2: A former CIA officer is in jail this morning and charged with illegally possessing classified information.

UNIDENTIFIED REPORTER #3: Well, he's 53-year-old Jerry Chun Shing Lee. He was arrested Monday night when he arrived on a flight from Hong Kong.

UNIDENTIFIED REPORTER #4: He is accused of unlawfully having notebooks containing national defense information, including names of covert CIA assets.

UNIDENTIFIED REPORTER #5: It's still not clear why it took authorities six years to bring charges against Lee. He was interviewed by the FBI five times.

TEMPLE-RASTON: Sound familiar? Jerry Chun Shing Lee is thought to have been spying for the Chinese for the past eight years, single-handedly helping them find, imprison and kill a dozen or more Chinese double agents. He pleaded guilty to possessing classified information. Grimes says even with all the technology we use to watch people today, we shouldn't be surprised.

GRIMES: It's much more open that such things exist. They always have existed. There's always been a spy. First one was the Garden of Eden, for Pete's sakes.

(SOUNDBITE OF MUSIC)

TEMPLE-RASTON: Have you just discovered I'LL BE SEEING YOU? There are three shows you missed. If you want to hear them, go to npr.org/illbeseeingyou to learn about the mysterious death of a famous hacker...

(SOUNDBITE OF ARCHIVED NPR BROADCAST)

UNIDENTIFIED REPORTER #6: Do you typically find stickers on dead bodies?

UNIDENTIFIED CORONER: That was a first for me.

TEMPLE-RASTON: ...How AI is saving the elephants...

(SOUNDBITE OF ELEPHANT GROWLING)

TEMPLE-RASTON: ...And to go behind the scenes of Cybercom as we reveal for the first time how the U.S. military hacked into the most dangerous terrorist organization in the world.

(SOUNDBITE OF ARCHIVED NPR BROADCAST)

NEIL (JTF ARES): We could take those over. We were going to win everything. It was a house of cards.

TEMPLE-RASTON: I'LL BE SEEING YOU is written and reported by me, Dina Temple-Raston. Our producer is Adelina Lancianese, and she scored our show, too. Special thanks to NPR's Investigations Team, the NPR Story Lab, Jay Czysz (ph), Barbara Van Woerkom, Ramtin Arablouei, Emily Dagger, Neal Carruth and to Josephine Wolff of Tufts University. I'm Dina Temple-Raston, and I'LL BE SEEING YOU. Transcript provided by NPR, Copyright NPR.