turning-and-running-a-controlled-agent

name	turning-and-running-a-controlled-agent
description	Review how a captured or walk-in agent is turned and then run day to day; use when reviewing this facet of a deception or counter-deception case.
kind	skill
status	ready
provenance	{"principles":["P001","P002","P008","P012","P019","P020","P026","P030","P031","P036","P055","P065","P072","P073","P080"],"claims":["C00001","C00002","C00003","C00004","C00005","C00007","C00008","C00009","C00010","C00011","C00012","C00014"],"evidence":[],"source_anchors":[],"authored_from_digest":"2fe8f88933bcb50cb67013d3ec17c07fbce1fa86090e24faa7a7d1768e650556"}

Turning And Running A Controlled Agent

Purpose

Review a source in the evidence chain — walk-in, defector, or long-running channel — for the tradecraft signatures of a professionally turned and run controlled agent: a suspiciously fast, quiet capture; a case record too clean to be organic; vigilance relaxed into confidence; a persona sustained with unnatural consistency across handlers; an incentive structure fixed unusually early and generously; and productivity that tracks a handler's feedback rather than the source's own access. Masterman's tradecraft describes exactly how a service turns and runs such a channel; this skill inverts that playbook into a detection checklist. A source exhibiting these signatures may not be the independent, organic asset the analytic product assumes — it may be doubled or controlled — and an analyst who has never tested for them cannot rule that out.

When to use

• A source's account of first contact or capture reads suspiciously quiet and fast, or leaves an unexplained gap before it was "activated," and the caller wants that timeline tested for a hidden signal or an undisclosed prior enemy contact.
• An asset has produced for a long time, yet no continuous, closely kept case record — the reporting log, contacts, and the small inconsistencies a real supervised case accumulates — has actually been reviewed.
• Confidence in a source has hardened into settled trust, or its persona reads with a consistency that looks manufactured rather than the variability a person under real risk would show, and the caller wants vigilance and immersion checked rather than assumed.
• A source's reporting carries a technical or stylistic signature — a wireless "fist," a writing voice — that has stayed identical across a change of contact, an illness, or an injury it cites as explanation, and the caller wants that continuity verified rather than taken as proof it is still the same person.
• A source's declared line of access has stayed suspiciously fixed, it seems to anticipate exactly the questions the analyst wants answered, or its financial arrangement was struck unusually early and generously, and the caller wants to know whether that fit is organic or handler-shaped.
• A comms breakdown, a proof-of-loyalty event, a level of tradecraft beyond the source's claimed training, or turnaround faster than its claimed institutional constraints is offered as background, and the caller wants each tested as a possible control signature rather than accepted at face value.
• A source has gone quiet or stopped producing, yet the analytic product still cites it for corroboration, and the caller wants that continued reliance justified rather than assumed.

Procedure

1. Test the capture or turn for a control signature: does the account show the source secured, contacted, or activated with suspicious speed and secrecy, with no window in which an independent enemy contact or a self-initiated approach could have occurred first? Treat an unexplained delay, or a story where the early exchanges were never checked for an undisclosed warning signal, as untested rather than benign (P055, P026).
2. Pull the continuous case record — the reporting log, the pattern of contacts, journeys, and actions — and check it for the friction a genuinely independent, unsupervised source accumulates over time. A record that reads too clean, too continuous, or has simply never been reviewed for the small inconsistencies close supervision would catch can itself be a signature that someone has been curating it (P002).
3. Check whether trust in the source has hardened into premature confidence — vigilance relaxed rather than sustained — and whether its persona shows the seamless, total consistency that a case officer fully immersed in a role produces, rather than the variability a person under genuine risk would show (P008, P030).
4. Where the source's reporting carries a technical or stylistic signature — a wireless "fist," a distinctive voice, a reporting rhythm — verify it was baselined and has actually been re-checked, especially across a change of contact or an illness/injury the source cites as explanation. A plausible injury story covering a stylistic shift is the same device used to disguise an operator substitution, and it works just as well whichever side is running the channel (P019, P031, P065).
5. Examine the fit between the source's declared access and its output: has its line of interest stayed suspiciously fixed, and does it seem unusually able to anticipate and offer exactly the questions the analyst is prepared to answer? That is the initiative-within-instructions signature of a well-run channel, not proof of an organically well-placed source. Check too whether its financial or incentive arrangement was struck unusually early and generously — a hallmark of a service binding a source to continued cooperation rather than an ad hoc relationship (P020, P012).
6. Treat operational "excuses" in the source's file as testable claims, not background colour: a comms breakdown that conveniently bought time before deeper vetting, a level of tradecraft sophistication beyond the source's claimed training, a dramatic proof-of-loyalty event that drew genuine press coverage yet did no real harm, and turnaround faster than the source's claimed institutional constraints would allow are all documented ways a controlling service manufactures credibility. Ask whether each was independently tested or simply accepted (P072, P073, P001, P080).
7. If the source has gone quiet or stopped producing, yet the analytic product still leans on it for corroboration, ask why it is being kept "alive" in the record — a dormant source retains reference and confirmation value to whoever controls it, so continued reliance needs its own justification, not inertia (P036).

Inputs

• The source's own account of first contact or capture, and any gap or delay before it began actively reporting.
• The continuous case record where one exists — the reporting log and the pattern of contacts, journeys, and actions — or an acknowledgement that no such record has been kept.
• The history of confidence placed in the source: when it was recruited, whether vigilance or scrutiny has been renewed since, and whether anyone still supervises it closely.
• Any technical or stylistic baseline for the source (a wireless sending style, a distinctive writing voice) and later samples to compare it against, including any point of contact change, illness, or injury cited as an explanation.
• The source's declared line of access or interest over time, and the history and terms of its financial or incentive arrangement.
• Any operational incidents on file — comms breakdowns, claimed training background, proof-of-loyalty events, response timing — offered as background rather than tested.
• Whether the source is still actively producing, and how its material is currently being used or cited in the analytic product under review.

Output

Per finding: name the control signature (an unexplained gap in the capture or turn timeline, a case record too clean or never actually reviewed, premature confidence paired with an over-consistent persona, a stylistic or technical match never baselined, a tasking or financial fit too neat to be organic, an untested operational excuse, or a dormant source still relied upon), apply the correction (pull and test the timeline, read the continuous record for real friction, re-test vigilance and persona variability, baseline and re-check the stylistic signature, examine the tasking/incentive fit, independently test the operational excuse, or justify the continued reliance), state the residual uncertainty — including whether the source reads as controlled by the caller's own side, controlled by the adversary, or genuinely independent — and end with a concrete next step. Order findings highest-impact first. Never certify a source controlled, doubled, or clean: that determination, and any decision to keep relying on it, belongs to the operation's owner.

Anti-patterns to flag

• A suspiciously quiet, fast capture or contact story taken at face value, with no check for an unexplained gap that could have let the enemy make independent contact, or for an undisclosed warning signal buried in the early exchanges (P055, P026).
• A long-running source's case record that has never actually been pulled and read for the friction a real, closely supervised case accumulates — confidence resting on reputation rather than the record (P002).
• Growing trust in a source read as reassuring rather than as the premature confidence that precedes a case unravelling, paired with a persona so seamless it looks curated rather than lived (P008, P030).
• A stylistic or technical match — sending style, writing voice — accepted as proof of continuity across a change of contact or a claimed illness/injury, with no baseline ever taken or re-checked (P019, P031, P065).
• A source's suspiciously fixed line of access, its uncanny fit to the exact questions being asked, or an unusually early and generous financial arrangement read as evidence of a well-placed, willing asset rather than tested as a handler-shaped fit (P020, P012).
• A comms breakdown, training-background mismatch, proof-of-loyalty event, or fast turnaround written off as incidental colour instead of tested as a documented device for manufacturing credibility (P072, P073, P001, P080).
• A dormant, non-producing source still cited for corroboration with no examination of why it is being kept "alive" in the record (P036).

References

See ../../references/deception-detection-principles-index.md for the full principle catalogue. For adjacent concerns, see the sibling skills: counter-deception-and-the-mirror holds the broader mirror question — whether the reviewer's own side is the one being deceived — that this skill's control signatures feed evidence into; assessing-enemy-trust-and-belief gauges how much a channel is trusted once it is running, a companion check once this skill has raised or cleared a control signature; network-security-and-compartmentation covers how a source found to carry control signatures should be firewalled within the wider network.

Provenance

Derived solely from P001, P002, P008, P012, P019, P020, P026, P030, P031, P036, P055, P065, P072, P073, and P080 (J. C. Masterman, The Double-Cross System; distillation-only; see the frontmatter above for the full claim list).