‘Tom Marcus’ (not his real name) was a shadowy MI5 watcher tracking Britain’s enemies on our streets.
On Saturday, in a heart-stopping extract from his new book, he described how he helped to foil two terrorist atrocities.
Here, in the concluding part, he describes his role in a tense operation to thwart a cyber-attack . . .
Alison, the operations officer, announced: ‘Your target is Magenta Stoat.’ It was a code-name that had us all buzzing as we sat in the surveillance team’s briefing room in Thames House, home of MI5, Britain’s secretive counter-espionage organisation.
He was a Russian and a potential intelligence goldmine for us — but one who hardly ever came out into the open.
He’d only ever been seen once doing anything operational.
Football crowds are a double-edged sword for operators like us. While being able to hide among thousands of people is a gift, it also makes it difficult to keep a visual on the target, writes former MI5 officer ‘Tom Marcus’ (not his real name)
But today he was expected to be meeting a contact. And our job — as the best covert surveillance operators in the world, with a unique skill for blending into the environment — was to track him without ourselves being seen.
These days, most people think of MI5’s job as stopping terrorists, but another side is to make sure that our way of life survives.
Imagine how different your day would be without the internet powering everything, from information systems right through to control signals for our railways.
While we are the best in the world at keeping people safe from maniac suicide-bombers (a subject we covered in Saturday’s Mail), the bigger threat to this country comes in the form of cyberwarfare and state-sponsored espionage by the likes of China and Russia.
That’s what Magenta Stoat was up to.
‘Intelligence indicates he’s a big Chelsea fan and he will be going to today’s match at Stamford Bridge to have some sort of meet inside the stadium,’ Alison revealed.
Football crowds are a double-edged sword for operators like us. While being able to hide among thousands of people is a gift, it also makes it difficult to keep a visual on the target.
Sometimes we would have to be within touching distance just to be able to see them. And that ran the risk of us being spotted.
He was such a sensitive target that he and whoever he met must not know we were watching them.
‘We cannot risk a compromise,’ Alison emphasised. ‘I would rather lose the target and any possible contacts than alert him to surveillance.’
Why precisely he was so important, we weren’t told. That knowledge was classified and limited to those at the very top of MI5.
That’s how MI5 works. We in surveillance report what we see and make no assumptions.
It’s the geeks back in Thames House who fit the pieces together and come up with the intelligence picture.
We in surveillance report what we see and make no assumptions. It’s the geeks back in Thames House who fit the pieces together and come up with the intelligence picture (file photo)
They run the show, playing chess with us operators on the ground.
Nonetheless, my gut was telling me that he didn’t just pose a threat to national security, but was highly likely to be a very credible threat to our nation as a whole.
My team — Green Team — went to work.
I drove towards a hotel near Stamford Bridge where it was hoped the target would be. A radio message came through from Control to ditch the car.
‘I need you on foot today. All stations, just be aware we have assets in place inside the stadium. We will take on any and all contacts.
We have Red and Blue teams on standby to help if we need them.’
We didn’t usually have so many people deployed. The stakes must be very high.
I parked in a side street and joined a large group of Chelsea supporters walking to the stadium.
If you’re carrying out surveillance, you mustn’t stand out, so you match your speed and posture to others around you.
In a dodgy area, you might slope along, hands in your pockets. In the City, you would be suited and booted, walking quickly with purpose.
Today, I flicked my hood up over my baseball cap and morphed into the crowd of football fans.
There were thousands everywhere, and a heavy police presence with riot vans, uniforms on foot, horses, the lot. An undertone of aggression was building.
‘Intelligence indicates he’s a big Chelsea fan and he will be going to today’s match at Stamford Bridge to have some sort of meet inside the stadium,’ Alison revealed
For me and the others, it was now a waiting game as we started blending into the area, becoming part of the crowd. That’s the nature of what we do.
Multiple surveillance units are on the ground, while people go about their daily lives none the wiser.
You could be walking your kids to school or nipping to the shop for some milk and not realise you’re surrounded by MI5.
A message on the radio: ‘Stations from Base, Magenta Stoat is confirmed inside the stadium. He’s not expected to stay to watch the game. Can we have eyes on every possible exit please.’
I could see one of the main entrances, the Shed End.
‘Zero Six’ — that was me — ‘has the Shed End,’ I called in.
But as I leant against a wall to keep an eye on the exit, suddenly the fans around me began to kick off and a mass brawl broke out.
As the police swarmed in, all the shouting drowned out transmission on my radio, which was a disaster. If I couldn’t hear, I was not an effective part of the team.
A kick landed straight in the middle of my thigh as crowd and police fought around me.
Out of the corner of my eye, I saw the stadium exit and Magenta Stoat smiling as he walked out.
I couldn’t work out if he was with anyone, but I was trapped, unable to follow.
I was trying to transmit an emergency signal over the radio to tell my team I was in trouble when a metal pole came careering towards me and hit me on the arm.
The pain was intense, but instantly forgotten. I had to get out of there.
I parked in a side street and joined a large group of Chelsea supporters walking to the stadium
I caught a glimpse of Magenta Stoat turning to someone behind him with his arm outstretched. I needed to see who this contact was, but I was pinned against the wall by a wave of people, the air knocked out of my lungs.
Through the bodies and police horses I caught another glimpse of him, now shaking hands with a man wearing a red jacket with a fur hood.
I urgently needed to get this information out to the team and dropped to the floor, where finally I had the space to draw breath and send the message.
‘Red coat, fur hood, contact!’
Eventually I managed to escape the melee, but when I looked over at the Shed End exit, there was no sign of the target or the figure in the red coat. B****cks! I’d lost them. But that’s where teamwork came in.
A transmission told me they’d already been spotted outside the ground and were being followed.
I headed back to my car, in some considerable pain. There, I listened in on my radio to the guys on foot following the contact in the red coat.
‘Stations, target now at the junction of Fulham Road and Harwood Road. Looking at his watch now, looking back on his route.’
‘Roger that. Stations, close in please. Base confirm Magenta Stoat is still under control inside the stadium.’ Except he wasn’t. ‘NEGATIVE!’ was the cry from base.
‘Magenta Stoat is not inside and is not under control [ie, in view]. He became unsighted before Blue Team could take control. Magenta Stoat is running free.’
The No. 1 threat to British security was no longer under surveillance. This was going bad, fast.
It would have been easy to panic at this point, but we continued to do our job.
Back at Thames House, they were monitoring the live feed I was sending and cross-referencing the images to identify this contact of Magenta Stoat
The contact in the red jacket and fur hood was still being followed, now heading towards the entrance to Eel Brook Common.
Fatima, one of our team, had him in sight. Others, including me, were dotted around, both close in and further out, a combination of staying out of view and hiding in plain sight.
We needed a picture of the target and since he was heading in my direction, that fell to me.
Trying to look inconspicuous, I stood in a queue at a cabin serving coffee and pastries and slid my hand into my satchel-style bag for the zoom button on my video camera.
While pretending to look at the coffee prices, I slowly moved the bag to the right angle.
Back at Thames House, they were monitoring the live feed I was sending and cross-referencing the images to identify this contact of Magenta Stoat.
Suddenly a surprised voice came over the radio. ‘It’s Last Dawn. The target in the red jacket is Last Dawn!’
I had no idea who he was. I’d never heard of him. But Graeme, our team leader, had. I heard him say: ‘But Last Dawn is dead!’
There was no time to explain further. Word came over that Blue Team had spotted Magenta Stoat, also now on Eel Brook Common and riding a bike.
We now had two full-size MI5 surveillance teams watching two of the most wanted men in Britain. If they met up, it was highly likely an operational activity.
These Russian operators were sneaky. The common was a wide open area, and if they were trying to flush out any surveillance teams they could easily move to a quiet corner and see who was following them.
Fatima was tailing Last Dawn and giving us a running commentary on our radios. ‘From Nine Nine, that’s Last Dawn now at the coffee cabin, with Magenta Stoat standing behind him waiting to order.
‘Both facing south and not talking. Appears they are ordering separately.’
‘Nine Nine, from Blue Team Leader, have they acknowledged each other in any way?’
They were close to MI6 headquarters (pictured). From all directions,teams were racing to Vauxhall — cars, people on foot, every available asset
‘From Nine Nine, Last Dawn is taking a napkin from the coffee counter. Taken something from his pocket and wrapped it inside the napkin. Napkin is still on the counter.’
‘Nine nine, Magenta Stoat is now ordering and has taken the napkin off the counter and put it in his pocket.’
It had to be a dead-drop — a way of passing intelligence material, equipment, instructions or money to another spy.
But why here? Why not among the crowds back at the football stadium? Perhaps this was a dummy run, a practice for the real thing.
Or were they trying to flush out anyone watching them?
Suddenly the radio communications got very loud. There was an urgent message from Base.
Something was wrong. Everyone was to get out of there fast and go to ground at a pre-arranged safe place outside of London. Which we did — no questions asked.
But clearly something serious had happened for the operation to be called off so dramatically. Had we been compromised?
When we reassembled the next night, Alison was questioned about Last Dawn. Who was he?
Reluctantly, she told us that, from the pictures I took in the park, he had been identified as a Russian agent believed to have been killed in Chechnya 15 years earlier but clearly still very much alive.
‘Once it was confirmed it was him, the desk came across some intelligence about a potential plot involving him and Magenta Stoat.
We have known for some time that Magenta Stoat was trying to organise an attack on a British government department. We just didn’t know what sort of attack or which department.’
It all clicked into place. That was why this particular Russian was such high priority.
The Russians think big, aiming to cause a huge amount of pain for as long as possible by corrupting the power supply grids or collapsing the banking system.
Take down the right part of the government and the country is wide open.
There was more.
Alison then played us a recording of an intercepted call from a mobile phone inside Eel Brook Common to an office in Moscow.
Two male voices were speaking in Russian and indicating that what had happened there was a practice to see if they were under surveillance.
‘We will see anything that moves,’ one voice said.
So that was why we had been pulled out so abruptly — to stop them becoming suspicious.
As it turned out, they hadn’t managed to get a lock on us and so they were presumably going ahead with their plan.
‘And their plan is?’ one of our number piped up.
Alison replied: ‘To plant remote access into the communications between us, Vauxhall [MI6 headquarters] and the West Country [GCHQ].’
Game on. The Russians were trying to get unrestricted and hidden access to all the information shared between the UK’s three intelligence agencies — MI5, MI6 and GCHQ, the government communications centre in Cheltenham.
This included assessments and information from the ‘Five Eyes’ intelligence-sharing alliance of Britain, Canada, Australia, New Zealand and the U.S., and top-secret intelligence being fed from deep-cover spies in hostile countries, including our assets in Russia.
As well as compromising our communications, it would leave us wide open militarily, too.
We were instructed to put Magenta Stoat, Last Dawn and a third target that had been identified, code-named Turquoise Flamingo, under 24-hour surveillance.
‘We need anything and everything about them you can get.’
This is the difference between a normal intelligence-gathering agency and MI5.
We could have had these guys immediately arrested and removed the problem.
But they couldn’t be prosecuted because the methods we use are secret and the directors in Thames House wouldn’t want to run the risk of showing the Russians how we tracked them down.
And arresting them would stop us identifying the real threat back in Moscow.
So the intention was to let them go as far as possible with their attempt to gain access to our communications, and then intercept it at the last minute.
Other countries would react completely differently to such a hostile attack on their intelligence agencies.
The Americans would probably stop the threat as soon as they became aware and double the amount of their own operations in the hostile country.
The Israelis would likely go on a very lethal offensive. Other powers might bring it up in the political arena; one or two might use it as a precursor to war.
Our plan was to intercept the device they planned to use to quietly observe our communications and replace the access they have with our own code.
This would be a double hit for us — removing the route into our communications network while giving us a door into their own.
The next phase of the operation tracked our three targets to Greenwich in South-East London and a night-time meeting in the park there.
Was this where an important hand-over would be made? Or perhaps it would be another dummy run like the one before?
There were enough of us to cover the whole park, despite its size and the trees obscuring our view.
Half the team were in vehicles and half on the ground.
Jenny and David were inside the bandstand, playing the drunk couple, hugging and stumbling. Mark was pretending to be a dosser bedded down for the night.
I chose to go on foot and picked my spot to hide and set up my camera in the roof space of a derelict building looking out onto the corner of the park.
A message came on the radio: ‘Last Dawn and Magenta Stoat approaching. Both have satchel-style bags.’
What we had to do was track them while not revealing ourselves to any other Russian-watchers who might be out there. If we were seen, it would blow the entire operation.
I watched as the two targets walked towards me, both wearing dark jackets, dark trousers and woollen hats.
‘Base from Zero Six, Last Dawn has his hand in his bag. He is taking something out and passing it to Magenta Stoat, who has placed the object in his jacket pocket.’
Suddenly there was a flash of light. The Russians had an infra-red laser pen and were pointing it in different directions. If they also had a night-vision device, they could potentially spot our team scattered around the park.
The laser’s beam settled on something and Last Dawn pulled a walkie-talkie out of his bag and said something into it.
The beam was directed at Mark, lying on the ground under a tree.
Had we been rumbled? Was this all about to go very wrong?
Quietly, the rest of the team extracted from the park as another figure walked towards Mark. It was the third Russian, Turquoise Flamingo. I stood by, ready to rescue Mark if things turned violent.
But he sent me a quick message: ‘Don’t blow the operation. I’ll front this out.’
And front it out he did — brilliantly. Turquoise Flamingo kicked Mark’s foot, which was sticking out from the old blanket with which he’d covered himself. He scrambled to his feet, waving his fists and ready for a fight, like any genuine drunk sleeping rough might do.
The Russian turned tail and ran.
Mark shouted and jeered at him, then, still living his cover, he punched a tree.
It worked. He had convinced the Russians. They didn’t suspect this nutter of being a part of MI5.
After this, Magenta Stoat and Last Dawn seemed satisfied they were not being watched. They looked relaxed as they passed something the size of a large chocolate bar between them. Neither man was looking around; they felt safe here.
They then left the park, clearly feeling this second practice-run for a dead-drop had gone well, that they weren’t being watched and that their plan to attack and subvert our communications system could go ahead.
A few days later, the Russian operation was in play again. The team was out on the streets of London when the call came over the radio: ‘All stations, Magenta Stoat and Last Dawn thought to be in the area of Vauxhall Cross and the southern end of the bridge.’
They were close to MI6 headquarters. From all directions,teams were racing to Vauxhall — cars, people on foot, every available asset.
Yet we had to be mindful not to appear obvious. We knew that the targets were here somewhere, but if they were hidden they could be initiating their plan to gain remote access to monitor our communications.
Then our group leader, Derek, had a brainwave.
Instead of our normal softly, softly approach, he said: ‘Let’s play these guys at their own game, make this whole place a pressure cooker and flush them out.’
We’d go overt and loud, making it clear to the targets we were looking for them. When they made a run for it, we’d have them.
Green Team’s job was to stay hidden and cover all routes in and out, including the Tube station. Meanwhile, police cars with blue lights flashing flooded the area and Six was put on lock-down.
‘At the same time,’ said Derek, ‘we’ll drop the mobile network for this immediate area.’
When their phones went dead, the Russians would be neutralised.
Suddenly, I heard one of my team running and then Jenny’s words filled the radio: ‘Stand by, I have control of [eyes on] Magenta and Last Dawn. They’re running east.’
We’d flushed them out. The job was done. Back on the street, I heard the message: ‘From Base, Executive Action coming in now.’
A strike team had been in place ready to hit the two men the moment we sighted them.
The police cars had moved off and Vauxhall Cross was back to normal, with the security teams downgrading their presence. The mobile network was back up.
As I sat in my car listening to the radio, I heard Jenny updating the team: ‘Executive Action has control of both Magenta Stoat and Last Dawn.’
We’d got the f***ers!
Back at base, we were all curious to know what was going to happen now. We’d just stopped a priority-one target.
Graeme, our team leader, put the question for us to Derek. What more could he tell us about Last Dawn and Magenta Stoat?’
Derek’s response was typically curt: ‘Does it matter? You guys know this is what we do. We find the targets given to us and pass the intelligence on. The bullsh*t afterwards doesn’t matter to us.’
This operation was wrapped up and now we looked to the next one. Because the work doesn’t stop, nor the demand for it.
Some operations can last for months or even years. And some days you are scrambling with only hours to stop an atrocity from a ‘clean skin’ — someone who’s emerged out of the blue.
You never know what is coming, and you need to be prepared to handle whatever the situation throws at you.
I Spy: My Life In MI5 by Tom Marcus will be published by Macmillan on May 30 at £18.99. © 2019 Tom Marcus.
To buy for £15.19 (20% discount) go to mailshop.co.uk/books or call 0844 571 0640. Offer valid until May 25, p&p free on orders over £15. Spend £30 and get FREE premium delivery.