Worked at NATO and spied for Russia? US lieutenant colonel arrested in the United Kingdom

Arrest near Gloucester

According to London’s Metropolitan Police, the 41-year-old serviceman was arrested on 10 November near Gloucester. He was detained on suspicion of offences under Sections 1 and 3 of the UK’s National Security Act 2023. These provisions concern obtaining or disclosing protected information and assisting a foreign intelligence service. Police stated that the suspicions related to activities connected with Russia. They also confirmed that searches had been conducted at two locations in Gloucestershire and that the suspect had been taken into police custody in London.

The Associated Press, citing US, NATO and British officials, reported that the detained officer was serving with the Allied Rapid Reaction Corps (ARRC) at Imjin Barracks near Gloucester. Sky News also confirmed his place of service. This means that the officer worked within a multinational headquarters responsible for preparing to command NATO military operations.

The Washington Post, citing an anonymous US official, reported that the detained officer holds the rank of lieutenant colonel.

Joint operation by British and American security services

FBI Director Kash Patel, in a statement included in a Metropolitan Police announcement, highlighted cooperation between British Counter Terrorism Policing, MI5, UK Defence Counter Intelligence (UK DCI) and the US Army Counterintelligence Command (ACIC).

Brigadier General Sean Stinchon, commander of ACIC, stated that „this case demonstrates the strength of our partnerships and the determination of the counterintelligence community”.

„I am grateful to the United Kingdom and the FBI for their professionalism and cooperation throughout the investigation. The alleged conduct of a senior military officer entrusted with sensitive information is a stark reminder that insider threats are real and persistent. I encourage anyone who believes they have witnessed something suspicious to report it to their local counterintelligence office,” he added.

Cooperation between these institutions reflects the nature of the case: the suspicions concern an American serviceman on British territory, while his place of service gives the investigation significance for the Alliance. ABC News, citing a source familiar with the matter, reported that both British criminal charges and proceedings within the US military remain possible.

Lieutenant colonel with access to classified information

According to The Sun, the detained officer served in the personnel department at Imjin Barracks. Anonymous military sources indicated that he held clearance to access information classified as „NATO Secret”. Details concerning his position and level of access remain findings reported by the newspaper rather than officially confirmed information.

Service in a personnel department may provide access to information useful to a foreign intelligence service seeking to identify personnel and understand command structures. Information concerning appointments, qualifications, service records and previous postings can establish who is responsible for particular tasks, what experience they possess and which units and individuals they maintain professional connections with. Such information can be used to identify personnel with access to valuable intelligence and select potential recruitment targets.

However, it remains unclear which of these records the detained officer could actually access. As The Sun noted, it has not been established whether he had access to soldiers« home addresses or their service histories. Possessing a security clearance at a particular classification level does not automatically grant access to every document bearing that classification.

Headquarters prepared to command during wartime

The significance of the case stems primarily from the responsibilities of the ARRC. Official NATO materials indicate that rapidly deployable corps headquarters prepare to undertake a wide range of missions, including high-intensity warfare. They must demonstrate capabilities in planning, logistics, administration, and command and control.

The United Kingdom serves as the ARRC’s framework nation, providing the majority of headquarters personnel as well as most of its equipment and funding.

In information published in 2025 concerning service at Innsworth, the US Army described the ARRC as NATO’s strategic reserve corps. The document indicated that it could support operations across various parts of the Alliance’s area of responsibility, from the Arctic to the Mediterranean. It also outlined the corps« role in reinforcing other formations and delaying an aggressor until additional forces arrive.

Information obtained from such a headquarters could therefore help an adversary assess NATO’s response times, command arrangements, logistical requirements and limitations in combat readiness. Knowledge of how the Alliance intends to mobilise and deploy its forces may be just as valuable as information about its weapons systems.

However, it has not been disclosed whether the allegations against the detained officer involve precisely this type of material.

Was the transfer of information prevented?

According to anonymous sources cited by The Washington Post, the detained officer had taken steps to gather information useful to Russia, but sensitive materials were not transferred to the country. The Sun also cited assurances from military sources that the officer had not provided information to actual Russian representatives.

The newspaper suggested the possibility of a counterintelligence sting operation involving undercover operatives. Under such a scenario, the suspect would believe that he was communicating with representatives of a foreign intelligence service, while his contacts would in fact be individuals operating under the control of security services and documenting his activities.

However, this version of events has not been officially confirmed.

It has not been disclosed who initiated the alleged contact or whether the suspect had previously maintained relationships with Russian representatives. Reports that no materials were passed to Moscow do not, in themselves, establish which counterintelligence methods were employed.

The distinction between a thwarted attempt and a successful intelligence leak is fundamental. In the first scenario, intervention may prevent damage. In the second, investigators must determine what the adversary has already learned and how that knowledge may have been exploited.

At this stage, it has also not been disclosed which Russian intelligence service the alleged cooperation might have involved or what motivated the officer.

The arrest of an American officer reflects the broader challenge of protecting information from individuals who have legitimate access to it. In recent years, US security services have uncovered cases involving the disclosure of military information in exchange for money, the sharing of classified material through online interactions and attempts to establish cooperation with foreign states.

One example is the case of Taylor Adam Lee, arrested in August 2025 on suspicion of attempting to provide information about the Abrams tank to an individual he believed represented Russia. These cases illustrate the variety of insider threats, but do not establish which mechanism was involved in the case of the officer stationed at Imjin Barracks.

Russia seeks access to Western defence structures

The arrest took place less than a month after MI5 Director General Ken McCallum delivered his annual threat assessment. In his speech on 13 October 2026, entitled „MI5 Director General delivers annual threat assessment”, he identified Russia as the principal aggressor targeting the United Kingdom.

He warned of intensifying hybrid activities and the use of criminal intermediaries and volunteers following the reduction of Russia’s intelligence presence as a result of expulsions.

McCallum also reported that the number of MI5 investigations concerning state threats had quadrupled over the past decade. These figures cover activities involving various countries and therefore do not establish the number of Russian operations or constitute evidence in the case of the detained officer.

The Gloucester case draws attention to insider threats within defence institutions. An individual working at a military headquarters has legitimate access to their place of service, understands internal procedures and can recognise the significance of information that might be incomprehensible to an outsider.

Their potential value to a foreign intelligence service may derive both from access to documents and from knowledge of personnel and the organisation’s working practices.

The rank of lieutenant colonel indicates the suspect’s experience and position within military structures. However, it does not establish whether any damage has occurred or what its potential extent might be.

The significance of the case will depend primarily on findings concerning the officer’s actual access to information and the actions he undertook.

NATO's ability to respond is at stake

Police emphasised that the investigation is not linked to other ongoing Counter Terrorism Policing investigations. There are therefore no grounds for treating it as part of the same operation as the separately reported threats against American military bases in the United Kingdom.

For this reason, the most important questions concern the extent of the officer’s access, the nature of his alleged activities, whom he actually contacted and whether he passed information to anyone.

Reports that the transfer of materials to Russia was prevented suggest that counterintelligence measures may have been effective. However, they do not replace a comprehensive assessment of what the suspect attempted to do and how far his activities progressed.

The significance of the case for Poland stems from the role of the institution involved. Knowledge of the preparation and conduct of Allied defence operations could help an adversary assess NATO’s response to a crisis on its eastern flank. Information about personnel could also facilitate the identification of additional intelligence sources within military structures.

Protecting information within a multinational headquarters must therefore encompass both classified military plans and information about the people responsible for preparing and conducting those operations.