The Long Approach

Welcome to your weekly briefing.

Most of what goes wrong in protective security had a long preparation period that no one saw. The attack, the breach, the arrest, these are endpoints, not starting points. Most threats have been building for months or years before anyone notices. The relationships, the access, the cover, all of it gets built quietly, in ordinary settings, by people who don't look like a threat until they do. Rarely is that window days. This week we're looking at what that looks like in practice.

Thomas Weir Pauken II was 50 years old when he pled guilty in a Virginia federal court on June 4. He had lived and worked in China for years. What he had was a business network, a travel schedule, and a handler.

The handler went by "Cathy." She represented China's Ministry of State Security, and Pauken first met her in 2017. By 2019, he was working under her direction.

Cathy directed him to identify potential intelligence assets inside the United States, recruit them, equip them with communication devices, including laptops and cellphones supplied by the MSS, and relay their reports back through her. Pauken was operating as a handler: a middle layer between the MSS and the sources it was building inside America.

He was paid at least $100,000 for this work over seven years. Cathy funded multiple trips between China and the United States between 2019 and 2025, providing cover for meetings that were anything but routine.

Pauken ran three additional handler relationships alongside Cathy. Two individuals he met in 2017, identified in court documents as "Richard" and "William" and believed by Pauken to work for the PRC, gave him separate taskings and told him his reports were going to Japan rather than China. A fourth relationship was commercial: a Wuhan-based group paid him for reports on US technology and the Department of Justice, and asked him to find a cyber espionage specialist for hire.

Four independent handler chains ran in parallel for seven years. None of the US-based sources Pauken was running have been publicly identified. The FBI Philadelphia and Washington Field Offices led the investigation; sentencing is scheduled for September 1 with a maximum penalty of 10 years.

The MSS did not insert an officer into the United States and task him with building a source network. It found a US citizen who was already moving between both countries, already embedded in the kind of professional networks that produce useful contacts, and recruited him into a handler role over a two-year assessment period before active tasking began.

The compartmentalization is the part that tells you how seriously the service treats exposure risk: four independent handler chains, at least two of which Pauken believed were unconnected, mean that burning one relationship leaves the others running.

Pauken's case is less useful as a warning about people with security clearances than as a read on how China builds collection capacity through people who never needed one.

Two decades of expert insights you can trust.

🇱🇧 Lebanon. Israeli airstrikes killed nine people across six locations on June 5, including active Lebanese army officers, raising the conflict's death toll to over 3,500 since March 2026. Lebanese President Joseph Aoun publicly demanded Iran stop using Lebanon as a bargaining chip in broader regional negotiations; Hezbollah rejected the latest ceasefire proposal.

🇺🇦 Ukraine. Russia launched its largest single aerial assault of the war on June 1: 729 weapons, 22 civilians killed, 130 wounded. Ukrainian air defenses intercepted 92% of drones but only 55% of missiles, and none of the eight Zircon hypersonic missiles fired.

🇾🇪 Yemen / Red Sea. Houthi leadership declared a total ban on Israeli-linked maritime navigation in the Red Sea on June 8 and claimed a missile strike targeting Jaffa in Israel. Israel temporarily closed airspace while intercept protocols ran.

🇺🇬 Uganda. The US State Department renewed its Level 4 Do Not Travel advisory for Uganda on June 4, citing crime, terrorism, civil unrest, and an active Ebola outbreak. All DRC border crossings are closed to non-authorized personnel; a 21-day quarantine is in effect for those already in-country.

WORKPLACE VIOLENCE — A 21-year-old Saudi national attacked a University of Surrey campus safety officer with a crossbow at student accommodation in Guildford, UK, on June 4, and was arrested on suspicion of attempted murder; the victim, a safety team member in his 50s, remains hospitalized in serious condition. Crossbows bypass standard metal detection.

ACTIVE SHOOTER — Twelve people were wounded at the Old West End Festival in Toledo, Ohio, on June 6 when at least two shooters opened fire during the 53rd annual street event; a US Navy veteran triaged five of the injured on scene, all twelve survived, and no suspects have been arrested. Soft targets remain the hardest category.