This reading list is drawn from Falcone International's Book of the Month reviews. It covers intelligence analysis, intelligence failure, histories and memoirs of the CIA, the NSA, MI5 and the BND, and the history of tradecraft. We have preferred books that explain how the work is done and why it goes wrong over books that retell famous operations. Each entry gives what the book is, the idea most worth taking from it, the reader it suits and a link to our review.
If you read only three
Begin with How Spies Think by David Omand, which teaches a method for reasoning under uncertainty that transfers directly to commercial decisions. Then read John Hughes-Wilson's Military Intelligence Blunders and Cover-Ups, in which the warning is almost always inside the system before the surprise arrives. Finish with Matthew Aid's The Secret Sentry, a history of the National Security Agency that shows how far gathering information and understanding it can drift apart.
How analysts think
How Spies Think, David Omand
Omand ran GCHQ and was Britain's first Security and Intelligence Coordinator. How Spies Think (2020) argues that an analyst's methods can be learned by anyone deciding without full information. Its four-stage model covers situational awareness, explanation, estimation and strategic notice, and the initials of those stages spell SEES. The lesson is to keep the four questions apart, since most weak assessments blur what is known with why it happened and what may follow. Our review recommends the book to anyone who commissions or reads due diligence, and explains its use of Bayesian updating.
On Intelligence, John Hughes-Wilson
Hughes-Wilson is a former colonel in the British Army's Intelligence Corps. On Intelligence surveys espionage from antiquity to the years after 9/11, arranged by the stages of the intelligence cycle. The idea to keep is the commissioning problem, in which assessments drift toward what the client hopes to hear without anyone intending it. The book suits readers who want the structural argument, and our review warns that the chapters on modern agencies rely more on opinion than on evidence.
How intelligence fails
Military Intelligence Blunders and Cover-Ups, John Hughes-Wilson
This narrower and sharper book covers surprises from Barbarossa and Pearl Harbor to Tet, the Yom Kippur War, the Falklands and, in the revised edition, 9/11 and Iraq. In nearly every case the warning had been collected, and the breakdown came as it traveled toward someone with authority to act. Its most useful idea is that a settled consensus absorbs contrary evidence, so able analysts using a sound method can be wrong together. Our review recommends it to anyone who owns reporting lines or board information, and suggests reading On Intelligence first.
In nearly every case Hughes-Wilson examines, the warning had already been collected before the surprise arrived.
Dark Territory, Fred Kaplan
Kaplan's history of cyber war begins in 1983, when Ronald Reagan asked the Chairman of the Joint Chiefs whether the film WarGames was plausible. Its central finding is that the threat was foreseen early and described accurately, then repeatedly given lower priority. Kaplan also explains the conflict inside state cyber policy, where the agencies defending networks benefit when flaws stay open for collection. Our review suggests that boards read it beside their own old assessments, since most organizations hold a sound warning that was noted and never funded.
The agencies: NSA, MI5, the Black Chamber and the BND
The Secret Sentry, Matthew M. Aid
Aid, a former Air Force Russian linguist and later a corporate investigator, built this NSA history from declassified files and Freedom of Information Act requests. It runs from the postwar years to Afghanistan and Iraq, and includes his reading of the Gulf of Tonkin intercepts of August 1964. The lesson is that collection and comprehension are separate capabilities, and an agency rich in intercepts often lacked the people to read them in time. Our review is aimed at risk and compliance leads deciding between more monitoring and more analysis.
The Defence of the Realm, Christopher Andrew
Andrew, the Cambridge historian given wide access to MI5's files as its official historian, wrote this authorized centenary history, known in its American edition as Defend the Realm. Its wartime chapters are the strongest, setting the double-cross system beside a Soviet penetration of the British state that went largely unseen at the time. The idea worth taking is that an organization sees the threats its structure was built to detect, while newer ones grow unnoticed. At more than a thousand pages it rewards selective reading, and our review suggests which chapters suit general counsel, risk leads and vetting teams.
The American Black Chamber, Herbert O. Yardley
Yardley ran an American codebreaking unit in New York after the First World War until Henry Stimson shut it in 1929, and published this account in 1931. Its chapters on the Washington Naval Conference of 1921–22, when the Americans were reading Japanese diplomatic cables, show what knowing an opponent's fallback position is worth. Our review treats it as the founding insider-disclosure case, since it prompted the Act of June 10, 1933. It suits anyone managing the exit of staff who hold sensitive knowledge. Historians have found exaggerations throughout, so it is best read as an interested insider's account.
Wer hat Angst vorm BND?, Gerhard Schindler
Schindler led Germany's foreign intelligence service, the Bundesnachrichtendienst, between January 2012 and mid-2016, when the federal government replaced him. After the Federal Chancellery reportedly declined to clear his memoir in the form he planned, he published this German-language polemic with Econ in October 2020. His charge is that layers of regulation have turned the service into something closer to an administrative body than an intelligence agency. The wider lesson is that any function whose rules grow faster than its purpose is reviewed will drift toward protecting itself. Our review summarizes it in English for organizations working between Britain, the United States and Germany.
Officers' own accounts: the CIA from the inside
The Art of Intelligence, Henry A. Crumpton
Crumpton served twenty-four years in the CIA's clandestine branch and, after 11 September 2001, organized the Agency's campaign in Afghanistan. His 2012 memoir is best on how a case officer spots, assesses and recruits a human source. The idea worth taking is that a source's information is only as valuable as your grasp of why the source is offering it. That reverses the habit of letting a plausible document end an inquiry. Our review recommends the book to anyone choosing a local partner where the public record is thin. It is an authorized account and says little about the campaign's later consequences.
Black Ops, Ric Prado
Prado spent around twenty-four years at the CIA, beginning in its paramilitary arm and rising to run operations at the Counterterrorist Center. Black Ops (2022) is most useful for procedure, such as testing a source through small repeated checks and planning every operation around a fallback. Its central idea is that trust is extended in stages and withdrawn cheaply, with the most plausible source checked hardest. Our review recommends it to anyone who vets senior people, while treating its policy views as one participant's account.
The Assault on Intelligence, Michael V. Hayden
Hayden is the only person to have headed both the NSA and the CIA. This 2018 book describes what happens when his career's premise, that a well-presented assessment will be acted on, no longer holds. He reads the Russian interference campaign as an effort to erode confidence that anything can be known, which makes confusion an objective separate from deception. Our review recommends it to anyone who delivers unwelcome findings to a board, and points readers who want the institutions to his memoir Playing to the Edge.
Tradecraft and its history
Spycraft, Nadine Akkerman and Pete Langman
Akkerman and Langman, two scholars of the early modern period, study the equipment of intelligence between Elizabeth I and the Restoration, from ciphers and invisible ink to seals and locks. They reconstructed and tested the period's recipes, reporting failures as well as successes. The lesson is that most compromises came from handling, such as keys kept with the letters they protected or methods used after the other side knew them. Our review recommends it to anyone whose controls have gone unrevised for years. Published by Yale in 2024, it is distinct from the Wallace and Melton Spycraft on CIA technical operations.
The Official CIA Manual of Trickery and Deception, H. Keith Melton and Robert Wallace
In the 1950s the CIA hired the magician John Mulholland to write manuals on acting unobserved in plain sight, and this book reproduces them. Melton, an intelligence historian, and Wallace, who once led the Agency's Office of Technical Service, supply the context, including the manuals' origin under MKUltra. Mulholland's principle is that deception steers attention, leaving observers to fill the gaps from expectation. Our review recommends it to security managers who wonder why confident visitors go unchallenged, and to investigators weighing how little witnesses actually notice.
The Irregulars, Jennet Conant
Conant tells how Roald Dahl, posted to Washington in 1942, worked for British Security Coordination, the operation William Stephenson ran from Rockefeller Center to win American support for Britain. Through Charles Marsh, a Texas newspaper owner, Dahl reached Vice President Henry Wallace, whose candid remarks about post-war policy found their way to Churchill. Wallace was befriended rather than recruited or deceived, so the operation ran on introductions and invitations that no intrusion control would notice. Our review recommends it to executives who attend conferences and private dinners, and to the people who protect them.
Countdown to Zero Day, Kim Zetter
Zetter, an investigative journalist covering cybersecurity since 1999, reconstructs Stuxnet from its discovery in June 2010 by a small antivirus firm in Belarus. Stuxnet reached offline machines on removable media, carried stolen signing certificates, and showed operators a recording of normal readings while it damaged centrifuges at Natanz. The idea worth taking is that the attackers went after what Natanz trusted, from contractors to certificates, instead of the plant itself. Our review recommends it to anyone running operational technology, and notes that public attribution took years.
What business intelligence borrows from state intelligence
Commercial intelligence works under different law and for different clients, but several habits these books return to shape how Falcone International runs its own engagements.
Omand's separation of fact, explanation and forecast is the first of them. Our strategic business intelligence reports label each material finding as established, likely or contested, so a board can judge how far to rely on each before it commits.
The second is the multi-source discipline Hughes-Wilson argues for in On Intelligence. In our work a single document or well-placed contact remains a lead until records and people with no link to one another confirm it independently.
The third is Crumpton's attention to motive. In a political risk assessment much of the useful information comes from people in the market. Each account is weighed against the reason its source has for giving it, particularly where a prospective local partner may be politically exposed.
The fourth is Prado's incremental approach to trust. Our executive background investigations verify credentials, dates and records first, then speak to former direct reports and counterparties the candidate did not nominate. The appointment then rests on what has been confirmed.
These books also make visible a boundary that commercial work has to respect. State services can collect by means closed to a private organization. Strategic business intelligence as we practice it does not extend to surveillance, pretexting or inducing anyone to breach a duty of confidence. What transfers is the analytical discipline, together with Hughes-Wilson's point that an assessment matters only once it reaches someone with authority to act. For that reason we settle who will receive each assessment when an engagement is scoped.
Falcone International
Bring us a question like this one
We handle corporate investigations, due diligence, financial investigations and duty of care — usually for people who need something established quietly, and established properly, before it turns into a problem.