The Moscow Rules

The Moscow Rules are a set of operational-security maxims associated with CIA officers working in Moscow during the Cold War — the most hostile counterintelligence environment the Agency faced, with the KGB’s Seventh Directorate maintaining pervasive surveillance of known and suspected foreign intelligence personnel. The canonical ten:

1. Assume nothing.
2. Never go against your gut.
3. Everyone is potentially under opposition control.
4. Do not look back; you are never completely alone.
5. Go with the flow, blend in.
6. Vary your pattern and stay within your cover.
7. Lull them into a sense of complacency.
8. Do not harass the opposition.
9. Pick the time and place for action.
10. Keep your options open.

Provenance

The list is folklore with a real pedigree: no declassified CIA document promulgates “the” Moscow Rules, and the canonical enumeration above circulated informally among officers. The list was popularized publicly by Antonio and Jonna Mendez (former CIA technical operations officers) in The Moscow Rules: The Secret CIA Tactics That Helped America Win the Cold War (2019), which frames them around the development of disguise, deception, and “Moscow Rules”-era tradecraft for handling assets under near-total surveillance. Espionage fiction — notably John le Carré’s Smiley novels (rule 4’s “you are never completely alone” appears in spirit in Tinker Tailor Soldier Spy) and Charles McCarry’s novels — carried versions of the rules into general culture. The list is now taught in OPSEC curricula (e.g. the opsec.institute course that preserves the zibaldone copy) as a compact thought exercise.

Why they endure

The rules generalize beyond espionage because they encode operating under a hostile observer with superior local resources — the same structural problem faced by dissidents, journalists with sources, incident responders on a compromised network, and red teamers on an assessed one. Rule 1 (“assume nothing”) and rule 10 (“keep your options open”) are planning doctrine; rules 4–6 are surveillance-countermeasure practice (they map directly onto modern SDR — surveillance detection route — procedure); rules 7–8 are the game-theoretic core: manage the adversary’s beliefs rather than merely your own exposure, an idea formalized differently in cooperation-and-defection and in the wider OODA framing of acting inside the opponent’s observation cycle.

Sources

• The Moscow Rules — Hachette Book Group listing
• OPSEC Institute — Thought Exercise: The Moscow Rules — dead link

Related

• Allen Dulles’s 73 Rules of Spycraft — the documented, single-author precursor: where the Moscow Rules are anonymous field folklore, Dulles’s Some Elements of Intelligence Work is the same genre written down by the DCI himself (security first, cover discipline, “the greatest vice is carelessness”).
• cooperation-and-defection — the adversarial belief-management game
• threat-modeling-adjacent OPSEC practice throughout the security corpus
• unknown-knowns — rule 1’s epistemology
• ten-crack-commandments — the same opsec genre on the other side of the law: folk rules for an illegal market under hostile observation