The best thing about bureaucracy is that it's always right. Until it's wrong, then suddenly it's just an incident.

This week it emerged that a Canadian intern at NATO headquarters SHAPE in Belgium is suspected of espionage. She is said to have been unusually curious, wandered into places she had little reason to be, and shown a particular interest in security procedures.

Of course, that raises the question of how she got in. No, not into the building.

Into the organisation.

Because for a package I order from China, the government nowadays knows almost everything. My bank transactions are recorded, my tax data is linked, my energy consumption is monitored, and soon my trash will probably even be weighed too.

The government will soon know how much butter I put on my bread, but an intern at one of the most heavily guarded military sites in the world? Turns out afterwards they might not have been the right person after all.

That’s talent.

The modern government builds a control system that maps out the entire population, but then trips over its own front door.

This intern probably had to go through dozens of screenings, security checks, recommendations, forms, and digital verifications. Committees met. Signatures were signed. Stamps were placed. Everyone did exactly what they were hired to do.

And yet counterintelligence is now on top of it.

That's pretty much the same as Schiphol proudly announcing that security procedures worked perfectly, after an unknown person had spent three months wandering around in the control tower.

What always fascinates me is the unshakable faith managers have in systems. Another database. More AI. Another European directive. Another authority. As if a spreadsheet has ever solved a lack of common sense.

Maybe that is the real lesson.

Organisations don’t become vulnerable because enemies get smarter. They become vulnerable because leaders start believing that procedures can think.

And when things go wrong, the same bureaucratic ritual always follows. There’s an independent investigation. An evaluation. An improvement plan. A Task Force for Comprehensive Safety Optimisation with a logo, a chairperson, and a communications advisor. Then the control system gets even bigger.

Not smarter.

Bigger.

But I can already draw one conclusion. If NATO really has a security leak, I wouldn’t just be looking for the alleged spy. I’d start at the HR department.

Because the front door seems to have been wide open for a while now.