What MI5 Actually Does, and What Spy Fiction Gets Wrong

Ask most people what MI5 does and you get one of two answers. It's the British CIA, running agents in foreign capitals. Or it's a secret police force that kicks doors in at dawn. Neither is right, and both mistakes turn up in spy fiction all the time.

MI5 is the UK's Security Service. Its job is to protect the country from threats to national security, mainly at home. It is a civilian intelligence organisation, not a law enforcement agency. That one fact shapes everything about how it works, and how Sarah Sterling works in The Key Series.

What the law says MI5 is for

MI5 dates back to 1909. For most of its history it had no legal footing at all. The Security Service Act 1989 changed that and set out what the service exists to do: protect national security against espionage, terrorism and sabotage, against the activities of agents of foreign powers, and against actions intended to overthrow or undermine parliamentary democracy. The Act also covers safeguarding the UK's economic well-being from threats overseas and, since 1996, supporting the police against serious crime.

In practice, two threats take most of the effort: terrorism and hostile states.

MI5 can't arrest anyone

This is the detail fiction gets wrong most often. MI5 officers have no powers of arrest or detention. When an investigation reaches the point where someone needs to be stopped, the police make the arrest, usually counter terrorism policing working alongside MI5. MI5 finds the threat, assesses it and follows it. The police act on it and build the case for court.

So the dawn raid scene in a thriller should have police officers at the door, with the MI5 officer somewhere behind them, or not there at all. The real tension sits at the handover. Move too early and you lose the wider network. Move too late and people die.

The scale of the work

MI5 employs more than 5,000 people, at Thames House in London and in regional offices across the UK, including Northern Ireland. Only one of them is publicly named: the Director General, Sir Ken McCallum.

In his annual threat update in October 2025, McCallum said MI5 and the police had disrupted 19 late-stage attack plots since the start of 2020. He reported 232 terrorism arrests in the previous year, with around one in five involving under-18s, and a 35% rise in the number of people investigated for state threat activity. He described "more volume and more variety of threat" than he had ever seen.

State threats are back

For most of the 2000s, counter terrorism took the bulk of MI5's resources. The balance has shifted. Russia, Iran and China now feature in every public threat assessment, and the activity goes well beyond classic espionage. When the National Security (State Threats) Bill received Royal Assent in July 2026, McCallum warned of states using arson, sabotage and physical violence against the UK, often through proxies: criminals paid to do work a hostile state wants to deny.

That proxy model sits behind The Grey Wind. Pressure applied without fingerprints, through people who may not know who they work for, designed to stay below the line of open conflict.

Where the intelligence comes from

Most of MI5's work is slower and more methodical than fiction suggests. Intelligence comes from agents, known formally as covert human intelligence sources; from physical and technical surveillance; from GCHQ and SIS (MI6); and from partners in policing, government and industry. The most intrusive methods, such as interception, need a warrant signed by a Secretary of State and approved by a Judicial Commissioner under the Investigatory Powers Act 2016.

Agent running is the part closest to the books. An agent is not an MI5 officer. An agent is a person with access, someone inside a network, a company or a community, who agrees to pass information on. Trained officers handle them under strict rules, and the agent's safety comes first. Most of the drama in real intelligence work lives in that relationship: trust, pressure, doubt, and what happens when a source's story stops adding up.

Who watches MI5

MI5 works under the authority of the Home Secretary. Three bodies oversee it. The Investigatory Powers Commissioner audits its use of intrusive powers. Parliament's Intelligence and Security Committee reviews its work. The Investigatory Powers Tribunal hears complaints from the public.

Fiction tends to cast oversight as the obstacle the hero ignores. In the real world the paperwork is part of the job, and an officer who cuts corners becomes the subject of the next inquiry.

MI5, MI6 and GCHQ

The UK has three intelligence agencies. MI6 works overseas. GCHQ handles signals intelligence and cyber security, which I covered in What GCHQ Actually Does. MI5 owns the threat at home. The joins between them are where cases get won or lost. The Joint Terrorism Analysis Centre, based within MI5, pulls their reporting together and sets the UK's national terrorism threat level, on a five-point scale from LOW to CRITICAL.

Why Sarah Sterling is an MI5 officer

When I built The Key Series, I needed a character who could see the whole domestic picture and still answer to the rules. An MI5 officer fits. Sarah Sterling can't arrest anyone. She can't run an operation abroad without SIS. She has to justify every intrusive step on paper and answer for every call that goes wrong. Those limits give her the best scenes in the books, because every decision costs her something.

James O'Neill, the former SAS operator, stands on the other side of that line. He has the skills and none of the authority. Put the two together and you get the tension at the centre of the series: the person who knows what needs doing, and the person who has to answer for it.

Sources: MI5, About us; MI5, FAQ; MI5, Director General welcomes new legislation (July 2026); Counter Terror Business, MI5 annual threat update (October 2025).

Related Notes: What GCHQ Actually Does · The Insider Problem · Is the tradecraft in British spy fiction actually real?