"You find a spy in East Germany and it's a one-time incident. But with technology, you find one op and you start pulling the thread and all sorts of ops come ou

"You find a spy in East Germany and it's a one-time incident. But with technology, you find one op and you start pulling the thread and all sorts of ops come out of the woodwork." Finding a spy in East Germany and finding a stuxnet are both one time incidents. The next step is processing the spy/malware and learning as much as possible as you can about your enemy; how did the malware propagate, how did the spy enter east germany, who did the spy/malware communicate with and how, etc. I do not think they are any different. What do you mean by separation of operations?