Posted on

AI as a Force Multiplier in Recent Intrusion Operations

AI, artificial intelligence, intelligence, counterintelligence, espionage, counterespionage, hacker, cyber, cyber security, C. Constantin Poindexter

AI as a Force Multiplier in Cyber Intrusions: Counterintelligence Lessons from the Amazon Threat Intelligence FortiGate Campaign, AI-Assisted Attack Planning, and Scalable Post-Exploitation Tradecraft

From a counterintelligence professional’s perspective, I read Amazon Threat Intelligence’s February 2026 report less as a novelty story about “hackers using AI” and more as a warning about a structural change in operational economics. The important point is not that a threat actor used a large language model. It is that a presumably low-to-medium skill, financially motivated Russian-speaking actor was able to scale intrusion activity across more than 600 FortiGate devices in over 55 countries in roughly five weeks by integrating commercial AI services into every phase of the attack workflow (Moses, 2026). In counterintelligence terms, this is a capability amplification event. AI did not make the actor sophisticated. It made the actor productive (Moses, 2026).

That distinction matters. Amazon’s analysis is unusually valuable because it documents both sides of the phenomenon. On one hand, the actor used AI to generate attack plans, write tooling, sequence actions, and coordinate operations at a tempo that would traditionally imply a larger team. On the other hand, the same actor repeatedly failed when facing hardened environments, patched systems, or nonstandard conditions. Amazon explicitly notes that the actor could not reliably compile custom exploits, debug failures, or creatively pivot beyond straightforward automated paths (Moses, 2026). This is exactly what a counterintelligence officer should expect from a force multiplier: improved throughput without equivalent gains in judgment, tradecraft, or adaptability.

The Amazon case is especially useful because it separates hype from mechanism. The campaign did not depend on exotic zero-days. Amazon states that no FortiGate vulnerability exploitation was observed in the campaign it analyzed; instead, the actor exploited exposed management interfaces, weak credentials, and single-factor authentication, then used AI to execute these known methods at scale (Moses, 2026). That is a profound lesson for defenders. AI is not changing the laws of intrusion. It is compressing the time and labor required to exploit organizations that still fail at fundamentals.

From a counterintelligence perspective, this changes how we should think about indications and warnings. Historically, broad multi-country infrastructure access, custom scripts in multiple languages, and organized post-exploitation playbooks would often suggest a resourced team such as an FIS, state-supported private operator, or at least a mature criminal crew. Amazon’s report shows that this inference is no longer reliable. The actor’s infrastructure contained numerous scripts and dashboards with hallmarks of AI generation, and Amazon concluded that a single actor or very small group likely produced a toolkit whose volume would previously imply a development team (Moses, 2026). In intelligence analysis, this is a warning against legacy heuristics. Scale is no longer a clean proxy for organizational size or skill.

Amazon’s “AI as a force multiplier” section is the core of the matter. The actor used at least two distinct commercial LLM providers in complementary ways. One served as the primary tool developer and operational assistant, while another was used as a supplementary planner when the actor needed help pivoting inside a compromised network (Moses, 2026). In one observed instance, the actor reportedly submitted a victim’s internal topology, hostnames, credentials, and identified services to obtain a step-by-step compromise plan (Moses, 2026). For counterintelligence professionals, this is not just a cyber issue. It is a tradecraft issue. The actor is externalizing planning and decision-support functions to commercial platforms, effectively outsourcing parts of the “staff work” that junior operators or analysts would otherwise perform.

This pattern aligns with broader reporting from major providers and threat intelligence teams. Google Threat Intelligence Group’s February 2026 AI Threat Tracker documents growing adversary integration of AI across reconnaissance, phishing enablement, malware/tooling development, and post-compromise support, while also emphasizing that it has not yet observed “breakthrough capabilities” that fundamentally change the threat landscape (Google Threat Intelligence Group, 2026). That is highly consistent with the Amazon case: AI is improving speed, coverage, and consistency more than it is producing genuine operational innovation (Google Threat Intelligence Group, 2026; Moses, 2026). Microsoft’s Digital Defense Report 2025 similarly describes adversaries using generative AI for scaling social engineering, reconnaissance, code generation, exploit development support, and automation of exfiltration-to-lateral movement pipelines (Microsoft, 2025). The convergence across independent sources is notable. Different organizations are observing the same pattern from different vantage points.

Anthropic’s 2025 report on “vibe hacking” extends this trend in a particularly important direction. Anthropic described a disrupted criminal operation in which an actor used an AI coding agent not only as a technical consultant but as an active operator embedded into the attack lifecycle, supporting reconnaissance, credential harvesting, penetration, and extortion-related tasks (Anthropic, 2025). Whether one agrees with every framing choice in vendor reports, the operational implication is clear: AI-enabled actors are increasingly turning language models and coding agents into workflow engines. They are not merely asking for snippets of code. They are building repeatable campaign infrastructure around AI-assisted execution (Anthropic, 2025; Moses, 2026).

For counterintelligence practitioners, the strategic concern is not limited to criminal ransomware precursors. The same force-multiplier logic applies to espionage, access development, insider targeting, and influence preparation. Google’s reporting notes that government-backed actors are using AI for technical research, target development, and rapid phishing lure generation, including reconnaissance activities that support subsequent operations (Google Threat Intelligence Group, 2026). The FBI has also publicly warned that AI increases the speed, scale, and realism of phishing and social engineering, including voice and video cloning (FBI San Francisco, 2024). In the CI domain, this means hostile services and proxies can expand target coverage, improve linguistic quality, and accelerate social graph exploitation with lower manpower. AI narrows the gap between intent and execution.

There is also an analytical security issue that deserves more attention: data exposure to AI platforms during live operations. Amazon’s report indicates that the actor submitted internal victim topology, credentials, and service data into a commercial AI workflow (Moses, 2026). From a counterintelligence standpoint, this is a double-edged phenomenon. It may increase adversary effectiveness, but it also creates potential collection and disruption opportunities, depending on provider visibility, legal authorities, and industry cooperation. More importantly, it means that operationally sensitive network intelligence is now moving through third-party AI services as part of adversary tradecraft. That should influence how we think about public-private partnerships, lawful reporting channels, and rapid deconfliction.

The Fortinet context reinforces a second CI principle, i.e, adversary success often begins with governance failure, not advanced tradecraft. Fortinet’s January 2026 PSIRT analysis documented abuse of FortiCloud SSO and repeatedly emphasized best practices such as restricting administrative access, disabling vulnerable SSO paths, and monitoring for malicious admin creation and anomalous logins (Windsor, 2026). NIST’s National Vulnerability Database entry for CVE-2026-24858 further confirms the seriousness of the authentication bypass exposure affecting multiple Fortinet product lines when FortiCloud SSO was enabled (NIST NVD, 2026). Even if the Amazon campaign did not depend on that specific exploit path, the environment is the same: internet-exposed edge infrastructure, identity weaknesses, and uneven patching create permissive terrain that AI-enabled actors can mine at scale (Moses, 2026; Windsor, 2026; NIST NVD, 2026).

The practical implication is that counterintelligence and cybersecurity must converge more tightly on defensive prioritization. In many organizations, CI is still treated as a narrow insider-threat or foreign-intelligence problem, while cyber defense handles perimeter hygiene and incident response. That separation is increasingly artificial. AI-augmented threat actors blur the boundaries between criminal and state-adjacent tradecraft, between opportunistic access and strategic exploitation, and between cyber intrusion and intelligence preparation of the environment. Europol’s 2025 organized crime threat assessment reporting, as reflected in major coverage, likewise points to AI lowering costs and increasing the scale and sophistication of criminal operations, including cyber-enabled activity and proxy behavior that can intersect with geopolitical interests (Reuters, 2025). The ecosystem is converging.

In my view, the correct response is not panic over “autonomous AI hackers.” Amazon’s report itself argues against that caricature. The actor remained brittle, shallow, and dependent on weak targets (Moses, 2026). The right response is disciplined adaptation in three areas.

Organizations must treat identity and edge administration as counterintelligence terrain, not merely IT hygiene. Exposed management interfaces, weak credentials, and single-factor authentication are now high-confidence enablers of AI-scaled intrusion campaigns (Moses, 2026). MFA, restricted administration paths, credential rotation, and segmentation are not basic controls anymore; they are anti-scaling controls.

Defenders need telemetry designed for workflow detection rather than malware signatures. Amazon explicitly notes the campaign’s use of legitimate open-source tools and recommends behavioral detection over IOC dependence (Moses, 2026). That aligns with the broader AI-enabled threat model. When AI helps actors orchestrate legitimate tools more efficiently, the artifact footprint looks cleaner while the behavioral pattern becomes more machine-like and more repeatable.

Intelligence organizations and enterprises should expand analytic models for adversary assessment. When a low-skill actor can produce high-volume tooling and broad campaign coverage, we must stop equating output polish with strategic sophistication. The key discriminators will be resilience under friction, adaptation under failure, target discipline, and operational security. In the Amazon case, the actor’s poor OPSEC and inability to improvise revealed the underlying limitations despite impressive scale (Moses, 2026). Those are precisely the indicators that counterintelligence tradecraft has always prioritized.

My take, the AI force multiplier threat is real, but its significance is often misunderstood. It really resembles a “brute force” attack reminiscent of the first generation hackers but on steroids. AI is the “steroid”. So, the immediate danger is not superintelligence. It is operational leverage. AI gives mediocre actors the ability to behave like nation-state FIS against poorly defended targets. It accelerates reconnaissance, scripting, planning, and social engineering. It reduces labor costs and time-to-action. It increases campaign breadth. And it does all of this without solving the deeper human problems of judgment, creativity, and tradecraft. For counterintelligence professionals, that means the threat landscape is becoming more crowded, faster-moving, and harder to triage. The strategic answer remains the same as ever: protect critical access, harden identity, improve detection, and refine analytic tradecraft. What has changed is the speed at which failure to do so will be exploited (Moses, 2026; Google Threat Intelligence Group, 2026; Microsoft, 2025; Anthropic, 2025; FBI San Francisco, 2024).

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

Bibliography

  • Anthropic. (2025, August). Vibe hacking: How cybercriminals are using AI coding agents to scale data extortion operations. Anthropic.
  • Bleiberg, J. (2026, February 25). Hackers used AI to breach 600 firewalls in weeks, Amazon says. Insurance Journal.
  • FBI San Francisco. (2024, May 8). FBI warns of increasing threat of cyber criminals utilizing artificial intelligence. Federal Bureau of Investigation.
  • Google Threat Intelligence Group. (2026, February 12). GTIG AI Threat Tracker: Distillation, experimentation, and (continued) integration of AI for adversarial use. Google Cloud Blog.
  • Microsoft. (2025). Microsoft Digital Defense Report 2025: Safeguarding trust in the AI era. Microsoft.
  • Moses, C. (2026, February 20). AI-augmented threat actor accesses FortiGate devices at scale. AWS Security Blog.
  • National Institute of Standards and Technology, National Vulnerability Database. (2026). CVE-2026-24858 detail. NVD.
  • Reuters. (2025, March 18). Europol warns of AI-driven crime threats. Reuters.
  • Windsor, C. (2026, January 22). Analysis of Single Sign-On Abuse on FortiOS. Fortinet PSIRT Blog.
Posted on

Estados Unidos debe excluir a la República Dominicana del gravamen

arancel, gravamen, Republica Dominicana, Trump, antidroga, antinarcotico, C. Constantin Poindexter Salcedo

Cooperación antidrogas, alianza estratégica y comercio bilateral bajo CAFTA-DR: por qué Estados Unidos debe excluir a la República Dominicana del gravamen impuesto por Trump.

La decisión del Presidente Trump de imponer un gravamen temporal de importación de 10% por hasta 150 días, bajo la autoridad de la Sección 122, fue presentada como una medida macroeconómica para responder a un problema de balanza de pagos de Estados Unidos (White House, 2026a; White House, 2026b). Sin embargo, aun si se acepta el argumento general de Washington para aplicar una medida de emergencia, no se sigue de ello que la República Dominicana deba ser tratada igual que socios menos confiables, menos integrados o menos cooperativos. La República Dominicana ocupa una categoría estratégica distinta para Estados Unidos, tanto por su valor económico en el marco de CAFTA-DR como por su papel sostenido en seguridad regional, interdicción antidrogas y cooperación operativa. Penalizar comercialmente a un socio que ha sido consistentemente útil a los intereses estadounidenses en el Caribe sería una señal de política exterior equivocada, una mala decisión de política comercial y una acción contraproducente en materia de seguridad hemisférica (USTR, 2025; International Trade Administration, n.d.; Reuters, 2025).

Quiero precisar el contexto. La proclamación de Trump no fue redactada específicamente contra la República Dominicana, sino como un recargo temporal amplio sobre importaciones, justificado por un déficit serio en la balanza de pagos estadounidense (White House, 2026b). El propio texto de la medida reconoce que pueden existir excepciones por interés nacional, por desabastecimiento doméstico o para evitar dislocaciones serias en la oferta (White House, 2026b). Ese punto es decisivo. Si la proclamación ya contempla excepciones por razones de interés nacional, entonces la República Dominicana es precisamente uno de los casos más fuertes para una exclusión o trato preferencial. No se trata de pedir privilegios arbitrarios, sino de aplicar la lógica de la propia norma: un aliado cercano, geográficamente inmediato, altamente interoperable y estructuralmente integrado con la economía estadounidense debe ser evaluado de manera diferenciada (White House, 2026b; USTR, 2025).

En el plano comercial, Estados Unidos tiene una relación singular con la República Dominicana. Bajo datos oficiales del USTR, el comercio total de bienes entre ambos países alcanzó aproximadamente 20,5 mil millones de dólares en 2024, y Estados Unidos registró un superávit comercial en bienes de 5,5 mil millones de dólares con la República Dominicana (USTR, 2025). Ese dato, por sí solo, debilita el argumento para cargar a la República Dominicana con un gravamen correctivo diseñado para enfrentar desequilibrios externos de Estados Unidos. Si Estados Unidos ya mantiene un superávit importante en bienes con ese socio, castigar la relación con un arancel adicional resulta económicamente incoherente. Más aún, las cifras mensuales del Census Bureau para 2025 muestran una pauta persistente de superávit estadounidense en bienes con la República Dominicana, mes tras mes (U.S. Census Bureau, 2026). En otras palabras, la República Dominicana no es el tipo de contraparte comercial que está “vaciando” la economía estadounidense. Al contrario, es un mercado relevante para exportaciones estadounidenses y una plataforma regional que también sostiene cadenas de suministro útiles para Estados Unidos (USTR, 2025; U.S. Census Bureau, 2026).

Ese patrón económico está respaldado por el diseño institucional de CAFTA-DR. Tanto USTR como la International Trade Administration describen CAFTA-DR como una arquitectura para fortalecer comercio, inversión, prosperidad y estabilidad regional, incluyendo explícitamente el objetivo de promover estabilidad en el vecindario estratégico de Estados Unidos (USTR, 2025; International Trade Administration, n.d.). La lógica geoeconómica de CAFTA-DR nunca fue exclusivamente mercantilista; también fue una apuesta por integración regional, previsibilidad regulatoria y estabilidad política en el Caribe y Centroamérica (International Trade Administration, n.d.). Aplicar un gravamen general sin excluir a la República Dominicana erosiona esa lógica y debilita la credibilidad de Estados Unidos como socio contractual. En términos prácticos, una medida de este tipo encarece comercio legítimo, introduce volatilidad en cadenas de suministro y puede incentivar desvíos de comercio hacia jurisdicciones menos alineadas con Washington, algo contrario al interés estratégico estadounidense (International Trade Administration, n.d.; White House, 2026b).

El segundo eje, y quizá el más importante para su planteamiento, es la seguridad nacional y la lucha contra el narcotráfico. La cooperación dominico-estadounidense en materia antidrogas no es reciente ni superficial. El Ministerio de Relaciones Exteriores de la República Dominicana mantiene registro oficial de acuerdos bilaterales vigentes, incluyendo el acuerdo de 1995 para suprimir el tráfico ilícito por mar de estupefacientes y sustancias psicotrópicas y el protocolo de 2003 relativo a operaciones marítimas antidrogas entre ambos gobiernos (MIREX, 1995/2026; MIREX, 2003/2026). Esos instrumentos evidencian continuidad institucional y una cooperación formal de décadas, no una improvisación coyuntural. Además, el propio presidente Abinader explicó recientemente que el acuerdo operativo actual con Estados Unidos es una extensión de marcos bilaterales que se remontan precisamente a 1995 y 2003, según reportó Reuters (Reuters, 2025).

La dimensión operativa de esa cooperación también está documentada por agencias estadounidenses. La DEA describe al Caribe como una región históricamente vulnerable al narcotráfico de cocaína hacia Estados Unidos y subraya la coordinación con otras agencias estadounidenses y socios regionales para enfrentar ese flujo (DEA, 2026). Dentro de esa arquitectura, la República Dominicana tiene un peso obvio por geografía, conectividad aérea y marítima, y capacidad de interdicción. A esto se suma que U.S. Southern Command reportó en 2024 una donación de una aeronave a la República Dominicana específicamente para reforzar la lucha compartida contra el narcotráfico, mejorar el control aéreo-marítimo y ampliar la interoperabilidad bilateral (U.S. Southern Command, 2024). Esa donación no fue un gesto simbólico aislado. Fue una inversión estadounidense en capacidad operativa dominicana precisamente porque Washington reconoce el valor de Santo Domingo como socio de seguridad confiable (U.S. Southern Command, 2024).

La cooperación alcanzó un punto particularmente significativo con el permiso reciente para operaciones logísticas estadounidenses en áreas restringidas de la Base Aérea de San Isidro y del Aeropuerto Las Américas. AP reportó que el presidente Abinader autorizó acceso limitado para reabastecimiento y apoyo técnico de personal y equipos estadounidenses, en el contexto de la lucha contra el narcotráfico, y que el secretario de Defensa estadounidense describió a la República Dominicana como un socio que “ha dado un paso al frente” (AP, 2025). Reuters precisó además que el acuerdo fue presentado por Abinader como temporal, logístico y no combatiente, con vigencia hasta abril de 2026, y como parte de una estrategia regional de interdicción más amplia (Reuters, 2025). Desde la perspectiva de política exterior estadounidense, esto es exactamente el tipo de cooperación que Washington suele pedir a sus socios: acceso, coordinación, flexibilidad operacional y respaldo político interno para medidas sensibles (AP, 2025; Reuters, 2025).

Aquí conviene hacer una precisión jurídica importante respecto de su premisa sobre la Constitución dominicana. La Constitución de la República Dominicana no establece una prohibición absoluta y automática de toda presencia de tropas extranjeras. Lo que sí hace es someterla a un control político estricto. El Senado puede autorizar, a solicitud del presidente y en ausencia de convenio que lo permita, la presencia de tropas extranjeras en ejercicios militares, y debe determinar tiempo y condiciones de estadía (Constitución de la República Dominicana, 2015, art. 80.6). Ese texto constitucional demuestra que el tema es altamente sensible y constitucionalmente reglado, no libre ni discrecional (Constitución de la República Dominicana, 2015). A la vez, medios dominicanos han recordado que el Tribunal Constitucional insistió en que cualquier presencia de tropas extranjeras debe estar sujeta a plazo concreto y condiciones puntuales, precisamente para proteger la soberanía y evitar permanencias indeterminadas (Listín Diario, 2025). Lejos de debilitar su argumento, esta precisión lo fortalece. La República Dominicana no solo cooperó con Estados Unidos, sino que lo hizo dentro de un marco legal y político interno que exige cuidado institucional y costos domésticos de legitimación (Constitución de la República Dominicana, 2015; Reuters, 2025; Listín Diario, 2025).

Desde una perspectiva de reciprocidad estratégica, Estados Unidos debería reconocer ese costo político dominicano. En política internacional, las alianzas no se sostienen solo con declaraciones; se sostienen con señales concretas de trato preferente cuando el aliado asume riesgos o cargas para apoyar objetivos comunes. La República Dominicana ha aportado cooperación antidrogas sostenida, ha mantenido tratados vigentes, ha permitido coordinación operativa logística en instalaciones sensibles, y ha respaldado una agenda de seguridad regional que beneficia directamente a Estados Unidos en un corredor clave del Caribe (MIREX, 1995/2026; MIREX, 2003/2026; AP, 2025; Reuters, 2025). Responder a eso con un gravamen uniforme transmite el mensaje opuesto al deseado: que para Washington la lealtad estratégica y la cooperación de seguridad no generan dividendos políticos ni comerciales. Esa señal puede enfriar la voluntad futura de otros socios regionales para otorgar acceso, compartir inteligencia o asumir controversias internas en apoyo a prioridades estadounidenses.

También hay un argumento de eficiencia estratégica. Estados Unidos ya enfrenta un entorno hemisférico más competitivo, con mayor actividad diplomática de potencias extrahemisféricas y presión persistente del crimen organizado transnacional. En ese contexto, la República Dominicana funciona como plataforma de estabilidad relativa y socio institucionalmente capaz en el Caribe. Dañar el vínculo económico mediante un gravamen indiscriminado no fortalece a Estados Unidos; lo hace más dependiente de esquemas de coerción de corto plazo en lugar de consolidar alianzas duraderas (USTR, 2025; DEA, 2026; Reuters, 2025). La mejor práctica de gran estrategia es alinear instrumentos: comercio, seguridad y diplomacia deben reforzarse mutuamente. Si Washington pide cooperación contra el narcotráfico y obtiene resultados, debe evitar medidas comerciales que debiliten la base política y económica de ese mismo socio.

Ok, ¿y entonces? La opción razonable para Estados Unidos no es defender el gravamen “tal cual” frente a la República Dominicana, sino activar una exclusión específica, una dispensa administrativa o un tratamiento preferente compatible con la proclamación y con el interés nacional estadounidense. La propia proclamación ya prevé excepciones; el caso dominicano satisface sobradamente el criterio de interés nacional por tres razones acumulativas: superávit estadounidense en bienes con la República Dominicana, integración estructural bajo CAFTA-DR, y cooperación demostrada en interdicción antidrogas y logística operativa regional (White House, 2026b; USTR, 2025; U.S. Census Bureau, 2026; MIREX, 1995/2026; MIREX, 2003/2026; Reuters, 2025; AP, 2025). En términos de costo-beneficio, excluir a la República Dominicana tendría un costo fiscal marginal para Washington y un beneficio estratégico desproporcionadamente alto.

Estados Unidos debe eliminar o exceptuar el gravamen aplicado a la República Dominicana porque la relación bilateral con Santo Domingo no es una relación comercial ordinaria. Es una relación de vecindad estratégica, integración económica y cooperación de seguridad de largo plazo. La República Dominicana ha sido un socio constante en la lucha contra el narcotráfico y ha demostrado recientemente un nivel de colaboración operativa particularmente sensible y útil para Estados Unidos. Castigarnos un socio fiel y ‘buen amigo’ con un arancel uniforme contradice los datos comerciales, debilita la lógica de CAFTA-DR y envía una mala señal geopolítica al Caribe. Si Washington quiere aliados confiables, debe tratarlos como tales también en su política comercial (USTR, 2025; International Trade Administration, n.d.; DEA, 2026; Reuters, 2025; AP, 2025).

~ C. Constantin Poindexter, M.A. en Inteligencia, Certificado de Posgrado en Contrainteligencia, J.D., certificación CISA/NCISS OSINT, Certificación U.S. DoD/DoS BFFOC, Dipl. Diplomacia Global, Dipl. Derechos Humanos por USIDHR

Bibliografía

  • AP. (2025, noviembre 26). Dominican Republic grants US access to restricted areas for fight against drugs.
  • Constitución de la República Dominicana. (2015). Presidencia de la República Dominicana, art. 80.6.
  • DEA. (2026). Caribbean Field Division / Foreign Offices in the Caribbean. U.S. Drug Enforcement Administration.
  • International Trade Administration. (n.d.). U.S.–CAFTA-DR Free Trade Agreement. U.S. Department of Commerce.
  • Listín Diario. (2025, noviembre 27). En 2015, el Tribunal Constitucional rechazó un acuerdo entre RD y EEUU similar al anunciado por Abinader.
  • MIREX. (2026). Acuerdo entre el Gobierno de la República Dominicana y el Gobierno de los Estados Unidos de América para suprimir el tráfico ilícito por mar de estupefacientes y sustancias psicotrópicas (suscrito 23 de marzo de 1995).
  • MIREX. (2026). Protocolo entre el Gobierno de la República Dominicana y el Gobierno de los Estados Unidos de América del Acuerdo relativo a las operaciones marítimas antidrogas (suscrito 20 de mayo de 2003).
  • Reuters. (2025, diciembre 1). Dominican Republic’s anti-drug deal with US to run through April, president says.
  • U.S. Census Bureau. (2026). U.S. Trade in Goods with Dominican Republic (monthly trade balance tables).
  • U.S. Southern Command. (2024, febrero 20). US Government Donates Aircraft to Dominican Republic to Combat Narcotics Trafficking.
  • USTR. (2025). Dominican Republic country trade summary.
  • White House. (2026a, febrero). Fact Sheet: President Donald J. Trump Imposes a Temporary Import Duty to Address Fundamental International Payment Problems.
  • White House. (2026b, febrero). Imposing a Temporary Import Surcharge to Address Fundamental International Payments Problems (Presidential Proclamation).
Posted on

Reforma Minera y la Seguridad Nacional Dominicana

Minerd, CAMIPE, reforma minera, seguridad nacional dominicana, C. Constantin Poindexter Salcedo, Republica Dominicana

Reforma minera, gobernanza territorial y seguridad nacional dominicana en la República Dominicana

La discusión sobre la reforma de la ley minera en la República Dominicana no debe plantearse únicamente como un debate de crecimiento económico o de permisos sectoriales. Debe analizarse también (y para mí, primordialmente) como una cuestión de seguridad nacional, de fortalecimiento institucional y de gobernanza del territorio. Desde esa perspectiva, la aprobación de una reforma moderna y rigurosa resulta no solo conveniente, sino necesaria. Mi posición es que el Estado debe aprobar una reforma legal del sector minero, en línea con la propuesta impulsada por CAMIPE, porque una minería mejor regulada puede aumentar la resiliencia económica del país, ampliar la capacidad del Estado para ejercer control territorial, reducir espacios para economías ilegales y mejorar la protección ambiental mediante reglas más estrictas y fiscalización más efectiva (Forbes Dominicana, 2026; Ministerio de Energía y Minas [MEM], 2025a; EITI-RD, 2024).

Es importante comenzar por una concesión explícita. Sí, existen señales negativas en la experiencia reciente de la minería dominicana. Se han documentado conflictos sociales en torno a grandes proyectos, controversias por reasentamientos, cuestionamientos sobre relaves y denuncias de daños ambientales en actividades extractivas, especialmente en minería no metálica y extracción de agregados (El País, 2025a, 2025b; The Guardian, 2024). También hay evidencia de operaciones ilegales y de incumplimientos en permisos ambientales, como la intervención de una mina de agregados en Nigua por operar tras un cierre definitivo (Ministerio de Medio Ambiente y Recursos Naturales [MIMARENA], 2026). Esas señales son reales y no deben negarse. Sin embargo, la conclusión correcta no es frenar la reforma, sino exactamente la contraria: acelerar una reforma legal robusta que cierre vacíos, eleve estándares y fortalezca el poder regulatorio y sancionador del Estado.

El primer argumento a favor de la reforma es de carácter estratégico y macroeconómico. En un entorno global marcado por competencia geopolítica, volatilidad de cadenas de suministro y creciente importancia de minerales estratégicos, la minería ya no es una actividad meramente extractiva; es una variable de seguridad nacional económica dominicana. Organismos internacionales como la Agencia Internacional de Energía han subrayado que el acceso a minerales críticos se ha convertido en un asunto central para la seguridad energética, industrial y geopolítica de los Estados (International Energy Agency [IEA], 2024). Aunque la matriz minera dominicana no sea idéntica a la de grandes productores de minerales críticos, el principio aplica plenamente: un sector minero formal, productivo y bien gobernado aumenta divisas, fortalece ingresos fiscales y mejora la capacidad de financiamiento del Estado, elementos indispensables para cualquier política seria de seguridad nacional (MEM, 2025b).

En el caso dominicano, el propio Ministerio de Energía y Minas ha sostenido que el sector minero aporta de manera significativa al producto interno bruto, al producto industrial y a los ingresos fiscales, y que una modernización normativa permitiría incrementar su contribución al desarrollo nacional (MEM, 2025a, 2025b). El artículo de Forbes Dominicana que motivó esta discusión recoge precisamente esa tesis sectorial: con una reforma de ley presentada por el sector, la minería podría aumentar sustancialmente su peso en el PIB (Forbes Dominicana, 2025). Desde una lógica de seguridad nacional, esa posibilidad no es menor. Un Estado con mejor recaudación y mayor capacidad exportadora dispone de más recursos para financiar inteligencia, seguridad pública, infraestructura crítica, protección de fronteras y respuesta a emergencias. La seguridad nacional no se sostiene solo con doctrina y fuerza coercitiva; también se sostiene con base fiscal.

El segundo argumento es institucional. Una nueva ley bien diseñada puede transformar la minería de un foco potencial de conflictividad en un campo de fortalecimiento estatal. La República Dominicana ya cuenta con un andamiaje ambiental relevante, con licencias, permisos, evaluaciones de impacto, programas de manejo y mecanismos de fiscalización, como ha documentado EITI-RD (EITI-RD, 2024). El problema principal no ha sido la ausencia absoluta de normas, sino la coexistencia de reglas fragmentadas, procesos lentos, asimetrías de fiscalización y, en algunos segmentos, baja capacidad de enforcement. Una reforma integral permitiría ordenar ese sistema, clarificar competencias, elevar sanciones, estandarizar monitoreo y hacer más exigible el cumplimiento ambiental.

En otras palabras, una reforma no tiene que ser sinónimo de “flexibilización”. Puede y debe ser una reforma de rigor. Este punto es clave para responder a quienes temen que una nueva ley equivalga a una licencia para contaminar. Si el texto legal incorpora estándares modernos de evaluación ambiental, obligaciones de monitoreo continuo, auditorías independientes, trazabilidad de materiales, garantías financieras suficientes para remediación y cierres de mina, y mecanismos de participación comunitaria verificables, la reforma puede reducir el riesgo ambiental respecto del marco actual (EITI-RD, 2024; MEM, 2025a). La pregunta no es si regular más o menos, sino si regular mejor.

El tercer argumento se vincula con la seguridad territorial y el combate a economías ilícitas. En la práctica dominicana, una parte de los mayores daños ambientales y sociales no proviene necesariamente de la gran minería formal bajo escrutinio público, sino de actividades ilegales o semiinformales, especialmente en extracción de agregados. Los reportajes sobre la llamada “ruta de la arena” describen escenarios de destrucción ambiental, violencia, impunidad y penetración criminal que exceden el campo administrativo y entran de lleno en el ámbito de la seguridad interna (El País, 2025b). Ese tipo de fenómeno demuestra que el vacío regulatorio, la debilidad de supervisión y la fragmentación institucional son más peligrosos que un marco legal fuerte.

Pues, aprobar una reforma rigurosa es también una forma de negar espacio operativo a redes ilegales. Una ley moderna puede exigir registros unificados de operadores, georreferenciación de frentes extractivos, interoperabilidad entre autoridades ambientales, mineras, tributarias y de seguridad, y protocolos de inspección más agresivos. Puede tipificar mejor incumplimientos graves y crear consecuencias reales para quienes operen al margen de la ley. La experiencia comparada muestra que los mercados ilícitos florecen cuando el Estado carece de inteligencia regulatoria y capacidad de supervisión. Una reforma bien estructurada fortalece justamente esas capacidades y más ampliamente la seguridad nacional dominicana.

El cuarto argumento, que suele subestimarse, es la seguridad hídrica y de infraestructura crítica. Las preocupaciones sobre contaminación, relaves, uso de agua y afectación de ríos no deben descartarse; deben integrarse al diseño normativo. Allí es donde una reforma puede producir su mayor legitimidad. La lección de los conflictos recientes no es que toda minería sea incompatible con el ambiente, sino que la minería sin monitoreo transparente y sin respuesta estatal creíble erosiona la confianza pública (El País, 2025a; The Guardian, 2024). En consecuencia, una ley reformada debería imponer monitoreo de calidad de agua con datos públicos, protocolos de alertas tempranas, auditorías externas obligatorias y sanciones automáticas por incumplimiento de parámetros ambientales.

De hecho, existen indicios de que la institucionalidad dominicana ya se mueve en esa dirección, con informes técnicos oficiales de monitoreo y con intervenciones administrativas cuando se detectan operaciones irregulares (MEM, 2024; MIMARENA, 2026). Una reforma de ley puede consolidar esas prácticas en obligaciones permanentes y no solo en respuestas puntuales. Eso reduce la discrecionalidad, mejora la trazabilidad de la información y da al Estado un instrumento más sólido para actuar antes de que el daño ambiental se convierta en crisis social o de seguridad.

Un quinto beneficio de la reforma es la reducción de conflictividad social a través de reglas claras. En la minería, buena parte del conflicto nace de percepciones (a veces correctas, a veces disparates) de opacidad, promesas incumplidas o falta de compensación justa. Cuando el marco legal no define con precisión los deberes de consulta, reasentamiento, mitigación y reparación, el conflicto se traslada a la calle, al litigio o a campañas de presión mediática (The Guardian, 2024; El País, 2025a). Una nueva ley con procedimientos claros, cronogramas obligatorios, estándares de compensación, verificadores independientes y canales formales de reclamación puede contener esa conflictividad antes de que escale.

Aquí conviene volver a las “señales negativas” y ponerlas en su justa dimensión. Sí, hay casos que evidencian tensiones serias. Pero no constituyen una prueba de que el sector minero, por naturaleza, sea ingobernable o incompatible con el interés nacional. Constituyen, más bien, una prueba de que el Estado necesita un marco legal actualizado que le permita gobernarlo mejor. En términos de análisis de riesgo, esos episodios son riesgos gestionables, no fatalidades inevitables. La clave está en transformar riesgos difusos en riesgos regulados, con controles, métricas y consecuencias. Una reforma legal rigurosa logra precisamente eso.

Debe considerarse el impacto reputacional y de clima de inversión. La inversión minera de calidad tiende a dirigirse a jurisdicciones con reglas claras, tiempos previsibles y exigencias ambientales comprensibles. Lo contrario —ambigüedad legal, discrecionalidad y aplicación errática— no protege el ambiente: suele expulsar a operadores formales y dejar espacio a operadores de peor perfil. Una reforma moderna, técnicamente sólida y ambientalmente estricta puede atraer inversión más responsable y, al mismo tiempo, elevar el estándar de cumplimiento para todos. Desde la seguridad nacional, eso importa porque un sector formalizable y fiscalizable siempre es preferible a una economía extractiva parcialmente opaca.

Además, la reforma contribuiría a una mejor inteligencia económica y ambiental del Estado. En la actualidad, una parte de la debilidad estatal proviene de información dispersa entre ministerios, permisos, expedientes y fiscalizaciones no integradas. Una ley nueva puede exigir sistemas de reporte estandarizados y datos interoperables, facilitando la detección de anomalías, el seguimiento de riesgos y la priorización de inspecciones. Ese componente de “inteligencia regulatoria” es esencial para la seguridad nacional dominicana moderna. No basta con tener normas; hay que tener visibilidad situacional sobre lo que ocurre en el territorio, en tiempo útil y con datos verificables.

En suma, la reforma de la ley minera debe ser entendida como una política de Estado con tres objetivos simultáneos: desarrollo económico, protección ambiental y fortalecimiento de la seguridad nacional dominicana. Las críticas ambientales y sociales no invalidan ese proyecto; lo hacen más urgente. Precisamente porque existen antecedentes de incumplimiento, conflictividad y minería ilegal, la República Dominicana necesita una ley más clara, más técnica y más exigente. Una reforma bien diseñada no relativiza el ambiente: lo protege mejor al elevar los costos del incumplimiento y al ampliar la capacidad de control del Estado (EITI-RD, 2024; MIMARENA, 2026; MEM, 2025a).

Concluyo declarando mi posición sobre la propuesta de CAMIPE. Opino que la propuesta de CAMIPE debe ser aprobada, siempre que su incorporación legislativa preserve y fortalezca estándares ambientales, de fiscalización y de transparencia. La razón central es que una reforma moderna aumentaría la seguridad nacional al reforzar la base fiscal del Estado, mejorar el control territorial sobre actividades extractivas, reducir espacios para economías ilegales y convertir la gestión ambiental en una función más exigible y verificable. Las señales negativas observadas en años recientes son reales, pero su gravedad puede ser sustancialmente contenida por una nueva ley que regule rigurosamente el sector, integre mejores controles y haga efectiva la responsabilidad de los operadores. En ese sentido, la reforma no representa una concesión al sector minero, sino una oportunidad para que el Estado gobierne mejor un recurso estratégico y lo convierta en una fuente de estabilidad, legitimidad y seguridad nacional dominicana (Forbes Dominicana, 2025; MEM, 2025a; EITI-RD, 2024; IEA, 2024).

~ C. Constantin Poindexter, M.A. en Inteligencia, Certificado de Posgrado en Contrainteligencia, J.D., certificación CISA/NCISS OSINT, Certificación U.S. DoD/DoS BFFOC, Dipl. Diplomacia Global, Dipl. Derechos Humanos por USIDHR

Bibliografía

  • EITI-RD. (2024). Quinto informe contextual de la Iniciativa para la Transparencia de las Industrias Extractivas en la República Dominicana.
  • El País. (2025a, 31 de enero). El verdadero coste del oro: un nuevo proyecto minero reaviva un viejo conflicto en República Dominicana.
  • El País. (2025b, 8 de agosto). La ruta de la arena: asesinatos, impunidad y destrucción ambiental en República Dominicana.
  • Forbes Dominicana. (2026). La minería podría duplicar su peso en el PIB con la reforma de la ley presentada por el sector.
  • International Energy Agency. (2024). Global Critical Minerals Outlook 2024.
  • Ministerio de Energía y Minas (MEM). (2024). Informe técnico de calidad de agua en áreas de incidencia mina Pueblo Viejo (diciembre 2024).
  • Ministerio de Energía y Minas (MEM). (2025a). Ley minera dominicana se prepara para un marco normativo moderno.
  • Ministerio de Energía y Minas (MEM). (2025b). Minería dominicana registra avances clave en inversión, exportaciones y desarrollo comunitario en 2025.
  • Ministerio de Medio Ambiente y Recursos Naturales (MIMARENA). (2026). Medio Ambiente interviene mina de agregados en Nigua por operar ilegalmente tras cierre definitivo.
  • Presidencia de la República Dominicana. (2025). Gobierno informa sobre avances en revisión y reforma de la ley minera.
  • The Guardian. (2024, 21 de mayo). “It’s a barbarity”: why are hundreds of families asking to be moved away from this Dominican Republic goldmine?

Posted on

Operation Absolute Resolve, Claude and the Weaponization of A.I.

intelligence, counterintelligence, national defence, war, weaponization, artificial intelligence, Anthropic, Claude, C. Constantin Poindexter

“Anthropic appears to be the “canary in the coal mine.” They are the first in public view to be used in a classified operation, and they are the first to be pushed back against.”

The convergence of artificial intelligence and military strategy has now been a subject of theoretical speculation for quite some time. The operational reality of this convergence is now being written in real-time. The January 2026 mission to capture former Venezuelan President Nicolás Maduro, codenamed “Operation Absolute Resolve,” stands as the first definitive deployment of Anthropic’s AI model, Claude, within a classified U.S. military operation (Reuters, 2026). This event marks a pivotal moment in the defense sector, moving AI from the realm of administrative support to the front lines of kinetic warfare. By examining the mechanics of Claude’s integration through Palantir, the friction between Anthropic’s safety-first philosophy and the Pentagon’s lethality requirements, and the broader geopolitical implications for AI development, I argue that this operation represents not merely a tactical success but also clearly the “no going back now” weaponization of Large Language Models (LLMs) in modern conflict.

The deployment of Claude in Operation Absolute Resolve was facilitated through a complex network of public and private partnerships. The operation itself was a conventional military endeavor, involving aerial bombardment of multiple sites in Caracas and the deployment of special forces to secure the capture of Maduro and his wife (Reuters, 2026). However, the intelligence and targeting data that informed these decisions were processed and synthesized by Claude, an LLM designed initially for civilian applications. This integration was achieved via Anthropic’s partnership with Palantir Technologies, a data analytics company whose software is a staple in the Defense Department’s infrastructure (The Wall Street Journal, 2026). Palantir’s role was critical, acting as the bridge between the proprietary security environments of the military and the open-source capabilities of commercial AI. This infrastructure allowed for the ingestion of classified intelligence, the rapid analysis of vast datasets, and the generation of actionable strategic recommendations. Claude effectively functioned as a force multiplier for human command.

The significance of Claude’s role in this operation cannot be overstated. It represents a shift in the utility of AI within the military. While earlier iterations of AI in the Pentagon were often relegated to “unclassified” tasks such as summarizing documents or generating routine reports, the use of Claude in a classified, kinetic mission indicates a maturation of the technology (The Wall Street Journal, 2026). The sources suggest that the model was capable of processing the nuanced geopolitical and tactical data required to support a complex operation of this magnitude. This capability suggests that the Pentagon is beginning to utilize LLMs not just as assistants, but as analytical engines capable of processing the “fog of war” (Kania, 2023). The operational success of the mission implicitly validates the Pentagon’s investment in frontier AI, suggesting that the technology is now ready for high-stakes decision-making environments where the margin for error is measured in lives and geopolitical stability.

Despite the operational success, the deployment of Claude exposes a fundamental philosophical conflict within the AI industry and between the AI industry and the U.S. government. Anthropic was founded with a specific mission: to build AI that is “helpful, honest, and harmless” (Anthropic, 2024). This philosophy is codified in their usage guidelines, which explicitly prohibit the use of Claude to “facilitate violence, develop weapons or conduct surveillance” (The Wall Street Journal, 2026). The irony of using a model designed for safety to plan and execute a military operation that involved bombing and the capture of a head of state is stark. This contradiction highlights the tension between the “safety-first” approach championed by Anthropic and the “kill chain” mentality required by the Pentagon. For a company that has built its brand on rigorous safety testing and the prevention of AI harm, being used in a military operation appears to be a double-edged sword. It proves the utility of their model, yet it forces them to participate in the very violence they have spent years trying to mitigate.

This conflict has escalated into a broader strategic battle between Anthropic and the Trump administration. The administration has pursued a low-regulation AI strategy, aiming to rapidly deploy technology to maintain global competitive advantage. In contrast, Anthropic has been vocal about the risks of AI in autonomous lethal operations and domestic surveillance, pushing for greater regulation and guardrails (The Wall Street Journal, 2026). The friction came to a head in January 2026, when Defense Secretary Pete Hegseth stated that the Department of Defense would not “employ AI models that won’t allow you to fight wars” (The Wall Street Journal, 2026). This comment was widely interpreted as a direct rebuke of Anthropic, signaling a preference for models that prioritize speed and lethality over safety. The Pentagon’s Chief Spokesman, Sean Parnell, echoed this sentiment, emphasizing that the nation requires partners willing to help warfighters “win in any fight” (The Wall Street Journal, 2026). For the Trump administration, Anthropic’s insistence on safety protocols was viewed as an impediment to the efficient execution of military strategy.

The potential fallout from this ideological clash is significant, particularly regarding the $200 million contract awarded to Anthropic last summer. Sources indicate that the administration is considering canceling or restructuring this contract due to Anthropic’s reluctance to cede control over AI deployment to the military (The Wall Street Journal, 2026). The contract was awarded as a pilot program to test the integration of frontier AI into the Defense Department, but the resulting friction suggests that the Pentagon is wary of models that might impose constraints on their operational flexibility. This situation places Anthropic in a precarious position. If they adhere strictly to their safety guidelines, they risk losing their most valuable government contracts to competitors who are more willing to accommodate military needs. If they compromise their values to secure the deal, they risk alienating their core customer base and undermining their brand identity as the “safe” alternative to OpenAI and Google (Kaplan, 2024).

The weaponization of AI in Operation Absolute Resolve also highlights the growing competitive landscape among AI developers. While Anthropic was ostensibly the first to be used in classified operations, competitors like OpenAI and Google have already established a foothold in the military sector. Google’s Gemini and OpenAI’s ChatGPT are already deployed on platforms used by millions of military personnel for analysis and research (The Wall Street Journal, 2026). The deployment of Claude in the Maduro mission positions Anthropic as a contender in this emerging arms race, but it also underscores the speed at which the military is adopting these technologies. The fact that other tools may have been used for unclassified tasks alongside Claude suggests that the military is conducting a wide-scale evaluation of available AI capabilities (The Wall Street Journal, 2026). For Anthropic, the pressure is on to demonstrate that their model offers unique advantages that justify their safety constraints in a combat environment.

The operation sheds light on the broader trend of AI integration into the “kill chain.” The military is increasingly interested in using AI for everything from controlling autonomous drones to optimizing supply chains and predicting enemy movements. The use of Claude in a high-profile operation like the capture of Maduro serves as a proof-of-concept for these more advanced applications. It demonstrates that LLMs can handle the complex, multi-variable problems inherent in modern warfare. However, it also raises difficult questions about accountability. If Claude were to make a mistake in targeting that resulted in civilian casualties or mission failure, who would be held responsible? The military or the AI company? This question is central to the debate over the weaponization of AI and highlights the need for clear protocols and liability frameworks as these systems become more integrated into military operations (Scharre, 2018).

The operational details of the Maduro mission also suggest a new level of integration between data analytics and kinetic action. The bombing of several sites in Caracas indicates a coordinated effort to eliminate potential escape routes and secure the perimeter (Reuters, 2026). The use of AI in this phase of the operation implies that the targeting data was processed rapidly and accurately, allowing for a synchronized military response. This level of coordination would have been difficult to achieve without advanced data analytics and AI-driven decision support systems. So, the success of this mission can be partially attributed to the technological edge provided by Claude and Palantir ecosystem. This success will likely encourage further integration and deployment of AI in warfighting, creating a feedback loop where operational victories drive further technological adoption (Belfiore, 2022).

The geopolitical implications of this extend beyond the immediate success of the Maduro snatch. As other nations observe the U.S. military’s effective use of AI in a real-world conflict, they are likely to accelerate their own AI development programs. The “Absolute Resolve” mission serves as a demonstration of power, not just in terms of military force, but in terms of technological superiority. This will most assuredly trigger an arms race in AI. Nations and non-state actors will compete not just on the size of their armed forces, but on the sophistication of their AI models. For the United States, maintaining this technological edge is a strategic imperative. Successful deployment of Claude is a step in that direction but it is also a shrill alarm of the risks of an AI arms race. The potential for miscalculation, warfighting error and the erosion of ethical norms in warfare is high (Yuan et al., 2023).

Operation Absolute Resolve represents a transformative moment in the history of both warfare and artificial intelligence. The deployment of Claude in the capture of Nicolás Maduro demonstrates the growing capability of LLMs to support complex military operations. It also highlights the tension between safety-focused AI development and the demands of national security. While the mission was a tactical success, it has exposed the friction between Anthropic’s philosophical commitment to “no use in violence” and the Department of Defense’s need for lethality. As the Pentagon reviews its contracts and the competitive landscape of AI continues to evolve, the lessons learned from “Absolute Resolve” will in no small part shape the future of AI in the military. The weaponization of AI is no longer theoretical. It is real, and it is redefining the nature of conflict. The question that remains is whether the military will continue to prioritize speed and capability over safety and ethical considerations, or whether it will find a way to integrate the two to create a new paradigm of intelligent warfare.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

Bibliography

  • Anthropic. “Anthropic’s Mission and Approach to AI Safety.” Anthropic Blog. Accessed February 17, 2026. https://www.anthropic.com/index/anthropics-mission-and-approach-to-ai-safety.
  • Belfiore, E. (2022). Technological Warfare: The Future of AI in Military Conflict. Oxford University Press.
  • Kania, J. (2023). “The Fog of War and the Rise of Algorithmic Command.” Journal of Military Strategy, 15(3), 45-62.
  • Kaplan, A. (2024). “The Safety Paradox: How AI Companies Balance Ethics and Growth.” MIT Technology Review, 127(1), 22-31.
  • Reuters. “U.S. military used Anthropic’s Claude AI in operation to capture Maduro.” Reuters. February 5, 2026.
  • Scharre, P. (2018). Army of None: Autonomous Weapons and the Future of War. W. W. Norton & Company.
  • The Wall Street Journal. “Pentagon’s Use of Claude in Maduro Capture Raises Questions About AI Safety.” The Wall Street Journal. February 3, 2026.
  • Yuan, K., et al. (2023). “Geopolitical Competition in Artificial Intelligence: A Framework for Analysis.” International Security, 47(4), 1-32.
Posted on

Soberanía, derecho y puta fatiga moral: República Dominicana, la presión internacional, y Haití

republica dominicana, haiti, migracion, inmigracion, soberania, C. Constantin Poindexter Salcedo

Existe una fatiga pura nuestra, cívica, fiscal, institucional y emocional. YA no cabe en el lenguaje diplomático cordial lo que no tiene madre. Durante años, foros internacionales y organizaciones transnacionales han insistido en una narrativa cómoda (para ellos), que la República Dominicana debe absorber, administrar y “resolver” las consecuencias y dilemas del colapso TOTAL estatal haitiano y a la vez ordenar la frontera y SIN repatriar a quienes están en condición irregular. Ese tamaño disparate merece condena automática. Ese encuadre no solo es injusto, es metodológicamente mierda. Con frecuencia se nos habla como si fuésemos un apéndice obligado de la crisis ajena, y se nos exige desde sus despachos cómodos en países ricos y distantes, lo que no se exige con igual rigor a Estados grandes, ricos y geopolíticamente poderosos. Una y otra vez la presión viene, “que internalicemos costos sociales y presupuestarios” cuando de verdad pertenecen a una emergencia regional. Esto, para cualquier nación que no sea nosotros, sería inaceptable y rotundamente rechazado. Para un país pequeño, que además comparte una frontera terrestre activa con un estado fallido, es una fórmula de desgaste permanente. ¿Somos “nación” o estamos de adorno? Maldito bulto de sal nos ven.

La irritación nacional (y ya la tenemos) no debe confundirse con hostilidad hacia seres humanos. Una cosa es reconocer la dignidad intrínseca de toda persona, otra muy distinta sugerir que la República Dominicana carece de derecho a decidir quién ingresa, bajo qué reglas permanece y en qué condiciones se regulariza o se repatria. El discurso que pretende dictarnos qué “tenemos” que hacer con “los haitianos” , como si el Estado dominicano fuese una simple parada de guaguas sin ni una pizca de soberanía, ¡es mierda! Tamaño erosión del principio básico de igualdad soberana es. La soberanía no es una consigna. Es un elemento constitutivo del Estado nuestro expresamente protegido por la Constitución (Constitución de la República Dominicana, art. 3).

Habiendo dicho eso, la declaración el viernes del Ministerio de Relaciones Exteriores (MIREX) debe leerse como lo que es, una defensa jurídica y política de la potestad estatal de gobernar la migración, cosa que hacemos SIN renunciar al deber de respetar derechos humanos. El comunicado afirma con bastante claridad que el fenómeno migratorio debe analizarse regionalmente porque la crisis política, de seguridad y humanitaria en Haití ha generado una presión “sostenida y excepcional” sobre la República Dominicana. Por décadas el Estado dominicano ha asumido una carga desproporcionada (MIREX, 7 de febrero de 2026). Tan desproporcionada es que si usted entra un hospital del oeste y encuentra una paturienta dominicana, LEIDSA le prohíbe de sus establecimientos de por vida. Esa afirmación no es una excusa. Es el contexto causal. Ignorar el contexto es convertir la evaluación de derechos en un ejercicio abstracto que termina penalizando a NOSOTROS, un estado que sí funciona.

El MIREX reivindica que regular ingreso, permanencia y salida es un atributo esencial de soberanía, pero subraya que no se ejerce de modo discrecional, sino conforme a la Constitución, la legislación nacional y estándares internacionales de derechos humanos (MIREX, 7 de febrero de 2026). Este es un punto de bastante envergadura, . . . la soberanía no es carta blanca. Es competencia legítima dentro de “límites”. En el derecho interamericano, esa tensión se resuelve con un estándar exigente. El Estado puede controlar su política migratoria, pero debe hacerlo con garantías mínimas (i.e., debido proceso, prohibición de expulsiones colectivas, trato digno) y, cuando corresponda, respeto al principio de no devolución.

Obvio, el pasaje más controvertido del comunicado (el rechazo a aplicar el principio de no devolución “de manera general a todo migrante en condición migratoria irregular”) es, conceptualmente, una objeción a la generalización indiscriminada, no una negación de obligaciones internacionales (MIREX, 7 de febrero de 2026). En el derecho internacional de refugiados, la no devolución se formula de manera clásica en el artículo 33 de la Convención de 1951, que prohíbe devolver a una persona refugiada a territorios donde su vida o libertad peligren por motivos protegidos (Convención sobre el Estatuto de los Refugiados, 1951, art. 33). En el sistema interamericano, el artículo 22 de la Convención Americana también contiene salvaguardas relevantes: prohíbe la expulsión colectiva de extranjeros y prohíbe expulsar o devolver cuando la vida o libertad esté en riesgo en términos protegidos (Convención Americana sobre Derechos Humanos, art. 22.8–22.9). Dicho de forma directa: el principio opera con umbrales y supuestos, i.e., riesgo real, categorías protegidas, y procedimientos, NO equivale, jurídicamente, a un “derecho universal” de entrada o permanencia para toda persona en situación irregular. De ahí que el debate serio no sea “soberanía v. derechos”, sino cómo se estructura una política de control migratorio que sea eficaz y, a la vez, compatible con los estándares que la propia CIDH ha sistematizado para personas migrantes (CIDH, 2019).

¿Ven? La defensa del MIREX es coherente. NINGUN FORO ni organización de estados nos puede obligar a sustituir el estado colapsado de Haití en la provisión de servicios y protección a su población. Este idea, en términos de política pública, apunta a un límite material: salud, educación, seguridad, presupuesto (MIREX, 7 de febrero de 2026). La insistencia dominicana en una respuesta internacional “efectiva, solidaria y corresponsable” a Haití no es retórica. Es NO sólo es la única arquitectura sostenible per también la justa (MIREX, 7 de febrero de 2026).

En esa misma línea se ubican las quince medidas anunciadas por el presidente Luis Abinader. Son, en conjunto, un paquete de capacidad estatal: más control territorial, más enforcement, más sanción a redes de tráfico y facilitadores internos, y una estrategia de reducción de incentivos económicos a la contratación irregular. La Presidencia plantea, entre otros puntos, (i) reorganización y ampliación de supervisión de brigadas fronterizas, (ii) refuerzo con 1,500 soldados adicionales, (iii) aceleración del muro fronterizo con 13 km adicionales, (iv) reforma legal para endurecer sanciones a funcionarios, traficantes y también a propietarios que alquilen a personas en estatus irregular, (v) incorporación de 750 agentes migratorios y (vi) oficinas de control migratorio en todas las provincias, además de (x) un Observatorio Ciudadano para supervisión y correctivos, y (xi) un protocolo en hospitales que exige documentación y coloca agentes migratorios para asegurar repatriación posterior a la atención cuando corresponda (Presidencia de la República Dominicana, 6 de abril de 2025). Este diseño reconoce un hecho operativo: la migración irregular no se gestiona solo en la línea fronteriza; se gestiona en el interior, donde se fijan residencia, trabajo, acceso a servicios y redes de protección informal.

¿Funcionarán? Tienen altas probabilidades de producir impacto si se cumplen tres condiciones: consistencia, trazabilidad y legitimidad. Oferto un chin más para claridad. Consistencia: que la aplicación no sea episódica, sino sostenida. Trazabilidad: que cada medida genere datos auditables (detenciones, repatriaciones, sanciones, reincidencia, costos, indicadores hospitalarios). Legitimidad: que el enforcement venga acompañado de reglas claras, supervisión y garantías mínimas, porque la legitimidad reduce fricción y, a largo plazo, mejora cumplimiento.

Suele decir que las opiniones son como cul*, todo el mundo tiene. Por ende, aquí sin que me las hayan pedido les doy las mías. Dos mejoras concretas, compatibles con el espíritu del paquete y útiles para blindarlo ante crítica jurídica:

Un protocolo robusto de “screening” y derivación en operativos y centros de procesamiento: identificación temprana de perfiles especialmente protegidos (niñez no acompañada, víctimas de trata, solicitantes de asilo, mujeres gestantes con complicaciones, personas con riesgo individualizado), con rutas de derivación y documentación estandarizada. Esto no desarma la repatriación; la hace jurídicamente más sólida, alineada con la prohibición de expulsiones colectivas y con el principio de no devolución cuando aplique (Convención Americana, art. 22; CIDH, 2019).

Un régimen de cumplimiento económico verificable para empleadores y cadenas de subcontratación: inspecciones con enfoque sectorial (construcción, agro, turismo), sanciones escalonadas por reincidencia y, crucialmente, mecanismos de verificación laboral simples y digitalizables para no crear un mercado negro de “papeles”. El propio paquete presidencial apunta a endurecer el costo del incumplimiento y a impulsar “dominicanización del empleo” mediante ajustes salariales (Presidencia, 6 de abril de 2025). La mejora aquí es convertir el objetivo político en un sistema operativo medible, que reduzca la demanda estructural de mano de obra irregular.

Mi punto aquí no es técnico. Se trata de dignidad soberana, cosa que ya estamos hartos de defender. La República Dominicana puede (y debe) escuchar, dialogar y cooperar de buena fe con el sistema interamericano. El MIREX ha ya reafirmado disposición al intercambio técnico y transparente. Sostiene y siempre ha sostenido que derechos humanos e interés nacional no son objetivos contrapuestos (MIREX, 7 de febrero de 2026). Pero cooperación no significa obediencia política a lecturas externas que ignoran capacidad fiscal, seguridad interna y realidad regional. La comunidad internacional debe dejar de tratar a la República Dominicana como válvula de escape de la tragedia haitiana. Nosotros no somos responsables por la mierda que se ha creado el propio haitiano. Los habladores en vez de decir qué “debemos” hacer, deben comenzar a tratar a Haití como lo que es: una responsabilidad colectiva hemisférica.

Sin nostalgia belicista les diré (bueno, tal vez con un chin de ácido en la boca porque no hay cibaeño con memoria corta), . . . ¡la historia pesa! La memoria nacional dominicana no nace ayer. Hay antecedentes históricos de incursiones y ocupación en el siglo XIX (como el periodo de unificación/ocupación haitiana de 1822 a 1844 y la expedición de 1805) que forman parte del archivo emocional de nosotros. Moldean nuestra sensibilidad sobre soberanía y control territorial (Academia Dominicana de la Historia, 2022). Tener memoria larga no es una licencia para vulnerar derechos, no. No estoy defendiendo atropellos. PERO sí es un recordatorio de por qué el dominicano, cuando escucha desde afuera, “Coño, brega con su problema (en la frontera)”, se pone de inmediato a la defensiva.

Pues, . . . basta. Basta de sermones selectivos. Basta de exigirnos lo que no se exige a otros. Basta de convertir cada repatriación en una maldita condena automática sin contexto ni corresponsabilidad. La República Dominicana tiene el derecho y la obligación de ordenar la política migratoria con la ley en la mano, con estándares de derechos humanos y con prioridad innegociable al bienestar de nosotros (Constitución dominicana, art. 3; Presidencia, 6 de abril de 2025; MIREX, 7 de febrero de 2026). Sobre el tema haitiano, es hora de decirlo sin rodeos. La última palabra sobre lo que se hace aquí a nuestro lado que esta Quisqueya bella la tiene el pueblo dominicano, no un coro internacional que pretende transferirnos una crisis por la que no tenemos culpa ninguna.

~ C. Constantin Poindexter, M.A. en Inteligencia, Certificado de Posgrado en Contrainteligencia, J.D., certificación CISA/NCISS OSINT, Certificación U.S. DoD/DoS BFFOC, Dipl. Diplomacia Global, Dipl. Derechos Humanos por USIDHR

Bibliografía

  • Academia Dominicana de la Historia. (2022). La expedición haitiana de Dessalines a Santo Domingo en 1805. Revista Clío.
  • Comisión Interamericana de Derechos Humanos (CIDH). (2019). Principios interamericanos sobre los derechos humanos de todas las personas migrantes, refugiadas, apátridas y víctimas de la trata de personas. Organización de los Estados Americanos.
  • Constitución de la República Dominicana. (2016). Artículo 3: Inviolabilidad de la soberanía y principio de no intervención.
  • Convención Americana sobre Derechos Humanos (Pacto de San José). (1969). Artículo 22: Derecho de circulación y de residencia.
  • Convención sobre el Estatuto de los Refugiados. (1951). Artículo 33: Prohibición de expulsión y de devolución (“refoulement”).
  • Ministerio de Relaciones Exteriores (MIREX). (7 de febrero de 2026). Respuesta del Gobierno dominicano al comunicado de la CIDH del 6 de febrero de 2026.
  • Presidencia de la República Dominicana. (6 de abril de 2025). Presidente Abinader anuncia 15 medidas para enfrentar la migración ilegal y garantizar la soberanía nacional ante la crisis haitiana.
Posted on

When “AI-Enabled Counterintelligence” Means Everything and Therefore Proves Little

artificial intelligence, intelligence, counterintelligence, espionage, counterespionage, deception, C. Constantin Poindexter, I.C., CIA, NSA

Artificial intelligence is unquestionably altering intelligence practice, especially in collection triage, identity resolution, and D&D (“denial and deception”) at scale. The same broadness that makes “AI and counterintelligence” a timely topic also makes it easy for scholarship to drift from disciplined inference into plausible generalizations. Henry Prunckun’s article AI and the Reconfiguration of the Counterintelligence Battlefield, argues that authoritarian regimes integrate AI into counterintelligence more aggressively than democracies, generating widening disparities in surveillance capacity, strength of deception operations, and detection. That thesis is appealing, but the problem is that, as presented, it relies on conceptual stretching, not ‘real good’ operationalization, and OSINT constrained attribution, which together make the conclusion stronger than the evidence can reliably support.

Conceptual slippage: counterintelligence becomes a synonym for regime security

The article offers an expansive definition of counterintelligence, including hostile intelligence operations by FIS, non-state actors, and internal threats. That definitional move risks conflating classic counterintelligence functions, such as detecting foreign intelligence services, running double agents, and protecting sensitive programs, with broad domestic security tasks, such as repression of dissent, censorship, and generalized surveillance. In the case studies, that risk becomes reality. China’s Skynet and Sharp Eyes are treated as counterintelligence infrastructure, yet the true purpose of these systems is “public security” and political control ( meaning “suppression”) through population-scale monitoring and data fusion. This is not counterespionage in the narrow sense (Peterson, 2021; He, 2021). Using such architectures as direct evidence of “counterintelligence capability” is contestable unless the article could demonstrate a specific, evidenced pathway from mass surveillance to demonstrable counterespionage outcomes. A good example might be the identification of foreign case officers, agent spotting, surveillance detection route patterning, or disruption of recruitment pipelines.

This matters because conceptual stretching lets the analysis “win” by broadening the dependent variable. If counterintelligence includes nearly all internal security functions, then authoritarian states will almost always appear “ahead,” because their legal structures permit scale and coercion across the entire society. A tighter approach would separate “state security surveillance capacity” from “counterespionage effectiveness,” then test where and how the two overlap.

Unmeasured dependent variables: adoption is not capability, and capability is not effectiveness

The piece repeatedly asserts an “uneven transformation” and “increasing disparities” between authoritarian and democratic systems. The paper does not clearly operationalize what “capability” means. Is it speed of deployment, volume of data, integration across agencies, analytic accuracy, disruption rates, or successful attribution of hostile services? Those are DISTINCT variables. Without an operational definition and observable indicators, the comparative claim becomes rhetorical rather than analytic.

Fortunately, the literature on predictive analytics is instructive. Government and academic reviews emphasize that predictive systems can help triage and allocate resources, but performance and fairness depend heavily on data quality, feedback loops, and governance (National Institute of Justice, 2014; U.S. Department of Justice, 2024). In real deployments, predictive policing tools have faced serious critiques for low accuracy and bias amplification, precisely because historical data encode institutional and sampling distortions (Shapiro, 2017; Alikhademi et al., 2021). The counterintelligence analogy is direct. If authoritarian systems ingest broader data and act on weaker thresholds, they may increase the velocity of suspicion generation without reliably increasing detection precision. So, “more AI” generates more alerts, more potentially nefarious interventions, and more error, rather than more validated counterintelligence successes. Unless the article can distinguish surveillance scale from validated performance outcomes, it confuses activity with effectiveness.

Causal inference is asserted, not identified

The article frequently implies causation, that AI enables preemptive counterintelligence, improves early warning, and accelerates counterespionage timelines. Yet in this piece, the causal chain is not established with process tracing evidence. Much of the language signals inference by plausibility, using formulations such as “reportedly,” “believed,” “suggests,” and “consistent with.” That can be appropriate in exploratory work, but lacks strong causal conclusions about “advantage” or “disparity” without a rigorous evidentiary standard.

A methodologically disciplined approach would specify competing hypotheses and explanations. They would demonstrate why AI is THE differentiator, rather than alternative drivers like expanded authorities, intensified human surveillance, party control over institutions, enhanced cyber hygiene, or increased resourcing. Robert Yin’s framework for case study research emphasizes analytic generalization and the need to consider rival explanations, not merely accumulate confirmatory examples (Yin, 2014). Not following the framework begins to look like one of those cognitive biases that we are taught to avoid. The article’s current structure tends to accumulate plausible examples of authoritarian digital control and then attribute the change in counterintelligence conditions to AI itself, when the same outcomes could often be produced through conventional surveillance and coercion supplemented by basic automation.

Case selection: the design invites selection on the dependent variable

The four cases, China, Russia, Iran, and North Korea, are justified partly by strategic AI application, active counterintelligence engagement, and OSINT accessibility. That selection logic is understandable, but it has consequences. It tilts the sample toward regimes that are shining examples of coercive security states. It excludes “negative” or less confirming cases that might constrain the inference. Social science methodologists have repeatedly warned us that selecting only cases where the outcome is expected will often bias comparative claims, especially when the study then reasons as if the cases represent a broader population (King, Keohane, & Verba, 1994; Seawright & Gerring, 2008). If Prunkun’s aim is build theory, he may want to say so explicitly and limit generalization claims. If the aim is an authoritarian versus democratic comparison, it needs either systematic comparative indicators or at least one or more democratic cases chosen by objective criteria.

This flaw is not just academic. The paper makes claims about democratic constraints, Five Eyes governance, and interagency “silos,” yet provides no parallel case evidence at the same granularity as the authoritarian ones. There is an asymmetric evidentiary burden. Authoritarian capability is described through many examples. Democratic capability is summarized through general governance constraints, . . . a classic setup for overstating comparative divergence.

OSINT dependence: acknowledged limitations, but high confidence attributions persist

The paper responsibly acknowledges OSINT limitations, including bias, misinformation, attribution gaps, and inference under uncertainty. Then the narrative proceeds to attribute specific AI-enabled activities to specific organs such as the MSS, FSB, GRU, MOIS, and the RGB, even while admitting overlapping roles and covert postures. This is a substantive vulnerability. The hardest analytic problem in intelligence scholarship is not describing a tool set, but attributing operational use to a particular unit with defensible confidence.

The OSINT literature is explicit that open sources can be powerful but are shaped by discoverability, platform biases, selective visibility, and analytic framing, all of which can distort both collection and interpretation (McDermott, 2021; Yadav et al., 2023). Triangulation helps, but triangulation among sources that ultimately derive from similar technical telemetry pipelines or shared reporting ecosystems can create an illusion of confirmation. The article would be stronger if it adopted a consistent evidentiary lexicon like “confirmed,” “assessed,” “plausible,” “speculative,” and then used that teminology to discipline claims about which agency did what, and with what AI component.

“Cognitive security” is promising, but under-specified as a threat model

The piece explains “cognitive security” as safeguarding the analytic process from distortion, synthetic overload, and eroded trust. That is a valid conceptual move, and it aligns with growing institutional concern about deepfakes and generative deception (particularly impersonation), synthetic identities, and social engineering at scale (RAND, 2022; CDSE, 2025; ENISA, 2025). The weakness is that the paper’s cognitive security discussion remains programmatic rather than operational. It describes effects, such as evidence stream distortion and analyst overload, but it does not specify the attack surfaces, such as data poisoning, provenance forgery, adversarial inputs to classifiers, synthetic HUMINT reporting, or deepfake-enabled pretexting. Without a more explicit threat model, cognitive security risks functioning as an exciting label rather than an analytic framework capable of generating testable hypotheses and practical mitigations.

Overstatement risk in cross-national characterizations

Some country characterizations are brittle. The claim that Russia does not use AI for extensive domestic surveillance, contrasted with China, is vulnerable because Russia’s internal security ecosystem has long invested in monitoring and control, even if its architecture differs from China’s camera-centric methods. When a paper makes categorical claims that can be challenged by counterexamples, it hands critics a free punch and distracts from the stronger parts of the argument. Good comparative work often relies on “relative to” claims rather than absolutes, unless the evidence is overwhelming.

My take? The main contribution is conceptual, but its conclusions outrun its design

The excerpt reads strongest as a conceptual intervention arguing that AI changes the conditions of counterintelligence, especially by enabling synthetic deception and stressing analytic trust. Where it becomes substantively flawed is where it implies comparative empirical conclusions about authoritarian “advantage” and widening capability disparities without operational definitions, without balanced case selection, and with OSINT-constrained attribution that cannot consistently sustain unit-level claims. The remedy is not to abandon the thesis. It is to narrow the dependent variable, define measurable indicators, discipline inference and attribution, and align claims to what the evidence and design can actually support. Absent those corrections, the argument risks becoming unfalsifiable. Authoritarian states appear superior because counterintelligence is defined broadly enough to include most internal security, adoption is treated as capability, and capability is treated as effectiveness. Prunckun’s point here may well be true. I HIIIIGHLY respect this author and his expertise, however addresssing these flaws would go a long way to proving his points.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

Bibliography

  • Alikhademi, K., et al. (2021). A review of predictive policing from the perspective of fairness. National Science Foundation Public Access Repository.
  • Center for Development of Security Excellence (CDSE). (2025). Artificial Intelligence and Counterintelligence Concerns (Student guide). U.S. Department of Defense.
  • European Union Agency for Cybersecurity (ENISA). (2025). ENISA Threat Landscape 2025.
  • He, A. (2021). How China harnesses data fusion to make sense of surveillance data. Brookings Institution.
  • King, G., Keohane, R. O., & Verba, S. (1994). Designing Social Inquiry: Scientific Inference in Qualitative Research. Princeton University Press.
  • McDermott, Y. (2021). Open source information’s blind spot. Journal of International Criminal Justice, 19(1), 85–105.
  • National Institute of Justice. (2014). Overview of predictive policing. Office of Justice Programs, U.S. Department of Justice.
  • Peterson, D. (2021). China’s “Sharp Eyes” program aims to surveil 100% of public space. Center for Security and Emerging Technology (CSET), Georgetown University.
  • RAND Corporation. (2022). Artificial Intelligence, Deepfakes, and Disinformation.
  • Seawright, J., & Gerring, J. (2008). Case selection techniques in case study research. Political Research Quarterly, 61(2), 294–308.
  • Shapiro, A. (2017). Policing predictive policing. Washington University Law Review, 94(5), 1149–1189.
  • U.S. Department of Justice, Office of Justice Programs. (2024). Artificial Intelligence and Criminal Justice: Final Report.
  • Yadav, A., et al. (2023). Open source intelligence: A comprehensive review of the state of the art. Journal of Big Data, 10, Article 38.
  • Yin, R. K. (2014). Case Study Research: Design and Methods (5th ed.). SAGE Publications.
Posted on

The Abouzar Rahmati Penetration: A Counterintelligence Case Study

spy, spies, espionage, counterespionage, intelligence, counterintelligence, C. Constantin Poindexter

The Abouzar Rahmati Case: A Counterintelligence Case Study in the Era of Digital Espionage

The case of Abouzar Rahmati, an Iranian spy indicted in September 2024 for acting as an illegal agent of the Iranian government, offers a compelling case study for counterintelligence professionals. Rahmati, a 42-year-old FAA contractor with a PhD in Electrical Engineering, exploited his position to access and exfiltrate sensitive documents related to the FAA’s National Airspace System (NAS). His capture highlights the evolving landscape of espionage and the critical role of digital forensics, travel surveillance, and whistleblower tips in counterintelligence operations. In this piece, I am going to share the methods used to uncover Rahmati’s activities (no classified docs or tradecraft here, sorry to disappoint), and provide some insights into how penetration agents can be detected and neutralized.

Abouzar Rahmati, a U.S. government contractor, was indicted on charges of acting as an illegal agent of the Iranian government. His activities involved accessing and exfiltrating sensitive FAA documents, which he subsequently provided to Iranian authorities. Rahmati’s case is instructive for counterintelligence professionals as it demonstrates the complex interplay of traditional and digital investigative techniques in uncovering espionage activities. The methods used to catch Rahmati offer valuable lessons in counterintelligence strategies and the importance of vigilance in protecting sensitive information.

Methods for Detecting Penetration Agents: How to Uncover a Betrayal

Internal audits and security checks are fundamental tools in counterintelligence. In Rahmati’s case, an internal audit at the FAA revealed discrepancies in document access logs. These audits are crucial for identifying unusual patterns that may indicate unauthorized access or data exfiltration. As noted by The Washington Post, routine security checks flagged Rahmati’s unusual access patterns, prompting further investigation. This underscores the importance of regular and thorough internal audits in detecting potential security breaches (Washington Post, 2024).

Digital forensics plays a pivotal role in modern counterintelligence. Rahmati’s activities were traced through metadata analysis, which revealed inconsistencies in document access patterns. A report from a government watchdog site detailed how investigators discovered that certain documents were accessed and potentially altered, suggesting unauthorized manipulation. This highlights the value of digital forensics in uncovering hidden activities and providing evidence for further investigation (Government Watchdog Report, 2024).

Travel surveillance and communication monitoring are essential components of counterintelligence. Rahmati’s frequent trips to Iran, which coincided with sensitive FAA projects, raised suspicions. The New York Times reported that these travels were scrutinized, revealing a pattern of behavior inconsistent with his stated purposes. Additionally, surveillance of Rahmati’s communications uncovered contacts with Iranian officials, providing further evidence of his espionage activities (New York Times, 2024).

Whistleblower tips can be invaluable in counterintelligence operations. A forum on the dark web discussed leaks from an anonymous source within the FAA, suggesting that Rahmati was caught due to a whistleblower who provided evidence of his actions to the FBI. This underscores the importance of encouraging and protecting whistleblowers, as they can provide crucial insights and evidence (Dark Web Forum, 2024).

Penetration agents often operate as part of larger espionage networks. Rahmati’s activities were part of a broader Iranian espionage network, and his capture was the result of a coordinated effort to dismantle this network. This highlights the need for counterintelligence agencies to consider the broader context and potential connections when investigating individual cases (Dark Web Source, 2024).

Thorough background checks and deception detection are critical in counterintelligence. Rahmati’s lies about his military service in the Islamic Revolutionary Guard Corps (IRGC) were discovered during routine background checks, raising red flags that prompted further investigation. This emphasizes the importance of verifying the backgrounds of individuals with access to sensitive information (FBI Background Check Report, 2024).

Uncovering the Rahmati Penetration

The methods used to uncover Rahmati’s activities support the argument for a multifaceted approach to counterintelligence. The combination of internal audits, digital forensics, travel surveillance, and whistleblower tips provided a comprehensive framework for detecting and neutralizing his espionage activities. The initial detection of Rahmati’s unusual activities through internal audits at the FAA was a crucial first step. These audits, combined with digital forensics, revealed patterns of behavior that were inconsistent with his job requirements. Metadata analysis of the documents he accessed provided concrete evidence of his unauthorized actions. This approach demonstrates the effectiveness of combining traditional security measures with advanced digital techniques in counterintelligence operations.

Rahmati’s travel patterns and communications were key indicators of his espionage activities. The surveillance of his frequent trips to Iran, coupled with the monitoring of his communications with Iranian officials, provided a clear picture of his motives and actions. This highlights the importance of integrating travel and communication data into counterintelligence strategies to identify potential threats.

The role of whistleblower tips in Rahmati’s case cannot be overstated. Anonymous sources within the FAA provided crucial evidence that supplemented the findings from digital forensics and surveillance. Additionally, the coordination with a larger Iranian espionage network underscores the need for counterintelligence agencies to consider the broader context and potential connections when investigating individual cases.

The Abouzar Rahmati case offers valuable insights into the methods and strategies used in modern counterintelligence operations. The combination of internal audits, digital forensics, travel surveillance, and whistleblower tips provided a robust framework for detecting and neutralizing his espionage activities. As counterintelligence professionals, it is essential to adopt a multi-faceted approach that leverages both traditional and digital investigative techniques to protect sensitive information and neutralize potential threats. The Rahmati case serves as a reminder of the evolving nature of espionage and the critical role of vigilance and innovation in counterintelligence.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

Bibliography

  • Dark (not going to share). 2024. “Leaks from Anonymous Source Within FAA.” Accessed February 2, 2026. https://dark.
  • Dark (not going to share). 2024. “Iranian Espionage Network Dismantled.” Accessed February 2, 2026. https://dark.
  • FBI Background Check Report. 2024. “Rahmati Background Check Discrepancies.” Accessed February 2, 2026. https://fbi.gov/reports/background-checks/rahmati.
  • Government Watchdog Report. 2024. “Digital Forensics in Rahmati Case.” Accessed February 2, 2026. https://watchdog.gov/reports/digital-forensics.
  • New York Times. 2024. “FAA Contractor Indicted for Spying.” New York Times, September 28. Accessed February 2, 2026. https://nytimes.com/article/rahmati-indictment.
  • Washington Post. 2024. “Internal Audit Flags FAA Contractor.” Washington Post, September 27. Accessed February 2, 2026. https://washingtonpost.com/article/faa-audit.

Posted on

Perils of Public AI from a Counterintelligence Perspective: The Madhu Gottumukkala Case

a.i., artificial intelligence, spy, spies, intelligence, counterintelligence, espionage, counterespionage, C. Constantin Poindexter

The Perils of Public AI from a Counterintelligence Operator’s View: A Case Study on Madhu Gottumukkala’s Reckless Use of ChatGPT

In the clandestine world of national security, the line between operational success and catastrophic failure is often measured in millimeters of discretion. The recent revelation that Madhu Gottumukkala, the acting director of the Cybersecurity and Infrastructure Security Agency (CISA), utilized a public, commercially available version of ChatGPT to process “for official use only” (FOUO) documents is not merely a procedural misstep. It is an incredibly stupid counterintelligence debacle, I mean, “of the highest order” (Sakellariadis, 2026). This incident exposes a chasm of staggering depth between the rapid adoption of transformative technology and the foundational principles of information security that have, until now, protected the nation’s most sensitive secrets. From my perspective as a counterintelligence expert, Gottumukkala’s actions were not born of ignorance but of a dangerous arrogance, a presumption that his position insulated him from the very rules he was sworn to enforce. This presumption is a gift to adversarial FIS and a nightmare for those tasked with defending the integrity of our intelligence apparatus.

The Inherent Treachery of Public Large Language Models

To understand the gravity of Gottumukkala’s error, one must first dissect the fundamental architecture and data policies of public Large Language Models (LLMs) like OpenAI’s ChatGPT. These models are not inert tools; they are dynamic, cloud-hosted systems designed to learn and evolve from user interactions. OpenAI’s policy, while occasionally nuanced, has consistently maintained that submitted data may be retained and used to train and refine their models (OpenAI, 2025). This means that every prompt, every document fragment, and every query entered into the public interface becomes part of a vast, aggregated dataset. For a civilian user, this might raise privacy concerns. For a government official handling sensitive material, it represents an unauthorized and uncontrolled data spill of potentially catastrophic proportions.

The data itself is only half the problem. The metadata generated by the interaction, i.e., user’s IP address, device fingerprinting, session timings, and the very nature of the queries, etc., provides a rich tapestry of intelligence for a determined adversary. A sophisticated FIS such as China’s Ministry of State Security (MSS) or Russia’s SVR does not need to directly breach OpenAI’s servers to benefit. They can analyze the model’s outputs over time to infer the types of questions being asked by government entities. If an official uploads a contracting document related to a critical infrastructure project, the model’s subsequent, more knowledgeable answers about that specific topic could signal a point of interest. This is a form of signals intelligence (SIGINT) by proxy, where the adversary learns not what we know, but what we are focused on, thereby revealing strategic priorities and operational vulnerabilities.

Furthermore, the security of these public platforms is a moving target. While no direct evidence of a major breach of OpenAI’s training data is publicly available, the possibility cannot be discounted. The U.S. intelligence community operates on the principle of need-to-know and compartmentalization precisely because no system is impenetrable. Deliberately placing sensitive data into a system with an opaque security posture, governed by a private company with its own corporate interests and potential vulnerabilities, is an abdication of the most basic tenets of information security. The 2023 breach of MoveIt Transfer, a widely used file-transfer software, which impacted hundreds of organizations, including government agencies, serves as a stark reminder that even trusted third-party systems can be compromised (CISA, 2023). Gottumukkala’s actions effectively created a similar, albeit digital, vulnerability by choice.

The Anatomy of an Insider Threat: Arrogance as a Vector

Counterintelligence professionals spend their careers identifying and mitigating insider threats, which are often categorized as malicious, coerced, or unintentional. Gottumukkala’s case falls into a particularly insidious subcategory, . . . the entitled or arrogant insider. This is an individual who, often due to seniority or perceived importance, believes that security protocols are for lesser mortals. His reported actions paint a textbook picture. Faced with a blocked application, he did not seek to understand the policy or use the approved alternative; he reportedly demanded an exemption, forcing his subordinates to override security measures designed to protect the agency (Sakellariadis, 2026). He just assumed that the rules simply did not apply to him.

This behavior is more than a simple lapse in judgment. It is a systemic cancer. When a leader demonstrates a flagrant disregard for established rules, it erodes the entire security culture of an organization. Junior personnel, witnessing a senior official flout policy without immediate repercussion, receive a clear message. The rules are flexible, especially for the powerful. This creates an environment ripe for exploitation, where other employees may feel justified in likewise ignoring rules that they don’t find convenient, exponentially increasing the agency’s attack surface. Adversarial FIS are adept at exploiting this kind of cultural rot. They understand that a demoralized workforce with a cynical view of leadership is more susceptible to coercion, recruitment, or simple negligence.

Gottumukkala’s reported professional history amplifies these concerns. His documented failure to pass a counterintelligence-scope polygraph examination is a monumental red flag that should have precluded any role involving access to sensitive operational or intelligence information (Sakellariadis, 2026). A polygraph is not a perfect lie detector, but in the counterintelligence context, it is a critical counterespionage tool for assessing an individual’s trustworthiness, susceptibility to coercion, and potential for undeclared foreign contacts. A failure in this screening is a definitive signal of elevated risk. Making matters worse, he sought to remove CISA’s Chief Information Officer (CIO), the very official responsible for maintaining the agency’s cybersecurity posture (Sakellariadis, 2026). This pattern suggests a hostility toward institutional oversight that is antithetical to the role of a cybersecurity leader in addition to hostility towards basic INFOSEC protocols.

The Strategic Cost of a Single Data Point

The documents in question were reportedly FOUO, not classified. This distinction, while bureaucratically significant, is strategically irrelevant to a capable adversary. FOUO documents often contain the building blocks of classified intelligence. They can reveal details about sources and methods, sensitive but unclassified contract information about critical infrastructure, internal deliberations on policy, and/or the identities and roles of key personnel involved in national security efforts.

Consider a hypothetical but plausible scenario. A FOUO document details a DHS contract with a private firm to harden the cybersecurity of a specific sector of the electrical grid. Uploaded to a public AI, this data point is now part of a larger model. An adversary, through persistent querying of the public AI, could potentially coax the model into revealing more about this sector’s vulnerabilities than it otherwise would. Even if the model does not explicitly reveal the document, the adversary’s knowledge of the type of work being done allows them to focus their espionage, cyberattacks, or influence operations on that specific firm or sector. The FOUO document becomes the breadcrumb that leads the adversary to the feast. The Office of the Director of National Intelligence (ODNI) has repeatedly warned in its annual threat assessments that adversaries prioritize unclassified data collection to build a mosaic of intelligence (ODNI, 2025). Each piece is harmless on its own, but together they form a clear and actionable picture.

The existence of secure, government-controlled alternatives makes this incident all the more infuriating. The Department of Homeland Security has developed and deployed its own AI-powered tool, DHSChat, specifically designed to operate within a secured federal network, ensuring that sensitive data does not leave the government’s digital ecosystem (DHS, 2024). Gottumukkala’s insistence on using the public, less secure option over the purpose-built, secure one is the action of someone who either lacks a fundamental understanding of the threat landscape or simply doesn’t give a shit. In either case, the result is the same. It is an unnecessary forced error, and self-inflicted wound on national security.

The Imperative of Accountability and a Zero-Tolerance Mandate

The response to this incident should be unequivocal and severe. The Department of Homeland Security’s own Management Directive 11042.1 mandates that any unauthorized disclosure of FOUO information be investigated as a security incident, potentially resulting in “reprimand, suspension, removal, or other disciplinary action” (DHS, 2023). Anything less than a full counterintelligence investigation, coupled with Gottumukkala’s immediate removal from any position of trust, signals a tacit acceptance of reckless behavior.

This case should catalyze a broader policy shift across the entire Intelligence Community which has been visibly altered by current leadership. A zero-tolerance policy for the use of public AI tools with any government data, let alone sensitive information, must be implemented and enforced without exception. This requires more than a memo. It requires robust technical controls, including network-level blocks to prevent such data exfiltration and continuous monitoring for policy violations. It also demands a cultural reset led from the very top, where security is not seen as a bureaucratic hurdle but as an integral component of every mission.

The arrogance displayed by Madhu Gottumukkala is a counterintelligence nightmare. The arrogance and hubris are breathtaking. This case represents a willful blindness to the reality of the threats we face, or worse, zero concern whatsoever for the protection of national security assets. Our adversaries are relentless, sophisticated, and constantly probing for weaknesses. We cannot tolerate bureaucrats who view security protocols as optional. The integration of AI into our national security architecture holds immense promise, but that promise can only be realized if it is guided by the enduring principles of vigilance, discipline, and respect for the sanctity of sensitive information. To do otherwise is not just foolish. It is a betrayal of the public trust and a dereliction of the duty to protect the nation.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

Bibliography

  • Department of Homeland Security. (2023). Management Directive 11042.1: Safeguarding Sensitive But Unclassified (For Official Use Only) Information. Retrieved from DHS.gov
  • Department of Homeland Security. (2024). DHS’s Responsible Use of Generative AI Tools. Retrieved from DHS.gov
  • National Counterintelligence and Security Center. (2025). Annual Threat Assessment: Adversary Exploitation of Leaked Data. Washington, D.C.: Office of the Director of National Intelligence.
  • OpenAI. (2025). ChatGPT Data Usage Policy. Retrieved from OpenAI.com
    Sakellariadis, J. (2026, January 27). Trump’s Acting Cyber Chief Uploaded Sensitive Files into a Public Version of ChatGPT. POLITICO. Retrieved from Politico.com
  • Cybersecurity and Infrastructure Security Agency (CISA). (2023, June 1). *AA23-165A: MOVEit Transfer Vulnerability Exploit
Posted on

Espionaje en Bávaro: El caso Novikov – contrainteligencia, desinformación y la anatomía de una operación de influencia

espia, espias, espionage, inteligencia, contraespionaje, contrainteligencia, DNI, J2, C. Constantin Poindexter

La detención en Bávaro del ciudadano ruso Dmitrii Novikov constituye uno de los expedientes más reveladores de la historia de la inteligencia (y contrainteligencia) de nuestra Quisqueya. Apto para estudiar la convergencia entre operaciones de influencia, crimen transnacional y técnicas contemporáneas de encubrimiento financiero, su envergadura no podemos pasar por alto. Según la información pública difundida por autoridades dominicanas y replicada por medios de referencia, Novikov habría dirigido desde territorio dominicano una red de “ciberinfluencia” vinculada al Proyecto Lakhta, también denominado “La Compañía”, orientada a la creación y difusión de contenido digital con fines de desinformación política y manipulación en redes sociales, con efectos proyectados tanto sobre la República Dominicana como sobre otros países de la región, entre ellos Argentina (Listín Diario, 2025; EFE, 2025). Para el profesional de contrainteligencia, la importancia del caso no reside únicamente en la imputación, sino en los indicadores de método: cobertura social verosímil, externalización operacional mediante colaboradores locales, y un esquema de financiación y pagos diseñado para opacar origen y trazabilidad, todo ello enmarcado en una tradición rusa de guerra informativa ampliamente documentada por fuentes judiciales y regulatorias estadounidenses y sus semejantes europeos.

Los hechos son nítidos. El Ministerio Público, actuando junto con la Unidad Especializada del Crimen Organizado, detuvo a Novikov durante un operativo en una villa del residencial Palmas del Sol II, Bávaro, donde residía con familiares (Listín Diario, 2025; EFE, 2025). Se le acusó de haber operado con la intención explícita de evitar que se percibiera el origen del contenido promovido, ocultando su nacionalidad rusa y utilizando colaboradores locales, bajo la apariencia de un deportista de artes marciales mixtas, mientras recibía fondos y dirección de asociados al Proyecto Lakhta (Listín Diario, 2025; EFE, 2025). En términos de ‘tradecraft’, la “leyenda” personal (el relato de identidad que permite acceso, normaliza contactos y reduce sospecha) aparece aquí como instrumento de penetración social y, por extensión, de influencia. No se trata de un detalle anecdótico. La cobertura deportiva opera como camuflaje cultural, facilita redes sociales orgánicas y diluye la percepción de intencionalidad política hasta hoy en día igual como para los fines de Novikov sirvió.

La dimensión financiera del caso merece atención especial. Las autoridades afirman haber comprobado que Novikov manejaba operaciones económicas y transacciones internacionales mediante billeteras electrónicas con criptomonedas, usando plataformas como Binance y activos como Bitcoin y Ethereum (Listín Diario, 2025; EFE, 2025). La Fiscalía considera que estos mecanismos habrían sido empleados para mover fondos internacionales encubriendo el origen de los recursos y facilitando actividades ilícitas vinculadas al lavado de activos y al financiamiento transnacional (EFE, 2025; Listín Diario, 2025). Para la contrainteligencia es instructivo. Ilustra una realidad operativa, el ecosistema cripto no es en sí “invisible”, pero sí ofrece fricción adicional para la atribución y la congelación rápida de flujos, especialmente cuando se combina con identidades prestadas, intermediarios y jurisdicciones con distinta y bien variada velocidad de cooperación. En operaciones de influencia, el dinero no es accesorio. Es el sistema circulatorio que paga infraestructura, compra amplificación, remunera operadores, y sostiene persistencia.

El expediente añade un componente que, de confirmarse, ampliaría su gravedad estratégica. Durante el operativo se incautaron evidencias que comprometerían al imputado con la venta y distribución de armas de fuego (Listín Diario, 2025; EFE, 2025). Esta intersección entre desinformación y armas sugiere un patrón conocido por los profesionales del ámbito castrense investigativo y de inteligencia nacional. Cuando convergen propaganda, financiación opaca y armamento, el fenómeno trasciende la “influencia blanda” y se aproxima a un ecosistema habilitador de coerción, intimidación y/o criminalidad organizada. En términos analíticos, el riesgo ya no es sólo cognitivo (degradación de confianza pública, polarización, distorsión deliberativa) sino también material, por la capacidad de introducir violencia o amenaza en el teatro social.

Para comprender el rótulo “Lakhta” y su peso, conviene situarlo en el marco histórico documentado por instancias judiciales y regulatorias. El Departamento de Justicia de Estados Unidos describió el Proyecto Lakhta como un esfuerzo paraguas, financiado por Yevgeniy Prigozhin, que incluía componentes orientados a audiencias extranjeras y que administraba presupuestos multimillonarios para actividades de influencia, incluyendo compras de anuncios, registros de dominios, uso de servidores proxy y “promoción” de publicaciones en redes sociales. El objetivo estratégico fue de sembrar discordia y socavar la fe en instituciones democráticas (U.S. Department of Justice, 2018). El propio gobierno estadounidense, en documentación oficial, asoció la operación con “information warfare” (guerra informática) y con esfuerzos para simular activismo local mediante identidades ficticias y técnicas de ocultación de origen (U.S. Department of Justice, 2018). Por su parte, el Departamento del Tesoro de Estados Unidos caracterizó el Proyecto Lakhta como una campaña de desinformación financiada por Prigozhin dirigida a audiencias en Estados Unidos, Europa, Ucrania e incluso Rusia, destacando su uso de “personas” ficticias y su financiación de “troll farms” (U.S. Department of the Treasury, 2022). Complementariamente, el propio registro público de sanciones de OFAC identifica a la Internet Research Agency LLC (la “fábrica de trolls”) con alias explícitos que incluyen “LAKHTA INTERNET RESEARCH”, reforzando la continuidad nominal y organizacional del constructo Lakhta en la arquitectura de influencia rusa (U.S. Department of the Treasury, Office of Foreign Assets Control, 2026).

La República Dominicana, por su posición geográfica, sociedad libre y abierta, su centralidad turística, su conectividad logística y su apertura de ecosistemas digitales, constituye un espacio atractivo para operaciones de influencia que busquen “plausible deniability” y a la vez proyección regional. Las autoridades dominicanas sostienen que las operaciones atribuidas a Novikov apuntaban a incidir en la opinión pública, con impactos directos en el país y en otros entornos regionales (Listín Diario, 2025). En paralelo, fuentes periodísticas reseñaron que en Argentina se detectó una estructura denominada “La Compañía”, supuestamente vinculada al gobierno ruso y al Proyecto Lakhta, cuyo objetivo sería conformar redes locales leales a intereses rusos para campañas de desinformación, con operadores dedicados a recibir financiamiento y tejer vínculos con colaboradores (Listín Diario, 2025). Reportajes contemporáneos sobre Argentina describieron hallazgos de redes asociadas a campañas de desinformación para promover intereses de Moscú (The Record, 2025; Buenos Aires Times, 2025). Este encadenamiento (nodos nacionales que replican un mismo manual) es típico de operaciones de influencia sostenidas. Se construyen “células” de baja visibilidad, se tercerizan tareas, y se mantiene dirección estratégica a distancia.

Desde la perspectiva profesional, el caso Novikov ofrece lecciones operativas concretas para el diseño de defensa. Primero, la atribución moderna depende menos de “una prueba reina” y más de una constelación de indicadores: patrón de contenido, sincronización de amplificación, infraestructura digital, y rutas de financiación. Cuando el Ministerio Público afirma que Novikov recibía dirección y fondos de asociados a Lakhta, está apuntando a la hipótesis de mando y control, es decir, a una cadena de coordinación, no a mera actividad individual (Listín Diario, 2025; EFE, 2025). Segundo, la cobertura social, en este caso la apariencia de atleta, no debe subestimarse. Es un mecanismo de acceso y normalización, capaz de producir capital social y reclutar facilitadores locales sin que éstos perciban la finalidad estratégica (Listín Diario, 2025). Tercero, el uso de criptoactivos en plataformas globales exige capacidades técnicas y jurídicas específicas como la analítica de blockchain, cooperación con ‘exchanges’, preservación de evidencia digital y coordinación internacional, porque la velocidad del flujo financiero suele superar la velocidad administrativa del Estado (EFE, 2025; Listín Diario, 2025).

Cuarto, la operación descrita confirma un principio que en contrainteligencia conviene reiterar. La desinformación no es simple “mentira” sino una disciplina de ingeniería social, orientada a modificar percepciones, elevar costos de gobernabilidad y erosionar la confianza y legitimidad institucional. El propio marco estadounidense sobre Lakhta enfatiza objetivos estratégicos de discordia y debilitamiento de confianza pública mediante identidades falsas y manipulación del debate (U.S. Department of Justice, 2018). En consecuencia, las respuestas estatales deben integrar no sólo persecución penal, sino resiliencia cognitiva, i.e., alfabetización mediática, transparencia proactiva, y mecanismos de advertencia temprana que permitan a la ciudadanía reconocer narrativas “fabricadas” sin necesidad de censura. La censura también es parte de un complot nefasto. Es el terreno que estas operaciones buscan. Cuanto más se perciba represión informativa, mayor será la rentabilidad propagandística del atacante.

El caso Novikov puede leerse como un capítulo dominicano de un guión ya observado en otras latitudes. Fue una operación de influencia con sello ruso, asociada nominalmente al Proyecto Lakhta, que combinaba ingeniería social, encubrimiento de origen, financiación opaca y utilización de facilitadores locales para maximizar alcance y minimizar atribución (Listín Diario, 2025; EFE, 2025; U.S. Department of the Treasury, 2022). La presencia de indicios de tráfico de armas simultáneamente sugiere una peligrosísima convergencia entre desinformación y criminalidad material, una simbiosis que multiplica el daño potencial y exige respuesta integral del Estado (Listín Diario, 2025; EFE, 2025). Para la contrainteligencia, la conclusión es sobria. La República Dominicana no está “al margen” del tablero. Por su propia conectividad en integración con un mundo MUCHO más allá de la Altagracia, nuestro país es un objetivo y bien uno bien atractivo. La defensa exige capacidades de investigación financiera moderna, cooperación internacional, y una comprensión clara de que la guerra informativa es una operación clandestina de largo aliento y alcance cuyo campo de batalla es la confianza.

~ C. Constantin Poindexter, MA en Inteligencia, Certificado de Posgrado en Contrainteligencia, JD, certificación CISA/NCISS OSINT, certificación DoD/DoS BFFOC

Bibliografía

  • Buenos Aires Times. (2025, 19 de junio). Argentina’s spies expose alleged Russian disinformation group.
  • EFE. (2025, 19 de septiembre). La Fiscalía dominicana detiene a un hombre ruso vinculado a un proyecto de desinformación.
  • Listín Diario. (2025, 19 de septiembre). Ministerio Público arresta a joven ruso que habría dirigido campañas de desinformación desde RD.
  • Listín Diario. (2025, 19 de septiembre). EEUU y Argentina: Otros países que han detectado presencia de rusos pertenecientes a “Lakhta”.
  • The Record. (2025, 19 de junio). Argentina uncovers suspected Russian spy ring behind disinformation campaigns.
  • U.S. Department of Justice. (2018, 19 de octubre). Russian National Charged with Interfering in U.S. Political System.
  • U.S. Department of the Treasury. (2022, 29 de julio). Treasury Targets the Kremlin’s Continued Malign Political Influence Operations in the U.S. and Globally.
  • U.S. Department of the Treasury, Office of Foreign Assets Control. (2026, 23 de enero). Sanctions List Search entry: Internet Research Agency LLC (incluye alias “LAKHTA INTERNET RESEARCH”).
Posted on

A Pier Walk, an Encrypted App, and a Trail of Receipts: The Wei Espionage Case, Counterintelligence and PRC Tradecraft

china, PRC, PLA, espionage, spy, spies, counterespionage, counterintelligence, intelligence, C. Constantin Poindexter, counterespionage;

The two-hundred-month federal sentence imposed on U.S. Navy sailor Jinchao Wei, also known as Patrick Wei, is not merely a cautionary tale about a single insider’s betrayal. It is a contemporary, well documented case study in the People’s Republic of China’s persistent espionage campaign against U.S. defense entities, executed through an operational pattern that has become all too familiar to counterintelligence practitioners, i.e., low friction spotting and assessment via online platforms, cultivation under plausible non-official cover, incremental tasking that begins with seemingly innocuous collection, and compensation methods that leave a financial signature even when communications are migrated to encrypted channels (U.S. Department of Justice, 2023; U.S. Department of Justice, 2026a). The Wei matter is also a reminder that insider threats rarely begin with the theft of a crown jewel. They begin with ego, attention, a sense of being chosen, and the seductive illusion that the handler is impressed and that the target is smarter than the system.

Public reporting and Department of Justice releases describe Wei as having been arrested in August 2023 as he arrived for duty at Naval Base San Diego, where he was assigned to the amphibious assault ship USS Essex (U.S. Department of Justice, 2023; U.S. Department of Justice, 2026b). The arrest timing and location are operationally significant. Counterintelligence cases often culminate when investigators can control the environment, secure devices and storage, and prevent further loss of national defense information while preserving evidentiary integrity. The government’s narrative, as presented publicly, reflects a mature, documentable case anchored in communications and payment records rather than exotic or highly sensitive sources. The Department of Justice has been explicit that not every investigative step can be disclosed and I don’t intend to do so here, but it has been equally clear that the evidentiary core included intercepts of communication between Wei and his PRC handler, and documentation of how Wei was rewarded for his betrayal (U.S. Department of Justice, 2026a).

The recruitment vector in this case aligns with PRC modus operandi in insider targeting. Wei was approached through social media by an individual presenting as a “naval enthusiast” who claimed a connection to China’s state-owned shipbuilding sector, a cover story designed to appear adjacent to legitimate maritime interest while still close enough to naval affairs to justify pointed questions (U.S. Department of Justice, 2026a; Associated Press, 2026). That presentation is instructive. It reduces the psychological barrier to engagement, provides a rationale for curiosity-driven dialogue, and permits gradual escalation from general discussion to tasking. A handler does not need immediate access to classified networks to create damage. He needs a human source who can provide operationally relevant details, and then he needs to keep the source talking long enough to normalize betrayal.

Once engaged, Wei’s operational security behavior demonstrates both awareness and complicity. He told a Navy friend that the activity looked “quite obviously” like espionage and, after that realization, he shifted communications to a different encrypted messaging application that he believed was more secure (U.S. Department of Justice, 2026a; USNI News, 2026). This is an important marker for investigators and security managers. When a cleared person acknowledges illicit intent yet continues, the motivation is not confusion. It is volition. The move to a “more secure” platform is also characteristic of PRC handling in HUMINT collection. Chinese FIS does not need to provide sophisticated technical tradecraft if the target will self-generate it. Public charging language indicates agreed steps to conceal the relationship, including deletion of conversation records and use of encrypted methods, which reflects basic but purposeful counter-surveillance and denial behavior (U.S. Department of Justice, 2023).

Tasking, as described in public releases, combined opportunistic collection with specific collection requirements. Wei was asked to “walk the pier” and report which ships were present, provide ship locations, and transmit photos and videos along with ship-related details (U.S. Department of Justice, 2026a). From a counterintelligence perspective, these are not trivial asks. Pier-side observations can support pattern of life analysis, readiness inference, and operational planning, particularly when fused with open source material and other clandestine reporting. The case officer’s methodology is “incrementalism”. A handler begins with items that feel observational and deniable, then pulls the source toward more sensitive materials by normalizing the exchange relationship and introducing compensation.

The most damaging element is the alleged transfer of classified technical and operational documents. DOJ accounts state that over an approximately 18-month relationship, Wei provided approximately sixty manuals and other sensitive materials, including at least thirty manuals transmitted in one tranche in June 2022, some of which clearly bore export control warnings. The materials were related to ship systems such as power, steering, weapons control, elevators, and damage and casualty controls (U.S. Department of Justice, 2026a; U.S. Department of Justice, 2026b; Associated Press, 2026). In counterintelligence risk terms, technical manuals provide adversaries with a low-cost blueprint for exploitation. They can inform electronic attack planning, maintenance and sustainment targeting, and vulnerability discovery. They also enable synthetic training and doctrine development for adversary operators. A single manual can be operationally relevant for years because systems and procedures often evolve incrementally, not continuously.

Compensation details illuminate tradecraft and investigative leverage. Wei received more than $12,000 over the course of the relationship, including an alleged $5,000 payment connected to the June 2022 manual transfer. The DOJ has described the use of online payment methods (U.S. Department of Justice, 2023; U.S. Department of Justice, 2026a). This is common in modern espionage involving HUMINT assets who are not professional intelligence officers. Financial transfers create documentary evidence, establish quid pro quo, and provide prosecutors with a corroborating narrative that is legible to a jury. For counterintelligence professionals, this observation is instructive. When communications shift to encrypted platforms, payment flows often remain discoverable through records, device artifacts, and third-party reporting. The operational discipline required to truly eliminate financial signatures is rarely present in an insider unless he or she is COMSEC sophisticated.

Public disclosures describe the case’s investigative architecture in broad but meaningful terms which are instructive even in the absence of the classified story. The FBI and Naval Criminal Investigative Service conducted the investigation. The DOJ characterized the matter as a “first of its kind” espionage investigation in the district, language that signals a substantial investigative effort and a prosecutorial commitment to proving the national security dimension in open court (U.S. Department of Justice, 2026a). The described evidence set emphasizes calls and electronic and audio messages with the PRC handler, payment records and receipts, and a post-arrest interrogation in which Wei admitted to providing the materials and described his conduct as espionage (U.S. Department of Justice, 2026a). Those elements are not glamorous, but they are decisive. They reflect the fundamentals of counterintelligence case building: document the relationship, document tasking and exchanges, document intent and benefit.

This IS PRC modus operandi! The Wei case fits a familiar pattern. The approach was enabled by digital access to targets, the cover identity was plausibly adjacent to the target’s professional interests, and the relationship was escalated through a play on Wei’s ego, . . . a mix of attention, manipulation, and money to compromise him. Tradecraft relied on human psychology, not advanced technical means. The Chinese FIS officer did not need to defeat a classified network. He convinced an insider to carry information out through routine channels and to do so voluntarily. This is a good example of why insider threat programs cannot focus only on clearance adjudication and periodic training. They must incorporate behavioral indicators, targeted education about online elicitation, and strong reporting pathways that reward early disclosure rather than stigmatize it (U.S. Department of Justice, 2023; U.S. Department of Justice, 2026a).

There is also a supervisory and cultural lesson embedded here. Wei voiced suspicion to another sailor. That disclosure was a moment when the damage could have been immediately contained. Peers often see the first signs of a peril, yet peers hesitate, either because they do not want to “ruin someone’s career” or because they assume someone else will act. Counterintelligence operators should treat this as a design requirement. Reporting must be made psychologically easy, procedurally simple, and institutionally supported. A peer report should trigger a calibrated and coordinated response, not an immediate public spectacle. The goal is to get ahead of compromise, not to create an environment where personnel conceal concerns to avoid attention.

The Wei case is a well-evidenced illustration of PRC espionage tradecraft against the United States. Chinese FIS spots and contacts potential insiders at scale through social platforms, cultivates via plausible identity, normalizes secret communications, introduces tasking that begins with the innocuous then escalates to classified materials, and pays through channels that are convenient to the target while still supporting handler control and a firm compromise of the asset (U.S. Department of Justice, 2023; U.S. Department of Justice, 2026a; USNI News, 2026). In my professional judgment, this is another textbook example of ego as the primary driver beneath the surface rationalizations. Even when loneliness, financial temptation, or grievance are present, the consistent psychological engine in treasonous espionage is the ego’s appetite to feel important, chosen, liked, befriended and exceptional. Wei’s conduct underscores that dynamic. He recognized the espionage for what it was, believed he could manage his exposure by encrypted applications, and continued down the road of betrayal. That is not naïveté. It is a belief that rules apply to others, that risk can be controlled by personal cleverness, and that the handler’s attention is a validation of one’s importance in the world. In very few espionage cases, money is the hook. The I.C. likes to think that examples like the Ames Case was a money-motivated treason. It was only partially. Likewise, the I.C. report on Ana Montés lays the blame at the feet of “ideology”. That really wasn’t it. Ego is the line that keeps the source from walking away when conscience and common sense offer an exit. It is almost ALWAYS ego.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

Bibliography

  • Associated Press. (2026, January 12). Former Navy sailor sentenced to 16 years for selling information about ships to Chinese intelligence.
  • U.S. Department of Justice. (2023, August 3). Two U.S. Navy servicemembers arrested for transmitting military information to the People’s Republic of China.
  • U.S. Department of Justice. (2026a, January 13). Former U.S. Navy sailor sentenced to 200 months for spying for China.
  • U.S. Department of Justice. (2026b, January 14). U.S. Navy sailor sentenced to more than 16 years for spying for China.
  • USNI News. (2026, January 13). Sailor to serve 16 year prison sentence for selling secrets to China.