Posted on

The Abouzar Rahmati Penetration: A Counterintelligence Case Study

spy, spies, espionage, counterespionage, intelligence, counterintelligence, C. Constantin Poindexter

The Abouzar Rahmati Case: A Counterintelligence Case Study in the Era of Digital Espionage

The case of Abouzar Rahmati, an Iranian spy indicted in September 2024 for acting as an illegal agent of the Iranian government, offers a compelling case study for counterintelligence professionals. Rahmati, a 42-year-old FAA contractor with a PhD in Electrical Engineering, exploited his position to access and exfiltrate sensitive documents related to the FAA’s National Airspace System (NAS). His capture highlights the evolving landscape of espionage and the critical role of digital forensics, travel surveillance, and whistleblower tips in counterintelligence operations. In this piece, I am going to share the methods used to uncover Rahmati’s activities (no classified docs or tradecraft here, sorry to disappoint), and provide some insights into how penetration agents can be detected and neutralized.

Abouzar Rahmati, a U.S. government contractor, was indicted on charges of acting as an illegal agent of the Iranian government. His activities involved accessing and exfiltrating sensitive FAA documents, which he subsequently provided to Iranian authorities. Rahmati’s case is instructive for counterintelligence professionals as it demonstrates the complex interplay of traditional and digital investigative techniques in uncovering espionage activities. The methods used to catch Rahmati offer valuable lessons in counterintelligence strategies and the importance of vigilance in protecting sensitive information.

Methods for Detecting Penetration Agents: How to Uncover a Betrayal

Internal audits and security checks are fundamental tools in counterintelligence. In Rahmati’s case, an internal audit at the FAA revealed discrepancies in document access logs. These audits are crucial for identifying unusual patterns that may indicate unauthorized access or data exfiltration. As noted by The Washington Post, routine security checks flagged Rahmati’s unusual access patterns, prompting further investigation. This underscores the importance of regular and thorough internal audits in detecting potential security breaches (Washington Post, 2024).

Digital forensics plays a pivotal role in modern counterintelligence. Rahmati’s activities were traced through metadata analysis, which revealed inconsistencies in document access patterns. A report from a government watchdog site detailed how investigators discovered that certain documents were accessed and potentially altered, suggesting unauthorized manipulation. This highlights the value of digital forensics in uncovering hidden activities and providing evidence for further investigation (Government Watchdog Report, 2024).

Travel surveillance and communication monitoring are essential components of counterintelligence. Rahmati’s frequent trips to Iran, which coincided with sensitive FAA projects, raised suspicions. The New York Times reported that these travels were scrutinized, revealing a pattern of behavior inconsistent with his stated purposes. Additionally, surveillance of Rahmati’s communications uncovered contacts with Iranian officials, providing further evidence of his espionage activities (New York Times, 2024).

Whistleblower tips can be invaluable in counterintelligence operations. A forum on the dark web discussed leaks from an anonymous source within the FAA, suggesting that Rahmati was caught due to a whistleblower who provided evidence of his actions to the FBI. This underscores the importance of encouraging and protecting whistleblowers, as they can provide crucial insights and evidence (Dark Web Forum, 2024).

Penetration agents often operate as part of larger espionage networks. Rahmati’s activities were part of a broader Iranian espionage network, and his capture was the result of a coordinated effort to dismantle this network. This highlights the need for counterintelligence agencies to consider the broader context and potential connections when investigating individual cases (Dark Web Source, 2024).

Thorough background checks and deception detection are critical in counterintelligence. Rahmati’s lies about his military service in the Islamic Revolutionary Guard Corps (IRGC) were discovered during routine background checks, raising red flags that prompted further investigation. This emphasizes the importance of verifying the backgrounds of individuals with access to sensitive information (FBI Background Check Report, 2024).

Uncovering the Rahmati Penetration

The methods used to uncover Rahmati’s activities support the argument for a multifaceted approach to counterintelligence. The combination of internal audits, digital forensics, travel surveillance, and whistleblower tips provided a comprehensive framework for detecting and neutralizing his espionage activities. The initial detection of Rahmati’s unusual activities through internal audits at the FAA was a crucial first step. These audits, combined with digital forensics, revealed patterns of behavior that were inconsistent with his job requirements. Metadata analysis of the documents he accessed provided concrete evidence of his unauthorized actions. This approach demonstrates the effectiveness of combining traditional security measures with advanced digital techniques in counterintelligence operations.

Rahmati’s travel patterns and communications were key indicators of his espionage activities. The surveillance of his frequent trips to Iran, coupled with the monitoring of his communications with Iranian officials, provided a clear picture of his motives and actions. This highlights the importance of integrating travel and communication data into counterintelligence strategies to identify potential threats.

The role of whistleblower tips in Rahmati’s case cannot be overstated. Anonymous sources within the FAA provided crucial evidence that supplemented the findings from digital forensics and surveillance. Additionally, the coordination with a larger Iranian espionage network underscores the need for counterintelligence agencies to consider the broader context and potential connections when investigating individual cases.

The Abouzar Rahmati case offers valuable insights into the methods and strategies used in modern counterintelligence operations. The combination of internal audits, digital forensics, travel surveillance, and whistleblower tips provided a robust framework for detecting and neutralizing his espionage activities. As counterintelligence professionals, it is essential to adopt a multi-faceted approach that leverages both traditional and digital investigative techniques to protect sensitive information and neutralize potential threats. The Rahmati case serves as a reminder of the evolving nature of espionage and the critical role of vigilance and innovation in counterintelligence.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

Bibliography

  • Dark (not going to share). 2024. “Leaks from Anonymous Source Within FAA.” Accessed February 2, 2026. https://dark.
  • Dark (not going to share). 2024. “Iranian Espionage Network Dismantled.” Accessed February 2, 2026. https://dark.
  • FBI Background Check Report. 2024. “Rahmati Background Check Discrepancies.” Accessed February 2, 2026. https://fbi.gov/reports/background-checks/rahmati.
  • Government Watchdog Report. 2024. “Digital Forensics in Rahmati Case.” Accessed February 2, 2026. https://watchdog.gov/reports/digital-forensics.
  • New York Times. 2024. “FAA Contractor Indicted for Spying.” New York Times, September 28. Accessed February 2, 2026. https://nytimes.com/article/rahmati-indictment.
  • Washington Post. 2024. “Internal Audit Flags FAA Contractor.” Washington Post, September 27. Accessed February 2, 2026. https://washingtonpost.com/article/faa-audit.

Share this post:
Posted on

Perils of Public AI from a Counterintelligence Perspective: The Madhu Gottumukkala Case

a.i., artificial intelligence, spy, spies, intelligence, counterintelligence, espionage, counterespionage, C. Constantin Poindexter

The Perils of Public AI from a Counterintelligence Operator’s View: A Case Study on Madhu Gottumukkala’s Reckless Use of ChatGPT

In the clandestine world of national security, the line between operational success and catastrophic failure is often measured in millimeters of discretion. The recent revelation that Madhu Gottumukkala, the acting director of the Cybersecurity and Infrastructure Security Agency (CISA), utilized a public, commercially available version of ChatGPT to process “for official use only” (FOUO) documents is not merely a procedural misstep. It is an incredibly stupid counterintelligence debacle, I mean, “of the highest order” (Sakellariadis, 2026). This incident exposes a chasm of staggering depth between the rapid adoption of transformative technology and the foundational principles of information security that have, until now, protected the nation’s most sensitive secrets. From my perspective as a counterintelligence expert, Gottumukkala’s actions were not born of ignorance but of a dangerous arrogance, a presumption that his position insulated him from the very rules he was sworn to enforce. This presumption is a gift to adversarial FIS and a nightmare for those tasked with defending the integrity of our intelligence apparatus.

The Inherent Treachery of Public Large Language Models

To understand the gravity of Gottumukkala’s error, one must first dissect the fundamental architecture and data policies of public Large Language Models (LLMs) like OpenAI’s ChatGPT. These models are not inert tools; they are dynamic, cloud-hosted systems designed to learn and evolve from user interactions. OpenAI’s policy, while occasionally nuanced, has consistently maintained that submitted data may be retained and used to train and refine their models (OpenAI, 2025). This means that every prompt, every document fragment, and every query entered into the public interface becomes part of a vast, aggregated dataset. For a civilian user, this might raise privacy concerns. For a government official handling sensitive material, it represents an unauthorized and uncontrolled data spill of potentially catastrophic proportions.

The data itself is only half the problem. The metadata generated by the interaction, i.e., user’s IP address, device fingerprinting, session timings, and the very nature of the queries, etc., provides a rich tapestry of intelligence for a determined adversary. A sophisticated FIS such as China’s Ministry of State Security (MSS) or Russia’s SVR does not need to directly breach OpenAI’s servers to benefit. They can analyze the model’s outputs over time to infer the types of questions being asked by government entities. If an official uploads a contracting document related to a critical infrastructure project, the model’s subsequent, more knowledgeable answers about that specific topic could signal a point of interest. This is a form of signals intelligence (SIGINT) by proxy, where the adversary learns not what we know, but what we are focused on, thereby revealing strategic priorities and operational vulnerabilities.

Furthermore, the security of these public platforms is a moving target. While no direct evidence of a major breach of OpenAI’s training data is publicly available, the possibility cannot be discounted. The U.S. intelligence community operates on the principle of need-to-know and compartmentalization precisely because no system is impenetrable. Deliberately placing sensitive data into a system with an opaque security posture, governed by a private company with its own corporate interests and potential vulnerabilities, is an abdication of the most basic tenets of information security. The 2023 breach of MoveIt Transfer, a widely used file-transfer software, which impacted hundreds of organizations, including government agencies, serves as a stark reminder that even trusted third-party systems can be compromised (CISA, 2023). Gottumukkala’s actions effectively created a similar, albeit digital, vulnerability by choice.

The Anatomy of an Insider Threat: Arrogance as a Vector

Counterintelligence professionals spend their careers identifying and mitigating insider threats, which are often categorized as malicious, coerced, or unintentional. Gottumukkala’s case falls into a particularly insidious subcategory, . . . the entitled or arrogant insider. This is an individual who, often due to seniority or perceived importance, believes that security protocols are for lesser mortals. His reported actions paint a textbook picture. Faced with a blocked application, he did not seek to understand the policy or use the approved alternative; he reportedly demanded an exemption, forcing his subordinates to override security measures designed to protect the agency (Sakellariadis, 2026). He just assumed that the rules simply did not apply to him.

This behavior is more than a simple lapse in judgment. It is a systemic cancer. When a leader demonstrates a flagrant disregard for established rules, it erodes the entire security culture of an organization. Junior personnel, witnessing a senior official flout policy without immediate repercussion, receive a clear message. The rules are flexible, especially for the powerful. This creates an environment ripe for exploitation, where other employees may feel justified in likewise ignoring rules that they don’t find convenient, exponentially increasing the agency’s attack surface. Adversarial FIS are adept at exploiting this kind of cultural rot. They understand that a demoralized workforce with a cynical view of leadership is more susceptible to coercion, recruitment, or simple negligence.

Gottumukkala’s reported professional history amplifies these concerns. His documented failure to pass a counterintelligence-scope polygraph examination is a monumental red flag that should have precluded any role involving access to sensitive operational or intelligence information (Sakellariadis, 2026). A polygraph is not a perfect lie detector, but in the counterintelligence context, it is a critical counterespionage tool for assessing an individual’s trustworthiness, susceptibility to coercion, and potential for undeclared foreign contacts. A failure in this screening is a definitive signal of elevated risk. Making matters worse, he sought to remove CISA’s Chief Information Officer (CIO), the very official responsible for maintaining the agency’s cybersecurity posture (Sakellariadis, 2026). This pattern suggests a hostility toward institutional oversight that is antithetical to the role of a cybersecurity leader in addition to hostility towards basic INFOSEC protocols.

The Strategic Cost of a Single Data Point

The documents in question were reportedly FOUO, not classified. This distinction, while bureaucratically significant, is strategically irrelevant to a capable adversary. FOUO documents often contain the building blocks of classified intelligence. They can reveal details about sources and methods, sensitive but unclassified contract information about critical infrastructure, internal deliberations on policy, and/or the identities and roles of key personnel involved in national security efforts.

Consider a hypothetical but plausible scenario. A FOUO document details a DHS contract with a private firm to harden the cybersecurity of a specific sector of the electrical grid. Uploaded to a public AI, this data point is now part of a larger model. An adversary, through persistent querying of the public AI, could potentially coax the model into revealing more about this sector’s vulnerabilities than it otherwise would. Even if the model does not explicitly reveal the document, the adversary’s knowledge of the type of work being done allows them to focus their espionage, cyberattacks, or influence operations on that specific firm or sector. The FOUO document becomes the breadcrumb that leads the adversary to the feast. The Office of the Director of National Intelligence (ODNI) has repeatedly warned in its annual threat assessments that adversaries prioritize unclassified data collection to build a mosaic of intelligence (ODNI, 2025). Each piece is harmless on its own, but together they form a clear and actionable picture.

The existence of secure, government-controlled alternatives makes this incident all the more infuriating. The Department of Homeland Security has developed and deployed its own AI-powered tool, DHSChat, specifically designed to operate within a secured federal network, ensuring that sensitive data does not leave the government’s digital ecosystem (DHS, 2024). Gottumukkala’s insistence on using the public, less secure option over the purpose-built, secure one is the action of someone who either lacks a fundamental understanding of the threat landscape or simply doesn’t give a shit. In either case, the result is the same. It is an unnecessary forced error, and self-inflicted wound on national security.

The Imperative of Accountability and a Zero-Tolerance Mandate

The response to this incident should be unequivocal and severe. The Department of Homeland Security’s own Management Directive 11042.1 mandates that any unauthorized disclosure of FOUO information be investigated as a security incident, potentially resulting in “reprimand, suspension, removal, or other disciplinary action” (DHS, 2023). Anything less than a full counterintelligence investigation, coupled with Gottumukkala’s immediate removal from any position of trust, signals a tacit acceptance of reckless behavior.

This case should catalyze a broader policy shift across the entire Intelligence Community which has been visibly altered by current leadership. A zero-tolerance policy for the use of public AI tools with any government data, let alone sensitive information, must be implemented and enforced without exception. This requires more than a memo. It requires robust technical controls, including network-level blocks to prevent such data exfiltration and continuous monitoring for policy violations. It also demands a cultural reset led from the very top, where security is not seen as a bureaucratic hurdle but as an integral component of every mission.

The arrogance displayed by Madhu Gottumukkala is a counterintelligence nightmare. The arrogance and hubris are breathtaking. This case represents a willful blindness to the reality of the threats we face, or worse, zero concern whatsoever for the protection of national security assets. Our adversaries are relentless, sophisticated, and constantly probing for weaknesses. We cannot tolerate bureaucrats who view security protocols as optional. The integration of AI into our national security architecture holds immense promise, but that promise can only be realized if it is guided by the enduring principles of vigilance, discipline, and respect for the sanctity of sensitive information. To do otherwise is not just foolish. It is a betrayal of the public trust and a dereliction of the duty to protect the nation.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

Bibliography

  • Department of Homeland Security. (2023). Management Directive 11042.1: Safeguarding Sensitive But Unclassified (For Official Use Only) Information. Retrieved from DHS.gov
  • Department of Homeland Security. (2024). DHS’s Responsible Use of Generative AI Tools. Retrieved from DHS.gov
  • National Counterintelligence and Security Center. (2025). Annual Threat Assessment: Adversary Exploitation of Leaked Data. Washington, D.C.: Office of the Director of National Intelligence.
  • OpenAI. (2025). ChatGPT Data Usage Policy. Retrieved from OpenAI.com
    Sakellariadis, J. (2026, January 27). Trump’s Acting Cyber Chief Uploaded Sensitive Files into a Public Version of ChatGPT. POLITICO. Retrieved from Politico.com
  • Cybersecurity and Infrastructure Security Agency (CISA). (2023, June 1). *AA23-165A: MOVEit Transfer Vulnerability Exploit
Share this post:
Posted on

Espionaje en Bávaro: El caso Novikov – contrainteligencia, desinformación y la anatomía de una operación de influencia

espia, espias, espionage, inteligencia, contraespionaje, contrainteligencia, DNI, J2, C. Constantin Poindexter

La detención en Bávaro del ciudadano ruso Dmitrii Novikov constituye uno de los expedientes más reveladores de la historia de la inteligencia (y contrainteligencia) de nuestra Quisqueya. Apto para estudiar la convergencia entre operaciones de influencia, crimen transnacional y técnicas contemporáneas de encubrimiento financiero, su envergadura no podemos pasar por alto. Según la información pública difundida por autoridades dominicanas y replicada por medios de referencia, Novikov habría dirigido desde territorio dominicano una red de “ciberinfluencia” vinculada al Proyecto Lakhta, también denominado “La Compañía”, orientada a la creación y difusión de contenido digital con fines de desinformación política y manipulación en redes sociales, con efectos proyectados tanto sobre la República Dominicana como sobre otros países de la región, entre ellos Argentina (Listín Diario, 2025; EFE, 2025). Para el profesional de contrainteligencia, la importancia del caso no reside únicamente en la imputación, sino en los indicadores de método: cobertura social verosímil, externalización operacional mediante colaboradores locales, y un esquema de financiación y pagos diseñado para opacar origen y trazabilidad, todo ello enmarcado en una tradición rusa de guerra informativa ampliamente documentada por fuentes judiciales y regulatorias estadounidenses y sus semejantes europeos.

Los hechos son nítidos. El Ministerio Público, actuando junto con la Unidad Especializada del Crimen Organizado, detuvo a Novikov durante un operativo en una villa del residencial Palmas del Sol II, Bávaro, donde residía con familiares (Listín Diario, 2025; EFE, 2025). Se le acusó de haber operado con la intención explícita de evitar que se percibiera el origen del contenido promovido, ocultando su nacionalidad rusa y utilizando colaboradores locales, bajo la apariencia de un deportista de artes marciales mixtas, mientras recibía fondos y dirección de asociados al Proyecto Lakhta (Listín Diario, 2025; EFE, 2025). En términos de ‘tradecraft’, la “leyenda” personal (el relato de identidad que permite acceso, normaliza contactos y reduce sospecha) aparece aquí como instrumento de penetración social y, por extensión, de influencia. No se trata de un detalle anecdótico. La cobertura deportiva opera como camuflaje cultural, facilita redes sociales orgánicas y diluye la percepción de intencionalidad política hasta hoy en día igual como para los fines de Novikov sirvió.

La dimensión financiera del caso merece atención especial. Las autoridades afirman haber comprobado que Novikov manejaba operaciones económicas y transacciones internacionales mediante billeteras electrónicas con criptomonedas, usando plataformas como Binance y activos como Bitcoin y Ethereum (Listín Diario, 2025; EFE, 2025). La Fiscalía considera que estos mecanismos habrían sido empleados para mover fondos internacionales encubriendo el origen de los recursos y facilitando actividades ilícitas vinculadas al lavado de activos y al financiamiento transnacional (EFE, 2025; Listín Diario, 2025). Para la contrainteligencia es instructivo. Ilustra una realidad operativa, el ecosistema cripto no es en sí “invisible”, pero sí ofrece fricción adicional para la atribución y la congelación rápida de flujos, especialmente cuando se combina con identidades prestadas, intermediarios y jurisdicciones con distinta y bien variada velocidad de cooperación. En operaciones de influencia, el dinero no es accesorio. Es el sistema circulatorio que paga infraestructura, compra amplificación, remunera operadores, y sostiene persistencia.

El expediente añade un componente que, de confirmarse, ampliaría su gravedad estratégica. Durante el operativo se incautaron evidencias que comprometerían al imputado con la venta y distribución de armas de fuego (Listín Diario, 2025; EFE, 2025). Esta intersección entre desinformación y armas sugiere un patrón conocido por los profesionales del ámbito castrense investigativo y de inteligencia nacional. Cuando convergen propaganda, financiación opaca y armamento, el fenómeno trasciende la “influencia blanda” y se aproxima a un ecosistema habilitador de coerción, intimidación y/o criminalidad organizada. En términos analíticos, el riesgo ya no es sólo cognitivo (degradación de confianza pública, polarización, distorsión deliberativa) sino también material, por la capacidad de introducir violencia o amenaza en el teatro social.

Para comprender el rótulo “Lakhta” y su peso, conviene situarlo en el marco histórico documentado por instancias judiciales y regulatorias. El Departamento de Justicia de Estados Unidos describió el Proyecto Lakhta como un esfuerzo paraguas, financiado por Yevgeniy Prigozhin, que incluía componentes orientados a audiencias extranjeras y que administraba presupuestos multimillonarios para actividades de influencia, incluyendo compras de anuncios, registros de dominios, uso de servidores proxy y “promoción” de publicaciones en redes sociales. El objetivo estratégico fue de sembrar discordia y socavar la fe en instituciones democráticas (U.S. Department of Justice, 2018). El propio gobierno estadounidense, en documentación oficial, asoció la operación con “information warfare” (guerra informática) y con esfuerzos para simular activismo local mediante identidades ficticias y técnicas de ocultación de origen (U.S. Department of Justice, 2018). Por su parte, el Departamento del Tesoro de Estados Unidos caracterizó el Proyecto Lakhta como una campaña de desinformación financiada por Prigozhin dirigida a audiencias en Estados Unidos, Europa, Ucrania e incluso Rusia, destacando su uso de “personas” ficticias y su financiación de “troll farms” (U.S. Department of the Treasury, 2022). Complementariamente, el propio registro público de sanciones de OFAC identifica a la Internet Research Agency LLC (la “fábrica de trolls”) con alias explícitos que incluyen “LAKHTA INTERNET RESEARCH”, reforzando la continuidad nominal y organizacional del constructo Lakhta en la arquitectura de influencia rusa (U.S. Department of the Treasury, Office of Foreign Assets Control, 2026).

La República Dominicana, por su posición geográfica, sociedad libre y abierta, su centralidad turística, su conectividad logística y su apertura de ecosistemas digitales, constituye un espacio atractivo para operaciones de influencia que busquen “plausible deniability” y a la vez proyección regional. Las autoridades dominicanas sostienen que las operaciones atribuidas a Novikov apuntaban a incidir en la opinión pública, con impactos directos en el país y en otros entornos regionales (Listín Diario, 2025). En paralelo, fuentes periodísticas reseñaron que en Argentina se detectó una estructura denominada “La Compañía”, supuestamente vinculada al gobierno ruso y al Proyecto Lakhta, cuyo objetivo sería conformar redes locales leales a intereses rusos para campañas de desinformación, con operadores dedicados a recibir financiamiento y tejer vínculos con colaboradores (Listín Diario, 2025). Reportajes contemporáneos sobre Argentina describieron hallazgos de redes asociadas a campañas de desinformación para promover intereses de Moscú (The Record, 2025; Buenos Aires Times, 2025). Este encadenamiento (nodos nacionales que replican un mismo manual) es típico de operaciones de influencia sostenidas. Se construyen “células” de baja visibilidad, se tercerizan tareas, y se mantiene dirección estratégica a distancia.

Desde la perspectiva profesional, el caso Novikov ofrece lecciones operativas concretas para el diseño de defensa. Primero, la atribución moderna depende menos de “una prueba reina” y más de una constelación de indicadores: patrón de contenido, sincronización de amplificación, infraestructura digital, y rutas de financiación. Cuando el Ministerio Público afirma que Novikov recibía dirección y fondos de asociados a Lakhta, está apuntando a la hipótesis de mando y control, es decir, a una cadena de coordinación, no a mera actividad individual (Listín Diario, 2025; EFE, 2025). Segundo, la cobertura social, en este caso la apariencia de atleta, no debe subestimarse. Es un mecanismo de acceso y normalización, capaz de producir capital social y reclutar facilitadores locales sin que éstos perciban la finalidad estratégica (Listín Diario, 2025). Tercero, el uso de criptoactivos en plataformas globales exige capacidades técnicas y jurídicas específicas como la analítica de blockchain, cooperación con ‘exchanges’, preservación de evidencia digital y coordinación internacional, porque la velocidad del flujo financiero suele superar la velocidad administrativa del Estado (EFE, 2025; Listín Diario, 2025).

Cuarto, la operación descrita confirma un principio que en contrainteligencia conviene reiterar. La desinformación no es simple “mentira” sino una disciplina de ingeniería social, orientada a modificar percepciones, elevar costos de gobernabilidad y erosionar la confianza y legitimidad institucional. El propio marco estadounidense sobre Lakhta enfatiza objetivos estratégicos de discordia y debilitamiento de confianza pública mediante identidades falsas y manipulación del debate (U.S. Department of Justice, 2018). En consecuencia, las respuestas estatales deben integrar no sólo persecución penal, sino resiliencia cognitiva, i.e., alfabetización mediática, transparencia proactiva, y mecanismos de advertencia temprana que permitan a la ciudadanía reconocer narrativas “fabricadas” sin necesidad de censura. La censura también es parte de un complot nefasto. Es el terreno que estas operaciones buscan. Cuanto más se perciba represión informativa, mayor será la rentabilidad propagandística del atacante.

El caso Novikov puede leerse como un capítulo dominicano de un guión ya observado en otras latitudes. Fue una operación de influencia con sello ruso, asociada nominalmente al Proyecto Lakhta, que combinaba ingeniería social, encubrimiento de origen, financiación opaca y utilización de facilitadores locales para maximizar alcance y minimizar atribución (Listín Diario, 2025; EFE, 2025; U.S. Department of the Treasury, 2022). La presencia de indicios de tráfico de armas simultáneamente sugiere una peligrosísima convergencia entre desinformación y criminalidad material, una simbiosis que multiplica el daño potencial y exige respuesta integral del Estado (Listín Diario, 2025; EFE, 2025). Para la contrainteligencia, la conclusión es sobria. La República Dominicana no está “al margen” del tablero. Por su propia conectividad en integración con un mundo MUCHO más allá de la Altagracia, nuestro país es un objetivo y bien uno bien atractivo. La defensa exige capacidades de investigación financiera moderna, cooperación internacional, y una comprensión clara de que la guerra informativa es una operación clandestina de largo aliento y alcance cuyo campo de batalla es la confianza.

~ C. Constantin Poindexter, MA en Inteligencia, Certificado de Posgrado en Contrainteligencia, JD, certificación CISA/NCISS OSINT, certificación DoD/DoS BFFOC

Bibliografía

  • Buenos Aires Times. (2025, 19 de junio). Argentina’s spies expose alleged Russian disinformation group.
  • EFE. (2025, 19 de septiembre). La Fiscalía dominicana detiene a un hombre ruso vinculado a un proyecto de desinformación.
  • Listín Diario. (2025, 19 de septiembre). Ministerio Público arresta a joven ruso que habría dirigido campañas de desinformación desde RD.
  • Listín Diario. (2025, 19 de septiembre). EEUU y Argentina: Otros países que han detectado presencia de rusos pertenecientes a “Lakhta”.
  • The Record. (2025, 19 de junio). Argentina uncovers suspected Russian spy ring behind disinformation campaigns.
  • U.S. Department of Justice. (2018, 19 de octubre). Russian National Charged with Interfering in U.S. Political System.
  • U.S. Department of the Treasury. (2022, 29 de julio). Treasury Targets the Kremlin’s Continued Malign Political Influence Operations in the U.S. and Globally.
  • U.S. Department of the Treasury, Office of Foreign Assets Control. (2026, 23 de enero). Sanctions List Search entry: Internet Research Agency LLC (incluye alias “LAKHTA INTERNET RESEARCH”).
Share this post:
Posted on

A Pier Walk, an Encrypted App, and a Trail of Receipts: The Wei Espionage Case, Counterintelligence and PRC Tradecraft

china, PRC, PLA, espionage, spy, spies, counterespionage, counterintelligence, intelligence, C. Constantin Poindexter, counterespionage;

The two-hundred-month federal sentence imposed on U.S. Navy sailor Jinchao Wei, also known as Patrick Wei, is not merely a cautionary tale about a single insider’s betrayal. It is a contemporary, well documented case study in the People’s Republic of China’s persistent espionage campaign against U.S. defense entities, executed through an operational pattern that has become all too familiar to counterintelligence practitioners, i.e., low friction spotting and assessment via online platforms, cultivation under plausible non-official cover, incremental tasking that begins with seemingly innocuous collection, and compensation methods that leave a financial signature even when communications are migrated to encrypted channels (U.S. Department of Justice, 2023; U.S. Department of Justice, 2026a). The Wei matter is also a reminder that insider threats rarely begin with the theft of a crown jewel. They begin with ego, attention, a sense of being chosen, and the seductive illusion that the handler is impressed and that the target is smarter than the system.

Public reporting and Department of Justice releases describe Wei as having been arrested in August 2023 as he arrived for duty at Naval Base San Diego, where he was assigned to the amphibious assault ship USS Essex (U.S. Department of Justice, 2023; U.S. Department of Justice, 2026b). The arrest timing and location are operationally significant. Counterintelligence cases often culminate when investigators can control the environment, secure devices and storage, and prevent further loss of national defense information while preserving evidentiary integrity. The government’s narrative, as presented publicly, reflects a mature, documentable case anchored in communications and payment records rather than exotic or highly sensitive sources. The Department of Justice has been explicit that not every investigative step can be disclosed and I don’t intend to do so here, but it has been equally clear that the evidentiary core included intercepts of communication between Wei and his PRC handler, and documentation of how Wei was rewarded for his betrayal (U.S. Department of Justice, 2026a).

The recruitment vector in this case aligns with PRC modus operandi in insider targeting. Wei was approached through social media by an individual presenting as a “naval enthusiast” who claimed a connection to China’s state-owned shipbuilding sector, a cover story designed to appear adjacent to legitimate maritime interest while still close enough to naval affairs to justify pointed questions (U.S. Department of Justice, 2026a; Associated Press, 2026). That presentation is instructive. It reduces the psychological barrier to engagement, provides a rationale for curiosity-driven dialogue, and permits gradual escalation from general discussion to tasking. A handler does not need immediate access to classified networks to create damage. He needs a human source who can provide operationally relevant details, and then he needs to keep the source talking long enough to normalize betrayal.

Once engaged, Wei’s operational security behavior demonstrates both awareness and complicity. He told a Navy friend that the activity looked “quite obviously” like espionage and, after that realization, he shifted communications to a different encrypted messaging application that he believed was more secure (U.S. Department of Justice, 2026a; USNI News, 2026). This is an important marker for investigators and security managers. When a cleared person acknowledges illicit intent yet continues, the motivation is not confusion. It is volition. The move to a “more secure” platform is also characteristic of PRC handling in HUMINT collection. Chinese FIS does not need to provide sophisticated technical tradecraft if the target will self-generate it. Public charging language indicates agreed steps to conceal the relationship, including deletion of conversation records and use of encrypted methods, which reflects basic but purposeful counter-surveillance and denial behavior (U.S. Department of Justice, 2023).

Tasking, as described in public releases, combined opportunistic collection with specific collection requirements. Wei was asked to “walk the pier” and report which ships were present, provide ship locations, and transmit photos and videos along with ship-related details (U.S. Department of Justice, 2026a). From a counterintelligence perspective, these are not trivial asks. Pier-side observations can support pattern of life analysis, readiness inference, and operational planning, particularly when fused with open source material and other clandestine reporting. The case officer’s methodology is “incrementalism”. A handler begins with items that feel observational and deniable, then pulls the source toward more sensitive materials by normalizing the exchange relationship and introducing compensation.

The most damaging element is the alleged transfer of classified technical and operational documents. DOJ accounts state that over an approximately 18-month relationship, Wei provided approximately sixty manuals and other sensitive materials, including at least thirty manuals transmitted in one tranche in June 2022, some of which clearly bore export control warnings. The materials were related to ship systems such as power, steering, weapons control, elevators, and damage and casualty controls (U.S. Department of Justice, 2026a; U.S. Department of Justice, 2026b; Associated Press, 2026). In counterintelligence risk terms, technical manuals provide adversaries with a low-cost blueprint for exploitation. They can inform electronic attack planning, maintenance and sustainment targeting, and vulnerability discovery. They also enable synthetic training and doctrine development for adversary operators. A single manual can be operationally relevant for years because systems and procedures often evolve incrementally, not continuously.

Compensation details illuminate tradecraft and investigative leverage. Wei received more than $12,000 over the course of the relationship, including an alleged $5,000 payment connected to the June 2022 manual transfer. The DOJ has described the use of online payment methods (U.S. Department of Justice, 2023; U.S. Department of Justice, 2026a). This is common in modern espionage involving HUMINT assets who are not professional intelligence officers. Financial transfers create documentary evidence, establish quid pro quo, and provide prosecutors with a corroborating narrative that is legible to a jury. For counterintelligence professionals, this observation is instructive. When communications shift to encrypted platforms, payment flows often remain discoverable through records, device artifacts, and third-party reporting. The operational discipline required to truly eliminate financial signatures is rarely present in an insider unless he or she is COMSEC sophisticated.

Public disclosures describe the case’s investigative architecture in broad but meaningful terms which are instructive even in the absence of the classified story. The FBI and Naval Criminal Investigative Service conducted the investigation. The DOJ characterized the matter as a “first of its kind” espionage investigation in the district, language that signals a substantial investigative effort and a prosecutorial commitment to proving the national security dimension in open court (U.S. Department of Justice, 2026a). The described evidence set emphasizes calls and electronic and audio messages with the PRC handler, payment records and receipts, and a post-arrest interrogation in which Wei admitted to providing the materials and described his conduct as espionage (U.S. Department of Justice, 2026a). Those elements are not glamorous, but they are decisive. They reflect the fundamentals of counterintelligence case building: document the relationship, document tasking and exchanges, document intent and benefit.

This IS PRC modus operandi! The Wei case fits a familiar pattern. The approach was enabled by digital access to targets, the cover identity was plausibly adjacent to the target’s professional interests, and the relationship was escalated through a play on Wei’s ego, . . . a mix of attention, manipulation, and money to compromise him. Tradecraft relied on human psychology, not advanced technical means. The Chinese FIS officer did not need to defeat a classified network. He convinced an insider to carry information out through routine channels and to do so voluntarily. This is a good example of why insider threat programs cannot focus only on clearance adjudication and periodic training. They must incorporate behavioral indicators, targeted education about online elicitation, and strong reporting pathways that reward early disclosure rather than stigmatize it (U.S. Department of Justice, 2023; U.S. Department of Justice, 2026a).

There is also a supervisory and cultural lesson embedded here. Wei voiced suspicion to another sailor. That disclosure was a moment when the damage could have been immediately contained. Peers often see the first signs of a peril, yet peers hesitate, either because they do not want to “ruin someone’s career” or because they assume someone else will act. Counterintelligence operators should treat this as a design requirement. Reporting must be made psychologically easy, procedurally simple, and institutionally supported. A peer report should trigger a calibrated and coordinated response, not an immediate public spectacle. The goal is to get ahead of compromise, not to create an environment where personnel conceal concerns to avoid attention.

The Wei case is a well-evidenced illustration of PRC espionage tradecraft against the United States. Chinese FIS spots and contacts potential insiders at scale through social platforms, cultivates via plausible identity, normalizes secret communications, introduces tasking that begins with the innocuous then escalates to classified materials, and pays through channels that are convenient to the target while still supporting handler control and a firm compromise of the asset (U.S. Department of Justice, 2023; U.S. Department of Justice, 2026a; USNI News, 2026). In my professional judgment, this is another textbook example of ego as the primary driver beneath the surface rationalizations. Even when loneliness, financial temptation, or grievance are present, the consistent psychological engine in treasonous espionage is the ego’s appetite to feel important, chosen, liked, befriended and exceptional. Wei’s conduct underscores that dynamic. He recognized the espionage for what it was, believed he could manage his exposure by encrypted applications, and continued down the road of betrayal. That is not naïveté. It is a belief that rules apply to others, that risk can be controlled by personal cleverness, and that the handler’s attention is a validation of one’s importance in the world. In very few espionage cases, money is the hook. The I.C. likes to think that examples like the Ames Case was a money-motivated treason. It was only partially. Likewise, the I.C. report on Ana Montés lays the blame at the feet of “ideology”. That really wasn’t it. Ego is the line that keeps the source from walking away when conscience and common sense offer an exit. It is almost ALWAYS ego.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

Bibliography

  • Associated Press. (2026, January 12). Former Navy sailor sentenced to 16 years for selling information about ships to Chinese intelligence.
  • U.S. Department of Justice. (2023, August 3). Two U.S. Navy servicemembers arrested for transmitting military information to the People’s Republic of China.
  • U.S. Department of Justice. (2026a, January 13). Former U.S. Navy sailor sentenced to 200 months for spying for China.
  • U.S. Department of Justice. (2026b, January 14). U.S. Navy sailor sentenced to more than 16 years for spying for China.
  • USNI News. (2026, January 13). Sailor to serve 16 year prison sentence for selling secrets to China.
Share this post:
Posted on

Legal Remedies Open to Minnesota: ICE Operations and Redress for Civilian Deaths

justice, alex pretti, renee good, ICE, C. Constantin Poindexter

I am a patriot. I have always felt it a privilege to be American and very proud of what we represent to the world. Times have changed, and something strickingly ugly has happened to us. The Renee Good, Keith Porter and Alex Pretti homicides are the last straw. If our President will not step in to stop this, the state(s) must. Minnesota’s ability to halt federal immigration enforcement is constrained by federal supremacy, but it is not null. A state cannot nullify or physically obstruct federal law enforcement acting within lawful federal authority, because immigration enforcement is a core federal power and the Supremacy Clause preempts contrary state action (U.S. Const., art. VI; Arizona v. United States, 2012). The practical and legally durable approach is to distinguish between lawful federal immigration enforcement and allegedly unlawful operational conduct, including unconstitutional crowd control, unreasonable seizures, excessive force, and agency action that exceeds statutory or constitutional limits. Within that framing, Minnesota and its political subdivisions can pursue aggressive, legally cognizable remedies that combine federal court equitable relief, state sovereign measures that deny logistical support and eliminate state entanglement, evidence preservation and independent investigations for lethal force incidents, and damages pathways structured around the Federal Tort Claims Act and carefully pleaded individual capacity claims.

A decisive early step is to build the record and procedural posture for emergency relief. Minnesota’s Attorney General and major cities have already placed this template into the federal docket by seeking declaratory and injunctive relief against what they characterize as an unprecedented surge operation, and by pleading constitutional and Administrative Procedure Act theories (State of Minnesota v. Noem, Complaint, 2026; Minnesota Attorney General’s Office, 2026a). Contemporary reporting describes civilian deaths during the surge, including Alex Pretti on January 24, 2026, and notes that a federal judge ordered preservation of evidence connected to that incident (CBS Minnesota, 2026; The Guardian, 2026). Reporting also documents a prior death earlier in the month and recurring force allegations tied to the surge environment (The Marshall Project, 2026). These allegations and procedural developments are central to remedy selection, because courts are materially more willing to restrain specific unconstitutional tactics than to enjoin immigration enforcement as a category.

A primary remedy is immediate federal court equitable relief. Minnesota’s fastest lawful braking mechanism is a temporary restraining order and preliminary injunction focused on unlawful conduct rather than federal authority in the abstract (28 U.S.C. §§ 1331, 2201–2202). Minnesota can seek a declaratory judgment that discrete federal practices violate the Constitution or exceed statutory authority, coupled with injunctive relief that prohibits specified behaviors, mandates training and supervision changes, and compels evidence retention and production schedules (State of Minnesota v. Noem, Complaint, 2026). Evidence control is not merely ancillary. In lethal force disputes, preservation orders can be the most attainable short-term relief and can materially influence later liability outcomes. Reporting indicates a preservation order in the Pretti matter, and allegations of obstruction in gaining access to the scene, which underscores why Minnesota should continue to press targeted preservation and access relief for body-worn camera footage, dispatch logs, chain of custody documentation, and third-party video sources (CBS Minnesota, 2026).

On the merits, Minnesota can plead multiple constitutional theories that are cognizable in equity even when actions for damages against federal actors are limited. First Amendment claims can be framed as retaliation and viewpoint discrimination, and as a chilling regime when federal agents are alleged to use force against peaceful expressive activity (Hartman v. Moore, 2006; Nieves v. Bartlett, 2019). Fourth Amendment claims can be framed as unreasonable seizures and excessive force. Those claims support injunctive relief to change practices governing stops, detentions, and use of force, particularly where plaintiffs can show a pattern, policy, or command structure rather than a one-off incident (Graham v. Connor, 1989; Tennessee v. Garner, 1985). Fifth Amendment due process framing can supplement where conduct is alleged to be arbitrary or conscience-shocking in a civil enforcement setting (County of Sacramento v. Lewis, 1998). In each lane, the remedy posture should be calibrated to what courts will enjoin. The goal is not a sweeping ban on federal presence, but enforceable constraints and oversight mechanisms that prevent unconstitutional practices and preserve evidence.

Statutorily, the Administrative Procedure Act remains a central lever when the dispute can be characterized as unlawful agency action, ultra vires deployment, or a final agency policy that is arbitrary and capricious, contrary to constitutional right, or adopted without required procedure (5 U.S.C. §§ 702, 706). Even where the government frames the operation as discretionary, plaintiffs can target categorical rules and structured practices that resemble policy rather than case-by-case discretion, including deployment criteria, operational directives, and deviations from articulated enforcement protocols (State of Minnesota v. Noem, Complaint, 2026; Minnesota Attorney General’s Office, 2026a). The APA posture also aligns with remedy realism. Courts often resist ordering how to enforce immigration law, but will restrain agency actions that lack lawful procedure, exceed statutory authority, or violate constitutional limits.

Separately, Minnesota’s structural state power is strongest in disentanglement. The anti-commandeering doctrine bars the federal government from compelling states or localities to administer or enforce federal regulatory programs (Printz v. United States, 1997; Murphy v. NCAA, 2018). This doctrine does not permit obstruction, but it does permit Minnesota to prohibit state and local employees from participating in certain federal immigration activities, such as honoring civil detainers absent judicial warrants, providing nonpublic data access beyond what federal law requires, and using state resources for federal tasking. Operationally, Minnesota can reinforce disentanglement through statewide policies governing state facilities and state-controlled information systems. The objective is to ensure that federal operations must stand on federal resources and federal legal authority alone, while Minnesota maintains compliance with any narrow federal preemption requirements and avoids discrimination against federal officers as such.

For redress of deaths and serious injuries, Minnesota’s investigative and prosecutorial tools matter, but they are bounded by Supremacy Clause immunity principles. Homicide and assault are state crimes, and Minnesota agencies can investigate shootings within Minnesota’s territory. However, federal officers may assert a Supremacy Clause-related immunity against state prosecution for actions taken within the scope of federal duties and authorized by federal law (In re Neagle, 1890). That doctrine is not absolute. If facts indicate actions outside lawful authority, or actions that no reasonable officer could regard as necessary and proper to execute federal duties, state prosecution becomes more plausible. Even where prosecution is foreclosed or removed, robust state investigation is still consequential. It establishes an independent factual record, constrains narratives, supports federal civil remedies, and can trigger institutional accountability mechanisms. In this context, contemporaneous reporting about contested accounts and video evidence underscores the importance of independent scene processing where possible, preservation of third-party footage, coordinated witness interviewing, and transparent public reporting (CBS Minnesota, 2026; The Guardian, 2026).

For damages, Minnesota must separate who can sue and under what theory. Wrongful death damages generally belong to estates and statutory beneficiaries under state law, but the state can support and, in some contexts, pursue recovery for sovereign and proprietary harms. The principal damages route for torts committed by federal employees is the Federal Tort Claims Act, which waives sovereign immunity for certain torts and applies the law of the place where the act occurred (28 U.S.C. §§ 1346(b), 2671–2680). The FTCA law enforcement proviso permits claims for specified intentional torts, including assault and battery, when committed by investigative or law enforcement officers (28 U.S.C. § 2680(h)). Lethal force cases frequently litigate as operational conduct rather than protected policy discretion, though the United States regularly pleads discretionary function defenses and other exceptions (28 U.S.C. § 2680(a)). Plaintiffs must also satisfy the FTCA’s administrative presentment, exhaustion, and limitations requirements, which makes early evidence preservation and record building essential.

If plaintiffs sue individual officers under state tort theories, the Westfall Act frequently triggers substitution of the United States as the defendant for acts within scope, routing the matter back into FTCA exclusivity (28 U.S.C. § 2679). That substitution fight can be dispositive, and it makes careful pleading and factual support crucial, including any evidence that conduct was outside the scope of employment or otherwise not in furtherance of federal duties. Constitutional damages claims against federal officers under Bivens remain theoretically available for some Fourth Amendment paradigms, but the Supreme Court has sharply limited extensions into new contexts, particularly those touching immigration and national security adjacent environments (Bivens v. Six Unknown Named Agents, 1971; Hernández v. Mesa, 2020; Egbert v. Boule, 2022). As a result, victims’ counsel should treat Bivens as a high-risk vehicle and pair any constitutional damages strategy with FTCA claims and equitable relief that does not depend on implying a new damages remedy.

The phrase “stop operations in their tracks” should be operationalized into legally enforceable outcomes: a court-ordered prohibition on unconstitutional suppression of protest, restrictions on unreasonable stops and seizures, strict evidence preservation and production directives for lethal force incidents, and APA-compliant justification and process for any mass surge policy. Minnesota’s existing litigation posture already seeks declaratory and injunctive relief and frames the surge as extraordinary, which positions the state to pursue precisely this kind of targeted judicial control rather than an unattainable blanket prohibition (State of Minnesota v. Noem, Complaint, 2026; Minnesota Attorney General’s Office, 2026a). When paired with disciplined state non-cooperation grounded in anti-commandeering doctrine and meticulous state-level investigation of lethal force incidents, Minnesota can constrain the operational environment, preserve accountability evidence, and position victims’ families for meaningful damages recovery.

In short, the strongest legal tools are not physical resistance or nullification. They are rapid federal court equitable relief, disciplined state disentanglement, evidence-centered litigation, and damages architectures that convert unlawful force into enforceable liability under the FTCA and related doctrines, while recognizing the Supreme Court’s narrowing of implied constitutional damages remedies.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

Bibliography

  • Arizona v. United States, 567 U.S. 387 (2012).
  • Bivens v. Six Unknown Named Agents of Federal Bureau of Narcotics, 403 U.S. 388 (1971).
  • CBS Minnesota. (2026, January 25). Judge grants restraining order against DHS after Border Patrol kills Alex Pretti in Minneapolis.
  • County of Sacramento v. Lewis, 523 U.S. 833 (1998).
  • Egbert v. Boule, 596 U.S. 482 (2022).
  • Graham v. Connor, 490 U.S. 386 (1989).
  • Hartman v. Moore, 547 U.S. 250 (2006).
  • Hernández v. Mesa, 589 U.S. 93 (2020).
  • In re Neagle, 135 U.S. 1 (1890).
  • Minnesota Attorney General’s Office. (2026a, January 12). Attorney General Ellison and cities of Minneapolis and Saint Paul sue to halt ICE surge into Minnesota.
  • Murphy v. NCAA, 584 U.S. 453 (2018).
  • Nieves v. Bartlett, 587 U.S. 391 (2019).
  • Printz v. United States, 521 U.S. 898 (1997).
  • State of Minnesota v. Noem, Complaint for Declaratory and Injunctive Relief, U.S. District Court for the District of Minnesota, Case No. 0:26-cv-00190 (D. Minn. filed 2026, January 12).
  • Tennessee v. Garner, 471 U.S. 1 (1985).
  • The Guardian. (2026, January 24). Report on the killing of a U.S. citizen in Minneapolis during federal agent activity.
  • The Marshall Project. (2026, January 7). Report on use of force allegations connected to immigration enforcement activity in Minneapolis.
Share this post:
Posted on

When Counterintelligence Did Not “Catch” Jonathan Soong

espionage, counterespionage, intelligence, counterintelligence, spy, spies, C. Constantin Poindexter

When Counterintelligence Did Not “Catch” the Bad Guy: How Export Compliance and Oversight Stopped an Illicit Transfer

As a counterintelligence guy, I would love to claim one for the team, telling you a story of how counterintelligence “caught” Jonathan Soong. The question presumes a familiar arc: a clandestine plot detected by a vigilant counterintelligence service, followed by an investigative takedown. In practice, many of the most consequential national security cases in the defense industrial base begin elsewhere. They begin in the unglamorous terrain of export controls, contractual oversight, documentation requirements, and compliance escalation. The Soong matter is best read not as a story of counterintelligence brilliance at the point of origin, but as a demonstration that a robust compliance mechanism can function as a practical counterintelligence force multiplier, surfacing deception through audit friction, verification, and internal accountability (U.S. Department of Justice 2025a).

Jonathan Yet Wing Soong worked under a University Space Research Association arrangement supporting NASA, where he helped administer licensing and distribution of U.S. Army-owned aviation and flight control software subject to U.S. export controls. Public charging and plea materials describe a pattern that is familiar to any counterintelligence professional who has studied insider-enabled technology transfer. A trusted administrator leveraged authorized access to facilitate improper export to a prohibited end user, while using misrepresentation and intermediaries to reduce detection risk and sustain the activity long enough to monetize it (U.S. Department of Justice 2022; U.S. Department of Justice 2023; U.S. Department of Commerce, Bureau of Industry and Security 2022).

Export compliance as counterintelligence by another name

In the contractor ecosystem, counterintelligence is no longer confined to investigations and briefings. It is built into controls that regulate who can access what, who can receive what, and what documentation must exist to justify a transfer. Export compliance is the legal expression of strategic technology denial. When an export compliance program is mature, it creates a perimeter of verification around controlled software, technical data, and sensitive know-how. It does this through end-user screening, licensing checks, record retention, and the expectation that representations are auditable, not merely asserted (U.S. Department of Justice 2025a).

Soong’s conduct, as publicly described, involved providing controlled U.S. Army aviation software to the Beijing University of Aeronautics and Astronautics, commonly known as Beihang University, an end-user on the U.S. Entity List. The Entity List designation matters because it transforms what might otherwise be a complicated compliance decision into a bright-line restriction: an elevated risk recipient that generally requires licensing and heightened scrutiny. In counterintelligence terms, it is a government signal that a recipient is associated with activities of concern and therefore must be treated as a strategic risk, not just a commercial counterparty (U.S. Department of Commerce, Bureau of Industry and Security 2022; U.S. Department of Justice 2022).

The decisive tripwire was oversight, not classic counterintelligence detection

The core point that the public often misses is timing. The publicly documented narrative indicates that the scheme was not halted because counterintelligence detected hostile tasking in real time. Rather, the activity began to unravel when NASA asked questions about software licensing activity involving China-based purchasers. That inquiry triggered internal examination at USRA, which then forced Soong’s process, documentation, and representations into a higher scrutiny environment (U.S. Department of Justice 2025a).

From a former operator’s perspective, that is the moment the system displayed its value. Oversight created heat. Heat compelled review. Review compelled proof. Proof created contradictions. Contradictions produced admissions and preserved evidence. That sequence is not incidental. It is the operational logic of compliance as an investigative engine. When a compliance system is designed to verify rather than merely record, it becomes difficult for an insider to sustain a cover story indefinitely.

The cover story failed under verification pressure

Public DOJ descriptions emphasize that Soong initially lied and fabricated evidence to make it appear that purchaser diligence had been conducted. In my experience, this is the most common failure mode for organizations that treat compliance as a box-checking function: insiders learn the minimum artifacts that satisfy superficial review. The Soong case illustrates what happens when counsel and compliance do not accept the first answer. DOJ accounts describe further investigation by USRA’s counsel, confrontation with contradictions, and Soong’s eventual admissions, including that he knew the end user was on the Entity List and that an export license was required (U.S. Department of Justice 2025a).

That is not just a legal detail. It is the fulcrum that turns suspicion into provable intent. Counterintelligence professionals care about intent because intent distinguishes mistake from exploitation and distinguishes weak governance from an insider who is actively enabling a strategic competitor or worse, adversarial FIS. Admissions anchored to documented contradictions are highly durable. They are not dependent on classified sources or contested analytic judgments. They are built for court cases.

Intermediaries and misdirection are a compliance evasion pattern

The public record also describes the use of an intermediary to obscure the true end user and facilitate the commercial pathway. This is a standard concealment vector. Intermediaries can be used to launder payment trails, shift transactional geography, and create plausible deniability within internal processes that rely on surface-level end-user statements. If a program relies on the integrity of a single administrator’s “screening,” the administrator becomes the control. If the administrator is compromised, the system is compromised. In this case, public materials describe intermediary involvement and a transfer pathway that, when examined, revealed the underlying restricted recipient (Department of Defense Office of Inspector General, Defense Criminal Investigative Service 2023; U.S. Department of Justice 2025a).

For counterintelligence practitioners, the lesson is straightforward: third party structures are not merely procurement conveniences. They are also tradecraft. In an export controls environment, every intermediary should be treated as a potential concealment method unless diligence is independently verifiable.

Voluntary self-disclosure converted an internal discovery into a national security case

Once internal discovery occurred, the matter moved from corporate governance to national security enforcement. DOJ’s public declination notice emphasized that USRA self disclosed export control offenses committed by its employee and cooperated, which shaped the government’s posture toward the company while leaving the individual to face prosecution (U.S. Department of Justice 2025a). That sequence is important for practitioners because it demonstrates how compliance maturity affects outcomes. Prompt internal escalation, self disclosure, and remediation can separate an organization’s institutional exposure from the conduct of a rogue insider, while also strengthening the government’s ability to build a case against the perpetrator.

DOJ also identified the investigative constellation, including Commerce export enforcement, the FBI, Defense Criminal Investigative Service, NASA Office of Inspector General, and U.S. Army elements including Army counterintelligence and investigative components. In other words, counterintelligence was present and relevant, but it was not the initial tripwire. It was part of the enforcement and investigative consolidation phase after compliance mechanisms surfaced the issue and the company disclosed it (U.S. Department of Justice 2025a; U.S. Department of Justice 2023).

Compliance “caught” the act and counterintelligence helped finish the job

If we insist on the verb “catch,” my professional assessment is that counterintelligence did not “catch” Jonathan Soong in the popular sense of the term. The decisive early detection function was performed by oversight and export compliance mechanisms. NASA’s questions triggered organizational scrutiny. Scrutiny demanded documentation. Documentation collapsed under verification. Verification produced contradictions and admissions. Those admissions and records enabled self-disclosure and a multi-agency investigation that culminated in a guilty plea. Counterintelligence contributed where it often contributes most effectively in the contractor environment: by supporting the investigative and enforcement architecture once a compliance tripwire has surfaced misconduct, and by helping translate a technical compliance failure into a national security narrative that the government can prosecute (U.S. Department of Justice 2025a; U.S. Department of Justice 2023).

This is not a criticism of counterintelligence. It is an argument for modernizing how we describe counterintelligence effectiveness. In the defense industrial base, export compliance is not adjacent to counterintelligence. Export compliance is frequently counterintelligence in operational form. When built correctly, it makes illicit transfer hard to hide, expensive to sustain, and likely to fail under audit pressure. The Soong case is the quiet proof that governance, oversight, and export controls can stop a technology transfer plot even when no one is running a classic counterintelligence operation at the beginning.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

Bibliography

  • Department of Defense Office of Inspector General, Defense Criminal Investigative Service. 2023. “Defendant Admits Using Intermediary to Funnel Payments for United States Army Aviation Software Exported to Beihang University.” Press release, January 17, 2023.
  • U.S. Department of Commerce, Bureau of Industry and Security. 2022. “South Bay Resident Charged with Smuggling and Exporting American Aviation Technology to Beijing University.” Press release, May 26, 2022.
  • U.S. Department of Justice. 2022. “South Bay Resident Charged with Smuggling and Exporting American Aviation Technology to Beijing University.” Press release, U.S. Attorney’s Office, Northern District of California, May 26, 2022.
  • U.S. Department of Justice. 2023. “Castro Valley Resident Pleads Guilty to Illegally Exporting American Aviation Technology.” Press release, U.S. Attorney’s Office, Northern District of California, January 17, 2023.
  • U.S. Department of Justice. 2025a. “Justice Department Declines Prosecution of Company That Self Disclosed Export Control Offenses Committed by Employee.” Press release, Office of Public Affairs, April 30, 2025.

Share this post:
Posted on

“Due diligence” inmobiliaria en la República Dominicana: la disciplina que separa una compra segura de un riesgo evitable

bienes raices, republica dominicana, abogado, bufete de abogados, despacho legal, abogado santo domingo, C. Constantin Poindexter Salcedo

En el mercado inmobiliario dominicano, especialmente en operaciones transfronterizas donde el comprador reside en Estados Unidos o Europa, el “entusiasmo por el proyecto” suele adelantarse a la verificación jurídica y financiera del promotor. Esa asimetría de información se amplifica cuando la propiedad se adquiere en preventa, cuando la construcción apenas iniciará, o cuando el comprador recibe un paquete de documentos que aparenta exhaustividad pero no necesariamente acredita lo esencial. Precisamente por eso, nuestro bufete en Santo Domingo ha estructurado un servicio integral de diligencia debida o due diligence inmobiliaria en la República Dominicana, diseñado para auditar riesgos, confirmar hechos registrales y contractuales, y producir un informe accionable que permita comprar con criterio técnico y no por confianza implícita.

El punto de partida de toda diligencia debida sería la comprensión del sistema de publicidad inmobiliaria dominicano y de la función del Estado en la mutación de derechos reales. La Ley núm. 108 05 de Registro Inmobiliario establece el marco institucional y los principios que gobiernan el saneamiento y el registro de los derechos reales, así como la registración de cargas y gravámenes sobre inmuebles, con intervención de los órganos de la Jurisdicción Inmobiliaria (República Dominicana, Ley 108 05, 2005). Esto no es un tecnicismo: en la práctica, la seguridad jurídica de la compra depende de que el inmueble esté correctamente identificado, que el derecho del vendedor esté debidamente registrado y que el estado jurídico del inmueble no esté afectado por gravámenes, anotaciones o conflictos que desnaturalicen el valor económico de la transacción.

Nuestro servicio de due diligence se estructura, primero, alrededor de la verificación robusta de la parcela y del título. Ello implica confirmar la identidad registral del inmueble y revisar el Certificado de Título, su coherencia con la realidad física y la cadena de titularidad, así como verificar que el vendedor es el titular registral o que posee facultades válidas para transferir. En términos operativos, el Registro de Títulos es la institución que custodia y procesa actuaciones vinculadas al estado jurídico de los inmuebles, y mantiene trámites y certificaciones que permiten establecer, con evidencia documental, la situación registral de un bien (Registro Inmobiliario, s. f.). En adición, existe una certificación específica para acreditar el estado jurídico del inmueble y la vigencia del duplicado del Certificado de Título, lo cual resulta particularmente útil cuando el comprador exige una constatación oficial del estatus registral antes de comprometer pagos significativos (Gobierno de la República Dominicana, s. f.).

Esta revisión no se limita a constatar “si hay título”. La diligencia debida examina si existen cargas y gravámenes susceptibles de afectar la compraventa, como hipotecas, embargos, anotaciones preventivas, servidumbres, restricciones registrales, o promesas previas que introduzcan riesgos de doble venta o de litigio. Dado que la Ley 108 05 contempla expresamente el registro de cargas y gravámenes y busca garantizar la legalidad de la mutación o afectación de derechos reales, la lectura crítica del expediente registral es un componente esencial de la gestión de riesgo (República Dominicana, Ley 108 05, 2005). En lenguaje empresarial, esto equivale a validar el “activo subyacente” antes de adquirirlo.

El segundo eje del servicio es la diligencia debida del vendedor o promotor, enfocada en su legitimación y capacidad jurídica para contratar. Cuando el vendedor es una sociedad, la revisión debe confirmar existencia, vigencia, órganos de representación y facultades del firmante a través del Registro Mercantil y los documentos corporativos pertinentes. Este paso, que con frecuencia se subestima, es determinante: un contrato firmado por una persona sin representación válida puede convertirse en un instrumento difícil de ejecutar, incluso si la narrativa comercial del proyecto es convincente. La diligencia debida, por tanto, actúa como un control de gobierno corporativo aplicado a la transacción, verificando que la voluntad contractual del vendedor esté jurídicamente bien formada y sea oponible.

El tercer componente, crítico en preventa, es la diligencia del proyecto y su ejecutabilidad regulatoria. Cuando “se va a empezar a construir ahora”, la compra deja de ser una adquisición de un inmueble terminado y pasa a ser, en gran medida, una exposición al riesgo de ejecución del promotor. En ese escenario, la debida diligencia revisa el paquete documental del proyecto y la disponibilidad de permisos o autorizaciones conforme aplique al tipo de obra y ubicación, y analiza si el cronograma y el esquema de pagos propuesto están alineados con hitos verificables y con condiciones suspensivas razonables. La intención no es burocratizar la compra, sino asegurar que el comprador no financie de forma desprotegida un proyecto cuyo avance no pueda medirse ni exigirse contractualmente.

Cuando el inmueble se enmarca en un régimen de condominio, la revisión añade un plano adicional de seguridad. La Ley 5038 sobre condominios regula la posibilidad de dividir la propiedad por unidades exclusivas y áreas comunes, y establece el régimen especial aplicable a ese tipo de inmuebles, lo que impacta la forma en que se constituye el proyecto, se registran derechos y se definen obligaciones de copropiedad (República Dominicana, Ley 5038, 1958). En términos prácticos, el comprador no solo adquiere una unidad, sino un paquete de derechos y obligaciones que deben estar correctamente articulados en la documentación del proyecto para evitar conflictos posteriores.

El cuarto eje del servicio, solicitado de manera recurrente por compradores internacionales, es la evaluación razonable de solvencia y capacidad de ejecución del vendedor o promotor. Conviene ser metodológicamente honestos: en el contexto dominicano, la disponibilidad de estados financieros auditados, información pública comparable o reportes crediticios corporativos estandarizados puede ser limitada. Por ello, nuestro enfoque no promete una auditoría financiera, sino una evaluación de fortaleza y capacidad operacional basada en evidencia documental aportada por el promotor, verificación de consistencia, y mitigación contractual del riesgo cuando la información sea incompleta. Este módulo suele incluir solicitud y análisis de documentación financiera disponible, certificaciones bancarias cuando proceda, identificación de estructura de financiamiento, revisión de proyectos ejecutados y en curso, y verificación razonable de contingencias relevantes. El resultado se expresa como un nivel de riesgo y confianza, acompañado de recomendaciones específicas para proteger el capital del comprador.

En esa línea, la ingeniería contractual se vuelve una herramienta de control de riesgo tan importante como el análisis registral. Un comprador en preventa debe negociar términos que traduzcan hallazgos de diligencia debida en protecciones reales: pagos contra avance comprobable, penalidades por incumplimiento, retenciones, condiciones suspensivas y, cuando sea viable, mecanismos de administración de fondos que reduzcan el riesgo de desvío. En el ordenamiento dominicano, la Ley 189 11 incorpora la figura del fideicomiso y crea un marco para impulsar el mercado hipotecario y estructuras fiduciarias que, bien diseñadas, pueden servir como arquitectura de protección en proyectos inmobiliarios (República Dominicana, Ley 189 11, 2011). Sin convertir cada operación en un proyecto financiero sofisticado, la debida diligencia responsable contempla estas herramientas cuando el perfil de riesgo lo justifica.

El entregable de nuestro servicio es un Informe de Diligencia Debida redactado con enfoque probatorio y ejecutivo. Ese informe integra los hallazgos registrales, corporativos y contractuales, identifica riesgos por categorías, y recomienda acciones concretas: desde subsanaciones previas al cierre hasta cláusulas que deben incorporarse o modificarse en la promesa de venta. Para clientes en Estados Unidos, este documento cumple una función adicional: sirve como evidencia de que la decisión de compra se adoptó con estándares comparables a un “legal due diligence” corporativo, lo cual es especialmente valioso cuando existen co inversionistas, asesores financieros o entidades bancarias revisando el expediente.

En síntesis, la due diligence inmobiliaria en la República Dominicana no es un gasto accesorio, sino una prima de control de riesgo. Su valor se mide por lo que evita: títulos defectuosos, cargas ocultas, vendedores sin legitimación, contratos desequilibrados, proyectos sin permisos suficientes o promotores cuya capacidad de ejecución no está demostrada. En un entorno donde la documentación puede ser abundante pero la verificación independiente es escasa, la diligencia debida convierte documentos en certezas y promesas en obligaciones exigibles. Nuestro bufete ofrece ese proceso con disciplina técnica, enfoque probatorio y un objetivo claro: que el cliente compre con seguridad jurídica, previsibilidad económica y mecanismos reales de protección.

~ C. Constantin Poindexter Salcedo, MA, JD, CPCU, MA2, AINS, AIS

Bibliografía

  • Gobierno de la República Dominicana. (s. f.). Certificación de estado jurídico del inmueble.
  • Registro Inmobiliario. (s. f.). Registro de Títulos.
  • República Dominicana. (1958). Ley 5038 sobre condominios.
  • República Dominicana. (2005). Ley 108 05 de Registro Inmobiliario.
  • República Dominicana. (2011). Ley 189 11 para el desarrollo del mercado hipotecario y el fideicomiso.
Share this post:
Posted on

SIGNAL: Una plataforma segura para profesionales de inteligencia, contrainteligencia, y lo será aún más en la era cuántica

SIGNAL, inteligencia, espionaje, contrainteligencia, contraespionaje, ciber, ciberseguridad, espia, C. Constantin Poindexter Salcedo, DNI, J2, CNI

Signal bien merece su reputación en comunidades de inteligencia, contrainteligencia e investigación por una razón práctica. A mí me encanta, y a usted también le debería gustar. La herramienta fue diseñada partiendo de supuestos adversariales que se alinean con el targeting real de activos en el terreno. Esos supuestos incluyen recolección a nivel estatal, interceptación encubierta y muchas veces ilegal, compromiso del endpoint, robo de credenciales y retención masiva de datos por largo tiempo para explotación futura. Signal no es mensajería convencional a la que luego se le “añadió” seguridad. Es un conjunto integrado de protocolos para acuerdo de claves, evolución de claves por mensaje y recuperación tras compromiso, sustentado en especificaciones abiertas y un endurecimiento criptográfico continuo.

Desde la perspectiva de un profesional de inteligencia, Signal es convincente porque está diseñado para mantenerse resiliente incluso bajo fallas parciales. Si un atacante “gana una batalla” capturando una clave, clonando un dispositivo por un rato o grabando tráfico durante años, Signal busca evitar que esa victoria puntual se convierta en acceso estratégico y duradero. Ese modelo de contención del daño encaja con prioridades de contrainteligencia: limitar el radio de impacto, reducir el tiempo de permanencia del adversario y forzarle esfuerzos repetidos que aumentan la probabilidad de detección.

El Double Ratchet y las claves por mensaje que limitan el daño

En el centro de la confidencialidad de mensajes en Signal está el algoritmo Double Ratchet, diseñado por Trevor Perrin y Moxie Marlinspike (Perrin and Marlinspike, 2025). En términos operacionales, el Double Ratchet importa porque entrega propiedades que se alinean con la realidad del tradecraft.

La “forward secrecy” (secreto hacia adelante) asegura que comprometer una clave actual no revele el contenido de mensajes anteriores. Los adversarios, de manera rutinaria, recolectan ciphertext en volumen y luego buscan un punto único de apalancamiento para descifrar más adelante mediante incautación de dispositivos, acceso interno, malware o procesos legales. La forward secrecy frustra esa estrategia al garantizar que el tráfico capturado anteriormente no se convierta en una “cosecha” de inteligencia en el futuro si una clave se expone después (Perrin y Marlinspike, 2025).

La “post-compromise security” (recuperación tras intrusión) aborda un escenario que los practicantes de inteligencia planifican: el compromiso temporal de un dispositivo. Inspecciones fronterizas, robo oportunista, acceso coercitivo o un implante de corta duración pueden ocurrir. El Double Ratchet incluye actualizaciones periódicas de Diffie-Hellman que inyectan entropía fresca, mientras su ratchet simétrico deriva nuevas claves de mensaje de manera continua. Una vez termina la ventana de compromiso, las claves de mensajes posteriores se vuelven criptográficamente inalcanzables para el atacante, siempre que ya no mantenga persistencia en el endpoint (Perrin and Marlinspike, 2025). Esto no es mercadeo exagerado: es una evolución disciplinada de claves que priva a servicios de inteligencia adversarios y a espías corporativos del uso indefinido de material de claves robado.

Aquí la lógica de respuesta a incidentes cambia: un compromiso breve no implica automáticamente exposición permanente de todo el historial y el futuro. En cambio, el atacante debe sostener persistencia para conservar visibilidad. Eso eleva la carga operativa y aumenta el riesgo de detección.

X3DH y PQXDH: el giro contra “cosecha ahora, descifra después”

Históricamente, Signal utilizó X3DH (Extended Triple Diffie-Hellman) para el establecimiento asíncrono de sesiones, algo vital en entornos móviles donde los destinatarios suelen estar offline. X3DH emplea claves de identidad de largo plazo y prekeys firmadas para autenticación, preservando a la vez forward secrecy y propiedades de negabilidad (Marlinspike and Perrin, 2016).

El panorama de riesgo estratégico cambió con la plausibilidad de computación cuántica criptográficamente relevante. La amenaza no es solo el descifrado futuro en tiempo real; es el modelo “harvest now/decrypt later”: intercepción masiva hoy con la expectativa de que avances futuros, incluida la capacidad cuántica, permitan abrir tráfico almacenado. Signal respondió introduciendo PQXDH (“Post Quantum Extended Diffie Hellman”), reemplazando el setup de sesión por una construcción híbrida que combina Diffie-Hellman clásico de curva elíptica (X25519) y un mecanismo post-cuántico de encapsulación de claves derivado de CRYSTALS-Kyber (Signal, 2024a). La implicación operacional es directa: el adversario tendría que romper tanto el componente clásico como el componente postcuántico para reconstruir el secreto compartido (Signal, 2024a).

Este establecimiento híbrido refleja ingeniería conservadora, muy típica de entornos de alta amenaza: migrar temprano, evitar cortes bruscos y no depender de un único primitivo nuevo. Esto también importa porque el componente post-cuántico corresponde a lo que NIST estandarizó como ML-KEM, derivado de CRYSTALS-Kyber, en FIPS 203 (NIST, 2024a; NIST, 2024b). La estandarización del NIST no garantiza invulnerabilidad, pero sí aumenta la confianza en que el primitivo ha sido escrutado y está siendo adoptado como línea base para entornos de alta seguridad.

Signal, además, hace una aclaración crucial en sus materiales sobre PQXDH: PQXDH aporta forward secrecy post-cuántica, mientras que la autenticación mutua en la revisión actual permanece anclada en supuestos clásicos (Signal, 2024b). Para los practicantes, esa precisión es valiosa porque define exactamente qué es post-cuántico hoy y qué no.

SPQR y el ratcheting poscuántico para operaciones de larga duración

El establecimiento de sesión es solo una parte del problema del ciclo de vida. Un recolector capaz puede grabar tráfico por periodos prolongados. Si la capacidad cuántica aparece más adelante, la pregunta es si la evolución continua de claves sigue siendo segura contra descifrado futuro. La introducción por parte de Signal del Sparse Post Quantum Ratchet (SPQR) atiende esa continuidad al añadir resiliencia postcuántica al mecanismo de ratcheting en sí (Signal, 2025).

SPQR extiende el protocolo para que no solo el handshake inicial, sino también las actualizaciones posteriores de claves, incorporen propiedades resistentes a cuántica, preservando forward secrecy y post-compromise security (Signal, 2025). Para profesionales de inteligencia esto es determinante, porque las relaciones operacionales suelen ser de largo aliento: activos y handlers, fuentes de investigación y coordinación entre equipos pueden durar meses o años. Un protocolo que solo endurece el handshake ayuda, pero uno que endurece el rekeying continuo encaja mejor con el modelo adversarial real de recolección persistente.

Trabajo académico ha analizado la evolución de X3DH a PQXDH dentro del movimiento de Signal hacia seguridad post-cuántica y enmarca PQXDH como mitigación del riesgo “cosecha ahora, descifra después” a escala (Katsumata et al., 2025). Ese enfoque cuadra con la gestión de riesgos en inteligencia: la confidencialidad se evalúa frente a adversarios pacientes, bien financiados y con horizonte estratégico.

Análisis formal, especificaciones abiertas y por qué esto importa operativamente

El practicante debe ser escéptico ante afirmaciones de seguridad que no soporten revisión externa. La suite de protocolos de Signal se beneficia de especificaciones públicas y escrutinio criptográfico sostenido. Un análisis formal ampliamente citado modela las propiedades de seguridad centrales del protocolo y examina en detalle su diseño basado en ratchets (Cohn Gordon et al., 2017). Ningún protocolo está “probado” contra cada modo de falla del mundo real. Sin embargo, métodos formales y análisis revisados por pares reducen la probabilidad de que debilidades estructurales permanezcan ocultas. Operacionalmente, esto se traduce en confiabilidad: cuando usted depende de una herramienta para trabajo sensible, evalúa si las afirmaciones son verificables, si los modos de falla están documentados y si las mejoras pueden validarse.

Metadatos, “Sealed Sender” y el rol del tradecraft

La confidencialidad del contenido es solo una parte de la seguridad en inteligencia. Los metadatos pueden ser decisivos: quién habla con quién, cuándo y con qué frecuencia puede producir inferencias dañinas. Sealed Sender de Signal fue diseñado para reducir la información del remitente visible al servicio durante la entrega del mensaje (Wired Staff, 2018). Investigación académica examina Sealed Sender y propone mejoras, además de discutir metadatos a nivel de red como la exposición de direcciones IP y las implicaciones para herramientas de anonimato (Martiny et al., 2021). Otro trabajo discute riesgos de análisis de tráfico que pueden persistir en entornos de grupos incluso cuando la identidad del remitente se oculta parcialmente (Brigham and Hopper, 2023).

La conclusión para el operador es clara: Signal mejora de manera material la seguridad del contenido y reduce ciertas exposiciones de metadatos. No elimina la necesidad de medidas de seguridad operacional. Dependiendo del perfil de misión, esas medidas pueden incluir endpoints endurecidos, manejo estricto de dispositivos, minimización de exposición de identificadores y protecciones de red consistentes con la ley y la política aplicables.

Por qué la trayectoria de SIGNAL es creíble en la transición cuántica

El enfoque de Signal hacia la transición cuántica refleja una postura de ingeniería creíble: migrar lo suficientemente temprano para amortiguar el riesgo “cosecha ahora, descifra después”; adoptar diseños híbridos para reducir la dependencia de un sólo supuesto; y extender garantías postcuánticas más allá del handshake hacia la evolución continua de claves (Signal, 2024a; Signal, 2025). La alineación con la dirección estandarizada por NIST para el establecimiento de claves también apoya la mantenibilidad a largo plazo y la interoperabilidad del ecosistema (NIST, 2024a; NIST, 2025). Desde la perspectiva de un practicante de inteligencia, el argumento central no es que Signal sea irrompible. El punto es que Signal está diseñado para limitar el daño, recuperarse tras un compromiso y anticipar amenazas estratégicas de descifrado. Está construido para un entorno hostil que se mueve hacia una realidad postcuántica.

Y lo digo sin rodeos ni disparates, Meta no hace nada de esto. FB Messenger y WhatsApp dejan huecos graves en la ciberseguridad porque el enfoque de Meta es la monetización del mecanismo de mensajería, no comunicaciones verdaderamente “a prueba” de adversarios. Úselos bajo su propio riesgo.

~ C. Constantin Poindexter, MA en Inteligencia, Certificado de Posgrado en Contrainteligencia, JD, certificación CISA/NCISS OSINT, certificación DoD/DoS BFFOC

Bibliografía

  • Brigham, Eric, and Nicholas Hopper. 2023. “Poster: No Safety in Numbers: Traffic Analysis of Sealed Sender Groups in Signal.” arXiv preprint.
  • Cohn Gordon, Katriel, Cas Cremers, Benjamin Dowling, Luke Garratt, and Douglas Stebila. 2017. “A Formal Security Analysis of the Signal Messaging Protocol.” Proceedings of the IEEE European Symposium on Security and Privacy.
  • Katsumata, Shota, et al. 2025. “X3DH, PQXDH to Fully Post Quantum with Deniable Ring.” Proceedings of the USENIX Security Symposium.
  • Marlinspike, Moxie, and Trevor Perrin. 2016. “The X3DH Key Agreement Protocol.” Signal Protocol Specification.
  • National Institute of Standards and Technology. 2024a. “NIST Releases First 3 Finalized Post Quantum Encryption Standards.” NIST News Release.
  • National Institute of Standards and Technology. 2024b. FIPS 203. “Module Lattice Based Key Encapsulation Mechanism Standard, ML KEM.” U.S. Department of Commerce.
  • National Institute of Standards and Technology. 2025. “Post Quantum Cryptography Standardization.” NIST Computer Security Resource Center.
  • Perrin, Trevor, and Moxie Marlinspike. 2025. “The Double Ratchet Algorithm.” Signal Protocol Specification.
  • Signal. 2024a. “Quantum Resistance and the Signal Protocol.” Signal Blog.
  • Signal. 2024b. “The PQXDH Key Agreement Protocol.” Signal Protocol Specification.
  • Signal. 2025. “Signal Protocol and Post Quantum Ratchets, SPQR.” Signal Blog.
  • Wired Staff. 2018. “Signal Has a Clever New Way to Shield Your Identity.” Wired Magazine.
Share this post:
Posted on

2026 Surety Company Demand Drivers: Data Center and Power Infrastructure Projects

data centers, construction, surety, surety bond, surety bonds, surety one, suretyone.com, Janus Assurance Re, C. Constantin Poindexter

Predictions of rising surety capacity demand in 2026 are often described as a general consequence of higher infrastructure spending. That explanation is largely accurate, but it understates the specific mechanism most likely to shape surety markets in 2026. The sharper, more decision-useful view is that the data center construction cycle, paired with the surge in energy and grid work required to power those facilities, is creating a two-stage construction pipeline that expands bonded volume, increases average contract size, and raises the importance of contractor prequalification. In short, more data centers mean more power projects, and that combined workload is positioned to pull more surety capacity into the market in 2026. The data center boom and power appetite will affect surety companies significantly.

The ‘data center story’ matters for surety companies because it converts digital demand into physical, schedule-critical construction. Data centers are capital-intensive, equipment-dependent, and commissioning-sensitive assets. Their owners typically face time commitments to customers and revenue penalties for delayed delivery. That pushes owners, lenders, and counterparties toward risk transfer tools that reduce completion uncertainty, including performance and payment bonds. As the number of projects rises and as their scopes broaden, the surety market sees both higher bond counts and higher aggregate exposure.

Electric load growth is the most direct indicator that the pipeline will remain active. The U.S. Energy Information Administration’s January 2026 Short Term Energy Outlook anticipates continued growth in electricity consumption and highlights data centers as a key contributor to demand growth through 2027 (U.S. Energy Information Administration 2026a; U.S. Energy Information Administration 2026b). For surety markets, this is not merely a macroeconomic footnote. Rising load implies that energy infrastructure must be accelerated, which means new contracting opportunities that frequently come with bonding requirements. When owners and utilities confront tight timelines and high outage sensitivity, they tend to prefer contractors with strong balance sheets and proven delivery histories, which increases the value of surety prequalification and, simultaneously, increases the pull on available surety capacity for qualified firms.

Federal research and energy authorities have also quantified how significantly data centers could reshape U.S. electricity demand. The U.S. Department of Energy, citing Lawrence Berkeley National Laboratory’s 2024 work, reports that data centers used roughly 4.4 percent of U.S. electricity in 2023 and could reach approximately 6.7 percent to 12 percent by 2028. The same discussion estimates data center electricity use rising from about 176 terawatt hours in 2023 to a range of roughly 325 to 580 terawatt hours by 2028 (U.S. Department of Energy 2024). These ranges signal a structural shift rather than incremental growth. If load rises toward the upper end, the scale of new generation, grid reinforcement, and interconnection work increases accordingly. Each of those categories tends to be delivered through large, multi-contractor contracting structures where owners and financiers frequently require bonding.

Commercial market research is consistent with that trajectory and provides near term context. S&P Global, summarizing 451 Research, has projected U.S. data center demand rising to around 75.8 gigawatts in 2026 and continuing upward afterward (Hering and Dlin 2025). In parallel, JLL’s 2026 outlook describes a construction supercycle and anticipates large additions in global data center capacity between 2026 and 2030, while also emphasizing construction cost escalation and the increasing use of onsite power and storage solutions (JLL 2025). For surety markets, the implication is straightforward: larger and more complex projects, delivered faster, tend to increase the use of bonds as a contractual safeguard, particularly where lenders want standardized completion security.

Here the “power appetite” element becomes decisive for my title statement. The surety effect is not limited to the data center buildings themselves. The more consequential driver for 2026 surety markets is that data center growth forces the construction of enabling energy assets outside the data center footprint. Those assets often include substations, transmission and distribution upgrades, utility interconnections, grid hardening, generation additions, utility scale storage, fuel supply tie-ins for thermal generation, and behind-the-meter microgrid solutions. Many of these projects face long equipment lead times, tight outage windows, right-of-way constraints, and regulatory milestones. Complexity and mission criticality increase the owner’s preference for bonding on the prime contract and sometimes for subcontractor bonding as well.

Contracting norms reinforce why surety demand rises as contract values rise. On federal construction, standard clauses generally require performance and payment bonds at 100 percent of the original contract price, with additional coverage needed if the contract price increases (Federal Acquisition Regulation 2026). Public works contracting also rests on the broader statutory framework requiring bonds for federal public buildings or public works (40 U.S.C. § 3131 2025). Even when data centers are privately financed, lenders frequently adopt bond requirements that mirror public sector practices because the economic consequences of nonperformance are severe. Also, our traditional bond forms and underwriting practices provide a familiar discipline.

The infrastructure spending environment remains relevant, but as a foundation rather than the marginal driver in this specific narrative. Federal reporting on IIJA funding status indicates continued movement from enacted funding to obligations and outlays, supporting a sustained baseline of public construction activity (U.S. Department of Transportation 2025). Industry reporting entering 2026 similarly points to durable construction demand while highlighting constraints such as labor availability, cost volatility, and schedule pressure (Construction Dive 2026). The key point for your title, however, is that data centers magnify the infrastructure baseline by adding a privately anchored project type that nevertheless pulls in large volumes of utility and grid work, often in the same regions and time windows. That coupling pushes surety markets in two ways: it increases total bonded work, and it concentrates demand in specialized contractor classes, especially electrical, power, and high-end mechanical trades.

Surety capacity demand in 2026 rises not only because there are more projects, but because the average risk profile and scope complexity both increase. Data center delivery depends on high-performance mechanical, electrical, and plumbing integration, plus commissioning and energization milestones that are intolerant of delay to the EXTREME. Energy projects that serve data centers add further interface risk between utilities, EPC firms, specialty subcontractors, and permitting authorities. As complexity rises, owners prefer contractors with stronger financials and deeper experience. That has two market effects. First, stronger contractors may require larger single job limits and higher aggregate programs to support expanding backlogs. Second, weaker or newer contractors may face tighter underwriting, higher collateral requirements, or reduced limits. The result is an overall rise in capacity demand, paired with more selective capacity allocation.

The global market context suggests that surety remains a growth segment, but not in an evenly distributed way. Broker market commentary continues to characterize surety as expanding, while also noting that underwriting discipline and loss experience affect where capacity is deployed and at what price (Aon 2025). Trade association and international surety company executive sentiment similarly reflect growth expectations while acknowledging performance pressures that can influence underwriting posture (International Credit Insurance and Surety Association 2025). For 2026, the implication is that surety markets may have ample aggregate capacity, yet will experience localized tightening in contractor classes or regions most exposed to data center and power project clustering.

To give some memorable perspective without undermining my academic rigor here, I’ll offer a metaphor. The 2026 data center wave is like opening a chain of all-night diners for a neighborhood of professional athletes. The diners are the data centers, but the real scramble is securing the supply chain of groceries, kitchens, and delivery trucks that keep them fed. In construction terms, the “groceries” are megawatts, substations, and interconnections. When the diners multiply, the supply chain projects multiply too. Sureties can get REALLY busy REALLY quickly, because more parties insist on guarantees that dinner will be served perfectly to picky diners and on time.

My point is supported by the causal chain observed in public forecasts and market outlooks. Data center construction growth is increasing electricity demand. Rising electricity demand is pulling forward grid and generation investment. Those projects, in turn, typically involve large contracts, complex scopes, and schedule-critical delivery that increases the use of performance and payment bonds. The combined effect in 2026 means higher surety capacity demand and more consequential surety market dynamics, particularly around limits, aggregates, and underwriting selectivity. Data centers and the power appetite of those centers will affect surety companies. This is not merely another construction category to take lightly. They are a load-driven construction engine that brings its own power infrastructure ecosystem, and that ecosystem is precisely what is poised to pressure and expand surety markets in 2026.

~ C. Constantin Poindexter, MA, JD, CPCU, AFSB, ASLI, ARe, AINS, AIS

Bibliography

  • Aon. 2025. 2025 Global Construction Insurance and Surety Market Report. Aon.
  • Construction Dive. 2026. “5 Construction Trends to Watch in 2026.” Construction Dive. January 2026.
  • Federal Acquisition Regulation. 2026. “52.228 15 Performance and Payment Bonds Construction.” Acquisition.gov.
  • Hering, Garrett, and Susan Dlin. 2025. “Data Center Grid Power Demand to Rise 22% in 2025, Nearly Triple by 2030.” S&P Global Commodity Insights. October 14, 2025.
  • International Credit Insurance and Surety Association. 2025. “ICISA Publishes 2025 Business Sentiment Report.” ICISA. November 3, 2025.
  • JLL. 2025. 2026 Global Data Center Outlook. Jones Lang LaSalle. January 2026.
  • U.S. Department of Energy. 2024. “DOE Releases New Report Evaluating Increase in Electricity Demand from Data Centers.” U.S. Department of Energy. December 20, 2024.
  • U.S. Department of Transportation. 2025. “Infrastructure Investment and Jobs Act Funding Status as of September 30, 2025.” U.S. Department of Transportation.
  • U.S. Energy Information Administration. 2026a. “Short Term Energy Outlook January 2026.” U.S. EIA. January 2026.
  • U.S. Energy Information Administration. 2026b. “EIA Forecasts Strongest Four Year Growth in U.S. Electricity Demand Since 2000.” U.S. EIA Press Release. January 13, 2026.
  • United States. 2025. “40 U.S.C. § 3131 Bonds of Contractors of Public Buildings or Public Works.” United States Code.
Share this post:
Posted on

SIGNAL Secure for Intelligence Practitioners and will be for the Quantum Era

SIGNAL, intelligence, counterintelligence, spy, espionage, counterespionage, cyber security, C. Constantin Poindexter

Signal has earned its reputation in intelligence, counterintelligence, and investigative communities for a practical reason. I love it and you should too! The tool was engineered around adversarial assumptions that align with real-world asset targeting. Those assumptions include state-grade collection, cover and often illegal interception, endpoint compromise, credential theft, and long-term bulk retention for future exploitation. Signal is not conventional messaging with security added afterward. It is an integrated protocol suite for key agreement, per-message key evolution, and compromise recovery, supported by open specifications and sustained cryptographic hardening.

From an intelligence professional’s perspective, Signal is compelling because it is designed to remain resilient under partial failure. If an attacker wins a battle by capturing a key, briefly cloning a device, or recording traffic for years, Signal aims to prevent that single win from turning into durable, strategic access. This damage containment model aligns with counterintelligence priorities. Limit the blast radius, shorten adversary dwell time, and force repeated effort that increases the chance of detection.

The Double Ratchet and Per-Message Keys That Constrain Damage

At the core of Signal message confidentiality is the Double Ratchet algorithm, designed by Trevor Perrin and Moxie Marlinspike (Perrin and Marlinspike, 2025). Operationally, the Double Ratchet matters because it delivers properties that align with intelligence tradecraft realities.

Forward secrecy ensures that compromising a current key does not reveal prior message content. Adversaries routinely collect ciphertext in bulk and then hunt for a single point of decryption leverage later through device seizure, insider access, malware, or legal process. Forward secrecy frustrates that strategy by ensuring earlier captured traffic does not become a later intelligence windfall if a key is exposed at some later time (Perrin and Marlinspike, 2025).

Post-compromise security (“break-in recovery”) addresses a scenario intelligence practitioners plan for temporary device compromise. Border inspections, opportunistic theft, coercive access, or a short-lived implant can occur. The Double Ratchet includes periodic Diffie-Hellman updates that inject fresh entropy, while its symmetric ratchet derives new message keys continuously. Once the compromised window ends, later message keys become cryptographically unreachable to the attacker, provided the attacker is no longer persistently on the endpoint (Perrin and Marlinspike, 2025). This is not an exaggerated marketing claim. It is a disciplined key evolution that deprives the adversarial FIS and corporate spies of indefinite reuse of stolen key material.

Incident response logic has a new paradigm. A single brief compromise does not automatically mean permanent exposure of the entire history and future. Instead, the attacker must maintain persistence to retain visibility. That is a higher operational burden and a higher detection risk.

X3DH and PQXDH and the Move Against Harvest Now Decrypt Later

Signal historically used X3DH, Extended Triple Diffie-Hellman, for asynchronous session establishment. This is vital in mobile environments where recipients are often offline. X3DH uses long-term identity keys and signed prekeys for authentication while preserving forward secrecy and deniability properties (Marlinspike and Perrin, 2016). The strategic risk landscape shifted with the plausibility of cryptographically relevant quantum computing. The threat is not only future real-time decryption. It is harvest now/decrypt later. Bulk interception today is strategic, with the expectation that future breakthroughs, including quantum, could unlock stored traffic. Signal responded by introducing PQXDH, “Post Quantum Extended Diffie Hellman”, replacing the session setup with a hybrid construction that combines classical elliptic curve Diffie-Hellman using X25519 and a post quantum key encapsulation mechanism derived from CRYSTALS Kyber (Signal, 2024a). The operational implication is direct. An adversary would need to break both the classical and the post-quantum components to reconstruct the shared secret (Signal, 2024a).

Hybrid key establishment reflects conservative intelligence engineering. Migrate early, avoid sudden cutovers, and reduce reliance on a single new primitive. This also matters because the post-quantum component corresponds to what NIST standardized as ML KEM, derived from CRYSTALS Kyber, in FIPS 203 (NIST, 2024a; NIST, 2024b). NIST standardization does not guarantee invulnerability. It does increase confidence that the primitive has been scrutinized and is being adopted as a baseline for high assurance environments.

Signal also makes an important clarity point in its PQXDH materials. PQXDH provides post-quantum forward secrecy, while mutual authentication in the current revision remains anchored in classical assumptions (Signal, 2024b). Practitioners benefit from that precision because it defines exactly what is post-quantum today.

SPQR and Post Quantum Ratcheting for Long-Lived Operations

Session establishment is only one part of the lifecycle problem. A capable collector can record traffic for long periods. If quantum capabilities emerge later, the question becomes whether ongoing key evolution remains safe against future decryption. Signal’s introduction of the Sparse Post Quantum Ratchet, SPQR, directly addresses continuity by adding post-quantum resilience to the ratcheting mechanism itself (Signal, 2025).

SPQR extends the protocol so that not only the initial handshake but also later key updates gain quantum-resistant properties, while preserving forward secrecy and post-compromise security (Signal, 2025). For intelligence practitioners, this matters because long-lived operational relationships are common. Assets, handlers, investigative sources, and inter-team coordination can persist for months or years. A protocol that hardens only the handshake helps. A protocol that hardens ongoing rekeying is more aligned with the real adversary model of persistent collection.

Academic work has analyzed the evolution from X3DH to PQXDH in the context of Signal move toward post-quantum security and frames PQXDH as mitigation against harvest now decrypt later risk at scale (Katsumata et al., 2025). That framing fits intelligence risk management. Confidentiality is evaluated against patient, well-resourced adversaries.

Formal Analysis and Open Specifications and Why That Matters Operationally

Practitioners should be skeptical of security claims that cannot withstand external review. Signal protocol suite benefits from public specifications and sustained cryptographic scrutiny. A widely cited formal analysis models the protocol’s core security properties and examines its ratchet-based design in detail (Cohn Gordon et al., 2017). No protocol is proven secure against every real-world failure mode. Formal methods and peer-reviewed analysis reduce the chance that structural weaknesses remain hidden. Operationally, this supports reliability. When you rely on a tool for sensitive work, you evaluate whether the claims are testable, whether failure modes are documented, and whether improvements can be validated.

Metadata Constraints and Sealed Sender and the Role of Tradecraft

Message content confidentiality is only part of intelligence security. Metadata can be operationally decisive. Who communicates with whom, when, and how often can create damaging inferences. Signal Sealed Sender was designed to reduce sender information visible to the service during message delivery (Wired Staff, 2018). Research examines Sealed Sender and proposes improvements while discussing network-level metadata such as IP address exposure and the implications for anonymity tooling (Martiny et al., 2021). Additional academic work discusses traffic analysis risks that can persist in group settings even when sender identity is partially obscured (Brigham and Hopper, 2023).

The intelligence operator’s takeaway is that Signal materially improves content security and reduces certain metadata exposures. It does not eliminate the need for operational security measures. Depending on mission profile, those measures can include hardened endpoints, strict device handling, minimized identifier exposure, and network protections consistent with applicable law and policy.

Why Signal Trajectory Is Credible in the Quantum Transition

The Signal approach to the quantum transition reflects a credible engineering posture. Migrate early enough to blunt harvest now/decrypt later risk. Adopt hybrid designs to reduce reliance on one assumption. Extend post-quantum guarantees beyond the handshake into ongoing key evolution (Signal, 2024a; Signal, 2025). Alignment with NIST standardized direction for key establishment further supports long-term maintainability and ecosystem interoperability (NIST, 2024a; NIST, 2025). From an intelligence practitioner’s perspective, the central claim is not that Signal is unbreakable. The point is that Signal is engineered to constrain damage, recover after compromise, and anticipate strategic decryption threats. It is designed for a hostile environment that is moving toward post-quantum reality. I will state at the end here that Meta does not do any of this. FB messenger and WhatsApp leave gaping holes in cybersecurity as Meta’s focus is on monetization of the I.M. mechanism, not unbreakable coms. Use them at your own risk.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

Bibliography

  • Brigham, Eric, and Nicholas Hopper. 2023. “Poster: No Safety in Numbers: Traffic Analysis of Sealed Sender Groups in Signal.” arXiv preprint.
  • Cohn Gordon, Katriel, Cas Cremers, Benjamin Dowling, Luke Garratt, and Douglas Stebila. 2017. “A Formal Security Analysis of the Signal Messaging Protocol.” Proceedings of the IEEE European Symposium on Security and Privacy.
  • Katsumata, Shota, et al. 2025. “X3DH, PQXDH to Fully Post Quantum with Deniable Ring.” Proceedings of the USENIX Security Symposium.
  • Marlinspike, Moxie, and Trevor Perrin. 2016. “The X3DH Key Agreement Protocol.” Signal Protocol Specification.
  • National Institute of Standards and Technology. 2024a. “NIST Releases First 3 Finalized Post Quantum Encryption Standards.” NIST News Release.
  • National Institute of Standards and Technology. 2024b. FIPS 203. “Module Lattice Based Key Encapsulation Mechanism Standard, ML KEM.” U.S. Department of Commerce.
  • National Institute of Standards and Technology. 2025. “Post Quantum Cryptography Standardization.” NIST Computer Security Resource Center.
  • Perrin, Trevor, and Moxie Marlinspike. 2025. “The Double Ratchet Algorithm.” Signal Protocol Specification.
  • Signal. 2024a. “Quantum Resistance and the Signal Protocol.” Signal Blog.
  • Signal. 2024b. “The PQXDH Key Agreement Protocol.” Signal Protocol Specification.
  • Signal. 2025. “Signal Protocol and Post Quantum Ratchets, SPQR.” Signal Blog.
  • Wired Staff. 2018. “Signal Has a Clever New Way to Shield Your Identity.” Wired Magazine.
Share this post: