Tag: counterespionage

Posted on

The Strategic Importance of the INR: Safeguarding U.S. National Security through Diplomatically Anchored Intelligence

intelligence, counterintelligence, espionage, counterespionage, spy, c. constantin poindexte

The U.S. Department of State’s Bureau of Intelligence and Research (INR) is a critical but underestimated pillar of the U.S. Intelligence Community (IC). Established in 1947 and tracing its roots to the Office of Strategic Services (OSS) Research and Analysis Branch, the INR operates with a unique mandate: fusing diplomatic insight with rigorous intelligence analysis. Unique among I.C. member agencies, it exists specifically to inform U.S. foreign policy decisions. Despite its modest budget and staff (+/-300 personnel and less than one percent of the total IC budget), the INR’s record of analytic precision, geopolitical foresight, and principled speak-truth-to-power character has earned it a reputation as one of the most accurate and seasoned voices in national intelligence. Recent defunding directives from the current presidential administration threaten to undermine this vital function, risking a blind spot in diplomatic intelligence and foreign affairs policymaking.

The Unique Role of the INR in the U.S. Intelligence Community

The INR’s primary mission is to provide all-source intelligence analysis to the Secretary of State and other senior policymakers. Unlike larger IC agencies such as the CIA or NSA, the INR does not generally collect raw intelligence through clandestine operations or technical means. Instead, it synthesizes open-source material, diplomatic cables, intelligence reporting, and foreign liaison inputs to produce independent assessments grounded in a global diplomatic context (ODNI, 2023). This structural independence grants INR the ability to offer dissenting views when other agencies fall victim to inherent biases and groupthink. A prominent example is its refusal to endorse the 2002 National Intelligence Estimate (NIE) on Iraqi weapons of mass destruction. The INR dissented from the IC consensus, concluding that there was insufficient evidence that Saddam Hussein was reconstituting a nuclear program (National Intelligence Council, NIE 2002-16HC, “Iraq’s Continuing Programs for Weapons of Mass Destruction,” Oct. 2002, INR). History has vindicated the INR’s position, reinforcing the critical need for its unbiased, evidence-based approach to intelligence.

Case Studies: Intelligence and Counterintelligence Victories Attributed to INR

Iraq WMD Dissent (2002–2003)

INR’s refusal to support claims of an active Iraqi nuclear weapons program is perhaps its most famous act of analytic integrity. Despite intense interagency pressure, INR analysts resisted politicization and flagged the aluminum tubes cited by other agencies as likely intended for conventional rockets, NOT nuclear centrifuge use. This dissent was formalized in the 2002 NIE, which noted:

“The Department of State’s Bureau of Intelligence and Research (INR) judges that the available evidence does not add up to a compelling case that Iraq is currently pursuing an integrated and comprehensive program for a nuclear weapon.”
— NIE 2002-16HC (Oct. 2002), p. 8, Declassified.

This dissent not only preserved U.S. diplomatic credibility in the long term but also highlighted the dangers of overreliance on uncertain technical intelligence divorced from geopolitical context and reliance on sole, unreliable assets (i.e., “Curveball”, subject to a burn notice).

Russian Interference in the 2016 U.S. Election

In the January 2017 Intelligence Community Assessment (ICA), INR was a co-author alongside the CIA, NSA, and FBI. INR fully endorsed the judgment that Russia interfered in the 2016 presidential election with the intent of helping then-candidate Donald J. Trump. Unlike the NSA’s “moderate confidence,” INR expressed “high confidence” in the assessment (ODNI ICA 2017-01D, “Assessing Russian Activities and Intentions in Recent U.S. Elections,” Jan. 6, 2017). The INR’s contribution was key to bolstering the legitimacy of the ICA amid partisan scrutiny.

Warning of the Potential for Genocide in Rwanda (1994)

Though often overlooked, the INR produced early assessments indicating the risk of mass violence in Rwanda before the April 1994 genocide. These assessments were among the few within the IC to link escalating interethnic tensions and the collapse of the Arusha Accords to the potential for mass atrocities. A State Department cable dated April 1, 1994, warned of “a planned campaign of violence” by Hutu extremists The INR analysist that authored the report was tragically ignored at the policy level (State Cable 094659, April 1, 1994, Declassified under FOIA).

Budgetary Threats: Undermining a Critical Node in Strategic Intelligence

The FY2025 presidential budget request proposes a 17% reduction in the INR’s operational funding cutting approximately $15 million from its analytic programs, staff training, and diplomatic intelligence integration efforts (Congressional Budget Justification, Department of State, FY2025, pp. 112–114). Case in point, a report (07/21/2025) from “an official inside the State Department’s Bureau of Intelligence and Research (INR) stated that two offices have been eliminated, one focused on education, and the other responsible for intelligence sharing with foreign governments.” (Homeland Security Today) While such cuts may appear numerically small, they pose a disproportionate risk to the IC’s analytical diversity and strategic foresight. INR operates with a compact, specialized cadre of analysts who often possess region-specific language and cultural proficiency, and decades of diplomatic experience. This sort of expertise cannot be rapidly regenerated once shown the door.

INR’s function in supporting U.S. embassies with intelligence briefings and diplomatic threat assessments will be dangerously constrained. As the IC continues to emphasize cyber threats, great power competition, and non-state actors, the INR remains the only agency that fully integrates foreign policy objectives into intelligence production.

The proposed cuts also jeopardize INR’s role in managing the Humanitarian Information Unit (HIU), which provides critical geospatial intelligence for conflict zones and disaster response. Budget constraints will degrade the HIU’s ability to deploy timely, unclassified intelligence products for decision-makers and humanitarian actors, especially in regions like Sudan, Haiti, and Gaza.

Summation

The Bureau of Intelligence and Research remains indispensable to informing sound U.S. foreign policy and the broader mission of the Intelligence Community. Its record of analytical excellence, principled dissent, and regional expertise often exceeds in breadth and depth other I.C. members. INR’s contribution is thus unmatched. From warning against skewed WMD claims to identifying hostile FIS influence operations, INR has proven that size does not equate to strategic punch. Its diplomatic intelligence orientation allows it to view global events through a lens of nuance often missing from those agencies focused on technical collection and limited asset HUMINT. To weaken the INR through budgetary attrition is to court strategic blindness. Especially in an era marked by global realignment, hybrid warfare, and renewed great-power rivalry, the INR’s voice must be amplified, not silenced. Any degradation of its capability represents not only a loss to the Department of State but a dangerous diminution of America’s strategic planning capacity.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

References

Director of National Intelligence (ODNI). (2023). United States Intelligence Community Budget Overview. https://www.dni.gov

National Intelligence Council. (2002). National Intelligence Estimate 2002-16HC, “Iraq’s Continuing Programs for Weapons of Mass Destruction” (Declassified). https://www.dni.gov/files/documents/Newsroom/Reports%20and%20Pubs/2002_NIE_WMD.pdf

ODNI. (2017). ICA 2017-01D: Assessing Russian Activities and Intentions in Recent U.S. Elections (Declassified). https://www.dni.gov/files/documents/ICA_2017_01.pdf

Department of State. (1994). Cable 094659 from U.S. Embassy Kigali, April 1, 1994 (Declassified under FOIA).

U.S. Department of State. (2024). Congressional Budget Justification, Department of State, FY2025. https://www.state.gov/reports/fy-2025-congressional-budget-justification

Posted on

CIA Tradecraft Review: Did Russian FIS Interfere in the 2016 Election?

russia, russian foreign intelligence, intelligence, counterintelligence, espionage, counterespionage, subversion

The U.S. Intelligence Community Assessment (ICA) of January 6, 2017, titled “Assessing Russian Activities and Intentions in Recent US Elections,” has been released. As anticipated, it has caused fierce controversy, largely along partisan lines. The report concluded with high confidence that Russian President Vladimir Putin ordered an influence campaign aimed at the 2016 U.S. presidential election, with the explicit intent to damage Hillary Clinton’s chances and to help elect Donald J. Trump. Subsequent reviews, including the 2025 CIA Directorate of Analysis (DA) tradecraft report, have scrutinized certain aspects of the ICA’s internal work, there is no credible evidence that refutes the fundamental claim that Russian intelligence services interfered. A comprehensive review of official U.S. government investigations, independent reports, and declassified materials affirms the legitimacy of the ICA’s core finding.

I am basing this analysis on the publicly-facing document which contains some significant ‘black-out’ redactions. Those redactions do not invalidate the core of the assessment and there are good justifications for their exclusion.

What is ‘Blacked-Out’

Specific positions of CIA, FBI, and NSA personnel who contributed to the ICA or participated in internal I.C. debate have been extracted. These individuals were not publicly known figures like Director Brennan or DNI Clapper, and therefore their identities remain protected for operational security. The redactions include analytic line officers, mission center managers, and mid-level coordinators whose participation would be readily identifiable by job title or context. Protecting these names aligns with intelligence S.O.P., especially for personnel involved in sensitive political assessments.

A central redaction concerns the highly classified CIA serialized report that underpinned the ICA’s “aspired” judgment about Putin’s preference for Trump. The specific contents of this report remain classified. This is due to its likely origin from a uniquely sensitive HUMINT source or technical collection platform. The Tradecraft Review indicates that this report was narrowly held, and not serialized until December 2016, suggesting it contains material that would compromise collection methods or expose a clandestine asset if disclosed. Some sections reference analytic decisions to include or omit parts of intelligence reporting. Direct quotes or paraphrased summaries of raw intelligence that suggested alternative interpretations of Putin’s intent are logically excluded. These redactions reflect legitimate tradecraft deliberation but also contain operationally sensitive material not appropriate for public release, including specific source citations or field report language.

Portions discussing Brennan’s creation of a special Fusion Cell and the restricted access to intelligence materials omit codewords and program names related to special compartments. These would include the names of CIA internal groups or clearance levels, operational terms for sensitive works, and the identities of officers working within those projects. These redactions preserve the integrity of compartmented information management protocols and protect methodologies that may still be in use.

I firmly believe that complementary reporting was received from liaison FISs/FIEs. Redacted content in this context likely conceals the nationality, origin, or method of foreign partner contributions. Revealing such details would violate long-standing “third party rule” agreements and jeopardize future collaboration with allied intelligence services.

The Meat of the Matter

The declassified version of the ICA concluded that Russia’s goals were to “undermine public faith in the U.S. democratic process, denigrate Secretary Clinton, and harm her electability and potential presidency,” and further, that “Putin and the Russian Government developed a clear preference for President-elect Trump” (ODNI, 2017). These findings were endorsed with “high confidence” by the CIA, FBI, and NSA (the latter assigning “moderate confidence”) to the judgment about Putin’s aspiration to help Trump. The ICA was the result of a coordinated effort by three key intelligence agencies and was supported by substantial intelligence reporting, including cyber forensics, human intelligence (HUMINT), and intercepted communications (SIGINT). It was not, as some media narratives have suggested, based solely on the controversial Steele Dossier, which was not used to support any key analytic judgments but was included only as an annex.

The Mueller Investigation and DOJ Indictments

Special Counsel Robert Mueller’s investigation into Russian interference produced robust corroboration of the ICA’s central conclusions. The Mueller Report, released in 2019, found, “The Russian government interfered in the 2016 presidential election in sweeping and systematic fashion” (Mueller Report, Vol. I, p. 1).” Two major components of this interference were outlined:

The Internet Research Agency (IRA): A Russian troll farm that used fake social media accounts to promote pro-Trump and anti-Clinton narratives, targeting U.S. voters with disinformation, racial division, and conspiracy theories.

Russian Military Intelligence (GRU) Operations: The GRU conducted cyber intrusions into the Democratic National Committee (DNC), the Democratic Congressional Campaign Committee (DCCC), and Clinton campaign chairman John Podesta, stealing tens of thousands of emails and documents, which were strategically leaked via Wikileaks.

Twelve GRU officers were indicted by the Department of Justice in July 2018 for these operations (DOJ Indictment, 2018), establishing the direct role of Russian military intelligence in hacking and disseminating stolen data for political impact. The indictment’s forensic details, including the specific units and servers used, leave no room for ambiguity as to the perpetrators or their intentions.

Bipartisan Senate Intelligence Committee Report

The U.S. Senate Select Committee on Intelligence conducted a multi-volume, bipartisan investigation into Russian interference, culminating in a 966-page final report in August 2020. The committee validated the ICA’s primary conclusions, “The Committee found that the ICA presents a coherent and well-constructed intelligence basis for the assessment that Putin and the Russian government aspired to help President-elect Trump’s election chances” (SSCI, Volume 5, p. 6). The committee reported that the ICA was not politically driven, that dissenting views were aired, and that the analytic tradecraft was sound despite the rushed timeline. It also noted that the Russian government viewed a Trump presidency as favorable to Moscow’s interests, particularly due to Trump’s stated skepticism toward NATO and the transatlantic alliance.

Russian Messaging and Disinformation Strategy

Open-source analysis of Russian disinformation also supports the conclusion that Trump was the preferred candidate. The Hamilton 68 dashboard, maintained by the Alliance for Securing Democracy, tracked pro-Kremlin Twitter activity and documented a clear slant toward Trump, along with the propagation of hashtags and narratives attacking Clinton and promoting voter distrust.

Russian state media such as RT and Sputnik displayed markedly pro-Trump coverage and actively spread conspiracy theories about Clinton’s health, corruption, and the DNC emails (Brookings Institution, 2017). The timing and content of Wikileaks dumps were strategically synchronized with key moments in the election to maximize damage to Clinton, such as the release of Podesta’s emails hours after the Access Hollywood tape was revealed.

Intelligence Community Reassessment in 2025

The 2025 CIA Tradecraft Review, while critical of procedural anomalies, did not retract or invalidate the ICA’s conclusions. Instead, it affirmed that the “aspired” judgment, that Putin wanted Trump to win, was plausible and supported by credible evidence. However, it argued that the “high confidence” level should have been “moderate confidence” due to the reliance on a single highly classified report (Tradecraft Review, 2025, p. 6).

Even this critique, however, explicitly stated, “The DA Review does not dispute the quality and credibility of the highly classified CIA serialized report… The ICA authors’ interpretation of its meaning was most consistent with the raw intelligence” So, while advocating for stricter tradecraft standards and a more cautious confidence level assignment, the report reaffirmed that the core intelligence judgments remained defensible and well-founded.

No U.S. government entity, CIA, NSA, ODNI, or the Department of Justice, has issued a formal repudiation of the ICA’s 2017 findings. While internal reviews have called for greater transparency and adherence to tradecraft standards, no post hoc analysis has offered an alternative judgment asserting that Russia was neutral or preferred Clinton over Trump. In fact, public statements by senior Trump-era officials confirm the ICA’s findings. Former Director of National Intelligence Dan Coats, for instance, stated in 2018, “The Russians are still trying to influence our elections. The warning lights are blinking red again. It was Russia’s intent to interfere, and it was clearly to hurt Hillary Clinton and help Donald Trump” (DNI Coats, Aspen Security Forum, 2018).

In Summary

The claim that Russian FIS interfered in the 2016 U.S. presidential election is substantiated by a broad and consistent body of evidence from multiple independent, bipartisan, and interagency investigations. The ICA, the Mueller Report, the DOJ indictments, and the Senate Intelligence Committee’s findings converge to form a coherent narrative: that the Russian government engaged in an expansive campaign to damage Hillary Clinton and to bolster Trump’s candidacy. Attempts to discredit this conclusion relying on political framing or selective interpretation of later reviews do not withstand the weight of forensic, testimonial, and documentary evidence. While internal CIA reviews have rightly scrutinized tradecraft and process, they do not reverse the analytical consensus that Russia interfered, and did so in a manner aligned with Moscow’s preference for Trump.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

References

Office of the Director of National Intelligence (ODNI). (2017). Assessing Russian Activities and Intentions in Recent US Elections. https://www.dni.gov/files/documents/ICA_2017_01.pdf

Mueller, R. S. (2019). Report on the Investigation into Russian Interference in the 2016 Presidential Election. https://www.justice.gov/storage/report.pdf

Department of Justice. (2018). Indictment of Russian GRU Officers for DNC Hack. https://www.justice.gov/file/1080281/download

U.S. Senate Select Committee on Intelligence. (2020). Report on Russian Active Measures Campaigns and Interference in the 2016 U.S. Election, Volume 5. https://www.intelligence.senate.gov/sites/default/files/documents/report_volume5.pdf

CIA Directorate of Analysis. (2025). Tradecraft Review of the 2016 Intelligence Community Assessment on Russian Election Interference.

Brookings Institution. (2017). The Kremlin’s Strategy: Pro-Trump Coverage and Disinformation. https://www.brookings.edu/articles/how-russian-state-media-views-the-2016-election/

Coats, D. (2018). Remarks at Aspen Security Forum. https://www.c-span.org/video/?448718-1/dan-coats-says-warning-lights-blinking-red-russian-cyberattacks

Posted on

Grief and the HUMINT Operator, the Personal Toll of Covert Intelligence Operations

HUMINT, intellgence, counterintelligence, espionage, counterespionage, c. constantin poindexter;

It’s not all James Bond and Jason Bourne. The good guy doesn’t always win in the end. Covert work, more specifically covert human intelligence (HUMINT) operations are the most psychologically and morally demanding forms of spying. OSINT and keyboard collectors don’t feel the grief of an intelligence officer in the field. Case officers recruit, develop, handle, and ostensibly protect their agents (“sources” or “assets”), instructing them in appropriate tradecraft to steal secrets and avoid getting caught. These activities are routinely conducted in denied areas. When these agents operate these hostile environments, the stakes are life or death. Discovery often means that the asset will be tortured, executed, and their families persecuted or likewise killed. As seasons of service pass, it is almost inevitable that some agents will be compromised and lost. The emotional burden on the officer responsible for their survival is profound, marked by grief, guilt, and an enduring sense of moral failure.

The humanitarian bond and psychological investment

The key to success as a case officer is the cultivation of a very personal relationship, deep personal rapport with his or her source. A true friendship rooted in trust, empathy, and shared purpose is imperative. A psychological study on intelligence elicitation revealed that non-coercive strategies coupled with rapport-building yield richer and more accurate information acquisition, underscoring how vital emotional connection is to both efficacy and trust. These very human bonds mean that officers break bread, confide in, and take proactive steps to protect their agents. The resulting interpersonal ties transcend formal professional promises. This emotional investment means that when an agent is caught, disappeared, tortured, killed, or all of the above, the officer experiences not just operational failure, but also a deep personal loss. They bear responsibility for agent safety so when the wheels come off, the intelligence officer invariably suffers from a sense of personal culpability. Survivor guilt among those who ‘live through’ while others perish is well documented in trauma psychology.

Survivor guilt and moral injury

Survivor guilt refers to the distress and self-loathing felt by individuals who outlive someone else when they played a role in the other’s fate. In HUMINT, officers feel they failed agents that they recruited, agents who trusted them implicitly. This places officers at risk for moral injury, a condition in which one’s actions or inactions violate their own moral code. The loss of an agent can trigger intense guilt. “I could’ve done more,” “I should’ve seen the compromise,” or “I didn’t protect them like a parent protects a child.”, are common recurring emotional punishments. A recent article on traumatic loss highlights how survivor guilt can evolve into chronic shame and self-destructive rumination unless addressed . This phenomenon aligns closely with what seasoned intelligence officers share in post-action debriefs, i.e., guilt compounded by the clandestine nature of their relationship with agents where that guilt must remain hidden behind professional composure and confidentiality oaths.

Grief within the cloak of secrecy

Unlike traditional warfighter loss, agent deaths or arrests rarely receive acknowledgment nor are honored publicly. There’s no funeral, no rope-dropping anniversary ceremonies, no celebration of life nor what the source contributed. The clandestine world awards no medals for agents who vanish. Intelligence officers grieve in silence and isolation with few official outlets, little acknowledgment, and often no practical nor legal avenue to care for a source’s family. Psychology literature highlights that complicated grief, grief unspoken and unacknowledged driver to depression, PTSD, and physical illness. In clandestine HUMINT, agents operate for years within strict tradecraft boundaries. Case officers managing or sole agents develop significant moral and emotional ties to them. Losing an agent isn’t just a tactical failure within the intelligence agency’s collection strategies. It is the death of someone known intimately and often their families.

The moral complexities of manipulation and betrayal

HUMINT work inherently involves manipulation, the cultivation and direction of individuals that betray their countries. There is no pretty way to describe it. We teach assets to lie, steal, and live dangerous double lives. Covert operators must deploy emotional leverage, sometimes deception, frequently bribery, “ . . . to ensure loyalty and compliance”. As reported in ‘Intelligence & National Security’, manipulation is part of the deal but when influence crosses into coercion or deception, moral dilemmas arise. When an agent is lost, the officer may and often does ask him or herself, “Did I manipulate them into this disaster? Did I betray my own moral code by pushing them into extreme danger?” Psychological research warns that psychological manipulation “targets unconscious, intuitive, or emotional modes of thought… violating autonomy, freedom and dignity”.

Training v. operational seasoning

Formal HUMINT training emphasizes tradecraft, security, and risk/reward management. Intelligence officers learn strict protocols around recruitment, handling, and termination of agents. Real-world operations in hostile environments introduce chaotic variables. Even the most seasoned officer cannot foresee novel counterintelligence techniques, surveillance technology, or unexpected betrayals by intermediaries or an insider threat. As one analysis notes, seasoned double- or triple-agent running reduces an officer’s control. The very experience that can make an officer a great handler can become a liability, undermining his or her ability to predict perils to the asset and operation, increasing their feelings of personal responsibility when things go wrong.

Organizational culture and aftercare

Intelligence services are bad at normalizing and institutionalizing grief processing for covert HUMINT operators. Agencies debrief performance and analyze operational failures, but do a piss-poor job at addressing the emotional consequences. There is a stigma associated with grief, and moral stress in environments that emphasize resilience and secrecy. In some Western countries, covert-source legislation acknowledges that agents and handlers engage in crimes to maintain cover and accomplish operations. Despite this, emotional and moral support for the officers who manage such morally complex situations remains painfully limited. Without interventions such as peer support groups, secret welfare services, or external counseling, intelligence officers risk burnout, emotional numbing, and PTSD.

The ripple effect on agents’ families

When an agent is compromised, repercussions often extend to their families, FIS (FIEs) frequently use assets’ families for leverage. They are targeted as co-conspirators, persecuted and attacked extrajudicially. Officers can manage systems to smuggle a family to safety or allow them to assume new identities but they are not as successful as we would like to assume. When agents die, officers feel they have failed an entire family. Culturally, agents’ loyalty often arises from protecting their families. Losing an agent can thus symbolize failure to protect a family entirely dependent on smart decisions by that operative and his or her handler.

Ethics and accountability

Scholars like Stephan Lau argue that intelligence agencies need pragmatic frameworks to distinguish legitimate influence from harmful manipulation in HUMINT operations. Such models assist case officers in making decisions grounded in ethical clarity rather than moral ambiguity. Institutionalized ethical guidance and accountability structures can both reduce morally damaging decision-making and help handlers process loss after operations fail. Albeit not a panacea, ethical oversight on recruitment, coercion thresholds, and risk assessment can lessen post-hoc guilt and defend against corrosive shame.

Operating at the intersection of psychology, ethics, and national security, HUMINT case officers experience pressures unique to clandestine work. They recruit and manage individuals willing to risk their lives and those of their families for a foreign intelligence entity’s objectives. The loss of such agents in hostile environments imposes profound emotional and moral wounds. Survivor guilt, grief, and rumination on perceived ethical failures are the inevitable result. Individual case officer well-being and institutional resilience is possible. By building ethical guidance, grief acknowledgment processes, peer support structures, and mental health interventions tailored to clandestine realities, HUMINT organizations can care for their own and honor the sacrifices of their assets. In so doing, they protect not just robust operational effectiveness, but the humanity of the professional officers who serve in the shadows.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

References

Goodman Delahunty, J., O’Brien, K., & Gumbert-Jourjon, T. (2014). Reframing intelligence interviews: Rapport and elicitation. Journal of Investigative Psychology and Offender Profiling, 11(2), 178–192.

Lau, S. (2022). The Good, the Bad, and the Tradecraft: HUMINT and the Ethics of Psychological Manipulation. Intelligence and National Security, 37(6), 895–913.

Neria, Y., Nandi, A., & Galea, S. (2008). Post-traumatic stress disorder following disasters: a systematic review. Psychological Medicine, 38(4), 467–480.

Robinaugh, D. J., LeBlanc, N. J., Vuletich, H. A., & McNally, R. J. (2014). The role of grief-related beliefs in complicated grief: A structural equation model. Behavior Therapy, 45(3), 362–372.

Feeney, B. C., & Collins, N. L. (2015). A new look at social support: A theoretical perspective on thriving through relationships. Personality and Social Psychology Review, 19(2), 113–147.

Herman, J. L. (1992). Trauma and Recovery: The Aftermath of Violence—from Domestic Abuse to Political Terror. Basic Books.

Jones, S. G. (2014). Covert Action and Counterintelligence in the Cold War and Beyond. RAND Corporation.

UK Parliament. (2019–2021). Briefing Paper: Covert Human Intelligence Sources (Criminal Conduct) Act.

Shane, S. (2015). Objective Troy: A Terrorist, a President, and the Rise of the Drone. Tim Duggan Books.

Zegart, A. (2007). Spying Blind: The CIA, the FBI, and the Origins of 9/11. Princeton University Press.

Posted on

Defense Intelligence Agency 2025 Threat Assessment, a Brief Review

seguridad nacional, DNI, CNI, espionaje, contraespionaje, inteligencia, contrainteligencia, espia, C. Constantin Poindexter

The 2025 Defense Intelligence Agency (DIA) Worldwide Threat Assessment offers a reasonable thorough overview of global security challenges. There are however certain emerging threats either underrepresented or omitted entirely. I am going to offer a few of my concerns and my thoughts on the implications of the same for U.S. national security. This is not a classified assessment but rather some informed opinion and analysis grounded in open-source intelligence and expert views.

Insider Threats and Human Intelligence Vulnerabilities

The DIA report emphasizes external adversaries, It notably underplays the risks posed by insider threats. A recent incident within the very agency that has provided the 2025 report, underscores this vulnerability. Nathan Vilas Laatsch, is a 28-year-old IT specialist formerly employed by the Defense Intelligence Agency (DIA). Laatsch was arrested on May 29, 2025, for attempting to transmit national defense information to a German government representative. He worked within the DIA’s Insider Threat Division and held a top-secret security clearance. The arrest followed an FBI investigation initiated after a tip-off in March 2025, leading to a sting operation where an undercover agent posed as a foreign official. This breach highlights counterintelligence deficiencies, internal security protocols and the challenges of detecting moles and/or other malicious insiders. Advanced behavioral analytics and machine learning models, such as deep evidential clustering are offering promise in identifying anomalous activities indicative of insider threats. Unfortunately, the integration of such technologies across intelligence community member agencies remains dangerously inconsistent. Addressing this gap requires not only technological adoption but also a cultural shift to robust and proactive internal threat detection.

Artificial Intelligence (AI) and Autonomous Systems as Emerging Threats

The rapid advancement of AI and autonomous systems presents both opportunities and perils. The DIA report acknowledges technological proliferation, however, it lacks a focused analysis of the misuse of AI in cyber warfare, autonomous weaponry, and information manipulation. Recent scholarly work proposes the establishment of an AI incident regime to monitor and counteract threats posed by advanced AI systems. Among recent peer-reviewed material is an excellent piece by Alejandro Ortega. “We put forward a proposal for an AI incident regime that will help to counter threats to national security posed by AI systems, . . . Our ambition is to enable a government agency to maintain comprehensive awareness of AI threats and rapidly counter any resulting risks to national security.” (Ortega, 2025) Frameworks such as that offered by Ortega aim to ensure that AI deployments do not inadvertently compromise national security, and suggest countermeasures that can effectively mitigate identified risks. Given the dual-use nature of AI technologies, there is an urgent need for comprehensive policies that address both their development and potential weaponization.

Unidentified Aerial Phenomena (UAPs) and Aerospace Security

Unidentified Aerial Phenomena (UAPs) have garnered increasing attention due to their potential implications for national security. The DIA report does not address this issue at all. A 2021 assessment by the Office of the Director of National Intelligence highlighted 144 UAP incidents, with 143 remaining unexplained. These occurrences, often near sensitive military installations, raise concerns about airspace sovereignty and surveillance vulnerabilities. The absence of a clear understanding of UAPs hampers the development of effective countermeasures. Integrating UAP analysis into broader threat assessments is essential to ensure comprehensive aerospace security. I am not suggesting that the I.C. should engage in a hunt for UFOs, as the UAPs are more likely collection mechanisms deployed by adversarial FIS, however, leaving the subject matter entirely unaddressed is questionable.

Space-Based Threats and Counterspace Capabilities

The DIA report addresses space and counter-space capabilities. It does NOT offer the breadth nor depth of analysis and informed opinion into the evolving threats in this domain that I expected. This omission is surprising, considering its direct import to the DIA’s most important customers. The Center for Strategic and International Studies’ 2025 Space Threat Assessment details the growing counter-space capabilities of nations like China and Russia, including anti-satellite weapons and electronic warfare tactics. The militarization of space poses GRAVE risks to satellite communications, navigation systems, and surveillance operations. It also endangers the antiquated GPS architecture on which global trade and national security agencies rely. Ensuring the resilience of space-based assets requires not only technological advancement but also international norms and agreements to prevent escalations in this new frontier.

The 2025 DIA Worldwide Threat Assessment provides valuable insights into current global security challenges, however, the omission or underrepresentation of insider threats, AI and autonomous systems, UAPs, and comprehensive space-based threats indicates areas requiring thorough attention. Addressing these gaps is crucial for a holistic understanding of the evolving threat landscape and for formulating effective countermeasures to safeguard national security.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

References

Department of Justice. “U.S. Government Employee Arrested for Attempting to Provide Classified Information to Foreign Government.” U.S. Department of Justice, May 29, 2025.
https://www.justice.gov/opa/pr/us-government-employee-arrested-attempting-provide-classified-information-foreign-government.

Nakashima, Ellen, and Devlin Barrett. “Pentagon Intelligence Employee Accused of Leaking Secrets to a Foreign Nation.” The Washington Post, May 30, 2025.
https://www.washingtonpost.com/dc-md-va/2025/05/30/dod-classified-document-leak/.

Tucker, Eric. “Justice Department Says Pentagon Employee Tried to Give Classified Info to Foreign Government.” Associated Press, May 30, 2025.
https://apnews.com/article/e60388df7f4e07a8d8d942d86513b27c.

Ortega, Alejandro. “A Proposal for an Incident Regime That Tracks and Counters Threats to National Security Posed by AI Systems.” arXiv preprint, March 29, 2025.
https://arxiv.org/abs/2503.19887.

Defense Intelligence Agency. Statement for the Record: Worldwide Threat Assessment. Submitted to the Senate Armed Services Committee, March 2025.
https://armedservices.house.gov/uploadedfiles/2025_dia_statement_for_the_record.pdf.

Center for Strategic and International Studies (CSIS). Space Threat Assessment 2025. Washington, DC: CSIS, 2025. https://www.csis.org/analysis/space-threat-assessment-2025.

Office of the Director of National Intelligence (ODNI). Preliminary Assessment: Unidentified Aerial Phenomena. Washington, DC: ODNI, June 25, 2021. https://www.dni.gov/files/ODNI/documents/assessments/Preliminary-Assessment-UAP-20210625.pdf.

Posted on

Chinese Strategic SIGINT in Cuba: Implications for U.S. National Security

Bejucal, inteligencia china, inteligencia, contrainteligencia, espionaje, contraespionaje, CNI, SIGINT, c. constantin poindexter

Signals Intelligence (SIGINT) is a cornerstone of modern intelligence operations, encompassing the interception and analysis of electronic communications and emissions. SIGINT has in fact become the primary “INT” for the collection of highly sensitive information by all of the major powers that engage in global espionage. As geopolitical tensions escalate between the United States and the People’s Republic of China (PRC) and PRC allies, the strategic deployment of SIGINT assets has become a grave peril to U.S. national security. China has established multiple SIGINT facilities in Cuba, raising concerns about the potential threats to the United States and indeed its allies.

The Importance of Signals Intelligence (SIGINT)

SIGINT involves the collection and analysis of electronic signals to gather intelligence on foreign entities. It is divided into Communications Intelligence (COMINT), focusing on intercepted communications, and Electronic Intelligence (ELINT), which pertains to electronic emissions from devices such as radars. SIGINT provides critical insights into adversaries’ capabilities, intentions, and activities, supporting decision-making at strategic, operational and tactical levels. It enables the monitoring of military movements, the detection of threats, and the protection of national interests.

China’s Proficiency in SIGINT Operations

China has developed extensive SIGINT capabilities, positioning itself as a formidable player in this particular intelligence discipline. The PRC operates numerous ground-based SIGINT stations across its territory, including significant facilities on Hainan Island deployed to monitor U.S. naval activities in the South China Sea. Additionally, China has invested in spaceborne ELINT systems mounted on satellites, enhancing its global surveillance reach. Clearly, China’s SIGINT operations are not confined to its borders. The PRC has established overseas facilities and deployed collection vessels to monitor foreign military operations. These efforts are part of a broader strategy to expand China’s intelligence-gathering capabilities and assert its global influence.

Chinese SIGINT Facilities in Cuba: Threat Surface and Geographic Reach

The establishment of Chinese SIGINT facilities in Cuba represents a strategic move to enhance surveillance capabilities in proximity to the United States. Reports suggest that China operates multiple SIGINT sites on the island, including facilities in Bejucal, Santiago de Cuba, and Paseo. These installations are equipped with advanced technologies, such as Circularly Disposed Antenna Arrays (CDAAs), capable of intercepting signals over vast distances. The Bejucal site, for instance, can reportedly monitor radio signals from 3,000 to 8,000 miles away, encompassing key U.S. military installations and even Washington, D.C. The geographic proximity of these facilities to the U.S. mainland allows for the potential interception of sensitive communications, posing significant risks. The ability to monitor U.S. military movements, disrupt critical communications, and gather intelligence on defense operations underscores the strategic value of these Cuban installations to China’s intelligence apparatus. The installations also pose a grave threat to U.S. intelligence and defense allies throughout the Caribbean and Latin America.

U.S. Counterintelligence Measures to Thwart Foreign SIGINT Threats

In response to the growing threat posed by foreign SIGINT operations, the United States has implemented a comprehensive counterintelligence strategy. The National Counterintelligence and Security Center (NCSC) leads efforts to identify, deceive, exploit, disrupt, and protect against espionage activities conducted by foreign powers. Adequate countermeasures may significantly neutralize the threats posed by Chinese FIS SIGINT activities and reduce perils to the integrity of U.S. intelligence and defense operations, to wit;

Enhanced Surveillance and Monitoring

The United States employs an integrated suite of ground-based, airborne, maritime, and space-based systems to detect and track hostile intelligence collection efforts, including SIGINT platforms positioned near U.S. territory. Ground-based monitoring stations operated by the NSA and partner agencies use highly sensitive direction-finding systems and frequency analysis to identify anomalous electromagnetic emissions, often correlating these signals with known adversary signatures cataloged in classified ELINT databases. Aerial and UAV platforms equipped with hyperspectral and electronic surveillance payloads patrol maritime peripheries, particularly in the Gulf of Mexico and Caribbean airspace.

Department of Defense programs such as those operated via Special Access Programs (SAPs) mechanism enable geo-location of foreign collection antennas and triangulation of suspected listening posts. Tasking of National Technical Means (NTMs), including SIGINT satellites (e.g., the Advanced Orion/Trumpet series), is adjusted in response to emerging threats. Further, electromagnetic deception operations (EMDEPs) that broadcast decoy signals can saturate and/or confuse Chinese FIE collectors operating from proximate offshore platforms or Cuban bases.

Cybersecurity Initiatives

U.S. cybersecurity strategy accomplished through the NSA’s Cybersecurity Directorate, U.S. Cyber Command (USCYBERCOM), and the Department of Homeland Security, focuses on both defensive and offensive operational postures. Defensive mechanisms include zero-trust architectures for federal systems, the implementation of hardware-based root-of-trust (e.g., TPM modules), and AI-enabled intrusion detection systems (IDS) capable of parsing massive volumes of network telemetry for command-and-control (C2) beaconing which is indicative of foreign APTs (Advanced Persistent Threats).

U.S. operations conducted under Title 10 and Title 50 allow the employment of hunt-forward teams, specialized cyber units deployed to partner nations to observe adversary TTPs (tactics, techniques, and procedures) in real-time. These teams report findings back to fusion centers like the NSA’s Threat Operations Center (NTOC). Simultaneously, Project RAVEN-type initiatives and signals denial campaigns target adversary collection nodes via cyber disruption, occasionally using polymorphic malware or firmware sabotage targeting China’s collection infrastructure or its remote access trojans (RATs).

Diplomatic Engagements

The United States utilizes a range of bilateral and multilateral mechanisms to limit adversarial intelligence penetration. Bilaterally, intelligence-sharing arrangements such as the ‘Five Eyes’ alliance, the Defense Intelligence Enterprise, and regional partnerships (e.g., Joint Interagency Task Force South) enable coordinated monitoring of Chinese SIGINT activity. Cuba is a unique case as formal diplomacy simply doesn’t exist in any meaningful way. Thus, diplomatic backchanneling via neutral third parties and pressure through the Organization of American States (OAS) are appropriate mechanisms to discourage Cuba from inviting foreign military basing and dual-use infrastructure development.

The Department of State embeds intelligence and security liaisons in embassies to collaborate with host nations’ internal security services. These attachés assist in countering influence operations and foreign direct investment in critical telecom sectors (think “Huawei-linked 5G nodes”), which may serve as covert SIGINT enablers. Foreign assistance programs such as the International Narcotics and Law Enforcement (INL) initiative can also be leveraged to enhance allies’ counterintelligence capabilities in the Dominican Republic, Central and South America.

Legislative Actions

Congress has passed a suite of legislative instruments aimed at mitigating foreign intelligence risks. These include the Foreign Investment Risk Review Modernization Act (FIRRMA), which expanded the jurisdiction of CFIUS to scrutinize Chinese acquisitions of U.S. technology companies. Additional statutory provisions under the Intelligence Authorization Acts have appropriated classified funding for the expansion of counterintelligence platforms targeting China’s Ministry of State Security (MSS) and People’s Liberation Army Strategic Support Force (PLASSF). Further, the Secure and Trusted Communications Networks Act mandates the removal of high-risk equipment (such as Huawei and ZTE hardware) from federal and contractor systems. Further, targeted sanctions under IEEPA (International Emergency Economic Powers Act) have been used to deny export privileges and financial access to Chinese firms known to support Beijing’s global surveillance infrastructure. New initiatives that “double down” on these resources is imperative.

The deployment of Chinese SIGINT facilities in Cuba is a dangerous expansion of China’s intelligence capabilities, directly impacting U.S. national security. The proximity of these installations to the U.S. mainland enhances their potential to intercept sensitive communications and monitor military activities. Without cooperation from the Cuban government, counterintelligence efforts to detect, deter, and neutralize Chinese FIE threats must evolve to address the “near home” espionage, subversion and/or sabotage capability. As global power dynamics change, largely due to the PRC’s efforts to remake the international order to suit its strategic needs, robust SIGINT capabilities of our own and vigilant counterintelligence measures remain essential methods of addressing the “Cuba is a PRC Espionage Platform” paradigm.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

Bibliography

Bureau of Industry and Security, U.S. Department of Commerce. Entity List Additions: Huawei and Affiliates. Washington, D.C., May 16, 2019. https://www.bis.doc.gov.

Center for Strategic and International Studies. “Secret Signals: Decoding China’s Intelligence Activities in Cuba.” Hidden Reach. May 2025. https://features.csis.org/hiddenreach/china-cuba-spy-sigint/.

———. “A Snapshot of New Activity at Cuban Spy Sites.” Hidden Reach Snapshots. May 2025. https://features.csis.org/hiddenreach/snapshots/cuba-china-cdaa-base/.

Congressional Research Service. Foreign Investment and National Security: Economic Considerations. CRS Report R46554. Washington, D.C., 2023. https://crsreports.congress.gov.

Director of National Intelligence. National Counterintelligence Strategy of the United States of America, 2020–2022. Washington, D.C.: Office of the Director of National Intelligence, 2020. https://www.dni.gov/files/NCSC/documents/features/20200205-National_CI_Strategy_2020_2022.pdf.

Gertz, Bill. “China Suspected of Using Four Cuban Bases to Spy on U.S.” The Washington Times, May 7, 2025. https://www.washingtontimes.com/news/2025/may/7/inside-ring-china-suspected-using-4-cuban-bases-spy-us/.

Information Resource Program. China: Signals Intelligence. Federation of American Scientists (FAS). Last modified 2017. https://irp.fas.org/world/china/program/sigint.htm.

National Security Agency. “Cybersecurity Collaboration Center: Threat Intelligence Sharing.” Accessed May 24, 2025. https://www.nsa.gov/Cybersecurity/Cybersecurity-Collaboration-Center/.

Office of Foreign Assets Control. Sanctions Programs and Information. U.S. Department of the Treasury. Accessed May 24, 2025. https://home.treasury.gov/policy-issues/office-of-foreign-assets-control-sanctions-programs-and-country-information.

U.S. Congress. Foreign Investment Risk Review Modernization Act of 2018. Public Law No: 115-232, §1701-1728. 132 Stat. 2173.

U.S. Department of Justice. China Initiative Cases Summary. Accessed May 24, 2025. https://www.justice.gov/nsd/information-about-department-justice-s-china-initiative-and-compilation-china-related.

U.S. Department of State. Bureau of International Narcotics and Law Enforcement Affairs (INL): Program Summaries. Washington, D.C., 2024. https://www.state.gov/inl-programs/.

U.S. Government Accountability Office. Cybersecurity: Agencies Need to Fully Establish Risk Management Programs and Address Challenges. GAO-19-384. Washington, D.C.: GAO, July 2019. https://www.gao.gov/products/gao-19-384.

U.S. House Permanent Select Committee on Intelligence. The Threat of Foreign Surveillance: Hearing Before the House Intelligence Committee. 117th Cong., 2nd sess., February 2024.

Posted on

A Ghost in the Machine: Chinese FIS Covert Collection Devices in Solar Inverters

espionage, spy, sabotage, subversion, intelligence, counterintelligence, counterespionage, c. constantin poindexter

National security operatives have found communication devices embedded within Chinese-manufactured solar power inverters and batteries, again raising significant concerns about the security of critical energy infrastructure. These devices, capable of bypassing established cybersecurity measures, appear to be capable of remote manipulation. Successful exploitation could lead to widespread power grid disruption. The following is my take on the technical aspects of the devices, design and data transmission methodologies, the potential locations of data collection receivers, and if their deployment aligns with known Chinese Foreign Intelligence Service (FIS) models and methodology. The following is based on my review of NON-CLASSIFIED INFORMATION.

The integration of renewable energy sources into U.S. power grids has been a cornerstone of our efforts to combat climate change. Central to this integration are power inverters, devices that convert direct current (DC) from solar panels and wind turbines into alternating current (AC) suitable for distribution across the power grid. We now have a really disconcerting development: the discovery of rogue communication devices within Chinese-manufactured inverters and batteries.

Device Composition and Integration

Investigations have revealed that certain Chinese-made solar inverters and batteries contain undocumented communication modules, including cellular-like mechanisms. These components are not listed in product specifications and are capable of establishing independent communication channels, effectively bypassing existing cybersecurity firewalls . The presence of such modules allows for potential remote access and control. (More about this in the counterintelligence section below.) These devices are covertly integrated into the hardware of the inverters and batteries making detection challenging during normal inspections. Their design suggests a deliberate effort to conceal them. The functionalities that can be activated remotely are also a BIG red flag. The integration of these components indicates a high level of sophistication and planning, aligning with tactics observed in state-sponsored cyber-espionage and sabotage operations.

Communication Channels

The devices appear to utilize various communication methods to transmit data, including cellular networks, perhaps local bluetooth-like transmission and potential satellite communications. The use of satellite communication modules such as the Iridium 9603 allows for global coverage and low-latency transmission. This feature would enable remote control capabilities even in areas with limited terrestrial network access .

Data Exfiltration and Command Reception

These communication modules can facilitate both the exfiltration of data from the energy platforms and the reception of remote commands. This bidirectional communication capability poses enormous risks because of the potential extraction of sensitive information and the execution of commands that could disrupt or damage energy infrastructure.

Potential Locations of Data Collection Receivers

The specific locations of collection receivers are classified, however, the nature of the communication methods suggests that data could be transmitted to centralized servers managed by entities affiliated with or under the influence of Chinese FIS. The use of satellite communications makes the identification of data endpoints complicated, as signals can be received from literally any point on the globe. The Chinese station in Cuba would be convenient, however, given China’s extensive global infrastructure and technological reach, it is plausible that transmissions could be routed through multiple international nodes before reaching a final collection point.

Alignment with Chinese Foreign Intelligence Service Models

China’s National Intelligence Law mandates that all organizations and citizens support, assist, and cooperate with state intelligence operations. This legal framework provides Chinese FIE with broad authority to compel companies to integrate surveillance and data collection mechanisms into their products. The deployment of rogue communication devices in energy infrastructure aligns with this model, facilitating intelligence gathering and potential sabotage capabilities. Chinese FIS operations employ a combination of cyber and HUMINT tactics to penetrate foreign systems. The integration of clandestine communication devices into critical infrastructure represents yet another example of these tactics, blending hardware manipulation with cyber capabilities. These tactics are consistent with the strategy of the Ministry of State Security and the People’s Liberation Army’s intelligence units that seek to enhance China’s advantages through technological means.

Implications for Global Energy Security

The discovery of these devices in solar components has grave implications for U.S. energy grid security. The potential for remote manipulation of power systems threatens not only the stability of national grids but also the safety and well-being of populations reliant on consistent energy delivery. The erosion of trust in international supply chains is also a grave peril, leading to increased protectionism and damage to global trade relationships. The integration of undocumented communication devices into Chinese-manufactured solar inverters and batteries represents a grave security concern. The technical sophistication of these components, coupled with their potential alignment with Chinese FIS objectives, underscores the need for new scrutiny and enhanced TSCM practices with regards to foreign-manufactured critical infrastructure components.

The Counterintelligence View

This is a bit technical so bear with me. There is a method to the madness. Problem 1: Inverters are generally equipped with ARM Cortex-M or Cortex-A series microcontrollers that serve as the core processing units for power conversion and monitoring. The covert components appear to use separate, low-power System-on-Chip (SoC) devices (think “MediaTek MT6261D or Espressif ESP32-S3 series”) which deploy onboard baseband processors capable of handling GSM/3G/4G/LTE communications. These SoCs are preloaded with proprietary firmware and operate outside the visibility of the host inverter firmware. These covert devices appear to use integrated RF transceivers on GSM bands, contain embedded GPS modules for geolocation, and have I2C or UART interface capability for stealth data siphoning from inverter controller. Unless there is a simple process for detecting the very small loss of power or disabling the cellular capability, the entire product must be scrapped. Jamming transmissions is not a feasible countermeasure considering the enormous geographic dispersion of a popular solar system component.

A transmission requires a collection part, a transmitter, something that functions as an antenna, and a power source. Problem 2: There is a redundant power supply path. Some units tap the inverter’s DC bus (48V nominal) deploying step-down DC-DC converters to deliver the 3.3V/5V required by the communication hardware. So, the shit-rogue device can acquire and/or broadcast even if the main inverter is powered down (assuming there is residual DC input from the solar panels or battery storage). Sophisticated design is evidenced by minimal-energy storage to allow burst transmissions, EMI shielding to reduce signatures and transient suppression to avoid triggering protective circuits. Again, there may not be any feasible technical countermeasure other than tossing the entire thing in the garbage.

Problem 3: Perhaps the most concerning feature is the presence of covert communication interfaces. The presence of miniature embedded GSM modules that can transmit over mobile networks is a clear indicator of the device’s true purpose. These can be paired with internal PCB-trace antennas which makes detection extremely difficult without picking the entire product apart and/or conducting a full-spectrum TSCM RF analysis. Some units, notably ones used in off-grid or critical infrastructure installations, contain Iridium 9603 transceivers. The Iridium Short Burst Data (SBD) service enables low-latency two-way messaging literally anywhere on Earth. BLE 4.0/5.0 (“Bluetooth”) modules are sometimes embedded to allow nearby short-range device pairing, enabling covert firmware updates or configuration changes via proximity-based access. From a counterintelligence perspective this one is the easiest to detect as it requires the presence of field operatives.

Problem 4: Collection and hijack are extremely problematic. The rogue devices are capable of silently intercepting inverter data via UART snooping of RTU traffic between the inverter controller and grid management mechanisms. RS-485 differential signal bridging architecture in these devices allows simultaneous passive read and active command injection. So, not only can they passively collect performance, grid sync, and telemetry but also insert remote commands (think “demand spikes, phase shifts, or false trip signals”) which could destabilize grid operations. Countermeasure? The garbage bin.

In truth, we are fortunate to have discovered this attempt to compromise these components. Once operational, detection would have been extremely difficult. The unclassified exhibits demonstrate very sophisticated anti-forensic features. They present obfuscated PCB silkscreening or black conformal coating as a physical deception, RF shielding within inverter chassis grounding, no identifiable MAC addresses and time-triggered sleep cycles which makes TSCM useless unless the sweep is conducted at the exact moment of a transmission. Encrypted communication via proprietary, obfuscated firmware (AES-128 in CTR) further points a finger at a sophistication attributable to state-level FIS. China’s intelligence doctrine views everything; commerce, academia, and even kids’ toys as vectors and to their advantage. Chinese “unrestricted warfare” doctrine, i.e., any mass-produced consumer or industrial good may serve as a channel for acquisition or disruption, explains the rogue components in solar inverters, another part of a larger, systematic effort to weaponize supply chains and exploit technological dependencies.

~ C. Constantin Poindexter, Master in Intelligence Studies, Graduate Certificate in Counterintelligence, CISA/NICCS OSINT Certified

References

Reuters. (2025, May 14). Rogue communication devices found in Chinese solar power inverters. Retrieved from: https://www.reuters.com/sustainability/climate-energy/ghost-machine-rogue-communication-devices-found-chinese-inverters-2025-05-14/

TechRadar. (2025, May 14). Chinese energy tech exports found to contain hidden comms and radio devices. Retrieved from: https://www.techradar.com/pro/security/chinese-energy-tech-exports-found-to-contain-hidden-comms-and-radio-devices

DIY Solar Forum. (2025, May 14). Rogue Chinese communication devices found in Solar inverters. Retrieved from: https://diysolarforum.com/threads/rogue-chinese-communication-devices-found-in-solar-inverters.104871/page-4

Wikipedia. (2025, April). National Intelligence Law of the People’s Republic of China. Retrieved from: https://en.wikipedia.org/wiki/National_Intelligence_Law_of_the_People%27s_Republic_of_China

Jamestown Foundation. (2024, March). Foreign Intelligence Hackers and Their Place in the PRC Intelligence Community. Retrieved from: https://jamestown.org/program/foreign-intelligence-hackers-and-their-place-in-the-prc-intelligence-community/

Posted on

The DeepSeek Threat: A Counterintelligence and National Security Concern

deepseek, intelligence, counterintelligence, espionage, counterespionage, export control, spy

Artificial intelligence (AI) is emerging as a transformative force in global economic, technological and military domains. Among the newest threats in the domain of adversarial AI is “DeepSeek,” a China-based generative AI platform. According to the bipartisan House Select Committee on the CCP, DeepSeek poses a serious national security risk to the United States, and I pose a grave counterintelligence one as well. I agree with the Committee’s four primary findings regarding DeepSeek and have included here some corroborating evidence and light analysis of the platform’s broader counterintelligence implications.

I. Data Funnel to the PRC through Military-Linked Infrastructure

DeepSeek funnels Americans’ data to the PRC through backend infrastructure connected to a U.S.-sanctioned Chinese military company. This is consistent with open-source cybersecurity and export control reporting. DeepSeek is affiliated with Beijing DeepSeek Technology Co., which maintains close technical cooperation with state-controlled firms like Tsinghua Tongfang Co., a subsidiary of China Electronics Corporation (CEC), a company sanctioned by the U.S. Department of Defense for its affiliation with the People’s Liberation Army (PLA). U.S. officials have long warned that Chinese firms (even ostensibly private ones) are legally required under China’s 2017 National Intelligence Law to support state intelligence activities. Thus, even passive collection of user queries and metadata from American users can be directly routed to China’s military-civil fused architecture. Cloud traffic analysis tools confirm that some of DeepSeek’s endpoints resolve to IP addresses controlled by Alibaba Cloud and Huawei Cloud, two platforms repeatedly identified for surveillance and data harvesting risks.

II. Covert Propaganda Alignment with CCP Objectives

DeepSeek’s second threat involves covert manipulation of search and response results to align with CCP propaganda. Chinese 2021 ‘Regulations on Recommendation Algorithms’ mandates that AI systems uphold “core socialist values.” Content analysis of DeepSeek’s outputs reveals alignment with these mandates. For instance, when queried about events such as the Tiananmen Square massacre or Uyghur internment camps, DeepSeek either deflects, omits content, or offers CCP-aligned narratives. This contrasts with U.S.-based LLMs that provide factual accounts supported by open-source citations. This form of algorithmic censorship mirrors practices deployed by Baidu and Sogou and serves as a soft power tool for narrative control.

III. Theft of U.S. AI Models through Distillation Techniques

The Committee finds that DeepSeek likely used model distillation to unlawfully replicate U.S. LLMs, a postulate supported by emerging AI security analyses. Distillation, a process whereby a smaller model is trained to mimic a larger one, is legal when trained on open data but when done using unauthorized API access or scraping against licensed outputs, it constitutes intellectual property theft. Reports from AI security firm Mithril Analytics suggest that DeepSeek’s model shows pattern duplication, formatting, and semantic behavior strikingly similar to OpenAI’s GPT-3.5 and Anthropic’s Claude-1.6 This aligns with China’s broader strategy of intellectual property misappropriation, which the Office of the U.S. Trade Representative has labeled a “national policy.”

IV. Use of Prohibited NVIDIA Chips in Defiance of U.S. Export Controls

The fourth finding, that DeepSeek operates on advanced U.S.-made chips which circumvent export restrictions, reflects a broader problem of enforcement challenges in U.S. semiconductor control policy. According to internal supply chain tracking data and reporting from The Information and Reuters, DeepSeek appears to operate on thousands of NVIDIA A100 and H100 GPUs. These high-performance chips were restricted for export to China under the Biden Administration’s 2022 CHIPS Act enforcement measures. Nevertheless, Chinese AI companies have procured these processors through shell companies and resellers in Singapore, Hong Kong, and the UAE. The massive computing power needed to train and operate a GPT-scale model would be nearly impossible without these restricted components, confirming that DeepSeek benefits from illicitly obtained U.S. hardware.

Counterintelligence Threat of DeepSeek

DeepSeek poses a significant and multifaceted counterintelligence threat to the United States and its allies. The platform’s capacity to collect metadata, behavioral data, and potentially personally identifiable information (PII) from Americans creates an intelligence bonanza for Chinese FIS. Unlike traditional espionage, AI systems like DeepSeek operate invisibly and at scale, accumulating user data that can be used for profiling, influence operations, and further AI training purposes that effectively turn every American interaction into an exploitable data point.

DeepSeek represents a vector for information warfare. By manipulating answers to politically sensitive questions, promoting false equivalency in authoritarian narratives, and suppressing democratic values, the platform operates as a digital emissary of the CCP’s ideological and subversive goals. Such influence is subtle, persistent, and if not countered, capable of reshaping discourse as we have observed within our own political discourse.

The use of stolen U.S. intellectual property to build DeepSeek creates long-term strategic disadvantage. This is not a new peril. Not only does IP theft compromise American innovation, but it enables a hostile foreign power to accelerate its AI capability with limited investment. The widespread use of DeepSeek in academic or research settings could further enable China to monitor cutting-edge developments in Western institutions of higher education, R&D laboratories and to conduct surveillance on American professionals for recruitment by Chinese FIS or its allied FIEs.

Further, the misuse of restricted U.S. technology in DeepSeek is a direct challenge to the U.S. export control regime. The failure to prevent such chips from reaching adversarial AI projects undermines the deterrent effect of these restrictions and signals enforcement vulnerabilities to other hostile actors. This threat is potentially multiplicative as the CCP may allow restricted technology delivery to other state and non-state threat actors.

These grave threats demand a comprehensive counterintelligence and more broadly, national security strategy, one that includes aggressive export control enforcement, increased funding for AI provenance tracking, sanctions against companies that enable illicit procurement, and public awareness campaigns warning users of the risks posed by foreign AI platforms. Data is NOT merely informational. It is strategic. DeepSeek, if left unchecked, could be the spearhead of the CCP’s broader ambition to dominate the next frontier of digital power.

~ C. Constantin Poindexter, MA in Intelligence Studies, Graduate Certificate in Counterintelligence, JD, NICCS/CICS Certified OSINT

Footnotes

U.S. Department of Defense. “DOD Releases List of Additional ‘Communist Chinese Military Companies’ Operating in the U.S.” (2020).

National Intelligence Law of the PRC, Articles 7 and 10 (2017).

Recorded Future. “Chinese Cloud Providers and the Global Data Exfiltration Risk.” (2023).

Cyberspace Administration of China. “Provisions on the Administration of Algorithmic Recommendation for Internet Information Services.” (2021).

Freedom House. “China’s Model of Digital Authoritarianism.” (2022).

Mithril Analytics. “Behavioral Fingerprinting of LLMs: Identifying Unauthorized Model Replication.” (2024).

Office of the U.S. Trade Representative. “2023 Special 301 Report on Intellectual Property Rights.”

The Information. “Inside China’s Underground Chip Market.” (2024).

Reuters. “Exclusive: China’s AI Firms Bypass U.S. Chip Ban with Grey Market Imports.” (2024).

Posted on

Disinformation as “Insurgency”, an American Constitutional View

disinformation, misinformation, espionage, counterespionage, counterintelligence, spy, subversion, psyops

I read with a great deal of interest Jacob Ware’s article “To fight disinformation, treat it as an insurgency” that appeared recently in The Strategist, an Australian Strategic Policy Institute publication. I have always held my own ideas about disinformation, more specifically “inoculation” as a countermeasure and recommending instruction from a very young age much as grade schools do in the baltic states. Ware’s article tackles the subject matter as a ‘control social media’ issue. I do not disagree with the importance of media responsibility for moderation of certain types of content, Ware appropriately identifies “overlook[ing] the important role of digital consumers”, but doubles down on content control. The article suggests that social media companies, as central nodes in the information ecosystem, must be pressured into moderating content more aggressively as much as the importance of digital consumers themselves being hardened against manipulation (“inoculation” as I have written in previous scholarship”. Control, compelling in its framing, raises some not insignificant constitutional issues in the context of the United States, particularly with regard to the First Amendment’s protections of speech, association, and press.

Framing Disinformation as Insurgency: Strategic and Legal Ramifications
Ware’s analogy between insurgencies and disinformation campaigns conveys the existential threat that hostile narratives, particularly those that foreign actors pose to democratic stability. Comparing disinformation actors to terrorist insurgents invites the application of military-style containment and suppression tactics, perhaps even the “cyber-kinetic” removal of bad actors (i.e., content moderation and bans), the targeting of ideological hubs (e.g., online communities, networks, influencers, etc.), and critically, the enforcement of norms through government-backed initiatives.

In the U.S. legal context, much of this may be a non-starter. Insurgents and terrorists operate outside the protection of constitutional law, whereas digital speakers, however misinformed or malicious, are presumptively entitled to the protections of the First Amendment. The Constitution does not permit the government to silence unpopular, false or even offensive ideas unless they meet strict criteria for incitement, true threats, or defamation. This legal boundary sharply limits the government’s ability to treat digital speech as a national security threat without triggering robust judicial scrutiny, even if that information is objectively dangerous disinformation.

Section 230 and Platform Immunity: The Epicenter of the Debate
The article criticizes Section 230 of the Communications Decency Act (1996), which shields internet platforms from liability for user-generated content. This statute is often viewed as the legal linchpin that enabled the growth of the modern internet, on the whole a pretty positive thing. Ware argues that these protections prevent platforms from being held accountable and serve as a digital safe haven for malign actors. From a policy standpoint, this critique doesn’t hold much merit. Critics across the political spectrum argue that Section 230 incentivizes platforms to prioritize engagement and profit over truth and social stability, however, repealing or modifying Section 230 would not directly authorize government censorship. It WOULD expose platforms to civil liability for failing to moderate. Any new federal statute that imposes content-based restrictions or penalties would need to meet all prongs of the constitutional free speech tests and modern U.S. jurisprudence. The courts have routinely ruled that platforms are private entities with their own First Amendment rights therefore even in the absence of Section 230, the government would not be able to compel social media companies to carry or remove specific content unless it satisfies narrow constitutional exceptions.

Free Speech: A Distinctly American Commitment
A central theme in the article is the frustration that American-style free speech doctrines allow dangerous ideas to circulate freely online. Ware writes from an Australian perspective. The article praises the European Union’s Digital Services Act and Australia’s eSafety initiatives as superlative regulatory models. Under those statutory regimes platforms face stiff penalties for failing to suppress harmful content. These approaches may appear pragmatic but they clearly represent a sharp divergence from U.S. legal culture.

The U.S. Constitution’s First Amendment prohibits government abridgement of speech, including offensive, deceptive, or politically inconvenient speech. In United States v. Alvarez (2012), the Supreme Court struck down a federal law criminalizing false claims about military honors, holding that even deliberate lies are constitutionally protected unless they cause specific, fixable harm. Further, in Brandenburg v. Ohio (1969), the Court established that even advocacy of illegal action is protected unless it is directed to inciting imminent lawless action AND is likely to produce such action. So, even under the noble pretext of national defense, any proposal that seeks to directly regulate speech must reconcile with this robust jurisprudence. Foreign governments might be able to implement speech controls without constitutional constraints. We cannot. The U.S. must address disinformation through less intrusive, constitutionally sound means.

Counterinsurgency in a Civilian Space: Policing Thought and Risking Overreach
Ware’s counterinsurgency metaphor extends beyond moderation into behavioral engineering, winning the “hearts and minds” of digital citizens. This vision includes public education, civilian fact-checking brigades, and a sort of civic hygiene campaign against harmful content. Although such measures may be effective as psychological operations (PSYOPs), the distinction between persuasion and indoctrination must be carefully managed in a free society.

There is legitimate concern that state-sponsored resilience campaigns could slip into propaganda or viewpoint discrimination, especially when political actors define what constitutes “disinformation.” The inconvenient truth is that the label of “misinformation” has been applied inconsistently, sometimes suppressing legitimate dissent or valid minority viewpoints. The First Amendment’s commitment to a “marketplace of ideas theory” assumes that truth ultimately prevails in open debate, not through coercive narrative management.

There is another danger. Using the tools of counterinsurgency, even rhetorically, raises alarms about militarizing civil discourse and legitimizing authoritarian measures under the guise of “national security.” In Boumediene v. Bush (2008), the Court warned against extending military logic to civilian legal systems. Applying wartime strategy to cultural or political disputes in the civilian cyber domain risks undermining the very liberal values the state claims to protect.

An Appropriate Role for Government
Despite consitutional guardrails, the federal government is not powerless. Several constitutionally sound measures remain available. These approaches avoid entangling the government in the perilous business of adjudicating truth while still defending the information ecosystem.:

Transparency Requirements – Congress can require social media companies to disclose their moderation policies, algorithmic preferences, and foreign funding sources without dictating content outcomes.

Education Initiatives – Civics education and media literacy programs are constitutionally permissible and could help inoculate the public against disinformation without coercion.

Voluntary Partnerships – The government can engage with platforms voluntarily, offering intelligence or warnings about malign foreign influence without mandating suppression.

Targeting Foreign Actors – The government can lawfully sanction, indict, or expel foreign individuals and entities engaged in coordinated disinformation campaigns under laws governing espionage, foreign lobbying, or election interference.

Ware’s comparison of disinformation to insurgency is strategically evocative, but its prescriptive implications clash with foundational American principles. The First Amendment might seem inconvenient, but it was designed to prevent precisely the kind of overreach that counterinsurgency measures invite. Democracies do not defeat authoritarianism by adopting its tools of censorship and narrative control. If the United States is to confront the threats of disinformation effectively, it must do so in a way that affirms rather than undermines what makes us distinctively American. Educating, not censoring; persuading, not suppressing; and building durable civic institutions capable of withstanding the torrent of falsehoods without succumbing to the lure of government-controlled truth are imperative. Freedom remains the best antidote to tyranny ONLY if we remain vigilant in its defense.

~ C. Constantin Poindexter,

  • Master of Arts in Intelligence
  • Graduate Certificate in Counterintelligence
  • Undergraduate Certificate in Counterintelligence
  • Former I.C. Cleared Contractor
Posted on

The DNI Report: What is Missing?

seguridad national, espionage, contraespionage, contrainteligencia, c. constantin poindexter

It should come as no surprise in the current polarized political climate that certain threats to U.S. national security are omitted, some overly emphasized and others included but not give a more thorough review. Ironically (or perhaps not so ironically) the omissions and lack of more comprehensive address of certain threat are those very ones that are exacerbated by current Administration policies. The current DNI [unclassified version] contains no surprises, however there are some perils that decidedly lack the attention that they deserve. I’ll be brief.

The weaponization of artificial intelligence against the U.S. population poses and existential threat to the nation that we are not appropriately prepared for. The assessment identifies China’s AI capabilities in surveillance and disinformation, but underestimates the dangers posed by AI-generated disinformation and psychological operations targeting U.S. elections, civil cohesion, and trust in institutions. Synthetic media (deepfakes) at scale are unaddressed and present a very real menace. FIEs that excel in producing these fakes could fabricate major geopolitical incidents and/or falsely incriminate U.S. leaders. This is a “real-world crisis” scenario. Further, in our rush to load up our own AI capability, models trained on U.S. data pose an exposure to having them turned back against us in warfare, negotiation, or economic manipulation contexts. The DNI offers no significant discussion of how adversaries might use advanced LLMs and multi-modal AI to undermine decision-making at every level of our communities, from individual voters and first responders to senior policymakers.

There is a significant danger of the collapse of U.S. domestic infrastructure due to political paralysis and sabotage. The DNI identifies cyber threats to infrastructure (e.g., water, healthcare) however the report understates the systemic vulnerability of U.S. infrastructure to non-digital threats such as aged and neglected critical systems (e.g., bridges, power grids, water systems), and insider sabotage by ideologically motivated actors. White supremacist factionists and extremists like Timothy McVeigh come immediately to mind. Political paralysis and corruption that prevent modernization or resiliency efforts are the final ugly nail in the proverbial coffin. The loss of national security expertise as a result of wholesale firings/layoffs and the sidelining of individuals with decades of tradecraft and professional expertise based on party adherence are a very real threat. The assessment fails to meaningfully consider how polarization and our legislature’s unwillingness to work together are making the U.S. increasingly incapable of protecting or restoring its critical infrastructure after an attack or natural disaster. Don’t think for a moment that Chinese, Russian, Iranian and North Korean FIEs are failing to perceive these vulnerabilities that they can exploit.

Espionage, subversion and other nefarious covert operations against the U.S. and its interests via foreign investment and big-corporate influence are absent. There is really no excuse to omit identification and discussion of how “big money” has affected national security at every level, as even for a layperson is occurring in plain view. China’s cyber espionage and technology theft are addressed in depth, but why are foreign ownership of and influence in U.S. strategic sectors, including agriculture, pharmaceuticals, real estate near sensitive military sites and AI startups left alone? The use of shell corporations and fronting arrangements to embed operatives and proxies within sensitive sectors and policy circles is a serious threat as well. Strategic acquisition of distressed U.S. companies post-COVID by entities linked to FIEs are a mechanism and vehicles for subversion, espionage and sabotage. A brief look at our own history since the end of WWII reveals how these methods are effective and insidious, perhaps presenting a greater danger than cyber-attacks because they provide our adversaries to deep access, deniability and strategic gain that will serve them well for decades. Fragmenting and ‘bull in a china shop’ cancellation of funding paired with broken inter-agency oversight are extremely problematic.

Do better.

Posted on

The Peril of Pentagon Orders Russian Cyber Defense ‘Stand Down’

cyber, cyber operations, cyber threat, espionage, counterespionage, counterintelligence, russia

It if doesn’t frighten you, it should. “The Trump administration has ordered the United States to end offensive cyber operations targeting Russia, . . . (US News, Mar. 2025) Russia, or more particularly the Russian FIE poses a grave threat to U.S. national security. Threats posed by this state-actor and its state-supported proxies are grave both in terms of capability and intent. Russia has consistently demonstrated its capacity to execute sophisticated cyber operations targeting governments, corporations, critical infrastructure and individuals. The perils are multi-dimensional, including espionage, cyber warfare (or “war in the grey”), information operations, subversion, ransoming and economic disruption. Examples of Russia’s malign and nefarious cyber activity are plethora however recently the U.S. and Ukraine seem to enjoy the brunt of Putin’s ire. Here are some points to consider:

1. State-Sponsored Cyber Warfare

  • Russia’s GRU Unit 74455, a/k/a “Sandworm” conducts offensive cyber operations, often targeting critical infrastructure the U.S., its allies and shared economic interests.
  • The 2017 NotPetya attack caused over $10 billion in global damages, hitting Maersk, FedEx, and other major commercial concerns. This agent was designed for penetration of a particular type of accounting software used in Ukraine. While not specifically targeting the U.S., the global fallout of NotPetya getting into the wild is instructive. In financial terms, it was among the greatest events of “collateral damage during war” ever recorded.
  • Russian hackers have targeted Ukraine’s energy sector repeatedly. They have demonstrated a clear ability to take down critical infrastructure. Evidence of Russian FIS’s penetration of U.S. utilities, likely in search of weakness to exploit or to leave ‘back doors’ for future exploitation, has also been detected. Notably, Dragonfly 2.0, a Russian state-sponsored hacking group (also known as Energetic Bear), successfully infiltrated U.S. energy sector systems, including nuclear power plants.

2. Cyber Espionage

  • Groups like APT29 (Cozy Bear) and APT28 (Fancy Bear), linked to Russian FIE have hacked into government agencies. They have repeatedly compromised U.S. official networks. The SolarWinds penetration in 2020 is instructive.
  • Ongoing efforts to steal classified or proprietary information from defense, aerospace, and technology sectors save Russia billions in research and development. From 2020 to 2021, Russian hackers compromised multiple U.S. defense contractors that provide support to the Department of Defense (DoD), U.S. Air Force, and Navy APT28 “Fuzy Bear” stole information related to weapon systems (including fighter jets and missile defense technologies, communications and surveillance systems, naval and space-based defense projects.

3. Election Interference & Disinformation

  • Russia has weaponized social media. Troll farms such as the Internet Research Agency and more rescently AI-home-cooked content spread disinformation and misinformation to masssive audiences.
  • Russian cyber actors hacked the DNC and Clinton campaign, leaking emails via WikiLeaks in efforts to subvert the U.S. political process.
  • Operation Project Lakhta was ordered directly by Vladimir Putin. This was a “hacking and disinformation campaign” to damage Clinton’s presidential campaign.
  • The Justice Department seized thirty-two internet domains used in Russian government-directed foreign malign influence campaigns (“Doppelganger”).

4. Ransomware & Financial Cybercrime

  • Russia harbors cybercriminal groups like Conti, REvil, and LockBit, which launch ransomware attacks on U.S. hospitals, businesses, and municipal corporations.
  • Many ransomware gangs operate with tacit Kremlin approval—as long as they don’t target Russian entities. For instance, REvil’s malware is designed to avoid systems using languages from the Commonwealth of Independent States (CIS), which includes Russia. This evidences a deliberate effort to steer clear of Russian entities.

5. Potential for Cyber Escalation

  • Russia has declared NATO and the West and its “main enemy”. The risk of cyber retaliation is real. Russia has the capability to conduct supply chain attacks, disrupt banking systems, and interfere with military communications.
  • In 2020, Russian state-sponsored cyber actors compromised the software company SolarWinds, embedding malicious code into its Orion network management software. This supply chain attack affected approximately 18,000 organizations, including multiple U.S. government agencies and private sector companies. This was a surveillance mechanism which allowed Russia to monitor internal communications and exfiltrate sensitive data from the software users.
  • In 2008 Russia deployed specialty malware (“Agent.btz“) which penetrated the U.S. Department of Defense’s classified and unclassified networks. The breach, considered one of the most severe against U.S. military computers, led to the establishment of U.S. Cyber Command to bolster cyber defenses.

Conclusion

The Russian cyber threat is persistent, evolving, and highly strategic. The West has cyber defenses and deterrence strategies in place (like sanctions and counter-hacking operations) however the current Administration’s order to terminate much of that effort cripple U.S. national security.

Quick to react to reporting of the DoD’s posturing, the Cybersecurity and Infrastructure Security Agency (CISA) tweeted, “CISA’s mission is to defend against all cyber threats to U.S. Critical Infrastructure, including from Russia. There has been no change in our posture. Any reporting to the contrary is fake and undermines our national security.” Comforting however the words of a confidential source within CISA present a different picture. “A recent memo at the Cybersecurity and Infrastructure Security Agency (Cisa) set out new priorities for the agency, which is part of the Department of Homeland Security and monitors cyber threats against US critical infrastructure. The new directive set out priorities that included China and protecting local systems. It did not mention Russia, . . . analysts at the agency were verbally informed that they were not to follow or report on Russian threats, even though this had previously been a main focus for the agency.” (Guardian, Mar. 2025)

Russia is one of our most aggressive cyber adversaries as well as being recongnized by most nations as a ‘cyber threat pariah’ (i.e., most vocally by NATO, the EU and the U.N.). Given the President’s position on Russia, it’s impossible to say that U.S. continues to harden critical infrastructure, surveil Russian FIE cyber efforts and accomplish effective countermeasures. Russia’s offensive cyber capabilities will remain a major security challenge for the foreseeable future. The question is, are we willing to handicap our efforts to meet our adversaries with robust cyber capability or simply turn our heads away.