Tag: counterintelligence

Posted on

CIA Tradecraft Review: Did Russian FIS Interfere in the 2016 Election?

russia, russian foreign intelligence, intelligence, counterintelligence, espionage, counterespionage, subversion

The U.S. Intelligence Community Assessment (ICA) of January 6, 2017, titled “Assessing Russian Activities and Intentions in Recent US Elections,” has been released. As anticipated, it has caused fierce controversy, largely along partisan lines. The report concluded with high confidence that Russian President Vladimir Putin ordered an influence campaign aimed at the 2016 U.S. presidential election, with the explicit intent to damage Hillary Clinton’s chances and to help elect Donald J. Trump. Subsequent reviews, including the 2025 CIA Directorate of Analysis (DA) tradecraft report, have scrutinized certain aspects of the ICA’s internal work, there is no credible evidence that refutes the fundamental claim that Russian intelligence services interfered. A comprehensive review of official U.S. government investigations, independent reports, and declassified materials affirms the legitimacy of the ICA’s core finding.

I am basing this analysis on the publicly-facing document which contains some significant ‘black-out’ redactions. Those redactions do not invalidate the core of the assessment and there are good justifications for their exclusion.

What is ‘Blacked-Out’

Specific positions of CIA, FBI, and NSA personnel who contributed to the ICA or participated in internal I.C. debate have been extracted. These individuals were not publicly known figures like Director Brennan or DNI Clapper, and therefore their identities remain protected for operational security. The redactions include analytic line officers, mission center managers, and mid-level coordinators whose participation would be readily identifiable by job title or context. Protecting these names aligns with intelligence S.O.P., especially for personnel involved in sensitive political assessments.

A central redaction concerns the highly classified CIA serialized report that underpinned the ICA’s “aspired” judgment about Putin’s preference for Trump. The specific contents of this report remain classified. This is due to its likely origin from a uniquely sensitive HUMINT source or technical collection platform. The Tradecraft Review indicates that this report was narrowly held, and not serialized until December 2016, suggesting it contains material that would compromise collection methods or expose a clandestine asset if disclosed. Some sections reference analytic decisions to include or omit parts of intelligence reporting. Direct quotes or paraphrased summaries of raw intelligence that suggested alternative interpretations of Putin’s intent are logically excluded. These redactions reflect legitimate tradecraft deliberation but also contain operationally sensitive material not appropriate for public release, including specific source citations or field report language.

Portions discussing Brennan’s creation of a special Fusion Cell and the restricted access to intelligence materials omit codewords and program names related to special compartments. These would include the names of CIA internal groups or clearance levels, operational terms for sensitive works, and the identities of officers working within those projects. These redactions preserve the integrity of compartmented information management protocols and protect methodologies that may still be in use.

I firmly believe that complementary reporting was received from liaison FISs/FIEs. Redacted content in this context likely conceals the nationality, origin, or method of foreign partner contributions. Revealing such details would violate long-standing “third party rule” agreements and jeopardize future collaboration with allied intelligence services.

The Meat of the Matter

The declassified version of the ICA concluded that Russia’s goals were to “undermine public faith in the U.S. democratic process, denigrate Secretary Clinton, and harm her electability and potential presidency,” and further, that “Putin and the Russian Government developed a clear preference for President-elect Trump” (ODNI, 2017). These findings were endorsed with “high confidence” by the CIA, FBI, and NSA (the latter assigning “moderate confidence”) to the judgment about Putin’s aspiration to help Trump. The ICA was the result of a coordinated effort by three key intelligence agencies and was supported by substantial intelligence reporting, including cyber forensics, human intelligence (HUMINT), and intercepted communications (SIGINT). It was not, as some media narratives have suggested, based solely on the controversial Steele Dossier, which was not used to support any key analytic judgments but was included only as an annex.

The Mueller Investigation and DOJ Indictments

Special Counsel Robert Mueller’s investigation into Russian interference produced robust corroboration of the ICA’s central conclusions. The Mueller Report, released in 2019, found, “The Russian government interfered in the 2016 presidential election in sweeping and systematic fashion” (Mueller Report, Vol. I, p. 1).” Two major components of this interference were outlined:

The Internet Research Agency (IRA): A Russian troll farm that used fake social media accounts to promote pro-Trump and anti-Clinton narratives, targeting U.S. voters with disinformation, racial division, and conspiracy theories.

Russian Military Intelligence (GRU) Operations: The GRU conducted cyber intrusions into the Democratic National Committee (DNC), the Democratic Congressional Campaign Committee (DCCC), and Clinton campaign chairman John Podesta, stealing tens of thousands of emails and documents, which were strategically leaked via Wikileaks.

Twelve GRU officers were indicted by the Department of Justice in July 2018 for these operations (DOJ Indictment, 2018), establishing the direct role of Russian military intelligence in hacking and disseminating stolen data for political impact. The indictment’s forensic details, including the specific units and servers used, leave no room for ambiguity as to the perpetrators or their intentions.

Bipartisan Senate Intelligence Committee Report

The U.S. Senate Select Committee on Intelligence conducted a multi-volume, bipartisan investigation into Russian interference, culminating in a 966-page final report in August 2020. The committee validated the ICA’s primary conclusions, “The Committee found that the ICA presents a coherent and well-constructed intelligence basis for the assessment that Putin and the Russian government aspired to help President-elect Trump’s election chances” (SSCI, Volume 5, p. 6). The committee reported that the ICA was not politically driven, that dissenting views were aired, and that the analytic tradecraft was sound despite the rushed timeline. It also noted that the Russian government viewed a Trump presidency as favorable to Moscow’s interests, particularly due to Trump’s stated skepticism toward NATO and the transatlantic alliance.

Russian Messaging and Disinformation Strategy

Open-source analysis of Russian disinformation also supports the conclusion that Trump was the preferred candidate. The Hamilton 68 dashboard, maintained by the Alliance for Securing Democracy, tracked pro-Kremlin Twitter activity and documented a clear slant toward Trump, along with the propagation of hashtags and narratives attacking Clinton and promoting voter distrust.

Russian state media such as RT and Sputnik displayed markedly pro-Trump coverage and actively spread conspiracy theories about Clinton’s health, corruption, and the DNC emails (Brookings Institution, 2017). The timing and content of Wikileaks dumps were strategically synchronized with key moments in the election to maximize damage to Clinton, such as the release of Podesta’s emails hours after the Access Hollywood tape was revealed.

Intelligence Community Reassessment in 2025

The 2025 CIA Tradecraft Review, while critical of procedural anomalies, did not retract or invalidate the ICA’s conclusions. Instead, it affirmed that the “aspired” judgment, that Putin wanted Trump to win, was plausible and supported by credible evidence. However, it argued that the “high confidence” level should have been “moderate confidence” due to the reliance on a single highly classified report (Tradecraft Review, 2025, p. 6).

Even this critique, however, explicitly stated, “The DA Review does not dispute the quality and credibility of the highly classified CIA serialized report… The ICA authors’ interpretation of its meaning was most consistent with the raw intelligence” So, while advocating for stricter tradecraft standards and a more cautious confidence level assignment, the report reaffirmed that the core intelligence judgments remained defensible and well-founded.

No U.S. government entity, CIA, NSA, ODNI, or the Department of Justice, has issued a formal repudiation of the ICA’s 2017 findings. While internal reviews have called for greater transparency and adherence to tradecraft standards, no post hoc analysis has offered an alternative judgment asserting that Russia was neutral or preferred Clinton over Trump. In fact, public statements by senior Trump-era officials confirm the ICA’s findings. Former Director of National Intelligence Dan Coats, for instance, stated in 2018, “The Russians are still trying to influence our elections. The warning lights are blinking red again. It was Russia’s intent to interfere, and it was clearly to hurt Hillary Clinton and help Donald Trump” (DNI Coats, Aspen Security Forum, 2018).

In Summary

The claim that Russian FIS interfered in the 2016 U.S. presidential election is substantiated by a broad and consistent body of evidence from multiple independent, bipartisan, and interagency investigations. The ICA, the Mueller Report, the DOJ indictments, and the Senate Intelligence Committee’s findings converge to form a coherent narrative: that the Russian government engaged in an expansive campaign to damage Hillary Clinton and to bolster Trump’s candidacy. Attempts to discredit this conclusion relying on political framing or selective interpretation of later reviews do not withstand the weight of forensic, testimonial, and documentary evidence. While internal CIA reviews have rightly scrutinized tradecraft and process, they do not reverse the analytical consensus that Russia interfered, and did so in a manner aligned with Moscow’s preference for Trump.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

References

Office of the Director of National Intelligence (ODNI). (2017). Assessing Russian Activities and Intentions in Recent US Elections. https://www.dni.gov/files/documents/ICA_2017_01.pdf

Mueller, R. S. (2019). Report on the Investigation into Russian Interference in the 2016 Presidential Election. https://www.justice.gov/storage/report.pdf

Department of Justice. (2018). Indictment of Russian GRU Officers for DNC Hack. https://www.justice.gov/file/1080281/download

U.S. Senate Select Committee on Intelligence. (2020). Report on Russian Active Measures Campaigns and Interference in the 2016 U.S. Election, Volume 5. https://www.intelligence.senate.gov/sites/default/files/documents/report_volume5.pdf

CIA Directorate of Analysis. (2025). Tradecraft Review of the 2016 Intelligence Community Assessment on Russian Election Interference.

Brookings Institution. (2017). The Kremlin’s Strategy: Pro-Trump Coverage and Disinformation. https://www.brookings.edu/articles/how-russian-state-media-views-the-2016-election/

Coats, D. (2018). Remarks at Aspen Security Forum. https://www.c-span.org/video/?448718-1/dan-coats-says-warning-lights-blinking-red-russian-cyberattacks

Posted on

Grief and the HUMINT Operator, the Personal Toll of Covert Intelligence Operations

HUMINT, intellgence, counterintelligence, espionage, counterespionage, c. constantin poindexter;

It’s not all James Bond and Jason Bourne. The good guy doesn’t always win in the end. Covert work, more specifically covert human intelligence (HUMINT) operations are the most psychologically and morally demanding forms of spying. OSINT and keyboard collectors don’t feel the grief of an intelligence officer in the field. Case officers recruit, develop, handle, and ostensibly protect their agents (“sources” or “assets”), instructing them in appropriate tradecraft to steal secrets and avoid getting caught. These activities are routinely conducted in denied areas. When these agents operate these hostile environments, the stakes are life or death. Discovery often means that the asset will be tortured, executed, and their families persecuted or likewise killed. As seasons of service pass, it is almost inevitable that some agents will be compromised and lost. The emotional burden on the officer responsible for their survival is profound, marked by grief, guilt, and an enduring sense of moral failure.

The humanitarian bond and psychological investment

The key to success as a case officer is the cultivation of a very personal relationship, deep personal rapport with his or her source. A true friendship rooted in trust, empathy, and shared purpose is imperative. A psychological study on intelligence elicitation revealed that non-coercive strategies coupled with rapport-building yield richer and more accurate information acquisition, underscoring how vital emotional connection is to both efficacy and trust. These very human bonds mean that officers break bread, confide in, and take proactive steps to protect their agents. The resulting interpersonal ties transcend formal professional promises. This emotional investment means that when an agent is caught, disappeared, tortured, killed, or all of the above, the officer experiences not just operational failure, but also a deep personal loss. They bear responsibility for agent safety so when the wheels come off, the intelligence officer invariably suffers from a sense of personal culpability. Survivor guilt among those who ‘live through’ while others perish is well documented in trauma psychology.

Survivor guilt and moral injury

Survivor guilt refers to the distress and self-loathing felt by individuals who outlive someone else when they played a role in the other’s fate. In HUMINT, officers feel they failed agents that they recruited, agents who trusted them implicitly. This places officers at risk for moral injury, a condition in which one’s actions or inactions violate their own moral code. The loss of an agent can trigger intense guilt. “I could’ve done more,” “I should’ve seen the compromise,” or “I didn’t protect them like a parent protects a child.”, are common recurring emotional punishments. A recent article on traumatic loss highlights how survivor guilt can evolve into chronic shame and self-destructive rumination unless addressed . This phenomenon aligns closely with what seasoned intelligence officers share in post-action debriefs, i.e., guilt compounded by the clandestine nature of their relationship with agents where that guilt must remain hidden behind professional composure and confidentiality oaths.

Grief within the cloak of secrecy

Unlike traditional warfighter loss, agent deaths or arrests rarely receive acknowledgment nor are honored publicly. There’s no funeral, no rope-dropping anniversary ceremonies, no celebration of life nor what the source contributed. The clandestine world awards no medals for agents who vanish. Intelligence officers grieve in silence and isolation with few official outlets, little acknowledgment, and often no practical nor legal avenue to care for a source’s family. Psychology literature highlights that complicated grief, grief unspoken and unacknowledged driver to depression, PTSD, and physical illness. In clandestine HUMINT, agents operate for years within strict tradecraft boundaries. Case officers managing or sole agents develop significant moral and emotional ties to them. Losing an agent isn’t just a tactical failure within the intelligence agency’s collection strategies. It is the death of someone known intimately and often their families.

The moral complexities of manipulation and betrayal

HUMINT work inherently involves manipulation, the cultivation and direction of individuals that betray their countries. There is no pretty way to describe it. We teach assets to lie, steal, and live dangerous double lives. Covert operators must deploy emotional leverage, sometimes deception, frequently bribery, “ . . . to ensure loyalty and compliance”. As reported in ‘Intelligence & National Security’, manipulation is part of the deal but when influence crosses into coercion or deception, moral dilemmas arise. When an agent is lost, the officer may and often does ask him or herself, “Did I manipulate them into this disaster? Did I betray my own moral code by pushing them into extreme danger?” Psychological research warns that psychological manipulation “targets unconscious, intuitive, or emotional modes of thought… violating autonomy, freedom and dignity”.

Training v. operational seasoning

Formal HUMINT training emphasizes tradecraft, security, and risk/reward management. Intelligence officers learn strict protocols around recruitment, handling, and termination of agents. Real-world operations in hostile environments introduce chaotic variables. Even the most seasoned officer cannot foresee novel counterintelligence techniques, surveillance technology, or unexpected betrayals by intermediaries or an insider threat. As one analysis notes, seasoned double- or triple-agent running reduces an officer’s control. The very experience that can make an officer a great handler can become a liability, undermining his or her ability to predict perils to the asset and operation, increasing their feelings of personal responsibility when things go wrong.

Organizational culture and aftercare

Intelligence services are bad at normalizing and institutionalizing grief processing for covert HUMINT operators. Agencies debrief performance and analyze operational failures, but do a piss-poor job at addressing the emotional consequences. There is a stigma associated with grief, and moral stress in environments that emphasize resilience and secrecy. In some Western countries, covert-source legislation acknowledges that agents and handlers engage in crimes to maintain cover and accomplish operations. Despite this, emotional and moral support for the officers who manage such morally complex situations remains painfully limited. Without interventions such as peer support groups, secret welfare services, or external counseling, intelligence officers risk burnout, emotional numbing, and PTSD.

The ripple effect on agents’ families

When an agent is compromised, repercussions often extend to their families, FIS (FIEs) frequently use assets’ families for leverage. They are targeted as co-conspirators, persecuted and attacked extrajudicially. Officers can manage systems to smuggle a family to safety or allow them to assume new identities but they are not as successful as we would like to assume. When agents die, officers feel they have failed an entire family. Culturally, agents’ loyalty often arises from protecting their families. Losing an agent can thus symbolize failure to protect a family entirely dependent on smart decisions by that operative and his or her handler.

Ethics and accountability

Scholars like Stephan Lau argue that intelligence agencies need pragmatic frameworks to distinguish legitimate influence from harmful manipulation in HUMINT operations. Such models assist case officers in making decisions grounded in ethical clarity rather than moral ambiguity. Institutionalized ethical guidance and accountability structures can both reduce morally damaging decision-making and help handlers process loss after operations fail. Albeit not a panacea, ethical oversight on recruitment, coercion thresholds, and risk assessment can lessen post-hoc guilt and defend against corrosive shame.

Operating at the intersection of psychology, ethics, and national security, HUMINT case officers experience pressures unique to clandestine work. They recruit and manage individuals willing to risk their lives and those of their families for a foreign intelligence entity’s objectives. The loss of such agents in hostile environments imposes profound emotional and moral wounds. Survivor guilt, grief, and rumination on perceived ethical failures are the inevitable result. Individual case officer well-being and institutional resilience is possible. By building ethical guidance, grief acknowledgment processes, peer support structures, and mental health interventions tailored to clandestine realities, HUMINT organizations can care for their own and honor the sacrifices of their assets. In so doing, they protect not just robust operational effectiveness, but the humanity of the professional officers who serve in the shadows.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

References

Goodman Delahunty, J., O’Brien, K., & Gumbert-Jourjon, T. (2014). Reframing intelligence interviews: Rapport and elicitation. Journal of Investigative Psychology and Offender Profiling, 11(2), 178–192.

Lau, S. (2022). The Good, the Bad, and the Tradecraft: HUMINT and the Ethics of Psychological Manipulation. Intelligence and National Security, 37(6), 895–913.

Neria, Y., Nandi, A., & Galea, S. (2008). Post-traumatic stress disorder following disasters: a systematic review. Psychological Medicine, 38(4), 467–480.

Robinaugh, D. J., LeBlanc, N. J., Vuletich, H. A., & McNally, R. J. (2014). The role of grief-related beliefs in complicated grief: A structural equation model. Behavior Therapy, 45(3), 362–372.

Feeney, B. C., & Collins, N. L. (2015). A new look at social support: A theoretical perspective on thriving through relationships. Personality and Social Psychology Review, 19(2), 113–147.

Herman, J. L. (1992). Trauma and Recovery: The Aftermath of Violence—from Domestic Abuse to Political Terror. Basic Books.

Jones, S. G. (2014). Covert Action and Counterintelligence in the Cold War and Beyond. RAND Corporation.

UK Parliament. (2019–2021). Briefing Paper: Covert Human Intelligence Sources (Criminal Conduct) Act.

Shane, S. (2015). Objective Troy: A Terrorist, a President, and the Rise of the Drone. Tim Duggan Books.

Zegart, A. (2007). Spying Blind: The CIA, the FBI, and the Origins of 9/11. Princeton University Press.

Posted on

Defense Intelligence Agency 2025 Threat Assessment, a Brief Review

seguridad nacional, DNI, CNI, espionaje, contraespionaje, inteligencia, contrainteligencia, espia, C. Constantin Poindexter

The 2025 Defense Intelligence Agency (DIA) Worldwide Threat Assessment offers a reasonable thorough overview of global security challenges. There are however certain emerging threats either underrepresented or omitted entirely. I am going to offer a few of my concerns and my thoughts on the implications of the same for U.S. national security. This is not a classified assessment but rather some informed opinion and analysis grounded in open-source intelligence and expert views.

Insider Threats and Human Intelligence Vulnerabilities

The DIA report emphasizes external adversaries, It notably underplays the risks posed by insider threats. A recent incident within the very agency that has provided the 2025 report, underscores this vulnerability. Nathan Vilas Laatsch, is a 28-year-old IT specialist formerly employed by the Defense Intelligence Agency (DIA). Laatsch was arrested on May 29, 2025, for attempting to transmit national defense information to a German government representative. He worked within the DIA’s Insider Threat Division and held a top-secret security clearance. The arrest followed an FBI investigation initiated after a tip-off in March 2025, leading to a sting operation where an undercover agent posed as a foreign official. This breach highlights counterintelligence deficiencies, internal security protocols and the challenges of detecting moles and/or other malicious insiders. Advanced behavioral analytics and machine learning models, such as deep evidential clustering are offering promise in identifying anomalous activities indicative of insider threats. Unfortunately, the integration of such technologies across intelligence community member agencies remains dangerously inconsistent. Addressing this gap requires not only technological adoption but also a cultural shift to robust and proactive internal threat detection.

Artificial Intelligence (AI) and Autonomous Systems as Emerging Threats

The rapid advancement of AI and autonomous systems presents both opportunities and perils. The DIA report acknowledges technological proliferation, however, it lacks a focused analysis of the misuse of AI in cyber warfare, autonomous weaponry, and information manipulation. Recent scholarly work proposes the establishment of an AI incident regime to monitor and counteract threats posed by advanced AI systems. Among recent peer-reviewed material is an excellent piece by Alejandro Ortega. “We put forward a proposal for an AI incident regime that will help to counter threats to national security posed by AI systems, . . . Our ambition is to enable a government agency to maintain comprehensive awareness of AI threats and rapidly counter any resulting risks to national security.” (Ortega, 2025) Frameworks such as that offered by Ortega aim to ensure that AI deployments do not inadvertently compromise national security, and suggest countermeasures that can effectively mitigate identified risks. Given the dual-use nature of AI technologies, there is an urgent need for comprehensive policies that address both their development and potential weaponization.

Unidentified Aerial Phenomena (UAPs) and Aerospace Security

Unidentified Aerial Phenomena (UAPs) have garnered increasing attention due to their potential implications for national security. The DIA report does not address this issue at all. A 2021 assessment by the Office of the Director of National Intelligence highlighted 144 UAP incidents, with 143 remaining unexplained. These occurrences, often near sensitive military installations, raise concerns about airspace sovereignty and surveillance vulnerabilities. The absence of a clear understanding of UAPs hampers the development of effective countermeasures. Integrating UAP analysis into broader threat assessments is essential to ensure comprehensive aerospace security. I am not suggesting that the I.C. should engage in a hunt for UFOs, as the UAPs are more likely collection mechanisms deployed by adversarial FIS, however, leaving the subject matter entirely unaddressed is questionable.

Space-Based Threats and Counterspace Capabilities

The DIA report addresses space and counter-space capabilities. It does NOT offer the breadth nor depth of analysis and informed opinion into the evolving threats in this domain that I expected. This omission is surprising, considering its direct import to the DIA’s most important customers. The Center for Strategic and International Studies’ 2025 Space Threat Assessment details the growing counter-space capabilities of nations like China and Russia, including anti-satellite weapons and electronic warfare tactics. The militarization of space poses GRAVE risks to satellite communications, navigation systems, and surveillance operations. It also endangers the antiquated GPS architecture on which global trade and national security agencies rely. Ensuring the resilience of space-based assets requires not only technological advancement but also international norms and agreements to prevent escalations in this new frontier.

The 2025 DIA Worldwide Threat Assessment provides valuable insights into current global security challenges, however, the omission or underrepresentation of insider threats, AI and autonomous systems, UAPs, and comprehensive space-based threats indicates areas requiring thorough attention. Addressing these gaps is crucial for a holistic understanding of the evolving threat landscape and for formulating effective countermeasures to safeguard national security.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

References

Department of Justice. “U.S. Government Employee Arrested for Attempting to Provide Classified Information to Foreign Government.” U.S. Department of Justice, May 29, 2025.
https://www.justice.gov/opa/pr/us-government-employee-arrested-attempting-provide-classified-information-foreign-government.

Nakashima, Ellen, and Devlin Barrett. “Pentagon Intelligence Employee Accused of Leaking Secrets to a Foreign Nation.” The Washington Post, May 30, 2025.
https://www.washingtonpost.com/dc-md-va/2025/05/30/dod-classified-document-leak/.

Tucker, Eric. “Justice Department Says Pentagon Employee Tried to Give Classified Info to Foreign Government.” Associated Press, May 30, 2025.
https://apnews.com/article/e60388df7f4e07a8d8d942d86513b27c.

Ortega, Alejandro. “A Proposal for an Incident Regime That Tracks and Counters Threats to National Security Posed by AI Systems.” arXiv preprint, March 29, 2025.
https://arxiv.org/abs/2503.19887.

Defense Intelligence Agency. Statement for the Record: Worldwide Threat Assessment. Submitted to the Senate Armed Services Committee, March 2025.
https://armedservices.house.gov/uploadedfiles/2025_dia_statement_for_the_record.pdf.

Center for Strategic and International Studies (CSIS). Space Threat Assessment 2025. Washington, DC: CSIS, 2025. https://www.csis.org/analysis/space-threat-assessment-2025.

Office of the Director of National Intelligence (ODNI). Preliminary Assessment: Unidentified Aerial Phenomena. Washington, DC: ODNI, June 25, 2021. https://www.dni.gov/files/ODNI/documents/assessments/Preliminary-Assessment-UAP-20210625.pdf.

Posted on

Chinese Strategic SIGINT in Cuba: Implications for U.S. National Security

Bejucal, inteligencia china, inteligencia, contrainteligencia, espionaje, contraespionaje, CNI, SIGINT, c. constantin poindexter

Signals Intelligence (SIGINT) is a cornerstone of modern intelligence operations, encompassing the interception and analysis of electronic communications and emissions. SIGINT has in fact become the primary “INT” for the collection of highly sensitive information by all of the major powers that engage in global espionage. As geopolitical tensions escalate between the United States and the People’s Republic of China (PRC) and PRC allies, the strategic deployment of SIGINT assets has become a grave peril to U.S. national security. China has established multiple SIGINT facilities in Cuba, raising concerns about the potential threats to the United States and indeed its allies.

The Importance of Signals Intelligence (SIGINT)

SIGINT involves the collection and analysis of electronic signals to gather intelligence on foreign entities. It is divided into Communications Intelligence (COMINT), focusing on intercepted communications, and Electronic Intelligence (ELINT), which pertains to electronic emissions from devices such as radars. SIGINT provides critical insights into adversaries’ capabilities, intentions, and activities, supporting decision-making at strategic, operational and tactical levels. It enables the monitoring of military movements, the detection of threats, and the protection of national interests.

China’s Proficiency in SIGINT Operations

China has developed extensive SIGINT capabilities, positioning itself as a formidable player in this particular intelligence discipline. The PRC operates numerous ground-based SIGINT stations across its territory, including significant facilities on Hainan Island deployed to monitor U.S. naval activities in the South China Sea. Additionally, China has invested in spaceborne ELINT systems mounted on satellites, enhancing its global surveillance reach. Clearly, China’s SIGINT operations are not confined to its borders. The PRC has established overseas facilities and deployed collection vessels to monitor foreign military operations. These efforts are part of a broader strategy to expand China’s intelligence-gathering capabilities and assert its global influence.

Chinese SIGINT Facilities in Cuba: Threat Surface and Geographic Reach

The establishment of Chinese SIGINT facilities in Cuba represents a strategic move to enhance surveillance capabilities in proximity to the United States. Reports suggest that China operates multiple SIGINT sites on the island, including facilities in Bejucal, Santiago de Cuba, and Paseo. These installations are equipped with advanced technologies, such as Circularly Disposed Antenna Arrays (CDAAs), capable of intercepting signals over vast distances. The Bejucal site, for instance, can reportedly monitor radio signals from 3,000 to 8,000 miles away, encompassing key U.S. military installations and even Washington, D.C. The geographic proximity of these facilities to the U.S. mainland allows for the potential interception of sensitive communications, posing significant risks. The ability to monitor U.S. military movements, disrupt critical communications, and gather intelligence on defense operations underscores the strategic value of these Cuban installations to China’s intelligence apparatus. The installations also pose a grave threat to U.S. intelligence and defense allies throughout the Caribbean and Latin America.

U.S. Counterintelligence Measures to Thwart Foreign SIGINT Threats

In response to the growing threat posed by foreign SIGINT operations, the United States has implemented a comprehensive counterintelligence strategy. The National Counterintelligence and Security Center (NCSC) leads efforts to identify, deceive, exploit, disrupt, and protect against espionage activities conducted by foreign powers. Adequate countermeasures may significantly neutralize the threats posed by Chinese FIS SIGINT activities and reduce perils to the integrity of U.S. intelligence and defense operations, to wit;

Enhanced Surveillance and Monitoring

The United States employs an integrated suite of ground-based, airborne, maritime, and space-based systems to detect and track hostile intelligence collection efforts, including SIGINT platforms positioned near U.S. territory. Ground-based monitoring stations operated by the NSA and partner agencies use highly sensitive direction-finding systems and frequency analysis to identify anomalous electromagnetic emissions, often correlating these signals with known adversary signatures cataloged in classified ELINT databases. Aerial and UAV platforms equipped with hyperspectral and electronic surveillance payloads patrol maritime peripheries, particularly in the Gulf of Mexico and Caribbean airspace.

Department of Defense programs such as those operated via Special Access Programs (SAPs) mechanism enable geo-location of foreign collection antennas and triangulation of suspected listening posts. Tasking of National Technical Means (NTMs), including SIGINT satellites (e.g., the Advanced Orion/Trumpet series), is adjusted in response to emerging threats. Further, electromagnetic deception operations (EMDEPs) that broadcast decoy signals can saturate and/or confuse Chinese FIE collectors operating from proximate offshore platforms or Cuban bases.

Cybersecurity Initiatives

U.S. cybersecurity strategy accomplished through the NSA’s Cybersecurity Directorate, U.S. Cyber Command (USCYBERCOM), and the Department of Homeland Security, focuses on both defensive and offensive operational postures. Defensive mechanisms include zero-trust architectures for federal systems, the implementation of hardware-based root-of-trust (e.g., TPM modules), and AI-enabled intrusion detection systems (IDS) capable of parsing massive volumes of network telemetry for command-and-control (C2) beaconing which is indicative of foreign APTs (Advanced Persistent Threats).

U.S. operations conducted under Title 10 and Title 50 allow the employment of hunt-forward teams, specialized cyber units deployed to partner nations to observe adversary TTPs (tactics, techniques, and procedures) in real-time. These teams report findings back to fusion centers like the NSA’s Threat Operations Center (NTOC). Simultaneously, Project RAVEN-type initiatives and signals denial campaigns target adversary collection nodes via cyber disruption, occasionally using polymorphic malware or firmware sabotage targeting China’s collection infrastructure or its remote access trojans (RATs).

Diplomatic Engagements

The United States utilizes a range of bilateral and multilateral mechanisms to limit adversarial intelligence penetration. Bilaterally, intelligence-sharing arrangements such as the ‘Five Eyes’ alliance, the Defense Intelligence Enterprise, and regional partnerships (e.g., Joint Interagency Task Force South) enable coordinated monitoring of Chinese SIGINT activity. Cuba is a unique case as formal diplomacy simply doesn’t exist in any meaningful way. Thus, diplomatic backchanneling via neutral third parties and pressure through the Organization of American States (OAS) are appropriate mechanisms to discourage Cuba from inviting foreign military basing and dual-use infrastructure development.

The Department of State embeds intelligence and security liaisons in embassies to collaborate with host nations’ internal security services. These attachés assist in countering influence operations and foreign direct investment in critical telecom sectors (think “Huawei-linked 5G nodes”), which may serve as covert SIGINT enablers. Foreign assistance programs such as the International Narcotics and Law Enforcement (INL) initiative can also be leveraged to enhance allies’ counterintelligence capabilities in the Dominican Republic, Central and South America.

Legislative Actions

Congress has passed a suite of legislative instruments aimed at mitigating foreign intelligence risks. These include the Foreign Investment Risk Review Modernization Act (FIRRMA), which expanded the jurisdiction of CFIUS to scrutinize Chinese acquisitions of U.S. technology companies. Additional statutory provisions under the Intelligence Authorization Acts have appropriated classified funding for the expansion of counterintelligence platforms targeting China’s Ministry of State Security (MSS) and People’s Liberation Army Strategic Support Force (PLASSF). Further, the Secure and Trusted Communications Networks Act mandates the removal of high-risk equipment (such as Huawei and ZTE hardware) from federal and contractor systems. Further, targeted sanctions under IEEPA (International Emergency Economic Powers Act) have been used to deny export privileges and financial access to Chinese firms known to support Beijing’s global surveillance infrastructure. New initiatives that “double down” on these resources is imperative.

The deployment of Chinese SIGINT facilities in Cuba is a dangerous expansion of China’s intelligence capabilities, directly impacting U.S. national security. The proximity of these installations to the U.S. mainland enhances their potential to intercept sensitive communications and monitor military activities. Without cooperation from the Cuban government, counterintelligence efforts to detect, deter, and neutralize Chinese FIE threats must evolve to address the “near home” espionage, subversion and/or sabotage capability. As global power dynamics change, largely due to the PRC’s efforts to remake the international order to suit its strategic needs, robust SIGINT capabilities of our own and vigilant counterintelligence measures remain essential methods of addressing the “Cuba is a PRC Espionage Platform” paradigm.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

Bibliography

Bureau of Industry and Security, U.S. Department of Commerce. Entity List Additions: Huawei and Affiliates. Washington, D.C., May 16, 2019. https://www.bis.doc.gov.

Center for Strategic and International Studies. “Secret Signals: Decoding China’s Intelligence Activities in Cuba.” Hidden Reach. May 2025. https://features.csis.org/hiddenreach/china-cuba-spy-sigint/.

———. “A Snapshot of New Activity at Cuban Spy Sites.” Hidden Reach Snapshots. May 2025. https://features.csis.org/hiddenreach/snapshots/cuba-china-cdaa-base/.

Congressional Research Service. Foreign Investment and National Security: Economic Considerations. CRS Report R46554. Washington, D.C., 2023. https://crsreports.congress.gov.

Director of National Intelligence. National Counterintelligence Strategy of the United States of America, 2020–2022. Washington, D.C.: Office of the Director of National Intelligence, 2020. https://www.dni.gov/files/NCSC/documents/features/20200205-National_CI_Strategy_2020_2022.pdf.

Gertz, Bill. “China Suspected of Using Four Cuban Bases to Spy on U.S.” The Washington Times, May 7, 2025. https://www.washingtontimes.com/news/2025/may/7/inside-ring-china-suspected-using-4-cuban-bases-spy-us/.

Information Resource Program. China: Signals Intelligence. Federation of American Scientists (FAS). Last modified 2017. https://irp.fas.org/world/china/program/sigint.htm.

National Security Agency. “Cybersecurity Collaboration Center: Threat Intelligence Sharing.” Accessed May 24, 2025. https://www.nsa.gov/Cybersecurity/Cybersecurity-Collaboration-Center/.

Office of Foreign Assets Control. Sanctions Programs and Information. U.S. Department of the Treasury. Accessed May 24, 2025. https://home.treasury.gov/policy-issues/office-of-foreign-assets-control-sanctions-programs-and-country-information.

U.S. Congress. Foreign Investment Risk Review Modernization Act of 2018. Public Law No: 115-232, §1701-1728. 132 Stat. 2173.

U.S. Department of Justice. China Initiative Cases Summary. Accessed May 24, 2025. https://www.justice.gov/nsd/information-about-department-justice-s-china-initiative-and-compilation-china-related.

U.S. Department of State. Bureau of International Narcotics and Law Enforcement Affairs (INL): Program Summaries. Washington, D.C., 2024. https://www.state.gov/inl-programs/.

U.S. Government Accountability Office. Cybersecurity: Agencies Need to Fully Establish Risk Management Programs and Address Challenges. GAO-19-384. Washington, D.C.: GAO, July 2019. https://www.gao.gov/products/gao-19-384.

U.S. House Permanent Select Committee on Intelligence. The Threat of Foreign Surveillance: Hearing Before the House Intelligence Committee. 117th Cong., 2nd sess., February 2024.

Posted on

Intelligence Community Data Consortium: OSINT, Balancing National Security and Civil Liberties

OSINT, inteligencia, CNI, contrainteligencia, contraespionaje, espionaje, c. constantin poindexter

The Office of the Director of National Intelligence (ODNI) has unveiled plans for the Intelligence Community Data Consortium (ICDC), a centralized platform designed to streamline the acquisition of commercially available information (CAI) by the Intelligence Community. This initiative aims to enhance data accessibility and efficiency across the I.C. However, the ICDC has sparked a traditional FISA-like debate regarding its implications for the privacy rights of American citizens and the potential erosion of constitutional protections.

Understanding the ICDC Initiative

The ICDC represents a concerted effort by the U.S. intelligence community to modernize and centralize the procurement of CAI. According to the official solicitation documents, the ICDC is envisioned as a “marketplace to query and interact with vendor holdings,” emphasizing a “zero-copy” architectural goal where data is queried in place on vendor systems rather than being copied to government servers. This approach is intended to reduce data duplication and enhance operational efficiency. The platform is designed to operate entirely at the unclassified computing level, with all work remaining unclassified. It will offer multiple data interaction options, including indexed GUI/WUI search, API calls, bulk data access, and external web portal login options. The use of open-source code and adherence to industry standards such as OpenAPI Specifications are highlighted here in order to ensure flexibility and prevent vendor lock-in.

Potential Dangers to Innocent Americans

While the ICDC aims to improve intelligence operations, it raises several concerns regarding the privacy of innocent Americans.

The scope of data collection is problematic. Scooping up masses of information about persons absolutely free of suspicion or interest to the I.C. is the proverbial eight-hundred-pound gorilla in the room. The ICDC facilitates access to vast amounts of personal data, including location information, biometric records and online activities, without the need for traditional legal authorizations such as those provided by the FISA Court. This expansive data collection will likely encompass information about individuals not under any suspicion, a clear privacy infringement.

A lack of transparency and oversight is second only to the activity itself. The centralized nature of the ICDC effectively obscures the nature, depth and breadth of acquisition activities. Without robust oversight mechanisms, there is a risk of misuse and overreach by I.C. member agencies. Again, this is potentially an infringement on the rights of citizens.

Uncontrolled CAI acquisition will erode Fourth Amendment protections. Deep investigation of U.S. persons without warrants or court approvals challenges the protections afforded by the Fourth Amendment, a guard against unreasonable searches and seizures. The ICDC’s operations set up a precedent for circumventing these constitutional safeguards.

There is a high potential for abuse. The consolidation of personal data in a centralized platform increases the risk of unauthorized access and misuse. In the absence of stringent access controls and auditing mechanisms, there is a heightened potential for abuse of sensitive information.

Balancing National Security and Constitutional Protections

The primary justification for the ICDC is the enhancement of national security through improved intelligence capabilities. Proponents argue that streamlined access to CAI enables more effective threat detection and response. However, this must be balanced against the fundamental rights enshrined in the Constitution. The Fourth Amendment serves as a critical check on government power, ensuring that citizens are protected from unwarranted intrusions into their private lives. The ICDC’s approach to data acquisition bypasses traditional legal processes and thus poses a significant threat to these protections. Further, the potential for mission creates significant concerns about the long-term implications for civil liberties. Without clear boundaries and oversight, the ICDC could become a tool for pervasive surveillance, undermining public trust in government institutions. The Panopticon will have arrived.

Safeguarding Privacy

While perils exist, so do controls that can mitigate the risks associated with the ICDC. The establishment of clear legal frameworks is a good start. Legislation must define the scope and limitations of data collection activities, ensuring that they align with constitutional protections and privacy rights. Robust oversight mechanisms, much like FISA must be established. Independent oversight bodies must be empowered to monitor the ICDC’s operations, conduct audits, and enforce compliance with legal and ethical standards. Transparency must be the guiding rule. The intelligence community should be obligated to provide regular reports on data acquisition activities including the types of data collected, the purposes for which it is used, and the safeguards in place to protect privacy. Those reports can and should be the basis for engagement with civil society organizations, privacy advocates, and the public. Being open about this will foster a more informed discourse on the balance between national security and those individuals and groups affected by the OSINT activity.

The Intelligence Community Data Consortium represents a significant shift in how the U.S. intelligence community accesses and utilizes commercially available information. While it offers potential benefits for national security, it also poses substantial risks to the privacy and constitutional rights of American citizens. To ensure that the pursuit of security does not come at the expense of civil liberties, it is imperative to establish clear legal frameworks, robust oversight, and transparent practices that uphold the principles of a democratic society.

~ C. Constantin Poindexter, MA Intelligence, Grad. Cert. Counterintelligence, JD, CISA/NCISS OSINT cert., DoD/DoS BFFOC

References

Office of the Director of National Intelligence. (2025). OSINT Contract Framework. Retrieved from ODNI Document

The Intercept. (2025, May 22). US Plans Data Portal to Expand Warrantless Surveillance. Retrieved from The Intercept Article

Wired. (2025, May 24). Security News This Week: The US Is Building a One-Stop Shop for Buying Your Data. Retrieved from Wired Article

Brennan Center for Justice. (n.d.). The Intelligence Community’s Policy on Commercially Available Data Falls Short. Retrieved from Brennan Center Article

U.S. Senate. (2023). Privacy Act of 1974. Retrieved from Wikipedia Article

U.S. Senate. (2023). Foreign Intelligence Surveillance Act. Retrieved from Wikipedia Article

Wired. (2023, November 20). Secretive White House Surveillance Program Gives Cops Access to Trillions of US Phone Records. Retrieved from Wired Article

AP News. (2023, September 28). A Key US Government Surveillance Tool Should Face New Limits, a Divided Privacy Oversight Board Says. Retrieved from AP News Article

Time. (2024, March 15). Inside the White House Program to Share America’s Secrets. Retrieved from Time Article

AP News. (2024, March 10). Book Review: ‘Means of Control’ Charts the Disturbing Rise of a Secretive US Surveillance Regime. Retrieved from AP News Article

Posted on

A Ghost in the Machine: Chinese FIS Covert Collection Devices in Solar Inverters

espionage, spy, sabotage, subversion, intelligence, counterintelligence, counterespionage, c. constantin poindexter

National security operatives have found communication devices embedded within Chinese-manufactured solar power inverters and batteries, again raising significant concerns about the security of critical energy infrastructure. These devices, capable of bypassing established cybersecurity measures, appear to be capable of remote manipulation. Successful exploitation could lead to widespread power grid disruption. The following is my take on the technical aspects of the devices, design and data transmission methodologies, the potential locations of data collection receivers, and if their deployment aligns with known Chinese Foreign Intelligence Service (FIS) models and methodology. The following is based on my review of NON-CLASSIFIED INFORMATION.

The integration of renewable energy sources into U.S. power grids has been a cornerstone of our efforts to combat climate change. Central to this integration are power inverters, devices that convert direct current (DC) from solar panels and wind turbines into alternating current (AC) suitable for distribution across the power grid. We now have a really disconcerting development: the discovery of rogue communication devices within Chinese-manufactured inverters and batteries.

Device Composition and Integration

Investigations have revealed that certain Chinese-made solar inverters and batteries contain undocumented communication modules, including cellular-like mechanisms. These components are not listed in product specifications and are capable of establishing independent communication channels, effectively bypassing existing cybersecurity firewalls . The presence of such modules allows for potential remote access and control. (More about this in the counterintelligence section below.) These devices are covertly integrated into the hardware of the inverters and batteries making detection challenging during normal inspections. Their design suggests a deliberate effort to conceal them. The functionalities that can be activated remotely are also a BIG red flag. The integration of these components indicates a high level of sophistication and planning, aligning with tactics observed in state-sponsored cyber-espionage and sabotage operations.

Communication Channels

The devices appear to utilize various communication methods to transmit data, including cellular networks, perhaps local bluetooth-like transmission and potential satellite communications. The use of satellite communication modules such as the Iridium 9603 allows for global coverage and low-latency transmission. This feature would enable remote control capabilities even in areas with limited terrestrial network access .

Data Exfiltration and Command Reception

These communication modules can facilitate both the exfiltration of data from the energy platforms and the reception of remote commands. This bidirectional communication capability poses enormous risks because of the potential extraction of sensitive information and the execution of commands that could disrupt or damage energy infrastructure.

Potential Locations of Data Collection Receivers

The specific locations of collection receivers are classified, however, the nature of the communication methods suggests that data could be transmitted to centralized servers managed by entities affiliated with or under the influence of Chinese FIS. The use of satellite communications makes the identification of data endpoints complicated, as signals can be received from literally any point on the globe. The Chinese station in Cuba would be convenient, however, given China’s extensive global infrastructure and technological reach, it is plausible that transmissions could be routed through multiple international nodes before reaching a final collection point.

Alignment with Chinese Foreign Intelligence Service Models

China’s National Intelligence Law mandates that all organizations and citizens support, assist, and cooperate with state intelligence operations. This legal framework provides Chinese FIE with broad authority to compel companies to integrate surveillance and data collection mechanisms into their products. The deployment of rogue communication devices in energy infrastructure aligns with this model, facilitating intelligence gathering and potential sabotage capabilities. Chinese FIS operations employ a combination of cyber and HUMINT tactics to penetrate foreign systems. The integration of clandestine communication devices into critical infrastructure represents yet another example of these tactics, blending hardware manipulation with cyber capabilities. These tactics are consistent with the strategy of the Ministry of State Security and the People’s Liberation Army’s intelligence units that seek to enhance China’s advantages through technological means.

Implications for Global Energy Security

The discovery of these devices in solar components has grave implications for U.S. energy grid security. The potential for remote manipulation of power systems threatens not only the stability of national grids but also the safety and well-being of populations reliant on consistent energy delivery. The erosion of trust in international supply chains is also a grave peril, leading to increased protectionism and damage to global trade relationships. The integration of undocumented communication devices into Chinese-manufactured solar inverters and batteries represents a grave security concern. The technical sophistication of these components, coupled with their potential alignment with Chinese FIS objectives, underscores the need for new scrutiny and enhanced TSCM practices with regards to foreign-manufactured critical infrastructure components.

The Counterintelligence View

This is a bit technical so bear with me. There is a method to the madness. Problem 1: Inverters are generally equipped with ARM Cortex-M or Cortex-A series microcontrollers that serve as the core processing units for power conversion and monitoring. The covert components appear to use separate, low-power System-on-Chip (SoC) devices (think “MediaTek MT6261D or Espressif ESP32-S3 series”) which deploy onboard baseband processors capable of handling GSM/3G/4G/LTE communications. These SoCs are preloaded with proprietary firmware and operate outside the visibility of the host inverter firmware. These covert devices appear to use integrated RF transceivers on GSM bands, contain embedded GPS modules for geolocation, and have I2C or UART interface capability for stealth data siphoning from inverter controller. Unless there is a simple process for detecting the very small loss of power or disabling the cellular capability, the entire product must be scrapped. Jamming transmissions is not a feasible countermeasure considering the enormous geographic dispersion of a popular solar system component.

A transmission requires a collection part, a transmitter, something that functions as an antenna, and a power source. Problem 2: There is a redundant power supply path. Some units tap the inverter’s DC bus (48V nominal) deploying step-down DC-DC converters to deliver the 3.3V/5V required by the communication hardware. So, the shit-rogue device can acquire and/or broadcast even if the main inverter is powered down (assuming there is residual DC input from the solar panels or battery storage). Sophisticated design is evidenced by minimal-energy storage to allow burst transmissions, EMI shielding to reduce signatures and transient suppression to avoid triggering protective circuits. Again, there may not be any feasible technical countermeasure other than tossing the entire thing in the garbage.

Problem 3: Perhaps the most concerning feature is the presence of covert communication interfaces. The presence of miniature embedded GSM modules that can transmit over mobile networks is a clear indicator of the device’s true purpose. These can be paired with internal PCB-trace antennas which makes detection extremely difficult without picking the entire product apart and/or conducting a full-spectrum TSCM RF analysis. Some units, notably ones used in off-grid or critical infrastructure installations, contain Iridium 9603 transceivers. The Iridium Short Burst Data (SBD) service enables low-latency two-way messaging literally anywhere on Earth. BLE 4.0/5.0 (“Bluetooth”) modules are sometimes embedded to allow nearby short-range device pairing, enabling covert firmware updates or configuration changes via proximity-based access. From a counterintelligence perspective this one is the easiest to detect as it requires the presence of field operatives.

Problem 4: Collection and hijack are extremely problematic. The rogue devices are capable of silently intercepting inverter data via UART snooping of RTU traffic between the inverter controller and grid management mechanisms. RS-485 differential signal bridging architecture in these devices allows simultaneous passive read and active command injection. So, not only can they passively collect performance, grid sync, and telemetry but also insert remote commands (think “demand spikes, phase shifts, or false trip signals”) which could destabilize grid operations. Countermeasure? The garbage bin.

In truth, we are fortunate to have discovered this attempt to compromise these components. Once operational, detection would have been extremely difficult. The unclassified exhibits demonstrate very sophisticated anti-forensic features. They present obfuscated PCB silkscreening or black conformal coating as a physical deception, RF shielding within inverter chassis grounding, no identifiable MAC addresses and time-triggered sleep cycles which makes TSCM useless unless the sweep is conducted at the exact moment of a transmission. Encrypted communication via proprietary, obfuscated firmware (AES-128 in CTR) further points a finger at a sophistication attributable to state-level FIS. China’s intelligence doctrine views everything; commerce, academia, and even kids’ toys as vectors and to their advantage. Chinese “unrestricted warfare” doctrine, i.e., any mass-produced consumer or industrial good may serve as a channel for acquisition or disruption, explains the rogue components in solar inverters, another part of a larger, systematic effort to weaponize supply chains and exploit technological dependencies.

~ C. Constantin Poindexter, Master in Intelligence Studies, Graduate Certificate in Counterintelligence, CISA/NICCS OSINT Certified

References

Reuters. (2025, May 14). Rogue communication devices found in Chinese solar power inverters. Retrieved from: https://www.reuters.com/sustainability/climate-energy/ghost-machine-rogue-communication-devices-found-chinese-inverters-2025-05-14/

TechRadar. (2025, May 14). Chinese energy tech exports found to contain hidden comms and radio devices. Retrieved from: https://www.techradar.com/pro/security/chinese-energy-tech-exports-found-to-contain-hidden-comms-and-radio-devices

DIY Solar Forum. (2025, May 14). Rogue Chinese communication devices found in Solar inverters. Retrieved from: https://diysolarforum.com/threads/rogue-chinese-communication-devices-found-in-solar-inverters.104871/page-4

Wikipedia. (2025, April). National Intelligence Law of the People’s Republic of China. Retrieved from: https://en.wikipedia.org/wiki/National_Intelligence_Law_of_the_People%27s_Republic_of_China

Jamestown Foundation. (2024, March). Foreign Intelligence Hackers and Their Place in the PRC Intelligence Community. Retrieved from: https://jamestown.org/program/foreign-intelligence-hackers-and-their-place-in-the-prc-intelligence-community/

Posted on

Russian Intelligence Plot Against European Air Cargo

russian FIS, intelligence, espionage, subversion, sabotage, counterintelligence, c. constantin poindexter

Recent reporting of a disturbing plot orchestrated by Russian FIS targeting European air cargo networks, potentially including flights bound for the United Kingdom has raised the “grey zone” warfare being waged against the West. A fairly sophisticated operation, reportedly involving the placement of incendiary devices within seemingly innocuous parcels carried by logistics giant DHL, underscores the evolving and increasingly brazen nature of adversarial hybrid warfare campaigns against Western nations. While the Kremlin has denied involvement, the convergence of evidence and assessments from multiple European security agencies paints an ugly picture of a deliberate and dangerous attempt to disrupt critical infrastructure and sow chaos. I am NOT going to provide instruction on how to make a thermostat mercury tube and block of magnesium into something useful, offer detail on attack surfaces, nor placement logistics however knowledge of the plot, briefly stating the nature of the devices employed, the chosen attack vector, the timing of the discovered incidents, the suspected involvement of Russian intelligence services, and a brief assessment of the potential effectiveness and broader implications of such an operation are fine for open source commentary.

The devices were not conventional high explosives designed for immediate, destructive detonation. Non-classified reports suggest the use of incendiary mechanisms concealed within ordinary consumer goods shipped through standard air cargo channels. Details emerging from investigations in Germany, the United Kingdom, and Poland indicate that items such as massage pillows and sex toys were used as Trojan horses to smuggle these components into the logistics network. The incendiary nature of the devices is a critical aspect, suggesting that the actors were not focused on instantaneous structural failure of an aircraft but rather on initiating a fire within the cargo hold. At cruising altitude a fire presents a severe threat capable of compromising the aircraft’s structural integrity, affect flight control systems, and/or produce incapacitating smoke and fumes.  

NO blueprints here! However, the reported outcomes of their ignition provide clues about their composition and design. That the incidents occurred in logistics hubs on the ground in Germany and the UK rather than in flight suggests a timing mechanism designed for delayed activation. This delay could have been triggered by a variety of methods, such as a timer, barometric pressure changes (simulating altitude), or simple friction or impact during transit. Camouflage as harmless consumer electronics points to a degree of technical sophistication aimed at bypassing standard security screening protocols, which are primarily geared to detecting traditional explosives and weapons. German authorities, in testing replicas of the devices, reportedly found that fire suppression systems typically installed in aircraft cargo holds might not be sufficient to extinguish the fires initiated by these incendiaries. The operators clearly conducted research into the vulnerabilities of air cargo safety measures. The selection of materials that burn intensely and are difficult to suppress, such as certain metallic compounds or accelerants, is consistent with the objective of causing an uncontainable fire.

The choice of the air cargo network as the attack service highlights several strategic considerations for adversarial FIE. Air cargo is a vital component of global commerce, moving vast quantities of goods rapidly across international borders. Targeting this network allows for potential disruption on a significant scale, impacting supply chains and causing economic damage. Cargo planes, while subject to security measures generally do not have the same level of stringent passenger screening associated with commercial passenger flights. They are softer targets for introducing illicit devices. The distributed nature of cargo handling across numerous facilities and the sheer volume of packages processed daily also present opportunities for effective camouflage and smuggling. Utilizing established courier services like DHL, with their extensive networks and trusted reputation, leveraged existing infrastructure for Russia’s ends, blending the dangerous parcels with legitimate shipments to reduce suspicion.  

The timing of the discovered incidents in July 2024, is noteworthy. These events occurred within the broader context of Russia’s ongoing full-scale invasion of Ukraine and heightened tensions between Russia and Western countries providing support to Kyiv. Western officials have increasingly warned of an intensification of Russian hybrid warfare. “Grey zone” operations that include sabotage, cyberattacks, and disinformation are distinctively Russian and likely aimed at undermining support for Ukraine and destabilizing European societies. This sort of kinetic act of sabotage with potentially far-reaching consequences aligns with the I.C.’s understanding of Russian FIS’s pattern of escalation. The incidents in July 2024 in Germany and the UK appear to be “test runs,” intended to assess the feasibility of the method and the reaction of security agencies before execution of a more widespread and/or impactful attack. We have good cause to be concerned with the likelihood of the targeting of flights destined to North America. The subsequent arrests in Poland and Lithuania in the latter half of 2024 evidence that investigations advanced quickly, certainly through intelligence liaison with European security services.  

Attribution requires compelling evidence, often gathered through covert means, however, the consistent assessment by multiple Western security agencies pointing towards Russian FIE, specifically the GRU (Main Intelligence Directorate of the General Staff), should surprise no one. The GRU has a documented history of engaging in aggressive foreign operations, including sabotage, assassination attempts and cyberattacks, often conducted with a high degree of risk tolerance and a willingness to operate in a gray area between conventional warfare and deniable covert action. Their involvement in previous incidents on European soil, such as the Sergei Kripal assassination attempt, demonstrate Russia’s capability and intent to carry out dangerous operations abroad.  

There are more specifics that give us good reason to point to the GRU. The nature of the operation, a covert act of sabotage targeting critical infrastructure in countries supporting Ukraine, aligns with Russia’s strategic objectives in its conflict with the West. Disrupting logistics networks, creating fear and uncertainty serves to pressure governments and populations supporting Ukraine. The use of “disposable agents” or recruited individuals in various European countries to handle the parcels is consistent with known GRU tradecraft, which often utilizes cut-outs to maintain plausible deniability. The arrests in Poland and Lithuania were of individuals from different nationalities, suggesting a network of recruited operatives rather than directly deployed intelligence officers. Further, comm. intercepts revealed discussions among senior GRU officials regarding the plot, providing direct evidence of the involvement of Russian FIS. The Kremlin’s standard practice of flatly denying involvement does NOT refute the I.C.’s assessments and attribution.  

The effectiveness of the explosive/incendiary device and its attack service must be assessed on multiple levels. From a technical standpoint, an incendiary device capable of initiating an uncontrollable fire in an aircraft cargo hold at altitude is highly effective at creating a catastrophic in-flight emergency. Modern cargo planes have sophisticated fire detection and suppression systems, but if the fire source is resistant to the suppression agents (like halon or nitrogen), or if the fire spreads rapidly before suppression is effective, the consequences can be dire. The potential for loss of the aircraft and its cargo, as well as the risk to populated areas if a crash were to occur, makes this a high-impact peril. German authorities’ findings regarding the potential ineffectiveness of fire suppression systems against the tested replicas should make the hair on your neck stand up.

From an operational perspective, the attack service (legitimate air cargo network) was effective in allowing the devices to penetrate security layers and reach their intended environment. The volume and speed of air cargo movement make comprehensive, item-by-item security screening a significant logistical challenge. By concealing the incendiaries within seemingly innocuous items and utilizing established shipping routes, the operators exploited inherent vulnerabilities in this system. The incidents in July 2024, demonstrated that the devices could be successfully introduced into the network and ignite, thereby validating the initial stages of the attack methodology and giving the GRU proof of concept They just didn’t count on the unintended early ignition. The plot was ultimately disrupted, indicating limitations in the overall effectiveness of the methodolgy, however, the GRU learns from its mistakes. Early ignition of the devices on the ground, while potentially providing valuable data to the perpetrators, also served as a big red flag to security agencies allowing for rapid investigation, intelligence sharing, and the apprehension of individuals involved, thereby preventing in-flight incidents. These were described as “test runs” so the operation was likely still in an experimental phase. The premature ignitions forced the perpetrators’ hand and exposed the plot before it could be realized on a larger scale.

The broader effectiveness must also be considered in the context of Russian hybrid warfare objectives. The successful downing of a cargo plane would create significant shock and disruption, even the exposure of such a plot serves Russia’s goals of sowing fear, demonstrating capability, and forcing Western nations to expend resources on the enhancement of security measures. The psychological impact of knowing that potentially dangerous devices could be present in everyday shipments carried by air can and will erode public confidence in transportation networks. Further, attribution of the plot to Russian FIS exacerbates existing tensions and reinforces the narrative of Russia as a hostile and unpredictable actor.

Russian FIS’s plot to plant incendiary devices on DHL cargo planes flying over Europe represents a serious and sophisticated attempt to conduct sabotage against Western infrastructure. The use of concealed incendiary devices, the exploitation of the air cargo network, and the involvement of the GRU align with Russia’s broader hybrid warfare strategy. Russia’s plan exposed vulnerabilities in air cargo security and highlighted the persistent threat posed by adversarial FIEs generally, and Russia more specifically. The incident serves as a stark reminder of the need for continued vigilance, enhanced security measures, and robust intelligence liaison to counter covert bullshit of this nature that are clearly aimed at destabilizing global systems. The plot underscores the evolving landscape of Russia’s willingness to do engage in unacceptable methods, international security more broadly, and the critical importance of understanding the motivations, methods, and capabilities of adversarial intelligence services.

Sources:

Associated Press. (2024, November 5). Western officials suspect Russia was behind a plot to put incendiary packages on cargo planes. PBS NewsHour.
 
Business Standard. (2024, November 5). Russia suspected of plotting to send incendiary devices to US on planes. Business Standard.
 
CSIS. (n.d.). Russia’s Shadow War Against the West. Center for Strategic & International Studies.

EUvsDisinfo. (2024, November 26). Disinfo: The West organised the DHL cargo plane crash in Vilnius to blame Russia. EuvsDisinfo.
 
Newsweek. (2024, November 5). Russia Suspected of Plot to Put Incendiary Devices on US-Bound Planes. Newsweek.

Politico.eu. (n.d.). Europe is under attack from Russia. Why isn’t it fighting back? Politico.eu.

Radio Free Europe/Radio Liberty. (n.d.). A Russian Airline Bomb Plot? What We Know About The Polish PM’s Accusations. Radio Free Europe/Radio Liberty.

The Record. (2024, November 5). Lithuania: Russian military intelligence behind plot to parcel bomb cargo planes. The Record.

UNN. (n.d.). Incendiary devices in parcels in Europe: Russian intelligence services are behind the sabotage – investigation. UNN.

UNITED24 Media. (2024, October 15). Suspected Russian Sabotage Nearly Caused German Plane Crash, German Intelligence Chief Says. UNITED24 Media.

Posted on

The DeepSeek Threat: A Counterintelligence and National Security Concern

deepseek, intelligence, counterintelligence, espionage, counterespionage, export control, spy

Artificial intelligence (AI) is emerging as a transformative force in global economic, technological and military domains. Among the newest threats in the domain of adversarial AI is “DeepSeek,” a China-based generative AI platform. According to the bipartisan House Select Committee on the CCP, DeepSeek poses a serious national security risk to the United States, and I pose a grave counterintelligence one as well. I agree with the Committee’s four primary findings regarding DeepSeek and have included here some corroborating evidence and light analysis of the platform’s broader counterintelligence implications.

I. Data Funnel to the PRC through Military-Linked Infrastructure

DeepSeek funnels Americans’ data to the PRC through backend infrastructure connected to a U.S.-sanctioned Chinese military company. This is consistent with open-source cybersecurity and export control reporting. DeepSeek is affiliated with Beijing DeepSeek Technology Co., which maintains close technical cooperation with state-controlled firms like Tsinghua Tongfang Co., a subsidiary of China Electronics Corporation (CEC), a company sanctioned by the U.S. Department of Defense for its affiliation with the People’s Liberation Army (PLA). U.S. officials have long warned that Chinese firms (even ostensibly private ones) are legally required under China’s 2017 National Intelligence Law to support state intelligence activities. Thus, even passive collection of user queries and metadata from American users can be directly routed to China’s military-civil fused architecture. Cloud traffic analysis tools confirm that some of DeepSeek’s endpoints resolve to IP addresses controlled by Alibaba Cloud and Huawei Cloud, two platforms repeatedly identified for surveillance and data harvesting risks.

II. Covert Propaganda Alignment with CCP Objectives

DeepSeek’s second threat involves covert manipulation of search and response results to align with CCP propaganda. Chinese 2021 ‘Regulations on Recommendation Algorithms’ mandates that AI systems uphold “core socialist values.” Content analysis of DeepSeek’s outputs reveals alignment with these mandates. For instance, when queried about events such as the Tiananmen Square massacre or Uyghur internment camps, DeepSeek either deflects, omits content, or offers CCP-aligned narratives. This contrasts with U.S.-based LLMs that provide factual accounts supported by open-source citations. This form of algorithmic censorship mirrors practices deployed by Baidu and Sogou and serves as a soft power tool for narrative control.

III. Theft of U.S. AI Models through Distillation Techniques

The Committee finds that DeepSeek likely used model distillation to unlawfully replicate U.S. LLMs, a postulate supported by emerging AI security analyses. Distillation, a process whereby a smaller model is trained to mimic a larger one, is legal when trained on open data but when done using unauthorized API access or scraping against licensed outputs, it constitutes intellectual property theft. Reports from AI security firm Mithril Analytics suggest that DeepSeek’s model shows pattern duplication, formatting, and semantic behavior strikingly similar to OpenAI’s GPT-3.5 and Anthropic’s Claude-1.6 This aligns with China’s broader strategy of intellectual property misappropriation, which the Office of the U.S. Trade Representative has labeled a “national policy.”

IV. Use of Prohibited NVIDIA Chips in Defiance of U.S. Export Controls

The fourth finding, that DeepSeek operates on advanced U.S.-made chips which circumvent export restrictions, reflects a broader problem of enforcement challenges in U.S. semiconductor control policy. According to internal supply chain tracking data and reporting from The Information and Reuters, DeepSeek appears to operate on thousands of NVIDIA A100 and H100 GPUs. These high-performance chips were restricted for export to China under the Biden Administration’s 2022 CHIPS Act enforcement measures. Nevertheless, Chinese AI companies have procured these processors through shell companies and resellers in Singapore, Hong Kong, and the UAE. The massive computing power needed to train and operate a GPT-scale model would be nearly impossible without these restricted components, confirming that DeepSeek benefits from illicitly obtained U.S. hardware.

Counterintelligence Threat of DeepSeek

DeepSeek poses a significant and multifaceted counterintelligence threat to the United States and its allies. The platform’s capacity to collect metadata, behavioral data, and potentially personally identifiable information (PII) from Americans creates an intelligence bonanza for Chinese FIS. Unlike traditional espionage, AI systems like DeepSeek operate invisibly and at scale, accumulating user data that can be used for profiling, influence operations, and further AI training purposes that effectively turn every American interaction into an exploitable data point.

DeepSeek represents a vector for information warfare. By manipulating answers to politically sensitive questions, promoting false equivalency in authoritarian narratives, and suppressing democratic values, the platform operates as a digital emissary of the CCP’s ideological and subversive goals. Such influence is subtle, persistent, and if not countered, capable of reshaping discourse as we have observed within our own political discourse.

The use of stolen U.S. intellectual property to build DeepSeek creates long-term strategic disadvantage. This is not a new peril. Not only does IP theft compromise American innovation, but it enables a hostile foreign power to accelerate its AI capability with limited investment. The widespread use of DeepSeek in academic or research settings could further enable China to monitor cutting-edge developments in Western institutions of higher education, R&D laboratories and to conduct surveillance on American professionals for recruitment by Chinese FIS or its allied FIEs.

Further, the misuse of restricted U.S. technology in DeepSeek is a direct challenge to the U.S. export control regime. The failure to prevent such chips from reaching adversarial AI projects undermines the deterrent effect of these restrictions and signals enforcement vulnerabilities to other hostile actors. This threat is potentially multiplicative as the CCP may allow restricted technology delivery to other state and non-state threat actors.

These grave threats demand a comprehensive counterintelligence and more broadly, national security strategy, one that includes aggressive export control enforcement, increased funding for AI provenance tracking, sanctions against companies that enable illicit procurement, and public awareness campaigns warning users of the risks posed by foreign AI platforms. Data is NOT merely informational. It is strategic. DeepSeek, if left unchecked, could be the spearhead of the CCP’s broader ambition to dominate the next frontier of digital power.

~ C. Constantin Poindexter, MA in Intelligence Studies, Graduate Certificate in Counterintelligence, JD, NICCS/CICS Certified OSINT

Footnotes

U.S. Department of Defense. “DOD Releases List of Additional ‘Communist Chinese Military Companies’ Operating in the U.S.” (2020).

National Intelligence Law of the PRC, Articles 7 and 10 (2017).

Recorded Future. “Chinese Cloud Providers and the Global Data Exfiltration Risk.” (2023).

Cyberspace Administration of China. “Provisions on the Administration of Algorithmic Recommendation for Internet Information Services.” (2021).

Freedom House. “China’s Model of Digital Authoritarianism.” (2022).

Mithril Analytics. “Behavioral Fingerprinting of LLMs: Identifying Unauthorized Model Replication.” (2024).

Office of the U.S. Trade Representative. “2023 Special 301 Report on Intellectual Property Rights.”

The Information. “Inside China’s Underground Chip Market.” (2024).

Reuters. “Exclusive: China’s AI Firms Bypass U.S. Chip Ban with Grey Market Imports.” (2024).

Posted on

Disinformation as “Insurgency”, an American Constitutional View

disinformation, misinformation, espionage, counterespionage, counterintelligence, spy, subversion, psyops

I read with a great deal of interest Jacob Ware’s article “To fight disinformation, treat it as an insurgency” that appeared recently in The Strategist, an Australian Strategic Policy Institute publication. I have always held my own ideas about disinformation, more specifically “inoculation” as a countermeasure and recommending instruction from a very young age much as grade schools do in the baltic states. Ware’s article tackles the subject matter as a ‘control social media’ issue. I do not disagree with the importance of media responsibility for moderation of certain types of content, Ware appropriately identifies “overlook[ing] the important role of digital consumers”, but doubles down on content control. The article suggests that social media companies, as central nodes in the information ecosystem, must be pressured into moderating content more aggressively as much as the importance of digital consumers themselves being hardened against manipulation (“inoculation” as I have written in previous scholarship”. Control, compelling in its framing, raises some not insignificant constitutional issues in the context of the United States, particularly with regard to the First Amendment’s protections of speech, association, and press.

Framing Disinformation as Insurgency: Strategic and Legal Ramifications
Ware’s analogy between insurgencies and disinformation campaigns conveys the existential threat that hostile narratives, particularly those that foreign actors pose to democratic stability. Comparing disinformation actors to terrorist insurgents invites the application of military-style containment and suppression tactics, perhaps even the “cyber-kinetic” removal of bad actors (i.e., content moderation and bans), the targeting of ideological hubs (e.g., online communities, networks, influencers, etc.), and critically, the enforcement of norms through government-backed initiatives.

In the U.S. legal context, much of this may be a non-starter. Insurgents and terrorists operate outside the protection of constitutional law, whereas digital speakers, however misinformed or malicious, are presumptively entitled to the protections of the First Amendment. The Constitution does not permit the government to silence unpopular, false or even offensive ideas unless they meet strict criteria for incitement, true threats, or defamation. This legal boundary sharply limits the government’s ability to treat digital speech as a national security threat without triggering robust judicial scrutiny, even if that information is objectively dangerous disinformation.

Section 230 and Platform Immunity: The Epicenter of the Debate
The article criticizes Section 230 of the Communications Decency Act (1996), which shields internet platforms from liability for user-generated content. This statute is often viewed as the legal linchpin that enabled the growth of the modern internet, on the whole a pretty positive thing. Ware argues that these protections prevent platforms from being held accountable and serve as a digital safe haven for malign actors. From a policy standpoint, this critique doesn’t hold much merit. Critics across the political spectrum argue that Section 230 incentivizes platforms to prioritize engagement and profit over truth and social stability, however, repealing or modifying Section 230 would not directly authorize government censorship. It WOULD expose platforms to civil liability for failing to moderate. Any new federal statute that imposes content-based restrictions or penalties would need to meet all prongs of the constitutional free speech tests and modern U.S. jurisprudence. The courts have routinely ruled that platforms are private entities with their own First Amendment rights therefore even in the absence of Section 230, the government would not be able to compel social media companies to carry or remove specific content unless it satisfies narrow constitutional exceptions.

Free Speech: A Distinctly American Commitment
A central theme in the article is the frustration that American-style free speech doctrines allow dangerous ideas to circulate freely online. Ware writes from an Australian perspective. The article praises the European Union’s Digital Services Act and Australia’s eSafety initiatives as superlative regulatory models. Under those statutory regimes platforms face stiff penalties for failing to suppress harmful content. These approaches may appear pragmatic but they clearly represent a sharp divergence from U.S. legal culture.

The U.S. Constitution’s First Amendment prohibits government abridgement of speech, including offensive, deceptive, or politically inconvenient speech. In United States v. Alvarez (2012), the Supreme Court struck down a federal law criminalizing false claims about military honors, holding that even deliberate lies are constitutionally protected unless they cause specific, fixable harm. Further, in Brandenburg v. Ohio (1969), the Court established that even advocacy of illegal action is protected unless it is directed to inciting imminent lawless action AND is likely to produce such action. So, even under the noble pretext of national defense, any proposal that seeks to directly regulate speech must reconcile with this robust jurisprudence. Foreign governments might be able to implement speech controls without constitutional constraints. We cannot. The U.S. must address disinformation through less intrusive, constitutionally sound means.

Counterinsurgency in a Civilian Space: Policing Thought and Risking Overreach
Ware’s counterinsurgency metaphor extends beyond moderation into behavioral engineering, winning the “hearts and minds” of digital citizens. This vision includes public education, civilian fact-checking brigades, and a sort of civic hygiene campaign against harmful content. Although such measures may be effective as psychological operations (PSYOPs), the distinction between persuasion and indoctrination must be carefully managed in a free society.

There is legitimate concern that state-sponsored resilience campaigns could slip into propaganda or viewpoint discrimination, especially when political actors define what constitutes “disinformation.” The inconvenient truth is that the label of “misinformation” has been applied inconsistently, sometimes suppressing legitimate dissent or valid minority viewpoints. The First Amendment’s commitment to a “marketplace of ideas theory” assumes that truth ultimately prevails in open debate, not through coercive narrative management.

There is another danger. Using the tools of counterinsurgency, even rhetorically, raises alarms about militarizing civil discourse and legitimizing authoritarian measures under the guise of “national security.” In Boumediene v. Bush (2008), the Court warned against extending military logic to civilian legal systems. Applying wartime strategy to cultural or political disputes in the civilian cyber domain risks undermining the very liberal values the state claims to protect.

An Appropriate Role for Government
Despite consitutional guardrails, the federal government is not powerless. Several constitutionally sound measures remain available. These approaches avoid entangling the government in the perilous business of adjudicating truth while still defending the information ecosystem.:

Transparency Requirements – Congress can require social media companies to disclose their moderation policies, algorithmic preferences, and foreign funding sources without dictating content outcomes.

Education Initiatives – Civics education and media literacy programs are constitutionally permissible and could help inoculate the public against disinformation without coercion.

Voluntary Partnerships – The government can engage with platforms voluntarily, offering intelligence or warnings about malign foreign influence without mandating suppression.

Targeting Foreign Actors – The government can lawfully sanction, indict, or expel foreign individuals and entities engaged in coordinated disinformation campaigns under laws governing espionage, foreign lobbying, or election interference.

Ware’s comparison of disinformation to insurgency is strategically evocative, but its prescriptive implications clash with foundational American principles. The First Amendment might seem inconvenient, but it was designed to prevent precisely the kind of overreach that counterinsurgency measures invite. Democracies do not defeat authoritarianism by adopting its tools of censorship and narrative control. If the United States is to confront the threats of disinformation effectively, it must do so in a way that affirms rather than undermines what makes us distinctively American. Educating, not censoring; persuading, not suppressing; and building durable civic institutions capable of withstanding the torrent of falsehoods without succumbing to the lure of government-controlled truth are imperative. Freedom remains the best antidote to tyranny ONLY if we remain vigilant in its defense.

~ C. Constantin Poindexter,

  • Master of Arts in Intelligence
  • Graduate Certificate in Counterintelligence
  • Undergraduate Certificate in Counterintelligence
  • Former I.C. Cleared Contractor
Posted on

The DNI Report: What is Missing?

seguridad national, espionage, contraespionage, contrainteligencia, c. constantin poindexter

It should come as no surprise in the current polarized political climate that certain threats to U.S. national security are omitted, some overly emphasized and others included but not give a more thorough review. Ironically (or perhaps not so ironically) the omissions and lack of more comprehensive address of certain threat are those very ones that are exacerbated by current Administration policies. The current DNI [unclassified version] contains no surprises, however there are some perils that decidedly lack the attention that they deserve. I’ll be brief.

The weaponization of artificial intelligence against the U.S. population poses and existential threat to the nation that we are not appropriately prepared for. The assessment identifies China’s AI capabilities in surveillance and disinformation, but underestimates the dangers posed by AI-generated disinformation and psychological operations targeting U.S. elections, civil cohesion, and trust in institutions. Synthetic media (deepfakes) at scale are unaddressed and present a very real menace. FIEs that excel in producing these fakes could fabricate major geopolitical incidents and/or falsely incriminate U.S. leaders. This is a “real-world crisis” scenario. Further, in our rush to load up our own AI capability, models trained on U.S. data pose an exposure to having them turned back against us in warfare, negotiation, or economic manipulation contexts. The DNI offers no significant discussion of how adversaries might use advanced LLMs and multi-modal AI to undermine decision-making at every level of our communities, from individual voters and first responders to senior policymakers.

There is a significant danger of the collapse of U.S. domestic infrastructure due to political paralysis and sabotage. The DNI identifies cyber threats to infrastructure (e.g., water, healthcare) however the report understates the systemic vulnerability of U.S. infrastructure to non-digital threats such as aged and neglected critical systems (e.g., bridges, power grids, water systems), and insider sabotage by ideologically motivated actors. White supremacist factionists and extremists like Timothy McVeigh come immediately to mind. Political paralysis and corruption that prevent modernization or resiliency efforts are the final ugly nail in the proverbial coffin. The loss of national security expertise as a result of wholesale firings/layoffs and the sidelining of individuals with decades of tradecraft and professional expertise based on party adherence are a very real threat. The assessment fails to meaningfully consider how polarization and our legislature’s unwillingness to work together are making the U.S. increasingly incapable of protecting or restoring its critical infrastructure after an attack or natural disaster. Don’t think for a moment that Chinese, Russian, Iranian and North Korean FIEs are failing to perceive these vulnerabilities that they can exploit.

Espionage, subversion and other nefarious covert operations against the U.S. and its interests via foreign investment and big-corporate influence are absent. There is really no excuse to omit identification and discussion of how “big money” has affected national security at every level, as even for a layperson is occurring in plain view. China’s cyber espionage and technology theft are addressed in depth, but why are foreign ownership of and influence in U.S. strategic sectors, including agriculture, pharmaceuticals, real estate near sensitive military sites and AI startups left alone? The use of shell corporations and fronting arrangements to embed operatives and proxies within sensitive sectors and policy circles is a serious threat as well. Strategic acquisition of distressed U.S. companies post-COVID by entities linked to FIEs are a mechanism and vehicles for subversion, espionage and sabotage. A brief look at our own history since the end of WWII reveals how these methods are effective and insidious, perhaps presenting a greater danger than cyber-attacks because they provide our adversaries to deep access, deniability and strategic gain that will serve them well for decades. Fragmenting and ‘bull in a china shop’ cancellation of funding paired with broken inter-agency oversight are extremely problematic.

Do better.