Posted on

The Retracted Intelligence Report on TdA

The Retracted Intelligence Report on Tren de Aragua, espionage, counterespionage, intelligence, counterintelligence, strategic intelligence, national security, C. Constantin Poindexter;

The recent retraction of a National Security Agency (NSA) report on Venezuela and the Tren de Aragua (TdA) criminal gang highlights the tension between intelligence assessments and political narratives. The danger of politicization of intelligence work is front and center here. It’s reasonably clear here that the DNI denied release of the full intelligence product because it did not align neatly with the current Administration’s assertions about TdA and Venezuelan President Maduro’s direction, financing and control over its nefarious activities. Boris Bondarev, former diplomat of the Russian Federation reported on his experience in a Far East assignment, “One day, I was called to meet with the embassy’s number three official, a quiet, middle-aged diplomat who had joined the foreign ministry during the Soviet era. He handed me text from a cable from Moscow, which I was told to incorporate into a document we would deliver to Cambodian authorities. Noticing several typos, I told him that I would correct them. “Don’t do that!” he shot back. “We got the text straight from Moscow. They know better. Even if there are errors, it’s not up to us to correct the center.” It was emblematic of what would become a growing trend in the ministry: unquestioned deference to leaders.” (Foreign Affairs, Nov. 2022) The example is instructive of what we do NOT want to be.

The report, “Venezuela: Examining Regime Ties to Tren de Aragua,” declassified in May 2025, offers an analytic picture that contradicts claims made by U.S. political leaders that Nicolás Maduro is actively engaged in supporting, financing, and directing TdA. The NIC assessment concludes that while the gang has benefitted from a permissive environment in Venezuela, including corruption and weak institutional control, there is no credible evidence that Maduro or senior regime officials exercise command over the group. This retraction is striking because it underscores how intelligence assessments that fail to support policy preferences may be subject to extraordinary pressure, despite their analytic rigor.

The NIC report is clear in its findings. It states that TdA leaders have historically benefitted from permissive conditions in Venezuela, particularly weak prison oversight and corrupt officials. That is NO surprise to those of us who have operated in corrupt Latin American states. Yet it stresses that many TdA cells operate independently across Latin America, with limited coordination even among themselves, let alone with the Venezuelan government (NIC 2025). The report underscores that much of TDA’s growth has been facilitated by Venezuelan migration and that individuals and networks frequently use the gang’s name without direct affiliation, underscoring the decentralized and diffuse nature of the group. Crucially, the report states that there is “no indication that Venezuelan President Nicolás Maduro or senior government officials are directing the actions of Tren de Aragua,” contradicting claims that Maduro orchestrates the group’s activities (AP News 2025).

The report does allow that some mid- and low-level Venezuelan officials may have financial ties to TdA. Such connections are typically opportunistic, involving corruption or passive tolerance, rather than the product of a coherent state policy (NIC 2025). In this sense, regime responsibility lies less in the deliberate deployment of the gang as a proxy and more in the systemic weakness of governance that allows TdA to operate with impunity. This distinction is critical: corruption and negligence do not equate to strategic coordination or sponsorship. Yet political leaders have blurred this line by portraying TdA as a regime-directed instrument of repression and transnational crime.

Redactions in the NIC report shed further light on analytic processes. Although redactions obscure details, we can reasonably infer that they conceal the names of regime-linked individuals, sources and methods of intelligence collection, or details about TdA’s operations abroad. In intelligence practice, such redactions protect human sources, sensitive communications intercepts, and law enforcement leads. Notably, the report’s unredacted portions are explicit in their rejection of senior-level regime direction. Given classification practices, it is unlikely that redacted sections would conceal evidence directly contradicting the assessment’s core conclusion, since that would undermine the transparency and credibility of the report’s stated findings (NIC 2025).

Other credible sources reinforce the NIC’s position. Associated Press reporting on the document emphasizes that there is no evidence of Maduro’s direct involvement, while acknowledging that some regime actors might benefit from TdA’s activities (AP News 2025). Investigations by InSight Crime and The Guardian further show that certain monitors and advocacy groups have exaggerated TdA’s presence in the United States, even fabricating reports of its activity (InSight Crime 2025; The Guardian 2025). By contrast, organizations such as the Human Rights Foundation (HRF) argue that regime-linked actors used TdA in the abduction of Venezuelan dissident Ronald Ojeda in Chile in 2024. A more definitive answer to the question of Maduro’s involvement with TdA may have come from Ojeda. Unfortunately, he was liquidated by the regime. Perhaps the Chilean criminal information to the ICC will reveal more. The allegations remain under judicial investigation and do not yet amount to definitive evidence of direct command by Maduro himself (HRF 2025). The U.S. Government Accountability Office (GAO) and Congressional Research Service (CRS) both highlight Venezuela’s permissive environment for illicit financial flows and organized crime, but stress that corruption at lower levels is more prevalent than systematic state direction (GAO 2023; CRS 2024).

When these sources are synthesized, a consistent analytic picture emerges. Venezuela under Maduro provides an enabling environment for organized crime, but this is the result of systemic corruption, institutional incapacity, and deliberate tolerance by some officials, not top-level strategic direction. TDA operates as a decentralized criminal network whose spread is tied to transnational migration and weak law enforcement, not to state financing or command. The strongest claims, that Maduro is personally orchestrating TdA’s financing and direction, misrepresent available evidence and are not supported by credible intelligence or rigorous analysis. This distinction is not trivial: overstating threats distorts policymaking and risks politicizing intelligence.

The retraction of the NIC report under the leadership of DNI Tulsi Gabbard underscores the sensitivity of such findings. According to reporting, Gabbard ordered the recall of a classified report on Venezuela even after NSA officials confirmed that it met analytic and procedural standards (WRAL 2025). This action illustrates the pressures intelligence agencies face when their findings contradict prevailing political narratives. While intelligence must consider the risks of exposing sources and methods, recalling a report that undermines a presidential claim risks signaling politicization and undermining the credibility of the intelligence community.

It is important to concede some counterarguments. Intelligence reports are limited by available sources, and the absence of evidence is not evidence of absence. Covert relationships between regime actors and TdA may exist beyond the reach of collection or declassification. Allegations such as those emerging in Chile may eventually provide more conclusive evidence. However, at present, the preponderance of credible sources supports the NIC’s conclusion that Maduro is not directly directing or financing TdA. Until more conclusive evidence emerges, policymaking should be grounded in this nuanced understanding.

Ultimately, the retraction of the NIC report raises broader questions about the role of intelligence in our governance. The U.S. intelligence community’s credibility depends on its ability to provide unbiased, apolitical assessments to policymakers, even when those assessments contradict political preferences. Intelligence that is shaped by politics rather than evidence undermines both domestic and international credibility. For policymakers, basing decisions on politicized claims risks misallocation of resources, legal overreach, and diplomatic missteps. For the public, it threatens the erosion of trust in government institutions and more specifically the I.C. It is imperative that the DNI ensures that analytic judgments reflect the best available evidence, acknowledges uncertainties, and resists the politicization of intelligence regardless if she falls out of favor with the Administration. Only through integrity in production and delivery to the consumer can intelligence provide a sound foundation for policy in matters as consequential as Venezuela’s transnational criminal networks.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

References

AP News. 2025. “Declassified Intelligence Memo Contradicts Trump’s Claims Linking Gang to Venezuelan Government.” May 6, 2025. https://apnews.com/article/d818cc58962ba90cd2c94ca1b494d4fd
.

Congressional Research Service (CRS). 2024. Venezuela: Political Crisis and U.S. Policy. CRS Report IF10230. https://www.congress.gov/crs-product/IF10230
.

GAO (Government Accountability Office). 2023. Venezuela: Illicit Financial Flows and U.S. Efforts to Disrupt Them. GAO-23-105668. https://www.gao.gov/products/gao-23-105668
.

Human Rights Foundation (HRF). 2025. “Venezuela’s Maduro Continues to Use Tren de Aragua for Transnational Repression, Kidnapping, Assassination.” April 25, 2025. https://hrf.org/latest/venezuelas-maduro-continues-to-use-tren-de-aragua-for-transnational-repression-kidnapping-assassination/
.

National Intelligence Council (NIC). 2025. Venezuela: Examining Regime Ties to Tren de Aragua. Case No. DF-2025-00379, declassified May 5, 2025.

The Guardian. 2025. “Trump Defense Official Led Think Tank that Spread Lies about Tren de Aragua.” August 13, 2025. https://www.theguardian.com/us-news/2025/aug/13/joseph-humire-thinktank-tren-de-aragua
.

WRAL. 2025. “DNI Gabbard Recalls Classified Report on Venezuela in Highly Unusual Move.” May 2025. https://www.wral.com/story/dni-gabbard-recalls-classified-report-on-venezuela-in-highly-unusual-move/22152236/
.

Foreign Affairs. “Sources: Russia Misconduct – Boris Bondarev.” [n.d.]. “Sources: Russia Misconduct – Boris Bondarev,” Foreign Affairs. Accessed [insert access date]. https://www.foreignaffairs.com/russian-federation/sources-russia-misconduct-boris-bondarev

Posted on

Conduct Not Becoming: Alleged U.S.-Linked Interference in Greenland

intelligence, counterintelligence, espionage, counterespionage, spy, spies, subversion operations, c. constantin poindexter

In August 2025, the Danish Ministry of Foreign Affairs summoned the chargé d’affaires of the United States Embassy in Copenhagen after revelations by the Danish Broadcasting Corporation (DR) that several Americans linked to the U.S. Presidential Administration had engaged in covert political activities in Greenland. According to the reporting, these individuals compiled lists of Greenlanders categorized as “pro-U.S.” or “anti-Trump,” cultivated ties with local elites, and promoted narratives designed to widen divisions between Nuuk and Copenhagen (PBS NewsHour 2025; Associated Press 2025). The Danish Security and Intelligence Service (PET) emphasized that Greenland remains a primary target for foreign interference operations, echoing earlier warnings that external actors could exploit or fabricate political disagreements within the Kingdom of Denmark (Al Jazeera 2025). These revelations, coupled with Denmark’s unusually direct diplomatic response, illustrate the characteristics of a malign influence or subversive operation and highlight the potential damage such activities can inflict on U.S. national security, particularly by undermining liaison trust with Denmark, arguably one of Washington’s most important intelligence partners.

Characteristics of a Malign Influence Operation

Malign influence operations are typically defined by certain recurring attributes: plausible deniability, use of cut-outs or intermediaries, audience mapping and segmentation, amplification of divisive narratives, and efforts aimed at shaping decision-making environments rather than openly persuading through argument. The Greenland episode, as described by DR and reported internationally, bears all of these hallmarks.

Plausible deniability was central to the actor’s positioning. Officials stressed that the government does not direct or control the actions of private citizens, even though the actors were reportedly politically connected to the Administration (PBS NewsHour 2025). Such disavowals allow states to shield themselves from direct accountability while benefiting from the effects of covert activity.

The use of cut-outs and informal networks appears evident. The alleged operatives were not formal embassy staff operating under Chief of Mission authority but instead American nationals cultivating relationships with Greenlandic political and business figures. This indirect approach mirrors tradecraft seen in both Cold War–era and contemporary influence campaigns, allowing sponsors to maintain distance while pursuing strategic objectives (Associated Press 2025).

The activity involved audience segmentation, as evidenced by the preparation of lists distinguishing sympathetic Greenlanders from opponents. Such mapping is a well-established precursor to micro-targeted persuasion and coalition-building (Rudbeck 2020).

The operation sought to exploit existing grievances. Greenland has a long history of tension regarding its relationship with Copenhagen, particularly concerning autonomy and resource management. PET has publicly warned that adversaries attempt to “promote or amplify particular viewpoints” in Greenland to exacerbate these tensions (Al Jazeera 2025). By pressing sovereignty-oriented narratives, the actors aligned with known fault lines.

The activities pursued a strategic effect on governance: nudging Greenland’s politics toward greater separation from Denmark or, at minimum, intensifying friction between Copenhagen and Nuuk. This fits the definition of a malign influence campaign, which aims not merely to influence public opinion but to shift the constitutional or strategic environment of the target polity (Fleshman et al. 2020).

Greenland’s Strategic Importance

Understanding why Denmark reacted so firmly requires recognition of Greenland’s immense strategic value. The island hosts Pituffik Space Base (formerly Thule Air Base), the northernmost U.S. military installation. Pituffik is critical to ballistic missile early warning, missile defense, and space surveillance missions, particularly through the 12th Space Warning Squadron, which tracks ballistic launches and supports U.S. Space Force operations (U.S. Space Force 2024). Pituffik’s radar and space-tracking systems are a vital component of NATO deterrence, as they enable early detection of potential Russian or other adversary launches.

Beyond Pituffik, Greenland’s geography makes it indispensable to North Atlantic security. The island sits astride the Greenland–Iceland–U.K. (GIUK) gap, a maritime chokepoint central to monitoring Russian submarine traffic from the Barents Sea into the North Atlantic. As the Arctic becomes increasingly contested due to climate change and resource competition, Greenland’s location at the intersection of North America and Europe magnifies its strategic importance.

Equally significant is Denmark’s intelligence capability. The Danish Defence Intelligence Service (FE) and PET are widely regarded as among the most capable small-state services, particularly in signals intelligence, counterintelligence, cyber and Arctic domain awareness. FE’s Intelligence Risk Assessment 2024 explicitly identifies Greenland as a frontline in great-power competition (Danish Defence Intelligence Service 2024). As such, Denmark is one of Washington’s most important intelligence liaisons, and trust in this relationship is crucial to U.S. and NATO security.

Damage to U.S. National Security

From a U.S. perspective, even if the federal government neither authorized nor directed the actions of the Americans involved, the perception of interference inflicts real costs. Four national security risks stand out.

Such activities risk eroding liaison trust. Intelligence sharing relies on reciprocity and respect for sovereignty. If Denmark perceives that the United States tolerates or encourages efforts to manipulate the Kingdom’s internal affairs, Danish services may hesitate to share sensitive information or to cooperate fully in Arctic monitoring. Trust, once diminished, is difficult to rebuild (Danish Defence Intelligence Service 2024).

Malign influence in Greenland undermines coordinated Arctic policy. Pituffik’s continued operation depends on alignment among Copenhagen, Nuuk, and Washington. Any perception that the U.S. is fueling secessionist sentiment in Greenland complicates base access negotiations, environmental approvals, and trilateral defense arrangements. Diplomatic friction could translate into delays or restrictions that weaken early warning and space-tracking capabilities (Associated Press 2025).

Such revelations hand adversaries narrative ammunition. Russia and China have long sought to depict the United States as hypocritical in its advocacy for sovereignty and democratic norms. A Danish finding that U.S.-linked actors engaged in subversive activity in Greenland would provide propaganda fodder for Moscow and Beijing, undermining U.S. credibility in NATO and in multilateral Arctic governance forums (Al Jazeera 2025).

These operations jeopardize operational continuity at Pituffik. Strategic deterrence depends on uninterrupted coverage of missile warning and space tracking. Political discord that affects budgets, labor relations, or local sentiment in Greenland could generate friction costs that weaken U.S. posture in the High North (U.S. Space Force 2024).

Theoretical Framing: Rudbeck and Malign Influence

Emma Rudbeck’s (2020) master’s thesis on foreign interference in Greenland provides an instructive framework. Applying Applied History and strategic narrative theory, Rudbeck argues that interference by major powers in Greenland echoes Cold War–era dynamics and threatens the concept of “Arctic Exceptionalism,” which had long portrayed the region as insulated from great-power rivalry. She concludes that Denmark must prepare for sustained interference by China, Russia, and the United States, and recommends a proactive Arctic strategy that emphasizes resilience and narrative management. Rudbeck’s insights align with the Greenland episode. The use of covert actors to segment populations and inflame tensions fits her description of “strategic narratives” designed to reshape perceptions of sovereignty and autonomy. By treating Greenland not as a neutral space but as contested political terrain, the alleged U.S.-linked operatives validated Rudbeck’s claim that interference is no longer limited to Russia or China but includes Washington itself. From Denmark’s perspective, this raises uncomfortable questions about the reliability of its closest ally.

Assessing the “Deception Operation” Frame

Denmark’s choice to summon the U.S. envoy demonstrates that it viewed the incident not as isolated private advocacy but as a coherent deception operation. The tactics of covert list-building, elite cultivation, and narrative seeding abroad reflect classic subversive tradecraft, intended to give the false impression of grassroots political momentum. PET has warned precisely about such techniques, noting that foreign influence in Greenland often seeks to “amplify particular viewpoints” to sow division (Al Jazeera 2025). This aligns with broader theoretical work on deception and influence, which emphasizes how adversaries shape decision environments by hiding their involvement (Fleshman et al. 2020).

We Need to Assure Copenhagen that “This isn’t who we are”

The Greenland case illustrates how malign influence can damage alliances even when conducted by non-official actors. Mitigating this damage will require visible U.S. steps: clear ministerial-level assurances to Copenhagen, tighter deconfliction to ensure all outreach in Greenland is coordinated through embassy channels, and symbolic trilateral initiatives with Denmark and Greenland to demonstrate respect for the Kingdom’s internal constitutional order. Absent such efforts, suspicion of U.S. duplicity may persist, weakening NATO cohesion at a time when Arctic security is increasingly central.

The alleged Administration-linked interference in Greenland demonstrates the characteristics of a malign influence operation: plausible deniability, cut-outs, audience segmentation, exploitation of grievances, and pursuit of strategic effects on governance. Greenland’s unique importance to U.S. defense posture and Denmark’s role as an elite intelligence ally magnify the stakes. By alienating Copenhagen, such operations risk degrading liaison trust, undermining trilateral defense cooperation, handing adversaries propaganda, and jeopardizing early-warning missions at Pituffik. Rudbeck’s (2020) analysis underscores that Greenland is no longer insulated from great-power rivalry, and that even allies may engage in subversive activity. For the United States, this episode should serve as a cautionary reminder that short-term political maneuvering can yield long-term strategic perils, especially when it undermines the trust of one of its most vital partners in the Arctic.

~ C. Constantin Poindexter, M.A. en Inteligencia, Certificado de Posgrado en Contrainteligencia, J.D., certificación CISA/NCISS OSINT, Certificación DoD/DoS BFFOC

References

Al Jazeera. 2025. “Denmark Summons US Envoy over Trump Allies’ Alleged Greenland Interference.” Al Jazeera, August 28, 2025. https://www.aljazeera.com/news/2025/8/28/denmark-summons-us-envoy-over-trump-allies-greenland.

Associated Press. 2025. “Denmark Summons US Envoy over Alleged Trump Allies’ Interference in Greenland.” AP News, August 28, 2025. https://apnews.com/article/denmark-greenland-us-trump-6c9544314792cf1e287e21af06111c1e.

Danish Defence Intelligence Service. 2024. Intelligence Risk Assessment 2024. Copenhagen: FE. https://fe-ddis.dk/en.

Fleshman, William, Jennifer L. Larson, and Christopher Paul. 2020. “Deception and the Strategy of Influence.” arXiv preprint arXiv:2011.01331.

PBS NewsHour. 2025. “Denmark Summons US Envoy over Claims of Interference in Greenland.” PBS NewsHour, August 28, 2025. https://www.pbs.org/newshour/world/denmark-summons-u-s-envoy-over-claims-of-interference-in-greenland.

Rudbeck, Emma. 2020. How Should the Kingdom of Denmark React to the Increased Chinese, Russian, and U.S. Interference in Greenland in Its Coming Arctic Strategy? Master’s thesis, University of Southern Denmark. https://thesis.sdu.dk/download?id=2260.

U.S. Space Force. 2024. “12th Space Warning Squadron, Pituffik Space Base.” Fact Sheet, Department of the Air Force. https://www.spaceforce.mil/About-Us/Fact-Sheets/
.

Posted on

Artificial Intelligence and Offensive Counterintelligence in the U.S. I.C.

counterintelligence, intelligence, espionage, counterespionage, espia, spy, spies, contrainteligencia, contraespionaje, c. constantin poindexter, J2, CNI, DNI

Artificial intelligence is transforming the national security landscape by augmenting the capabilities of intelligence organizations to “identify, disrupt, and neutralize adversarial threats”. While much scholarly and policy attention has been devoted to the defensive applications of AI, i.e., cybersecurity, threat detection, and insider threat monitoring, implications for offensive counterintelligence (CI) are equally profound. Offensive counterintelligence, which involves proactive measures to manipulate, exploit, or dismantle adversarial intelligence operations, has traditionally depended on human ingenuity, deception, and long-term HUMINT. The introduction of AI into this realm promises to exponentially increase the scale, speed, and sophistication of U.S. counterintelligence campaigns. The U.S. Intelligence Community (IC) will become more effective at penetration of FIS, deception operations, and neutralization of espionage activities.

One of the most significant ways AI will enhance offensive counterintelligence is through advanced pattern recognition and anomaly detection across massive data streams. The IC already ingests petabytes of information daily, from open-source intelligence (OSINT) to signals intelligence (SIGINT). Offensive counterintelligence officers have historically been hobbled by fragmentary reports and painfully dry and drawn-out analysis to identify foreign intelligence officers, their networks, and their vulnerabilities. Machine learning algorithms now enable CI analysts to identify subtle anomalies in communications metadata, financial transactions, or travel records that suggest covert operational behavior. Algorithms trained on known espionage tradecraft can detect anomalies in mobile phone usage, repeated travel to consular facilities, or encrypted message timing that would elude traditional analysis (Carter, 2020). By automating the detection of clandestine activity, AI provides offensive CI officers with early targeting leads for recruitment, deception, or disruption.

AI’s role in predictive modeling of adversary behavior is a game-changer. Traditional counterintelligence operations have required years of painstaking collection before a service could anticipate an adversary’s moves. Now, reinforcement learning and predictive analytics can generate probabilistic models of how foreign intelligence services will act under specific conditions. This capability is invaluable for offensive CI, in which anticipating an adversary’s agent recruitment attempts or technical collection strategies and techniques allows the U.S. to insert double agents, conduct controlled leaks, or channel disinformation in ways that compromise foreign intelligence effectiveness (Treverton & Miles, 2021). By simulating adversary decision-making processes and Loops, AI effectively allows the IC to wage a chess match several moves ahead, shifting initiative in favor of U.S. operators.

AI will transform deception operations, a core element of offensive counterintelligence. Deception requires constructing credible false narratives, fabricating convincing documents, and sustaining elaborate covers. Generative AI models provide new tools for producing synthetic but convincing content, i.e., emails, social media profiles, deepfake videos, etc., that can be deployed to manipulate adversarial intelligence targets. These capabilities enable more robust false-flag operations, digital honeypots, and disinformation campaigns designed to lure adversary collectors into traps or consume their resources chasing fabricated leads. Deepfake technology raises concerns about disinformation in democratic societies, however, if deployed in a tightly controlled counterintelligence context it becomes a force multiplier, providing scalable deception tools that previously demanded enormous human and material resources (Brundage et al., 2018).

AI enhances the identification and exploitation of recruitment opportunities, central to offensive CI operations. The IC has long relied on spotting, assessing, and recruiting human assets with access and placement. AI-driven analysis of social media, professional networks, and digital exhaust enables rapid identification of individuals with access, grievances, or vulnerabilities suitable for recruitment. Natural language processing (NLP) tools can detect sentiment, stress, or dissatisfaction in posts, while network analysis maps reveal connections within bureaucracies or security services (Greitens, 2019). By narrowing down large populations to high-value recruitment targets, AI augments human case officer ability to prioritize approaches and customize persuasion angles. The integration of AI with human tradecraft accelerates the traditionally slow and resource-intensive recruitment cycle.

Cyber counterintelligence represents another frontier where AI confers offensive advantages. FISs increasingly operate in cyberspace, exfiltrating sensitive data and conducting influence campaigns. AI-enabled intrusion detection, combined with offensive cyber capabilities, allows U.S. counterintelligence to not only identify intrusions but also manipulate them. AI can facilitate “active defense” strategies in which foreign intelligence hackers are fed false or misleading data, undermining their confidence in purloined data. Automated adversarial machine learning tools can also detect attempts by foreign services to poison U.S. AI training data, allowing counterintelligence operators to preemptively counter them (Henderson, 2022). AI both defends critical systems and creates new opportunities for denial and deception operations (D&D) and disruption of adversarial cyber espionage.

Further, AI also addresses one of the perennial challenges of offensive counterintelligence, scalability. Human operator and analyst resources are finite. Adversarial services often enjoy the advantage of operating from within authoritarian systems unconstrained by meaningful oversight. AI offers the IC the ability to scale counterintelligence operations across global theaters without proportional increases in manpower. Automated triage systems can flag potential espionage indicators for human review, while AI-driven simulations can test the effectiveness of proposed offensive strategies before deployment. The scalability of AI ensures that offensive CI efforts remain proactive rather than reactive, allowing the IC to contest adversarial services at a global level (Allen & Chan, 2017).

I will note here that the insertion of AI into offensive counterintelligence is not a panacea. Overreliance on algorithmic outputs without human validation can lead to “false positives”, misidentification, or ethically and legally problematic targeting. Adversaries are also rapidly adopting AI for their own counter-counterintelligence measures, raising the specter of an AI-driven arms race in deception, espionage and counterespionage disciplines. The U.S. IC must ensure that AI tools are embedded within a robust framework of human review, legal compliance, and ethical norms. Offensive CI, clearly operating in the shadows of democratic accountability, requires enhanced governance mechanisms to balance operational effectiveness with adherence to rule-of-law principles (Zegart, 2022).

The adoption of AI in offensive counterintelligence necessitates organizational adaptation. Case officers, analysts, and technical specialists must be trained not only to use AI tools but also to understand their limitations. Interdisciplinary collaboration between computer scientists, behavioral experts, and intelligence professionals will be essential for designing AI systems that are operationally relevant, a particularly challenging problem in a group of agencies accustomed to “siloing”. Investment in secure, resilient AI infrastructure is critical, as adversaries will inevitably seek to penetrate, manipulate, or sabotage U.S. counterintelligence AI systems. Just as past eras of counterintelligence revolved around protecting codes and agent networks, the new era will hinge on safeguarding the integrity of AI platforms themselves (Carter, 2020).

Artificial intelligence offers unprecedented opportunities to enhance the effectiveness of offensive counterintelligence. By improving anomaly detection, predictive modeling, deception, recruitment targeting, and cyber counterintelligence, AI serves as both a force multiplier and a strategic enabler. It allows the IC to proactively shape the intelligence battlespace, seize the initiative from adversaries, and scale operations to meet global challenges. These opportunities come with risks, ethical, operational, and strategic, however, with careful management the payoff will be monumental. Offensive counterintelligence has always been a contest of wits, deception, and foresight. In the twenty-first century, AI will become the decisive instrument that determines whether the U.S. retains the upper hand in the shadow war.

~ C. Constantin Poindexter, M.A. en Inteligencia, Certificado de Posgrado en Contrainteligencia, J.D., certificación CISA/NCISS OSINT, Certificación DoD/DoS BFFOC

References

Allen, G., & Chan, T. (2017). Artificial intelligence and national security. Belfer Center for Science and International Affairs, Harvard Kennedy School.

Brundage, M., Avin, S., Clark, J., Toner, H., Eckersley, P., Garfinkel, B., … & Amodei, D. (2018). The malicious use of artificial intelligence: Forecasting, prevention, and mitigation. Future of Humanity Institute.

Carter, A. (2020). The future of counterintelligence in the age of artificial intelligence. Center for a New American Security.

Greitens, S. C. (2019). Dealing with demand for authoritarianism: The domestic politics of counterintelligence. International Security, 44(2), 9–47.

Henderson, T. (2022). Offensive cyber counterintelligence: Leveraging AI to deceive adversaries. Journal of Cybersecurity Studies, 8(1), 55–74.

Treverton, G. F., & Miles, R. (2021). Strategic counterintelligence: The case for offensive measures. RAND Corporation.

Zegart, A. (2022). Spies, lies, and algorithms: The history and future of American intelligence. Princeton University Press.

Posted on

Can I.C. HUMINT Operators Counter Facial Recognition Supercharged by A.I.?

HUMINT, facial recognition, intelligence, counterintelligence, espionage, counterespionage, c. constantin poindexter;

The WAPO article in May of this year (“CIA chief faces stiff test in bid to revitalize human spying”) revealed a peril that has been on my radar for a few years. Writers Warren P. Strobel and Ellen Nakashima reported that the CIA is facing ‘unprecedented operational challenges’ in conducting human intelligence (HUMINT) missions, particularly in “denied areas” such as China, Russia, and other heavily surveilled states. The central premise is that advances in artificial intelligence–powered facial recognition, combined with integrated surveillance networks are making it extremely difficult for intelligence officers and sub-handlers to operate covertly. Maybe, . . . but maybe not.

As I.C. agencies grapple with the proliferation of AI-enhanced facial recognition in denied areas, human intelligence (HUMINT) operators must seek new tradecraft to elude detection. Exploiting the inherent bias vulnerabilities and adaptive learning mechanisms within facial recognition systems, HUMINT operatives can deliberately degrade their reliability, more specifically, by flooding systems with inputs that are not identical but very similar thereby “poisoning” the recognition algorithm. Operators can broaden acceptance thresholds and reduce fidelity. Drawing a parallel with Apple’s iPhone Face ID system, whose adaptive mechanism occasionally grants access to similar-looking individuals (e.g., family members), here is how HUMINT practitioners could deliberately introduce adversarial noise to AI surveillance systems to slip through.

Algorithmic Bias in Facial Recognition

Facial recognition systems are susceptible to algorithmic bias rooted in uneven training data. For instance, the now-classic “Gender Shades” study revealed error rates up to 35 % for darker-skinned women versus < 1 % for lighter-skinned males. More broadly, the National Institute of Standards and Technology (NIST) has documented that commercial face recognition systems misidentify Black and Asian faces 10 to 100 times more often than white faces. These disparities not only expose systemic flaws but also point to the system’s sensitivity to subtle variations. Adversarial machine learning research has demonstrated that imperceptible perturbations can dramatically mislead facial recognition models. These adversarial examples exploit “non-robust” features, patterns perceptible to AI but invisible to humans that induce misclassification. Studies in the domain have confirmed that even small alterations in pixel patterns can force erroneous outputs in face recognition systems.

Adaptive Learning: The iPhone Face ID Example

Apple’s Face ID serves as a real-world instance of an adaptive facial recognition mechanism. The system uses a detailed infrared depth map and neural engine adaptation to adjust to users’ appearance changes over time, i.e., aging, makeup, glasses, or facial hair. Critically, Face ID “updates its registered face data” when it detects a close match that is subsequently unlocked via passcode, effectively learning from borderline inputs. This adaptability can lead to misrecognition in practice. A widely reported case involved a ten-year-old boy unlocking his mother’s iPhone X on the first attempt, thanks to their similar features. The system adapted sufficiently that the child could consistently unlock the device in subsequent attempts even though he was neither registered nor the primary user. Apple’s own user disclosure acknowledges that Face ID is statistically more prone to false positives with twins, siblings, and children under thirteen owing to underdeveloped, similar facial features.

HUMINT Application: Poisoning Recognition Systems

HUMINT operators, aware of such adaptive vulnerabilities, could deliberately exploit them when entering denied areas monitored by AI facial recognition cameras or checkpoints. How would that work?

Creating “near duplicate” appearances: Operators could train the system by repeatedly presenting faces that are not identical but nearly identical. Sending similar-looking collaborators through passport control wearing slight variations in makeup, glasses, lighting, or facial hair is a good example. Over time, the system’s adaptive threshold would widen, accepting a broader range of inputs as belonging to the same identity.

Adversarial perturbation via “morphing”: Using adversarial machine learning techniques, operatives could create morphs (digital or printed images blending two individuals) so that the system’s recognition vector drifts toward both identities. The DHS has documented such “morphing attacks” as a real threat to face recognition systems. Not a perfect solution as adversarial C.I. might simply surveil them ALL.

Feedback loop poisoning: With systems that incorporate user feedback (e.g., unlocking after near matches), HUMINT operators might deliberately trigger false acceptances or input other authentication data after near matches, feeding the system mis-labelled data and amplifying its error tolerance. That’s the way siblings or children inadvertently taught Face ID to accept them in the previous example.

Ethical, Operational, and Technical Defense

Is the approach technically plausible or ethically defensible? Technically, the literature on adversarial attacks and adaptive biases confirms that recognition systems can be deliberately misconfigured through controlled input poisoning. Operationally, such techniques must be deployed after careful risk assessment. If a HUMINT operating group consistently “trains” a system in advance, the likelihood of detection increases, perhaps dramatically. However, in dynamic environments with rotating operators and multiple lookalikes, the system can deteriorate in reliability over time without drawing attention to a single individual. Ethically, these strategies are defensible under the doctrine of necessity and deception inherent to espionage. The goal is not harm but evasion in hostile surveillance contexts.

Limitations and Countermeasures

The approach is not foolproof. Highly calibrated systems may lock after repeated unlock failures or require emergency analysis and supervisory resets. Advanced systems may isolate per identity representations, preventing cross-contamination. Systems without adaptive learning or those that guard against morphing remain immune. Nonetheless, many real-world systems are not designed for adversarial resistance, . . . yet. Authoritarian regimes with bulk “brute” surveillance networks, less than state-of-the-art platforms and/or resource constraints may nullify robust defense against poisoning.

In the escalating arms race between AI surveillance and clandestine operations, HUMINT tradecraft must evolve. By exploiting biases and adaptive flaws in facial recognition systems (ex., through near identical inputs, morphing techniques, and feedback poisoning) operators can subtly degrade recognition fidelity. The iPhone Face ID example underscores the viability of such tactics in practice, i.e., a system designed for convenience can become a liability when its adaptability is weaponized. As surveillance proliferates, understanding and manipulating AI’s algorithmic susceptibilities will be indispensable for evasion and operational success.

Facial recognition is not the only sophisticated peril to HUMINT operations. Per Thomas Claburn’s recent report in The Register, “Researchers in Italy have developed a way to create a biometric identifier for people based on the way the human body interferes with Wi-Fi signal propagation. The scientists claim this identifier, a pattern derived from Wi-Fi Channel State Information, can re-identify a person in other locations most of the time when a Wi-Fi signal can be measured. Observers could therefore track a person as they pass through signals sent by different Wi-Fi networks – even if they’re not carrying a phone.” (Claburn, 2025) Tradecraft and countermeasures will likewise have to evolve to address this threat, but I’ll leave that subject for a future piece.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

References

Buolamwini, J., & Gebru, T. (2018). Gender Shades: Intersectional accuracy disparities in commercial gender classification. Proceedings of Machine Learning Research, 81, 1–15. https://en.wikipedia.org/wiki/Algorithmic_bias

National Institute of Standards and Technology. (2019). Face recognition vendor test (FRVT) Part 3: Demographic effects (NIST Interagency/Internal Report No. 8280). https://en.wikipedia.org/wiki/Anti-facial_recognition_movement

Goodfellow, I. J., Shlens, J., & Szegedy, C. (2015). Explaining and harnessing adversarial examples. International Conference on Learning Representations. https://www.wired.com/story/adversarial-examples-ai-may-not-hallucinate

Vakhshiteh, A., Alparslan, F., & Farokhi, F. (2020). Adversarial attacks on deep face recognition systems. arXiv. https://arxiv.org/abs/2007.11709

Apple Inc. (2024). About Face ID advanced technology. Apple Support. https://support.apple.com/en-us/102381

Greenberg, A. (2017, December 14). A 10-year-old unlocked his mom’s iPhone X using Face ID. Wired. https://www.wired.com/story/10-year-old-face-id-unlocks-mothers-iphone-x

U.S. Department of Homeland Security. (2023). Risks and mitigation strategies for morphing attacks on biometric systems. https://www.dhs.gov/sites/default/files/2023-12/23_1222_st_risks_mitigation_strategies.pdf

Posted on

La pesadilla de contrainteligencia: Huawei, España y la amenaza a la cooperación transatlántica de inteligencia

La pesadilla de contrainteligencia Huawei, España y la amenaza a la cooperación transatlántica de inteligencia, inteligencia, contrainteligencia, espionage, contraespionage, c. constantin poindexter

El Gobierno de España adjudicó a Huawei Technologies un contrato por valor de 12,3 millones de euros para proveer los sistemas de almacenamiento y procesamiento de las escuchas judiciales autorizadas por jueces en investigaciones penales y de seguridad nacional. El contrato contempla la utilización de servidores de la línea OceanStor 6800 V5 de Huawei, destinados a manejar datos clasificados de extrema sensibilidad relacionados con interceptaciones de comunicaciones autorizadas judicialmente, muchas de las cuales forman parte de operaciones en curso en las que colaboran servicios de inteligencia de otros países aliados. La decisión ha causado consternación en sectores diplomáticos, legislativos y de seguridad, no sólo en los Estados Unidos, sino también en el seno de la Unión Europea y la Organización del Tratado del Atlántico Norte (OTAN), dadas las implicaciones que esto tiene en materia de contrainteligencia, interoperabilidad y confianza entre socios estratégicos.

La principal preocupación se origina en el hecho incontrovertible de que Huawei mantiene una relación estructural con el Partido Comunista Chino (PCCh) y está sujeta a las leyes de inteligencia nacionales de China, en particular la Ley de Inteligencia Nacional de 2017. Esta legislación obliga a todas las entidades chinas, incluidas las privadas, a cooperar con los servicios de inteligencia del Estado cuando se les requiera. De este modo, el hecho de que Huawei tenga acceso directo o indirecto a los sistemas españoles de interceptación electrónica AUNQUE supuestamente aislados y sin conexión a redes externas, constituye una amenaza inherente para la seguridad nacional, no sólo de España, sino de todos los países que mantienen canales de cooperación bilateral o multilateral con sus servicios de inteligencia españoles. Aunque el Ministerio del Interior ha insistido en que los servidores de Huawei están blindados y físicamente desconectados de redes externas, y que cumplen con los estándares del Esquema Nacional de Seguridad (ENS), expertos internacionales han señalado que tales garantías son insuficientes cuando se trata de proveedores sujetos a legislación extranjera opaca y autoritaria.

La respuesta de los EEEUU fue inmediata y contundente. Los congresistas Rick Crawford, miembro del Comité de Inteligencia de la Cámara de Representantes, y Tom Cotton, miembro del Comité Selecto de Inteligencia del Senado, enviaron una carta a la Directora de Inteligencia Nacional (DNI) solicitando una revisión integral de los acuerdos de intercambio de inteligencia entre Washington y Madrid (CNI). En dicha carta, los legisladores advierten que la decisión del gobierno español de confiar a Huawei el manejo de escuchas judiciales constituye una “puerta trasera potencial” para que el aparato de inteligencia chino acceda a información clasificada generada en el contexto de operaciones conjuntas. La gravedad del asunto es tal que los firmantes sugieren suspender temporalmente el intercambio de inteligencia con España si no se revierte la medida. Estas preocupaciones no son infundadas ni exageradas; más bien reflejan una lógica estricta de seguridad nacional en la que la integridad de la cadena de custodia de la información es condición sine qua non para la cooperación.

Además, la reacción internacional expone una contradicción estructural en la política de seguridad digital de la Unión Europea. Mientras que Bruselas ha desaconsejado expresamente la participación de Huawei en redes 5G debido a los “riesgos sustanciales” que representa en términos de espionaje, ciberataques y dependencia tecnológica, no existe un marco normativo vinculante que prohíba su participación en otras infraestructuras críticas, como lo son los sistemas de gestión de datos de inteligencia y contrainteligencia. Esta brecha normativa fue denunciada en un análisis reciente de The Cipher Brief, donde expertos como el Dr. Dave Venable, exfuncionario de la Agencia de Seguridad Nacional (NSA), señalaron que la “caja de herramientas” de la UE frente a proveedores de alto riesgo es demasiado limitada y carente de fuerza jurídica. En consecuencia, cada Estado miembro actúa con un margen de discrecionalidad que pone en riesgo la coherencia del bloque y mina la confianza entre socios.

En este sentido, la decisión española también afecta de forma directa a la arquitectura de seguridad colectiva de la OTAN. España es un miembro activo de la Alianza Atlántica y participa regularmente en misiones y operaciones de inteligencia compartida, tanto en el marco europeo como transatlántico. Muchas de las escuchas judiciales que ahora estarán bajo la custodia tecnológica de Huawei probablemente incluyan comunicaciones de interés para operaciones conjuntas, tanto en el ámbito del contraterrorismo como del crimen organizado transnacional. Si uno de los eslabones de esta cadena adopta prácticas tecnológicas que no garantizan la inmunidad frente a actores hostiles, todo el sistema se ve comprometido. Esta vulnerabilidad estructural plantea la necesidad urgente de establecer normas comunes, con fuerza jurídica, que limiten o prohíban la contratación de proveedores tecnológicos sujetos a regímenes autoritarios y leyes de inteligencia incompatibles con los valores democráticos.

Las implicaciones no se limitan al plano técnico. Existe también un componente diplomático y estratégico. Al ignorar las advertencias previas sobre los riesgos asociados a Huawei, España corre el riesgo de erosionar su reputación como socio fiable en materia de seguridad e inteligencia. La percepción de que Madrid prioriza el precio y la conveniencia tecnológica sobre la seguridad estratégica puede tener consecuencias en términos de acceso a inteligencia sensible y participación en operaciones multilaterales. Esta posibilidad fue esbozada por altos funcionarios estadounidenses, quienes plantean que la continuidad del intercambio de inteligencia con España podría estar condicionada a la eliminación de Huawei de sus sistemas de seguridad nacional. En el contexto actual de competencia geopolítica entre Occidente y China, las decisiones tecnológicas tienen un peso estratégico equivalente al de las decisiones militares o diplomáticas.

Por su parte, el gobierno chino, a través del diario estatal Global Times, celebró la adjudicación como una muestra de independencia y racionalidad frente a la “presión hegemónica” de los Estados Unidos. Según los editoriales publicados, la decisión española prueba que Huawei es una empresa confiable y que las acusaciones en su contra carecen de fundamento técnico. Esta narrativa se alinea con la estrategia del PCCh de proyectar una imagen de inocuidad y eficiencia técnica de sus empresas, mientras oculta las estructuras de control estatal que las rigen. Desde esta perspectiva, el caso español se convierte en un caso testigo de la pugna entre dos visiones irreconciliables: una basada en la apertura, la transparencia y el Estado de derecho, y otra cimentada en el control autoritario, la opacidad y la manipulación estratégica de la tecnología con fines geopolíticos.

En resumen, el contrato adjudicado a Huawei no es un asunto meramente administrativo ni una cuestión de eficiencia tecnológica. En realidad, se trata de una grave falla de contrainteligencia con efectos potenciales sobre toda la red occidental de cooperación en seguridad. La combinación de factores legales, tecnológicos, estratégicos y diplomáticos que confluyen en esta decisión genera una tormenta perfecta que pone en jaque los principios fundamentales de confianza, integridad e interoperabilidad entre aliados. Si no se revierte la medida o se establecen controles supranacionales estrictos, se corre el riesgo de que otros países sigan el mismo camino, desdibujando la línea entre aliados seguros y entornos tecnológicos vulnerables a la penetración de adversarios estratégicos como China. En un mundo cada vez más definido por la competencia informacional, la lealtad tecnológica no puede ser tratada como un tema secundario; es, en última instancia, una cuestión de soberanía, integridad nacional y supervivencia estratégica.

~ C. Constantin Poindexter, MA en Inteligencia, Certificado de Posgrado en Contrainteligencia, JD, Certificación OSINT CISA/NCISS, Certificación BFFOC del DoD/DoS

Referencias

Politico Europe. (2025). Spain’s Huawei contract raises US alarm over judicial wiretap security. Disponible en: https://www.politico.eu/article/spain-huawei-contract-judicial-wiretaps/

El País. (2025). España asegura a EE UU que el contrato de Interior con la china Huawei no supone ningún riesgo de seguridad. Disponible en: https://elpais.com/espana/2025-07-19/espana-asegura-a-ee-uu-que-el-contrato-de-interior-con-la-china-huwaei-no-supone-ningun-riesgo-de-seguridad.html

The Cipher Brief. (2025). Huawei, Spain and the Threat to Western Intelligence Cooperation. Disponible en: https://www.thecipherbrief.com/huawei-spain-intelligence

Global Times. (2025). Huawei’s win in Spain shows EU autonomy in face of US pressure. Disponible en: https://www.globaltimes.cn/page/202507/1339651.shtml

Venable, D. (2025). EU Security Frameworks and the Huawei Dilemma. The Cipher Brief Expert Commentary.

Posted on

The Strategic Importance of the INR: Safeguarding U.S. National Security through Diplomatically Anchored Intelligence

intelligence, counterintelligence, espionage, counterespionage, spy, c. constantin poindexte

The U.S. Department of State’s Bureau of Intelligence and Research (INR) is a critical but underestimated pillar of the U.S. Intelligence Community (IC). Established in 1947 and tracing its roots to the Office of Strategic Services (OSS) Research and Analysis Branch, the INR operates with a unique mandate: fusing diplomatic insight with rigorous intelligence analysis. Unique among I.C. member agencies, it exists specifically to inform U.S. foreign policy decisions. Despite its modest budget and staff (+/-300 personnel and less than one percent of the total IC budget), the INR’s record of analytic precision, geopolitical foresight, and principled speak-truth-to-power character has earned it a reputation as one of the most accurate and seasoned voices in national intelligence. Recent defunding directives from the current presidential administration threaten to undermine this vital function, risking a blind spot in diplomatic intelligence and foreign affairs policymaking.

The Unique Role of the INR in the U.S. Intelligence Community

The INR’s primary mission is to provide all-source intelligence analysis to the Secretary of State and other senior policymakers. Unlike larger IC agencies such as the CIA or NSA, the INR does not generally collect raw intelligence through clandestine operations or technical means. Instead, it synthesizes open-source material, diplomatic cables, intelligence reporting, and foreign liaison inputs to produce independent assessments grounded in a global diplomatic context (ODNI, 2023). This structural independence grants INR the ability to offer dissenting views when other agencies fall victim to inherent biases and groupthink. A prominent example is its refusal to endorse the 2002 National Intelligence Estimate (NIE) on Iraqi weapons of mass destruction. The INR dissented from the IC consensus, concluding that there was insufficient evidence that Saddam Hussein was reconstituting a nuclear program (National Intelligence Council, NIE 2002-16HC, “Iraq’s Continuing Programs for Weapons of Mass Destruction,” Oct. 2002, INR). History has vindicated the INR’s position, reinforcing the critical need for its unbiased, evidence-based approach to intelligence.

Case Studies: Intelligence and Counterintelligence Victories Attributed to INR

Iraq WMD Dissent (2002–2003)

INR’s refusal to support claims of an active Iraqi nuclear weapons program is perhaps its most famous act of analytic integrity. Despite intense interagency pressure, INR analysts resisted politicization and flagged the aluminum tubes cited by other agencies as likely intended for conventional rockets, NOT nuclear centrifuge use. This dissent was formalized in the 2002 NIE, which noted:

“The Department of State’s Bureau of Intelligence and Research (INR) judges that the available evidence does not add up to a compelling case that Iraq is currently pursuing an integrated and comprehensive program for a nuclear weapon.”
— NIE 2002-16HC (Oct. 2002), p. 8, Declassified.

This dissent not only preserved U.S. diplomatic credibility in the long term but also highlighted the dangers of overreliance on uncertain technical intelligence divorced from geopolitical context and reliance on sole, unreliable assets (i.e., “Curveball”, subject to a burn notice).

Russian Interference in the 2016 U.S. Election

In the January 2017 Intelligence Community Assessment (ICA), INR was a co-author alongside the CIA, NSA, and FBI. INR fully endorsed the judgment that Russia interfered in the 2016 presidential election with the intent of helping then-candidate Donald J. Trump. Unlike the NSA’s “moderate confidence,” INR expressed “high confidence” in the assessment (ODNI ICA 2017-01D, “Assessing Russian Activities and Intentions in Recent U.S. Elections,” Jan. 6, 2017). The INR’s contribution was key to bolstering the legitimacy of the ICA amid partisan scrutiny.

Warning of the Potential for Genocide in Rwanda (1994)

Though often overlooked, the INR produced early assessments indicating the risk of mass violence in Rwanda before the April 1994 genocide. These assessments were among the few within the IC to link escalating interethnic tensions and the collapse of the Arusha Accords to the potential for mass atrocities. A State Department cable dated April 1, 1994, warned of “a planned campaign of violence” by Hutu extremists The INR analysist that authored the report was tragically ignored at the policy level (State Cable 094659, April 1, 1994, Declassified under FOIA).

Budgetary Threats: Undermining a Critical Node in Strategic Intelligence

The FY2025 presidential budget request proposes a 17% reduction in the INR’s operational funding cutting approximately $15 million from its analytic programs, staff training, and diplomatic intelligence integration efforts (Congressional Budget Justification, Department of State, FY2025, pp. 112–114). Case in point, a report (07/21/2025) from “an official inside the State Department’s Bureau of Intelligence and Research (INR) stated that two offices have been eliminated, one focused on education, and the other responsible for intelligence sharing with foreign governments.” (Homeland Security Today) While such cuts may appear numerically small, they pose a disproportionate risk to the IC’s analytical diversity and strategic foresight. INR operates with a compact, specialized cadre of analysts who often possess region-specific language and cultural proficiency, and decades of diplomatic experience. This sort of expertise cannot be rapidly regenerated once shown the door.

INR’s function in supporting U.S. embassies with intelligence briefings and diplomatic threat assessments will be dangerously constrained. As the IC continues to emphasize cyber threats, great power competition, and non-state actors, the INR remains the only agency that fully integrates foreign policy objectives into intelligence production.

The proposed cuts also jeopardize INR’s role in managing the Humanitarian Information Unit (HIU), which provides critical geospatial intelligence for conflict zones and disaster response. Budget constraints will degrade the HIU’s ability to deploy timely, unclassified intelligence products for decision-makers and humanitarian actors, especially in regions like Sudan, Haiti, and Gaza.

Summation

The Bureau of Intelligence and Research remains indispensable to informing sound U.S. foreign policy and the broader mission of the Intelligence Community. Its record of analytical excellence, principled dissent, and regional expertise often exceeds in breadth and depth other I.C. members. INR’s contribution is thus unmatched. From warning against skewed WMD claims to identifying hostile FIS influence operations, INR has proven that size does not equate to strategic punch. Its diplomatic intelligence orientation allows it to view global events through a lens of nuance often missing from those agencies focused on technical collection and limited asset HUMINT. To weaken the INR through budgetary attrition is to court strategic blindness. Especially in an era marked by global realignment, hybrid warfare, and renewed great-power rivalry, the INR’s voice must be amplified, not silenced. Any degradation of its capability represents not only a loss to the Department of State but a dangerous diminution of America’s strategic planning capacity.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

References

Director of National Intelligence (ODNI). (2023). United States Intelligence Community Budget Overview. https://www.dni.gov

National Intelligence Council. (2002). National Intelligence Estimate 2002-16HC, “Iraq’s Continuing Programs for Weapons of Mass Destruction” (Declassified). https://www.dni.gov/files/documents/Newsroom/Reports%20and%20Pubs/2002_NIE_WMD.pdf

ODNI. (2017). ICA 2017-01D: Assessing Russian Activities and Intentions in Recent U.S. Elections (Declassified). https://www.dni.gov/files/documents/ICA_2017_01.pdf

Department of State. (1994). Cable 094659 from U.S. Embassy Kigali, April 1, 1994 (Declassified under FOIA).

U.S. Department of State. (2024). Congressional Budget Justification, Department of State, FY2025. https://www.state.gov/reports/fy-2025-congressional-budget-justification

Posted on

CIA Tradecraft Review: Did Russian FIS Interfere in the 2016 Election?

russia, russian foreign intelligence, intelligence, counterintelligence, espionage, counterespionage, subversion

The U.S. Intelligence Community Assessment (ICA) of January 6, 2017, titled “Assessing Russian Activities and Intentions in Recent US Elections,” has been released. As anticipated, it has caused fierce controversy, largely along partisan lines. The report concluded with high confidence that Russian President Vladimir Putin ordered an influence campaign aimed at the 2016 U.S. presidential election, with the explicit intent to damage Hillary Clinton’s chances and to help elect Donald J. Trump. Subsequent reviews, including the 2025 CIA Directorate of Analysis (DA) tradecraft report, have scrutinized certain aspects of the ICA’s internal work, there is no credible evidence that refutes the fundamental claim that Russian intelligence services interfered. A comprehensive review of official U.S. government investigations, independent reports, and declassified materials affirms the legitimacy of the ICA’s core finding.

I am basing this analysis on the publicly-facing document which contains some significant ‘black-out’ redactions. Those redactions do not invalidate the core of the assessment and there are good justifications for their exclusion.

What is ‘Blacked-Out’

Specific positions of CIA, FBI, and NSA personnel who contributed to the ICA or participated in internal I.C. debate have been extracted. These individuals were not publicly known figures like Director Brennan or DNI Clapper, and therefore their identities remain protected for operational security. The redactions include analytic line officers, mission center managers, and mid-level coordinators whose participation would be readily identifiable by job title or context. Protecting these names aligns with intelligence S.O.P., especially for personnel involved in sensitive political assessments.

A central redaction concerns the highly classified CIA serialized report that underpinned the ICA’s “aspired” judgment about Putin’s preference for Trump. The specific contents of this report remain classified. This is due to its likely origin from a uniquely sensitive HUMINT source or technical collection platform. The Tradecraft Review indicates that this report was narrowly held, and not serialized until December 2016, suggesting it contains material that would compromise collection methods or expose a clandestine asset if disclosed. Some sections reference analytic decisions to include or omit parts of intelligence reporting. Direct quotes or paraphrased summaries of raw intelligence that suggested alternative interpretations of Putin’s intent are logically excluded. These redactions reflect legitimate tradecraft deliberation but also contain operationally sensitive material not appropriate for public release, including specific source citations or field report language.

Portions discussing Brennan’s creation of a special Fusion Cell and the restricted access to intelligence materials omit codewords and program names related to special compartments. These would include the names of CIA internal groups or clearance levels, operational terms for sensitive works, and the identities of officers working within those projects. These redactions preserve the integrity of compartmented information management protocols and protect methodologies that may still be in use.

I firmly believe that complementary reporting was received from liaison FISs/FIEs. Redacted content in this context likely conceals the nationality, origin, or method of foreign partner contributions. Revealing such details would violate long-standing “third party rule” agreements and jeopardize future collaboration with allied intelligence services.

The Meat of the Matter

The declassified version of the ICA concluded that Russia’s goals were to “undermine public faith in the U.S. democratic process, denigrate Secretary Clinton, and harm her electability and potential presidency,” and further, that “Putin and the Russian Government developed a clear preference for President-elect Trump” (ODNI, 2017). These findings were endorsed with “high confidence” by the CIA, FBI, and NSA (the latter assigning “moderate confidence”) to the judgment about Putin’s aspiration to help Trump. The ICA was the result of a coordinated effort by three key intelligence agencies and was supported by substantial intelligence reporting, including cyber forensics, human intelligence (HUMINT), and intercepted communications (SIGINT). It was not, as some media narratives have suggested, based solely on the controversial Steele Dossier, which was not used to support any key analytic judgments but was included only as an annex.

The Mueller Investigation and DOJ Indictments

Special Counsel Robert Mueller’s investigation into Russian interference produced robust corroboration of the ICA’s central conclusions. The Mueller Report, released in 2019, found, “The Russian government interfered in the 2016 presidential election in sweeping and systematic fashion” (Mueller Report, Vol. I, p. 1).” Two major components of this interference were outlined:

The Internet Research Agency (IRA): A Russian troll farm that used fake social media accounts to promote pro-Trump and anti-Clinton narratives, targeting U.S. voters with disinformation, racial division, and conspiracy theories.

Russian Military Intelligence (GRU) Operations: The GRU conducted cyber intrusions into the Democratic National Committee (DNC), the Democratic Congressional Campaign Committee (DCCC), and Clinton campaign chairman John Podesta, stealing tens of thousands of emails and documents, which were strategically leaked via Wikileaks.

Twelve GRU officers were indicted by the Department of Justice in July 2018 for these operations (DOJ Indictment, 2018), establishing the direct role of Russian military intelligence in hacking and disseminating stolen data for political impact. The indictment’s forensic details, including the specific units and servers used, leave no room for ambiguity as to the perpetrators or their intentions.

Bipartisan Senate Intelligence Committee Report

The U.S. Senate Select Committee on Intelligence conducted a multi-volume, bipartisan investigation into Russian interference, culminating in a 966-page final report in August 2020. The committee validated the ICA’s primary conclusions, “The Committee found that the ICA presents a coherent and well-constructed intelligence basis for the assessment that Putin and the Russian government aspired to help President-elect Trump’s election chances” (SSCI, Volume 5, p. 6). The committee reported that the ICA was not politically driven, that dissenting views were aired, and that the analytic tradecraft was sound despite the rushed timeline. It also noted that the Russian government viewed a Trump presidency as favorable to Moscow’s interests, particularly due to Trump’s stated skepticism toward NATO and the transatlantic alliance.

Russian Messaging and Disinformation Strategy

Open-source analysis of Russian disinformation also supports the conclusion that Trump was the preferred candidate. The Hamilton 68 dashboard, maintained by the Alliance for Securing Democracy, tracked pro-Kremlin Twitter activity and documented a clear slant toward Trump, along with the propagation of hashtags and narratives attacking Clinton and promoting voter distrust.

Russian state media such as RT and Sputnik displayed markedly pro-Trump coverage and actively spread conspiracy theories about Clinton’s health, corruption, and the DNC emails (Brookings Institution, 2017). The timing and content of Wikileaks dumps were strategically synchronized with key moments in the election to maximize damage to Clinton, such as the release of Podesta’s emails hours after the Access Hollywood tape was revealed.

Intelligence Community Reassessment in 2025

The 2025 CIA Tradecraft Review, while critical of procedural anomalies, did not retract or invalidate the ICA’s conclusions. Instead, it affirmed that the “aspired” judgment, that Putin wanted Trump to win, was plausible and supported by credible evidence. However, it argued that the “high confidence” level should have been “moderate confidence” due to the reliance on a single highly classified report (Tradecraft Review, 2025, p. 6).

Even this critique, however, explicitly stated, “The DA Review does not dispute the quality and credibility of the highly classified CIA serialized report… The ICA authors’ interpretation of its meaning was most consistent with the raw intelligence” So, while advocating for stricter tradecraft standards and a more cautious confidence level assignment, the report reaffirmed that the core intelligence judgments remained defensible and well-founded.

No U.S. government entity, CIA, NSA, ODNI, or the Department of Justice, has issued a formal repudiation of the ICA’s 2017 findings. While internal reviews have called for greater transparency and adherence to tradecraft standards, no post hoc analysis has offered an alternative judgment asserting that Russia was neutral or preferred Clinton over Trump. In fact, public statements by senior Trump-era officials confirm the ICA’s findings. Former Director of National Intelligence Dan Coats, for instance, stated in 2018, “The Russians are still trying to influence our elections. The warning lights are blinking red again. It was Russia’s intent to interfere, and it was clearly to hurt Hillary Clinton and help Donald Trump” (DNI Coats, Aspen Security Forum, 2018).

In Summary

The claim that Russian FIS interfered in the 2016 U.S. presidential election is substantiated by a broad and consistent body of evidence from multiple independent, bipartisan, and interagency investigations. The ICA, the Mueller Report, the DOJ indictments, and the Senate Intelligence Committee’s findings converge to form a coherent narrative: that the Russian government engaged in an expansive campaign to damage Hillary Clinton and to bolster Trump’s candidacy. Attempts to discredit this conclusion relying on political framing or selective interpretation of later reviews do not withstand the weight of forensic, testimonial, and documentary evidence. While internal CIA reviews have rightly scrutinized tradecraft and process, they do not reverse the analytical consensus that Russia interfered, and did so in a manner aligned with Moscow’s preference for Trump.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

References

Office of the Director of National Intelligence (ODNI). (2017). Assessing Russian Activities and Intentions in Recent US Elections. https://www.dni.gov/files/documents/ICA_2017_01.pdf

Mueller, R. S. (2019). Report on the Investigation into Russian Interference in the 2016 Presidential Election. https://www.justice.gov/storage/report.pdf

Department of Justice. (2018). Indictment of Russian GRU Officers for DNC Hack. https://www.justice.gov/file/1080281/download

U.S. Senate Select Committee on Intelligence. (2020). Report on Russian Active Measures Campaigns and Interference in the 2016 U.S. Election, Volume 5. https://www.intelligence.senate.gov/sites/default/files/documents/report_volume5.pdf

CIA Directorate of Analysis. (2025). Tradecraft Review of the 2016 Intelligence Community Assessment on Russian Election Interference.

Brookings Institution. (2017). The Kremlin’s Strategy: Pro-Trump Coverage and Disinformation. https://www.brookings.edu/articles/how-russian-state-media-views-the-2016-election/

Coats, D. (2018). Remarks at Aspen Security Forum. https://www.c-span.org/video/?448718-1/dan-coats-says-warning-lights-blinking-red-russian-cyberattacks

Posted on

Grief and the HUMINT Operator, the Personal Toll of Covert Intelligence Operations

HUMINT, intellgence, counterintelligence, espionage, counterespionage, c. constantin poindexter;

It’s not all James Bond and Jason Bourne. The good guy doesn’t always win in the end. Covert work, more specifically covert human intelligence (HUMINT) operations are the most psychologically and morally demanding forms of spying. OSINT and keyboard collectors don’t feel the grief of an intelligence officer in the field. Case officers recruit, develop, handle, and ostensibly protect their agents (“sources” or “assets”), instructing them in appropriate tradecraft to steal secrets and avoid getting caught. These activities are routinely conducted in denied areas. When these agents operate these hostile environments, the stakes are life or death. Discovery often means that the asset will be tortured, executed, and their families persecuted or likewise killed. As seasons of service pass, it is almost inevitable that some agents will be compromised and lost. The emotional burden on the officer responsible for their survival is profound, marked by grief, guilt, and an enduring sense of moral failure.

The humanitarian bond and psychological investment

The key to success as a case officer is the cultivation of a very personal relationship, deep personal rapport with his or her source. A true friendship rooted in trust, empathy, and shared purpose is imperative. A psychological study on intelligence elicitation revealed that non-coercive strategies coupled with rapport-building yield richer and more accurate information acquisition, underscoring how vital emotional connection is to both efficacy and trust. These very human bonds mean that officers break bread, confide in, and take proactive steps to protect their agents. The resulting interpersonal ties transcend formal professional promises. This emotional investment means that when an agent is caught, disappeared, tortured, killed, or all of the above, the officer experiences not just operational failure, but also a deep personal loss. They bear responsibility for agent safety so when the wheels come off, the intelligence officer invariably suffers from a sense of personal culpability. Survivor guilt among those who ‘live through’ while others perish is well documented in trauma psychology.

Survivor guilt and moral injury

Survivor guilt refers to the distress and self-loathing felt by individuals who outlive someone else when they played a role in the other’s fate. In HUMINT, officers feel they failed agents that they recruited, agents who trusted them implicitly. This places officers at risk for moral injury, a condition in which one’s actions or inactions violate their own moral code. The loss of an agent can trigger intense guilt. “I could’ve done more,” “I should’ve seen the compromise,” or “I didn’t protect them like a parent protects a child.”, are common recurring emotional punishments. A recent article on traumatic loss highlights how survivor guilt can evolve into chronic shame and self-destructive rumination unless addressed . This phenomenon aligns closely with what seasoned intelligence officers share in post-action debriefs, i.e., guilt compounded by the clandestine nature of their relationship with agents where that guilt must remain hidden behind professional composure and confidentiality oaths.

Grief within the cloak of secrecy

Unlike traditional warfighter loss, agent deaths or arrests rarely receive acknowledgment nor are honored publicly. There’s no funeral, no rope-dropping anniversary ceremonies, no celebration of life nor what the source contributed. The clandestine world awards no medals for agents who vanish. Intelligence officers grieve in silence and isolation with few official outlets, little acknowledgment, and often no practical nor legal avenue to care for a source’s family. Psychology literature highlights that complicated grief, grief unspoken and unacknowledged driver to depression, PTSD, and physical illness. In clandestine HUMINT, agents operate for years within strict tradecraft boundaries. Case officers managing or sole agents develop significant moral and emotional ties to them. Losing an agent isn’t just a tactical failure within the intelligence agency’s collection strategies. It is the death of someone known intimately and often their families.

The moral complexities of manipulation and betrayal

HUMINT work inherently involves manipulation, the cultivation and direction of individuals that betray their countries. There is no pretty way to describe it. We teach assets to lie, steal, and live dangerous double lives. Covert operators must deploy emotional leverage, sometimes deception, frequently bribery, “ . . . to ensure loyalty and compliance”. As reported in ‘Intelligence & National Security’, manipulation is part of the deal but when influence crosses into coercion or deception, moral dilemmas arise. When an agent is lost, the officer may and often does ask him or herself, “Did I manipulate them into this disaster? Did I betray my own moral code by pushing them into extreme danger?” Psychological research warns that psychological manipulation “targets unconscious, intuitive, or emotional modes of thought… violating autonomy, freedom and dignity”.

Training v. operational seasoning

Formal HUMINT training emphasizes tradecraft, security, and risk/reward management. Intelligence officers learn strict protocols around recruitment, handling, and termination of agents. Real-world operations in hostile environments introduce chaotic variables. Even the most seasoned officer cannot foresee novel counterintelligence techniques, surveillance technology, or unexpected betrayals by intermediaries or an insider threat. As one analysis notes, seasoned double- or triple-agent running reduces an officer’s control. The very experience that can make an officer a great handler can become a liability, undermining his or her ability to predict perils to the asset and operation, increasing their feelings of personal responsibility when things go wrong.

Organizational culture and aftercare

Intelligence services are bad at normalizing and institutionalizing grief processing for covert HUMINT operators. Agencies debrief performance and analyze operational failures, but do a piss-poor job at addressing the emotional consequences. There is a stigma associated with grief, and moral stress in environments that emphasize resilience and secrecy. In some Western countries, covert-source legislation acknowledges that agents and handlers engage in crimes to maintain cover and accomplish operations. Despite this, emotional and moral support for the officers who manage such morally complex situations remains painfully limited. Without interventions such as peer support groups, secret welfare services, or external counseling, intelligence officers risk burnout, emotional numbing, and PTSD.

The ripple effect on agents’ families

When an agent is compromised, repercussions often extend to their families, FIS (FIEs) frequently use assets’ families for leverage. They are targeted as co-conspirators, persecuted and attacked extrajudicially. Officers can manage systems to smuggle a family to safety or allow them to assume new identities but they are not as successful as we would like to assume. When agents die, officers feel they have failed an entire family. Culturally, agents’ loyalty often arises from protecting their families. Losing an agent can thus symbolize failure to protect a family entirely dependent on smart decisions by that operative and his or her handler.

Ethics and accountability

Scholars like Stephan Lau argue that intelligence agencies need pragmatic frameworks to distinguish legitimate influence from harmful manipulation in HUMINT operations. Such models assist case officers in making decisions grounded in ethical clarity rather than moral ambiguity. Institutionalized ethical guidance and accountability structures can both reduce morally damaging decision-making and help handlers process loss after operations fail. Albeit not a panacea, ethical oversight on recruitment, coercion thresholds, and risk assessment can lessen post-hoc guilt and defend against corrosive shame.

Operating at the intersection of psychology, ethics, and national security, HUMINT case officers experience pressures unique to clandestine work. They recruit and manage individuals willing to risk their lives and those of their families for a foreign intelligence entity’s objectives. The loss of such agents in hostile environments imposes profound emotional and moral wounds. Survivor guilt, grief, and rumination on perceived ethical failures are the inevitable result. Individual case officer well-being and institutional resilience is possible. By building ethical guidance, grief acknowledgment processes, peer support structures, and mental health interventions tailored to clandestine realities, HUMINT organizations can care for their own and honor the sacrifices of their assets. In so doing, they protect not just robust operational effectiveness, but the humanity of the professional officers who serve in the shadows.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

References

Goodman Delahunty, J., O’Brien, K., & Gumbert-Jourjon, T. (2014). Reframing intelligence interviews: Rapport and elicitation. Journal of Investigative Psychology and Offender Profiling, 11(2), 178–192.

Lau, S. (2022). The Good, the Bad, and the Tradecraft: HUMINT and the Ethics of Psychological Manipulation. Intelligence and National Security, 37(6), 895–913.

Neria, Y., Nandi, A., & Galea, S. (2008). Post-traumatic stress disorder following disasters: a systematic review. Psychological Medicine, 38(4), 467–480.

Robinaugh, D. J., LeBlanc, N. J., Vuletich, H. A., & McNally, R. J. (2014). The role of grief-related beliefs in complicated grief: A structural equation model. Behavior Therapy, 45(3), 362–372.

Feeney, B. C., & Collins, N. L. (2015). A new look at social support: A theoretical perspective on thriving through relationships. Personality and Social Psychology Review, 19(2), 113–147.

Herman, J. L. (1992). Trauma and Recovery: The Aftermath of Violence—from Domestic Abuse to Political Terror. Basic Books.

Jones, S. G. (2014). Covert Action and Counterintelligence in the Cold War and Beyond. RAND Corporation.

UK Parliament. (2019–2021). Briefing Paper: Covert Human Intelligence Sources (Criminal Conduct) Act.

Shane, S. (2015). Objective Troy: A Terrorist, a President, and the Rise of the Drone. Tim Duggan Books.

Zegart, A. (2007). Spying Blind: The CIA, the FBI, and the Origins of 9/11. Princeton University Press.

Posted on

Defense Intelligence Agency 2025 Threat Assessment, a Brief Review

seguridad nacional, DNI, CNI, espionaje, contraespionaje, inteligencia, contrainteligencia, espia, C. Constantin Poindexter

The 2025 Defense Intelligence Agency (DIA) Worldwide Threat Assessment offers a reasonable thorough overview of global security challenges. There are however certain emerging threats either underrepresented or omitted entirely. I am going to offer a few of my concerns and my thoughts on the implications of the same for U.S. national security. This is not a classified assessment but rather some informed opinion and analysis grounded in open-source intelligence and expert views.

Insider Threats and Human Intelligence Vulnerabilities

The DIA report emphasizes external adversaries, It notably underplays the risks posed by insider threats. A recent incident within the very agency that has provided the 2025 report, underscores this vulnerability. Nathan Vilas Laatsch, is a 28-year-old IT specialist formerly employed by the Defense Intelligence Agency (DIA). Laatsch was arrested on May 29, 2025, for attempting to transmit national defense information to a German government representative. He worked within the DIA’s Insider Threat Division and held a top-secret security clearance. The arrest followed an FBI investigation initiated after a tip-off in March 2025, leading to a sting operation where an undercover agent posed as a foreign official. This breach highlights counterintelligence deficiencies, internal security protocols and the challenges of detecting moles and/or other malicious insiders. Advanced behavioral analytics and machine learning models, such as deep evidential clustering are offering promise in identifying anomalous activities indicative of insider threats. Unfortunately, the integration of such technologies across intelligence community member agencies remains dangerously inconsistent. Addressing this gap requires not only technological adoption but also a cultural shift to robust and proactive internal threat detection.

Artificial Intelligence (AI) and Autonomous Systems as Emerging Threats

The rapid advancement of AI and autonomous systems presents both opportunities and perils. The DIA report acknowledges technological proliferation, however, it lacks a focused analysis of the misuse of AI in cyber warfare, autonomous weaponry, and information manipulation. Recent scholarly work proposes the establishment of an AI incident regime to monitor and counteract threats posed by advanced AI systems. Among recent peer-reviewed material is an excellent piece by Alejandro Ortega. “We put forward a proposal for an AI incident regime that will help to counter threats to national security posed by AI systems, . . . Our ambition is to enable a government agency to maintain comprehensive awareness of AI threats and rapidly counter any resulting risks to national security.” (Ortega, 2025) Frameworks such as that offered by Ortega aim to ensure that AI deployments do not inadvertently compromise national security, and suggest countermeasures that can effectively mitigate identified risks. Given the dual-use nature of AI technologies, there is an urgent need for comprehensive policies that address both their development and potential weaponization.

Unidentified Aerial Phenomena (UAPs) and Aerospace Security

Unidentified Aerial Phenomena (UAPs) have garnered increasing attention due to their potential implications for national security. The DIA report does not address this issue at all. A 2021 assessment by the Office of the Director of National Intelligence highlighted 144 UAP incidents, with 143 remaining unexplained. These occurrences, often near sensitive military installations, raise concerns about airspace sovereignty and surveillance vulnerabilities. The absence of a clear understanding of UAPs hampers the development of effective countermeasures. Integrating UAP analysis into broader threat assessments is essential to ensure comprehensive aerospace security. I am not suggesting that the I.C. should engage in a hunt for UFOs, as the UAPs are more likely collection mechanisms deployed by adversarial FIS, however, leaving the subject matter entirely unaddressed is questionable.

Space-Based Threats and Counterspace Capabilities

The DIA report addresses space and counter-space capabilities. It does NOT offer the breadth nor depth of analysis and informed opinion into the evolving threats in this domain that I expected. This omission is surprising, considering its direct import to the DIA’s most important customers. The Center for Strategic and International Studies’ 2025 Space Threat Assessment details the growing counter-space capabilities of nations like China and Russia, including anti-satellite weapons and electronic warfare tactics. The militarization of space poses GRAVE risks to satellite communications, navigation systems, and surveillance operations. It also endangers the antiquated GPS architecture on which global trade and national security agencies rely. Ensuring the resilience of space-based assets requires not only technological advancement but also international norms and agreements to prevent escalations in this new frontier.

The 2025 DIA Worldwide Threat Assessment provides valuable insights into current global security challenges, however, the omission or underrepresentation of insider threats, AI and autonomous systems, UAPs, and comprehensive space-based threats indicates areas requiring thorough attention. Addressing these gaps is crucial for a holistic understanding of the evolving threat landscape and for formulating effective countermeasures to safeguard national security.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

References

Department of Justice. “U.S. Government Employee Arrested for Attempting to Provide Classified Information to Foreign Government.” U.S. Department of Justice, May 29, 2025.
https://www.justice.gov/opa/pr/us-government-employee-arrested-attempting-provide-classified-information-foreign-government.

Nakashima, Ellen, and Devlin Barrett. “Pentagon Intelligence Employee Accused of Leaking Secrets to a Foreign Nation.” The Washington Post, May 30, 2025.
https://www.washingtonpost.com/dc-md-va/2025/05/30/dod-classified-document-leak/.

Tucker, Eric. “Justice Department Says Pentagon Employee Tried to Give Classified Info to Foreign Government.” Associated Press, May 30, 2025.
https://apnews.com/article/e60388df7f4e07a8d8d942d86513b27c.

Ortega, Alejandro. “A Proposal for an Incident Regime That Tracks and Counters Threats to National Security Posed by AI Systems.” arXiv preprint, March 29, 2025.
https://arxiv.org/abs/2503.19887.

Defense Intelligence Agency. Statement for the Record: Worldwide Threat Assessment. Submitted to the Senate Armed Services Committee, March 2025.
https://armedservices.house.gov/uploadedfiles/2025_dia_statement_for_the_record.pdf.

Center for Strategic and International Studies (CSIS). Space Threat Assessment 2025. Washington, DC: CSIS, 2025. https://www.csis.org/analysis/space-threat-assessment-2025.

Office of the Director of National Intelligence (ODNI). Preliminary Assessment: Unidentified Aerial Phenomena. Washington, DC: ODNI, June 25, 2021. https://www.dni.gov/files/ODNI/documents/assessments/Preliminary-Assessment-UAP-20210625.pdf.

Posted on

Chinese Strategic SIGINT in Cuba: Implications for U.S. National Security

Bejucal, inteligencia china, inteligencia, contrainteligencia, espionaje, contraespionaje, CNI, SIGINT, c. constantin poindexter

Signals Intelligence (SIGINT) is a cornerstone of modern intelligence operations, encompassing the interception and analysis of electronic communications and emissions. SIGINT has in fact become the primary “INT” for the collection of highly sensitive information by all of the major powers that engage in global espionage. As geopolitical tensions escalate between the United States and the People’s Republic of China (PRC) and PRC allies, the strategic deployment of SIGINT assets has become a grave peril to U.S. national security. China has established multiple SIGINT facilities in Cuba, raising concerns about the potential threats to the United States and indeed its allies.

The Importance of Signals Intelligence (SIGINT)

SIGINT involves the collection and analysis of electronic signals to gather intelligence on foreign entities. It is divided into Communications Intelligence (COMINT), focusing on intercepted communications, and Electronic Intelligence (ELINT), which pertains to electronic emissions from devices such as radars. SIGINT provides critical insights into adversaries’ capabilities, intentions, and activities, supporting decision-making at strategic, operational and tactical levels. It enables the monitoring of military movements, the detection of threats, and the protection of national interests.

China’s Proficiency in SIGINT Operations

China has developed extensive SIGINT capabilities, positioning itself as a formidable player in this particular intelligence discipline. The PRC operates numerous ground-based SIGINT stations across its territory, including significant facilities on Hainan Island deployed to monitor U.S. naval activities in the South China Sea. Additionally, China has invested in spaceborne ELINT systems mounted on satellites, enhancing its global surveillance reach. Clearly, China’s SIGINT operations are not confined to its borders. The PRC has established overseas facilities and deployed collection vessels to monitor foreign military operations. These efforts are part of a broader strategy to expand China’s intelligence-gathering capabilities and assert its global influence.

Chinese SIGINT Facilities in Cuba: Threat Surface and Geographic Reach

The establishment of Chinese SIGINT facilities in Cuba represents a strategic move to enhance surveillance capabilities in proximity to the United States. Reports suggest that China operates multiple SIGINT sites on the island, including facilities in Bejucal, Santiago de Cuba, and Paseo. These installations are equipped with advanced technologies, such as Circularly Disposed Antenna Arrays (CDAAs), capable of intercepting signals over vast distances. The Bejucal site, for instance, can reportedly monitor radio signals from 3,000 to 8,000 miles away, encompassing key U.S. military installations and even Washington, D.C. The geographic proximity of these facilities to the U.S. mainland allows for the potential interception of sensitive communications, posing significant risks. The ability to monitor U.S. military movements, disrupt critical communications, and gather intelligence on defense operations underscores the strategic value of these Cuban installations to China’s intelligence apparatus. The installations also pose a grave threat to U.S. intelligence and defense allies throughout the Caribbean and Latin America.

U.S. Counterintelligence Measures to Thwart Foreign SIGINT Threats

In response to the growing threat posed by foreign SIGINT operations, the United States has implemented a comprehensive counterintelligence strategy. The National Counterintelligence and Security Center (NCSC) leads efforts to identify, deceive, exploit, disrupt, and protect against espionage activities conducted by foreign powers. Adequate countermeasures may significantly neutralize the threats posed by Chinese FIS SIGINT activities and reduce perils to the integrity of U.S. intelligence and defense operations, to wit;

Enhanced Surveillance and Monitoring

The United States employs an integrated suite of ground-based, airborne, maritime, and space-based systems to detect and track hostile intelligence collection efforts, including SIGINT platforms positioned near U.S. territory. Ground-based monitoring stations operated by the NSA and partner agencies use highly sensitive direction-finding systems and frequency analysis to identify anomalous electromagnetic emissions, often correlating these signals with known adversary signatures cataloged in classified ELINT databases. Aerial and UAV platforms equipped with hyperspectral and electronic surveillance payloads patrol maritime peripheries, particularly in the Gulf of Mexico and Caribbean airspace.

Department of Defense programs such as those operated via Special Access Programs (SAPs) mechanism enable geo-location of foreign collection antennas and triangulation of suspected listening posts. Tasking of National Technical Means (NTMs), including SIGINT satellites (e.g., the Advanced Orion/Trumpet series), is adjusted in response to emerging threats. Further, electromagnetic deception operations (EMDEPs) that broadcast decoy signals can saturate and/or confuse Chinese FIE collectors operating from proximate offshore platforms or Cuban bases.

Cybersecurity Initiatives

U.S. cybersecurity strategy accomplished through the NSA’s Cybersecurity Directorate, U.S. Cyber Command (USCYBERCOM), and the Department of Homeland Security, focuses on both defensive and offensive operational postures. Defensive mechanisms include zero-trust architectures for federal systems, the implementation of hardware-based root-of-trust (e.g., TPM modules), and AI-enabled intrusion detection systems (IDS) capable of parsing massive volumes of network telemetry for command-and-control (C2) beaconing which is indicative of foreign APTs (Advanced Persistent Threats).

U.S. operations conducted under Title 10 and Title 50 allow the employment of hunt-forward teams, specialized cyber units deployed to partner nations to observe adversary TTPs (tactics, techniques, and procedures) in real-time. These teams report findings back to fusion centers like the NSA’s Threat Operations Center (NTOC). Simultaneously, Project RAVEN-type initiatives and signals denial campaigns target adversary collection nodes via cyber disruption, occasionally using polymorphic malware or firmware sabotage targeting China’s collection infrastructure or its remote access trojans (RATs).

Diplomatic Engagements

The United States utilizes a range of bilateral and multilateral mechanisms to limit adversarial intelligence penetration. Bilaterally, intelligence-sharing arrangements such as the ‘Five Eyes’ alliance, the Defense Intelligence Enterprise, and regional partnerships (e.g., Joint Interagency Task Force South) enable coordinated monitoring of Chinese SIGINT activity. Cuba is a unique case as formal diplomacy simply doesn’t exist in any meaningful way. Thus, diplomatic backchanneling via neutral third parties and pressure through the Organization of American States (OAS) are appropriate mechanisms to discourage Cuba from inviting foreign military basing and dual-use infrastructure development.

The Department of State embeds intelligence and security liaisons in embassies to collaborate with host nations’ internal security services. These attachés assist in countering influence operations and foreign direct investment in critical telecom sectors (think “Huawei-linked 5G nodes”), which may serve as covert SIGINT enablers. Foreign assistance programs such as the International Narcotics and Law Enforcement (INL) initiative can also be leveraged to enhance allies’ counterintelligence capabilities in the Dominican Republic, Central and South America.

Legislative Actions

Congress has passed a suite of legislative instruments aimed at mitigating foreign intelligence risks. These include the Foreign Investment Risk Review Modernization Act (FIRRMA), which expanded the jurisdiction of CFIUS to scrutinize Chinese acquisitions of U.S. technology companies. Additional statutory provisions under the Intelligence Authorization Acts have appropriated classified funding for the expansion of counterintelligence platforms targeting China’s Ministry of State Security (MSS) and People’s Liberation Army Strategic Support Force (PLASSF). Further, the Secure and Trusted Communications Networks Act mandates the removal of high-risk equipment (such as Huawei and ZTE hardware) from federal and contractor systems. Further, targeted sanctions under IEEPA (International Emergency Economic Powers Act) have been used to deny export privileges and financial access to Chinese firms known to support Beijing’s global surveillance infrastructure. New initiatives that “double down” on these resources is imperative.

The deployment of Chinese SIGINT facilities in Cuba is a dangerous expansion of China’s intelligence capabilities, directly impacting U.S. national security. The proximity of these installations to the U.S. mainland enhances their potential to intercept sensitive communications and monitor military activities. Without cooperation from the Cuban government, counterintelligence efforts to detect, deter, and neutralize Chinese FIE threats must evolve to address the “near home” espionage, subversion and/or sabotage capability. As global power dynamics change, largely due to the PRC’s efforts to remake the international order to suit its strategic needs, robust SIGINT capabilities of our own and vigilant counterintelligence measures remain essential methods of addressing the “Cuba is a PRC Espionage Platform” paradigm.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

Bibliography

Bureau of Industry and Security, U.S. Department of Commerce. Entity List Additions: Huawei and Affiliates. Washington, D.C., May 16, 2019. https://www.bis.doc.gov.

Center for Strategic and International Studies. “Secret Signals: Decoding China’s Intelligence Activities in Cuba.” Hidden Reach. May 2025. https://features.csis.org/hiddenreach/china-cuba-spy-sigint/.

———. “A Snapshot of New Activity at Cuban Spy Sites.” Hidden Reach Snapshots. May 2025. https://features.csis.org/hiddenreach/snapshots/cuba-china-cdaa-base/.

Congressional Research Service. Foreign Investment and National Security: Economic Considerations. CRS Report R46554. Washington, D.C., 2023. https://crsreports.congress.gov.

Director of National Intelligence. National Counterintelligence Strategy of the United States of America, 2020–2022. Washington, D.C.: Office of the Director of National Intelligence, 2020. https://www.dni.gov/files/NCSC/documents/features/20200205-National_CI_Strategy_2020_2022.pdf.

Gertz, Bill. “China Suspected of Using Four Cuban Bases to Spy on U.S.” The Washington Times, May 7, 2025. https://www.washingtontimes.com/news/2025/may/7/inside-ring-china-suspected-using-4-cuban-bases-spy-us/.

Information Resource Program. China: Signals Intelligence. Federation of American Scientists (FAS). Last modified 2017. https://irp.fas.org/world/china/program/sigint.htm.

National Security Agency. “Cybersecurity Collaboration Center: Threat Intelligence Sharing.” Accessed May 24, 2025. https://www.nsa.gov/Cybersecurity/Cybersecurity-Collaboration-Center/.

Office of Foreign Assets Control. Sanctions Programs and Information. U.S. Department of the Treasury. Accessed May 24, 2025. https://home.treasury.gov/policy-issues/office-of-foreign-assets-control-sanctions-programs-and-country-information.

U.S. Congress. Foreign Investment Risk Review Modernization Act of 2018. Public Law No: 115-232, §1701-1728. 132 Stat. 2173.

U.S. Department of Justice. China Initiative Cases Summary. Accessed May 24, 2025. https://www.justice.gov/nsd/information-about-department-justice-s-china-initiative-and-compilation-china-related.

U.S. Department of State. Bureau of International Narcotics and Law Enforcement Affairs (INL): Program Summaries. Washington, D.C., 2024. https://www.state.gov/inl-programs/.

U.S. Government Accountability Office. Cybersecurity: Agencies Need to Fully Establish Risk Management Programs and Address Challenges. GAO-19-384. Washington, D.C.: GAO, July 2019. https://www.gao.gov/products/gao-19-384.

U.S. House Permanent Select Committee on Intelligence. The Threat of Foreign Surveillance: Hearing Before the House Intelligence Committee. 117th Cong., 2nd sess., February 2024.