Posted on

Stealing From the Spooks is now a monograph

In September I posted a short piece on this blog called Stealing From the Spooks. The argument was simple. The United States Intelligence Community got burned, publicly and catastrophically, by its own mind-sets, and it responded by writing down how its analysts ought to think and then drilling it. Police departments have the same failure mode and, in wrongful convictions and unsolved cases, the same body count. So why in the world has policing not stolen the cure?

The post got more reaction than anything I have written on the subject. Analysts wrote to say they had been fighting that fight alone in their squad rooms for years. A couple of prosecutors wrote to say they had never once seen a written hypothesis matrix in a case file and would pay money for one. One detective wrote to tell me I was full of it, which is fair, and then asked where he could read more. That last question did not have a good answer. The blog post was a sketch. So I wrote the book.

Stealing From the Spooks: Structured Analytic Techniques for Law Enforcement Crime Analysis is a sixty page monograph, free, and you can download it here: ConstantinPoindexterAuthor.com. There is no paywall and no email form. Print it, hand it to your lieutenant, leave it on the prosecutor’s desk.

Where the ideas come from

Let me be clear about credit, because the title is a confession. The twelve techniques in the monograph are not mine. They come from a forty page unclassified document the US Government published in 2009, A Tradecraft Primer: Structured Analytic Techniques for Improving Intelligence Analysis, which in turn stands on Richards Heuer’s The Psychology of Intelligence Analysis. Heuer’s diagnosis is the whole foundation: analysts do not fail for lack of information, they fail because the human mind decides which facts to notice before conscious thought ever gets a vote (Heuer 1999; US Government 2009). Anyone who has watched a homicide squad lock onto a suspect in the first seventy two hours and then spend months bending every new fact to fit knows exactly what he was describing. The wrongful conviction literature calls it tunnel vision (Findley and Scott 2006). Heuer called it a mind-set. It is the same animal.

What is mine is the translation. The primer was written for people who track missile programs. I rebuilt it for the detective sergeant staring at a whiteboard full of string, the civilian crime analyst who can smell that the squad’s theory is running ahead of its evidence, the supervisor who signs charging recommendations, and the prosecutor who inherits whatever the investigation did or did not think about. Every chapter follows the same plan: what the primer says, what it looks like in a case file, how to run it with the people and hours a real unit actually has, and where it goes wrong.

What is in it

The primer sorts its techniques into three families, and the monograph keeps that order. The diagnostic techniques make the argument visible: the Key Assumptions Check, the Quality of Information Check, indicators, and Heuer’s Analysis of Competing Hypotheses. The contrarian techniques attack it on purpose: Devil’s Advocacy, Team A/Team B, High-Impact/Low-Probability analysis, and “What If?” analysis. The imaginative techniques go looking for the theories and futures nobody in the room has thought of yet: structured brainstorming, outside-in thinking, red teaming, and alternative futures.

Each one gets a worked example built for police work. A burglary series with an assumptions register that exposes two assumptions resting on nothing but habit. A shooting investigation with a source log that shows, in one column, that the whole theory is standing on a paid informant with secondhand knowledge and an identification run by a detective who already had a favorite. An arson matrix in which the squad’s two favorite facts, the unpaid rent and the increased insurance coverage, turn out to be consistent with every hypothesis on the board and therefore eliminate nobody. That last one is the lesson I most want a working detective to take away. A case is not built by piling up facts that fit. It is built by eliminating the explanations that do not.

The primer’s own showcase example, by the way, is a police case. During the 2002 Washington sniper shootings the working theory was a lone white male with military training in a white van. The primer breaks that sentence into its five assumptions and grades each one. The shooters were two Black males, one of them seventeen, in a blue Chevrolet Caprice that officers had run more than once during the spree. Nobody had written down that the investigation was assuming a van, so nobody recognized the Caprice as a contradiction of anything. You cannot notice the violation of an assumption you never admitted making. That sentence is the monograph in miniature.

The objection, and the answer

The pushback I hear most from investigators is legal, not analytical. “If we write down our doubts, the defense gets them.” The monograph spends a full chapter on that, because it is the objection that kills the practice before it starts. The short version: assume the defense will read every analytic product you write, and understand that this is a feature. Under Brady and Kyles the prosecution already owes the accused everything favorable that the police know, whether the prosecutor has heard about it or not. A dated matrix of considered and rejected hypotheses, a source log that recorded the informant’s motive on day one, a labeled devil’s advocate memo showing the department tried to break its own case before asking a jury to believe it: those are the things that survive cross examination. The cases that fall apart are the ones where the doubt existed, went unrecorded, and came out anyway, ten years later, in a habeas petition.

I also wrote a chapter the enthusiasts will not like, on the limits. The experimental evidence that these techniques make any individual analyst more accurate is thin, and the serious critics have a point (Chang et al. 2018; Dhami, Belton, and Mandel 2019). My answer is that accuracy is not the strongest argument for them in policing. Transparency is. A criminal case gets its accuracy from adversarial testing, and adversarial testing needs something written down to test. A theory that lives only inside the lead investigator’s head can be reviewed by no one.

For the chief who has read this far

The last part of the monograph is a program, not a sermon. A one page directive. A table of who owns what, with the civilian analyst as the owner of the method, deliberately, because the analyst is the person in the building least invested in the lead detective’s theory and least able to challenge it without standing. A ninety day rollout. A way to measure whether any of it is working that does not depend on the clearance rate. And a note for the nine officer department with no analyst, which can still do this with one sheet of paper and a devil’s advocate borrowed from the agency next door.

If a department adopts only three things from the whole document, they should be the assumptions register, the source log, and a devil’s advocate before charging. They are the cheapest. They catch the most.

The appendices hold blank worksheets for all of it and a supervisor’s checklist to run before a charging recommendation goes up. Photocopy them. That is what they are for.

Why I bother

I spent years inside the community that invented this discipline, and I carried a badge before that. I have sat in both rooms. The analytic cadre at Langley and the detective squad in a county building are closer cousins than either would admit: incomplete information, people who lie, a hierarchy in which the senior person’s theory becomes everyone’s theory, and a long record of confident error traced afterward to assumptions nobody wrote down. One of those communities got humiliated badly enough to fix it. The other is still running investigations with the analytic rigor of a bar argument.

The framework is public, it is free, and it is forty pages long. There is no excuse left for not using it. I put sixty more pages around it so there would be even less.

A Spanish edition, Robándoles a los Espías, is ready as well and will be posted separately on the author’s law firm blog for colleagues in the Dominican Republic, Puerto Rico, and the rest of the hemisphere.

~ C. Constantin Poindexter Salcedo, MA en Inteligencia, Certificado de Posgrado en Contrainteligencia, JD, certificación OSINT CISA/NCISS, Diplomado Negociación Estratégica de Harvard, Certificación BFFOC del DoD/DoS

References

  • Chang, Welton, Elissabeth Berdini, David R. Mandel, and Philip E. Tetlock. 2018. “Restructuring Structured Analytic Techniques in Intelligence.” Intelligence and National Security 33 (3): 337-356.
  • Dhami, Mandeep K., Ian K. Belton, and David R. Mandel. 2019. “The ‘Analysis of Competing Hypotheses’ in Intelligence Analysis.” Applied Cognitive Psychology 33 (6): 1080-1090.
  • Findley, Keith A., and Michael S. Scott. 2006. “The Multiple Dimensions of Tunnel Vision in Criminal Cases.” Wisconsin Law Review 2006 (2): 291-397.
  • Heuer, Richards J., Jr. 1999. The Psychology of Intelligence Analysis. Washington, DC: Central Intelligence Agency, Center for the Study of Intelligence.
  • US Government. 2009. A Tradecraft Primer: Structured Analytic Techniques for Improving Intelligence Analysis. March 2009.
Share this post:
Posted on

The Intelligence Cycle at NATO’s Northeastern Flank: A Critique

NATO's intelligence cycle argument.

My review of the field study of the intelligence cycle at Multinational Corps Northeast published in the International Journal of Intelligence and CounterIntelligence

This is a valuable article and an uneven one. As a body of evidence it is well above the standard of the journal in which it appears. As a work of social science it is middling, and as a test of the intelligence cycle as a model it does not succeed. The authors gathered a dataset that exists nowhere else in the open literature and reported what they found with a candor that argues for its credibility. They then asked that data to carry a theoretical conclusion it cannot bear, and they described their method in terms that do not match what they actually did. I recommend the piece without reservation as a snapshot of how a NATO corps practiced intelligence in the first year of the Russo-Ukrainian war, and as a pointer to two questions the field has neglected. I do not accept its closing claim that the results “largely reflect the academic critique on the intelligence cycle.” What they reflect is a cycle that was not being run.

The evidence is strong. Why?

The access alone justifies publication. Forty-nine semi-structured interviews with fifty-six respondents of fourteen nationalities, across nine units and commands in four countries, conducted inside cleared NATO working spaces between May and October 2022. No outside researcher obtains this, and the authors are honest that their own clearances, service backgrounds and cultural fluency were the price of admission. The timing matters as much as the volume. The interviews took place while the corps was digesting an Article 5 threat that its requirements, exercises and mandate had not anticipated.

The authors are also correct about the gap they fill. The debate over the intelligence cycle has run for two decades on the strength of Hulnick, Omand, Davies and a handful of others, and it has done so almost entirely without field data. NATO itself is nearly invisible in the two flagship journals. The bibliometric exercise the authors use to show this is crude, but the point stands and I have not seen it made before.

The findings are concrete and unflattering, which is precisely why I believe them. Priority intelligence requirements that drive nothing. A requirements and collection management function that every analyst routes around and that its own officers describe as having nothing to bring to a synchronization meeting. Open source work performed on a handful of internet terminals by staff who have never attended an OSINT course. The A through F and 1 through 6 source grading scheme collapsing the moment it is applied to a news article. Circular reporting infecting the shared databases because uploaded products carry no original sourcing. Analysts who have never once received feedback on a finished product. A major exercise in late 2021 run on a counterinsurgency scenario while a conventional threat gathered on the border. These are the details only insiders capture, and the authors captured them.

Two contributions are new rather than confirmatory. The first is the identification of Intelligence Requirement Management and Collection Management as the doctrinal mechanism the academic feedback critique has ignored. The critics have long argued that the cycle hides its feedback loops. NATO doctrine actually names a process to manage those loops, and this study shows it broken in practice. The second is the observation that practitioners critique the cycle only as proceduralists, complaining that the procedure malfunctions, while academics critique it as conceptualists, arguing that the model is wrong. That the two conversations do not touch is the most interesting thing in the paper and deserves an article of its own.

Why the argument doen’t make it

The central weakness is a confound the authors half acknowledge and then set aside. Multinational Corps Northeast in 2022 was a peacetime headquarters with a limited operational mandate and essentially no organic collection. Requirements were frozen around the Zapad exercises. The commander’s engagement with the requirements was, by the respondents’ account, minimal. A cycle with no collection assets, no direction and no consumer pull is not a test of whether the intelligence cycle is a valid model of intelligence. It is a starved cycle. The “self-organizing cycle” the authors describe, in which open source reporting and current events drive production and direction arrives last if at all, may say a great deal about mandate and posture and very little about the model. The case cannot discriminate between the proposition that the cycle is wrong and the proposition that the cycle was not being operated. A defensible conclusion would have been narrower: peacetime corps-level intelligence in NATO does not function as a cycle. The authors reached for the broader claim instead.

The methodology is dressed above its station. The authors invoke the Gioia method, which is inductive by design and insists on staying close to respondent terminology without preconceived categories. They then state, in the same section, that interviews were structured along the main lines of the academic critique of the cycle and that coding labels were drawn from that critique and from the proceduralist and conceptualist distinction. That is a deductive, theory-driven design wearing grounded theory clothing. There is no data structure figure, which is the signature artifact of the Gioia approach, no account of how first-order codes became second-order themes, and no measure of coder agreement. The results read as a competent thematic sort against a prior framework. That is a legitimate thing to do. It should be called what it is.

Sampling is a mixture of commander selection, volunteers, snowball referral and chance encounters. In a rank hierarchy, respondents chosen by their commanders are a known source of bias, and the authors do not discuss it. Forty-two of fifty-six respondents were intelligence personnel and only fourteen were consumers, yet the core finding concerns the absence of direction from the commander and his staff. The consumer side of that story is barely heard. Interviews could not be recorded, so every quoted line in the results is a reconstruction from two note takers, presented as verbatim. Participant observation and document study appear in the methods section and then never visibly enter the results. No triangulation is shown.

The authors’ insider position is handled well as a matter of access and ethics but not as a matter of interpretation. They are serving or former military intelligence professionals at a national defense academy. Their prescriptions, better alignment of organization to doctrine and more emphasis on IRM&CM in NATO training, are thoroughly proceduralist. Having diagnosed their respondents as unable to think outside the proceduralist frame, the authors then prescribe from inside it without noticing that they have done so.

Smaller matters accumulate. A counterintelligence review of the draft, together with a four-year lag between data collection and publication, means an unknown quantity of material was removed or softened. The corps’ structure and NATO’s northeastern posture have changed materially since 2022, and the note that respondents will have rotated addresses security but not currency. The claim that the findings “have validity outside the case” is asserted in a single sentence rather than argued. Several evaluative statements, that a particular maritime pattern analysis was “extremely valuable” or that certain OSINT fixes are “relatively easy,” carry no supporting evidence. The prose needed another pass; the grammatical slips are frequent enough that the journal’s copyediting should have caught them.

My Take

Read this article as an authoritative account of how a NATO corps actually did intelligence in the opening year of the war, and as the first empirical demonstration that the feedback problem the theorists have described for twenty years has a doctrinal name and an organizational home. Do not read it as settled evidence against the intelligence cycle as a model. The case was never in a position to deliver that verdict, and the authors should have said so.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification, Criminal Intelligence Analyst Classification 1 (IALEIA)

Share this post:
Posted on

The Power of OSINT: Attribution and the Identification of Oleg Smolenkov

spy, spies, intelligence, counterintelligence, counterespionage, C. Constantin Poindexter Salcedo, national security, NATSEC

The public identification of Oleg Smolenkov illustrates a contemporary counterintelligence reality, i.e., a sensitive resettled asset can be unmasked without a hostile service penetrating classified systems, without a HUMINT penetration of our services, and without a single administrative branch leak. The decisive mechanism is open-source convergence, the disciplined fusion of administrative traces, archived reporting, and behavioral cues into a coherent attribution. In this case, a non-governmental investigative newsroom and parallel OSINT collectors did not begin with a name. They began with a publicly reported event, a bounded time window, and an implied access profile. They exploited predictable transparency mechanisms in both Russia and the United States. The result was a high confidence linkage between an anonymized description of a relocated source and a specific individual, supported by cross-domain corroboration. (Bellingcat 2019; Reuters 2019a)

A counterintelligence practitioner evaluating this episode should resist the temptation to treat it as an exceptional scandal driven by personalities or politics. It is better understood as a repeatable analytic pipeline. The steps are familiar: cueing, candidate generation, plausibility testing, registry linkage, reaction validation, and signature reinforcement. Each step relies on data that appears mundane in isolation. The compromise emerges from aggregation.

The process begins with cueing. In early September 2019, major United States media described a clandestine extraction that occurred in 2017 involving a high-level Russian government source who had provided unusually sensitive insight into Kremlin and Russian policy-level decision-making. The reporting framed the extraction as protective and urgent, occurring after fears that the source’s security was at risk. Even when anonymized, those details are operationally useful to a determined investigator because they narrow the search space. The investigator obtains institutional scope, timing, and a risk narrative, which in counterintelligence terms function as selection criteria. The relevant question becomes: which Russian official with plausible access disappears from public view in the relevant period, under circumstances consistent with sudden relocation? (Time 2019; RFE RL 2019b)

Once cueing is in place, candidate generation becomes feasible. OSINT investigators queried Russian language media archives, cached pages, and secondary reporting for disappearance stories in the mid-2017 window that involved government personnel. The case benefited from pre-existing Russian reporting. Multiple outlets later described that Russian authorities had opened a criminal investigation in 2017 into the suspected murder of a missing official who disappeared during travel in Montenegro, and that the investigation was later abandoned after authorities concluded the individual was alive abroad. The Guardian reported that the online outlet Daily Storm had described that arc, including the murder probe and the eventual conclusion that the official had left Russia. (The Guardian 2019a; RFE RL 2019c) Reuters likewise reported that Kommersant identified the possible individual as Oleg Smolenkov, describing his disappearance in Montenegro in June 2017 with his wife and children, along with the evolution of the Russian investigative posture from suspected murder to an assessment that he was living abroad. (Reuters 2019a)

The OSINT collector has a candidate name and an event narrative that already fits the timing constraint. A counterintelligence practitioner will note the structural weakness revealed here. If an extraction or relocation corresponds to a conspicuous real-world absence, and if that absence triggers a foreign law enforcement process, then the foreign process itself can generate discoverable artifacts, including press interest, investigative leaks, and later retrospective reporting. Even if the foreign process is opaque, the fact pattern is often newsworthy enough to be recorded ‘somewhere’, and later rediscovered when a cueing event directs attention to it.

We now move to plausibility testing. A candidate must match the access and placement implied by the original extraction narrative. Collectors therefore, reconstruct a career trace from open sources. Reuters reported that the Kremlin confirmed that a person named Smolenkov had worked in the Russian presidential administration and had been dismissed, while disputing that he had meaningful access to President Vladimir Putin. (Reuters 2019a; Reuters 2019b) Whether or not one accepts the Kremlin’s minimization, the acknowledgement of employment is itself confirmatory for attribution purposes. This validates that the named candidate is not fictional, and places the asset inside the relevant institutional universe.

Supplementary open source synthesis connected Smolenkov to senior foreign policy structures, particularly through reporting that he had worked in the Russian embassy in Washington during a period associated with senior diplomat Yuri Ushakov and later served in roles linked to the presidential administration. Russia Matters summarized Kommersant reporting that described Smolenkov as a longtime assistant to Ushakov, which is precisely the kind of staff proximity that can produce indirect exposure to high-level deliberations without public prominence. (Russia Matters 2019) From a counterintelligence perspective, that distinction matters. A source does not need to be a cabinet-level decision maker to be strategically valuable. In many systems, staff, aides, and administrators are the connective tissue that accesses documents, schedules, and briefing flows. OSINT collectors correctly treat that staff layer as a plausible access vector.

Plausibility testing alone still does not establish that the candidate is the person relocated to the United States. The decisive linkage emerged from United States administrative records, particularly property ownership documentation. Bellingcat reported that open records showed “Oleg and Antonina Smolenkov” purchasing a home in northern Virginia in June 2018, and connected that purchase to the hypothesis that the family had been resettled under protection after leaving Russia. (Bellingcat 2019) RFE RL reporting similarly discussed public records indicating ownership of a house in Stafford County, Virginia, by Oleg and Antonina Smolenkov, and described subsequent changes consistent with attempts to reduce visibility, including the transfer of ownership into a trust. (RFE RL 2019a; RFE RL 2019b)

For a counterintelligence practitioner, this phase is the core operational lesson. The United States property recording system is designed to be durable, searchable, and transparent. A relocated human source living under a real name, or under a name that can be linked by deed chain, becomes discoverable. Even when a trust is used, the initial purchase may preserve the identity in a durable record, and later transfers can be traced. The trust can help against casual discovery, but it does not reliably defeat an investigator who already has a lead and is willing to follow the chain across databases. Even to the untrained eye, recent deeding from a Russian surname to a blind trust is a dead giveaway.

The deed stuff is important, HOWEVER, the linkage was not limited to property records in isolation. Investigators layered temporal correlation. The property purchase followed the 2017 disappearance window by roughly one year, a plausible period for relocation, debriefing, and resettlement logistics. The geographic placement, near Washington, aligns with the practical needs of ongoing handling, access to government liaison, and security support. RFE RL reporting placed the residence in a neighborhood with current and former United States government personnel, which would not be an implausible environment for a protected relocatee, but also increases the risk of attention because residents recognize unusual patterns. (RFE RL 2019a)

Attribution confidence increases through cross-side corroboration. Reuters reported that Russian state media and other Russian outlets visited or referenced the Virginia address associated with Smolenkov, and that Russian official commentary focused on disputing his access level rather than disputing his identity. (Reuters 2019b) The Guardian reported that Russian media quickly identified Smolenkov as the likely figure after the initial extraction story circulated and that earlier Russian reporting had already treated his disappearance as suspicious. (The Guardian 2019b) In counterintelligence analytic terms, this is validation by reaction. When an implicated government acknowledges employment, debates seniority, and frames narratives around access, it implicitly accepts the identity anchor, even if it contests the operational characterization.

Another reinforcing layer is signature observation, i.e., the detection of behaviors consistent with protective posturing. Bellingcat described journalists encountering indications of security presence when approaching the residence and noted that the family likely departed after the story circulated. (Bellingcat 2019) RFE RL reported that neighbors stated that the family of the identified property left abruptly soon after publicity, and that no one answered at the residence when a reporter from RFE visited. (RFE RL 2019a; RFE RL 2019b) From a practitioner’s view, these signatures are a bit ambiguous but directionally meaningful. They do not prove intelligence affiliation however, they do add coherence to the broader narrative when combined with verified administrative linkages.

The identification of Smolenkov can be described as an open-source attribution chain with mutually reinforcing elements. The chain begins with an anonymized description of an extracted asset, which supplies a time-bound and an access profile. It then leverages a pre-existing disappearance narrative in Russian reporting that matches the window. It validates institutional plausibility through official acknowledgement of employment and through open source reconstruction of staff level proximity to senior policy structures. It then bridges the gap from Russia to the United States by locating the same names in property records, supported by temporal correlation and geographic plausibility. Finally, attribution through adversary reaction and observable protective signatures after publicity adds stability to the former. Each element could be dismissed alone, but in totality of the circumstances they provide a high probability attribution that is operationally sufficient for pretty damn reliable public identification. (Bellingcat 2019; Reuters 2019a; RFE RL 2019b)

The counterintelligence implications are clear. A protective extraction does not end an operational dilemma. It begins a new phase in which the threat is not hostile surveillance alone but also open-source exploitation. Transparency regimes create predictable exposure surfaces. Registers of deeds and county recorders, tax collectors, court records, licensing agencies, and corporate filing records are not intelligence sources, but they are an extremely searchable source of structured and more than reasonably accurate data. C.I. measures or countermeasures applied after asset resettlement (such as transferring property into a trust) reduce opportunistic discovery after the fact but will fail against an OSINT collector that already possesses a starting point. Also, cueing can be powerfully exploited. Public narratives about timing and sensitivity can provide sufficient structure for a collector to find pre-existing anomalies and connect them to these domestic records.

The Smolenkov resettlement demonstrates that our source protection doctrine must be extended beyond traditional clandestine concerns. It must incorporate administrative footprint management, name and identity compartmentation, and a realistic appreciation of how quickly digital records can be correlated across jurisdictions, in real-time and remotely. This case CANNOT be viewed as an isolated breach. It really is a warning about the baseline capabilities of OSINT. Oh, and a parting shot from a former C.I. guy, don’t put properties that are deeded to Russian surnames into trusts that are filed publicly.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

Bibliography

  • Bellingcat. 2019. “Murdered in Montenegro, or Living in Suburban Virginia? Unraveling the 2017 American Spy Story.” September 10, 2019.
  • Radio Free Europe Radio Liberty. 2019a. “Virginia Residents Question Whether Their Neighbor Was a Russian Informant.” September 10, 2019.
  • Radio Free Europe Radio Liberty. 2019b. “Russia Seeking Interpol’s Help on Location of Alleged CIA Informant.” September 12, 2019.
  • Radio Free Europe Radio Liberty. 2019c. “Paper Reports ‘Details’ of Alleged CIA Informer’s Disappearance in Montenegro.” September 12, 2019.
  • Reuters. 2019a. “Kremlin Says Alleged U.S. Spy Did Not Have Access to Putin.” September 10, 2019.
  • Reuters. 2019b. “Russia Blasts Idea a CIA Mole Lifted Lid on Its U.S. Meddling.” September 11, 2019.
  • Russia Matters. 2019. “Russia in Review, Sept. 6 to 13, 2019.” September 2019.
  • The Guardian. 2019a. “Russia Investigated Disappearance of Suspected US Spy as Possible Murder.” September 10, 2019.
  • The Guardian. 2019b. “Oleg Smolenkov: Alleged US Spy Who Gave Russia the Slip.” September 14, 2019.
  • Time. 2019. “The U.S. Reportedly Extracted a High Level Spy From Russia in 2017 Amid Concerns of Mishandled Intelligence.” September 10, 2019.
Share this post:
Posted on

Disinformation as “Insurgency”, an American Constitutional View

disinformation, misinformation, espionage, counterespionage, counterintelligence, spy, subversion, psyops

I read with a great deal of interest Jacob Ware’s article “To fight disinformation, treat it as an insurgency” that appeared recently in The Strategist, an Australian Strategic Policy Institute publication. I have always held my own ideas about disinformation, more specifically “inoculation” as a countermeasure and recommending instruction from a very young age much as grade schools do in the baltic states. Ware’s article tackles the subject matter as a ‘control social media’ issue. I do not disagree with the importance of media responsibility for moderation of certain types of content, Ware appropriately identifies “overlook[ing] the important role of digital consumers”, but doubles down on content control. The article suggests that social media companies, as central nodes in the information ecosystem, must be pressured into moderating content more aggressively as much as the importance of digital consumers themselves being hardened against manipulation (“inoculation” as I have written in previous scholarship”. Control, compelling in its framing, raises some not insignificant constitutional issues in the context of the United States, particularly with regard to the First Amendment’s protections of speech, association, and press.

Framing Disinformation as Insurgency: Strategic and Legal Ramifications
Ware’s analogy between insurgencies and disinformation campaigns conveys the existential threat that hostile narratives, particularly those that foreign actors pose to democratic stability. Comparing disinformation actors to terrorist insurgents invites the application of military-style containment and suppression tactics, perhaps even the “cyber-kinetic” removal of bad actors (i.e., content moderation and bans), the targeting of ideological hubs (e.g., online communities, networks, influencers, etc.), and critically, the enforcement of norms through government-backed initiatives.

In the U.S. legal context, much of this may be a non-starter. Insurgents and terrorists operate outside the protection of constitutional law, whereas digital speakers, however misinformed or malicious, are presumptively entitled to the protections of the First Amendment. The Constitution does not permit the government to silence unpopular, false or even offensive ideas unless they meet strict criteria for incitement, true threats, or defamation. This legal boundary sharply limits the government’s ability to treat digital speech as a national security threat without triggering robust judicial scrutiny, even if that information is objectively dangerous disinformation.

Section 230 and Platform Immunity: The Epicenter of the Debate
The article criticizes Section 230 of the Communications Decency Act (1996), which shields internet platforms from liability for user-generated content. This statute is often viewed as the legal linchpin that enabled the growth of the modern internet, on the whole a pretty positive thing. Ware argues that these protections prevent platforms from being held accountable and serve as a digital safe haven for malign actors. From a policy standpoint, this critique doesn’t hold much merit. Critics across the political spectrum argue that Section 230 incentivizes platforms to prioritize engagement and profit over truth and social stability, however, repealing or modifying Section 230 would not directly authorize government censorship. It WOULD expose platforms to civil liability for failing to moderate. Any new federal statute that imposes content-based restrictions or penalties would need to meet all prongs of the constitutional free speech tests and modern U.S. jurisprudence. The courts have routinely ruled that platforms are private entities with their own First Amendment rights therefore even in the absence of Section 230, the government would not be able to compel social media companies to carry or remove specific content unless it satisfies narrow constitutional exceptions.

Free Speech: A Distinctly American Commitment
A central theme in the article is the frustration that American-style free speech doctrines allow dangerous ideas to circulate freely online. Ware writes from an Australian perspective. The article praises the European Union’s Digital Services Act and Australia’s eSafety initiatives as superlative regulatory models. Under those statutory regimes platforms face stiff penalties for failing to suppress harmful content. These approaches may appear pragmatic but they clearly represent a sharp divergence from U.S. legal culture.

The U.S. Constitution’s First Amendment prohibits government abridgement of speech, including offensive, deceptive, or politically inconvenient speech. In United States v. Alvarez (2012), the Supreme Court struck down a federal law criminalizing false claims about military honors, holding that even deliberate lies are constitutionally protected unless they cause specific, fixable harm. Further, in Brandenburg v. Ohio (1969), the Court established that even advocacy of illegal action is protected unless it is directed to inciting imminent lawless action AND is likely to produce such action. So, even under the noble pretext of national defense, any proposal that seeks to directly regulate speech must reconcile with this robust jurisprudence. Foreign governments might be able to implement speech controls without constitutional constraints. We cannot. The U.S. must address disinformation through less intrusive, constitutionally sound means.

Counterinsurgency in a Civilian Space: Policing Thought and Risking Overreach
Ware’s counterinsurgency metaphor extends beyond moderation into behavioral engineering, winning the “hearts and minds” of digital citizens. This vision includes public education, civilian fact-checking brigades, and a sort of civic hygiene campaign against harmful content. Although such measures may be effective as psychological operations (PSYOPs), the distinction between persuasion and indoctrination must be carefully managed in a free society.

There is legitimate concern that state-sponsored resilience campaigns could slip into propaganda or viewpoint discrimination, especially when political actors define what constitutes “disinformation.” The inconvenient truth is that the label of “misinformation” has been applied inconsistently, sometimes suppressing legitimate dissent or valid minority viewpoints. The First Amendment’s commitment to a “marketplace of ideas theory” assumes that truth ultimately prevails in open debate, not through coercive narrative management.

There is another danger. Using the tools of counterinsurgency, even rhetorically, raises alarms about militarizing civil discourse and legitimizing authoritarian measures under the guise of “national security.” In Boumediene v. Bush (2008), the Court warned against extending military logic to civilian legal systems. Applying wartime strategy to cultural or political disputes in the civilian cyber domain risks undermining the very liberal values the state claims to protect.

An Appropriate Role for Government
Despite consitutional guardrails, the federal government is not powerless. Several constitutionally sound measures remain available. These approaches avoid entangling the government in the perilous business of adjudicating truth while still defending the information ecosystem.:

Transparency Requirements – Congress can require social media companies to disclose their moderation policies, algorithmic preferences, and foreign funding sources without dictating content outcomes.

Education Initiatives – Civics education and media literacy programs are constitutionally permissible and could help inoculate the public against disinformation without coercion.

Voluntary Partnerships – The government can engage with platforms voluntarily, offering intelligence or warnings about malign foreign influence without mandating suppression.

Targeting Foreign Actors – The government can lawfully sanction, indict, or expel foreign individuals and entities engaged in coordinated disinformation campaigns under laws governing espionage, foreign lobbying, or election interference.

Ware’s comparison of disinformation to insurgency is strategically evocative, but its prescriptive implications clash with foundational American principles. The First Amendment might seem inconvenient, but it was designed to prevent precisely the kind of overreach that counterinsurgency measures invite. Democracies do not defeat authoritarianism by adopting its tools of censorship and narrative control. If the United States is to confront the threats of disinformation effectively, it must do so in a way that affirms rather than undermines what makes us distinctively American. Educating, not censoring; persuading, not suppressing; and building durable civic institutions capable of withstanding the torrent of falsehoods without succumbing to the lure of government-controlled truth are imperative. Freedom remains the best antidote to tyranny ONLY if we remain vigilant in its defense.

~ C. Constantin Poindexter,

  • Master of Arts in Intelligence
  • Graduate Certificate in Counterintelligence
  • Undergraduate Certificate in Counterintelligence
  • Former I.C. Cleared Contractor
Share this post: