The Cipher Brief

Democracy was on display during the 2026 midterm elections in the U.S. Over 124 million ballots were cast across the country, with considerable foreign interest.

This was democracy in action. A testament to the power of the people; engaging in governance through free and fair elections and ensuring that all public officials are answerable to the electorate.

A few authoritarian countries – where a peaceful electoral transition of power is nearly impossible -- followed these elections, providing their people with selective information.

Russia acknowledged the results and said the political shift would not alter Russia’s current geopolitical strategies. Deputy Foreign Minister Sergei Ryablov said Moscow historically has strained interactions with Democrats. He said the war in Ukraine would remain unchanged regardless of the U.S. election.

China said the election was an internal U.S. matter. Their Foreign Ministry spokesperson emphasized China’s readiness to manage differences and maintain a stable bilateral relationship based on mutual respect.

Iran publicized the election results, saying the Democratic victory was a victory against U.S. foreign policy. On November 4, Iran’s chief negotiator, Mohammad Bagher Ghalibaf, posted a public message asserting the U.S. electorate had rejected the war with Iran.

North Korea, as Americans were casting ballots, test-fired multiple missiles toward the East Sea. The display was highly unusual because it paired a new surface-to-air defensive missile with a drill utilizing long-range strategic cruise missiles. Apparently, it was a show of force to demonstrate North Korea’s advanced electronic warfare and defense-evading capabilities. Kim Yo-jong, the sister of leader Kim Jong Un, issued statements coinciding with the U.S. election. Ms. Jong said North Korea has no need to sit face to face with such unreliable and hostile persons, demanding that Washington abandon its hostile policies and show respect to North Korea. This was typical of Ms. Jong’s previous statements about the U.S. and a response to President Trump’s willingness to again meet with Kim Jong Un.

It must have been difficult for these authoritarian countries to comment too freely about the U.S. election when the people in these, and many other countries, are denied the ability to participate in free and fair elections. Indeed, their governments often are not answerable to the people. They answer only to a supreme leader in Russia and North Korea, and to a ruling theocracy in Iran and to the Chinese Communist Party in China.

Russian President Vladimir Putin must be concerned about his questionable support from the public, witnessing over one million casualties in its war in Ukraine and flagrant corruption. Former Russian leader Mikhail Gorbachev withdrew from Afghanistan in 1989, when Russian casualties mounted and the Russian people said “no” to losing any more of their sons and daughters. Will the Russian people say “no” to Putin for the mounting casualties in Ukraine? Mr. Putin must be concerned if Russia’s elections were free and fair.

The Iranian theocracy was brutal towards the people during the 2009 Green Movement, when Iranians protested the disputed re-election of President Mahmoud Ahmadinejad. The government was brutal in dealing with widespread demonstrations throughout Iran in 2022 with the “Woman, Life, Freedom” demonstrations and with the recent demonstrations over crushing inflation and deep poverty due to government failures. The Iranian theocracy must be concerned about the lack of support they have from the people and what would happen with free and fair elections.

Will the North Koreans continue to support a regime that sends troops to Russia, suffering extreme casualties, for Russia’s war with Ukraine? This and other issues, to include inferior medical facilities and the lack of food and the gulags that imprison political dissidents, are some of the issues that raise questions about the public support for the regime. Would Pyongyang permit free and fair elections?

Will the Chinese people continue to support the Chinese Communist Party (CCP) when they are denied the right to vote and elect officials who will represent and be answerable to the people?

It is obvious why these authoritarian countries do not permit free and fair elections.

According to The Economist Democracy Index, authoritarian countries make up 36.5% of the world’s countries. Hopefully, this percentage will shrink. Recent elections in Serbia, Hungary, and Brazil give hope to the view that democracy will prevail, because it is what the people want and demand of their governments.

This article was originally published in The Washington Times and is republished here with permission.

The author is a former associate director of national intelligence. All statements of fact, opinion or analysis expressed are those of the author and do not reflect the official positions or views of the U.S. government.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Reinventing Intelligence To Operate At Machine Speed

For almost a decade, the U.S. Intelligence Community (IC) has lived with a quiet anxiety: that the proliferation of open-source information, machine learning, and artificial intelligence would one day reshape its analytic enterprise the way the internet reshaped the newspaper industry. Senior civilian policymakers, military commanders, and national security staff are not passive consumers. They need decision support and have an incentive to build their own if national agencies do not meet their needs. That day is arriving.

The IC’s leadership insists it is seizing the AI moment. At the Special Competitive Studies Project (SCSP) AI+ Intelligence Summit in April 2026, CIA Deputy Director Michael Ellis reported that the Agency ran more than 300 AI projects in 2025 and had, for the first time in its history, used AI to generate an intelligence report. He described plans to embed AI “coworkers” in the Agency’s analytic platforms—tools that will help prepare assessments, edit for clarity, and check drafts against tradecraft standards. AI, in his words, “won’t do the thinking for our analysts, but it will help draft key judgments.”

This is real progress, and it deserves credit. The near-term vision positions AI as a valuable assistant to the human analyst, a tool that drafts, edits, triages, and flags while the existing workforce, workflow, and organizational structure stay largely in place, even as CIA leaders describe mixed human-machine teams over the next decade. This is a sensible starting point, but there is a tremendous opportunity to build on it. Today’s agentic AI systems, which can plan, research, reason, draft, and iterate with minimal human intervention, are increasingly capable of performing core analytic tasks themselves, faster and at a fraction of the cost. That progress opens the door for IC leadership to move beyond the question of whether to adapt and focus on how best to shape that adaptation. By taking deliberate steps now, leaders can redesign workflows and structures on their own terms, keeping the IC’s analytic enterprise ahead of shifting customer expectations rather than reacting to them.

In its groundbreaking 2021 final report, the National Security Commission on Artificial Intelligence envisioned AI supporting human analysts in an AI-ready Intelligence Community by 2025. Subsequent assessments by SCSP, including our 2024 report, Intelligence Innovation, urged enterprise-scale AI adoption, preparing for an AI-ready workforce, and expanding the IC’s use of unclassified, open source information as the “INT of first resort” to provide the fuel for future AI-powered analytic work. While the trend toward better and better AI was clear to us, we assessed that AI systems were still too prone to hallucinations, weak reasoning, and limited access to outside tools and were not yet capable of reliably producing sophisticated intelligence assessments. We could sense the future, but assessed the IC would have plenty of time to prepare and adapt.

What Agentic AI Can Actually Do Today

What has changed in the last two years is the rapid pace of growth in AI capabilities. The frontier models produced by Anthropic, OpenAI, Google, and xAI today are very capable platforms for building autonomous analytic workflows. An orchestrated stack of AI agents can now perform, in parallel and with minimal human prompting: open-source data scanning and collection; source credibility assessments; pattern recognition and anomaly detection; hypothesis generation and structured analytic techniques; drafting, editing, and tradecraft compliance checking; and dissemination tailored to specific customer profiles, formats, and languages—continuously, around the clock, in any theater.

The benchmarks bear this out. Stanford’s 2026 AI Index found that AI capability is now outpacing the benchmarks designed to measure it: frontier models gained 30 percentage points in a single year on Humanity’s Last Exam, an expert-level test built to be hard for AI. Leading models scored under 10 percent when the test was released in early 2025; several models exceeded 60 percent in Stanford’s early 2026 results. ForecastBench, run by the Forecasting Research Institute, compares the accuracy of AI systems in forecasting real-world events with human superforecasters using a difficulty-adjusted Brier score, which rewards being right and being well calibrated. In January 2026, superforecasters still led the best AI entry (xAI’s Grok 4.20, at about 0.102) by 0.017 Brier points, and the Forecasting Research Institute (FRI) projected parity for around November 2026. In its July 2026 update, the institute reported that several systems, including entries from Cassi AI, xAI, and Google DeepMind, were statistically indistinguishable from superforecasters on the tournament leaderboard. OpenAI’s GDPval benchmark measures whether AI can produce real professional deliverables, such as reports, spreadsheets, and presentations, across 44 occupations. Industry experts compare the AI’s work with that of human professionals without knowing which is which. In September 2025, the best model (Claude Opus 4.1) matched or beat the expert 47.6 percent of the time. In its March 2026 results, OpenAI reported rates of 70.9 percent for GPT-5.2 and 83.0 percent for GPT-5.4.

This is already being tested. Dr. Christopher Porter, head of international security cooperation at Google Cloud, has set large language models loose on the National Intelligence Council’s archive of declassified National Intelligence Estimates to dissect how the IC’s most senior analysts built their long-range judgments. Work like this suggests that the tacit knowledge analysts long believed made them irreplaceable may be increasingly capturable and deployable at scale. The moat for human-produced intelligence analysis is narrowing.

Customers Are Already Building Around the IC

Perhaps the greatest long-term threat to the IC analytic enterprise is not replacement from within—it is disintermediation from without. As frontier AI systems become accessible through commercial platforms and enterprise deployments, sophisticated consumers of intelligence are discovering that they can put their questions directly to commercial AI agents, or build their own systems that are tuned to their specific information needs, decision timelines, organizational vocabulary, and risk tolerances.

The appeal is easy to understand. These tools answer in minutes rather than on the 24-hour turnaround the IC offers most senior customers. They tailor every response to the person asking, they require no clearances, and they never close. And they are not bound by the IC’s coordination cycles or institutional risk aversion. During the 2026 Iran campaign, The Washington Post* reported that the Pentagon’s Maven Smart System supported near-real-time targeting. The United States struck more than 1,000 targets in the first 24 hours, according to an analysis by the Carnegie Endowment for International Peace.

The IC’s traditional rejoinder—that commercial tools lack access to classified intelligence and decades of hard-won expertise and tradecraft—describes a moat that is draining, for two reasons. First, the volume of open-source and commercially available data—satellite imagery, ship and aircraft tracking, social media, trade and financial records—is growing exponentially, steadily eroding the marginal value of secret collection on a widening range of questions. SCSP warned in its 2024 report that many open-source assessments from media and think tanks rival what the IC produces using mostly classified information. Commercial AI does not tap the IC’s classified holdings, but on a growing range of questions its assessments may rival the IC’s. Second, as Porter’s work shows, AI systems can be taught the IC’s analytic tradecraft.

The Promise of Agentic AI for Intelligence Analysis

The disruption is real, but so is the opportunity. Properly built and governed, agentic AI offers the IC’s analytic enterprise the chance to deliver more intelligence, to more customers, faster and in greater depth than the Community has ever managed—providing the “decision advantage” the IC must achieve. The goal is not simply speed to an answer. It is speed to defensible judgment: analysis that is timely, sourced, traceable, caveated, and fit for the decision it supports.

Agentic systems expand both the scope and the pace of analytic production. Where today’s analytic cadre must ration its attention across a limited number of priority accounts, AI agents can monitor every country, issue, and actor at once; update assessments as new reporting arrives rather than on a production calendar; provide persistent indications and warning around the clock, as decision support rather than prediction, since no current system reliably predicts geopolitical flashpoints and outputs still need analyst validation; and surge instantly when a crisis breaks—without pulling analysts off other accounts to do it.

They can also end the IC’s chronic triage of “global coverage” accounts. Low-priority and episodic issues—a fragile mid-sized state, a regional resource dispute, an obscure arms transfer—rarely command dedicated analysts until they erupt into crises, at which point the IC starts from a cold baseline. Agentic systems can sustain continuous, credible coverage of these accounts at marginal cost, freeing the Community’s scarce human experts to concentrate on the truly complex, high-stakes, and highly compartmented problems where their judgment matters most. SCSP’s 2025 intelligence memo to the president proposed a related step: a National Open Source Center to take on day-to-day collection for lower-priority global coverage topics.

Agentic AI can also widen access to the IC’s best analysis. An analytic engine is not constrained by the size of a briefing staff. It can give sub-Cabinet decisionmakers—assistant secretaries, combatant commanders, ambassadors, and their staff—access to the best available national intelligence, tailored to their portfolios, decision calendars, and preferred formats. Today, that kind of dedicated support is reserved for the President and a handful of Cabinet principals.

It can also make sharing far less burdensome. Sanitizing an assessment for release is slow, line-by-line work—one reason so little IC analysis reaches audiences beyond the national security community. Agents that generate releasable versions alongside the classified original—with humans reviewing what is released—would let the IC extend timely support at scale to departments and agencies outside the national security community; to state, local, tribal, and territorial governments; to foreign allies and partners; and, where appropriate, to the American people. This extends the “write for release” default that SCSP proposed in Intelligence Innovation.

None of this requires the IC to lower its standards. It lets the IC stop rationing its best analysis.

The Anatomy of an AI Analytic Engine

The purpose of all-source analysis is not to produce reports. It is to reduce uncertainty for decisionmakers, warn them of danger and opportunity, and help frame their choices. Many of today’s products and processes—the daily publication cycle, the fully coordinated finished assessment, the layered review—were designed for a paper-driven era serving a small number of senior readers. Automating them as they stand would simply produce the old outputs faster. The better question is which functions the IC must perform for its customers, and how humans and machines should share them. The layers described below are a near-term engine that can be built from today’s workflows. The destination is more ambitious: a system in which collection, analysis, and delivery happen continuously rather than in sequence, and in which the report itself may no longer be the primary product.

A functional AI Analytic Engine would operate across four integrated layers:

Data Acquisition and Scanning

Automated agents continuously monitor designated data environments—open-source, commercial, and (where authorized) classified holdings—flagging items of relevance against standing collection requirements and emerging triggers. When a human analyst can read only a fraction of an account’s daily reporting, these agents ingest it all—translating, deduplicating, and tagging every cable, report, and foreign-language source against the analytic line before a human opens an inbox. The same agents can generate intelligence requirements automatically and in real time—turning a customer’s query, or an upcoming summit, negotiation, or sanctions decision, into specific collection and analytic tasking within minutes rather than waiting for requirements to work their way through a formal cycle that can take weeks.

Analytic Rigor

A second tier of agents applies structured analytic techniques: key assumption checks, indicator monitoring, alternative hypothesis generation, confidence calibration. These processes can be encoded against established tradecraft standards and applied consistently, without the fatigue that affects human analysts, though models carry biases of their own. Every judgment can be logged with supporting evidence, sources, and a confidence rationale, creating an auditable record of inputs, sources, and judgments. A log does not by itself fully explain how a model reached a judgment, but few human-authored products can match this level of accountability.

Production and Tailoring

Production agents generate, format, and tailor draft assessments to customer specifications—length, classification level, language, visualization preferences, and dissemination channel—using validated templates. The more important change, however, may be to the product itself. A static report, written once and read once, fits poorly in a world that changes by the hour. The engine makes possible continuously updated assessments, dynamic warning displays, and interactive simulations that let a customer test how an adversary might respond to a given move.

Customer Interface and Feedback

A final layer manages the customer relationship: tracking outstanding requirements, soliciting feedback on delivered products, and routing that feedback to refine future tasking. Over time, the engine learns each customer’s priorities, preferred formats, and decision calendar, anticipating questions before they are asked. As customers deploy AI agents of their own, this interface will increasingly run machine-to-machine—a policymaker’s agents querying the IC’s directly—with analysts setting the rules of engagement rather than handling each request.

The architecture is not simple to build. It requires accurate workflow mapping, robust data integration, and carefully constructed tradecraft ontologies—formal representations of what “good analysis” looks like in each analytic domain. The hardest part is neither the models nor the engineering. It is converting the tacit expertise of experienced analysts—how they break down a question, which sources they trust and why, how much evidence is enough, when a judgment is ready—into explicit, documented workflows that AI systems can execute and humans can test. But it is buildable. Several private-sector firms are already building versions of it. One, DreamPort, says its team includes former CIA officials and has built a multi-agent platform based on CIA analytic tradecraft. Others deliver AI-enabled analytic products modeled on the President’s Daily Brief to C-suite decisionmakers; still others are deploying “digital intelligence officers”—tradecraft-based autonomous agents designed to work inside business units.

Rebuilding the Analytic Organization

The critical insight for IC leadership is this: such an engine does not require a large human analytic workforce to operate. It requires a smaller, differently skilled workforce to build, maintain, govern, and improve it. The organizational design implications are profound.

Today’s analytic organization is a pyramid: a broad base of analysts producing drafts, topped by successive layers of reviewers, editors, and managers whose principal function is quality control and coordination. An engine-centered organization flattens that pyramid. It looks less like a production line and more like a software product team—small, cross-functional cells of domain experts, data engineers, and AI engineers, each responsible for a mission area and the agents that serve it.

Because tradecraft standards, style guidance, and classification rules can be encoded and checked automatically, much of the layered human review that now governs production—line editing, formatting, sourcing checks, and basic tradecraft compliance—can fall away. Human reviewers remain, but their attention shifts from polishing individual products to auditing the system: validating its judgments, catching systematic errors, and refining the standards it applies. Fewer layers mean faster delivery. The coordination cycle that today takes days could take hours.

What does this mean for an individual analytic unit? Consider, illustratively, a branch that today covers a regional account with fifteen to twenty analysts, a branch chief, and layers of reviewers and editors above it. In an AI engine-centered model, a team of six to eight might cover the same account. Perhaps half would be substantive experts—senior analysts who own the analytic line, set requirements, and judge the engine’s output. The other half would run the machinery: data engineers who acquire new sources and maintain the pipelines that feed the engine; AI engineers who build, tune, and retrain the team’s agents as the account evolves; and an evaluation specialist who monitors the agents’ performance, tests them against known outcomes, and flags drift, bias, or signs of adversary manipulation. These figures illustrate the direction of change and are not an estimate; agencies should test them, as the recommendations below propose.

The team’s center of gravity shifts accordingly. Fewer people will write; more will build, measure, and steer. And the team’s performance will be measured not by the number of products it publishes, but by the quality, timeliness, and reach of the analysis its engine delivers.

What This Means for the All-Source Analyst

For the individual all-source analyst, the shift is unsettling, but it is not a dead end. Intellectual honesty requires acknowledging what AI systems cannot yet do reliably, and where human expertise retains a genuine comparative advantage. Six roles stand out.

First, analysts bring what no model has: lived experience. Years on an account—the travel, the liaison relationships, the memory of how a leader behaved in the last crisis, the instinct for when a source is too good to be true—add up to tacit knowledge of both substance and tradecraft that is hard to codify and slow to acquire. That knowledge is what lets an analyst recognize when the AI engine is confidently wrong.

Second, analysts will remain the bridge to the most sensitive intelligence, at least for a while. Operational elements within CIA, NSA, DIA, and other collection agencies will resist—in part legitimately—connecting their most sensitive compartmented holdings to agentic AI systems. The security architecture required to do so safely does not yet exist at IC-wide scale, and may not for some time. Until it does, analysts cleared for those streams will hold a genuine—though temporary—moat.

Third, analysts will advocate for the customer. They know what a policymaker is actually trying to decide, what that official already believes, and what will land. They will translate those needs into tasking for the engine and push back when its output answers the wrong question.

Fourth, analysts will become stewards and mentors of the analytic system. Someone must decide what the engine should try to do: which questions it pursues, what evidence standards it must meet, which heuristics it applies, which failure modes it watches for, and when to escalate, caveat, or withhold its outputs. And just as senior analysts train new hires today, they will coach the engine—correcting its reasoning, supplying the context it lacks, and feeding those lessons back into the standards and examples it learns from.

Fifth, analysts will manage teams of AI agents. A single analyst may direct several agents at once—one scanning collection, another running alternative hypotheses, a third drafting tailored products—assigning tasks, reconciling outputs, and spotting when one has gone astray. The skill is closer to running a small team than to writing a paper.

Sixth, analysts will decide what is finished—and answer for it. The engine can generate endless drafts; someone must judge when an assessment is sound enough, sourced well enough, and relevant enough to put in front of a decisionmaker. When a high-profile intelligence failure occurs—as failures inevitably do—a customer who relied on an AI system alone has no one to summon before a congressional committee. This is consistent with the principle of Meaningful Human Control in SCSP’s 2025 report The Digital Case Officer, which calls for a named officer responsible for an AI system’s operations and outcomes.

That accountability matters even more because AI systems fail differently than humans. They can fabricate sources, state weak judgments with unwarranted confidence, and be manipulated by adversaries at every layer—poisoning the data they ingest, compromising the models they run on, and manipulating the prompts, retrieval tools, and agents that tie them together. The danger compounds when agents draw on the same corrupted source and reinforce one another’s errors. Analysts are also prone to automation bias, the tendency to trust machine output too readily, which becomes harder to resist as outputs improve. Analytic integrity can no longer be judged by the finished product alone. It requires visibility into the data, models, prompts, and agent interactions that produced it. Accountability by itself, however, is not a stable value proposition for a workforce of tens of thousands. That is why the other five roles matter.

The analysts who thrive will be those who stop measuring their worth by the products they author and start measuring it by the quality of the judgments they enable. The pen is passing to the machine. The judgment is not.

The Analytic Community’s Strategic Choice

The IC’s analytic enterprise stands at a strategic inflection point that its leadership has not yet fully internalized. Agentic AI systems are not on the horizon. They are in the market. IC customers are adopting them, private firms are building them, and adversary services, including the PRC’s, are pursuing them. The question is not whether the all-source analytic workflow will be substantially automated. It will be. The question is whether the IC will lead that transformation or be overtaken by it.

For the IC’s analytic enterprise, continued tinkering at the margins is no longer sufficient. IC analytic organizations must fundamentally transform how they are designed, staffed, and governed. That transformation must begin with the workforce. Leaders at CIA, DIA, and other IC components that play a significant role in all-source analysis should direct their analytic organizations to pause growth in traditional, production-oriented analyst positions until they complete an honest accounting of the skills the transformed analytic enterprise will actually require. The answer is not more people who can write finished intelligence. It is people who can build, modify, govern, and improve agentic AI systems. The current workforce is not a legacy asset to be managed down; it is the primary source of the expertise the engine must encode. The pause should therefore be paired with an immediate reskilling mandate: every analytic organization should identify a cohort of its best analysts and train them as workflow designers, AI evaluators, and capability owners. And before undertaking major restructuring, agencies should test alternative human-AI team models against traditional teams, measuring not only speed and output but analytic quality, reliability, and usefulness to decisionmakers.

Specifically, the enterprise will need substantially more data engineers who can identify, acquire, clean, and connect the data holdings on which AI agents operate. It will need AI/ML engineers who can build and optimize agent workflows. It will need software designers who can build the interfaces through which customers and internal users interact with the AI Analytic Engine. It will also need a small, highly experienced cadre of domain experts and tradecraft masters to encode analytic standards and evaluate outputs. Conversely, the enterprise will need far fewer of the roles the current production model rewards: line editors, production staff, and generalist drafters. Recruitment, training, promotion, and performance evaluation should reflect that shift now, not after the engine is built—rewarding officers for the quality of the systems they design, supervise, and improve rather than the number of reports they write.

Workforce changes alone are not enough. The IC should accelerate its AI infrastructure buildout, with the necessary security and governance architectures to support it, that empower experienced human analysts to create AI bots that work seamlessly across classified and unclassified data to deliver tailored analytic tools and assessments under human supervision. It should use Other Transaction Authority and shared enterprise licensing to shorten acquisition, as the Defense Intelligence Agency did through Task Force Sabre. DIA Chief AI Officer Maj. Gen. Robert Kinney said at the April 2026 summit that one award took 40 days from request for information to award. It should continually re-evaluate the Intelligence Community Directives that govern all-source analysis to enable AI-assisted and AI-produced analysis while maintaining the highest standards for transparency, interpretability, and analytic rigor and integrity. It should develop specific guidance on implementing Meaningful Human Control, such as a named responsible officer for each assessment, and regular red-teaming against data poisoning and adversary manipulation. It should create career series and a digital reserve for AI talent. And it should invite close foreign intelligence to share this approach.

None of these changes will be easy, or comfortable, for the IC to adopt. They will require IC leadership to make decisions that threaten established career paths, upset organizational equities, and challenge the self-conception of a workforce that takes justified pride in its expertise. But the alternative—a workforce that becomes progressively less relevant to its customers while its leaders maintain the appearance of human primacy—is worse for the mission and ultimately worse for the people in it. The IC’s analytic workforce contains some of the most capable people in the U.S. national security enterprise. They deserve leadership honest enough to tell them what is coming, and decisive enough to build the organizational structures that will let the best of them thrive in what comes next.

All statements of fact, opinion, or analysis expressed are those of the author and do not reflect the official positions or views of the U.S. Government. Nothing in the contents should be construed as asserting or implying U.S. Government authentication of information or endorsement of the author's views.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

What Congress Can Learn From Vietnam About the War in Iran

“The American people don't know what the heck we're fighting for in Iran. He's [President Trump] never made it clear. He changes his mind day-to-day and minute-to-minute. This war must end. It must end. And make no mistake, whenever Trump defies the will of the American people or the law, we will launch investigations, take him to court, and entangle him in legislative razor wire. The days of Trump's supplicant Senate are over.”

That was Sen. Charles Schumer (D-N.Y.), currently in line to be sworn in as Senate Majority Leader when the new Congress meets January 4, 2027, speaking last Wednesday about his plans for next year’s Senate.

The Schumer suggestion that when Congress convenes its 120^th session next January, the chairman of a Democratic-run Senate committee could be initiating an investigation into President Trump’s Iran War took me back 58 years to 1969.

That was when I had been hired by then-Chairman Sen. J. William Fulbright (D-Ark.) of the Senate Foreign Relations Committee for 18 months to be chief of staff of an investigative subcommittee looking into U.S. military involvement in American foreign policy during the time of the Vietnam War.

A Fulbright subcommittee investigation back then was much different than those of more recent times – and I will explain further because I believe Senate Democrats now ought to begin planning something similar.

First of all, for the initial months, I and my one colleague – the subcommittee’s chief counsel – were to investigate. That’s correct – we two were the only staff members of the subcommittee. We did the investigating by traveling together overseas, first to Europe, then to the Middle East and finally the Far East. We stayed at military bases, got briefings, but also questioned not just service members from generals and admirals through enlisted non-commissioned officers, but also American ambassadors, other U.S. diplomats, and even CIA station chiefs.

I’m describing this get-out-of-Washington approach because some recent congressional investigative hearings have been done based on published or televised stories and not with original congressional on-the-scene inquiry. Also, now is the time for whichever committee or committees will be looking into the Iran fighting to have Democratic members or staff to begin gathering information.

For example, if I were putting this together, now would be the time for visiting the Gulf States, Israel, Jordan, Saudi Arabia and even Diego Garcia. Central Command at MacDill Air Force Base, Florida, would be another spot to visit. For example, if I were putting this together now would be the time for visiting the Gulf States, Israel, Jordan, Saudi Arabia and even Diego Garcia. Central Command at MacDill Air Force Base, Florida, would be another spot to visit.

For example, I would ask American officials in the Gulf about Trump’s Iran strategy and how it was working; find out about the Iran destruction to U.S. Navy Fifth Fleet Headquarters in Bahrain and should it be rebuilt; and what new protection should be prpared for remaining U.S. forces in the area.

Back in 1969, when each of these trips were over, we summed up in memos what we had found. We eventually developed and then scheduled a series of closed hearing covering several of the countries we had visited. We kept the original hearings closed because we knew classified information would be involved, some of which the committee would demand be declassified, but more on that later.

The purpose of the closed hearings was to make a record of the facts we already had gathered, both abroad and in Washington. It was not primarily to find new facts. Often, the Nixon administration supplied senior State Department and Pentagon witnesses and they would provide their explanations for the facts we wanted to make public.

However, in one case, our closed hearing on Laos in October 1969, where I had interviewed an Air Force liaison officer in Laos, who had first-hand knowledge of American pilots flying secret reconnaissance missions from Laos. We required he be brought to Washington to testify in person in order to have first-hand information.

I will add that while I was in Laos in summer 1969, I arranged to fly on such a mission so we knew they were taking place. But Fulbright and other Senators on the subcommittee wanted the information on the record from the original source under oath, since up-to-that time those flights were secret, even from the Congress.

However, one lesson for today’s incoming Democrat investigators, as indicated above, is get out of Washington to investigate the Iran war situation.

During two days of closed hearings on Laos, we put on the classified record that the U.S. not only had American pilots in Laos flying recon missions, but that CIA was supporting thousands of Lao Hmong troops that were fighting against both North Vietnamese and Pathet Lao forces who were bringing military supplies into South Vietnam for the Viet Cong communist rebels.

After the closed October Laos hearings, Fulbright and other subcommittee members became concerned that the Nixon administration might expand the war by sending U.S ground combat troops into Laos.

In a televised press conference on December 8, 1969, President Nixon said there were "no American combat troops in Laos." But Nixon acknowledged for the first time that the U.S. was engaged in interdiction of the Ho Chi Minh Trail from North to South Vietnam-"as it runs through Laos."

Fulbright and other Senators decided to try to use Nixon’s words as a basis for an amendment to the Fiscal Year 1970 Defense Appropriations Bill, when it came up in the Senate. Fulbright then arranged for a closed session of the Senate on December 15. 1969 so the classified material from the closed October hearing could be discussed on the Senate floor. In the secret Senate session, only Senators and a handful of staff members were present.

The outcome of what was a secret three-hour debate, was passage of an amendment to the Defense bill, by a 78-to-11 vote, that said, “In line with the expressed intention of the President of the United States [Richard M. Nixon], none of the funds appropriated by this Act shall be used to finance the introduction of American ground combat troops into Laos or Thailand” – the latter country being added because some U.S. Air Force aircraft were operating from there along with American Army training units.

The Laos/Thailand amendment was accepted by the House and became law when the overall Defense Appropriation measure was signed by Nixon.

Another lesson for today: If you want to end or limit U.S. fighting in Iran, try to write legislation built around something the President has said or done.

Back in time, it was not until April 19, 1970, that the declassified Laos subcommittee hearings were made public, but only after time-consuming and often frustrating negotiations because there are no rules – nor limits – on what can be classified.

First, the State Department had to circulate the classified material to other government agencies that had a stake in the material. Then State delivered to the subcommittee the administration’s version of what in the hearing transcript could be released to the public, blackening out what they felt should not.

Thereafter, my colleague and I went over what was to be withheld, and picked out what we disagreed with. Then began a series of negotiations since, as we found out, classified material was in the eye of the beholder.

For example, I often found the same information State wanted to keep classified had already been made public. I was then told by State’s negotiator that it hadn’t been previously disclosed by an “official government release,” and therefore it should remain classified.

In one case, State had wanted to keep classified that during a hearing Sen. Fulbright had called the head of an allied government “a crook.” State’s argument was to make that public could cause the U.S. an embarrassment. Eventually it was published.

Next January, the Democratic members of the new Congress will each have some power to effect the last two years of the Trump administration just by speaking out; the Democratic chairmen of House and Senate committees and subcommittees will have even more power through hearings and speeches.

As someone who years ago saw, first-hand, congressional power exercised, I know the upcoming Congress could have an enormous influence on directions this country takes in the coming year if that legislative power is used aggressively and wisely.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Startups Are Now on the Front Lines

A recent Air Force contract to help screen small businesses applying for federal research funding reflects a growing national security concern: foreign access to American innovation.

Screening applicants is one part of that challenge. Protecting the technology those companies develop is another.

Startups are part of great power competition, even when their founders do not see themselves that way. Some of the technology the military may rely on over the next decade is being developed by small teams working on specialized components, software and materials.

Consider a hypothetical eleven-person quantum sensing startup, a team writing drone autonomy software for GPS-denied environments, or three researchers prototyping a radiation-hardened chip. None is building an entire weapons system. Each could hold a piece of technology valuable to a foreign intelligence service.

An adversary does not have to steal a complete system to benefit. Access to a component design, source code or test results could help it understand a capability, accelerate its own development or identify a weakness.

Intelligence officials have publicly warned about this exposure. At a Five Eyes gathering in California in October 2023, British intelligence officials warned that espionage increasingly targets startups, university research and people who may not think national security concerns them.

Small companies can face difficult tradeoffs. They need to recruit employees, attract investment and demonstrate products, often with limited resources for security. Those activities require sharing information with people outside the organization. An investor meeting, a product demonstration or a contractor’s network access can create an opportunity for collection if identities, permissions and requests are not adequately checked.

Companies developing sensitive technology need a way to evaluate those relationships without bringing their work to a halt.

Government and industry also operate across different information environments. Classified government work requires approved systems and facilities. A startup’s unclassified research may instead be discussed through commercial email, chat and document-sharing services.

Unclassified does not mean inconsequential. Individually modest details can become revealing when combined. In a hypothetical project, test results in one channel, a product roadmap in another and an integration schedule in a third could collectively reveal a capability’s maturity, expected delivery date or technical limitations.

A documented attack shows how collaboration services can become a route to sensitive information. In August 2023, a technology provider reported that a threat actor used previously compromised cloud accounts belonging to small businesses to send workplace messages impersonating technical support. The report described attempts to steal credentials by persuading users to approve authentication prompts. It identified the actor as a Russia-based group attributed by the U.S. and U.K. governments to Russia’s foreign intelligence service.

That report did not establish that the compromised businesses were startups or that the targets were larger companies. It did illustrate how an attacker could use a compromised business account to make an approach appear legitimate.

The lesson extends beyond any one platform: identity, access and account security matter wherever organizations collaborate.

Defense-related information can pass through a government program office, a prime contractor, a small technology company and a specialist supplier. Every transfer creates another point at which access must be managed.

Imagine a specification shared with a supplier and then uploaded to a folder used by outside contractors. Whether that transfer is appropriate depends on the information, the applicable requirements, the system’s configuration and who has access. Security depends on those decisions at each stage, alongside the protections maintained by the organization that created the file.

Commercial collaboration tools require security controls, configurations and usage policies appropriate to the information being shared. Different products and service offerings support different uses. A familiar interface or an encrypted connection does not, by itself, establish that a particular system is authorized or suitable for a particular defense project.

A March 2025 incident offered a separate example of the risks surrounding sensitive communications. A news organization reported that one of its journalists had inadvertently been included in a messaging group in which senior U.S. officials discussed impending strikes in Yemen. The incident illustrated the consequences of including an unintended participant in a sensitive discussion. It did not, by itself, demonstrate a failure of the messaging service’s encryption.

For startups, the practical challenge is to make appropriate security workable in everyday operations. Employees need clear rules about where information belongs, how to verify outside participants and when to escalate an unusual request. Organizations also need to manage guest access, review permissions and remove access when a relationship ends.

As AI capabilities develop and organizations prepare for future quantum computing risks, security requirements will continue to evolve. New tools may help. So can better use of existing capabilities, stronger account protections and clearer responsibility for information shared between companies.

Screening who receives federal funding is a useful first step. Protecting the intellectual property developed afterward requires sustained attention throughout a project and its supplier relationships.

The next theft of sensitive military technology could begin with a compromised collaboration account or an improperly managed guest invitation at a small supplier. Protecting that point of access deserves attention alongside the defenses surrounding the largest contractors.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The Command We Must Fund

The Army's Armored Force was born in July 1940, a few weeks after France fell. No act of Congress created it, and no budget line funded it. The Chief of Staff ordered it into being, took the tanks from the infantry and the cavalry, and placed them under a single commander. The money came later, once the force had demonstrated what it could do with what it already had. The idea had been waiting since 1928. The force did not wait for its appropriation.

Last week, I argued that the Autonomous Warfare Command could begin its work before it had a charter, a commander, or the $54 billion a reconciliation bill was supposed to deliver. This week, the bill lost its Congress. Democrats took both houses, and the two members who will now write the defense budget said what they think of the Pentagon's request within a day of the vote. Adam Smith, the incoming chairman of the House Armed Services Committee, said the mission "does not require a defense budget in excess of $1 trillion." Rosa DeLauro, who will chair Appropriations, promised to claw back billions across the Pentagon and homeland security. The budget resolution that would carry a reconciliation bill is one John Thune, the Senate's current leader, will not bring to the floor, and one Wall Street defense analyst gives it a one-in-ten chance. Of the $54.6 billion requested for autonomous warfare, $53.6 billion was to come through that reconciliation. The House's appropriations bill provides one billion. For now, that is the command's budget.

It is enough, if the command stops behaving like a program waiting for its money and starts behaving like a command. Three things happened this week that show how.

First, the hardware is arriving without the command. Central Command took delivery this year of more than 25,000 systems bought for $782 million through the Pentagon's competitive purchase rounds: some 1,300 one-way attack drones, more than a hundred unmanned surface and undersea vessels, and 24,000 counter-drone systems. The Army has already named its component, the Futures and Autonomous Systems Command, for a four-star command that does not yet exist. The systems do not need the $53 billion; they are coming anyway, and each purchase round is driving the price down. What does not exist is the authority to decide which theater gets them when there are not enough for both. That authority costs nothing. It requires a decision, and the Secretary can make it tomorrow.

Second, the budget that will pass has room for the command's purpose, though not for its request. The Center for Strategic and Budgetary Assessments published four ways this week to fund defense at between $1.05 and $1.15 trillion, written for hawks in both parties. Every one of them quadruples spending on critical munitions, and every one puts that money in the base budget, beyond the reach of a reconciliation fight. Two of the four need no reconciliation at all, and those are the two the Center recommends. A command whose case rests on cost per kill and speed from sensor to shooter belongs inside a munitions line that Congress has already agreed to grow fourfold. It should ask to be included in that appropriation as the authority that allocates among theaters and sets the architecture that every purchase must meet. It should also hold the priority order that stocks rare-earth magnets, because the ban on Chinese-origin magnets takes effect on January 1. None of that costs $53 billion. All of it is what a four-star command exists to do.

Third, the new chairmen have said what they will fund, and it is not nothing. Smith's trillion-dollar ceiling is a budget ceiling, not a mission ceiling. He did not object to autonomy, to lethality per dollar, or to folding the Services' separate drone programs into a single architecture. He objected to the $1.5 trillion figure and to the reconciliation that was to carry a quarter of it. A command that arrives at its first hearings, before Smith in the House and Jack Reed in the Senate, with a plan to deliver more capability from the budget it will actually get, by retiring duplicate programs and ruling among the Services, will find two committees that have waited years for that argument. A command that arrives asking for its $53 billion back will find the door that closed in 1931.

That is the test I set last week, with its terms now in plain view. The command's plan was due to the Secretary on October 30 and has not been reported delivered. No commander has been named. No priority order has been issued for the magnets. Each is a decision within the Secretary's authority, and each would show Congress a command that commands before it asks to be paid. The alternative is the one the Services will offer: each takes its share of the drones and its share of the billion dollars, and the result is called joint. That is what the Army did in 1931. It is what every institution does when the integrator has no money and no power to rule. Coordination assigns. Integration arbitrates. The Armored Force got its appropriation because it had already arbitrated. It had taken the tanks and put them under one man before anyone voted on the money.

Industry should read the same signal. The companies that will matter to this command are not the ones positioned for the $53 billion; that money is gone, and the primes sized to it will be resized by chairmen who have said a trillion is enough. They are the ones whose systems already work inside an architecture someone else controls, because the first thing a real command will do is refuse to buy what it cannot integrate. That is the whole test, for the command and for everyone who wants to sell to it: prove inside the smaller budget that one authority ruling among the Services delivers more than three Services coordinating with a check. Make that case before the first markup, and the money will follow the force, as it did in 1940. Wait for the bill, and the force will be absorbed by the institutions it was meant to change, as it was in 1931. Build for the command that arbitrates now, before the standard is written, and the standard will be written around what you built.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

China's Return to One-Man Rule

The U.S. will be holding mid-term elections on November 3, to elect the people’s representatives to enact laws, provide oversight and represent the people. In sharp contrast, China’s ruling Communist Party (CCP) announced that it formally expelled 33 senior political and military officials, in line with President Xi Jinping’s anticorruption purges, as Mr. Xi prepares for a fourth term as President of China next year. This will give Mr. Xi twenty years unquestionable power.

The U.S. and China obviously have different forms of governance. Senior Chinese officials often say that their form of governance is far superior to the U.S. political system. They argue that others, especially in the Global South, will see that China’s authoritarian form of governance is preferable to the constitutional democracy in the U.S.

China’s political system is an authoritarian form of governance, endowing the Chinese Communist Party (CCP) and its paramount leader, the General Secretary, with the power to make the laws, control individual rights and suppress the opposition, in return for the promise of stability and economic growth.

But it is ironic to hear these officials and academics criticize the U.S., comparing a democracy with an authoritarian political system.

Many in China realize the important role the U.S. has played to make China the second largest economy in the world. And it was Deng Xiaoping who realized that working with the U.S. would be key to making China great again.

Mr. Deng, after being purged twice, rose to power in China in December 1978, followed by formal diplomatic relations with the U.S. in January 1979. Mr. Deng visited the U.S. in late January 1979, setting the stage for greater cooperation with the U.S.

Mr. Deng inherited an impoverished China, having lost millions of Chinese due to Chairman Mao Zedong’s failed policies of land reform and the Great Leap Forward.

Mr. Deng immediately established a policy of “reform and opening up”, looking to the U.S. for economic assistance. And the U.S was there for China, permitting dual-use technology transfers that created the conditions for foreign direct investment in China; investment that fueled China’s export industries, key to China’s growth. The U.S. also provided China with market access for Chinese goods, while training millions of Chinese in modern technology and know-how. It was the U.S. that provided unprecedented help and support to China’s success story of lifting 20% of the global population out of poverty and assisting with its rapid modernization.

Although Mr. Deng moved China to a market economy, relying heavily on the U.S., he was opposed to a western tripartite separation of powers. He advocated for CCP control of the government, with collective leadership and term limits for the General Secretary of the CCP. – two terms, each 5 years.

But there were other senior Chinese leaders who advocated for greater reform in China. Former General Secretary of the CCP, Zhao Ziyang, wrote in his banned book, Prisoner of the State: The Secret Journal of Zhao Ziyang, that he was in favor of a parliamentary democracy for China, with the rule of law, not rule by men. Mr. Zhao was purged from the CCP in 1989, after sympathizing with the student protests at Tiananmen. Mr. Zhao wrote in his book that his predecessor, Hu Yaobang, was also replaced by Mr. Deng for indulging in bourgeois liberalization and advocating democracy.

And Former Chinese Premier Wen Jiabao, who served from 2003-2013, often spoke of the need for political reform, and in 2012 said that “democracy is inevitable” in China, to keep pace with China’s rapid economic growth.

Indeed, Mr. Deng, probably remembering the disastrous reign of one-man-rule of Mao Zedong, was a strong advocate of collective leadership and term limits for China’s paramount leader, the president of China and the general secretary of the CCP. Positions Mr. Xi has had since 2012.

Expectations are that Mr. Xi will seek and secure an unprecedented fourth five-year term as general secretary of the CCP at the 21^st Party Congress scheduled for the second half of 2027.

Mr. Xi’s anti-corruption campaign that started in 2012 has purged over 500 ministerial-level officials and over 2 million government officials for so-called corruption. No doubt, loyalty also played a role in many of these cases. Many of the purged senior officials were from the People’s Liberation Army, Navy and Air Force. Generals Zhang Youxia, Vice Chairman of the Central Military Commission and member of the CCP’s Politburo and Liu Zhenli, Chief of Staff of the Joint Staff Department of the Central Military Commission, both were expelled from the CCP and the military. General Zhang’s purge from the Party and PLA was especially surprising, given his long history of working closely with Mr. Xi.

It would be fair to ask how many of the 500 ministerial-level officials were purged because they were viewed by Mr. Xi as disloyal. How many shared Mr. Deng’s dictum of collective leadership and term limits, in opposition to Mr. Xi seeking a fourth five-year term as President and Party General Secretary? How many of the PLA generals and admirals expressed views on Taiwan that were not pleasing to Mr. Xi?

Indeed, how many people in China wish that they could vote to elect representatives who would represent the people and articulate their concerns?

The constitutional democracy in the U.S. is occasionally laud, and expensive to manage, especially during periods of voting for representatives, but it is a transparent and fair system. It is a system of governance that empowers the people.

The U.S. form of governance – a constitutional democracy – can easily compete with China’s authoritarian form of governance.

This article was initially published in The Washington Times and is republished here with permission.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

In Its Race to Field AI, The Pentagon’s Testing Can’t Keep Up

CNN reported, citing four sources familiar with the episode, that the U.S. military prepared to intercept a Chinese vessel after an AI-assisted intelligence report misidentified its cargo. According to CNN, the report incorrectly concluded that the ship was carrying components of a nuclear weapons program. Some of CNN’s sources said troops prepared to board the vessel and military aircraft were already airborne. Officials discovered the error before the planned operation. CNN could not establish which chatbot the analyst used and reported that the Pentagon and U.S. Special Operations Command Pacific did not respond to its requests for comment.

Military organizations use different tools and standards to check AI-generated information. As CNN reported, there is "no one set of standards for how the US verifies the information generated by these tools." The January 2026 AI Acceleration Strategy directs that the department enable “the latest models to be deployed within 30 days of public release". The model behind any application can change every month, but the definition of a correct answer should not. The fix, and the department's best path to AI safety, is to put guardrails in place by testing the systems built on these models the same way the department tests everything else it fields: against a written specification, by someone who does not work for the vendor, with evidence that outlasts any one model.

Scott Cohen is co-founder and CEO of Jaxon.AI, which sells AI verification and validation tools, including under Air Force and Space Force contracts. Jen Warren advises Jaxon.AI. The company could benefit financially if the Pentagon adopts the testing requirements recommended in this article.

A Model Is a Component

The department is dedicated to fielding AI quickly and widely. GenAI.mil launched in December 2025 with Google's Gemini; by September 2026 it had 1.7 million users. ChatGPT and Grok were added August 31, 2026. Users have built more than 100,000 custom agents since launch. On September 23, 2026, the deputy under secretary for research and engineering said the department will "proliferate frontier models" onto the secret and top secret networks next.

The directive on autonomy in weapon systems requires that "any further changes to the system will undergo appropriate V&V and T&E," that is, verification and validation, and test and evaluation. The department's own testers admit in a 2025 guidebook that "T&E of GenAI is still in its infancy as a discipline." The whole field shares the problem. Generative AI is particularly hard to test because a traditional test compares a system's output to a known right answer, and generative AI writes answers no one has seen before. There is no answer key to check them against.

The eight public announcements we reviewed, issued between December 2025 and September 23, 2026, did not disclose what performance tests GenAI.mil models underwent, what standards applied, or who signed off on fielding them. Every announcement cites Impact Level 5 accreditation instead, and the Chief Information Officer's July 2025 guide points out: "AI models do not need an ATO [authority to operate], but the actual system infrastructure layer does," and "adding models to an already approved system will typically not require a new system authorization." The same guide clarifies that it covers cybersecurity only and excludes "AI system performance expectations." The accreditation covers the hosting environment.

Military AI users number in the millions, yet the department cut its independent operational test organization's staff in half. The Government Accountability Office found in April that "well-defined, universal AI tests do not exist yet," and in June that this cut "increases the risk of weapon systems being delivered to the warfighters with undocumented shortfalls." In a January 12 speech, Defense Secretary Pete Hegseth named test and evaluation and authority to operate among the barriers to be "treated as operational risks." Three senators called for an inspector general investigation into the intelligence report based on faulty AI answers.

The Models Will Keep Surprising Their Makers

Testing the system is better than testing the model because AI vendors cannot predict what their own models will do. OpenAI reported that models in an internal cybersecurity evaluation bypassed isolation controls and compromised parts of its research infrastructure and Hugging Face’s systems in July 2026. OpenAI described how agents used a shared message board to exchange exploits. The incident illustrates how a model can behave in ways its developers did not anticipate.

The frontier labs' safety remedies (red lines, better alignment, more monitoring by more models) are all model-level. The department’s strategy calls for the ability to deploy new models within thirty days of release. It should also spell out how those models will be tested independently in military applications. Anthropic proposed embedding outside evaluators, arguing that a second opinion "free of commercial incentives" beats any self-report. The department should apply independent verification to models used in the military, especially any that are used in or inform the killweb.

What a System Test Looks Like, and Who Runs It

The department has made AI available to millions of users. Its public GenAI.mil announcements give little detail about how it tests system performance. A weapon system has to pass an independent operational test before it is fielded. An analyst's finished intelligence product has to meet assurance standards in Intelligence Community Directive 203: document how good the sources are, and keep what is known apart from what is assumed. The department should apply a comparable retesting requirement when it swaps a model in an AI system.

AI systems should be tested the way any other system is: define what right looks like, run a test to verify it behaves as expected, and document the evidence for future reviews. The returned verdict should pass or fail against a documented test metric, while demonstrating the strength of evidence the verdict rests on. A pass on thin evidence should never be mistaken for a pass on all related questions, and a test with no evidence to rule on should say so rather than pass by default. This test survives a model swap because the specification lives outside the model. The specification says what a correct output looks like for this system.

Swap Gemini for ChatGPT for Grok and the specification does not change, so the same specification is run again against the new model, and the comparison shows whether the swap moved the system's behavior, and by how much. The objection that you cannot test a system whose core component changes every month gets it backward. The component is the thing you cannot certify, because it will be different next month. The specification is the thing that stays put, and running it again after every change is the only test that still means anything once the swap has happened.

A test for an intelligence system could check whether cited evidence actually supports a claim about a ship’s cargo. That would help test for the kind of error CNN described.

Some have argued that military units using AI should handle testing themselves, with a single authorized operator who logs prompts, keeps a small test set, tunes prompts until the model’s answers look right, and rolls back a model that is inaccurate or drifting. That is a poor force-wide answer for four reasons: (1) it makes one person in each unit a single point of failure, applied differently across the force, which complicates multi-theater operations; (2) the judgment behind those prompts leaves with every operator's change of station, and the prompts left behind were tuned for a model that’s constantly changing; (3) units lack the authority to roll back a model in a system shared across organizations; and (4) a prompt tuned for one AI model fails on the next, while the department runs several vendors' models concurrently.

Vendor benchmarks alone cannot establish whether an AI system meets a military mission’s requirements. For weapons, operational testing is independent of the program office by law, because a program office and its vendor have every incentive to report that performance meets the requirement. A system test for AI needs the same independence: a tester that owns the specification, runs it on every model change, and reports to the authorizing official. That tester can be the Director of Operational Test and Evaluation, a service operational test agency, a federally funded research and development center, a university-affiliated research center, a contracted third party, or a combination thereof. It has to answer to the government and must have no stake in the model under test. The tools for writing and running a specification are a secondary question. Several already exist, and the United Kingdom’s AI Security Institute has released one as open source.

Critics may argue that thirty days is too short to verify a model. That assumes every model swap triggers a scheduled test event, with testers, test windows, and a written report. A specification-based test needs none of that. When a model changes, so does every system that runs on it, such as a custom agent on GenAI.mil or an intelligence system built on the same model. No test workforce, let alone one just cut in half, could review thousands of systems every month. Running a specification-based test doesn't depend on that workforce’s daily capacity, because the specification is programmed once and reruns at machine speed. The systems with the new model undergo the programmed tests, the testing software scores the answers, and the results are delivered to accreditors. Systems that fail stay on the currently approved model while the vendor fixes the model release that failed. The test specification is updated on its own schedule, as the mission changes or test results reveal gaps, and never to fit a particular model.

Write It Down, Fund It, and Own It

Program offices that want AI safety run into the same challenges as most programs: no documented requirement and insufficient authorized and appropriated funding. First, the requirement: the acceleration strategy tells vendors to deliver the newest model, fast, and is silent on verifying outputs by a tester. It should also require that the system be tested against the command's written specification by a government or independent tester, with a record. It is imperative this testing happens before a model is fielded for any use that produces finished intelligence or feeds targeting, and after every model change. That language can go into the next GenAI.mil model release tomorrow, rather than wait for the standards Congress has ordered by June 2027. Second, the money: the department should identify funding for the testing it requires. The department already knows what a failure costs.

Currently, authorizing officials accredit system infrastructure, not the AI models within, nor the answers they produce. The department should make the AI's performance part of what is authorized, similar to how a weapon must meet accuracy thresholds. The definition of a correct answer, the test evidence, and the record should travel with the authorization package, and a model swap that fails against them should be reworked before it is fielded. This approach mirrors what the autonomy directive already requires for weapons. Extending it to the intelligence tools that inform what those weapons do is the same requirement, applied one step earlier.

Specifications, Checks, and a Record

We are not arguing the department should slow down AI implementation. All military users should have the power of AI. What the department should prevent is a wrong answer that tears a hole in the killweb.

The senators called for the inspectors general to investigate. Any investigation comes down to three questions: what were the specifications, who checked the systems met these specifications, and where is the record. Right now, the department can answer the first with a stack of directives and the other two with a shrug. Corrective action is straightforward and ready to implement immediately. The department can update the policy to require that AI models be tested for accuracy, specifying that contracts be updated to reflect this requirement, then apply funding to address this pressing operational need. Improving AI safety will directly drive operational outcomes and protect the department and its people from being misled by AI hallucinations.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The Missing Dimension of Cyber Preparedness

The technical aspect of incident response can be immense. In extreme scenarios, such as the NotPetya incident in 2017, global organisations such as the shipping company Maersk found the speed and scale of the malware’s impact to be unlike anything they’d seen before.

Computer screens turned black. Employees sprinted through the offices demanding that colleagues disconnect their devices. Almost immediately, the infrastructure and systems underpinning a vast network of port operations, vessels and cargo movements had become inaccessible. The task of understanding what had happened, rebuilding and launching some kind of fallback operation was simply enormous.

But this is just part of the operational response. There is another part that is so often undervalued that organisations often find themselves having to work on in the most pressured and intense moments of crisis response: communication.

When considering the impact of an incident, and how that can be positively impacted, of course the technical and operational response plays a huge part. However, communications – done in an honest, transparent, consistent and authentic way – can also play a significant role both in the resilience of an organisation and the attitude, understanding and reaction of an organisation’s key stakeholders.

It is precisely this capability, however, that is often overlooked: in terms of preparedness; practice; and the appropriate skills and training.

Organisations do not enter a crisis with a blank slate

Customers, employees, regulators and the media will interpret an incident through what they already know or believe about the organisation involved, and their relationship to it. Its record on customer service, transparency and accountability will shape whether its early statements are trusted or tolerated and whether it is given the benefit of the doubt.

Trust cannot suddenly be manufactured when systems go down. It is accumulated over years but can be lost in hours. This was one of the key messages that came across from cyber leaders when interviewed for Communicating Cyber Risk. Crisis communication should therefore be understood as an extension of how an organisation behaves and communicates in normal times, rather than as a separate capability activated only when something has gone wrong.

The UK’s National Cyber Security Centre (NCSC) makes this connection explicit. Its guidance argues that communicating with stakeholders throughout an incident can reduce its short-term impact, build customer trust and limit longer-term harm. It also recommends preparing a communications strategy before an incident, including identifying audiences, agreeing responsibilities and considering which channels will remain available if normal systems are compromised.

From good practice to governance requirements

This is increasingly more than operational guidance. Across different jurisdictions, governments and regulators are making incident reporting and cyber risk governance more formal, more time-sensitive and more visible to senior leaders.

In the United States, Securities and Exchange Commission (SEC) rules require listed companies to disclose material cyber incidents within four business days of determining that they are material. The rules also require companies to describe their processes for managing material cyber risks and the board’s oversight of them. Significantly, disclosure may be delayed where the US Attorney General determines that it would create a substantial risk to national security or public safety.

In Europe, the NIS2 framework has strengthened incident-reporting and cyber-risk-management obligations across critical sectors. The direction of travel is clear: communication during an incident is no longer simply a matter for public-relations teams. It is becoming an essential part of governance, regulatory compliance and national resilience.

Yet policymakers and boards should be careful not to confuse faster reporting with effective communication. An organisation may meet a statutory deadline while still leaving its employees confused, its customers exposed and its technical teams overwhelmed by competing demands for information. Regulation can compel disclosure, but it cannot manufacture clarity, judgement or trust.

Policy should therefore place greater emphasis on communication readiness. Sector exercises and regulatory stress tests should examine whether organisations can coordinate messages, reach affected groups, operate through secure alternative channels and communicate responsibly when information remains incomplete.

One incident, multiple audiences

Preparation should begin by recognising that there is no single audience. Employees need to know what has happened, what they should do and where reliable information can be found. Customers will be concerned with the consequences for them: whether services remain available, whether their information is at risk and what protective action they should take. Regulators require accurate, evidence-based reporting within prescribed timeframes. The media will seek clear explanations and visible accountability.

The detail and tone may differ, but the core facts must remain consistent. Anything said internally should be assumed eventually to become public. Organisations therefore need a central spine of agreed messaging that can be adapted for different audiences without producing contradictions.

Timing and sequencing are critical. Employees and those directly affected should not discover the incident through a news report. Regulators should hear from the organisation rather than from journalists. Customers should receive practical information before being confronted with technical explanations. The media should have access to a clear, authoritative source rather than being left to assemble the story from leaks, rumours and external commentary.

Communicating without certainty

None of this means waiting until every fact is known. During the early stages of an incident, certainty is often impossible. An effective initial communication can simply explain what is known, what remains unknown, what the organisation is doing and when further information will be provided.

Acknowledging uncertainty is generally more credible than filling an information vacuum with premature assurances that may later have to be withdrawn. Early communication does, however, create an obligation to return with meaningful updates. Organisations must be prepared to communicate repeatedly as their understanding changes.

Communication is also essential inside the response itself. The Bank of England’s 2024 CBEST findings identified inadequate communication channels during incident response as a recurring weakness. Where attackers retain access to the network, they may be able to observe how an organisation is coordinating its containment activity. Secure, alternative communication channels are therefore not merely a public-relations consideration; they are part of the operational response.

Preparedness must be practiced

In practice, this means bringing technical, legal and communications specialists together before a crisis occurs. Organisations should agree roles, escalation routes and approval processes; maintain secure contact lists and alternative channels; prepare adaptable holding statements; and decide who will speak at different stages.

Most importantly, they should test these arrangements through realistic exercises. Such exercises should create pressure, uncertainty and imperfect information. They should ask leaders to make decisions without waiting for a complete technical picture. They should test whether communications can still be approved if email is unavailable, whether the organisation can reach employees quickly, and whether senior leaders can explain the incident in language that customers will understand.

Communication is therefore the means through which leadership becomes visible, uncertainty is managed and trust is protected. Organisations that recognise this before a crisis will be far better placed to withstand one when it arrives.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

BLUF: The Next AI Problem for Intelligence Is Not the Model, It's the Manager

The Intelligence Community has decided AI agents are coming. It has not decided how they will be supervised, checked and held to analytic standards. In April, CIA Deputy Director Michael Ellis said analysts will soon work alongside AI “coworkers” that draft key judgments and check them against tradecraft standards, and that within a decade officers will manage teams of AI agents. In August, DIA’s Chief AI Officer, MG Robert Kinney described this path as “building agents, and then agents with agents.”

The direction is set. What is missing is the discipline for managing it. Building one capable agent is now an engineering problem that industry has largely solved. Getting a dozen of them to work together on an intelligence question or targeting or planning issue, without losing the sourcing, the dissent and the accountability that underpin intelligence work, is a tradecraft problem.

That discipline has a name in industry: orchestration. It means deciding which agent does what, what each is allowed to touch, how their work is checked, and where and when a human must decide. For intelligence, orchestration is not a technical detail to leave to vendors. It is where analytic integrity will be won or lost.

The future of the US Intelligence Community is likely to involve networks of AI agents working amongst themselves — exchanging information, coordinating tasks and providing actionable intelligence. “Building agents, and then agents with agents, is the direction that we want to go,” Kinney said during an AI panel at DIA’s DODIIS conference in August. Kinney envisioned an AI agent that supports intelligence functions communicating with multiple other agents supporting operations, fires, logistics, communications and planning, creating an interconnected system able to help reason through complex mission problems.

Why Orchestration is the Hard Part

Anyone who has run analytic production or targeting knows the failure modes, because people have them too. With agents, they arrive faster and at greater scale.

Errors compound. When one agent’s output becomes the next agent’s input, a small mistake early in the chain can harden into a confident conclusion at the end. A human manager catches this by asking, “How do we know that?” An orchestration system has to ask the same question at every handoff.

Sourcing gets lost. Intelligence consumers trust a judgment because they can trace it to its reporting. When five agents summarize, reformat and combine material, the link between a claim and its source can quietly disappear. A judgment without provenance is an opinion.

Dissent disappears. Agents built on similar models tend to agree with one another. Without deliberate design, a team of agents produces consensus by default, the very groupthink that structured analytic techniques were created to break.

Accountability blurs. DIA’s chief AI officer highlighted the issue: no one yet knows what good tradecraft looks like when agents work with other agents. If a flawed assessment reaches a policymaker, or a flawed target package reaches a commander, someone must be able to say which agent produced which step, on what evidence, and who approved it. In April, NSA and its Five Eyes partners warned that opaque agentic systems make exactly this kind of audit hard.

What Good Orchestration Looks Like

The good news is that the Community does not have to invent the answer from scratch. Our own analytic standards, and a few early commercial systems, point the way. We also have organizations who have the authority to lay out the policy, the Office of the Director of National Intelligence (ODNI) and the Undersecretary for Intelligence and Security in the Office of the Secretary of War (OUSW I&S). In developing the policy, the DNI, with OUSWI&S should focus on the following:

Build in the audit trail. Every agent action should be logged and traceable to its evidence, the way a source citation anchors a finished product. Blockchain intelligence firm TRM Labs calls its investigative agent a “glass box”: it suggests and explains, never changes a case on its own, and every finding traces back to the underlying data. That is the right instinct for intelligence work.

Give each agent only what it needs. The Five Eyes guidance warns that over-privileged agents magnify the damage from a single compromise. The same principle improves analysis. TRM reports that its internal orchestrator holds 56 tools but shows each agent only the eight or so relevant to its task, and that narrower choices produce better decisions. Need-to-know works for machines, too.

Write the analytic standards into the system. ICD 203 already tells us what good analysis requires: sourcing, expressed uncertainty, alternative views, logical argument. The supervising layer should check every draft against those standards before a human sees it, as Ellis described.

Design for dissent. Assign an agent the job of the red team, or the devil’s advocate, and require the orchestrator to carry its view forward rather than average it away.

Put humans at the decision points, not every step. People should approve anything irreversible or consequential, such as a published judgment, a final target package, a dissemination or an operational recommendation. Asking a person to rubber-stamp every machine step is not oversight. It is fatigue.

The Hardest Test: Targeting

Nowhere does orchestration matter more than in the joint targeting cycle, where intelligence becomes action. This year showed both the promise and the risk of AI in the targeting cycle. During the Iran campaign, the Maven Smart System helped U.S. forces strike more than 13,000 targets in 38 days, regenerating target lists in minutes after each round of damage assessment. Public reporting has also tied the February 28 strike on the Shajareh Tayyebeh school, which killed more than 170 people, to outdated intelligence on AI-generated target lists. Speed without discipline turns a stale fact into a tragedy.

DOW Joint doctrine already separates the jobs that keep targeting accurate and lawful: developing the target, vetting the intelligence, checking no-strike lists, estimating collateral damage and the commander’s decision. Orchestration should preserve that separation, not collapse it into a single system. One agent’s only job should be to flag intelligence that is aging or contradicted by newer reporting. The agent that vets a target should be independent of the one that builds the case, so no agent grades its own work. Every element of a target package should trace to its source and date. And assessment results should automatically recheck every package built on the same intelligence, not just refresh the list.

Validation, legal review and the commander’s decision must stay human, with enough time and visibility to make real decisions rather than clicks. In targeting, orchestration is not mainly about going faster. It is about making sure the safeguards scale with the speed.

Building AI to Fight Back

The Community can build on its own analytic standards and a few early commercial systems. AI technology that arms adversaries, also gives defenders a way to at least match their scale. For example, TRM Labs is defining a new category of work called AI investigations; their platform which performs this is called Ardence. As described above, this brings blockchain intelligence together with data from dozens of partners, including CACI DarkBlue, Flashpoint, Team Cymru, Magnet Forensics and ShadowDragon, so investigators or analysts can see their critical data in one platform and work a single unified investigation or target. Under the analyst’s direction, Ardence searches all those sources in parallel. Every finding traces back to its source record, and the analyst decides what happens next. This moves analysts from individual leads and disjointed targeting lines to coordinated disruption at the speed and scale today's threats demand. It can be done but the IC needs to set the policy so it is secure in the Agents’ findings.

What Leaders Should Do Now

First, ODNI and I&S should treat AI orchestration as tradecraft. That means issuing Community-wide standards for multi-agent analysis, much as ICD 203 did for human analysis, covering what must be logged, how provenance is preserved, how dissent is carried, and where human approval is mandatory.

Second, test the orchestration as well as the model. Evaluations today focus on whether a model answers correctly. The Community also needs to test how teams of agents fail, including how errors propagate, whether sourcing survives, and whether a planted contrary fact gets surfaced or buried.

Third, buy for transparency. Agencies should write audit trails, provenance and human approval gates into contracts, and choose orchestration layers they can inspect. Ellis was right that the CIA "cannot allow the whims of a single company" to constrain it. The orchestration layer is where that dependence would be hardest to unwind.

Fourth, train the managers. Tomorrow's analysts will spend less time drafting and more time supervising agents, judging their work and owning the result. That skill set resembles running an analytic team and needs its own training and career path.

The remaining open question is how far the government should allow agents to operate without human intervention. Kinney suggested the answer will depend on the consequences of a decision. In potentially reversible mission areas, agencies could accept more risk and keep a human "on the loop," while irreversible actions such as fires would require a human "in the loop."

The Bottom Line

I spent more than four decades watching the Community absorb new collection systems and new analytic tools, and the management discipline around each one determined its success. AI agents will follow the same pattern. The agencies that get orchestration right will produce faster intelligence that policymakers can trust. The agencies that miss will produce faster intelligence that no one can defend. The time to write the rules for the intelligence community is now, before the agents start managing agents on their own.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Fire Base Australia: Can America’s Southern Base Sustain a Pacific War?

American access to Australian bases is only as valuable as Australia’s ability to keep them operating under attack. For Washington, expanding military cooperation raises an operational question: can Australia sustain an American campaign while defending its own territory, infrastructure and population?

For Canberra, the corresponding question is whether investment in national resilience is keeping pace with Australia’s growing usefulness to American operations. Both governments need convincing answers before a regional crisis turns access arrangements into wartime demands.

The benefits are considerable. Australian facilities offer strategic depth, logistical support and opportunities to disperse forces. Australia gains access to American capabilities, intelligence and interoperability. Their wartime value, however, depends on protection, sustainment and the host country’s continued ability to function.

The 2026 Iran war offers a warning. Despite America’s regional military presence, Gulf partners suffered casualties, damage and disruption from Iranian attacks. The lesson is not that every incoming weapon must be intercepted. It is that defending individual facilities and sustaining the country around them are different tasks.

Australia differs substantially from the Gulf states. Nevertheless, an adversary could seek to weaken an American campaign by imposing costs on its Australian support network. A base might remain operational while disruption to surrounding energy, transport and civilian services progressively reduces its usefulness.

Australia could face three simultaneous responsibilities: supporting American operations, contributing combat forces and defending its homeland. Aircraft assigned to coalition missions might also be needed to protect Australian approaches. Maritime forces could face competing demands to support forward operations and secure essential supply routes. Fuel, munitions and maintenance capacity would serve all three responsibilities.

These tensions matter directly to Washington. Disruption could reduce sortie generation, delay replenishment and constrain repairs. Requests for additional protection could divert American forces from other missions. Civilian hardship could generate political pressure over the scale or conditions of continued Australian support.

This is a planning problem, not a prediction that Australia would abandon its ally. Alliance planning should make such pressure difficult to exploit.

The ANZUS Treaty provides a commitment to meet common danger through each country’s constitutional processes. It does not allocate the forces, stockpiles or repair capacity needed to sustain Australia under attack. Those arrangements require practical agreement.

Canberra carries substantial responsibility. It cannot expand its supporting role while assuming Washington will supply whatever protection becomes necessary. Australia’s 2026 National Defence Strategy emphasizes greater self-reliance, industrial resilience and civil preparedness. The test is whether implementation can sustain national defense and alliance operations simultaneously.

Washington must likewise distinguish access from assured capacity. American forces operating from Australia may have missions elsewhere; their presence should not automatically be counted as an equivalent addition to Australian territorial defense. Reassigning them would carry consequences for the wider campaign.

The Wartime Planning Dilemma

Consider a Taiwan conflict later this decade in which the United States intervenes and Australia provides access, logistical support and a limited combat contribution while defending itself. This is a planning scenario, not a forecast. Proposed facilities must be assessed separately from capabilities already available.

Northern airfields, including Darwin and Tindal, could support aircraft rotations, staging, refueling and maintenance. Upgrades at Tindal to accommodate American bombers increase its potential utility. But aircraft parking capacity does not determine sustained combat output. Fuel distribution, munitions handling, maintenance personnel and runway repair would govern how frequently aircraft could operate.

Southern Australia offers additional depth. Reported plans for a Marine Corps prepositioning facility in Victoria, expected to reach full capacity in 2028, illustrate the value of storing equipment away from northern operating locations. Distance can reduce exposure to some threats while increasing transport requirements and replenishment times.

Such facilities also require planning with surrounding communities. Targeting exposure, hazardous fuel and ammunition storage, and pressure on civilian roads, utilities and emergency services must all be assessed. Local preparedness is part of operational resilience.

In Western Australia, HMAS Stirling could support submarine operations and sustainment. Its contribution would depend on qualified personnel, specialist facilities and available components, rather than port access alone. Joint facilities, including Pine Gap’s intelligence and missile-warning functions and Harold E. Holt’s submarine communications, add capabilities whose disruption could affect operations far beyond Australia.

The threat should be assessed across three overlapping tiers. These describe the expanding scope of disruption, not a predictable escalation sequence.

Tier one: military capability. Attacks on airfields, naval facilities, logistics installations or communications could reduce operational output without destroying entire bases. Planners should test combinations of physical attack, cyber disruption and sabotage. Concentrating essential functions at a few locations creates dependencies that dispersal, hardening, redundancy and rapid repair must address.

The relevant measure is how much military activity survives and how quickly lost capacity returns. An intact runway offers limited value if fuel cannot reach aircraft or maintenance systems are unavailable.

Tier two: the civilian systems sustaining military operations. Electricity, telecommunications, commercial ports, roads and fuel distribution connect military facilities to the national economy. Their disruption could constrain operations even where bases escape direct attack. Several modest interruptions could combine into a serious loss of capacity.

Fuel illustrates the problem. Canberra’s 2026 fuel-security package includes a A$3.2 billion government reserve and measures intended to lift diesel and aviation-fuel reserves to 50 days. This is an important investment, but a national stockholding target does not establish endurance under wartime consumption or guarantee delivery to the facilities needing it.

Tier three: national endurance and political decision-making. Prolonged disruption could place military requirements in competition with hospitals, food distribution, civilian transport and essential industry. Shipping interruptions could compound domestic damage. The resulting hardship could become a means of coercion, whether or not civilian suffering was the initial purpose of an attack.

Deliberate attacks on population centers would represent an additional, grave contingency. They are not necessary for this tier to emerge: disruption to shared infrastructure could already produce substantial civilian harm. Planning must therefore include essential-service continuity, emergency communications and support for affected communities, alongside military recovery.

Across all three tiers, the central question is the same: how much pressure can Australia absorb while sustaining its agreed contribution?

Turning Access into Endurance

The answer requires decisions before hostilities. Both governments should establish which functions each facility can sustain, for how long, and under what assumptions about replenishment and damage. Planned capacity should enter campaign calculations only when it is available, staffed and exercised.

The United States Studies Centre has recommended prioritizing the “five R’s” of logistics—refuel, rearm, resupply, repair and revive—through the Combined Logistics Sustainment and Maintenance Enterprise announced at the 2021 Australia–U.S. Ministerial Consultations. This provides an existing foundation for stronger sustainment arrangements.

The additional requirement is to test those arrangements against simultaneous homeland-defense and civilian-continuity demands. Logistics cooperation alone cannot settle who protects facilities or who receives scarce resources.

First, the allies should agree protection responsibilities and procedures for allocating scarce aircraft, fuel, munitions, transport and repair capacity. Australian homeland defense, Australian combat deployments and American operations cannot each assume first call on the same resources. Governments must retain decision-making authority, but the trade-offs should be understood beforehand.

Second, investment should address the dependencies that most constrain sustained output: alternative distribution routes, dispersed reserves, repair teams, replacement components and resilient communications. Additional operating capacity should be matched by the capacity to protect, supply and restore it.

Third, joint exercises should test concurrent disruption across military installations and civilian networks. State governments, infrastructure operators and emergency services should participate where relevant. Exercises should measure sustained output and recovery times under delayed replenishment, rather than merely demonstrate that forces can deploy.

Neither government needs to disclose classified plans to make these priorities visible in budgets and preparedness programs.

A resilient Australia gives Washington more dependable operational options and reduces emergency reinforcement demands. An exposed Australia could require additional protection precisely when American forces are most heavily committed elsewhere.

The alliance’s southern base will be judged by what it can sustain under pressure. Australian resilience must therefore be treated as an essential input to American campaign planning, with responsibilities agreed, resources funded and recovery exercised before war begins.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The Coming Age of Robotic Warfare

A battalion of armed robots moves against a unit of soldiers, aiming to seize territory. In the ensuing battle, the robots open fire, communicate with one another and change tactics as needed. Air cover is provided by uncrewed drones; logistical support and supplies are delivered by a separate team of robots. Territory is taken, prisoners captured. When the battle is over, the attacking side has lost several drones and robots, but no human beings have been killed or wounded.

Science fiction? Hardly. Some elements in this scenario – unmanned aerial cover and logistical support – are already commonplace in Ukraine. So are small-scale robot-led military actions. And experts say the other piece – robots leading major battlefield operations – is coming soon.

Ukraine's ex-Defense Minister Mykhailo Fedorov, who led a warp-speed campaign to bring an “Army of Drones” to the battlefield, has launched what he calls a “Manhattan Project” to build an “Army of Robots.”

“The goal of the Robot Army is to save human lives,” Fedorov said in a recent presentation. “Robots should perform the most dangerous work so that our soldiers return home.”

“The main question for 2027 is not whether Ukraine will have an army of robots – it already does,” said Morgan, the commander of a Special Operations Group in the DIU (Defense Intelligence of Ukraine), who goes by his call name.

“The question is how quickly we can scale it up, and hand over to robots more of the tasks that people perform today at the risk of their own lives.”

It’s a brave new world of warfighting, and beyond its life-saving promise, it raises questions about non-human decision-making, and how widely and quickly AI-guided robots will displace the world’s soldiers.

“The premise has to be that there will be human control,” Lt. Gen. Jack Shanahan (Ret.), who served as the first director of the Defense Department’s Joint Artificial Intelligence Center, told The Cipher Brief.

“What we have to figure out is where, when and how that control gets applied. I do not want to see machines deciding…to do something that the humans never anticipated.”

Major Yabchanka’s Journey

When Russia launched its full-scale invasion of Ukraine in 2022, Oleksandr Yabchanka was a combat medic; today, he commands an unmanned systems platoon for the “Da Vinci Wolves” battalion, and specializes in what he calls “the robotization of combat processes.”

“The route a robot covers today is one that people would previously have had to cover,” Major Yabchanka told The Cipher Brief. “In our conditions, that would mean an extremely high risk of being hit. Robots take that risk upon themselves.”

Nearly every Ukrainian military unit now uses AI-guided robots, or UGVs (unmanned ground vehicles), for a range of mundane but dangerous tasks. Yabchanka described a supply chain that begins with human soldiers in rear positions who hand off ammunition, food and other supplies to UGVs for the proverbial last mile to the front. Robots repair cables and antennas, transfer munitions, and help armored vehicles that are stuck in the mud. And increasingly, they’ve been evacuating wounded soldiers.

“This is one of the most difficult operations, often carried out under intense fire,” Morgan, the Special Operations commander, told The Cipher Brief. “When robotic systems are used for evacuation, the risk is significantly reduced for service members who would otherwise have to go out to help their wounded comrades.” He believes that ground robots have already saved tens of thousands of lives.

“Imagine having to carry a wounded person ten kilometers,” Major Yabchanka said. “It takes a long time, it’s physically exhausting, and once detected, the evacuation team becomes a priority target. We risk losing both the wounded soldier and those who go to save him. That is why we hand this work over to UGVs.”

Ukraine's Defense Ministry reported in September that UGVs had carried out 112,000 logistics and casualty-evacuation missions this year.

“Many of the (scenarios) are no longer science fiction,” Major Yabchanka said. “The question is not so much whether an army of robots is possible, but how quickly we can bring these technologies to the required level of reliability, integrate them into combat processes and ensure their mass use.”

Robot soldiers that think

The holy grail in this robotic evolution is full-scale offensive operations. Call that Mykhailo Fedorov’s dream.

For the moment, battlefield decisions are still made by humans. Those casualty evacuations are overseen by a human operator; and no large “units” of robots have gone into battle alone.

But in small ways, Fedorov’s dream is already a reality.

The New York Times reported on a battle in the Kharkiv region featuring robotic vehicles which advanced on a Russian position – “little green wagons” that “looked like something you might buy at a garden store to move bags of soil.” Each vehicle carried 66 pounds of explosives, and as they neared the Russian troops, an aerial drone dropped a bomb and one of the robots blew itself up.

Two Russian soldiers soon emerged from a trench with a sign that read “We want to surrender.”

In other words, a robot-led attack had resulted in the capture of Russian prisoners. “It is better to throw in metal than people,” Lt. Mykola Zinkevych, who commanded the attack, told the Times. “Human life is precious, and robots don’t bleed.”

More recently, in Ukraine’s Operation Vivaldi in the Donbas, UGVs were dropped by aerial drones deep into Russian lines; the robots then attacked Russian positions. As one of Vivaldi’s commanders, who goes by “Darwin,” told The Cipher Brief, his men would establish a defense line and then wait “until artillery, flying drones and robots do their work, and then go in again.” Darwin said his corps was the first to demonstrate such coordination between autonomous and human elements.

David Kirichenko, an Associate Research Fellow at the Henry Jackson Society, said Vivaldi had demonstrated “the inexorable erosion of the usefulness of humans in direct contact with the enemy.”

In another recent milestone, Ukraine’s "Lava" Unmanned Systems Regiment carried out what it said was the world’s first combat logistics mission utilizing an AI-driven ground robot without human supervision. The Defense Ministry said its robot navigated 93 percent of a roughly 12-mile route; a human operator stepped in only for a one-mile stretch where the terrain differed from what mapping software had suggested.

Fedorov’s “Manhattan Project,” which he unveiled at a conference in Lviv in late September, would take all this to scale – battalions of “humanoid robots” that are given a mission and are able to adjust tactics in mid-battle. Swarms of aerial drones have already shown this capability; as Lt. Gen. Shanahan noted, “we’re talking about drone swarms on the ground as opposed to in the air.” Fedorov says his “Army of Robots” is a logical evolution in the autonomous weapons space, and a way to address Ukraine’s manpower shortage.

“We want to eventually substitute our infantry with these robots,” he said.

Fedorov’s plans are supported by a new consortium that includes outside investors including Palantir CEO Alex Karp. In a recent interview, Fedorov said the project had attracted more than 800 applications from companies, engineers, designers and programmers.

As with nearly all military innovation in Ukraine, the “Army of Robots” time horizon is ambitious. Fedorov’s presentation included an initial six-month phase culminating when a “humanoid robot” kills its first Russian soldier; within a year, he said, robots will be ready to conduct major coordinated assaults on their own.

“We don’t have enough time,” Fedorov told the Lviv conference. “We need to achieve these results as soon as possible.”

The Pentagon’s Push

Ukraine is now the widely-recognized global testing ground for new military technology, the home to what Cipher Brief expert and former CIA Director Gen. David Petraeus has referred to as “tomorrow's technology for today's wars.”

With this in mind, American manufacturers have sent prototypes of robotic soldiers to Ukraine. In June, San Francisco-based Foundation Future Industries said it had dispatched its Phantom Mk1 robots to Ukraine for battlefield testing. Foundation CEO Sankaet Pathak said he was “convinced the technology is reaching a level where it can replace jobs that are dangerous for humans to perform, and if you can do that, it’s the highest net good you can create out of all applications of robotics.”

Meanwhile, the U.S. and other countries are escalating efforts to boost robotic capabilities within their militaries. In late September, Defense Secretary Pete Hegseth announced the creation of an Autonomous Warfare Command, and called on all the services to accelerate their autonomous and robotic capabilities.

“We will fuse procurement with operations at scale,” Hegseth said, “and allow warfighters and engineers and entrepreneurs to learn, adapt, and rapidly iterate on their domain.”

“What we’re beginning to see with the U.S military is an increasing emphasis on autonomous systems on the ground side, the sea side and the air side,” Lt. Gen. Shanahan said. “I sense a palpable sense of urgency that I didn’t feel a couple of years ago.”

Experts say the urgency is driven by Ukraine’s successes as well as the possibility of conflict with China. China is developing sophisticated military robotic systems of its own, helped by an already-strong commercial robotics and electronics sector. Recently China showcased quadrupedal ground robots, or “robotic wolves,” which experts say are designed to cover rough and mountainous terrain. Beijing’s broader military strategy emphasizes “intelligentized warfare”; integrating AI, robotics, and data networks into combat operations.

Lt. Gen. Shanahan says such integration will be critical for the U.S. as it boosts its autonomous systems.

“Technically, it’s doable pretty quickly,” Shanahan said. “Organizationally, and the integration piece of it, these are hard things to work through.”

Risks and limitations

Questions abound about the future of robotic armies – not least, their reliability, mobility and ability to react under fire. “Humanoid robots” are expensive, mechanically complicated and – for the moment at least – far less sophisticated than conventional ground vehicles and drones.

“You still need to take ground and hold it to end a war, and both sides have to agree the war is over,” Shanahan said. “You can’t do that with drones on the ground...At some point you will need to end up putting humans on the ground to hold ground or push back.”

Among practical concerns, experts list communications, cost and coordination.

An operator cannot continuously control a robot if the adversary jams its radio links; Major Yabchanka has seen his UGVs frequently disabled by Russian electronic jamming. “For more complex autonomous functions,” he said, “more and more computing has to happen on board the robotic system itself, without depending on an external server or a continuous communication link. This requires additional computing power, sensors and power supply. All of this increases cost.”

In terms of coordination, large “units” of deployed robots must avoid collisions, particularly in a dynamic battlefield. As with other AI-driven systems, experts say repeated battlefield tests will help iron out such problems.

The most profound questions involve the human element. Will human beings remain in control of missions once they are launched? Will robot soldiers identify potential targets? And will robots or humans authorize engagement?

“We get so caught up in technology itself, we forget what the most important piece of it is,” Shanahan said. “How are you going to fight with it? What’s your operating concept? What’s your organizational design, for bringing in all these ground systems? Where do you want to put the humans, where do you want to put the machines?”

Shanahan raised one specific nightmare scenario: a robot unit that collectively “decides” that its mission is best served by striking a civilian target that no human has authorized.

“You could see this robot out there with agentic capability, deciding that the quickest way to end the war is not to hit this thing that the human wants it to hit, but to hit that hospital over there because the enemy will back down once 500 civilians are killed in a hospital off the battlefield,” Shanahan said. “That’s a catastrophe in the making.”

Even frontline commanders in Ukraine, who crave every technological edge they can get, share such concerns.

“Questions that once seemed like fiction are now becoming entirely practical,” Major Yabchanka said. “Today, in most of the systems we work with, the decision to use lethal force remains with the operator. But technology is already moving toward a point where that decision could be handed over to a machine…We could end up in a situation where the decision to kill a human being gradually ceases to be a human decision. This is a very dangerous stage of technological development, and humanity should not rush toward it.”

Morgan, the special operations commander, shares these concerns. But he also calls Ukraine’s AI-driven robots “one of our enormous advantages over Russia.”

Yabchanka agrees. “Robotization is not just a new technology,” he said. “It is our competitive advantage and one of the main paths to victory over an enemy with far greater manpower. This is not just a matter of technological progress. I am convinced that this is how we can win this war.”

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The Hidden Cost of America’s War With Iran

“The [U.S. Naval Support Activity Bahrain] base and Fifth Fleet headquarters have been rendered largely inoperable for their original functions, with repairs estimated at $400 million… Chief of Naval Operations Admiral Daryl Caudle and other senior defense officials stated that the Navy will not return to full normal operations at the Bahrain facility anytime soon…Because the Juffair surrounding area [to the U.S. Bahrain Navy facilities] is considered unsafe, [U.S. Navy] major logistical and port-call operations have been rerouted over 2,000 miles away to the Naval Support Facility Diego Garcia and other alternative hubs, causing significant resupply delays.”

That is an excerpt from a 19-page Congressional Budget Office (CBO) report titled, Estimating the Cost of Combat Operations Against Iran, sent to Congress September 15.

I read the now-seven-week-old CBO report last week, and was surprised at how much new-to-me information it contained about the early days of the Iran war, and particularly Tehran’s early destruction of U.S. military infrastructure which, up-to-recently, had not had much publicity in this country.

For example, although the U.S. attacks along with Israel on Iran began before dawn February 28, 2026, there apparently was a lack of expectation for the size of Iran counterattacks with missiles and drones that actually took place later that same day, February 28, in Bahrain and at other U.S. bases in Qatar, Kuwait, Jordan, Saudi Arabia, and the United Arab Emirates.

And while the White House and Pentagon repeatedly have described the destruction U.S. and Israeli forces have done to Iran’s military, there has been as almost no mention of what was happening to the U.S. facilities.

In mid-September, the Defense Department (DoD) Inspector General (IG), as Lead IG, released a report on Operation Epic Fury (OEF) -- the war against Iran. The IG report found that “Iranian strikes damaged and destroyed hundreds of buildings and structures at U.S. bases in Kuwait, Bahrain, Qatar, UAE, Saudi Arabia, Iraq, Oman, and Jordan during the conflict,” as of June 30, 2026, and the DoD had “$3.7 billion in equipment losses, but [that] does not include costs for infrastructure repairs.”

The IG report later noted it “did not include the cost of military construction for damaged infrastructure in its estimate because [DoD] has not determined what its future posture will be in the region, how it will construct its bases, and what percentage of the construction costs Allies and partners will contribute.”

On the other hand, the IG report did say “damage to U.S. embassies, consulates, and other diplomatic facilities had already cost the U.S. approximately $184 million.”

I should point out that the CBO September report, sent to Congress one day after the IG report was released, noted that DoD had failed to provide to it, the CBO, with an estimate on the cost of the damage to U.S. bases and facilities.

In fact, there still has yet to be any publicly-released official DoD estimate of the cost of damage to U.S. military bases and facilities based on Iran’s attacks.

However, Iran attacks in those first days of the war continued in a scale and duration that appeared to have taken the U.S. government by surprise. For example, it was not until March 2, the third day after attacks began, before the Navy and the State Department ordered the evacuation of dependents from Bahrain.

The September CBO report said, “Military families and non-essential personnel were evacuated [from Bahrain] in March 2026, and remain displaced across temporary housing, awaiting the eventual retrieval of personal belongings left behind…[and] Evacuated families have faced added strain as military leadership noted that temporary evacuation financial support is scheduled to conclude on November 30, 2026, even though shipping personal effects is expected to take several more months.”

Also indicating a surprise from Iran’s military response, the DoD’s IG report noted, “Prior to OEF, Bahrain had been U.S. Navy Central’s main logistics hub to sustain operations in the Persian Gulf region, USCENTCOM [U.S. Central Command] said. During major combat operations, Iran targeted Bahrain with [drones] and ballistic missile strikes. USCENTCOM stated that it initially shifted naval sustainment resources from Bahrain to alternate hubs.”

The IG Report added, “The establishment of adequate naval bases and support ports posed significant challenges before and during OEF, arising from complexities and due to uncertainties with host nation access permissions to utilize ports for fleet resupply, USCENTCOM said.”

For example, the need to shift logistics support and infrastructure to Diego Garcia added 14-to-18 days for transporting material by sea, according to the IG report.

As for the U.S. Combined Air and Space Operations Center (CAOC) at Al Udeid Air Base in Qatar, the Air Force had since 2019 periodically conducted tests and temporary shifts of its operations to Shaw Air Force Base in South Carolina to demonstrate distributed command-and-control capabilities and reduced reliance on a single point of failure.

As reported in June by Air and Space Forces Magazine, personnel were transferred away from Al Udeid before February 28. Therefore, when Iran weapons struck the COAC facility at Al Udeid Air Base in the early days of the war, operations were already being run out of Shaw Air Force Base.

Then, there is the already publicized, but apparently un-planned, heavy use of both offensive and defensive U.S. weaponry caused by the Iran war.

For example, the September CBO report estimated, “The cost to replace the munitions expended through August 1, 2026, is $21.7 billion: $7.3 billion for the land-attack cruise missiles, $13.1 billion for the missile defense interceptors, and $1.2 billion for other munitions. Replacing those munitions has been the largest single component of the costs incurred by DoD during the conflict.”

CBO estimated that it “would probably take at least five years” to replace certain interceptors even at an increased rate of production.

An October 5, Congressional Research Service (CRS) report, U.S. Military Operations Against Iran’s Missile and Nuclear Programs, raises another point worth considering -- whether the Trump planners understood the difficulty they faced in trying to disarm Iran.

The CRS report noted that President Trump on February 28, listed among the OEF’s objectives was destroying Iran’s missiles, and “[razing] their missile industry to the ground.”

However, as CRS reported following the initial U.S./Israeli attacks, “DIA [the Defense Intelligence Agency] assessed in April 2026 that Iran ‘retains thousands of missiles and one-way attack UAVs [drones] that can threaten U.S. and partner forces throughout the region, despite degradations to its capabilities from both attrition and expenditure.’”

CRS also reported articles that said “that Iran may have begun rebuilding military infrastructure, restoring access to missile bases, and resuming missile production using stockpiled components. An Iranian official reportedly asserted in August that Iran has sufficient ‘stockpiles in our underground missile and drone cities’ to enable continued production.”

The CRS report suggested Congress consider directing the Pentagon to produce an “annual report on military power of Iran,” along with a public version of that report.

While dealing with public reporting, I must note the odd way DoD has been handling public disclosure of U.S. dead and wounded since February 28, a system clearly designed to lower the numbers.

Instead of having one category, there are two – one for the period February 28-to-July 6, covering OEF with 15 deaths and 417 wounded; the second from July 7-to-present in a second category, “overseas operations,” which lists eight deaths and 448 wounded.

The Trump administration rationale was that a temporary ceasefire or memorandum of understanding was reached to end OEF and that fighting resumed on July 7, after the earlier ceasefire collapsed.

However, as Stars and Stripes reported last Thursday, “The Pentagon has revised the number of U.S. troops who have died during operations related to the war against Iran to 23… Additionally, 865 American service members have been wounded.”

Now we are in a period where President Trump has threatened, after today’s elections, to renew attacks on Iran. He has amassed a battle force that could carry it out. He has also warned allies in the region it may be coming.

The State Department has ordered nonessential government employees and their families to leave Saudi Arabia and made staffing adjustments or family departures across several diplomatic missions in the Middle East.

But as I have indicated above, Iran, which has the largest armed forces in the region, has a capability to strike back, whether the Pentagon acknowledges that or not.

Iran has developed a defense industry and its own military capabilities, including extensive underground facilities, and dispersal of munitions inventories.

The volume of U.S. offensive and defensive ammunition used so far against Iran show that any U.S. renewing of attacks to force Tehran to accept Washington’s terms, would not be a day or two operation.

And perhaps just as important to think about -- given what Ukraine has shown -- explosive drones can be launched toward targets thousands of miles away, showing no country is completely safe, no matter how far its borders are from the enemy.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The Command We Must Start

In 1928, Secretary of War Dwight Davis ordered the Army to assemble an experimental mechanized force of tanks, armored cars, and motorized infantry at Camp Meade, Maryland. It was disbanded within months. A second attempt was dissolved in 1931, when the Army told each of its branches to mechanize itself. The infantry kept the tanks, the cavalry built “combat cars” to work around a law that gave tanks to the infantry, and the United States created its Armored Force in July 1940, weeks after France fell. The Army had the idea twelve years before it had the force.

Owen West and Max Strasiser, who are building the Autonomous Warfare Command, cited the 1928 force in their October 21 open letter as the fragmentation the country must not repeat. They are right, and the week since shows how it happens. The command’s plan of action and milestones was due to the Secretary of War on October 30, and no one has reported that it arrived. The Pentagon is drafting a budget of about $1.1 trillion against a $1.5 trillion request, Politico reports, and the command rests on $54 billion in a reconciliation bill that has not passed and has no backup, according to Defense One. No commander has been named. Davis’s force was not defeated by an adversary. It was absorbed in peacetime, in a budget fight, by the institutions it was meant to change, while no one with the authority to stop it chose to.

Last week, I named three things the plan must settle: the authority to allocate resources among theaters, edge computing, and magnets for drones stocked before the ban. These items remain the test of the plan when it appears. But a command is formed by what it does before its charter is signed, and the Services are already deciding what this one will be. Five things can start this month, and none of them requires an act of Congress or the $54 billion:

Start in the theater. The letter allows different mixes of systems for the Indo-Pacific and for Europe. It does not say who chooses between them when there are not enough for both, which is the only week that matters. The command’s planners should sit with Indo-Pacific Command now and run that choice in an exercise: two theaters, the same systems, the same day, and a ruling the Services agree in advance to treat as binding. I served six commanders at Indo-Pacific Command and one at Special Operations Command. Each could state exactly what the fight required. The process that allocated scarce systems and bought new ones answered late, and more often not at all. A rule practiced before the war is the only kind that survives it.

Start measuring time. The letter grades spending by cost per kill. Add a second number: the time from sensing a target to striking it, and who owns each link in between. The advantage of autonomous warfare is reduced latency. Ukraine’s drones compute on the airframe because they cannot afford the round trip; too many of ours still make it. A force that relies on someone else’s network to communicate, or on a signal an adversary can jam to determine its location, has let another party set its speed. Make latency and assured positioning, navigation and timing a condition of every purchase.

Start with command and control. No technical architecture, interface standard, or acquisition priority list has been published. Write them before the first large buy, as one architecture across every Service and domain, including space. Every system bought before the architecture exists is a problem handed to the warfighter to solve under fire, and it becomes obsolete the day a system that integrates arrives.

Start telling industry what it needs. Industry answers requests for proposals; it does not invest against a need it cannot see. The Defense Innovation Unit and the Defense Advanced Research Projects Agency identify gaps faster than the system can close them, and drones are the proof. Publish the demand signal: the architecture, the quantities, and the dates. Put supply in it. The command’s motors still turn on Chinese magnets, and Beijing’s pause on licensing lapses on November 10. The Pentagon’s own ban on Chinese-origin magnets begins on January 1. No Defense Production Act priority rating has been reported to carry the command across that gap.

Start with allies where they give an operational advantage. The letter does not mention them. Yet allies are already paying for American weapons: Canada, Germany, and Norway are financing a possible sale of 500 Patriot interceptors for Ukraine, approved October 30. Korean yards overhaul American supply ships, and the second pillar of AUKUS, the Australian, British, and American partnership, carries autonomy as a line of effort. Build and repair the systems where the fight would be, inside the theater, with partners whose industry can surge when ours cannot. That makes the arsenal of freedom an operational fact rather than a slogan.

None of this is money, and all of it is integration. The Services will coordinate the command into existence if it lets them, each taking a share of the systems, the budget, and the mission, and calling the result joint. That is what the Army did in 1931. West and Strasiser are right that the advantage goes to the force that adapts faster than its adversary. But adaptation is a decision made again and again, and a command that cannot rule among the Services will adapt only as fast as the slowest of them. A command earns its four stars by deciding among competing claims and making the decision bind, and this one can start before it has a charter. Coordination assigns. Integration arbitrates.

The Army that told each branch to mechanize itself built its Armored Force after France fell, and still had more than two years before its armor met the enemy. This command will not be given two years.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The Cipher Brief’s 10th Threat Conference: Optimism, Urgency, and the Imperative to Act

Which came first: The Cloister at Sea Island, the Office of Strategic Services, or the CIA? The resort wins. The Cloister first opened in 1928, fourteen years before the OSS and nineteen before CIA. It was a fitting setting for The Cipher Brief’s 10th Threat Conference, where conversations returned repeatedly to a question familiar to generations of intelligence professionals: how do we adapt quickly enough to meet the threats ahead?

Over three and a half days, national security practitioners (we counted at least four four-star generals, over a dozen Chiefs of Station and three agency heads), industry leaders, journalists, and former senior officials examined what that adaptation requires. While the grounds were truly breathtaking, it was the windowless ballroom that drew in the national security diehards. Across discussions of threats to the US, artificial intelligence, commercial capabilities, intelligence tradecraft, and talent, we heard a common imperative: America’s national security institutions need to move faster. We left encouraged by the possibilities and concerned about the cost of delay. A few themes stood out, connecting what must change with what we cannot afford to lose:

Technology: Opportunity and Exposure: If we had a dollar for every time we discussed technology, we would own Sea Island or at least one of the homes there! From computer vision and ubiquitous technical surveillance to disinformation campaigns and AI-accelerated cyber operations, there was little disagreement that today’s technology is reshaping intelligence work and the threat landscape. These capabilities create extraordinary opportunities for intelligence collection and analysis while giving adversaries new ways to surveil, deceive, and attack.

We discussed the sobering lessons from Ukraine’s battlefield, and those discussions sharpened another question: are we prepared to stay focused, learn, and adapt as technology is developed and employed in real time? Those lessons demonstrate both the opportunities and the risks of failing to move now, with fascinating questions still open about AUTOWARCOM’s implementation. As one speaker remarked, it is “open season” for cyber operations. The October 29 attack, only a day after our conference closed, on cryptocurrency exchange Binance provided a sobering example of the stakes.

Going Commercial- More Than Ever: The Cipher Brief team underscored that industry is driving advances in intelligence capabilities, making closer cooperation across a broader range of sectors essential. Government must identify, acquire, and integrate those capabilities at the speed technology evolves.

That requires more open dialogue: government needs to understand what industry can deliver, and industry needs a clearer understanding of mission needs and constraints. Both must address slow acquisition timelines, security and classification requirements, data access, intellectual property rights, and barriers to moving talent between sectors, while maintaining ethical standards and safeguards against conflicts of interest.

The private sector must also reckon with the responsibilities that accompany becoming integral to national security operations. Discussion of Starshield underscored difficult questions about who sets the terms of support, who decides when capabilities can be used, and whether government can count on their availability when it matters most.

Startups need a meaningful place at the table. Many lack the staff, resources, and procurement experience of established defense contractors, yet offer some of the most creative solutions. Turning that innovation into mission capability requires practical help navigating government requirements and a willingness by primes to give smaller partners meaningful workshare.

Tradecraft Still Matters: One of the best parts of the Cipher Threat Conference is a battery recharge of the importance of espionage, tradecraft and underscoring that there is no substitute for the human context that makes for exceptional insights into our adversaries. The national security apparatus needs to make sure that in the euphoria of AI the community does not forget the traditional intelligence disciplines and our writ to steal secrets wherever and however we find them. Each of the panels highlighted that the human use and capitalization of technology is where the magic happens and also humans are our targets and we need to remain focused on their values, their strengths and weaknesses as we use tech as a tool.

The Chiefs of Station reinforced this point in discussing HUMINT, but it applies equally to the reflections shared of GEOINT and SIGINT. AI can enhance each of these disciplines. It cannot replace the sources, collection capabilities, tradecraft, and human judgment on which they depend. As we modernize, we must strengthen and reimagine how to use those foundations alongside the technologies that help us exploit them.

Talent: The People Make the Mission Possible: Anyone who has served in the Intelligence Community knows the refrain: people make the mission possible. If AI was the conference’s dominant theme, talent was a close second. How can we meet increasingly complex threats if we are not attracting the right people, retaining critical expertise, and reimagining what a career in intelligence can look like? Discussions reflected concern about the scale of recent federal departures, competition with private sector compensation, and a new generation of recruits whose ambitions may not include forty years in one organization. But there is opportunity here too. Fresh ideas, varied perspectives, and an increasingly digital native workforce can reinvigorate institutions that offer opportunities to serve found nowhere else.

During our government careers, the expectation was largely that intelligence would be a lifelong professional home. That model still has value, but it cannot be the only path. The Community needs to accommodate people who serve for several years, build experience in industry or academia, and return with new skills and perspectives. Making those transitions practical would benefit both government and the broader national security enterprise.

That requires shorter hiring timelines (yes, we still wrestle with this), workable processes for maintaining or reestablishing security clearances, and career paths that value experience gained outside government, making it easier for talent to move between government and industry. Compensation deserves attention too. Government may not match technology sector salaries, but competitive benefits, childcare, educational support, and opportunities for professional growth can strengthen its appeal. The mission remains a powerful draw, but we cannot expect commitment to service alone to overcome a system that makes joining, staying, or returning unnecessarily difficult.

Optimism Among Professional Pessimists: Three days of discussing threats and vulnerabilities could leave anyone discouraged. Yet throughout the conference, urgency, frustration, and concern shared the stage with energy and optimism that this is a moment when the US can get things right and reinforce its advantages over its adversaries. Who would have thought?

Success is hardly guaranteed. Still, there was a recurring conviction that we can rise to difficult challenges, even against the clock, against the odds, and in a challenging national security environment. Industry leaders described work underway with government partners, giving substance to that optimism. National security professionals are rarely known for sunny outlooks, but even we were struck by the energy and determination in the room. There certainly was a thread of renewed commitment to turn promising capabilities into mission results, strengthen intelligence and defense advantages, and protect the US from those who would do it harm.

NOW! NOW! NOW!

Everyone discussed that America has a history of being able to overcome crisis and meet new demands when needed. The characterization that the US is “expending readiness” quieted the room, capturing the concern that delay carries a cost. There was a shared agreement that we are moving too slowly. It is clear what needs to happen and it is happening but maybe not fast enough.

The question was asked about whether we had learned the lessons of the past where we put off change until we were forced into it by a cataclysmic event like Pearl Harbor or 9/11. The establishment of the DNI is an example of that. The IC and lawmakers all knew that an entity outside of CIA was needed to be the integrator of intelligence. There was draft legislation that developed this entity as early as 1995, but it was not until after the horrific attacks on the United States in 2001 that the DNI was established, once it became clear that stovepipes in the intelligence community contributed to those attacks. Several discussions also raised a more fundamental question: are we organized for today’s challenges, and which elements of the framework established by the National Security Act of 1947 still serve us well, versus those that need to evolve? Not for this Cipher conference to tackle.

The bottom line was that we are at a moment when thoughtful change for our national security community is possible. Do not squander this moment.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The Kids are Alright: U.S. Soft Power, Aid, and Youth in Africa

OPINION — A recent survey of African youth challenges conventional wisdom on foreign aid. Policymakers should take heed of their views as they design the future of U.S. foreign assistance to increase effectiveness and American soft power on the continent.

We ask a lot of our aid to Africa. Over the years, it has saved countless lives from HIV/AIDS and malaria, fed the hungry, stopped pandemics, and increased farmers’ yields. We take it for granted that our good intentions are appreciated by Africans, augmenting American soft power and influence.

Yet, what if those assumptions don’t hold? What if our aid simply did not have the positive reception we thought it did? Today, in the wake of USAID’s shutdown, the entire architecture of foreign aid is under review, with many studies, commissions, and proposals underway. Now would be the time to dig deeper to understand what Africans want from aid. Doing so would help us be more effective and relevant, with the added benefit of increasing American soft power.

In August, the Ichikowitz Family Foundation of South Africa conducted its fourth iteration of the African Youth Survey, the most extensive continent-wide survey of African youth. This year’s survey included questions specifically about USAID cuts, and its findings blow up any illusions we might have had about young Africans feeling hopeless over USAID’s departure.

After 21 years with USAID in places like Uganda and South Sudan, where my focus was out-of-school youth, and a tour as mission director to Somalia that was canceled by USAID’s shutdown, I thought I understood how African youth viewed us. I was wrong. Three findings in particular challenged my preconceptions and provide important lessons as we design the future of U.S. foreign assistance.

Less Than Half Will Miss USAID

The survey was conducted in places that had enormous USAID programs, like Nigeria, Kenya, the Democratic Republic of the Congo (DRC), and many others. Yet, only 46% of respondents thought USAID cuts would have a negative impact. Fully 26% saw a positive impact, 16% saw no impact, and 11% did not know.

However, the researchers also commented, “Just over a quarter (26%) take a more optimistic view, believing the closure will force leaders to confront domestic challenges directly.”

This idea was certainly borne out during my Africa tours with USAID. Often, the U.S. budget for health far exceeded the country’s national budget for the sector, allowing the country to direct spending elsewhere, such as Russian-made fighter jets, as happened in Uganda in 2011.

The lesson: Our foreign assistance should be part of a larger bilateral partnership with mutual accountability, where the country must increase its own domestic spending on the sector in tandem with our assistance.

China Is Viewed More Positively Than the U.S., Despite Flaws

When asked about the influence of China and the U.S. on their countries, again, the results are surprising. China is fully ten percentage points ahead of the U.S. regarding whether the influence is positive (95% for China, 85% for the U.S.).

Is this a reaction to the Trump administration? In 2024, results for the same question were similar, with China slightly ahead. However, positive responses for the U.S. actually went up during Trump’s tenure (from 79% in 2024 to 85% in 2026).

Key to this finding is a related one in the 2026 report: 58% of respondents thought that the U.S. would disregard international law to gain access to natural resources. Recent actions like the capture of Nicolás Maduro and asserting ownership over Venezuela’s oil showed a disregard for international law. Respondents may be surmising that the same could apply to African natural resources.

What is astounding about China’s strength on this question is the abundance of evidence that China is highly transactional with its aid recipients, often leaving them indebted and in weaker positions. That was certainly the case with South Sudan’s “Oil for Roads” deal, widely disparaged by locals and diplomats when I served there.

Why aren’t widely known stories like this one reflected in the responses? Emmanuel Kwezi Tabaro, an analyst of the 2026 survey, explained:

“Young Africans are not uninterested in geopolitics, but they appear far more concerned with the practical realities that shape daily life: jobs, infrastructure, economic opportunity and the cost of living. When they think about international partnerships, many are asking less about ideology and more about whether those partnerships will improve their prospects.”

China is seen as meeting youth where they are, which leads to the third finding.

The lesson: With huge youth populations in Africa, increase programs specifically for youth that prepare them for jobs, like training and leadership programs, and adulthood, such as family planning.

It’s the Economy, Stupid

Actually, it’s about jobs. When asked about the biggest threats to African communities, 54% of respondents said unemployment and poverty, not violent crime (20%), gangs (17%), or terrorism (16%). When asked what government priorities should be to improve security, 56% of respondents said job creation for young people, far ahead of military investment (35%) or improvements to policing (29%).

Why are questions about threats and security coming back to jobs? Jihane Cherif, another analyst of the 2026 survey, answered:

“A young person who cannot find work, cannot afford to eat, and cannot see a way forward within the system does not feel protected by a well-equipped police force. They feel abandoned by it.”

The lesson: As in the World Bank’s new strategy, keep a laser focus on the bottom line of job creation for the millions of youth entering the workforce each year.

The Bottom Line

In the great power competition being played out in Africa, we cannot take for granted that our generous assistance will lead to increased positive views of the U.S. This survey shows a rising generation of savvy youth that sees the whole picture of U.S. policy, questions rhetoric, and asks fair questions about the impacts on their lives of billions of dollars of assistance. Hearing their concerns will result not only in more effective aid programs, but also in increased American influence across the continent.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

F-35 Fallacy: Jets Alone Will Not Save Us

NATO Allies have bet the future of European skies on the world’s most sophisticated combat aircraft. NATO Allies are buying the world's most advanced fighter but many are neglecting vital investments in hard security, ground crews, and support systems that will keep it flying.

By 2028, European flight lines will host upwards of 700 F-35 Lightning jets. On paper, this inventory represents an insurmountable technological edge: a sensor-fused, fifth-generation fleet that outmatches any potential adversary in radar-cross-section, situational awareness, and electronic attack.

Yet this procurement spree masks a dangerous complacency. The Alliance has poured vast capital into acquiring fifth-generation airframes while systematically underinvesting in the unglamorous terrestrial infrastructure that keeps them flying: base hardening, counter-drone defenses, resilient networks, and ground crews. An F-35 sitting on an unhardened runway without fuel, parts, or secure command links is not a deterrent, it is an expensive target.

The cockpit may deliver tactical lethality, but operational endurance is generated entirely on the tarmac. If conflict erupts with Russia, the fight for European airspace will look less like a sterile, high-tech turkey shoot and more like the grueling attrition of the Battle of Britain.

Surviving Day Zero

Historically, the most efficient method of destroying an air force has rarely been in air-to-air combat; it has been catching it on the ramp. Operation Focus in 1967 wiped out Egypt’s air force before breakfast. Conversely, Ukraine averted immediate disaster in February 2022 because it aggressively dispersed its scarce aircraft and mobile air-defense batteries hours before Russian cruise missiles slammed into permanent garrisons.

Recent innovations have further collapsed the boundary between frontline and rear sanctuary. In June 2025, Ukraine demonstrated the democratization of deep strike with Operation Spiderweb, deploying commercial-style drones smuggled deep into the Russian interior to strike strategic bombers parked in the open. The threat bypassed layered air defense belts entirely; it originated outside the airbase perimeter fence. Coupled with intelligence reports of sabotage devices targeting logistical hubs in Western Europe, such as the attempted strikes near Leipzig, the implication for NATO is clear: rear sanctuary no longer exists.

Russia has studied these dynamics carefully. A coordinated "Day Zero" assault will not rely solely on long-range Iskander or Kalibr barrages. It will combine standoff salvos with covert proxy drone launches, special reconnaissance sabotage, and electromagnetic disruption targeting key airbases before any formal declaration of Article 5. If NATO’s F-35 fleet remains concentrated at sprawling, unhardened hubs, the Alliance risks losing the air war before its pilots can take off.

Survival on Day Zero will not come from a single system. Ground-based air defense will kill aircraft, cruise missiles will crater runways, and drones will hunt anything left in the open. The answer is dispersal, concealment, and resilience, practiced and exercised daily long before the shooting starts.

A Battle of Britain, Not a High-Tech War in the Air

The operational template NATO must internalize is not Desert Storm, but southern England in the summer of 1940. When the Luftwaffe hammered RAF sector stations across Kent and Sussex - cratering Biggin Hill, Manston, and Kenley - the British survived because of an integrated, highly resilient system.

It was not the Spitfire alone that preserved Britain; it was the Dowding System. Radar stations, visual observers, filter rooms, and telephone lines fused intelligence into an actionable operational picture and directed scarce interceptors to precise intercept vectors. Crucially, the system was distributed and made redundant. When individual nodes went dark, the architecture adapted. Meanwhile, exhausted ground crews patched runways and re-armed aircraft under constant threat of bombardment.

NATO faces an analogous network challenge today. The F-35 is a formidable intelligence-collection platform, but its utility plummets if its Multifunction Advanced Data Link (MADL) cannot pass target tracks to legacy fourth-generation fighters, naval surface combatants, or ground-based air defenses under heavy electronic jamming. If a Combined Air Operations Center (CAOC) is knocked offline, who assumes control of the theater airspace? Without distributed, jam-resistant data architectures and mission command protocols for degraded environments, tactical technological dominance will dissolve into operational paralysis.

Operational Imperatives for NATO Airpower

If NATO intends to build genuine deterrence by denial, member states must balance platform acquisition with systemic survivability across five core areas:

Institutionalize Dispersal and Agile Combat Employment (ACE): Finland and Sweden have long mastered highway-strip operations, rapid turnaround, and camouflage doctrine. These must cease to be High North novelties and become standard operating procedure across all Allied air forces. Peacetime operations must routinely exercise dispersed sortie generation from municipal airports and road networks.
Harden the Perimeter and the Flight Line: Every euro invested in advanced airframes must be matched by funding for base survivability: point-defense against low-altitude UAS, hardened aircraft shelters, mobile arrestor gear, rapid airfield damage repair (RADR) kits, and deep magazines of precision munitions.
Expand Logistics at Strategic Depth: Dispersed operating locations demand rapid logistics and robust aerial refueling capacity. Staging fighters farther from the contact line requires a dramatic expansion of NATO’s multinational tanker fleet and hardened pipeline distribution networks.
Solve the Cross-Domain Data Mesh: Allies must field resilient, low-probability-of-intercept gateways that translate fifth-generation sensor data into common operational pictures accessible to non-stealth assets and ground-based integrated air and missile defense systems. They also need the ability to protect and secure their entire EW spectrum, given the F-35's massive reliance on it.
Re-arm and Re-train the Ground Crew: The maintainer, armorer, and combat engineer are frontline combatants. NATO must equip ground personnel with specialized force-protection capabilities, chemical-biological-radiological-nuclear defense gear, and the cross-training required to generate combat sorties in austere, contested conditions.

The True Cost of Deterrence

Deterrence is not measured by the sophistication of one platform; it is measured by the credible ability to absorb a first strike and generate combat power under fire. Building that credibility requires realistic, high-tempo exercises in harsh weather, degraded communications environments, and austere road bases. It must be under conditions that carry legitimate operational risk and wear on equipment.

Before 1989, this operational friction was the routine cost of doing business in Allied Air Forces Central Europe. The pilots of 1940 earned their place in history, but unheralded mechanics, plotters, and engineers preserved their freedom to fight. As NATO retools for contested collective defense, it must remember that fifth-generation air power is only as resilient as the ground beneath its wheels.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The U.S. Military Has Much to Learn From Ukraine

“What does Ukraine really need? How do we make sure they're delivering what they actually need? And you know, right now those are air defense munitions, it's funding for drones, it's extended range artillery, electronic warfare, etc. And then the other big thing was to try to improve predictability because, you know, Ukraine could only plan operationally, if they knew what they were getting. And so how could we help better inform their planning efforts and their ability to operate together?”

That was just-retired -- on October 1-- Army Lt. Gen. Curtis Buzzard, most recently the former U.S. Commander of Security Assistance Group – Ukraine (SAG–U) and NATO Security Assistance and Training for Ukraine (NSATU), speaking last Wednesday on the Center for Strategic and International Studies (CSIS) streaming podcast, The Last Line of Defense.

Being in charge of both these headquarters, located in Wiesbaden, Germany, Buzzard said he had traveled to Ukraine “some 30 times” over the past two years and was able to “develop close relationships with government officials, with the general staff, with units, and really watch them evolve over this period, visit the unmanned systems force, [and] visit some of these underground command posts.”

As a result, he said, “I think this is the most consequential environment to observe the evolution of warfare right now. And it really gave me firsthand observations about the future of war. It's really an action, reaction, counter-counter-reaction at an incredible pace.”

After Russia’s February 2022 invasion, Ukraine has turned it into “a brutal contest of wills,” Buzzard said, adding, “Who would have imagined they've [the Ukrainians] essentially halted the Russian offenses, and Russia's not accomplished a strategic objective in this war yet. And the Ukrainians have been doing this largely with innovations in unmanned systems, particularly drones.”

Buzzard confirmed reports that Ukrainians “largely have stopped Russian advances and these continued attacks are at great cost to Russia.” He continued, “You know over 30,000 [Russian] casualties a month generally and, from reporting, over 60 percent are fatalities. So this is incredibly lethal and that costs Russia money to recruit and to pay death gratuities.”

But it were the details that Gen. Buzzard went on to describe that made his presentation most interesting.

For example, Buzzard said, “When when anybody wants to talk about employing unmanned systems [in Ukraine]…I'd say the secret sauce is really Delta. It's this mission command system that enables them to be…fast, flat, and accurate [with] over 200,000 users -- on a handheld device like your cell phone or a tablet.”

Developed by Ukraine’s Centre of Innovations of the Ministry of Defense and Aerorozvidka, a prominent Ukrainian civic-tech volunteer NGO and military unit specializing in aerial reconnaissance, Delta is a cloud-based, modular situational awareness and battle management system that gathers and integrates data from diverse sources, and mapping it in real time.

Buzzard said, “I used to carry [a] tablet with layers of intelligence so you can see where the enemy is. You can coordinate missions. You can do targeting on there. You can also see every drone feed, and they've got an app called Vasia which allows you to ingest every drone feed, so you're not having to [deal with], you know, proprietary computers with imagery or whatever.”

Actually, Vasia, according to her Instagram, is the call sign of vasylynanakonechna, a well-known female drone operator and the Deputy Commander of a UAV unit within the Ukrainian Armed Forces called the White Demons. “War is brutal and dangerous,” she has written, “but our goal is simple: risk technology instead of people whenever possible.”

Buzzard last Wednesday continued saying of Delta, it “allows them to fight so fast and rapidly upload BDA. I mean battle damage assessment. Yeah, to rapidly upload what they've just done, and then using that data to better understand what tactical effects they've had on the battlefield.”

Buzzard identified “the guy that's really remarkable doing this” was Major Robert Yosypovych Brovdi , Commander of the Unmanned Systems Forces of Ukraine, “who was a businessman three years ago, a grain trader, art dealer.”

Buzzard went on, “I mean, his [Brovdi’s] underground command posts are kind of a surreal experience because you're watching essentially like a Vegas stream of what effects they're having on the battlefield in terms of destruction of enemy. And then there's this incredible piece of art with a QR code [quick response matrix bar code] on it where I could look up the history of it.”

“You know,” Buzzard said, “they're sitting on the world's best combat data when you think about all the imagery feeds, all the understanding of Russian attacks into Ukraine and what routing speeds -- you know all this stuff. And so there's opportunities to work with them to use this to inform aided target recognition…to support Ukraine first and foremost, but also to learn ourselves. There's a professional responsibility to do that. This data in particular reinforces this idea of a lab, a battle lab that this fight in Ukraine is kind of like the Silicon Valley. I mean, they already had a real knack for technology and innovation.”

I should insert here that Buzzard also said Ukraine drone companies put a QR code on each drone.

“So, if you're out on the front,” he continued, “you get a drone from a company and there's something wrong with the drone, you scan the QR code; it'll go right back to a 24-hour op center of a Ukrainian company; then probably down to a team that's there to help you out; or you may even talk to them right away. And then, if it needs to be adjusted, they're probably changing the production line within 48 hours. So you know how to adjust that rapidly or if the [radio] frequencies change how rapidly they got to change what frequencies are on. So just an incredible amount of innovation [arrives] at a pace that is important and gives you combat advantage quite honestly. And so I got to think about how do we learn from this?”

At one point, Buzzard said, “The number one thing I've learned, and a lot of people would ask, is it technology, you know, drones, is it whatever? It's this velocity of learning that the Ukrainians demonstrate -- from observing, to learning, to adapting. to then fighting it again. This loop, action, reaction, counter-action, is just unbelievable. And I think it equates to combat power. And when you look at a lot of the success they've had on the battlefield, it's due to their own innovation.”

For example, he said the Ukrainians “didn't have enough mid-range strike capabilities, so they invented their own…There weren't enough interceptors to engage [Iranian-designed] shaheds.” These were one-way attack unmanned combat aerial vehicles and loitering munitions and now there are jet-powered shaheds.

Buzzard went on, “So they created their own. They created drone interceptors which actually from a cost standpoint are tremendously cheaper than what it would normally cost,” adding, “And they've really kind of mastered, I would argue, the cost of war -- developed cheap attritable [interceptors] because they haven't had expensive and exquisite. And I think that's an important lesson for us to learn, you know, what's the right balance of that, and how do you layer this capability with some of the very exquisite stuff that that we have also.”

Buzzard also noted, “It's just unbelievable how quick they iterate. As you look at some of the [Ukraine] long-range strike with drones, you know, even over the course of several months, it's a different drone, a different technique…What's used in the latter, you know, an earlier and a later one as you compare these things.”

He also noted “some incredible innovation particularly in the middle, deep-strike [drones], and then they're learning a lot just about how to do this. How do you weave through the electromagnetic signature, the EW [electronic warfare], the air defense; what's the right weapon to target pairing? What's the type of redundant network? How do you dynamically control all kinds of other things that I think would be hugely valuable for us, but again it all comes back to that velocity of learning from unit to industry to government funding.”

Buzzard also talked about some Ukraine counterattacks that have not gotten much public attention in the U.S.

“Right now,” he said, “there's one,Operation Vivaldi, a lot of folks are talking about with [Ukraine’s] Third Army, Gen. [Denys] Prokopenko down at Donetsk had done counterattacks, and Gen. Oleh Apostol, the Airborne Commander down south had done them in Zaporizhzhia.”

Buzzard continued, saying, “They've been taking back terrain too in the midstrike [areas] that's been very effective, about 20-to-30-to-150 kilometers, to help relieve pressure on the front so they've been very effective at striking logistics nodes, command and control, etc., electronic warfare.”

Buzzard also talked of “Ukrainians deep strike into Russia, most of that's with indigenous capabilities and a ton they've learned on just how to execute that. But that's clearly had an impact. Also, most recently, these huge logistics sites, Wildberries.” The latter, Wildberrries,

being Russia's largest online marketplace, and the attacks are part of a Ukraine campaign to disrupt Moscow's wartime economy.

Buzzard concluded, “So collectively I think this all aggregates to be military pressure, economic pressure [on Russia]…You know if I'm inflicting a lot of [Russian] casualties on the front, he's [Putin] potentially losing terrain. His economy is getting worse every day. Ideally at some point would he think that a deal today is better than a deal tomorrow?”

Buzzard went on to speculate, “And I don't know whether that'll actually end up happening or not, but they're [the Ukrainians] certainly in a position that in terms of what they're doing and I think these long-range strikes you're seeing from Russia to Ukraine now are really somewhat of desperation, because they're not achieving anything on the front or very little gains. And so the only thing they [the Russians] can do, and a lot of its impact is due to [shortage in Ukraine of] global supply of air defense interceptors, is [for Putin] to strike into Kiev and make it seem like they're more effective [against Ukraine] than what they really are.”

Buzzard presented a more optimistic view for Ukraine than I see, in part because he has left out President Trump’s recent moves that favor Putin and the Russian side. I don’t believe that either Putin or Trump know what’s going to happen next. Only Ukraine President Volodymyr Zelensky seems to have a set path, and that is to continue defending his country by seeking continuing aid from supportive countries.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The Terms We Must Set

On October 23, Russia's deputy prime minister said three tankers were at sea, that supply contracts were being finalized, and that volumes would rise to 1 million tons in December and could reach 3 million a month. A week earlier, the United States had waived, by executive order, the duties Congress had required to punish Russia's energy customers. Within a week, the waiver became a contract.

Azura's cargo is about 40 minutes of American diesel demand; 3 million tons a month would be a fifth of it, and roughly four times what Russia exported in the third quarter. To deliver that, Russia must repair the refineries Ukraine has spent a year destroying, which Rosneft now says it cannot afford. The contract's first effect is to give Washington an interest in Russian refineries running, even as Ukraine's president says the interceptors it has already paid for "are still not coming."

Diesel is one of four things the arsenal took this autumn from parties it does not control. The second is magnets: China exported 6,165 tons in September, its largest month this year, and they are the magnets in the motors of the drones the new Autonomous Warfare Command is to buy by the hundreds of thousands; Beijing's pause on its licensing rules lapses on November 10, with no notice published. The third is a room: the President said on October 19 that he would meet Vladimir Putin and Xi Jinping in China next month, after the Wall Street Journal reported that Putin had proposed a three-way meeting in Shenzhen to settle the war in Ukraine, without Ukraine. The fourth is money: on October 21, the Treasury sold 20-year bonds at a record 5.469 percent with foreign demand well below its average, and the 10-year fell below 5 percent the next day only because investors fled artificial-intelligence debt for the government's.

The one adversary with nothing to sell was squeezed: a third carrier group was ordered toward Iran on October 21, and Brent settled Friday at $116.72, its highest since April, which raised the price of everything the arsenal buys from the adversaries that do sell.

A sanction is the instrument of the party that sells. This autumn, the United States is the party that needs, and each supplier holds a date on which it can change the terms: October 31, when Russia's own fuel-export ban lapses; November 10 for Beijing's licenses; early November for the Treasury's refunding; November 18 for the summit. In economic warfare, the buyer takes the terms.

I write this from the Cipher Brief's Threat Conference at Sea Island, where General Bryan Fenton and I addressed the question of what the Department of War has to do with economic warfare. The week answered it before we spoke: the Department is now, by available reports, a customer of one adversary's refineries, a buyer of another's magnets, the holder of an ally's interceptors, and the owner of the carriers that set the price of oil. No office weighed those instruments against one another; the suppliers did.

For nine weeks in these pages, I have written about what the United States cannot do, from the army it cannot command to the day it cannot choose, and each piece ended at the same place: a decision no one was assigned to make. The diagnosis is complete, and the series turns here from what we cannot do to what we must. The place to start is the Autonomous Warfare Command: its plan is due on October 30, and it will be the government's largest buyer of the parts this piece is about.

Three things must be in that plan, and none of them is money.

First, the authority to decide. The Secretary's memorandum settles who buys. It has not settled who decides: one command-and-control architecture across every Service and domain, including space; who allocates among theaters when two ask for the same drones on the same day; who overrides at tempo; and whether the answer binds the Services. Congress granted those authorities to Special Operations Command in 1986, with its own budget line and acquisition power. The plan should name the same for this command, and add the paragraph Congress left out in 1986: command and control.

Second, the edge. Ukraine computes on the aircraft; we compute in Virginia and wait, and the Pacific cannot fight on a round trip. The plan must put the computing on the platform and the communications on a layer the force controls, so that no one else sets its speed.

Third, supply before the ban. The command's motors turn on Chinese magnets until American plants deliver, and the Pentagon's own ban takes effect on January 1. A Defense Production Act priority rating and a drawdown from the National Defense Stockpile, issued before November 10, stock what we need before we forbid what we depend on. The same plan is the demand signal industry has asked for: an architecture and a date.

The economic front needs the same discipline before the summit. The diesel contract Moscow is drafting can carry an American sunset and condition, or Moscow's; the choice closes when it is signed. The Shenzhen agenda can be published by Washington before Beijing publishes its own. An office beneath the President must hold those terms once set, because the next price of fuel will argue for changing them. A buyer who does these things is still a buyer, but no longer a price-taker. Set the terms before the supplier does. In this war, the suppliers are the parties we set out to pressure, and they hold the dates

—

Correction: The MT PVT AZURA was carrying liquid fertilizer, not Russian diesel.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The Thirteenth Mile: This Is What Gray Zone War Looks Like

On the morning of October 23, the cargo ship Khoryv sent a distress call 13 nautical miles off Constanța, Romania. Territorial waters end at twelve. Whoever flew the drone that sank her knew where the line was, and chose to stand one mile outside it.

That mile is the story. It is the difference between an attack on a NATO member and an incident in a NATO member's exclusive economic zone. It is the difference between Article 5 and a press release. The London insurance market understood this before most capitals did. When the Joint War Committee extended its Black Sea listed area on September 16, it covered the entire sea except the territorial waters of Bulgaria, Georgia, Romania and Turkey. The underwriters drew the same line the drone operators did. Nobody should find that comforting.

This is what gray zone conflict looks like. Freighters burning off the coasts of two NATO allies, sailors lost in cold water, and attacks clustered around the Sulina Channel, which became the main outlet for Ukrainian grain after Russia hammered Ukraine's own ports. It is war at a time and place of the attacker's choosing, priced just below the point where anyone is obliged to do anything about it.

"The problem is that we cannot prove it"

Bulgaria's prime minister, Rumen Radev, is nobody's idea of a Russia hawk. He told his parliament the logic of the attacks points to Moscow, and then said the quiet part out loud: "The problem is that we cannot prove it."

NATO's response has been built to solve Radev's problem. After the North Atlantic Council met on October 20, the Alliance announced it would send maritime patrol aircraft, radar, drones, intelligence personnel and forensic teams to examine the explosives. A U.S. Navy P-8 Poseidon is already flying the Black Sea. These are sensible deployments. They are also answers to the wrong question.

Play the scenario out. Grant NATO perfect attribution. The forensic teams recover a guidance board with Russian markings. The P-8 tracks a launch back to a known site. The Alliance announces, with high confidence, that the Russian Federation sank the ship. Now make it worse: the next drone hits a tanker alongside the pier at Constanța, the fire spreads, and thousands of civilians are dead.

The Kremlin denies it. Within the hour, Russian state media points at Kyiv, and it doesn't have to work hard to sell the story. Ukraine has been running its own maritime drone campaign since July, so the Black Sea is full of Ukrainian drones, and everyone knows it. A few Western commentators find the denial "plausible enough to warrant caution." Allies invoke Article 4 and consult. Statements are issued. Sanctions, already near their ceiling, are tightened at the margins. Then nothing happens, because every capital in the room is doing the same arithmetic: Russia has nuclear weapons, the Black Sea is not worth a war, and the dead are already dead.

You don't have to imagine that sequence. We ran it on July 17, 2014, when a Buk missile destroyed Malaysia Airlines Flight 17 over eastern Ukraine and killed everyone aboard. A Dutch-led investigation established in 2016 that the launcher had been delivered from Russia, and by 2018 that it came from a Russian army unit. The ICAO Council found Russia responsible in May 2025. The European Court of Human Rights did the same that July. Moscow denied all of it, spent years promoting theories that blamed Ukraine, and in 2022 invaded the country the missile had been fired over. Attribution was as good as attribution gets. The consequence, eleven years later, was an order to enter into good-faith negotiations on reparations.

That is the lesson Moscow took from MH17, and it is the one we refuse to learn. Deniability is not a shield for the attacker. It is a gift to the defender who would rather not act. Russia doesn't need us to believe its denials. It only needs us to want to.

Operational freedom is the target

The point of these strikes isn't the ships. It's the water around them. Every hull that burns off Sulina raises the premium on the next one, pushes a charterer toward a different route, and teaches a shipowner that a NATO coastline offers no protection. The attacker never has to declare a blockade. The market imposes it for him. Freedom of action shrinks by increments, each too small to justify a response, until the defender wakes up to find that the sea he was sure he controlled has a new landlord.

This is how Russia and China will impose costs on the West for the foreseeable future. Not with the decisive battle our doctrine, our budgets, and our military exercises are built around, but with a steady accumulation of incidents chosen for their deniability, timed to our distractions, and calibrated to our fear of escalation. Salami slicing is not a new idea; Beijing has practiced it in the South China Sea for more than a decade. What's new is the drone, which makes the slicing cheap, precise and anonymous.

The honest complication

The Black Sea gray zone is not one-sided, and pretending otherwise hands Moscow its talking points. Ukraine's Operation Molochka, launched in July, claims to have disabled 300 Russian-linked vessels in the Black and Azov Seas. Turkey's foreign minister says both sides are mounting heavy attacks to establish superiority before winter.

The distinction holds. Ukraine is striking the logistics of the country that invaded it, mostly sanctioned tankers serving Russian ports and occupied Crimea. Russia is striking grain ships in the economic zones of two NATO members that are not party to the war, with the apparent aim of making Ukraine's last reliable export route uninsurable. One is a belligerent waging war at sea. The other is exporting that war to the Alliance's doorstep and daring it to notice.

Taiwan won't look like Hellscape

If you want to know what a Taiwan conflict will look like, watch the Black Sea.

In 2024, Adm. Samuel Paparo said he wanted to "turn the Taiwan Strait into an unmanned hellscape" to defeat what he described as Beijing's likely plan: a massive attack with little warning. It's a sound concept, and the CNAS work that fleshed it out this year is serious. Hellscape is built to break an amphibious assault at the water's edge.

Beijing is rehearsing something else. The PLA's Justice Mission 2025 drills in December, run alongside the China Coast Guard, simulated a blockade of Taiwan's main ports and control of the waterways that carry its energy imports. This year the China Coast Guard and Maritime Safety Administration have run what the Jamestown Foundation calls a "quasi-quarantine" east of the island, creating the appearance of administrative control without declaring a blockade. Taiwan has already prosecuted a Chinese captain for severing an undersea cable. Each step is a law enforcement action, an inspection, an accident. None of them is an invasion.

A drone swarm waiting in the Strait for a landing force has nothing to shoot at when the adversary is a coast guard cutter boarding a container ship for a "safety inspection." The first Taiwanese or American drone to fire makes Taipei the aggressor. So Beijing won't cross the Strait. It will tighten the noose: a quarantine, a severed cable, an insurance listing, a shipping line that quietly decides Kaohsiung isn't worth the premium. It will bank on the world's risk aversion. It’s already working. After the May summit in Beijing, Washington paused a record $14 billion arms package for Taiwan, and the President described those sales as a "very good negotiating chip". Taiwan will not be conquered. It will be persuaded, one closed option at a time, that there is nothing left to defend.

Answering below the threshold

You cannot deter gray zone coercion with a capability designed for the war the adversary is careful never to start. The answer has to live in the same band the attacker does: below the threshold of general war, above the threshold of pain. Three steps would help in the Black Sea, and each has a Pacific twin.

Presence that denies, not presence that watches. Turkey, Romania and Bulgaria already run a Mine Countermeasures Task Group whose mandate was widened in July to cover undersea infrastructure. Montreux restricts warships of non-Black Sea states, not the littoral navies. Widen the mandate once more, to counter-drone escort of merchant traffic through allied economic zones, and buy the equipment from the Ukrainians who have kept their own grain corridor open under fire. In the Pacific, the equivalent is a convoy and escort plan for a quarantine, not only a kill chain for an invasion.

Decide the response before the incident. The moment of decision is where risk aversion wins, because it is always easier to wait for one more forensic report. Allies should agree in advance, and say publicly, what a verified strike on shipping in their waters will cost Moscow: a pre-approved tranche of capability released to Ukraine, a pre-agreed number of shadow fleet hulls detained. Attribution should trigger an equivalent consequence, not another discussion. Taipei and Washington need the same menu for a quarantine, written now, while no one is under pressure.

Take the market off the adversary's side. When insurers and charterers do the attacker's work, governments need a sovereign war-risk backstop for vessels trading to allied ports, so the next listed-area extension doesn't function as a blockade by spreadsheet. Taiwan will need that backstop on the first day of a quarantine, not the ninetieth.

None of this is escalation. It is the minimum required to make the gray zone cost something.

The Thirteenth Mile

The Khoryv went down one mile outside a line we drew. The adversary picked the mile. Next time it will pick the hour, the cargo, the flag and the ocean. The question for the Alliance isn't whether we can prove who did it. It's whether, once we prove it, we will do anything.

———

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The Intelligence Community’s Missing Discipline

Economic statecraft has become a primary instrument of US national security, deployed with a frequency and ambition that outpaces the intelligence architecture built to support it. For sanctions, tariffs, investment screening, export controls, and development finance to succeed, the United States must fully leverage the data and intelligence available to it. Now is the time for the IC to organize itself around the discipline of economic and financial intelligence.

The IC has long struggled to prove its value to economic customers: the Secretaries of Treasury, Commerce, Defense, and State, as well as the US Trade Representative and financial regulators. One frequent explanation is the IC’s historic orientation toward military and diplomatic support. Another is the perception that classified economic analysis lacks distinctive value. I spent most of a twenty-three-year intelligence career inside the economic discipline, ultimately leading Treasury’s Office of Intelligence and Analysis (OIA). While this may once have been true, the IC is doing better than ever to meet growing demand.

The problem is no longer the quality of the analysis—which has matured immensely—but the IC’s decentralized approach to serving its economic customers. No IC agency is specifically responsible for the discipline of economic and financial intelligence. The closest is OIA.

Congress created OIA in statute in 2004 with an eye toward sanctions support and countering terrorism finance. Its role has since expanded across economic, financial, and cyber issues for customers across government and industry. However, OIA is not the designated IC lead for US economic statecraft—no IC agency is. One consequence is that the Office of the Director of National Intelligence (ODNI) remains the statutory lead for analytic support to the Treasury-led Committee on Foreign Investment in the United States (CFIUS). That made sense in 2007, when the Foreign Investment and National Security Act codified CFIUS and assigned the Director of National Intelligence that role. At the time, OIA was in its infancy and consumed by counterterrorism. That is no longer the case.

The instinct in Washington is to solve a challenge like this by first creating a new organization, then fixing the functions. Congress should start with the functions instead, then address where the discipline sits. To improve IC support to economic statecraft, Congress must first act on six fronts.

Designate a functional manager. One IC element must own economic and financial intelligence as a discipline: collection priorities, analytic standards, a hiring and training pipeline, and a framework for systematic engagement with allies and industry. Nothing about that role requires a new agency.

Clarify authorities. Explicitly authorize collaboration between the designated lead and both its government customers and the private sector, including exchange of expertise and data.

Supercharge private sector engagement. Many of the best national security solutions in economics and finance will come from industry. Create a permanent path for its ideas, expertise, and capabilities.

Work with what exists. Use OIA as the foundation and keep the number of IC agencies flat, but cap its size so it stays nimble as economic statecraft evolves.

Revisit ODNI’s CFIUS role. IC support to CFIUS sits with ODNI because in 2007 no one else could carry it. Whether it should move depends on where the discipline lands, but Congress should not view the 2007 answer as permanent.

Fund it as a national mission. Economic intelligence should not have to compete for a share of a domestic department’s topline. Give the discipline a dedicated budget line, with the investment in people and AI that exploiting economic data at scale requires.

That leaves where the discipline sits—and there are three answers, not one.

The easiest first step is a designation: name OIA the functional manager, leave it in Treasury, and make clear in statute and to policy customers that OIA is the center of gravity for economic and financial intelligence. That is available now and beats the status quo. Nevertheless, an IC office answering to the Secretary of the Treasury will always be seen—correctly—as Treasury’s first. This is why Commerce and others periodically press for shops of their own, an outcome that grows the IC rather than optimizing it.

The achievable reform is bureau status. Treasury did this with FinCEN in 2002, and FinCEN is now treated as a government-wide and international resource rather than Treasury’s alone. Done properly it means a separate appropriation, a director accountable to both the Secretary and the DNI, and a statutory mission naming service to the whole government, the private sector, and our allies.

The stretch option is to elevate OIA to become an independent National Geo-Economic Intelligence Agency—still my own preference, because only independence settles the question of whose intelligence office it is. But where the discipline sits is the last decision, not the first. Under any of the three, the proximity OIA has built with Treasury policymakers is a design problem with a known solution: dedicated, co-located teams at each major customer department.

Economic intelligence is a core national security capability and should be organized and resourced like one: purpose-built to track, anticipate, and disrupt adversary financial and commercial threats in real time. The playbook has changed. Our competitors are more agile, emboldened, and shaping markets and supply chains to their advantage while we debate whether the threat qualifies as strategic.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

We’re Losing the Cognitive Space Race

Over the last century, modern medicine achieved a historic feat. We increased the human lifespan by 33%. But at the same time, we completely failed to defend our brain healthspan. Today, a silent gap of 15 to 30 years exists between the time our bodies survive and the time our brains remain vibrant, innovative, and fully functional. It is a terrifying paradox. Medical science has advanced so much that a newborn today can realistically expect to live to 100, if not 120 years old. Yet, we passively accept that their cognitive engine will begin an irreversible, downhill slide in their thirties with the likelihood of dementia reaching almost 100% by the age of 110. What good is an extra three decades of biological existence if our brains lack the strength and resilience to enjoy it? This is no longer just a localized healthcare crisis; it is an imminent national security threat to our competitive edge.

Look at where our national focus and funding are directed. America is focused on investing billions of dollars into artificial intelligence and hypersonic defense systems. However, we are systematically ignoring the ultimate computing engine that builds the technology, commands our military, drives our economy, and stabilizes our communities: the human brain.

Our global competitors are not making this mistake. Most notably, China understands that future geopolitical dominance will not be won simply by hoarding raw technology. It will be won by the cognitive longevity, relentless innovation, and emotional resilience of their population. They are playing the long game and investing in their brain economy; We are falling behind.

In the military, we use a concept called staying "left of boom." It means executing proactive, aggressive conditioning and preventative strategies to stop a catastrophe before it happens, rather than digging through the wreckage after an explosion.

Right now, America’s approach to brain health is reactive. Our public policy treats brain aging as an inevitable, downhill slide into deficit. We pour billions of dollars into solving brain health collapse, like dementia and visible cognitive breakdown, before we actively intervene. But that approach is a losing strategy. We must shift from a reactive, disease-focused model to a proactive era of precision brain health in order to finally maximize American brainpower. If we do not actively optimize our collective intelligence and mental endurance, we will fall behind not only in defense readiness but also in scientific advancement and workforce productivity.

Fortunately, building a sharper, more resilient nation has never been easier or more measurable.

A landmark, three-year longitudinal study of 4,000 adults recently published in Nature Portfolio’s Scientific Reports completely dismantles the myth of inevitable cognitive decline. The data proves that the human brain possesses a no-ceiling capability. From ages 19 to 94, the brain retains a profound capacity to continually rewire, adapt, and improve its performance over time.

The key to unlocking this potential is a newly validated, multidimensional metric called the BrainHealth Index. For the first time, we can treat the brain exactly like physical fitness. We don't guess if our hearts are healthy; we measure blood pressure. The BrainHealth Index finally gives us a credible benchmark to track and measure holistic brain improvement across three critical pillars:

Clarity: Our raw capacity to solve complex, novel problems and drive deep technological innovation.
Connectedness: Our capacity for social purpose and communication, which serves as the bedrock for stable families and strong communities.
Emotional Balance: The mental resilience required to perform under extreme pressure, from corporate boardrooms to tactical defense environments.

When we actively invest in and train our cognitive micro-skills, the positive implications ripple across society. Every day, citizens become better in their personal relationships, more productive at their jobs, and significantly more resilient against modern burnout and life stressors. Scaled nationally, this collective mental fitness becomes the invisible armor required for our national defense and technological endurance.

As a neurologist, a retired U.S. Army Colonel, and the former founding director of DARPA’s Biological Technologies Office, I have spent my entire career protecting and restoring the brains of our service members. I know what the human mind is capable of achieving when it is pushed to optimize, rather than just manage decline.

Our federal agencies, including the Department of Health and Human Services, the NIH, and the Department of Veterans Affairs, must immediately work to adopt scalable, digital health initiatives that democratize these brain optimization tools nationwide. But executive action is only half the battle. Congress must step up and introduce a unified, bipartisan National Brain Capital Act. Just as lawmakers realized we could not secure our future without a CHIPS and Science Act to defend our artificial intelligence hardware, they must recognize that we cannot protect our nation without a legislative framework to maximize our human brainpower. We must empower every single citizen with the self-agency to improve their own cognitive capacity. It is time for Congress to stop treating brain performance as a passive medical luxury for the few. It is a national imperative to keep America leading the world.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Russia Never Left the International Financial System. It Built a Way Back In.

A7’s OpenAI prompt was six words long: "Translate [name] to [language]. Answer only translated text."

Developer code leaked in 2025 from A7—the Kremlin-linked payment network designated by Treasury on October 1 as “a significant transnational criminal organization”—shows A7 used this prompt with OpenAI's API to create fake invoices, fake stamps, and a complex ledger that made Russian procurement look like ordinary trade.

Our investigative work, as featured originally in the “Big Shor” investigation and in subsequently featured in the New York Times and Financial Times, reveals that between January 2025 and June 2026, A7 laundered over $80 billion through the international financial system and continues to do so today. Zach was the principal researcher and Dawson peer reviewed the report and mentored the research team.

The common story is that sanctions cut Russia off from SWIFT and dollar clearing. In reality, Russia never left the Western financial system; A7 is how it re-entered at state scale. It still needs dollars and euros to buy components, sell oil, and pay intermediaries; China’s CIPS, yuan, crypto, and barter cannot replace them.

How the scheme works

A7 acts for Promsvyazbank, the state bank serving Russia's defense sector. A7 has laundered over $80 billion through roughly 435 financial institutions in at least 83 countries, funding Russia’s war in Ukraine, intelligence operations, election interference, and trade. Its clients have included Iranian oil sellers, which is why Treasury rolled the designation into Operation Economic Outcast.

A7’s shell companies, often run from Russia over VPNs, open accounts at local banks in Bishkek or Dubai’s free trade zones. Those banks rely on larger regional banks, which clear dollars through correspondents in New York or Hong Kong. Each sees only the customer in front of it. Card programs issued under sponsor banks give front companies and Russians access to payment rails without a direct banking relationship.

Fundamental to the scheme were fake invoices, produced at scale using OpenAI’s ChatGPT. A7 also used ChatGPT to forge stamps and automate intake of SWIFT payment confirmations from scanned receipts. Because A7 broke the operation into steps that each looked legitimate, OpenAI’s screening was unlikely to flag it—a gap AI companies must close.

This is where the burden falls on banks, and where the anti-money laundering (AML) framework fails. It was built to catch criminals hiding proceeds, not a state-backed service with intelligence-grade tradecraft. A7’s disposable shell companies are replaced faster than any sanctions list can be updated. To Western correspondent banks, its flows look like normal bilateral trade.

Banks can catch A7 only by tracking behavior over time: new free-zone trading companies moving outsized volumes, product descriptions that do not match the counterparty, and payment routes with no commercial logic. However, banks can only go so far on their own.

The deeper problem is permissive jurisdictions—UAE free zones, Hong Kong, Kyrgyzstan, and Türkiye—that offer fast incorporation, light ownership checks, and access to dollars and euros. Intermediating Russian trade is profitable, and many of these governments frame it as “neutrality” rather than evasion. In Kyrgyzstan, A7 relied on relationships reaching the highest levels of government and the banking sector.

The Macro Threat: Sanctions, SWIFT, and China

As former U.S. Treasury and intelligence officials, we see A7 as a sobering reminder that the first wave of financial sanctions on Russia fell short. The international banking system remains the indispensable engine of Russia’s war effort.

This exposes a broader geopolitical failure: adversary coordination. Russia, Iran, the DPRK, and China increasingly share intermediaries and methods to exploit Western finance rather than build their own. Yet the allied response remains fragmented, targeting networks like A7 one at a time.

This forces hard choices about dollar access. Washington could strip correspondent access from the Chinese and regional banks moving billions for U.S. adversaries. That might disrupt A7, but it raises the question of whether weaponizing dollar access compels compliance or accelerates Beijing and Moscow's push for a closed-loop financial system.

Changing the Equation: Government Actions

Allied governments must close systemic loopholes. Diplomacy with third countries has largely run its course; the leverage now lies in their banks’ access to Western finance. Tools like FinCEN’s Section 311 can force regional banks to choose between servicing networks like A7 and keeping their Western correspondent accounts. Regulators must treat nested correspondent relationships (banks clearing payments for other banks’ customers) and sponsored credit card programs (cards issued by smaller banks and fintechs under a bank’s license) as direct compliance liabilities.

Exams that test only static list-screening teach banks to build to that baseline. Exams should require network analysis, and governments should help scale these costly tools for vulnerable institutions in developing countries. This must be paired with mandatory information sharing: secure channels for client exit data and real-time international exchange of typologies.

Finally, authorities must treat AI and cloud infrastructure with the same scrutiny as traditional finance. Finalizing know-your-customer rules for cloud providers and requiring AI companies to flag behavioral anomalies would deny illicit actors the cheap infrastructure they need to scale.

A7 still moves billions every month. A week after Treasury acted, A7 announced a stablecoin USDT-SWIFT product; the timing was not a coincidence. Even if A7 is degraded, its model is highly portable, and Iran and North Korea are watching. The question for Washington, London, and Brussels is whether they can help industry disrupt these networks through a compliance culture that prioritizes real impact over list-based box-checking.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Turkey Has Outsourced Its Censorship to American Companies

Earlier this month, Sky News correspondent Alex Crawford got a notice from X: her account was being blocked in Turkey. She asked the Turkish presidency why and has yet to get an answer. She isn’t the only one.

Crawford is one of at least 1,270 accounts Turkish courts ordered X to block in September. X made roughly 90% of them unavailable in Turkey, according to the Freedom of Expression Association. Weeks before X began blocking these accounts in Turkey, Elon Musk declared that “any censorship required by governments is now clearly visible.”

While American social media platforms show clear outrage when they are banned in other countries, they rarely show the same outrage when Turkey silences its citizens online. These bans and blocks disproportionately hit marginalized communities, particularly those who rely on these platforms to organize, share information, and make their experiences visible. These restrictions reduce the visibility of minority perspectives and encourage self-censorship among LGBTQ+ people, activists, and independent journalists. A democracy depends on people being able to access information, express their views, and participate in public debate. When certain communities are systematically pushed out of these spaces, their experiences and perspectives become less visible in the broader political conversation.

The Crackdown Behind the Blocks

Since the failed 2016 coup attempt in Turkey, the government has steadily expanded its control over the information environment, including by targeting journalists, media organizations, and political opponents who criticize the government. According to Reporters Without Borders (RSF), roughly 90% of Turkey’s traditional media is currently under government control. As a result, many journalists have turned to YouTube and social media to reach audiences independently of traditional outlets. These platforms, however, have also become subject to government pressure, including licensing requirements, arrest threats, and content restrictions.

The scale of these restrictions was particularly visible following the arrest of Istanbul Mayor Ekrem İmamoğlu. Between March 19 and April 12, 2025, X blocked access in Turkey to at least 471 accounts with a combined 17.2 million followers. The affected accounts ranged from journalists with more than 1.2 million followers to grassroots organizations with fewer than ten. At least 22 of the blocked accounts belonged to women’s rights organizations, including the We Will Stop Femicides Platform, which had approximately 181,000 followers. The breadth of the restrictions suggests that online censorship in Turkey has affected not only prominent journalists but also smaller civil-society and activist organizations.

Similar restrictions were reported in September 2026 during the government’s “My Family Is Safe” operation targeting LGBTQ+ organizations. On September 13, access to 32 X accounts—many belonging to university LGBTQ+ groups—was blocked in Turkey. Three days later, an Istanbul court ordered access restrictions on another 419 accounts over allegations that they had shared “obscene content.” The accounts reportedly included journalists, activists, media organizations, and women’s rights groups. The restrictions also affected the accounts of Evrensel newspaper, Amnesty International Turkey, and the Media and Law Studies Association (MLSA). Moreover, the website and social media accounts of the news organization T24 were blocked over content authorities characterized as “LGBT propaganda.”

When American Platforms Do Ankara’s Work

The role of social media companies is particularly significant because many of these restrictions depend on platforms complying with requests from Turkish authorities. Transparency reports show high compliance with government requests: TikTok (91.8%), X (85.66%), Instagram (79.15%), Google (77.5%), and Facebook (42%). These rates illustrate that restrictions on online speech do not result solely from direct government censorship. When platforms carry out blocking orders without challenge, government censorship reaches the spaces where journalists and activists work independently. The result is a chilling effect: people who have not been blocked censor themselves, and citizens lose access to information they need to take part in public life.

X says it challenges the orders in court and that refusing risks throttling the entire platform in Turkey. But when a court ordered İmamoglu’s campaign account blocked in August, X implemented the block while contesting it. The damage also reaches Americans: the accounts blocked include U.S.-based @Gayety and @Pride.

The hypocrisy is hard to miss. X has long portrayed itself as a defender of free speech, and American officials and tech executives have spent years warning about foreign censorship. Yet when a NATO ally demands that dissidents be erased, American companies behave like compliance departments.

The Silence After the Block

The impact of censorship extends beyond the accounts that are formally blocked. It can also affect people who remain free to post but choose not to do so. Journalists, activists, academics, and ordinary users may engage in self-censorship because they fear arrest, legal consequences, harassment, or repercussions for people associated with them. Self-censorship occurs when individuals possess information or opinions they would otherwise share but deliberately withhold them because they perceive a risk in speaking publicly. In this sense, censorship can operate indirectly: the possibility of punishment may be enough to silence speech even when no account has been formally restricted.

However, this self-censorship has consequences. Activists in Turkey use online platforms to raise awareness about violence, sexual assault, and killings targeting marginalized groups. For communities whose perspectives receive limited attention in traditional media, social media can provide an important space to document abuse, organize campaigns, and reach audiences both inside and outside the country. Yet while people continue to rely on these platforms for information, they must also navigate the risks associated with speaking publicly online.

This creates a broader chilling effect on public discussion. When websites are blocked or activists are arrested, others may become less willing to publish, share, or amplify information about marginalized communities. The result is not simply the removal of individual accounts or pieces of content; it can also reduce the amount of information available to the public about abuses affecting vulnerable groups. For communities that depend on outside attention and advocacy, these restrictions may also make it more difficult to reach international audiences and build cross-border support.

Online censorship in Turkey is expanding, and it falls especially hard on marginalized groups. Turkey still holds elections, but democracy depends on more than voting: when journalists, activists and opposition figures are blocked from the platforms where public debate happens, the choice voters make is less informed and less free. Those platforms are American, and so is a share of the responsibility.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Technology Is Outrunning the Way We Fight

The United States is racing to field AI and autonomous systems. It is not racing to figure out how to fight with them. This imbalance between technology and concepts is widening a gap the U.S. is ill prepared to close. Ukraine has shown us why this gap is a threat: every new capability breeds a countermeasure, and technological advantage now spoils in months. The answer is not just faster innovation. It is making concept development a continuous military function, one that ties new technology to experimentation, validation, and adoption at the speed the fight demands. Not just a function of schoolhouses and Headquarters.

Russia’s full-scale invasion of Ukraine began in 2022 as a war of armored columns and maneuver. Today, trenches and minefields stretch for hundreds of miles, reminiscent of World War I; while drones, unmanned ground vehicles, precision munitions, and persistent surveillance hunt anything that moves.

The United States has poured considerable energy into buying and fielding new technologies faster, and has shown how we are endeavoring to learn from Ukraine. But the U.S. has put far less energy into the institutional processes we need to determine how we fight as technology and adversary behavior changes. This creates a consequential gap between what we build and how we fight.

This growing gap has two parts. The first is substance: technology and concepts need each other. A concept that ignores new technology will overlook new operational possibilities, while a new technology without a concept is a demonstration… not a warfighting capability.

The second is tempo: technology moves in weeks and months, while the processes that decide how formations should use it operate in years. Our fastest-ever concept cycle, from counterinsurgency doctrine to the Iraq Surge, took eighteen months. Most move slower still: gradual, methodical, and caked in decades of calcified bureaucracy.

The problem isn’t just that doctrine changes more slowly than technology. Units in combat adapt fast. The greater challenge is translating those adaptations into concepts that can be tested, refined, integrated into combined-arms operations, and adopted across the force.

That doesn’t mean rewriting concepts every time a new drone appears. It means recognizing when a change in technology (or in the enemy) breaks assumptions behind how we fight, then testing and spreading the fix before it goes stale.

Concept development must become a continuous military function, not a periodic publication. The winner won’t be the side that buys technology fastest, but the side that turns it into battlefield advantage before the enemy adapts. Today, the U.S. is not built to do that quickly.

Ukraine: Adaptation as Necessity

Ukraine illustrates the increasingly reciprocal nature of battlefield adaptation. To date, every advantage has invited an answer. Both sides have changed their technology and tactics again and again in response to each other, and neither has held an edge for long.

Consider the first-person-view (FPV) drone. Cheap, attritable, and easy to build, FPVs turned every squad into a precision strike force. Electronic jamming became its counterpoint. Fiber-optic drones, immune to jamming, then entered the field. Each move created new openings and new limits, and forced changes in both the technology and how it was used.

The operational consequences extend well beyond FPV drones. Persistent surveillance paired with cheap precision strike has changed where and how formations can move, mass, resupply, and survive. Concealment, dispersion, and deception matter more than ever. A unit that concentrates in a location, moves in the open, or runs a predictable supply route becomes a target.

This is the more consequential lesson from Ukraine: a technological innovation may initially improve the effectiveness of a particular weapon or unit, but its broader significance emerges when it changes the conditions under which formations operate. Then the enemy adapts, and the cycle starts again. And again.

In Ukraine, technological advantage is perishable. The hard part isn’t fielding new capabilities. It’s recognizing when they, or the enemy’s countermeasures, demand a different way of fighting.

The American Challenge: From Innovation to Institutional Learning

For the United States, Ukraine demonstrates why concept development cannot remain an episodic activity conducted in schoolhouses and periodically revisited. The lesson is not that Ukrainian solutions are universally applicable. It’s that new technology and countermeasures can break operational assumptions faster than our institutions are built to respond.

The United States cannot just replicate Ukraine’s approach. U.S. forces fight expeditionary campaigns, integrate across joint and coalition formations, and answer to policy, legal, and safety requirements that a nation like Ukraine, fighting for its survival and territorial integrity, does not. The goal is Ukraine’s capacity to adapt, built to American requirements.

Our gap isn’t a shortage of experiments or innovation offices; efforts like the Army’s “Transformation in Contact” are putting new capabilities into units and learning from them. Our gap is having a pathway from what one unit learns, to what the whole force learns. A concept that works in one brigade may fail against a different enemy, in different terrain, or at a higher echelon. And a successful experiment rarely changes training, force design, or acquisition on its own.

Autonomy has raised the stakes and made our pathway to institutional learning an even greater necessity. A software update, a retrained model, or a new way of employing a system can change how technology behaves, and can quietly invalidate the conditions under which it was tested and fielded.

That is the problem assured autonomy is meant to solve. Assured autonomy is justified confidence that an autonomous system will do what it is supposed to do. It must therefore account for the whole relationship: the technology, how it is employed, and the environment it operates in. Continuous, evidence-based assessments can tell commanders when a change requires fresh evaluation and where the boundaries of responsible use lie. Built into the adaptation process, assurance can support speed without abandoning safety, reliability, accountability, or established approval authorities.

Building an Adaptive Concept-Development Enterprise

The United States needs a repeatable process that links new technology, operational concepts, experimentation against a thinking enemy, validation, and adoption across the force.

We are suggesting neither a prototype nor a concept paper. It’s a validated, revisable concept of employment, backed by operational evidence: how a formation can fight differently, under what conditions that works, and what it takes to make it happen. Four functions are needed to get us there:

First, connect concept and technology development directly to operational formations.

Operators, technologists, testers, and concept developers should work alongside commanders. Their job goes beyond improving systems or inventing tactics: they should identify which operational assumptions a new capability breaks, and draft concepts to test.

Not every improvement demands a new concept. A better jammer may only need a new tactic; a capability that changes how a brigade moves, masses, or resupplies demands a new way of fighting. The force needs people close enough to the fight to tell the difference.

In Ukraine, operational units have designated innovation officers liaising directly with industry; industry partners provide prototypes, receive feedback on battlefield experimentation and adaptation. Through this relationship, operators, technologists, and testers converge on a specific requirement, and battalion-level Commanders have the authority to acquire the necessary prototypes to integrate into their formations.

Second, establish a persistent cycle of adversarial operational experimentation.

The question isn’t whether the technology works as designed. It’s whether the formation using it accomplishes the mission better against an opponent who adapts. Experiments should also find where a concept fails: what works against one threat may fail against another, and a promising system may impose unacceptable costs elsewhere in the formation.

Combat training centers, experimentation units, and operational formations already provide the foundation. The task is to link them into a persistent learning loop, fed by operational evidence and intelligence.

Ukraine offers a cautionary tale. For nearly three years, intelligence indicated Russia was developing jet-powered Shahed variants, by most accounts ample time to prepare countermeasures. But when Russia began launching these faster one-way attack systems, Ukraine had too few interceptors capable of that speed, and their previous interception tactics were insufficient to stop them. The warning did not sufficiently feed a cycle of experimentation before the threat was fielded. That gap cost lives.

Third, connect operational validation to adaptive fielding.

Today, a system is typically tested, approved, and fielded as a finished product. But in a fight like Ukraine’s, nothing stays finished: software is updated, models are retrained, and units find new ways to employ what they have. Each change can quietly invalidate the evidence behind the original fielding decision. Adaptive fielding treats validation as continuous, asking what has changed and whether the earlier evidence still holds.

For autonomous systems, this is where assured autonomy matters most, and where scrutiny should match the modification. A minor software patch for a drone flying the same mission in the same conditions may need only a quick check. Retraining its targeting model, sending it into a new environment, or reducing human supervision demands full re-evaluation. This doesn’t bypass approval authorities or testing requirements. It gives them a faster, evidence-based way to decide when more evaluation is needed.

Fourth, institutionalize validated concepts across the force.

This is the decisive step. Experimentation produces evidence; learning happens only when that evidence changes how the force trains, organizes, equips, and fights.

A counter-drone tactic proven in one division should appear in the next combat training center rotation, the next force design update, and the next acquisition…not in an after-action report on a shelf.

This change requires a defined pathway and clear authorities. Commanders, testers, capability developers, and acquisition officials each own different decisions, but those decisions must draw on a common body of operational evidence, with clear decision points for when the evidence is strong enough to act. The result is a continuous cycle: develop, experiment, validate, field, learn, institutionalize, adapt. Then repeat, as the technology and the enemy change.

In Ukraine, Aerorozvidka, a non-governmental organization, plays this role: not a think tank but an empowered change agent -- capturing evidence from the field and shepherding it through commanders, technologists, and acquisition officials until new tech is deployed or new concepts (like deep strike) are fielded.

Operational Advantage Depends on the Capacity to Learn

The United States possesses substantial technological, industrial, and innovative capacity to compete in AI and autonomous warfare. But technological leadership alone will not produce operational advantage. Adapting a system isn’t the same as adapting a force, and a better-performing unit doesn’t change the course of a campaign.

Four questions will dictate our capacity to learn: The technical question is what a system can do. The tactical question is how formations should employ it. The operational question is how it changes the way maneuver, fires, intelligence, protection, sustainment, and command combine to win. The strategic question is whether the institution can answer all three, again and again, faster than the enemy.

The race isn’t to build the best autonomous systems or to field them first. It’s to turn technological change into operational advantage, faster than the enemy can take it away. In the age of AI and autonomy, the force that learns fastest wins.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Hybrid Threats: Why Awareness Must Transcend Individual Cyberattacks

Every October, Cybersecurity Awareness Month puts practical security measures in the spotlight. Can an employee recognize a phishing email? Will someone pause before clicking a suspicious link? Are passwords and access credentials being protected? These are important questions; individual behaviors are crucial to maintaining cybersecurity.

But awareness is so laser focused on preventing and mitigating the malicious cyberattack, it’s easy to lose sight of the bigger picture: the cyberattack in front of you may be only one piece of the threat.

In the era of hybrid threats, a cyberattack could be part of a broader campaign in which digital activity intersects with cognitive warfare, sabotage, unusual drone activity, disruptions to communications and navigation systems, and much more. State and state-linked networks might use online fraud or scams to generate revenue for operations, launder funds and undermine confidence in financial and/or government institutions.

The challenge for security and law enforcement agencies transcends detecting and responding to one cyber incident at a time. They must also determine whether events that appear separate may be connected.

That distinction changes what it means to be aware, and the urgency is intensifying. Recent research and reporting shows Russian cyber activity directed at European targets is likely intended to enable intelligence collection, operational reach and long-term access rather than immediate disruption. In parallel, the Iranian government is believed to be relying on a longstanding hybrid warfare model combining cyber operations, asymmetric military operations, information warfare, proxy attacks and coercive state activity, with AI increasingly acting as a force multiplier.

Expect to see more of this going forward, not less.

CONNECTING THE DOTS

Consider the signals individually: a government agency experiences a cyberattack. Unusual drone activity is reported over critical infrastructure. GPS service is disrupted. False or misleading information is deliberately spread. Viewed on their own, these events may have different causes, and each can appear to be a separate incident.

Yet hybrid campaigns often depend on individual activities initially looking ambiguous or unrelated. If each signal is treated only as a self-contained incident, relevant connections may be missed – and when the connections are missed, so is the broader pattern they could form.

This does not make traditional cybersecurity awareness less important. It makes awareness more demanding. The familiar focus on individual judgment must be matched by institutional awareness: the ability of government agencies, armed forces, critical infrastructure operators, and other relevant organizations to recognize which signals may matter beyond the immediate event.

That begins before advanced analysis enters the picture. An organization cannot share information it did not capture, and it cannot capture information it did not recognize as potentially relevant. The first requirement is therefore a common understanding of what may be security-relevant and what information is needed to contribute to a broader situational picture.

This shift is central to the awareness challenge. A suspicious link has a clear place in the traditional conversation. A weak signal in a hybrid environment may not have the same clarity. Its significance may emerge only when it is considered alongside other information. Awareness, in this context, means looking beyond the apparent boundaries of a single incident without assuming that any one event tells the entire story.

The sequence matters: recognize, capture, share, assess. If a potentially relevant signal drops out at any stage, it cannot inform the larger picture. If it moves through that sequence, it becomes one piece of information that can be examined in relation to others.

The next task is to bring those fragmented pieces together. Threat intelligence, decision intelligence and artificial intelligence can help teams work across large volumes of data, correlate information, reveal connections, and alert analysts to anomalies. Their value is especially clear when no single signal is decisive. Several weak and seemingly unrelated signals may form a pattern that supports a more informed assessment of the security situation.

The point is not simply to accumulate more data. It is to make relevant information usable as part of a coherent view. A list of isolated incidents still leaves decision-makers looking at fragments. A situational picture asks a different set of questions: What may connect these events? What does the combined pattern suggest? Which developments deserve closer attention? And what might happen next?

That last question is essential. The goal is not limited to identifying a cyberattack or another security-relevant event after it occurs. It is to understand the relationships among relevant signals well enough to identify potential future developments at an early stage. Detection remains necessary, but detection without connection can leave the larger threat out of view.

For Cybersecurity Awareness Month, this broader perspective offers a useful way to expand the conversation. At the individual level, awareness still means recognizing the suspicious email, protecting credentials, avoiding scams and frauds and thinking before clicking. At the national level, it also means making sure the right organizations know what to notice, what to record, what to share, and how to place that information in context.

The difference is one of scale. An individual may be watching for a malicious link. Government agencies, armed forces, critical infrastructure operators, and other relevant organizations must also be watching for relationships among cyber activity, disinformation, sabotage, drone activity and communications interference.

That is the blind spot Cybersecurity Awareness Month should help bring into focus. There’s more to awareness than paying attention before clicking a link. Awareness means we know which signals deserve attention, whether we can bring them together, and whether we can see the threat they may form before the pattern becomes unmistakable.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

America's Counter-Drone Authority Is Real, The Capacity Isn't Yet

Here is a number worth sitting with: federal teams seized roughly 700 drones around World Cup venues this summer. Seven hundred — at one tournament, in one season, with the best-resourced counter-drone units in the world on the field. That figure is a success story and a warning in the same breath: the threat volume is enormous, and the federal government cannot be the only team suiting up for it.

Until this year, it legally had to be. The power to disable a hostile drone belonged to a short list of federal agencies, which left a state trooper at a stadium gate or a corrections captain watching an aircraft hover over his yard with nothing but binoculars and a report form. Congress ended that with the SAFER SKIES Act in December's defense bill, and the DHS-Justice framework implementing it has been in force since July 1: state, local, tribal, and territorial police and corrections agencies that complete federal training and certification, on approved equipment, can now track a threatening drone and — against a credible threat — take it out of the sky above major venues, critical infrastructure, and prisons.

And in the past week, Washington has shown it means to deliver. The Justice Department announced that the FBI's counter-drone training center in Huntsville will double its capacity. DHS's Science and Technology Directorate put commercial counter-drone systems through operational testing alongside state and local officers. The Pentagon selected four directed-energy systems for a homeland counter-drone pilot. This is what implementation momentum looks like, and the departments deserve real credit for it.

Now the hard truth: doubling a small number produces a small number. The Huntsville center's first class, last fall, held twelve officers, and it remains the only place in America where a state or local officer can earn the legal right to bring down a drone. More than 18,500 agencies are now eligible for these authorities. Against that denominator, even a doubled schoolhouse leaves the vast majority of American communities exactly where they were — watching — while the Super Bowl arrives in four months and the Los Angeles Olympics in under two years. Our prisons cannot wait either: drone incidents at federal correctional facilities rose twentyfold in six years, and state systems from South Carolina to Georgia are logging airborne contraband runs by the hundreds.

What turns momentum into coverage is money, sustained past the current news cycle. Congress should fund training at the scale of the authority it created: regional and satellite course delivery so a deputy in Phoenix is not waiting on a classroom seat in Alabama, instructor pipelines that multiply the schoolhouse instead of merely enlarging it, and a certification target tied to the event calendar that oversight committees actually track. Just as important, the FEMA counter-UAS grant program — $500 million across 2026 and 2027, built around the World Cup — should not sunset with the tournament that inspired it. The threat is not leaving when the fans do.

Governors have their own homework, and fewer excuses than ever: the grant rules push at least 97 percent of awarded funds down to local and tribal agencies within 45 days. The money is designed to reach the street. States should name a lead agency, compete for those dollars this cycle, and put their corrections systems and stadium districts first in line for certified teams.

Over more than twenty years in federal homeland security — the last of them leading U.S. Immigration and Customs Enforcement — I watched threats outrun statutes again and again. This time the statute arrived first, and this past week proved the executive branch intends to use it. The remaining question belongs to Congress and fifty governors: whether a nation that just confiscated 700 drones at a single sporting event will fund protection for everyone else. Authority without capacity is a promise. Appropriations are how promises get kept.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The U.S. Army’s Pacific Strategy Depends on Allies

“We never fight alone. We've never done that. You can go all the way back to the days of Revolutionary War. The United States has never gone into conflict on its own. We've always built coalitions. We've always involved partners and allies. And we'll continue to do so going forward.”

That was Gen. Ronald P. Clark, Commanding General, U.S. Army Pacific Command, speaking last Tuesday at a contemporary military forum, Decisive Landpower -- Deterrence and Partner Integration Against the Pacing Threat, as part of the 2026 Association of the United States Army (AUSA) Conference in Washington, D.C.

On the panel with Clark was Army Gen. Xavier T. Brunson, Commander, United Nations Command, U.S. Forces Korea, and Tara Murphy Dougherty, Chief Executive Officer of Air, a leading AI software firm that specializes in national security readiness.

The two Army generals spent a good deal of their time talking about lessons learned from Ukraine and the benefits to the U.S. of allies – specifically in the Pacific. That struck me as something to further explore, since one day later, on Wednesday, President Trump continued his running criticism of allies with an October 14, Truth Social screed.

Trump said in part: “Because of the fact that we have had such Military Success, we no longer ‘need,’ or desire, the NATO Countries’ assistance — WE NEVER DID! Likewise, Japan, Australia, or South Korea. In fact, speaking as President of the United States of America, by far the Most Powerful Country Anywhere in the World, WE DO NOT NEED THE HELP OF ANYONE! Thank you for your attention to this matter. President DONALD J. TRUMP.”

On the other hand, Gen. Brunson had told the AUSA audience one day earlier, “Everything that we do is intricately woven around the ROK (Republic of Korea)-U.S. alliance. That alliance has stood for some 75 years and it is an example or a paragon, if you will, of all that's right when folk work in alliance together. The problems that we solve are joint problems. They're not just U.S. problems. They're not just Republic of Korea problems. What they are is great opportunities for two nations to work in concert with one another in order to arrive at solutions that are beneficial for both countries.”

Gen. Clark explained further, “So our ability to be able to work with partners and allies on their sovereign soil, to be able to share procedures that we build through [military] exercises over the course of a year, some joint, some army-to-army, but always integrated with our partners. It gives us the opportunity to have our systems work technically, to have our procedures nested, and to get to know one another in a way that allows us to build the trust that's necessary in training. Because if we wait until crisis or conflict, it's too late to ask the question, can I trust

you? But because we've been working together, because we've exercised at scale, because we're modernizing our forces alongside one another, it works.”

Clark added, “We've really worked hard at building those relationships at scale inside of the land forces. We have a land forces dialogue that meets multiple times a year -- chiefs of army of Australia, Japan, the Philippines, and the U.S. We've invited the ROKs in, we've invited India in, and it continues to grow. So those relationships built army-to-army are what allows us to really integrate across interoperability, and integrate it really across our formations and with our partners in all.”

Brunson described how he and Korean Gen. Kim Sung-min, Deputy Commander of the U.S.-ROK Combined Forces Command, discussed training differently “taking advantage of the knowledge that we have of the threats that exist or that prevail in the Ukraine fight.”

Brunson said, “We talk about how we would operate in a distributed fashion…Just imagine if we trained across the entirety of the [Korean] Peninsula and got ourselves in a shape where we would say you can't utilize the things that you've learned in the fight in the battlefield in Ukraine on us, because we learned the same lessons and we've distributed ourselves in such a way that we don't make ourselves the target. We won't be moored in place.”

Clark talked about Russia, North Korea and China “learning from watching us partner, but the partnerships that our adversaries have built are transactional versus the transformational relationships that we build as a security partner of choice globally…for us it's really transformational relationships that we look to cultivate with partners and allies over time.”

Brunson described how the North Koreans, fighting for the Russians in Ukraine were “able to test systems there…and then bring that back home. So, in one aspect, they've shortened their RDT&E cycle.” He also pointed out, “The fact that you have a combat trained force with recent

combat on the [Korean] Peninsula for the first time since 1953..[and] are now bringing those lessons learned back into their own training cycle, it's shortened their time to develop them.”

Clark said that U.S. forces had also learned from Ukraine about the need for mobility and camouflage, which he described as “age-old army forgotten sciences of how to hide in plain sight and how to camouflage ourselves from observation...Our ability to be able to use electronic warfare, to be able to use just good, old-fashioned camouflage and the ability to deceive our adversary is a must. In those two theaters [Ukraine and Iran] it's not a near-peer adversary that we would be working against -- whereas, in our theater [the Pacific] it absolutely is.”

For Clark, the questions were: “How do we fight, you know, Type One, Type Two UAS [unmanned aerial system, drones]; how do we think through ballistic missile defense holistically in the region. We spend a lot of time working again with the joint force for solutions associated with that. How do we maneuver?”

Brunson raised a new issue by pointing out that, “Our old system was something [a weapons system] breaks, we send it all the way back CONUS [Continental U.S.] in order to fix it so we can then bring it all the way back out again.” That used to take 29 days by ship.

However, he added, “In the ally that we have in Korea we have a an absolutely premier industrial base, if you look at the Korea defense industry, some of the kit that we're producing right now sits along our friends, allies and partners.” Brunson said, “The Army’s new infantry squad vehicle (ISV), for example, is produced by GM Defense and GM Defense is also in the Republic of Korea.”

“So the idea of a regional sustainment hub would simply be…to bring those means of production to the theater,” Brunson suggested, noting, “In the maritime domain, when we look at maintenance, repair, and overhaul, which is being done forward alongside the Koreans, you know that 15 percent of global ship building is done in Korea. And, oh by the way, we've got an ally with a mutual defense treaty in Japan that has 10% of global ship building. And if we take these cases forward, we're able to stay in theater longer.”

The answer, Brunson said, “We've got to try to achieve admirable endurance in theater by partnering alongside our allies, seeing the things that they can do better than we can right now at distance and then keeping them right where they belong. That keeps our [military] forces forward.”

Dougherty chipped in saying: “Tens of millions of dollars saved by simply identifying things like unfilled requisitions or parts that are obsolete that can be replaced with something not obsolete and also less expensive. I think that this is it. This is part of how you generate lethality. You get readiness to pay for itself, because otherwise sustainment is too expensive when it has to be done for the entirety of the joint force all the way on the other side of the world.”

At one point, Clark said, “The secret sauce for us as an Army is our Non-Commissioned Officer (NCO) corps, reflecting Defense Secretary Pete Hegseth’s September 30 speech praising the same group.

Clark noted that both he and Brunson were sons of NCOs, and that “with the assistance of our senior non-commissioned officers, senior enlisted leaders across the [PACOM] region have embarked upon conducting assessments with our partners and developing strategies to help them build their NCO development programs inside of their formations.”

To illustrate his point, Clark said his units had just finished an assessment in Cambodia of its army and the Commander, Gen. Mao Sophan, “basically said, ‘Hey, whatever you're asking us to do, we're going to do it because we want to get to a level of proficiency with our Non-Commissioned Officer core that we see in yours.’"

I must point out that during the one-hour-and-thirty-minute session neither General -- Clark nor Brunson -- came near to mentioning President Trump’s repeated critical views about U.S. allies.

The closest anyone came was Dougherty, who at one point said diplomatically, “We'll head into midterm elections here [in the U.S.] in November, obviously as you know, and I think we expect some variation in the political dynamic in the United States, and our allies and partners all navigate their own political changes as well.”

She then added, “If you look over the course of history, however, at least modern history, certainly the United States has invested in those partnerships. And today, we still are -- maybe with a different flavor or a different attitude. And that's not really for me to say. I'm simply observing. But we haven't lost sight of the importance of allies and partners to securing U.S. national interests.”

I would bet Clark and Brunson – along with most U.S. military professionals – would silently agree with her statement.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The Hidden Risks of AI-Powered Intelligence

Picture an intelligent analyst's screen. Data about troop movements, a port closure, a terrorist attack, or a weapons transfer sits at the center of a clean interface, with a confidence indicator glowing green. Two hundred outlets are carrying it, and the platform has counted every one. It looks like a corroboration. In many cases, it is a single Telegram post, copied, translated, summarized, and republished until its origin disappeared behind its own echo.

Nobody must be negligent for this to happen. It is what you get when a product or platform is built to measure volume and the user is tempted to read volume as truth.

I say this as someone who works with open-source material and believes in it. Commercial imagery, ship-tracking data, procurement records, leaked databases, and social media have changed what is knowable about conflicts and illicit networks; but the market that has grown up around these sources is selling something different from the discipline that makes them valuable, and governments and companies are buying it without noticing the difference.

A Crowded Market and a Thin Product

Open-source intelligence platforms are multiplying quickly. Walk through the company stands at any security conference and you will find dozens of them, each promising to fuse, monitor, and surface threats across the open internet, now almost always with an AI layer that summarizes, ranks, and alerts.

Strip away the interface and most of them offer little that a competent analyst couldn't already do with a search engine, a handful of specialist tools, and some patience. Reverse image searching, scraping social platforms, pulling corporate registry data, and geolocating an image are all learnable skills, and many of the best practitioners picked them up in public, often as volunteers. What the platforms add is convenience and scale, which is genuinely useful, but convenience is not analysis. The real product, in most cases, is the dashboard.

Dashboards are persuasive by design. They squeeze a messy information environment into something that looks like a picture of the world, with counts, trend lines, heat maps, and sentiment scores. Each of those findings implies that someone has already done the hard work of deciding what matters and what is true. Usually, no one has. The system has counted things, and counting is the easy part.

Counting Sources Is Not Testing Them

The core flaw is in what these systems reward. They tend to measure the number of sources behind a claim, not the independence of those sources. The two are very different things.

Independence is the foundation of corroboration. Two witnesses who saw an event separately make a claim stronger. Two witnesses who heard about it from the same third person do not. The same logic applies to reporting. A claim that traces back to a single channel but appears in two hundred outlets has one source and two hundred echoes.

Intelligence tradecraft has a name for this: circular reporting. It is among the oldest and best-documented ways analysts go wrong. The failures that most damaged the credibility of Western intelligence in the past generation involved, among other things, uncorroborated claims that were repeated, cross-referenced, and eventually treated as established because they seemed to come from many places. The lesson drawn at the time was that provenance matters more than prevalence. An aggregator that treats prevalence as confirmation is rebuilding the vulnerability that analysts spent years learning to guard against.

AI makes this problem fourfold. First, language models summarize and synthesize, and in doing so they take away the provenance trail that an analyst needs. A fluent paragraph that blends fifteen sources does not tell you that twelve of them are derivative. Second, the cost of generating plausible content has collapsed. Fabricated articles, cloned news sites, and coordinated amplification networks can now create the appearance of breadth cheaply, which is exactly the signal these platforms are built to count. Third, as more web content is produced or recycled by automated systems, the pool that analytics tools draw from becomes more self-referential. The echo chamber is increasingly populated by machines quoting each other. Lastly, AI can make uncertainty harder to see. Language models are designed to produce coherent answers, not to preserve the ambiguity of the evidence on which those answers are based. Contradictory sources can be reconciled into a smooth narrative, gaps can disappear beneath plausible inference, and tentative conclusions can acquire the tone of established fact. The danger is therefore not simply that an analyst receives false information, but that the uncertainty surrounding otherwise legitimate information becomes less visible.

None of this means the technology is useless. Entity extraction, translation, deduplication, and pattern detection across large data sets are real contributions. But the same tools that can help trace a claim to its origin are too often deployed to certify it instead.

Information Is Not Intelligence

The deeper problem is what happens after the dashboard produces its output. Companies market it as intelligence, and buyers, including government agencies, intelligence firms, financial institutions, and corporate security teams, purchase it as intelligence, then act on it.

However, open-source material is raw information. It becomes intelligence only after a process that no interface can fully automate. Someone has to establish where the material came from, grade how reliable the source has been, assess how credible the specific claim is, and test it against other collection. Established standards exist for this. Grading systems that rate source reliability separately from information credibility have been used for decades, and analytic standards require analysts to describe the quality and credibility of their sources, to distinguish between underlying evidence and judgment, and to account for alternative explanations. These are not bureaucratic formalities. They are the mechanism by which an organization knows how much weight a conclusion can bear.

When that step is skipped, the result is aggregated internet content with a confident interface. The output reads like a finished product, but the epistemic work behind it is missing, and the person reading it often can't see that. A decisionmaker shown a green indicator does not know whether it reflects three independent confirmations or one rumor with good distribution.

The consequences are practical. A government that bases sanctions designations, force posture, or diplomatic messaging on an unverified claim risks embarrassment at best and escalation at worst. A company that reroutes shipments or exits a market because a risk platform flagged a rumor can lose real money; and an agency that comes to rely on commercial feeds may quietly stop investing in the capabilities that would let it check them.

What Should Change

I would offer the following two principles.

One, to treat provenance and independence as essential to intelligence. Open-source material should be treated as a cue and a corroborator, not a conclusion. Open sources are at their best when they point collection in a useful direction or when they test and strengthen what other sources have suggested. A satellite image that shows construction at a site tells analysts where to look and what to ask. A procurement database entry might confirm a pattern already suspected. Neither is a finding on its own. The workflow should run from open-source lead to targeted collection to assessment, not from dashboard alert to briefing slide. As AI makes it easier to summarize, reproduce and generate information, analysts need to know not only what a source says, but where the information originated and whether apparently separate sources are actually independent. A fluent paragraph that blends fifteen sources does not tell an analyst that twelve of them are derivative. Likewise, a cluster of articles, websites or database entries may create the appearance of broad corroboration while ultimately tracing back to a single underlying claim. Platforms should therefore preserve provenance wherever possible and make the distinction between original reporting, derivative content and AI-generated material visible to the user. The workflow should run from open-source lead to targeted collection to assessment, not from dashboard alert to briefing slide.

Two, protect human assessment and the collection that supports it. AI can make uncertainty harder to see. Language models are designed to produce coherent answers, not to preserve the ambiguity of the evidence on which those answers are based. Contradictory sources can be reconciled into a smooth narrative, gaps can disappear beneath plausible inference, and tentative conclusions can acquire the tone of established fact. Human analysts therefore need both the time and the authority to question what automated systems produce rather than simply validate it. That also means protecting the collection capabilities that AI cannot replace. As open-source material becomes more abundant, the value of what cannot be found online rises. Human sources, financial intelligence, law enforcement access and legal process take years to cultivate and moments to lose. A budget cycle that trims them in favor of subscriptions is trading durable capability for a license that expires. The objective should not be to remove automation from intelligence work, but to ensure that automation remains subordinate to collection, verification and human judgment.

What Open Sources Cannot Close

I learned the limits of open-source work firsthand while researching foreign components in Russian strike drones. Open sources got me a long way. Recovered wreckage data, teardown imagery, part markings, and manufacturer documentation could establish what was inside these systems and who made it. That is valuable, and it was achievable by skilled analysts working in public.

But the questions that mattered most were different. Who actually bought a given part? Through which intermediaries did it move? Who paid for it, and through which accounts? Those gaps could not be closed by any amount of scraping. They required the tools that sit behind a legal threshold or inside a trusted relationship: law enforcement access to shipping and customs records, financial intelligence on transactions, and human sources with knowledge of how the networks operate. A dashboard could tell us a component existed. Only that other collection could tell us how it got there and who was responsible, which is the information policymakers need if they want to disrupt the supply chain rather than simply describe it.

That experience shaped how I think about the current issue. Open sources and closed collection are not competitors. The first made the second more efficient, because it let investigators ask better questions. The second made the first more meaningful, because it turned an interesting observation into an attributable finding. Treating either as a substitute for the other would have left us with a weaker product.

Defending the Analytical Craft

None of this is an argument against open-source intelligence. It is an argument for it, properly understood.

The practitioners who built the field's reputation, whether in newsrooms, nonprofits, academia, or government, are rigorous precisely because they distrust easy answers. They document their methods, show their chains of evidence, and say so when something can't be confirmed. That culture is the real asset. It is also what the commercial market is most at risk of undermining, because rigor is slow and expensive to sell, while a dashboard can be demoed in ten minutes.

The test I would offer any buyer, policymaker, or analyst is simple. When you are shown a claim, ask where it began, who else has independent knowledge of it, and what other collection could confirm or contradict it. If the system in front of you cannot answer those questions, it hasn't given you intelligence. It has given you a well-organized rumor.

The volume of open information will keep growing, and the tools to process it will keep improving. The scarce resource will not be data. It will be judgment, along with the access and tradecraft that make judgment possible. Agencies and firms that remember that, and invest accordingly, will see more clearly than those who confuse a full screen with a full picture.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

What a Russian Hybrid Attack Might Look Like

Russia has demonstrated a growing willingness to use hybrid tactics – including sabotage, cyberattacks, information operations, and the use of deniable or “throwaway” agents – to create disruption and uncertainty across Europe. This paper examines how those tactics could be combined in a hypothetical Russian operation against Estonia designed not to defeat NATO militarily, but to create a crisis that tests the Alliance’s ability to respond quickly and collectively.

The scenario is deliberately constructed as a red-team exercise rather than a prediction. It envisions Russia exploiting the existence of Estonia’s Russian-speaking population, infiltrating operatives into the Schengen Area through legitimate visa channels, allowing those operatives to move through the largely borderless Schengen zone, and exploiting gaps in European immigration enforcement. The scenario culminates in a deliberately ambiguous armed crisis in Narva, accompanied by cyberattacks and a coordinated information campaign intended to complicate attribution and slow NATO decision-making.

The exercise identified several vulnerabilities. Some elements of the scenario are highly speculative, particularly Russian operatives' ability to obtain weapons once inside Estonia. Other elements, however, reflect existing conditions: Estonia’s large Russian-speaking population, the continued issuance of Schengen visas to Russian nationals, the decentralized nature of internal immigration enforcement, and the absence of a clearly identifiable EU-level capability dedicated to systematically analyzing the EES overstayer population for emerging national-security threats.

The paper therefore recommends three measures: continued EU-wide efforts to disrupt organized criminal networks that could provide support to hostile actors; eliminating tourist visas for Russian nationals except in limited humanitarian circumstances while developing a forward-deployed EU visa-security capability; and establishing a national-security immigration coordination center capable of analyzing immigration data against emerging threats and coordinating responses among Member States.

The central conclusion is that NATO’s military deterrence remains essential, but military strength alone cannot close every avenue through which a sophisticated hybrid operation could develop. Preventing such a crisis requires identifying and closing the less visible vulnerabilities that could allow hostile actors to establish themselves inside Europe before a crisis begins.

I. Introduction

Drones at Leipzig Airport. Drone incursions of NATO airspace. Throwaway agents. Arson and sabotage at facilities throughout Europe. 2026 has been a busy year, and it appears that Russia is engaged in an ongoing hybrid campaign on the European continent. The EU says that Russia’s goal is to spread fear, distrust, and undermine European unity. Additionally, just this Sunday, September 20, European security officials raised alarm that Russia is testing NATO resolve and could potentially even attempt a limited incursion into NATO territory.

This paper takes the current situation and threat picture as a starting baseline and imagines a scenario in which Russia creates a strategic crisis in Estonia, a NATO member, to discredit NATO collective defense and distract from the war in Ukraine by creating a sort of second front for NATO. In working through this thought exercise, the article examines what Russia could gain from escalation, how it might carry it out, and what security gaps the scenario identifies. Like with any hypothetical scenario, I suspect some will wholeheartedly disagree with my assertions. Still, I ask you to think of this as a red teaming exercise designed to identify vulnerabilities, and not an effort at forecasting.

II. Why might Putin want to escalate?

The “special military operation” that was supposed to take Kyiv in 6 days is going on for four years. Russia is not making significant gains on the battlefield, and whatever small gains it makes come at a prohibitive cost. The Center for Strategic and International Studies estimates that, since the full-scale invasion in 2022, Russia has suffered 450,000 dead and 1.4 million battlefield casualties. Moreover, Russian control of Ukrainian territory actually shrank in the Spring of 2026. The situation is so unfavorable that the Russian MoD now resorts to outright fabrication to claim battlefield gains that have not occurred.

Ukraine, on the other hand, seems to have stabilized its position after 4 years of war. It is becoming ever more adept at using drone technology and can finally bring the war home to Russia. Ukrainian long-range drones are now striking infrastructure deep inside Russia every week, including Russian oil refineries. This matters because Russian oil is the last remaining cash cow keeping the Russian economy afloat. And even though official Russian government numbers purport to show economic stability, a June report from the Kiel Institute for the World Economy concludes that “the Russian economy is showing clear signs of structural exhaustion.” Meanwhile, European support for Ukraine is strong across the continent, at least among mainstream political parties. On September 17, the EU Commission disbursed 3.3 billion euros to Ukraine – part of the 90-billion-euro Ukraine support loan. So in this war that increasingly looks like a war of attrition, it is Ukraine, and not Russia, that appears to be coming out on top.

In my assessment, these factors are gradually painting Putin into a corner, where he is slowly running out of options and may be forced to “flip the script.” In theory, one option Putin always has is a genuine move towards peace on fair terms, which should at minimum include a complete withdrawal of Russian forces from Ukraine. But he is stuck in a trap of his own making. If he relents on his maximalist demands and opts for fair peace, the entire very expensive and painful 4-year war would appear to have been fought for naught. That might very well threaten his political, or even personal, survival in a cutthroat political system. So, he is not willing to make peace. And sticking to business as usual looks like an eventual dead end as well.

In my imagined scenario, Putin invents a third option and chooses to escalate by launching a proxy military operation in Estonia. The operation has several goals. First, it aims to create a crisis NATO must solve on alliance territory, competing with NATO support for Ukraine. NATO would have to decide how to react to the crisis, and balance the reaction with the risk of escalation and full-blown war with Russia. Thus, as a second goal, Putin might succeed in discrediting Article 5 provisions of the defensive alliance if NATO’s response were to be slow or ineffective. Third, a military operation on NATO territory could force NATO partners to focus on their own defense rather than continuing to support Ukraine.

At first glance, this scenario may seem implausible or even reckless. After all, we have been almost conditioned to see NATO and Article 5 collective defense as an ironclad guarantee. This is one reason why countries that were formerly part of the Warsaw Pact flocked to NATO in the 1990s. But we also need to keep in mind that the concept of collective defense has not been routinely tested. Article 5 was invoked only one time – in the aftermath of the September 11 attacks against the United States. NATO has never dealt with a situation where an opponent seeks to test NATO boundaries by mapping out red lines, which I believe is exactly what Russia is doing. In other words, NATO has not yet been fully tested in hybrid war.

III. What might Putin assume about NATO?

We have discussed how the West views NATO. But what might Putin assume about the alliance, especially NATO’s willingness to go to war?

NATO is focused on defense and may prefer to avoid war. First, NATO explicitly describes itself as a defensive alliance and identifies preventing conflict and war as a core purpose of its deterrence and defense strategy. Putin could reasonably assume that NATO governments strongly prefer to resolve a confrontation without escalating it into a direct war with Russia. This does not mean NATO would fail to respond to an attack; rather, it creates a potential vulnerability that Russia could exploit by presenting NATO with an ambiguous crisis in which the costs of escalation are apparent, but the attribution of Russian responsibility remains contested.

NATO may be slow to act. An armed NATO response requires deliberation and consensus among alliance members. Article 5 obligations are triggered in instances of an armed attack, and determining whether an action is an armed attack is addressed on a case-by-case basis. NATO’s own materials note that “events that lack an international element, such as purely domestic acts of terrorism, do not trigger Article.” In Putin’s view, he could see case-by-case deliberations as a vulnerability and conclude that a deliberately vague scenario would make it difficult for the alliance to reach consensus quickly, keeping the window of action open for Russia.

Information operations may complicate consensus. NATO is a collective alliance of democracies, and democratic governments depend to some degree on public support and political legitimacy. In Putin’s assessment of the political situation, he may conclude that Moscow does not need to persuade NATO governments that Russia is innocent. It may only need to create enough confusion and debate within NATO populations to make decisive action more politically difficult. Russia has both the tools and demonstrated experience to flood the information environment with contradictory narratives. The U.S. State Department has documented Russian use of multiple, sometimes contradictory narratives specifically to generate confusion and discourage responses. NATO likewise describes hostile information operations as activities designed to “create confusion, deepen divisions, destabilize societies and ultimately weaken the Alliance,” and notes that such operations are not always intended to persuade audiences of a particular falsehood; they can instead be designed to muddy the information environment and make it more difficult to distinguish fact from fiction.

From Moscow’s perspective, the objective therefore need not be to achieve consensus around a pro-Russian narrative. It may be sufficient to prevent consensus around a coordinated response. If a crisis involving Estonia produced competing narratives about what happened, who was responsible, and whether Russia was directly involved, political divisions within individual NATO member states could complicate the Alliance’s response and make consensus harder to achieve.

Nuclear intimidation may complicate consensus. Putin may believe that nuclear signaling can amplify Western caution. Russia has repeatedly used explicit and implicit nuclear threats during the war in Ukraine. Evidence suggests these threats can have effects beyond traditional military deterrence, including a Chatham House assessment that Russian nuclear threats contributed to Western concerns about escalation and constrained some governments' willingness to provide Ukraine with certain forms of military support. This does not mean that Western populations will automatically oppose confrontation with Russia. Public attitudes toward nuclear deterrence have, in some cases, become more supportive since Russia's invasion of Ukraine. Rather, the point is that nuclear signaling adds an extra political cost to any decision to escalate a confrontation with Moscow. A Russian leadership that believes Western governments are highly sensitive to the prospect of nuclear escalation may therefore conclude that even an ambiguous or limited confrontation could be accompanied by nuclear rhetoric designed to encourage caution, delay, or disagreement within the Alliance.

Taken together, these assumptions suggest that what may appear from NATO’s perspective to be an irrational and extraordinarily risky decision—deliberately creating a crisis on NATO territory—could look considerably more rational from Moscow. Russia would not necessarily need to believe that NATO would stand aside. It would need to believe that NATO’s preference to avoid war, consensus-based decision-making, democratic political constraints, vulnerability to information manipulation, and sensitivity to nuclear escalation could create enough hesitation and disagreement to complicate a unified response. In this model, the objective would not necessarily be to defeat NATO militarily. It would be to create a crisis in which NATO’s overwhelming military advantage becomes difficult to translate into timely, unified political action. If Moscow believed such a crisis could fracture Alliance cohesion, force NATO to divert attention and resources from Ukraine, or show that Article 5 could be challenged without producing an immediate, unified response, the potential payoff might outweigh the risks in the Kremlin’s calculus.

IV. Free Narva – a Baltic hybrid war scenario

With the analysis of the previous sections in mind, I constructed a scenario in which Russia executes a deliberately ambiguous and confusing operation designed to threaten Estonia’s territorial integrity and test NATO’s resolve. In developing the scenario, I considered Russia’s potential objectives, lessons from previous Russian operations, the defensive measures Estonia and NATO have already adopted, and how Moscow might circumvent or exploit those defenses. This paper discusses the vulnerabilities identified through this process in a later section.

Phase 1 – Propaganda and throwaway agents

In October 2026, with the September Duma elections behind him and a comfortable supermajority win for his United Russia party, Putin decides to launch Operation “Narva Spring.” Analysts and think tanks pick up on increased messaging about the so-called “People’s Republic of Narva.” This is an entirely fictitious concept created by Russian intelligence, with a flag, notional borders, and a capital in Narva, a city of about 50,000 residents, 97% of whom are Russian speakers. The online narratives shared on Telegram, TikTok, and other platforms are the usual assortment of Kremlin grievance narratives about marginalized Russian minorities. Ongoing Estonian reforms that aim to make Estonian the official language of education in the country are weaponized and portrayed as “linguistic genocide” against Russian speakers.

The online propaganda campaign is amplified by Kremlin-controlled trolls and shared with pro-Russian Western influencers and political factions who decry Estonian government abuses of the Russian-speaking population. With the propaganda campaign at a fever pitch, the Kremlin is ready to escalate physically. But Russia cannot simply repeat the Crimea or Donbas scenario against Estonia. The Estonian border is one of the most heavily monitored frontiers in the world, where NATO has implemented a “deterrence by denial” strategy. This doctrine holds that defensive measures are so formidable the enemy sees an operation as too costly to attempt. Infiltrating several hundred “little green men” into Narva from Russia just across the river, while maintaining deniability, is not plausible. The Estonian side of the border is teeming with sensors.

But the Russians have been practicing another gray zone tactic recently – the use of “throwaway agents.” So, the Kremlin uses its network of low-level recruits to spray graffiti, place posters and stickers with QR codes, and eventually commit acts of arson and sabotage against local infrastructure and public property – and especially anything linked to law enforcement, security agencies and the courts. The goal is to create the appearance of local resistance against Estonian authority, while staying well beneath the threshold of armed conflict. But propaganda, graffiti, arson, and low-level sabotage are not the intensity of crisis the Kremlin needs. At this point, Russia needs to use specialists trained in fomenting armed violence on the ground.

Phase 2 – Infiltration

In 2014, Igor Strelkov emerged as the face of the armed separatist movement in Donbas, providing Moscow with something enormously valuable: an apparent local actor around whom an armed conflict could coalesce. To bring the Estonia situation from a nuisance to a crisis for NATO, Moscow needs people trained in violence, and a few Strelkov types to direct them. But how to bring them in? Estonia hasn’t allowed free travel for Russian citizens since 2022, and applications for entry for the few exceptions are closely scrutinized.

So, the Kremlin probes for weaknesses in the Schengen zone, and it finds these in Italy, France and Spain. In 2025, France, Italy and Spain collectively issued more than 441,000 Schengen visas to Russian nationals, while more than 477,000 Russian nationals received tourist visas across the entire Schengen zone. The refusal rate for Schengen visas for Russian nationals in 2025 was a mere 6.4%. The Schengen creates an interesting counterintelligence problem for Europe. Once a person has legitimately crossed the EU's external border, Europe's internal geography largely disappears.

In this scenario, Russia begins to infiltrate intelligence and military specialists from units like GRU’s Unit 29155 and the 390th Special Purpose Reconnaissance Point into the Schengen area starting in June 2026, before the launch of the Narva propaganda campaign and increased tensions. Even with the extra scrutiny for Russian visa applicants and shorter admission periods, the Russian operatives obtain tourist visas, enter Italy, and move with ease through Austria, Slovakia, Poland, Lithuania and Latvia via the excellent European train network and private commercial bus services. Once in Estonia, the operatives blend into the large Russian-speaking population and make their way to Narva. In total, just under a hundred Russian operatives follow this and other routes into Estonia over the summer months, and go to ground in the Narva region, supported by a tiny group of local sympathizers and a network of throwaway agents.

Even once the tourist visas of the Russian operatives expire, and they become illegal immigrants within the EU, nothing causes the system to blink red in reaction to this. In a way, no centralized, integrated system focuses specifically on immigration, so no lights blink red. Unlike the United States, Europe does not have an EU-wide interior immigration enforcement agency, and it currently lacks a central entity to monitor immigration violations against emerging national security risks, although that gap has been acknowledged. In terms of what exists today, in 2026, the EU rolled out the Entry/Exit System (EES), which captures biometrics from non-EU nationals entering the EU on short stays. So, in theory, the EES captures the biometrics of the Russian operatives in our scenario. And once their period of admission to the EU ends, typically at 90 days, the operatives are added to the EES “overstayer” list. But at present, unless the overstayer is also matched to additional alerts in the Schengen Information System – an EU-wide law enforcement database – no specific actions are automatically triggered, and law enforcement is not alerted.

Any interior immigration enforcement beyond this point is the responsibility of law enforcement within individual EU member states. If one of the operatives has the bad luck of being stopped by police and this results in a document check, the EES hit would likely show, and he would be detained. But the EES list is not proactively pushed to law enforcement for action. It is simply available to query. And importantly, EES is managed by eu-LISA – the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice – which is an agency focused on IT systems management and not law enforcement or security. In other words, no analysts are scouring the EES list for a sudden uptick in Russian nationals of military age being added to the overstayer list. Unless they attract attention to themselves, no one is coming for the Russian operatives. And in a city with a 97% Russian-speaking population, they don’t attract attention. Meanwhile, they quietly get to work acquiring small arms and mapping out critical infrastructure, communications, and defense and law enforcement sites.

Phase 3 – Estonian Donbas

By the end of 2026, the ground is set to initiate a crisis in earnest, in a way that gets NATO’s full attention. On January 2, 2027, a Saturday, Estonians are still recovering from the raucous New Year’s Eve celebrations. At 0700, Estonia's Information System Authority (RIA) Operations Center in Tallinn begins receiving simultaneous alerts indicating disruptions across government and critical infrastructure networks from unattributed sources. Analysts and incident handlers track the situation as key government and private-sector websites become unreachable due to denial-of-service attacks. Physical equipment begins to act erratically as unknown actors hack industrial control systems. Rail networks are disrupted. Traffic lights rapidly cycle in bizarre patterns. A few urban areas across Estonia lose electricity.

At the same time, radar operators identify air signatures from Russia, apparently heading toward Estonian airspace. Alert aircraft are scrambled. But the real crisis kicks off on the ground in Narva. Masked armed men, dressed in civilian clothing and wearing tricolor armbands, break into the empty Narva City Government building at Peetri Platz 5, climb their way to the top of the tower, and unfurl a green, black, and white flag. As the city government building is occupied and barricaded, another group of armed men attacks a nearby police station, overwhelms the skeleton crew, and takes a handful of hostages.

The last two groups are tasked with seizing the two border crossings across the Narva River. Narva 1 is the main border crossing point between Russia and Estonia, across the Friendship Bridge. A smaller, rarely used secondary crossing, Narva 2, sits about a mile south in a mixed industrial and residential area. The armed group attacking Narva 1 engages the border station building, about 380 meters from the foot of the bridge, drawing Estonian police defenders into a firefight. A second section of attackers takes up positions in the Narva Museum, a complex of 14th-century stone fortification with a commanding view of Friendship Bridge and the surrounding area, and supports the assault. Further south at Narva 2, the attackers similarly engage the border station, while setting up overwatch positions in the massive abandoned Kreenholm textile manufacturing complex.

While Estonian police defenders focus on attacks from the Estonian side of the border, additional attackers cross the bridges on foot and join the fight. These groups of men dressed in plain clothes are armed with heavier weapons including RPGs, squad machine guns and MANPADS. By 0800, both border crossings and bridges across the Narva River are seized, securing a thin but steady supply line from Russia. Reinforcements continue to stream into the city across the two bridges, and attackers strengthen their key defensive positions. Meanwhile, hundreds of small FPV drones appear in the skies above and begin hunting Estonian defenders. Anyone in a police or military uniform becomes a target.

Phase 4 – Information war

The chaos and fighting across Narva make for online content that quickly goes viral. With the hashtag #FreeNarva, videos of the chaos are shared across social media platforms, and pro-Kremlin trolls immediately label the situation as an uprising of the local population. A network of pro-Kremlin influencers in the West amplifies the content, then mainstream media in Europe and around the world pick it up. At 0900 local time, while the Estonian government and NATO are still trying to determine exactly what is happening in Narva and how to respond, the “separatist government” broadcasts its first official message from the seized City Government building.

Sitting behind a desk, with a black, green and white tricolor flag behind him, and flanked by armed men, the spokesperson announces the establishment of the Narva People’s Republic. In a short speech, delivered intentionally in Russian, he cites grievances against the Estonian government. He says the uprising is an act of self-preservation for Russian speakers in the region. Social media networks and news outlets quickly pick up the speech, adding to the moment's confusion. Kremlin trolls and their proxies call for support for the “world’s newest nation,” while cautioning against being pulled into World War Three by “Estonian fascists.” Memes quickly circulate featuring the mushroom cloud. Meanwhile, Russia expresses understanding of the separatist grievances but categorically denies having taken any part in the events. Putin appears on Russian television from a nuclear launch center and warns that an attack against Russian territory will result in a response using all available means.

Where does the scenario go from here? At minimum, Estonia would seek Article 5 consultations, but beyond that, the crisis could unfold in many different ways. I am not trying to explore every possible path. This hypothetical illustrates one way Russia could attack NATO territory while preserving enough ambiguity to complicate the Alliance’s response.

V. What gaps were identified?

Let us now examine how much of the hypothetical scenario reflects real-world vulnerabilities, how much was speculative, and what potential gaps the exercise identified.

Speculative Risk: Russian operatives' ability to acquire small arms once on the ground. The most speculative element of this scenario is the ability of Russian intelligence officers to acquire weapons through illicit means. While criminal networks trafficking illegal weapons exist and may extend into the Baltics, there is no basis to assume Russian operatives could readily access such networks without increasing the risk of detection. In the hypothetical scenario, weapons acquisition would therefore represent a significant uncertainty and a potential point of failure.

Confirmed Risk: Estonia has a large ethnic Russian and Russian-speaking population, with some evidence of social tensions in Narva, but the situation is nuanced. Official Estonian statistics show that ethnic Russians comprise about 20 percent of the country’s population. In Narva, approximately 97 percent of residents speak Russian. The relationship with Russia in Narva, however, is nuanced. After Estonia regained independence in 1991, many ethnic Russians who had settled in Estonia during the Soviet period did not automatically acquire Estonian citizenship and instead had to obtain citizenship through naturalization. Consequently, in 2014, only about 46 percent of Narva’s residents held Estonian citizenship, while 36 percent held Russian citizenship. Some Estonian government policies have contributed to local resentment, and these kinds of social friction points attract the attention of Russian intelligence services. However, there is no evidence of broad support in Narva for joining Russia, and documented reports indicate otherwise.

Confirmed Risk: The “Narva People’s Republic” is thought to be a Russian information operation. The idea of a “Narva People’s Republic” is not purely hypothetical. The current online campaign appears to have emerged in 2025 and became active in February 2026, when social-media accounts began promoting the idea of Narva and Ida-Viru County separating from Estonia. In March 2026, Estonia’s Internal Security Service characterized the activity as an information operation intended to sow confusion and undermine social cohesion.

Confirmed Risk: Russian nationals continue to receive Schengen visas with a relatively low refusal rate. Russians continue to receive short-stay visas into the Schengen zone. Although applications from Russian nationals receive more scrutiny now than in previous years, in 2025 Russian nationals applied for 679,425 short-stay visas, and 630,641 were issued, including 175,862 multiple-entry visas. The refusal rate for Russian visa applicants was only 6.4 percent according to official European Commission statistics.

Confirmed Risk: Absence of coordinated internal immigration enforcement and interoperability challenges. In our scenario, the fragmented nature of internal immigration enforcement in the EU was the biggest identified risk, as it allowed Russian operatives to move from their initial countries of admission to other parts of the Schengen area. The Entry/Exit (EES) system, fully deployed in April 2026, is a significant step toward gaining an operational picture of who enters and exits the Schengen area. Still, it works best for securing the EU’s external borders and preventing re-entry by previous violators. Individuals who do not leave the EU on time are added to the EES “overstayers” list, which is available to the member state competent authorities. But the overstayer list is just that – a list. To move from list to action, an individual on the overstayer list would need to have a “return order” (the EU version of a deportation order) issued by the competent member state authority. The order would need to be entered in the Schengen Information System (SIS) promptly. At that point, member states would need to coordinate to share SIS alerts and apprehend the individual. That could be facilitated through the SIRENE (Supplementary Information Request at the National Entries) bureaus, 24/7 centers each member state operates to facilitate information exchange. All that is possible if the system works without flaws, but that is not the current operational reality. The European Commission acknowledged in its 2026 State of Schengen report that interoperability and coordination remain challenging. The report specifically points out that “further efforts are required across all Member States to address challenges related to the timely issuance of return decisions, the streamlining of procedures and the implementation of measures to prevent absconding and unauthorized secondary movements.”

Confirmed Risk: Absence of a single entity that monitors the EES overstayer list for emerging security threats. Building on the previous risk factor, I could not confirm in my research the existence of a single EU entity that systematically monitors the EES overstayer population for emerging national-security threats based on targeting criteria. While extensive mechanisms exist for sharing information once a person becomes the subject of a relevant alert, it remains less clear who is systematically examining the EES overstayer population for national-security significance before that threshold is reached. The EU has an entity with extensive experience coordinating Member State investigations and criminal intelligence: EUROPOL, the European Union Agency for Law Enforcement Cooperation. EUROPOL has access to EES data for law-enforcement purposes, but its current EES capabilities are primarily integrated into existing investigative and analytical functions. EUROPOL itself identifies the need for greater interoperability among the EU's large-scale information systems and states that, once the planned changes are implemented by 2027, it will be able to use EES and other systems to “support assessing the security risks associated with third country nationals arriving to Europe.” At present, therefore, I found no evidence of a centralized process dedicated to systematically screening the EES overstayer population for national-security indicators. In other words, the EU has built the haystack and mechanisms for sharing information about individual needles, but it is less clear who is systematically looking for the needles. And because the EES is still new, the size and characteristics of the haystack are not yet fully established.

VI. Recommendations

I deliberately fashioned this scenario to unfold as a Russian operation against NATO might: deliberately ambiguous, difficult to attribute, and accompanied by an aggressive information campaign designed to complicate the Alliance’s response. The incursion itself would not necessarily need to be militarily successful. If Russia could create a crisis that divided NATO, delayed a unified response, or exposed weaknesses in the Alliance’s ability to defend its territory, the crisis itself could constitute a strategic success. For that reason, the most effective defense is to prevent the scenario from occurring in the first place—by identifying the vulnerabilities that could make such an operation possible and closing those gaps before Russia can exploit them.

NATO and Estonia are doing many things well, including their strategy of “deterrence by denial,” and I will not spend time analyzing those efforts here. They should continue. My recommendations instead focus on less frequently recognized vulnerabilities outside the traditional military sphere that could still be exploited in a hybrid conflict.

Recommendation 1: Continue EU-wide coordination targeting organized criminal activity. A key element of the hypothetical scenario depended on Russian operatives gaining access to firearms through criminal networks. Organized crime can provide illicit infrastructure that terrorists, intelligence services, and other national-security threats may exploit. Continued EU-wide efforts to disrupt these networks therefore serve a purpose beyond traditional crime reduction: they deny hostile actors access to networks, resources, and capabilities that could facilitate operations inside Europe.

Recommendation 2: Eliminate tourist visas for Russian nationals and create a forward-deployed EU visa security program for high-threat regions. One of the larger gaps identified in this scenario is that Russian nationals still have legal avenues to obtain visas to enter the EU. My recommendation would be to stop issuing tourist visas to Russian nationals, with exceptions for limited humanitarian circumstances. The EU should also consider a uniform, EU-wide mechanism to systematically assess the security risks posed by visa applicants and incorporate those assessments into visa issuance decisions. While the EU has a sophisticated common visa-information system, including biometric screening and mechanisms for sharing information among Member States, responsibility for visa adjudication and national-security assessment remains distributed among national authorities. The United States provides one potential model. Through HSI’s Visa Security Program, trained special agents are assigned to diplomatic posts overseas to conduct law-enforcement interviews and identify terrorists and other national-security threats before they enter the United States. A comparable EU capability, whether centralized or deployed through participating Member States, could add an investigative and intelligence dimension to the existing European visa-screening architecture.

Recommendation 3: Establish a national-security immigration coordination center within an appropriate European agency. The EU should consider establishing a dedicated national-security immigration coordination capability within an existing agency such as EUROPOL. The center would proactively analyze the EES overstayer list and other relevant databases against current threats, identify concerning emerging patterns, centralize alerts concerning visa overstays and other significant immigration violations, and provide a mechanism for Member State coordination. Where an overstay or other immigration violation involves additional security indicators, the center could elevate the case for immediate coordination with the appropriate law-enforcement and intelligence authorities in the affected Member State. The objective would be to move beyond simply recording immigration violations toward proactively identifying those that may represent emerging national-security threats.

VII. Conclusion

The purpose of this exercise was not to predict that Russia will attack Narva, or that events would unfold exactly as described. It was to show how a deliberately ambiguous hybrid operation could exploit vulnerabilities outside the traditional military sphere. Russia would not necessarily need to defeat NATO on the battlefield. It could seek to create a crisis in which attribution is uncertain, information is contested, political leaders face competing pressures, and the Alliance must make consequential decisions under extreme uncertainty.

That is why prevention matters. Once armed men are occupying buildings in a NATO member state and information operations are shaping the narrative faster than governments can establish the facts, the opportunity to prevent the crisis has already passed. The objective should therefore be to identify the vulnerabilities that make such a scenario possible while there is still time to address them. NATO's military deterrence and Estonia's defenses remain essential, but closing the less visible gaps in Europe's immigration, intelligence, law-enforcement, and information-security architecture may be just as important in preventing the next hybrid crisis from becoming a reality.

At minimum, these measures would make it significantly harder for Russia, or any hostile actor, to establish the personnel, infrastructure, and freedom of movement needed to conduct such an operation inside Europe.

Disclaimer

The views expressed in this article are the author’s own and do not reflect the official position of the U.S. Department of Homeland Security, Homeland Security Investigations, or the U.S. government.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Muhammad bin Salman’s Humbling and the Return of the Ottomans

The Houthis bloodied Saudi Crown Prince Muhammad bin Salman’s nose—again—with their deadly, cruel, but effective attacks on Riyadh’s King Khalid International Airport last week. The strikes are the latest in a series of mostly self-inflicted setbacks—exacerbated by President Trump’s ill-considered war with Iran—that have frustrated the Crown Prince’s now decade-old aspirations to turn Saudi Arabia into a global economic, financial, and military powerhouse. Instead, MbS’s faltering economic reforms, combined with his bad bet on relying on Donald Trump as a security partner, are yet another reminder that Saudi Arabia is a weak state, dependent on and vulnerable to the whims of more powerful outside actors. And more than ever, the Saudis don’t have a good way out of that predicament.

The roots of MbS’s cascading problems lie in the early years of his de facto reign, which began in 2015, when he assumed the roles of defense minister and deputy crown prince. They stem from his personal arrogance and foreign misadventures, as well as his more admirable recognition—poorly acted upon—that the Saudi kingdom was, and remains, a relic in need of modernization and a future beyond hydrocarbons.

Over several years, MbS shattered Al Saud governing norms; alienated and pushed aside many members of the large and mostly indolent royal family; and sidelined the kingdom’s religious establishment (good riddance, say I). He also alienated neighbors such as Qatar and the UAE, ultimately to Saudi Arabia’s detriment, and started a war with the Houthis that he lost—and is now losing again.

MbS also unleashed much-needed economic and social reforms (women can now—gasp!—drive). The economy has gone from being mostly driven by government spending to being slightly less so. Homeownership is up, and unemployment among Saudis is down, according to IMF data. Nonreligious tourism grew from 2019 until last year, albeit from a low base. And Aramco’s kind-of, sort-of IPO in 2019 raised billions to support MbS’s ambitions in what was then the largest such offering in global equity history, although it now seems quaint beside the $85 billion SpaceX IPO.

But extravagant government spending in pursuit of unproductive, unachievable vanity projects (NEOM, anyone?) and MbS’s wild overestimation of the resources at his disposal are hobbling his ability to pursue the Vision 2030 economic reform program. And it turns out that, beyond the usual cadre of foreign finance bros and management consultants who are happy to bill the Saudi government by the hour or by the project, outside investors who could provide the capital and expertise needed to make the reforms viable are not convinced that Saudi Arabia is a place where they want to do business at the scale MbS needs. Net foreign direct investment in the kingdom last year was only about one-third of what the Saudi government had envisioned under Vision 2030. And, it goes without saying, 2026 is not proving to be a good year, with the IMF estimating that FDI will fall by about one-third.

The Crown Prince’s problems are not all of his own making, of course. But even so, his miscalculations have exacerbated the difficulties he is now struggling to address. The Iran war has scrambled the kingdom’s security and economic calculations, inviting Iran and its Houthi allies to prey on a country woefully unprepared for conflict despite decades of profligate but mostly ineffectual defense spending. The extravagant welcome MbS accorded Trump in Riyadh early last year has gained the Saudis mostly nothing. It’s not just that the Saudis—and other Gulf potentates, to be sure—assess that President Trump has treated them shabbily. It is that the American military has so far proved unable to achieve anything better than a stalemate against a third-rate regional power—Iran—with all the implications that sad fact holds for the region and for our global standing and credibility.

So where does this leave the now-middle-aged Crown Prince and the country he rules as he contemplates the coming decades of his reign? Recalibrating and scrambling, to be sure. Many of the investment megaprojects that were once cornerstones of his Vision 2030 program are dead or on life support. Three prominent examples are the now-bankrupt, Saudi-financed LIV Golf league; The Line at NEOM; and the absurdly overpriced, vanity-driven $50 billion giant cube, the Mukaab in Riyadh. And the economic pain is bleeding into other prestige projects as well, including the postponed (read: canceled) Asian Winter Games originally scheduled for 2029. The tens of billions spent—and the tens of billions more not spent because the country can’t afford it—have left the Saudis mostly where they were after all their past failed efforts to diversify the economy: reliant on hydrocarbons to sustain it and pay the government’s bills. Vision 2030 has changed that at the margins (and the vibes of living in and visiting the country are certainly different), but not in a fundamental way.

Compounding MbS’s woes, of course, is the regional security earthquake brought about by Trump’s Iran war. The United States is receding and retreating from its role as regional hegemon and the Crown Prince can be under no illusion that this will change after Trump leaves office in 2029. The Saudi brand is toxic among Democrats, and the emergence of the US as the global energy superpower under President Obama and during the first Trump administration has fundamentally changed the relationship between Riyadh and Washington. So, again, Riyadh is reduced to trying to do what it has always been forced to do: seek outside protection while also accommodating its adversaries.

The Crown Prince’s options are not good. His much-vaunted security agreement with Turkey and Pakistan demonstrates how poor his alternatives are to the now-defunct Pax Americana—and must also be personally humiliating. After all, one of his putative new protectors, President Erdoğan, gleefully embarrassed the then-young Crown Prince after Saudi agents murdered Jamal Khashoggi in Turkey in 2018. And anyone who has spent time in the kingdom knows well the lingering distaste for—and insecurity about—the country’s former Ottoman masters. As for Pakistan, it takes little imagination to understand how that benighted and impoverished country is viewed by the kingdom’s ruling family.

At a more practical level, Turkey and Pakistan will never replace the military capabilities of the United States, and both countries’ commitment to their new security agreement will be limited by the simple fact that Iran holds them at risk as well. Riyadh’s security strategy will probably closely resemble its current response to the Houthi threat, as detailed in a recent Wall Street Journal article: scouring the globe for weapons to defend against missiles and drones, contemplating hiring mercenaries to fight in Yemen in lieu of Saudi forces that are demonstrably not up to the task, and quietly seeking an accommodation with the Houthis to try to make the whole thing go away. In a region fundamentally altered by the US-Iran war—with US credibility as a security partner in tatters and Iran emboldened, if weakened—good luck with that.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

I just want to read the news

Get the news and only the news!

Guardian

Back to top

Kaupunki

Back to top

Yle

Back to top

CNN

Back to top

Hesari

Back to top

Al Jazeera

Back to top

New York Times

Back to top

Reuters

Back to top

NPR

Back to top

The Cipher Brief

Back to top