The Cipher Brief

Every October, Cybersecurity Awareness Month puts practical security measures in the spotlight. Can an employee recognize a phishing email? Will someone pause before clicking a suspicious link? Are passwords and access credentials being protected? These are important questions; individual behaviors are crucial to maintaining cybersecurity.

But awareness is so laser focused on preventing and mitigating the malicious cyberattack, it’s easy to lose sight of the bigger picture: the cyberattack in front of you may be only one piece of the threat.

In the era of hybrid threats, a cyberattack could be part of a broader campaign in which digital activity intersects with cognitive warfare, sabotage, unusual drone activity, disruptions to communications and navigation systems, and much more. State and state-linked networks might use online fraud or scams to generate revenue for operations, launder funds and undermine confidence in financial and/or government institutions.

The challenge for security and law enforcement agencies transcends detecting and responding to one cyber incident at a time. They must also determine whether events that appear separate may be connected.

That distinction changes what it means to be aware, and the urgency is intensifying. Recent research and reporting shows Russian cyber activity directed at European targets is likely intended to enable intelligence collection, operational reach and long-term access rather than immediate disruption. In parallel, the Iranian government is believed to be relying on a longstanding hybrid warfare model combining cyber operations, asymmetric military operations, information warfare, proxy attacks and coercive state activity, with AI increasingly acting as a force multiplier.

Expect to see more of this going forward, not less.

CONNECTING THE DOTS

Consider the signals individually: a government agency experiences a cyberattack. Unusual drone activity is reported over critical infrastructure. GPS service is disrupted. False or misleading information is deliberately spread. Viewed on their own, these events may have different causes, and each can appear to be a separate incident.

Yet hybrid campaigns often depend on individual activities initially looking ambiguous or unrelated. If each signal is treated only as a self-contained incident, relevant connections may be missed – and when the connections are missed, so is the broader pattern they could form.

This does not make traditional cybersecurity awareness less important. It makes awareness more demanding. The familiar focus on individual judgment must be matched by institutional awareness: the ability of government agencies, armed forces, critical infrastructure operators, and other relevant organizations to recognize which signals may matter beyond the immediate event.

That begins before advanced analysis enters the picture. An organization cannot share information it did not capture, and it cannot capture information it did not recognize as potentially relevant. The first requirement is therefore a common understanding of what may be security-relevant and what information is needed to contribute to a broader situational picture.

This shift is central to the awareness challenge. A suspicious link has a clear place in the traditional conversation. A weak signal in a hybrid environment may not have the same clarity. Its significance may emerge only when it is considered alongside other information. Awareness, in this context, means looking beyond the apparent boundaries of a single incident without assuming that any one event tells the entire story.

The sequence matters: recognize, capture, share, assess. If a potentially relevant signal drops out at any stage, it cannot inform the larger picture. If it moves through that sequence, it becomes one piece of information that can be examined in relation to others.

The next task is to bring those fragmented pieces together. Threat intelligence, decision intelligence and artificial intelligence can help teams work across large volumes of data, correlate information, reveal connections, and alert analysts to anomalies. Their value is especially clear when no single signal is decisive. Several weak and seemingly unrelated signals may form a pattern that supports a more informed assessment of the security situation.

The point is not simply to accumulate more data. It is to make relevant information usable as part of a coherent view. A list of isolated incidents still leaves decision-makers looking at fragments. A situational picture asks a different set of questions: What may connect these events? What does the combined pattern suggest? Which developments deserve closer attention? And what might happen next?

That last question is essential. The goal is not limited to identifying a cyberattack or another security-relevant event after it occurs. It is to understand the relationships among relevant signals well enough to identify potential future developments at an early stage. Detection remains necessary, but detection without connection can leave the larger threat out of view.

For Cybersecurity Awareness Month, this broader perspective offers a useful way to expand the conversation. At the individual level, awareness still means recognizing the suspicious email, protecting credentials, avoiding scams and frauds and thinking before clicking. At the national level, it also means making sure the right organizations know what to notice, what to record, what to share, and how to place that information in context.

The difference is one of scale. An individual may be watching for a malicious link. Government agencies, armed forces, critical infrastructure operators, and other relevant organizations must also be watching for relationships among cyber activity, disinformation, sabotage, drone activity and communications interference.

That is the blind spot Cybersecurity Awareness Month should help bring into focus. There’s more to awareness than paying attention before clicking a link. Awareness means we know which signals deserve attention, whether we can bring them together, and whether we can see the threat they may form before the pattern becomes unmistakable.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

America's Counter-Drone Authority Is Real, The Capacity Isn't Yet

Here is a number worth sitting with: federal teams seized roughly 700 drones around World Cup venues this summer. Seven hundred — at one tournament, in one season, with the best-resourced counter-drone units in the world on the field. That figure is a success story and a warning in the same breath: the threat volume is enormous, and the federal government cannot be the only team suiting up for it.

Until this year, it legally had to be. The power to disable a hostile drone belonged to a short list of federal agencies, which left a state trooper at a stadium gate or a corrections captain watching an aircraft hover over his yard with nothing but binoculars and a report form. Congress ended that with the SAFER SKIES Act in December's defense bill, and the DHS-Justice framework implementing it has been in force since July 1: state, local, tribal, and territorial police and corrections agencies that complete federal training and certification, on approved equipment, can now track a threatening drone and — against a credible threat — take it out of the sky above major venues, critical infrastructure, and prisons.

And in the past week, Washington has shown it means to deliver. The Justice Department announced that the FBI's counter-drone training center in Huntsville will double its capacity. DHS's Science and Technology Directorate put commercial counter-drone systems through operational testing alongside state and local officers. The Pentagon selected four directed-energy systems for a homeland counter-drone pilot. This is what implementation momentum looks like, and the departments deserve real credit for it.

Now the hard truth: doubling a small number produces a small number. The Huntsville center's first class, last fall, held twelve officers, and it remains the only place in America where a state or local officer can earn the legal right to bring down a drone. More than 18,500 agencies are now eligible for these authorities. Against that denominator, even a doubled schoolhouse leaves the vast majority of American communities exactly where they were — watching — while the Super Bowl arrives in four months and the Los Angeles Olympics in under two years. Our prisons cannot wait either: drone incidents at federal correctional facilities rose twentyfold in six years, and state systems from South Carolina to Georgia are logging airborne contraband runs by the hundreds.

What turns momentum into coverage is money, sustained past the current news cycle. Congress should fund training at the scale of the authority it created: regional and satellite course delivery so a deputy in Phoenix is not waiting on a classroom seat in Alabama, instructor pipelines that multiply the schoolhouse instead of merely enlarging it, and a certification target tied to the event calendar that oversight committees actually track. Just as important, the FEMA counter-UAS grant program — $500 million across 2026 and 2027, built around the World Cup — should not sunset with the tournament that inspired it. The threat is not leaving when the fans do.

Governors have their own homework, and fewer excuses than ever: the grant rules push at least 97 percent of awarded funds down to local and tribal agencies within 45 days. The money is designed to reach the street. States should name a lead agency, compete for those dollars this cycle, and put their corrections systems and stadium districts first in line for certified teams.

Over more than twenty years in federal homeland security — the last of them leading U.S. Immigration and Customs Enforcement — I watched threats outrun statutes again and again. This time the statute arrived first, and this past week proved the executive branch intends to use it. The remaining question belongs to Congress and fifty governors: whether a nation that just confiscated 700 drones at a single sporting event will fund protection for everyone else. Authority without capacity is a promise. Appropriations are how promises get kept.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The U.S. Army’s Pacific Strategy Depends on Allies

“We never fight alone. We've never done that. You can go all the way back to the days of Revolutionary War. The United States has never gone into conflict on its own. We've always built coalitions. We've always involved partners and allies. And we'll continue to do so going forward.”

That was Gen. Ronald P. Clark, Commanding General, U.S. Army Pacific Command, speaking last Tuesday at a contemporary military forum, Decisive Landpower -- Deterrence and Partner Integration Against the Pacing Threat, as part of the 2026 Association of the United States Army (AUSA) Conference in Washington, D.C.

On the panel with Clark was Army Gen. Xavier T. Brunson, Commander, United Nations Command, U.S. Forces Korea, and Tara Murphy Dougherty, Chief Executive Officer of Air, a leading AI software firm that specializes in national security readiness.

The two Army generals spent a good deal of their time talking about lessons learned from Ukraine and the benefits to the U.S. of allies – specifically in the Pacific. That struck me as something to further explore, since one day later, on Wednesday, President Trump continued his running criticism of allies with an October 14, Truth Social screed.

Trump said in part: “Because of the fact that we have had such Military Success, we no longer ‘need,’ or desire, the NATO Countries’ assistance — WE NEVER DID! Likewise, Japan, Australia, or South Korea. In fact, speaking as President of the United States of America, by far the Most Powerful Country Anywhere in the World, WE DO NOT NEED THE HELP OF ANYONE! Thank you for your attention to this matter. President DONALD J. TRUMP.”

On the other hand, Gen. Brunson had told the AUSA audience one day earlier, “Everything that we do is intricately woven around the ROK (Republic of Korea)-U.S. alliance. That alliance has stood for some 75 years and it is an example or a paragon, if you will, of all that's right when folk work in alliance together. The problems that we solve are joint problems. They're not just U.S. problems. They're not just Republic of Korea problems. What they are is great opportunities for two nations to work in concert with one another in order to arrive at solutions that are beneficial for both countries.”

Gen. Clark explained further, “So our ability to be able to work with partners and allies on their sovereign soil, to be able to share procedures that we build through [military] exercises over the course of a year, some joint, some army-to-army, but always integrated with our partners. It gives us the opportunity to have our systems work technically, to have our procedures nested, and to get to know one another in a way that allows us to build the trust that's necessary in training. Because if we wait until crisis or conflict, it's too late to ask the question, can I trust

you? But because we've been working together, because we've exercised at scale, because we're modernizing our forces alongside one another, it works.”

Clark added, “We've really worked hard at building those relationships at scale inside of the land forces. We have a land forces dialogue that meets multiple times a year -- chiefs of army of Australia, Japan, the Philippines, and the U.S. We've invited the ROKs in, we've invited India in, and it continues to grow. So those relationships built army-to-army are what allows us to really integrate across interoperability, and integrate it really across our formations and with our partners in all.”

Brunson described how he and Korean Gen. Kim Sung-min, Deputy Commander of the U.S.-ROK Combined Forces Command, discussed training differently “taking advantage of the knowledge that we have of the threats that exist or that prevail in the Ukraine fight.”

Brunson said, “We talk about how we would operate in a distributed fashion…Just imagine if we trained across the entirety of the [Korean] Peninsula and got ourselves in a shape where we would say you can't utilize the things that you've learned in the fight in the battlefield in Ukraine on us, because we learned the same lessons and we've distributed ourselves in such a way that we don't make ourselves the target. We won't be moored in place.”

Clark talked about Russia, North Korea and China “learning from watching us partner, but the partnerships that our adversaries have built are transactional versus the transformational relationships that we build as a security partner of choice globally…for us it's really transformational relationships that we look to cultivate with partners and allies over time.”

Brunson described how the North Koreans, fighting for the Russians in Ukraine were “able to test systems there…and then bring that back home. So, in one aspect, they've shortened their RDT&E cycle.” He also pointed out, “The fact that you have a combat trained force with recent

combat on the [Korean] Peninsula for the first time since 1953..[and] are now bringing those lessons learned back into their own training cycle, it's shortened their time to develop them.”

Clark said that U.S. forces had also learned from Ukraine about the need for mobility and camouflage, which he described as “age-old army forgotten sciences of how to hide in plain sight and how to camouflage ourselves from observation...Our ability to be able to use electronic warfare, to be able to use just good, old-fashioned camouflage and the ability to deceive our adversary is a must. In those two theaters [Ukraine and Iran] it's not a near-peer adversary that we would be working against -- whereas, in our theater [the Pacific] it absolutely is.”

For Clark, the questions were: “How do we fight, you know, Type One, Type Two UAS [unmanned aerial system, drones]; how do we think through ballistic missile defense holistically in the region. We spend a lot of time working again with the joint force for solutions associated with that. How do we maneuver?”

Brunson raised a new issue by pointing out that, “Our old system was something [a weapons system] breaks, we send it all the way back CONUS [Continental U.S.] in order to fix it so we can then bring it all the way back out again.” That used to take 29 days by ship.

However, he added, “In the ally that we have in Korea we have a an absolutely premier industrial base, if you look at the Korea defense industry, some of the kit that we're producing right now sits along our friends, allies and partners.” Brunson said, “The Army’s new infantry squad vehicle (ISV), for example, is produced by GM Defense and GM Defense is also in the Republic of Korea.”

“So the idea of a regional sustainment hub would simply be…to bring those means of production to the theater,” Brunson suggested, noting, “In the maritime domain, when we look at maintenance, repair, and overhaul, which is being done forward alongside the Koreans, you know that 15 percent of global ship building is done in Korea. And, oh by the way, we've got an ally with a mutual defense treaty in Japan that has 10% of global ship building. And if we take these cases forward, we're able to stay in theater longer.”

The answer, Brunson said, “We've got to try to achieve admirable endurance in theater by partnering alongside our allies, seeing the things that they can do better than we can right now at distance and then keeping them right where they belong. That keeps our [military] forces forward.”

Dougherty chipped in saying: “Tens of millions of dollars saved by simply identifying things like unfilled requisitions or parts that are obsolete that can be replaced with something not obsolete and also less expensive. I think that this is it. This is part of how you generate lethality. You get readiness to pay for itself, because otherwise sustainment is too expensive when it has to be done for the entirety of the joint force all the way on the other side of the world.”

At one point, Clark said, “The secret sauce for us as an Army is our Non-Commissioned Officer (NCO) corps, reflecting Defense Secretary Pete Hegseth’s September 30 speech praising the same group.

Clark noted that both he and Brunson were sons of NCOs, and that “with the assistance of our senior non-commissioned officers, senior enlisted leaders across the [PACOM] region have embarked upon conducting assessments with our partners and developing strategies to help them build their NCO development programs inside of their formations.”

To illustrate his point, Clark said his units had just finished an assessment in Cambodia of its army and the Commander, Gen. Mao Sophan, “basically said, ‘Hey, whatever you're asking us to do, we're going to do it because we want to get to a level of proficiency with our Non-Commissioned Officer core that we see in yours.’"

I must point out that during the one-hour-and-thirty-minute session neither General -- Clark nor Brunson -- came near to mentioning President Trump’s repeated critical views about U.S. allies.

The closest anyone came was Dougherty, who at one point said diplomatically, “We'll head into midterm elections here [in the U.S.] in November, obviously as you know, and I think we expect some variation in the political dynamic in the United States, and our allies and partners all navigate their own political changes as well.”

She then added, “If you look over the course of history, however, at least modern history, certainly the United States has invested in those partnerships. And today, we still are -- maybe with a different flavor or a different attitude. And that's not really for me to say. I'm simply observing. But we haven't lost sight of the importance of allies and partners to securing U.S. national interests.”

I would bet Clark and Brunson – along with most U.S. military professionals – would silently agree with her statement.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The Hidden Risks of AI-Powered Intelligence

Picture an intelligent analyst's screen. Data about troop movements, a port closure, a terrorist attack, or a weapons transfer sits at the center of a clean interface, with a confidence indicator glowing green. Two hundred outlets are carrying it, and the platform has counted every one. It looks like a corroboration. In many cases, it is a single Telegram post, copied, translated, summarized, and republished until its origin disappeared behind its own echo.

Nobody must be negligent for this to happen. It is what you get when a product or platform is built to measure volume and the user is tempted to read volume as truth.

I say this as someone who works with open-source material and believes in it. Commercial imagery, ship-tracking data, procurement records, leaked databases, and social media have changed what is knowable about conflicts and illicit networks; but the market that has grown up around these sources is selling something different from the discipline that makes them valuable, and governments and companies are buying it without noticing the difference.

A Crowded Market and a Thin Product

Open-source intelligence platforms are multiplying quickly. Walk through the company stands at any security conference and you will find dozens of them, each promising to fuse, monitor, and surface threats across the open internet, now almost always with an AI layer that summarizes, ranks, and alerts.

Strip away the interface and most of them offer little that a competent analyst couldn't already do with a search engine, a handful of specialist tools, and some patience. Reverse image searching, scraping social platforms, pulling corporate registry data, and geolocating an image are all learnable skills, and many of the best practitioners picked them up in public, often as volunteers. What the platforms add is convenience and scale, which is genuinely useful, but convenience is not analysis. The real product, in most cases, is the dashboard.

Dashboards are persuasive by design. They squeeze a messy information environment into something that looks like a picture of the world, with counts, trend lines, heat maps, and sentiment scores. Each of those findings implies that someone has already done the hard work of deciding what matters and what is true. Usually, no one has. The system has counted things, and counting is the easy part.

Counting Sources Is Not Testing Them

The core flaw is in what these systems reward. They tend to measure the number of sources behind a claim, not the independence of those sources. The two are very different things.

Independence is the foundation of corroboration. Two witnesses who saw an event separately make a claim stronger. Two witnesses who heard about it from the same third person do not. The same logic applies to reporting. A claim that traces back to a single channel but appears in two hundred outlets has one source and two hundred echoes.

Intelligence tradecraft has a name for this: circular reporting. It is among the oldest and best-documented ways analysts go wrong. The failures that most damaged the credibility of Western intelligence in the past generation involved, among other things, uncorroborated claims that were repeated, cross-referenced, and eventually treated as established because they seemed to come from many places. The lesson drawn at the time was that provenance matters more than prevalence. An aggregator that treats prevalence as confirmation is rebuilding the vulnerability that analysts spent years learning to guard against.

AI makes this problem fourfold. First, language models summarize and synthesize, and in doing so they take away the provenance trail that an analyst needs. A fluent paragraph that blends fifteen sources does not tell you that twelve of them are derivative. Second, the cost of generating plausible content has collapsed. Fabricated articles, cloned news sites, and coordinated amplification networks can now create the appearance of breadth cheaply, which is exactly the signal these platforms are built to count. Third, as more web content is produced or recycled by automated systems, the pool that analytics tools draw from becomes more self-referential. The echo chamber is increasingly populated by machines quoting each other. Lastly, AI can make uncertainty harder to see. Language models are designed to produce coherent answers, not to preserve the ambiguity of the evidence on which those answers are based. Contradictory sources can be reconciled into a smooth narrative, gaps can disappear beneath plausible inference, and tentative conclusions can acquire the tone of established fact. The danger is therefore not simply that an analyst receives false information, but that the uncertainty surrounding otherwise legitimate information becomes less visible.

None of this means the technology is useless. Entity extraction, translation, deduplication, and pattern detection across large data sets are real contributions. But the same tools that can help trace a claim to its origin are too often deployed to certify it instead.

Information Is Not Intelligence

The deeper problem is what happens after the dashboard produces its output. Companies market it as intelligence, and buyers, including government agencies, intelligence firms, financial institutions, and corporate security teams, purchase it as intelligence, then act on it.

However, open-source material is raw information. It becomes intelligence only after a process that no interface can fully automate. Someone has to establish where the material came from, grade how reliable the source has been, assess how credible the specific claim is, and test it against other collection. Established standards exist for this. Grading systems that rate source reliability separately from information credibility have been used for decades, and analytic standards require analysts to describe the quality and credibility of their sources, to distinguish between underlying evidence and judgment, and to account for alternative explanations. These are not bureaucratic formalities. They are the mechanism by which an organization knows how much weight a conclusion can bear.

When that step is skipped, the result is aggregated internet content with a confident interface. The output reads like a finished product, but the epistemic work behind it is missing, and the person reading it often can't see that. A decisionmaker shown a green indicator does not know whether it reflects three independent confirmations or one rumor with good distribution.

The consequences are practical. A government that bases sanctions designations, force posture, or diplomatic messaging on an unverified claim risks embarrassment at best and escalation at worst. A company that reroutes shipments or exits a market because a risk platform flagged a rumor can lose real money; and an agency that comes to rely on commercial feeds may quietly stop investing in the capabilities that would let it check them.

What Should Change

I would offer the following two principles.

One, to treat provenance and independence as essential to intelligence. Open-source material should be treated as a cue and a corroborator, not a conclusion. Open sources are at their best when they point collection in a useful direction or when they test and strengthen what other sources have suggested. A satellite image that shows construction at a site tells analysts where to look and what to ask. A procurement database entry might confirm a pattern already suspected. Neither is a finding on its own. The workflow should run from open-source lead to targeted collection to assessment, not from dashboard alert to briefing slide. As AI makes it easier to summarize, reproduce and generate information, analysts need to know not only what a source says, but where the information originated and whether apparently separate sources are actually independent. A fluent paragraph that blends fifteen sources does not tell an analyst that twelve of them are derivative. Likewise, a cluster of articles, websites or database entries may create the appearance of broad corroboration while ultimately tracing back to a single underlying claim. Platforms should therefore preserve provenance wherever possible and make the distinction between original reporting, derivative content and AI-generated material visible to the user. The workflow should run from open-source lead to targeted collection to assessment, not from dashboard alert to briefing slide.

Two, protect human assessment and the collection that supports it. AI can make uncertainty harder to see. Language models are designed to produce coherent answers, not to preserve the ambiguity of the evidence on which those answers are based. Contradictory sources can be reconciled into a smooth narrative, gaps can disappear beneath plausible inference, and tentative conclusions can acquire the tone of established fact. Human analysts therefore need both the time and the authority to question what automated systems produce rather than simply validate it. That also means protecting the collection capabilities that AI cannot replace. As open-source material becomes more abundant, the value of what cannot be found online rises. Human sources, financial intelligence, law enforcement access and legal process take years to cultivate and moments to lose. A budget cycle that trims them in favor of subscriptions is trading durable capability for a license that expires. The objective should not be to remove automation from intelligence work, but to ensure that automation remains subordinate to collection, verification and human judgment.

What Open Sources Cannot Close

I learned the limits of open-source work firsthand while researching foreign components in Russian strike drones. Open sources got me a long way. Recovered wreckage data, teardown imagery, part markings, and manufacturer documentation could establish what was inside these systems and who made it. That is valuable, and it was achievable by skilled analysts working in public.

But the questions that mattered most were different. Who actually bought a given part? Through which intermediaries did it move? Who paid for it, and through which accounts? Those gaps could not be closed by any amount of scraping. They required the tools that sit behind a legal threshold or inside a trusted relationship: law enforcement access to shipping and customs records, financial intelligence on transactions, and human sources with knowledge of how the networks operate. A dashboard could tell us a component existed. Only that other collection could tell us how it got there and who was responsible, which is the information policymakers need if they want to disrupt the supply chain rather than simply describe it.

That experience shaped how I think about the current issue. Open sources and closed collection are not competitors. The first made the second more efficient, because it let investigators ask better questions. The second made the first more meaningful, because it turned an interesting observation into an attributable finding. Treating either as a substitute for the other would have left us with a weaker product.

Defending the Analytical Craft

None of this is an argument against open-source intelligence. It is an argument for it, properly understood.

The practitioners who built the field's reputation, whether in newsrooms, nonprofits, academia, or government, are rigorous precisely because they distrust easy answers. They document their methods, show their chains of evidence, and say so when something can't be confirmed. That culture is the real asset. It is also what the commercial market is most at risk of undermining, because rigor is slow and expensive to sell, while a dashboard can be demoed in ten minutes.

The test I would offer any buyer, policymaker, or analyst is simple. When you are shown a claim, ask where it began, who else has independent knowledge of it, and what other collection could confirm or contradict it. If the system in front of you cannot answer those questions, it hasn't given you intelligence. It has given you a well-organized rumor.

The volume of open information will keep growing, and the tools to process it will keep improving. The scarce resource will not be data. It will be judgment, along with the access and tradecraft that make judgment possible. Agencies and firms that remember that, and invest accordingly, will see more clearly than those who confuse a full screen with a full picture.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

What a Russian Hybrid Attack Might Look Like

Russia has demonstrated a growing willingness to use hybrid tactics – including sabotage, cyberattacks, information operations, and the use of deniable or “throwaway” agents – to create disruption and uncertainty across Europe. This paper examines how those tactics could be combined in a hypothetical Russian operation against Estonia designed not to defeat NATO militarily, but to create a crisis that tests the Alliance’s ability to respond quickly and collectively.

The scenario is deliberately constructed as a red-team exercise rather than a prediction. It envisions Russia exploiting the existence of Estonia’s Russian-speaking population, infiltrating operatives into the Schengen Area through legitimate visa channels, allowing those operatives to move through the largely borderless Schengen zone, and exploiting gaps in European immigration enforcement. The scenario culminates in a deliberately ambiguous armed crisis in Narva, accompanied by cyberattacks and a coordinated information campaign intended to complicate attribution and slow NATO decision-making.

The exercise identified several vulnerabilities. Some elements of the scenario are highly speculative, particularly Russian operatives' ability to obtain weapons once inside Estonia. Other elements, however, reflect existing conditions: Estonia’s large Russian-speaking population, the continued issuance of Schengen visas to Russian nationals, the decentralized nature of internal immigration enforcement, and the absence of a clearly identifiable EU-level capability dedicated to systematically analyzing the EES overstayer population for emerging national-security threats.

The paper therefore recommends three measures: continued EU-wide efforts to disrupt organized criminal networks that could provide support to hostile actors; eliminating tourist visas for Russian nationals except in limited humanitarian circumstances while developing a forward-deployed EU visa-security capability; and establishing a national-security immigration coordination center capable of analyzing immigration data against emerging threats and coordinating responses among Member States.

The central conclusion is that NATO’s military deterrence remains essential, but military strength alone cannot close every avenue through which a sophisticated hybrid operation could develop. Preventing such a crisis requires identifying and closing the less visible vulnerabilities that could allow hostile actors to establish themselves inside Europe before a crisis begins.

I. Introduction

Drones at Leipzig Airport. Drone incursions of NATO airspace. Throwaway agents. Arson and sabotage at facilities throughout Europe. 2026 has been a busy year, and it appears that Russia is engaged in an ongoing hybrid campaign on the European continent. The EU says that Russia’s goal is to spread fear, distrust, and undermine European unity. Additionally, just this Sunday, September 20, European security officials raised alarm that Russia is testing NATO resolve and could potentially even attempt a limited incursion into NATO territory.

This paper takes the current situation and threat picture as a starting baseline and imagines a scenario in which Russia creates a strategic crisis in Estonia, a NATO member, to discredit NATO collective defense and distract from the war in Ukraine by creating a sort of second front for NATO. In working through this thought exercise, the article examines what Russia could gain from escalation, how it might carry it out, and what security gaps the scenario identifies. Like with any hypothetical scenario, I suspect some will wholeheartedly disagree with my assertions. Still, I ask you to think of this as a red teaming exercise designed to identify vulnerabilities, and not an effort at forecasting.

II. Why might Putin want to escalate?

The “special military operation” that was supposed to take Kyiv in 6 days is going on for four years. Russia is not making significant gains on the battlefield, and whatever small gains it makes come at a prohibitive cost. The Center for Strategic and International Studies estimates that, since the full-scale invasion in 2022, Russia has suffered 450,000 dead and 1.4 million battlefield casualties. Moreover, Russian control of Ukrainian territory actually shrank in the Spring of 2026. The situation is so unfavorable that the Russian MoD now resorts to outright fabrication to claim battlefield gains that have not occurred.

Ukraine, on the other hand, seems to have stabilized its position after 4 years of war. It is becoming ever more adept at using drone technology and can finally bring the war home to Russia. Ukrainian long-range drones are now striking infrastructure deep inside Russia every week, including Russian oil refineries. This matters because Russian oil is the last remaining cash cow keeping the Russian economy afloat. And even though official Russian government numbers purport to show economic stability, a June report from the Kiel Institute for the World Economy concludes that “the Russian economy is showing clear signs of structural exhaustion.” Meanwhile, European support for Ukraine is strong across the continent, at least among mainstream political parties. On September 17, the EU Commission disbursed 3.3 billion euros to Ukraine – part of the 90-billion-euro Ukraine support loan. So in this war that increasingly looks like a war of attrition, it is Ukraine, and not Russia, that appears to be coming out on top.

In my assessment, these factors are gradually painting Putin into a corner, where he is slowly running out of options and may be forced to “flip the script.” In theory, one option Putin always has is a genuine move towards peace on fair terms, which should at minimum include a complete withdrawal of Russian forces from Ukraine. But he is stuck in a trap of his own making. If he relents on his maximalist demands and opts for fair peace, the entire very expensive and painful 4-year war would appear to have been fought for naught. That might very well threaten his political, or even personal, survival in a cutthroat political system. So, he is not willing to make peace. And sticking to business as usual looks like an eventual dead end as well.

In my imagined scenario, Putin invents a third option and chooses to escalate by launching a proxy military operation in Estonia. The operation has several goals. First, it aims to create a crisis NATO must solve on alliance territory, competing with NATO support for Ukraine. NATO would have to decide how to react to the crisis, and balance the reaction with the risk of escalation and full-blown war with Russia. Thus, as a second goal, Putin might succeed in discrediting Article 5 provisions of the defensive alliance if NATO’s response were to be slow or ineffective. Third, a military operation on NATO territory could force NATO partners to focus on their own defense rather than continuing to support Ukraine.

At first glance, this scenario may seem implausible or even reckless. After all, we have been almost conditioned to see NATO and Article 5 collective defense as an ironclad guarantee. This is one reason why countries that were formerly part of the Warsaw Pact flocked to NATO in the 1990s. But we also need to keep in mind that the concept of collective defense has not been routinely tested. Article 5 was invoked only one time – in the aftermath of the September 11 attacks against the United States. NATO has never dealt with a situation where an opponent seeks to test NATO boundaries by mapping out red lines, which I believe is exactly what Russia is doing. In other words, NATO has not yet been fully tested in hybrid war.

III. What might Putin assume about NATO?

We have discussed how the West views NATO. But what might Putin assume about the alliance, especially NATO’s willingness to go to war?

NATO is focused on defense and may prefer to avoid war. First, NATO explicitly describes itself as a defensive alliance and identifies preventing conflict and war as a core purpose of its deterrence and defense strategy. Putin could reasonably assume that NATO governments strongly prefer to resolve a confrontation without escalating it into a direct war with Russia. This does not mean NATO would fail to respond to an attack; rather, it creates a potential vulnerability that Russia could exploit by presenting NATO with an ambiguous crisis in which the costs of escalation are apparent, but the attribution of Russian responsibility remains contested.

NATO may be slow to act. An armed NATO response requires deliberation and consensus among alliance members. Article 5 obligations are triggered in instances of an armed attack, and determining whether an action is an armed attack is addressed on a case-by-case basis. NATO’s own materials note that “events that lack an international element, such as purely domestic acts of terrorism, do not trigger Article.” In Putin’s view, he could see case-by-case deliberations as a vulnerability and conclude that a deliberately vague scenario would make it difficult for the alliance to reach consensus quickly, keeping the window of action open for Russia.

Information operations may complicate consensus. NATO is a collective alliance of democracies, and democratic governments depend to some degree on public support and political legitimacy. In Putin’s assessment of the political situation, he may conclude that Moscow does not need to persuade NATO governments that Russia is innocent. It may only need to create enough confusion and debate within NATO populations to make decisive action more politically difficult. Russia has both the tools and demonstrated experience to flood the information environment with contradictory narratives. The U.S. State Department has documented Russian use of multiple, sometimes contradictory narratives specifically to generate confusion and discourage responses. NATO likewise describes hostile information operations as activities designed to “create confusion, deepen divisions, destabilize societies and ultimately weaken the Alliance,” and notes that such operations are not always intended to persuade audiences of a particular falsehood; they can instead be designed to muddy the information environment and make it more difficult to distinguish fact from fiction.

From Moscow’s perspective, the objective therefore need not be to achieve consensus around a pro-Russian narrative. It may be sufficient to prevent consensus around a coordinated response. If a crisis involving Estonia produced competing narratives about what happened, who was responsible, and whether Russia was directly involved, political divisions within individual NATO member states could complicate the Alliance’s response and make consensus harder to achieve.

Nuclear intimidation may complicate consensus. Putin may believe that nuclear signaling can amplify Western caution. Russia has repeatedly used explicit and implicit nuclear threats during the war in Ukraine. Evidence suggests these threats can have effects beyond traditional military deterrence, including a Chatham House assessment that Russian nuclear threats contributed to Western concerns about escalation and constrained some governments' willingness to provide Ukraine with certain forms of military support. This does not mean that Western populations will automatically oppose confrontation with Russia. Public attitudes toward nuclear deterrence have, in some cases, become more supportive since Russia's invasion of Ukraine. Rather, the point is that nuclear signaling adds an extra political cost to any decision to escalate a confrontation with Moscow. A Russian leadership that believes Western governments are highly sensitive to the prospect of nuclear escalation may therefore conclude that even an ambiguous or limited confrontation could be accompanied by nuclear rhetoric designed to encourage caution, delay, or disagreement within the Alliance.

Taken together, these assumptions suggest that what may appear from NATO’s perspective to be an irrational and extraordinarily risky decision—deliberately creating a crisis on NATO territory—could look considerably more rational from Moscow. Russia would not necessarily need to believe that NATO would stand aside. It would need to believe that NATO’s preference to avoid war, consensus-based decision-making, democratic political constraints, vulnerability to information manipulation, and sensitivity to nuclear escalation could create enough hesitation and disagreement to complicate a unified response. In this model, the objective would not necessarily be to defeat NATO militarily. It would be to create a crisis in which NATO’s overwhelming military advantage becomes difficult to translate into timely, unified political action. If Moscow believed such a crisis could fracture Alliance cohesion, force NATO to divert attention and resources from Ukraine, or show that Article 5 could be challenged without producing an immediate, unified response, the potential payoff might outweigh the risks in the Kremlin’s calculus.

IV. Free Narva – a Baltic hybrid war scenario

With the analysis of the previous sections in mind, I constructed a scenario in which Russia executes a deliberately ambiguous and confusing operation designed to threaten Estonia’s territorial integrity and test NATO’s resolve. In developing the scenario, I considered Russia’s potential objectives, lessons from previous Russian operations, the defensive measures Estonia and NATO have already adopted, and how Moscow might circumvent or exploit those defenses. This paper discusses the vulnerabilities identified through this process in a later section.

Phase 1 – Propaganda and throwaway agents

In October 2026, with the September Duma elections behind him and a comfortable supermajority win for his United Russia party, Putin decides to launch Operation “Narva Spring.” Analysts and think tanks pick up on increased messaging about the so-called “People’s Republic of Narva.” This is an entirely fictitious concept created by Russian intelligence, with a flag, notional borders, and a capital in Narva, a city of about 50,000 residents, 97% of whom are Russian speakers. The online narratives shared on Telegram, TikTok, and other platforms are the usual assortment of Kremlin grievance narratives about marginalized Russian minorities. Ongoing Estonian reforms that aim to make Estonian the official language of education in the country are weaponized and portrayed as “linguistic genocide” against Russian speakers.

The online propaganda campaign is amplified by Kremlin-controlled trolls and shared with pro-Russian Western influencers and political factions who decry Estonian government abuses of the Russian-speaking population. With the propaganda campaign at a fever pitch, the Kremlin is ready to escalate physically. But Russia cannot simply repeat the Crimea or Donbas scenario against Estonia. The Estonian border is one of the most heavily monitored frontiers in the world, where NATO has implemented a “deterrence by denial” strategy. This doctrine holds that defensive measures are so formidable the enemy sees an operation as too costly to attempt. Infiltrating several hundred “little green men” into Narva from Russia just across the river, while maintaining deniability, is not plausible. The Estonian side of the border is teeming with sensors.

But the Russians have been practicing another gray zone tactic recently – the use of “throwaway agents.” So, the Kremlin uses its network of low-level recruits to spray graffiti, place posters and stickers with QR codes, and eventually commit acts of arson and sabotage against local infrastructure and public property – and especially anything linked to law enforcement, security agencies and the courts. The goal is to create the appearance of local resistance against Estonian authority, while staying well beneath the threshold of armed conflict. But propaganda, graffiti, arson, and low-level sabotage are not the intensity of crisis the Kremlin needs. At this point, Russia needs to use specialists trained in fomenting armed violence on the ground.

Phase 2 – Infiltration

In 2014, Igor Strelkov emerged as the face of the armed separatist movement in Donbas, providing Moscow with something enormously valuable: an apparent local actor around whom an armed conflict could coalesce. To bring the Estonia situation from a nuisance to a crisis for NATO, Moscow needs people trained in violence, and a few Strelkov types to direct them. But how to bring them in? Estonia hasn’t allowed free travel for Russian citizens since 2022, and applications for entry for the few exceptions are closely scrutinized.

So, the Kremlin probes for weaknesses in the Schengen zone, and it finds these in Italy, France and Spain. In 2025, France, Italy and Spain collectively issued more than 441,000 Schengen visas to Russian nationals, while more than 477,000 Russian nationals received tourist visas across the entire Schengen zone. The refusal rate for Schengen visas for Russian nationals in 2025 was a mere 6.4%. The Schengen creates an interesting counterintelligence problem for Europe. Once a person has legitimately crossed the EU's external border, Europe's internal geography largely disappears.

In this scenario, Russia begins to infiltrate intelligence and military specialists from units like GRU’s Unit 29155 and the 390th Special Purpose Reconnaissance Point into the Schengen area starting in June 2026, before the launch of the Narva propaganda campaign and increased tensions. Even with the extra scrutiny for Russian visa applicants and shorter admission periods, the Russian operatives obtain tourist visas, enter Italy, and move with ease through Austria, Slovakia, Poland, Lithuania and Latvia via the excellent European train network and private commercial bus services. Once in Estonia, the operatives blend into the large Russian-speaking population and make their way to Narva. In total, just under a hundred Russian operatives follow this and other routes into Estonia over the summer months, and go to ground in the Narva region, supported by a tiny group of local sympathizers and a network of throwaway agents.

Even once the tourist visas of the Russian operatives expire, and they become illegal immigrants within the EU, nothing causes the system to blink red in reaction to this. In a way, no centralized, integrated system focuses specifically on immigration, so no lights blink red. Unlike the United States, Europe does not have an EU-wide interior immigration enforcement agency, and it currently lacks a central entity to monitor immigration violations against emerging national security risks, although that gap has been acknowledged. In terms of what exists today, in 2026, the EU rolled out the Entry/Exit System (EES), which captures biometrics from non-EU nationals entering the EU on short stays. So, in theory, the EES captures the biometrics of the Russian operatives in our scenario. And once their period of admission to the EU ends, typically at 90 days, the operatives are added to the EES “overstayer” list. But at present, unless the overstayer is also matched to additional alerts in the Schengen Information System – an EU-wide law enforcement database – no specific actions are automatically triggered, and law enforcement is not alerted.

Any interior immigration enforcement beyond this point is the responsibility of law enforcement within individual EU member states. If one of the operatives has the bad luck of being stopped by police and this results in a document check, the EES hit would likely show, and he would be detained. But the EES list is not proactively pushed to law enforcement for action. It is simply available to query. And importantly, EES is managed by eu-LISA – the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice – which is an agency focused on IT systems management and not law enforcement or security. In other words, no analysts are scouring the EES list for a sudden uptick in Russian nationals of military age being added to the overstayer list. Unless they attract attention to themselves, no one is coming for the Russian operatives. And in a city with a 97% Russian-speaking population, they don’t attract attention. Meanwhile, they quietly get to work acquiring small arms and mapping out critical infrastructure, communications, and defense and law enforcement sites.

Phase 3 – Estonian Donbas

By the end of 2026, the ground is set to initiate a crisis in earnest, in a way that gets NATO’s full attention. On January 2, 2027, a Saturday, Estonians are still recovering from the raucous New Year’s Eve celebrations. At 0700, Estonia's Information System Authority (RIA) Operations Center in Tallinn begins receiving simultaneous alerts indicating disruptions across government and critical infrastructure networks from unattributed sources. Analysts and incident handlers track the situation as key government and private-sector websites become unreachable due to denial-of-service attacks. Physical equipment begins to act erratically as unknown actors hack industrial control systems. Rail networks are disrupted. Traffic lights rapidly cycle in bizarre patterns. A few urban areas across Estonia lose electricity.

At the same time, radar operators identify air signatures from Russia, apparently heading toward Estonian airspace. Alert aircraft are scrambled. But the real crisis kicks off on the ground in Narva. Masked armed men, dressed in civilian clothing and wearing tricolor armbands, break into the empty Narva City Government building at Peetri Platz 5, climb their way to the top of the tower, and unfurl a green, black, and white flag. As the city government building is occupied and barricaded, another group of armed men attacks a nearby police station, overwhelms the skeleton crew, and takes a handful of hostages.

The last two groups are tasked with seizing the two border crossings across the Narva River. Narva 1 is the main border crossing point between Russia and Estonia, across the Friendship Bridge. A smaller, rarely used secondary crossing, Narva 2, sits about a mile south in a mixed industrial and residential area. The armed group attacking Narva 1 engages the border station building, about 380 meters from the foot of the bridge, drawing Estonian police defenders into a firefight. A second section of attackers takes up positions in the Narva Museum, a complex of 14th-century stone fortification with a commanding view of Friendship Bridge and the surrounding area, and supports the assault. Further south at Narva 2, the attackers similarly engage the border station, while setting up overwatch positions in the massive abandoned Kreenholm textile manufacturing complex.

While Estonian police defenders focus on attacks from the Estonian side of the border, additional attackers cross the bridges on foot and join the fight. These groups of men dressed in plain clothes are armed with heavier weapons including RPGs, squad machine guns and MANPADS. By 0800, both border crossings and bridges across the Narva River are seized, securing a thin but steady supply line from Russia. Reinforcements continue to stream into the city across the two bridges, and attackers strengthen their key defensive positions. Meanwhile, hundreds of small FPV drones appear in the skies above and begin hunting Estonian defenders. Anyone in a police or military uniform becomes a target.

Phase 4 – Information war

The chaos and fighting across Narva make for online content that quickly goes viral. With the hashtag #FreeNarva, videos of the chaos are shared across social media platforms, and pro-Kremlin trolls immediately label the situation as an uprising of the local population. A network of pro-Kremlin influencers in the West amplifies the content, then mainstream media in Europe and around the world pick it up. At 0900 local time, while the Estonian government and NATO are still trying to determine exactly what is happening in Narva and how to respond, the “separatist government” broadcasts its first official message from the seized City Government building.

Sitting behind a desk, with a black, green and white tricolor flag behind him, and flanked by armed men, the spokesperson announces the establishment of the Narva People’s Republic. In a short speech, delivered intentionally in Russian, he cites grievances against the Estonian government. He says the uprising is an act of self-preservation for Russian speakers in the region. Social media networks and news outlets quickly pick up the speech, adding to the moment's confusion. Kremlin trolls and their proxies call for support for the “world’s newest nation,” while cautioning against being pulled into World War Three by “Estonian fascists.” Memes quickly circulate featuring the mushroom cloud. Meanwhile, Russia expresses understanding of the separatist grievances but categorically denies having taken any part in the events. Putin appears on Russian television from a nuclear launch center and warns that an attack against Russian territory will result in a response using all available means.

Where does the scenario go from here? At minimum, Estonia would seek Article 5 consultations, but beyond that, the crisis could unfold in many different ways. I am not trying to explore every possible path. This hypothetical illustrates one way Russia could attack NATO territory while preserving enough ambiguity to complicate the Alliance’s response.

V. What gaps were identified?

Let us now examine how much of the hypothetical scenario reflects real-world vulnerabilities, how much was speculative, and what potential gaps the exercise identified.

Speculative Risk: Russian operatives' ability to acquire small arms once on the ground. The most speculative element of this scenario is the ability of Russian intelligence officers to acquire weapons through illicit means. While criminal networks trafficking illegal weapons exist and may extend into the Baltics, there is no basis to assume Russian operatives could readily access such networks without increasing the risk of detection. In the hypothetical scenario, weapons acquisition would therefore represent a significant uncertainty and a potential point of failure.

Confirmed Risk: Estonia has a large ethnic Russian and Russian-speaking population, with some evidence of social tensions in Narva, but the situation is nuanced. Official Estonian statistics show that ethnic Russians comprise about 20 percent of the country’s population. In Narva, approximately 97 percent of residents speak Russian. The relationship with Russia in Narva, however, is nuanced. After Estonia regained independence in 1991, many ethnic Russians who had settled in Estonia during the Soviet period did not automatically acquire Estonian citizenship and instead had to obtain citizenship through naturalization. Consequently, in 2014, only about 46 percent of Narva’s residents held Estonian citizenship, while 36 percent held Russian citizenship. Some Estonian government policies have contributed to local resentment, and these kinds of social friction points attract the attention of Russian intelligence services. However, there is no evidence of broad support in Narva for joining Russia, and documented reports indicate otherwise.

Confirmed Risk: The “Narva People’s Republic” is thought to be a Russian information operation. The idea of a “Narva People’s Republic” is not purely hypothetical. The current online campaign appears to have emerged in 2025 and became active in February 2026, when social-media accounts began promoting the idea of Narva and Ida-Viru County separating from Estonia. In March 2026, Estonia’s Internal Security Service characterized the activity as an information operation intended to sow confusion and undermine social cohesion.

Confirmed Risk: Russian nationals continue to receive Schengen visas with a relatively low refusal rate. Russians continue to receive short-stay visas into the Schengen zone. Although applications from Russian nationals receive more scrutiny now than in previous years, in 2025 Russian nationals applied for 679,425 short-stay visas, and 630,641 were issued, including 175,862 multiple-entry visas. The refusal rate for Russian visa applicants was only 6.4 percent according to official European Commission statistics.

Confirmed Risk: Absence of coordinated internal immigration enforcement and interoperability challenges. In our scenario, the fragmented nature of internal immigration enforcement in the EU was the biggest identified risk, as it allowed Russian operatives to move from their initial countries of admission to other parts of the Schengen area. The Entry/Exit (EES) system, fully deployed in April 2026, is a significant step toward gaining an operational picture of who enters and exits the Schengen area. Still, it works best for securing the EU’s external borders and preventing re-entry by previous violators. Individuals who do not leave the EU on time are added to the EES “overstayers” list, which is available to the member state competent authorities. But the overstayer list is just that – a list. To move from list to action, an individual on the overstayer list would need to have a “return order” (the EU version of a deportation order) issued by the competent member state authority. The order would need to be entered in the Schengen Information System (SIS) promptly. At that point, member states would need to coordinate to share SIS alerts and apprehend the individual. That could be facilitated through the SIRENE (Supplementary Information Request at the National Entries) bureaus, 24/7 centers each member state operates to facilitate information exchange. All that is possible if the system works without flaws, but that is not the current operational reality. The European Commission acknowledged in its 2026 State of Schengen report that interoperability and coordination remain challenging. The report specifically points out that “further efforts are required across all Member States to address challenges related to the timely issuance of return decisions, the streamlining of procedures and the implementation of measures to prevent absconding and unauthorized secondary movements.”

Confirmed Risk: Absence of a single entity that monitors the EES overstayer list for emerging security threats. Building on the previous risk factor, I could not confirm in my research the existence of a single EU entity that systematically monitors the EES overstayer population for emerging national-security threats based on targeting criteria. While extensive mechanisms exist for sharing information once a person becomes the subject of a relevant alert, it remains less clear who is systematically examining the EES overstayer population for national-security significance before that threshold is reached. The EU has an entity with extensive experience coordinating Member State investigations and criminal intelligence: EUROPOL, the European Union Agency for Law Enforcement Cooperation. EUROPOL has access to EES data for law-enforcement purposes, but its current EES capabilities are primarily integrated into existing investigative and analytical functions. EUROPOL itself identifies the need for greater interoperability among the EU's large-scale information systems and states that, once the planned changes are implemented by 2027, it will be able to use EES and other systems to “support assessing the security risks associated with third country nationals arriving to Europe.” At present, therefore, I found no evidence of a centralized process dedicated to systematically screening the EES overstayer population for national-security indicators. In other words, the EU has built the haystack and mechanisms for sharing information about individual needles, but it is less clear who is systematically looking for the needles. And because the EES is still new, the size and characteristics of the haystack are not yet fully established.

VI. Recommendations

I deliberately fashioned this scenario to unfold as a Russian operation against NATO might: deliberately ambiguous, difficult to attribute, and accompanied by an aggressive information campaign designed to complicate the Alliance’s response. The incursion itself would not necessarily need to be militarily successful. If Russia could create a crisis that divided NATO, delayed a unified response, or exposed weaknesses in the Alliance’s ability to defend its territory, the crisis itself could constitute a strategic success. For that reason, the most effective defense is to prevent the scenario from occurring in the first place—by identifying the vulnerabilities that could make such an operation possible and closing those gaps before Russia can exploit them.

NATO and Estonia are doing many things well, including their strategy of “deterrence by denial,” and I will not spend time analyzing those efforts here. They should continue. My recommendations instead focus on less frequently recognized vulnerabilities outside the traditional military sphere that could still be exploited in a hybrid conflict.

Recommendation 1: Continue EU-wide coordination targeting organized criminal activity. A key element of the hypothetical scenario depended on Russian operatives gaining access to firearms through criminal networks. Organized crime can provide illicit infrastructure that terrorists, intelligence services, and other national-security threats may exploit. Continued EU-wide efforts to disrupt these networks therefore serve a purpose beyond traditional crime reduction: they deny hostile actors access to networks, resources, and capabilities that could facilitate operations inside Europe.

Recommendation 2: Eliminate tourist visas for Russian nationals and create a forward-deployed EU visa security program for high-threat regions. One of the larger gaps identified in this scenario is that Russian nationals still have legal avenues to obtain visas to enter the EU. My recommendation would be to stop issuing tourist visas to Russian nationals, with exceptions for limited humanitarian circumstances. The EU should also consider a uniform, EU-wide mechanism to systematically assess the security risks posed by visa applicants and incorporate those assessments into visa issuance decisions. While the EU has a sophisticated common visa-information system, including biometric screening and mechanisms for sharing information among Member States, responsibility for visa adjudication and national-security assessment remains distributed among national authorities. The United States provides one potential model. Through HSI’s Visa Security Program, trained special agents are assigned to diplomatic posts overseas to conduct law-enforcement interviews and identify terrorists and other national-security threats before they enter the United States. A comparable EU capability, whether centralized or deployed through participating Member States, could add an investigative and intelligence dimension to the existing European visa-screening architecture.

Recommendation 3: Establish a national-security immigration coordination center within an appropriate European agency. The EU should consider establishing a dedicated national-security immigration coordination capability within an existing agency such as EUROPOL. The center would proactively analyze the EES overstayer list and other relevant databases against current threats, identify concerning emerging patterns, centralize alerts concerning visa overstays and other significant immigration violations, and provide a mechanism for Member State coordination. Where an overstay or other immigration violation involves additional security indicators, the center could elevate the case for immediate coordination with the appropriate law-enforcement and intelligence authorities in the affected Member State. The objective would be to move beyond simply recording immigration violations toward proactively identifying those that may represent emerging national-security threats.

VII. Conclusion

The purpose of this exercise was not to predict that Russia will attack Narva, or that events would unfold exactly as described. It was to show how a deliberately ambiguous hybrid operation could exploit vulnerabilities outside the traditional military sphere. Russia would not necessarily need to defeat NATO on the battlefield. It could seek to create a crisis in which attribution is uncertain, information is contested, political leaders face competing pressures, and the Alliance must make consequential decisions under extreme uncertainty.

That is why prevention matters. Once armed men are occupying buildings in a NATO member state and information operations are shaping the narrative faster than governments can establish the facts, the opportunity to prevent the crisis has already passed. The objective should therefore be to identify the vulnerabilities that make such a scenario possible while there is still time to address them. NATO's military deterrence and Estonia's defenses remain essential, but closing the less visible gaps in Europe's immigration, intelligence, law-enforcement, and information-security architecture may be just as important in preventing the next hybrid crisis from becoming a reality.

At minimum, these measures would make it significantly harder for Russia, or any hostile actor, to establish the personnel, infrastructure, and freedom of movement needed to conduct such an operation inside Europe.

Disclaimer

The views expressed in this article are the author’s own and do not reflect the official position of the U.S. Department of Homeland Security, Homeland Security Investigations, or the U.S. government.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Muhammad bin Salman’s Humbling and the Return of the Ottomans

The Houthis bloodied Saudi Crown Prince Muhammad bin Salman’s nose—again—with their deadly, cruel, but effective attacks on Riyadh’s King Khalid International Airport last week. The strikes are the latest in a series of mostly self-inflicted setbacks—exacerbated by President Trump’s ill-considered war with Iran—that have frustrated the Crown Prince’s now decade-old aspirations to turn Saudi Arabia into a global economic, financial, and military powerhouse. Instead, MbS’s faltering economic reforms, combined with his bad bet on relying on Donald Trump as a security partner, are yet another reminder that Saudi Arabia is a weak state, dependent on and vulnerable to the whims of more powerful outside actors. And more than ever, the Saudis don’t have a good way out of that predicament.

The roots of MbS’s cascading problems lie in the early years of his de facto reign, which began in 2015, when he assumed the roles of defense minister and deputy crown prince. They stem from his personal arrogance and foreign misadventures, as well as his more admirable recognition—poorly acted upon—that the Saudi kingdom was, and remains, a relic in need of modernization and a future beyond hydrocarbons.

Over several years, MbS shattered Al Saud governing norms; alienated and pushed aside many members of the large and mostly indolent royal family; and sidelined the kingdom’s religious establishment (good riddance, say I). He also alienated neighbors such as Qatar and the UAE, ultimately to Saudi Arabia’s detriment, and started a war with the Houthis that he lost—and is now losing again.

MbS also unleashed much-needed economic and social reforms (women can now—gasp!—drive). The economy has gone from being mostly driven by government spending to being slightly less so. Homeownership is up, and unemployment among Saudis is down, according to IMF data. Nonreligious tourism grew from 2019 until last year, albeit from a low base. And Aramco’s kind-of, sort-of IPO in 2019 raised billions to support MbS’s ambitions in what was then the largest such offering in global equity history, although it now seems quaint beside the $85 billion SpaceX IPO.

But extravagant government spending in pursuit of unproductive, unachievable vanity projects (NEOM, anyone?) and MbS’s wild overestimation of the resources at his disposal are hobbling his ability to pursue the Vision 2030 economic reform program. And it turns out that, beyond the usual cadre of foreign finance bros and management consultants who are happy to bill the Saudi government by the hour or by the project, outside investors who could provide the capital and expertise needed to make the reforms viable are not convinced that Saudi Arabia is a place where they want to do business at the scale MbS needs. Net foreign direct investment in the kingdom last year was only about one-third of what the Saudi government had envisioned under Vision 2030. And, it goes without saying, 2026 is not proving to be a good year, with the IMF estimating that FDI will fall by about one-third.

The Crown Prince’s problems are not all of his own making, of course. But even so, his miscalculations have exacerbated the difficulties he is now struggling to address. The Iran war has scrambled the kingdom’s security and economic calculations, inviting Iran and its Houthi allies to prey on a country woefully unprepared for conflict despite decades of profligate but mostly ineffectual defense spending. The extravagant welcome MbS accorded Trump in Riyadh early last year has gained the Saudis mostly nothing. It’s not just that the Saudis—and other Gulf potentates, to be sure—assess that President Trump has treated them shabbily. It is that the American military has so far proved unable to achieve anything better than a stalemate against a third-rate regional power—Iran—with all the implications that sad fact holds for the region and for our global standing and credibility.

So where does this leave the now-middle-aged Crown Prince and the country he rules as he contemplates the coming decades of his reign? Recalibrating and scrambling, to be sure. Many of the investment megaprojects that were once cornerstones of his Vision 2030 program are dead or on life support. Three prominent examples are the now-bankrupt, Saudi-financed LIV Golf league; The Line at NEOM; and the absurdly overpriced, vanity-driven $50 billion giant cube, the Mukaab in Riyadh. And the economic pain is bleeding into other prestige projects as well, including the postponed (read: canceled) Asian Winter Games originally scheduled for 2029. The tens of billions spent—and the tens of billions more not spent because the country can’t afford it—have left the Saudis mostly where they were after all their past failed efforts to diversify the economy: reliant on hydrocarbons to sustain it and pay the government’s bills. Vision 2030 has changed that at the margins (and the vibes of living in and visiting the country are certainly different), but not in a fundamental way.

Compounding MbS’s woes, of course, is the regional security earthquake brought about by Trump’s Iran war. The United States is receding and retreating from its role as regional hegemon and the Crown Prince can be under no illusion that this will change after Trump leaves office in 2029. The Saudi brand is toxic among Democrats, and the emergence of the US as the global energy superpower under President Obama and during the first Trump administration has fundamentally changed the relationship between Riyadh and Washington. So, again, Riyadh is reduced to trying to do what it has always been forced to do: seek outside protection while also accommodating its adversaries.

The Crown Prince’s options are not good. His much-vaunted security agreement with Turkey and Pakistan demonstrates how poor his alternatives are to the now-defunct Pax Americana—and must also be personally humiliating. After all, one of his putative new protectors, President Erdoğan, gleefully embarrassed the then-young Crown Prince after Saudi agents murdered Jamal Khashoggi in Turkey in 2018. And anyone who has spent time in the kingdom knows well the lingering distaste for—and insecurity about—the country’s former Ottoman masters. As for Pakistan, it takes little imagination to understand how that benighted and impoverished country is viewed by the kingdom’s ruling family.

At a more practical level, Turkey and Pakistan will never replace the military capabilities of the United States, and both countries’ commitment to their new security agreement will be limited by the simple fact that Iran holds them at risk as well. Riyadh’s security strategy will probably closely resemble its current response to the Houthi threat, as detailed in a recent Wall Street Journal article: scouring the globe for weapons to defend against missiles and drones, contemplating hiring mercenaries to fight in Yemen in lieu of Saudi forces that are demonstrably not up to the task, and quietly seeking an accommodation with the Houthis to try to make the whole thing go away. In a region fundamentally altered by the US-Iran war—with US credibility as a security partner in tatters and Iran emboldened, if weakened—good luck with that.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The Day We Cannot Choose

Washington made three decisions this week, and none of them has an end date. On the night of October 14, Ukrainian units in the field found that their Starshield terminals had been capped at a speed, 160 kilometers an hour by the published figure, 70 by President Zelensky's account two days later, which cuts off any strike drone that flies faster than the cap. Reuters reported, citing American and Western officials, that the order came from inside the White House; a senior official said the President had made no such request. Service was reported partly restored by October 15. No terms were ever published. The restriction followed a week in which American negotiators had warned Kyiv that intelligence sharing could be suspended if strikes on Russian energy targets continued, and in which the President announced an "energy ceasefire," which President Zelensky said was "news for me." Ukraine paused its refinery campaign for three days. On October 15, Zelensky told the Financial Times, "We're done," and that morning Rosneft's Ryazan refinery burned. The same day, CNN reported that Ukraine had run out of Patriot interceptors.

Two days later, on Friday afternoon, the President signed an executive order implementing the sanctions act passed by Congress in September. Its second section imposes what the law required by October 18: a 500 percent duty on Russian goods and a 100 percent duty on goods from any country that continues buying Russian crude or gas. Its fourth section waives both, along with eleven other sections of the act, until the President or the Secretary of State decides otherwise. The order names no country, mentions no fuel, and sets no date. The White House said enforcement now "would impede" the search for peace. Diesel in the United States stood at $6.33 a gallon on Saturday, higher than on the day the Russian diesel license was issued.

Last week, in these pages, I argued that no single authority in Washington was charged with weighing the sanctions against the price of fuel, and that whichever claim had the nearest deadline would win. This week, the President himself weighed the claims, and the ranking is visible in the two documents: the diesel license and the peace track outranked the statute, and the ally's campaign was slowed to protect them. Washington gave the peace track as its reason for the first and denied ordering the second. Whatever each was meant to do, both eased the pressure on Moscow in the weeks before November 3. That is a decision, and it bound the only party it could reach, the ally. It is also the week's lesson, because of what it did not contain.

It contained no horizon. The waiver has no end date. The throttle has no published terms. The diesel license runs through April. Each can be reversed by the same hand on any morning, which means none of them bind the party across the table; they inform him. Moscow learned that a license and a telephone call can buy a pause in the campaign against its refineries. Beijing, which must decide by November 10 whether to extend the suspension of its rare-earth licensing rules for American buyers, learned the price at which American pressure lifts, a month before the President arrives in Shenzhen. New Delhi, the act's principal target, received a waiver that asks nothing of it. And every ally that fights on an American-controlled communications or targeting layer learned that the layer can be set to a speed, without announcement, and that the setting is deniable. The European Union's foreign policy chief said the following day that Europe cannot replace Starshield in the short term.

The parties for whom the pressure was built spent the week waiting. Russia's first licensed diesel cargo, 40,000 tons loaded at Primorsk, sailed for Morocco. The volumes could not have moved the American price in any case: the 300,000 tons promised "immediately" are less than a day of American consumption. Tehran kept the American counterproposal under review and held to its sequence, the strait first and enrichment after, while flows through Hormuz ran at 11.6 million barrels a day, down from a pre-war 17.2, and a Singapore-flagged container ship sank, its port authority confirmed, after being struck. The International Energy Agency reported the world's oil stocks 509 million barrels below their pre-war level and agreed on Thursday to release what remains of the barrels pledged in March. Economic warfare is now being fought on two clocks. The West's runs to its elections and its inventories. The other side's runs to neither.

There is precedent for winning a contest of this kind, and it was won by time rather than force. In June 1948, the Soviet Union closed the roads and railways to West Berlin. The Western allies responded with an airlift. The blockade was lifted on May 12, 1949, after eleven months, not because the aircraft had defeated anything, but because Moscow concluded that the West could hold its position longer than Moscow could sustain the blockade. The instrument that prevailed was the horizon, and the West had shown it could keep it.

The remedy I named last week, a single authority to rank competing claims, turns out to be necessary but not sufficient. The authority existed this week and used itself. What it lacked was a commitment that outlasts the next election: a stated date and condition under which the pressure lifts, a provision of fuel and interceptors that carries the country to that date, and an officer beneath the President charged with holding the ranking when the price of diesel argues for changing it. In practice that is a sunset clause: the waiver expires on a date unless the President certifies to Congress why it should not. A sanction without a horizon is a disclosure. A satellite link without published terms is a lever on the ally rather than the adversary.

If you advise on these instruments, the decision you owe this quarter is a horizon. Before the next sanction is signed, the next license issued, or the next allied system switched on, put the date in the document: the condition under which the pressure ends, the provision that carries you there, and the office that holds the line until it arrives. The side that can wait chooses the day. This week, it was not ours.

Richard Berry is the founder and principal of Stratnova Advisors and a former Senior Executive who led the Commander's Action Group at U.S. Indo-Pacific Command; he publishes the weekly assessment Strategic Horizons.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

How Far Should the U.S. Go to Defend Saudi Arabia?

Recent deadly attacks by Yemen's Iranian-backed Houthis inside of Saudi Arabia have raised questions about just how far the U.S. should go in helping to protect the Kingdom. We spoke with former National Intelligence Manager for Iran at ODNI, Norm Roule , who travels regularly to the region for meetings with senior leaders and asked him to help us better understand the realm of possibility.

The Cipher Brief: What exactly can the United States provide to or undertake for the Saudis that the Kingdom cannot do on its own?

Roule: The Royal Saudi Air Force is experienced, well-led, and well-resourced with advanced technology, and it can draw on a deep relationship with U.S. Central Command (CENTCOM). Riyadh also has decades of experience dealing with Yemen. Its understanding of Yemen’s political, tribal, and military landscape is as granular as one could reasonably hope. Saudi officials responsible for managing this portfolio have repeatedly sought political and diplomatic solutions with the Houthis and other Yemeni factions. The failure of these efforts reflects Houthi unwillingness to make necessary compromises more than any lack of effort on the part of the Saudis or the United Nations. It should also be remembered that the Saudis have sought Western and international engagement on this issue for years, just as they have warned repeatedly of the consequences of allowing the Houthis to acquire sophisticated ballistic missile and drone capabilities with Iranian assistance.

In terms of the ongoing conflict, Washington has reportedly responded robustly to Saudi requests for support, providing munitions, maintenance, intelligence, and other assistance needed to improve operational effectiveness, protect personnel, and minimize civilian casualties. There remain areas in which the United States and other partners can provide additional capabilities that would likely be welcomed by the Kingdom, particularly in integrated air and missile defense, early warning, intelligence collection, and replenishment of interceptor inventories. These capabilities are particularly important given the challenge of defending against coordinated missile and drone attacks, including attacks designed to overwhelm defensive systems. The United States can also assist in identifying and disrupting the networks responsible for supplying the Houthis with missile and drone components.

We must also distinguish between Saudi air superiority from the ability to locate and destroy dispersed, mobile, or concealed Houthi missile and drone capabilities. There is no public evidence that Saudi aircraft are unable to meet their current targeting requirements or that direct U.S. air operations would fundamentally change the course of the conflict. The question is whether there are specific military capabilities or operations that Washington can provide that would materially improve Saudi security beyond what Riyadh and its Yemeni partners can accomplish themselves.

A comment on the GBU-43/B Massive Ordnance Air Blast bomb (MOAB). Unlike the GBU-57 Massive Ordnance Penetrator, which is designed to destroy reinforced or deeply buried underground facilities, the MOAB is an airburst weapon that detonates just above the ground. Its principal value lies in its devastating effects against concentrated personnel and exposed targets, its potential effectiveness against certain cave and tunnel complexes, and its considerable psychological impact on enemy forces and their leadership.

One can envision circumstances in which such a weapon might be useful in Yemen, including against certain underground missile storage facilities, manufacturing locations, or concentrations of Houthi missile and drone operators. However, its effectiveness would depend on the characteristics of the target, including the depth and reinforcement of underground structures. It is unlikely to resolve the broader missile and drone threat, much of which depends on mobile launchers, dispersed equipment, and facilities that may be difficult to locate. Its employment would also require consideration of potential civilian casualties. Most importantly, its use makes sense only if suitable targets exist that cannot be addressed as effectively by Saudi or Saudi-supported Yemeni government operations, and if we judge that destroying those targets would materially alter the course of the conflict without risking broader U.S. involvement.

The Cipher Brief: How would direct U.S. involvement in Yemen affect our operations against Iran?

Roule: Iran remains, and should remain, the principal focus of our military efforts in the region. Tehran would welcome nothing more than an American decision to become embroiled in another regional conflict. Although not all military assets or munitions are interchangeable, additional commitments of aircraft, intelligence capabilities, logistical support, and senior military attention to Yemen could divert resources that might otherwise support operations against Iran. This is particularly important given the demands of maintaining the blockade, securing the Strait of Hormuz, conducting defensive operations with our Gulf partners, and potentially preparing for expanded operations against Iran itself.

We should not, however, assume that every action against the Houthis would necessarily weaken our campaign against Iran although we do need to consider the cost to broader U.S. military requirements. The Houthis remain one of Tehran’s most important instruments of regional coercion, and effective measures to reduce their ability to attack Saudi Arabia could reinforce our broader strategy against Iran. The issue is whether the military and strategic benefits of any proposed American operation against the Houthis would justify the resources involved and the risks of escalation. This requires distinguishing limited defensive assistance, which could strengthen our regional posture, from offensive operations that might require a sustained American military commitment.

Direct U.S. military involvement against the Houthis would also risk unraveling the existing U.S.-Houthi ceasefire and exposing American forces to renewed attacks, potentially setting off a chain of events that could lead to another open-ended military campaign. Our engagement with the Houthis to sustain the ceasefire may not be attractive symbolically, particularly as Houthi attacks against Saudi Arabia continue. But the arrangement has preserved American military resources and operational flexibility for the confrontation with Iran. We should not abandon that advantage without compelling evidence that doing so would produce meaningful strategic gains.

The Cipher Brief: This is a tricky situation. The U.S. wants to be seen as a strong and reliable security partner, but Houthi attacks against Saudi Arabia are likely to continue. How can the administration walk this line?

Roule: The Administration will need to thread this needle carefully. It has reportedly intensified its already extensive discussions with Riyadh concerning what more can be done to protect Saudi lives, airspace, critical infrastructure, and energy facilities against continued Houthi attacks. The Kingdom’s security is not simply a matter of regional symbolism or alliance credibility. Attacks against Saudi territory threaten civilian lives, economic activity, international aviation, energy infrastructure, and the Kingdom’s ambitious economic transformation. This has a national, regional, and even global impact. Saudi Arabia’s ability to defend itself against these threats is critical to American national security and economic interests.

Our support will need to become more visible, particularly as the Saudis face growing domestic and regional expectations that their security partners will respond to attacks on the Kingdom. But visibility must be accompanied by meaningful results. Additional air and missile defense capabilities, intelligence cooperation, replenishment of defensive munitions, and measures to disrupt Houthi weapons supply networks may ultimately offer greater strategic value than direct American strikes. These measures would also demonstrate that Washington takes Saudi security seriously without necessarily expanding the American military commitment.

A MOAB strike would certainly attract attention and demonstrate American willingness to employ overwhelming force. But visibility alone is not a measure of military effectiveness or strategic success. Any such operation must be judged by whether it would significantly degrade Houthi capabilities, deter further attacks, or otherwise change the course of the conflict. A dramatic strike that fails to reduce the Houthi threat could actually weaken deterrence by demonstrating the limits of American military power. Conversely, a carefully selected operation against a critical Houthi capability could reinforce deterrence if its military benefits justified the risks.

The larger objective must remain to demonstrate that the United States is a dependable security partner without allowing the Houthis, and ultimately Iran, to draw us into another costly and potentially open-ended conflict. We should do everything possible to support our Saudi partners in defending their people, territory, and critical infrastructure against Houthi attacks. But our actions must be designed to achieve meaningful military and strategic results while preserving the resources and operational flexibility needed for the confrontation with Iran. Protecting Saudi Arabia against Iranian-supported aggression should reinforce, not undermine, that effort. Iran remains our principal adversary, and bringing that confrontation to a successful conclusion must remain our primary objective.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Who Really Makes Decisions in Tehran?

Ayatollah Ali Khamenei’s death led to greater decentralization of the regime and a more collective, securitized decision-making system. In Iran today, authority is distributed across several actors and groups, in which the military-security network has gained disproportionate agenda-setting power.

There has been much speculation about how decisions are made in Iran following the death of Supreme Leader Ali Khamenei. There has been a diffusion of power since his demise and the elevation of his son Mojtaba Khamenei as his successor. To understand current leadership dynamics in Tehran, there are three overlapping levels to consider: individuals, institutions, and networks. Increasingly, they all operate around one overriding concern: regime survival.

The result is the transformation of the Islamic Republic from a more personalized leadership at the end of Ali Khamenei’s rule to a more security- and military-centered form of collective leadership. While certain individuals are on display, institutions still organize and implement decisions. Crucially, a network of power shapes and provides policy choices for decision-making. Because of war and instability, the security and military network has ultimately become the most powerful among others.

At the first level of decision-making stands individuals. When Ali Khamenei was alive, he was the final arbiter on matters of strategy and policy. After his death, power has become more diffuse. This is especially true given that his son and successor Mojtaba Khamenei has been neither seen nor heard from since his elevation as supreme leader. This has left the Iranian system releasing old archival images of Mojtaba Khamenei, written statements, and in one case a purportedly handwritten note to the commander of the Islamic Revolutionary Guard Corps (IRGC) Aerospace Force to create the impression that he is in charge.

Additionally, Iranian officials like President Masoud Pezeshkian have recounted only a few hours-long meetings with the new supreme leader, which are hard to verify. Other regime figures like Mojtaba Khamenei’s mother-in-law have insisted he was present at the burial of his father despite no videographic or photographic evidence that he was there. A clerical speaker at one recent nighttime rally in Tehran recently suggested the new supreme leader was at the rally just 30 minutes before he spoke.

Despite these attempts to portray Mojtaba as in command, already, reports have circulated of demoralization among the Islamic Republic’s core base in Iran with a supreme leader who is absent from public view. This is a sea change in the way Iran has operated since 1979. An accessible and visible supreme leader always served as the glue which held the Iranian establishment together. Ali Khamenei was a regular presence on state television—and Iranian officials often interpreted his public remarks as directives. Today with Mojtaba Khamenei absent, this is growing more difficult and has added confusion. As one former IRGC officer recently told Iran Wire, “now, if Mr. Mojtaba issues an order, it reaches officials through intermediaries, leaving everyone uncertain whether the message was distorted along the way. Officials trust one another even less than before; small cliques based on family or personal ties have formed.”

Today the individuals comprising key decision-making and shaping include Secretary of the Supreme National Security Council (SNSC) Mohsen Rezaei; Chief Justice Gholamhossein Mohseni-Ejei, IRGC Commander-in-Chief Ahmad Vahidi, President Masoud Pezeshkian, Speaker of Parliament Mohammad Bagher Ghalibaf, and Chief of Staff of Iran’s Armed Forces Ali Abdollahi. Within this circle of power, the IRGC plays an outsized role. This group also has interpersonal dynamics which impact strategy. Rezaei and Ghalibaf are both outsized personalities who have harbored competing political ambitions. Ghalibaf and Abdollahi are longtime associates, with Abdollahi having been promoted to a variety of state positions under Ghalibaf’s tutelage. Vahidi served under Rezaei when he headed the IRGC. Pezeshkian and Foreign Minister Abbas Araghchi are likely more eager for an immediate diplomatic settlement given their roles in day-to-day state administration than the IRGC’s top brass like Vahidi, who may believe time is on the Islamic Republic’s side and is more interested in reestablishing deterrence.

After the individuals, come the institutions that administer the country and make strategic decisions. The presidency and ministries remain important for daily governance and implementing state strategy. But when it comes to matters of national security and regime survival, the center of gravity shifts towards the military-security establishment. The SNSC connects the political, military, intelligence, and bureaucratic institutions.

Behind these institutions lay informal networks based on family, personal, and professional ties, especially those who fought wars together like veterans of the Iran-Iraq War. Within the military-security establishment, these ties are embedded in the IRGC, the Intelligence Ministry, and among military commanders. Within the economic and political class, these networks prevail among state-linked companies, parastatal foundations, contractors, oil traders, financial intermediaries, and sanctions evaders.

The clerical elite also maintains significant ideological and religious networks, especially within seminaries, among Friday Prayer leaders, and the many overlapping propaganda institutions of the Islamic Republic. Bureaucratic-technical elites also have networks, among diplomats, economists, engineers, nuclear experts, and administrators who make the government run.

These networks matter because they shape what information reaches the decisionmakers in Iran, how threats are defined, and which policy options are considered palatable. Disagreements do exist, but they, for now, remain concentrated on tactics, not grand strategy. All are committed to the founding principles of the Islamic Republic. For example, diplomats may favor negotiation. Economic officials will emphasize the costs of war. Military commanders will prioritize deterrence. Ideological actors will resist compromise and fear infiltration of American and Western mores. These factors are weighed by the Islamic Republic through the lens how best to preserve the system. Likewise, while disagreement is genuine, the actors do not all have equal influence.

The war with the United States and Israel has accelerated securitization. Economic unrest, social protests, information, foreign policy, and nuclear policy are all viewed as security issues. As threats increase, security institutions gain influence over areas previously dominated by civilian institutions.

In this mix, Iran’s national interests and the survival of the Islamic Republic are not always identical. A policy may appear economically irrational but still be political rational if leaders believe it protects the regime. The central paradox confronting Iranian leaders is that Tehran has incentives to end a costly conflict, but also incentives to avoid an agreement that looks like surrender or demonstrates weakness. The late Supreme Leader Ali Khamenei often looked to the example of the collapse of the Soviet Union and the reforms undertaken by Mikhail Gorbachev like perestroika and glasnost as mistakes. The lesson Khamenei took away from these experiences is such reforms invite weakness, which the West preys upon and this could facilitate the end of the Islamic Republic. Such logic likely continues to animate Iranian decisions.

Whether Mojtaba shares his father's ideology is not as important as Khamenei’s institutional legacy that his worldview has left behind. This is the logic of what we call the Islamic Republic 3.0. In the Islamic Republic 3.0, there is a greater diffusion of power where individuals decide, institutions organize and implement, and networks shape the choices. Power is increasingly shifting toward the security establishment.

For policymakers in Washington, this has important implications; who makes decisions in Iran no longer has a simple answer. When the bombs hit the Office of the Supreme Leader in February 2026, Araghchi was briefing Khamenei’s security advisor Ali Asghar Mir Hejazi on recent talks with Washington. But today, Araghchi admitted over the summer that he had never had a personal interaction with the new supreme leader and Mojtaba Khamenei has not announced advisors to replace Hejazi, whom was reportedly opposed to his ascension as supreme leader.

If President Trump were to renew military action against Iran after the midterm elections, U.S. policymakers would need to confront these new layers of decision-making to further weaken the regime. Should decapitations form part of these operations—as was the case during Operation Epic Fury—solely striking Supreme Leader Mojtaba Khamenei would not suffice to weaken the regime even more. U.S. bombing would need a more expansive approach, targeting entire institutions like the SNSC.

Araghchi himself signaled this vulnerability in the regime during an interview in July with journalist Javad Mogooyi. He said, “The regime would collapse if all members of the SNSC are hit, which is why they never met at once during the war.” This would entail precise intelligence and targeted killings of individuals like the SNSC secretary, president, foreign minister, intelligence minister, chief justice, speaker of parliament, chief of staff of the armed forces, and the commanders-in-chief of the IRGC and Artesh. Additionally, aiming at the second and third layers beneath each of these figures would be required.

This is because not only would individuals on the SNSC be eliminated, but an entire institution would be decapitated. And the networks that fed into those members would be severed.

Saeid Golkar is the UC Foundation associate professor of political science at the University of Tennessee at Chattanooga and a senior advisor at United Against Nuclear Iran. Jason M. Brodsky is the policy director at United Against Nuclear Iran.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The Soviet Roots of Russia’s Modern Disinformation War

Anti-Semitism, the Rev. Dr. Martin Luther King Jr. pronounced while repudiating an anti-Israel resolution adopted at the 1967 National Conference for New Politics, is “immoral.” Accordingly, the civil rights leader would surely have been dismayed at the prevalence of that age-old prejudice in the wake of the barbarous October 7, 2023, terrorist attack on Israel. Nor would he necessarily have accepted the cynical camouflaging of anti-Jewish prejudice as “anti-Zionism.” At an October 1967 dinner, according to sociologist Seymour Martin Lipset’s later eyewitness account, King rebuked a student: “When people criticize Zionists, they mean Jews. You’re talking anti-Semitism!”

Moreover, Dr. King saw the fight against that age-old hatred as congruent with the civil rights struggle. In a June 1965 message, he wrote, “We deplore anti-Semitism as we deplore discrimination and segregation in Mississippi and Alabama." Given his awareness of Soviet intelligence attempts to discredit him by portraying him as an “Uncle Tom” secretly receiving U.S. government subsidies, King might also have recognized the pattern identified by the U.S. Department of State’s Global Engagement Center: after October 7, the Kremlin fanned “the flames of antisemitism” while seeking to “discredit, divide, and weaken” its adversaries, particularly the United States.

It was not surprising that members of the so-called “Axis of Autocracies”—united by a common antipathy toward the United States—would mount influence operations aimed at exploiting that awful day. China, for its part, seeks to portray the United States as a violent, racist, politically riven, dysfunctional, declining power. As part of a state-linked operation, Chinese actors pretending to be Americans have leveraged divisive issues—including the Israel-Hamas war—to portray the United States as a country with weakleadership and a failing political system. This covert messaging campaign has been augmented by the distribution of more inflammatory material—including provocative memes and AI-generated images—on Western-facing Chinese diplomatic and state-affiliated accounts.

Iran has been much less subtle in its post-October 7 influence operations. Iranian actors have deployed fake personas, sock-puppet networks, hacked material, and cyber operations designed to support Hamas and discredit Israel. Neither the tone nor the aggressiveness of those actions is unexpected, given that Tehran’s ideological messaging—in accord with that of its terrorist proxies, Hezbollah, Hamas, Palestinian Islamic Jihad, and the Houthis—has long been premised on cries of “death” to the “Great” and “Little” Satans. Publicly available information does not establish that Moscow, Beijing, or Tehran created, directs, or controls the broader movement being advanced by an unholy coalition of the radical left and Islamists. Those governments have, however, identified and amplified real divisions in American society, often injecting poisonous content into them.

Of the latter-day Axis states, Russia has been especially forceful in its post-October 7 influence operations. After Hamas’s attack, Russian state media and Russia-linked covert networks rapidly exploited the war to promote anti-American themes and exacerbate tensions among the parties. Russian actors circulated manipulated videos and false stories, including fabricated claims that Ukraine had supplied Hamas with Western weapons. Some material was deliberately designed toresemble reporting from legitimate Western media. According to the Department of Justice (DOJ), in 2024 the Russian government directed a “Doppelganger” influence operation that used fake personas, paid advertisements, fabricated media brands, and websites designed to impersonate legitimate U.S. news organizations; internal planning documents also contemplated AI-generated content. The operation’s goals included sowing division inside the United States, weakening support for U.S. foreign policy, and underminingAmerican relationships with allies, including Israel.

Russian intelligence services and Kremlin-directed influence organizations clearly regard anti-Semitic, anti-Zionist, and Israel-related polarization as exploitable American vulnerabilities and have demonstrated the capability and intent to amplify such divisions. Moscow has taken a pro-Palestinian position on the Israel-Hamas war while promoting conspiracy theories, ethnic tensions, and politically inflammatory narratives. Russian messaging fuels American domestic discord by hammering home claims—such as “Zionists control Washington”—that appeal to parts of the far left, far right, and isolationist middle. It also seeks to reinforce pernicious narratives that the United States causes instability; that its position on Israel exposes Western hypocrisy; that Ukraine and Israel receive Washington’s support while Americans suffer at home; and that the United States cannot be trusted asan honest broker in international affairs.

That the operational methodology Russia employs in pursuit of these goals reflects Moscow’s long-standing “active measures” (‘aktivnyye meropriyatiya’) doctrine—identifying divisions, entering debates through apparently legitimate accounts, intensifying antagonism, encouraging opposing groups to distrust one another, and thereby weakening social cohesion—is no accident. Like many Russian intelligence operations, Moscow’s current active-measures program has roots in the Soviet era. After Israel’s victory in the 1967 Six-Day War, the KGB’s Service A intensified an anti-Israel active-measures campaign that has echoes today. Cold War Romanian intelligence officer Ion Mihai Pacepa later described part of that campaign as “Operation SIG,” intended to undermine support for Israel, damage U.S. influence in the Middle East, and widen the political divide between Washingtonand the Arab and Muslim worlds.

According to Pacepa, “SIG”—derived from the Russian phrase for “Zionist Governments” (‘sionistskoye gosudarstvo’)—was a clandestine propaganda and disinformation effort directed against Israel and its principal supporter, the United States. After Soviet-aligned Arab states were soundly defeated on the battlefield, Moscow sought to reframe the Middle East conflict, portraying Israel not simply as an Arab adversary but as an imperialist, colonialist, and racist extension of American power. Pacepa attributed to KGB chief Yuri V. Andropov the statement that the KGB “needed to instill a Nazi-style hatred for the Jews throughout the Islamic world.” The instruments available to Service A for clandestinely disseminating this theme included forged documents, front organizations, agents of influence, covert political support, and manipulation of foreign media. According to Pacepa’s account, those tools were used to place stories in sympathetic or controlled media, circulate inflammatory literature, exploit existing anti-Semitic material, provide covert assistance to organizations capable of repeating Soviet themes, and amplify them through Soviet-bloc and developing-world media.

Operation SIG sought to establish several mutually reinforcing propositions: that Israel was an illegitimate imperialist, colonialist state; that Zionism was inherently racist; that Israel and the United States constituted a single strategic enemy; and that the Palestinian struggle formed part of a worldwide “national liberation” movement. Indeed, according to KGB foreign-intelligence archivist Vasili Mitrokhin, “Zionism was second only to the United States (‘the Main Adversary’) as a target for KGB active measures.” As with other active measures, success could come from polarization, repetition, and erosion of confidence in an adversary’s motives, thereby improving Moscow’s geopolitical standing and influence. This constituted less a single disinformation story than a sustained campaign that developed and clandestinely circulated a narrative, placing it through ostensibly independent sources, encouraging sympathetic organizations to repeat it, and relying on repetition to confer apparent legitimacy. The objective was not necessarily to persuade audiences to accept every assertion. Rather, it was to establish a narrative that undermined the American position in the Middle East by portraying Washington as incapable of acting independently of Israel.

There is a striking thematic resemblance between several narratives promulgated by Operation SIG and rhetoric now used by some far-left, revolutionary socialist, anti-Zionist (a euphemism for raw anti-Semitism), and Islamist activists in the United States. The resemblance is reflected in a number of fallacious, often contradictory propositions: Zionism equals racism; Israel is a settler-colonial state; Zionism is tied to fascism; Israel is an instrument of American imperialism; “Zionists” control U.S. policymaking; Israel is an imperialist outpost; the United States and Israel constitute a single oppressive system; and violent Palestinian or Iranian-aligned “resistance” is part of a broader anti-imperialist struggle. This does not mean that Moscow controls today’s American protest movement.

What is, however, demonstrably true is that the recycling of an ideological vocabulary—albeit with the mendacious substitution of the label word “Zionist” for “Jew”—that Soviet active measures spent decades promoting internationally lives on in that movement and the language it employs. Operation SIG is illustrative of a fundamental principle of Soviet disinformation that continues in Russian operations today: Do not manufacture a grievance when an authentic grievance can be weaponized. The most effective active measure rarely invents an issue from nothing. It identifies a genuine conflict or prejudice and then manipulates, radicalizes, and internationalizes it.

Apart from the deliberate perversion of the historical significance of the Holocaust with the antithetical assertion that Israel’s justifiable response against those who conceived, directed, and participated in the heinous October 7 attack constitutes genocide, the chief difference between what the KGB did in SIG and what Russian intelligence is doing today is the speed with which disinformation and propaganda can now be created and disseminated. Whereas the KGB of the 1970s needed agents of influence, front organizations, controlled newspapers, forgeries, clandestine payments, friendly Communist parties, and sympathetic journalists willing to place stories that could take months to prepare and be circulated widely enough to have an impact, its Russian successors can utilize social media, fake Americans, AI-generated photographs, deep-fakes, bot networks, controlled influencers, and algorithmic amplification to spread disinformation themes at scale in a matter of hours.

In so doing, Russian intelligence systematically takes the most incendiary versions of American political arguments and makes them appear more popular, more widespread, and more authentic than they really are. The originating intelligence service no longer needs to control the narrative. Once an ideological concept becomes embedded in political culture, an active measures operation can become self-sustaining as genuine activists reproduce it voluntarily.

Building on Operation SIG, our adversaries are turning our democratic system inside out by using against us the freedom of speech we value and that is anathema to them. To those who argue today—as they did in his day—that the enlightened and anti-racist could not succumb to anti-Jewish prejudice, George Orwell had a rejoinder. “People of left opinions,” he wrote in 1945, “are not immune to it.” Revolutionary Marxists, progressive anti-colonial activists, Palestinian nationalists, and some imported Islamist or Iranian-aligned activists are converging around a common concept: “Anti-imperialism.” Organizations whose underlying ideologies would otherwise appear incompatible are united by hatred for the U.S., its democratic ideals, and its history. They also share a very thinly veiled anti-Semitic worldview and a common desire to destroy Western civilization.

In his landmark 1963 Letter from Birmingham Jail, Dr. King reminded us that "Injustice anywhere is a threat to justice everywhere” and that “We are caught in an inescapable network of mutuality, tied in a single garment of destiny. Whatever affects one directly, affects all indirectly.” Although those words addressed the evil of segregation, King later explicitly invoked the Holocaust in the same letter. Explaining the distinction between law and justice, he observed that Nazi persecution was carried out under German law, whereas resistance to it was illegal. He then declared, “Had I lived in Germany at the time, I would have aided and comforted my Jewish brothers.”

King’s words provide an appropriate warning for our own time. The lesson of Operation SIG is not that Moscow created anti-Semitism or the political divisions concerning Israel, but that an adversary can identify such divisions, sharpen them, legitimize their most poisonous expressions, and ultimately induce others to propagate them voluntarily. What once required the KGB years of painstaking active measures can now be accomplished—and amplified globally—in hours. In such a milieu, Orwellian inversions of the truth can be made to appear more plausible for the very simple reason that they are delivered to target audiences before any countervailing argument can be mustered.

The danger, therefore, lies not simply in Russian, Chinese, or Iranian disinformation, but in our willingness to become its unwitting agents of influence. A democratic society cannot defeat foreign propaganda by abandoning the freedoms that distinguish it from its adversaries. It can, however, recognize when old prejudices have been repackaged in fashionable political language and refuse to lend them legitimacy. King understood that anti-Semitism was not made less immoral by the ideology in which it was cloaked. Nearly sixty years later, that remains a lesson worth remembering.

All statements of fact, opinion, or analysis expressed are those of the author and do not reflect the official positions or views of the US Government. Nothing in the contents should be construed as asserting or implying US Government authentication of information or endorsement of the author's views.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Europe’s Changing Politics and the Future of U.S. Leadership

“And now, there is war again. There is new competition between great powers. There is vulnerability, aggression, terrorism, a whole universe of new threats and attacks again. And so, we must rebuild our institutions and our alliances to face these threats together.” From Secretary of State Marco Rubio’s October 7th speech in Greece, at the Acropolis. Mr. Rubio’s excellent speech should be mandatory reading for high school and college civics classes.

Mr. Rubio’s message was clear: He warned that Western nations are at a critical inflection point, facing a choice between maintaining global leadership or sliding into “atrophy, servitude, and decline”.

Francesco Sisci, a Sinologist and Director of Rome’s Appia Institute, says America is failing to exercise leadership and is pushing Europeans toward China.

Recent public opinion polls and surveys across Europe show shifting views in how Europeans view the U.S. and China.Trust in the U.S. alliance and traditional transatlantic ties has dropped significantly, while public favorability toward Chinese leadership in some European nations has occasionally edged higher than views of U. S. leadership.

Some of this can be attributed to the U.S. pivot to Asia during former President Obama’s presidency, with many in Europe thinking the U.S. focus shifted from the transatlantic relationship to Asia.This pushed the Europeans toward a China that projected a message of success, with modern technologies and new infrastructure.

However, the Europeans discovered there are drawbacks when dealing with China. China’s currency, the Renminbi (RMB), is not freely convertible, restricting cross-border movement of investments, stocks, bonds, real estate, and loans. And their territorial claims to Taiwan and the South China Sea are issues of concern in Europe, as is China’s support to Russia and Iran.

On October 9, the European Union (EU) and China reached a landmark interim trade agreement to curb the influx of Chinese vehicles, avoiding a full-scale trade war. The EU and China established a 16-point consensus aimed at balancing an unsustainable European trade deficit with China.

Another European concern is the rise of right-wing populist and nationalist parties. This trend is highlighted by the Alternative for Germany (AfD) successes in eastern states like Saxony and neighboring Saxony-Anhalt.Many view this shift as a critical threat to EU solidarity and democratic institutions, while hard-right factions celebrate it as a democratic mandate against failed mainstream policies.

What’s driving this shift? In Germany, a geographic and political divide has placed eastern states at the forefront of the country’s rightward shift. This shift is fueled by sharp economic anxieties and intense anti-immigration sentiment and a perceived detachment of the ruling coalition in Berlin. This has normalized AfD support across a broad voter segment, especially young people.

Germany’s domestic intelligence agency has formally designated the AfD branches in Saxony and Saxony-Anhalt as “confirmed right-wing extremist” organizations.

Centrist governments in Europe are alarmed by the pro-Russian, anti-NATO, and anti-Ukraine-aid rhetoric from groups like the AfD.With over a quarter of European voters supporting hard-right platforms, centrist governments warn that the Western alliance’s united front against external geopolitical threats is under siege.

The AfD’s eastern factions reportedly have ties to radical extremist and neo-Nazi elements, thus motivating Marine Le Pen in France and Prime Minister Giorgia Meloni in Italy to distance their parties from the AfD, and expelling the AfD from their main coalition in the European Parliament.Despite this, far right-wing populist parties in the 31 European nations are gaining momentum, with approximately 23% of the electorate voting for right-wing populist parties.

According to Mr. Sisci, even the Vatican is concerned with this shift to far-right political groups, viewed by many as heirs of the Fascists.

Mr. Sisci said the U.S. must be at the center of these geopolitical discussions, with strong U.S. leadership. Without this, there will be chaos.

And as Mr. Rubio said in Greece, at the Acropolis, “It shows us that ours is the inheritance of great heroes, and that we should be proud – intensely proud – of where we come from. We should marvel at what our forefathers carved out of this countryside. The story of our civilization is the greatest story ever know to man.”

The author is the former associate director of national intelligence. All statements of fact, opinion o analysis expressed ae those of the author and do not reflect he official positions or views of the U.S. government.

This article was originally published in The Washington Times.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

What Beijing Calls Open, Washington Should Call an Operation

China is about to run the largest influence operation in history. It will not have to run it. The world will download it.

EXPERT PERSPECTIVE -- Our research team at Vanderbilt spent months inside the internal documents of GoLaxy, a Beijing firm - with ties to the Chinese state - that built a machine for shaping opinion abroad. Using AI, it generates personas, amplifies narratives that are favorable to Beijing and buries narratives that are not. And it’s been busy. It was used in Hong Kong to combat dissent against the National Security Law. It was used in Taiwan to sway the island’s 2024 elections.

Now consider what happens when it does not need to be built at all. If Chinese open-weight models — the ones that anyone can download, modify and run on their own machines — become the foundation that the world builds on, then the Chinese Communist Party’s (CCP) framing of Taiwan, Tiananmen, Xinjiang and Beijing itself ships inside every product that sits on top. No personas. No campaign. Just the default answer, everywhere. Something like this would make GoLaxy look like a dress rehearsal.

And here is the part that should stop Washington cold. Chinese models are about to be everywhere, and American strategy could allow it to happen. Washington is deciding whether to let frontier development run while clamping down on powerful open-weight models (whose safeguards can be stripped away). Here’s the deal though: restrictions would not kill demand for a cheap model that a company can download and make its own. China is standing at the counter with exactly that.

Today, we talk about the AI race as if it has one finish line. But it has two. The first is for frontier capability: who builds the most advanced models. American companies lead the way today. The second finish line is for reach: whose models become the foundation on which thousands of products are built? Chinese firms may have the advantage on this one. The first brings concentrated scientific, economic and military power. The second decides whose systems become the workhorses of ordinary life, and that reach shapes what people know and will learn in the future.

American frontier models like Claude, ChatGPT and Gemini are closed, meaning you use them on the company's servers, and the company can cut off access. Chinese developers compete by releasing cheap open-weight models that companies can run on their own, with no provider to answer to. The babysitter has left the building.

This has already started. Airbnb relies on Alibaba's Qwen in its customer-service agent. Qwen, even briefly, powered a tool for searching proposed regulations on the Federal Register website. Amazon says thousands of customers have deployed DeepSeek through its cloud. In every case the interface is American. But the model underneath it is not.

Here’s something else to consider: Chinese developers must operate under Communist Party rules about what may be said. Those rules then shape which questions the models answer, which facts they omit and how they frame sensitive subjects. Open weights can be retuned, but scrubbing built-in defaults is expensive, and most companies will focus their efforts on addressing what matters to their business rather than check how a model handles every political subject. If a cheap Chinese model sits under thousands of products, its habits travel with it — into research tools, classroom software and fact-checkers — and the person on the other end never knows.

Beijing already knows about this risk. When Meta released its open-weight Llama models, Chinese regulators worried that a foreign model could "poison" China's AI ecosystem with information that the CCP censors. It seems to make sense that Washington should take seriously a vulnerability that Beijing recognized first.

None of this makes the open-weight safety problem smaller. In fact, just the opposite. Once a powerful open-weight model is released, its developer cannot recall it. Its safeguards can be stripped away and the model can be used for cyberattacks, the creation of biological weapons or worse. If we’re going to address this as a society, then testing requirements, liability rules and release restrictions are needed. But a Chinese open-weight model carries the same dangerous capabilities as an American one, and no American rule touches it.

If we constrain American developers and leave foreign weights untouched, demand will certainly shifts toward Chinese models. Theoretically, Washington could end up regulating the companies it can see while deepening its own dependence on the ones it cannot.

One answer might be to ban the Chinese models. But that means telling Americans which information technology they may use — and here lies the irony: the openness that protects Americans from domestic censorship may leave them exposed to systems built under Chinese censorship.

TikTok offers a glimpse of the stakes. More than 170 million Americans use it, and tens of millions say they get their news there. Washington spent five years fighting over its recommendation algorithm, and the deal that kept it in the United States required a change to that algorithm. But an algorithm only ranks videos that people make. While that fight dragged on, AI models learned to make the videos themselves — realistic footage with synced audio, from a sentence, in seconds. Three months after the deal closed, TikTok upgraded its ad tools to ByteDance’s newest video model. No rule required anyone to ask whose model was making the videos.

Now, you can see why the United States is facing a trilemma. It wants to prevent the uncontrolled release of dangerous AI capabilities. It wants to preserve Americans' freedom to choose their technology and information. And it wants to avoid dependence on models that are shaped inside an authoritarian system. It cannot fully secure all three.

Honest regulation starts by admitting that. Before restricting an U.S. model, ask which model developers will pick first. Domestic and foreign models distributed in the United States should face the same tests and the same rules. And companies that build products on a foundation model should have to say whose model it is.

AI leadership combines two things: the capability of a country's best models, and the reach of the models embedded in ordinary life. AI risk also combines two things: what a powerful model might do, and what a ubiquitous one tells people is true. GoLaxy showed us what Beijing can do with a machine to shape a belief. Now, what are we going to do about it?

Mr. Goldstein and Mr. Benson are professors at Vanderbilt University who specialize in national and international security.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.
Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.
Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Washington Cannot Outsource Saudi Security to the Mecca Pact

The Houthis have significantly escalated their airstrike campaign targeting civilian infrastructure in Saudi Arabia, with two consecutive attacks at Riyadh’s international airport, killing 12 and injuring 300 others between October 10 and 11. The Houthis’ deadly strike campaign has exposed an uncomfortable truth that Saudi Arabia’s newest defense alliance cannot yet guarantee its security. Saudi, Turkish, and Pakistani leaders activated the Mecca Pact on October 5, but the Riyadh airport attacks demonstrated how little a collective-defense declaration means to an adversary willing to keep firing. Riyadh needs more than diplomatic solidarity and bare-minimum defense support, which are not willing to undertake kinetic engagements with the Houthis. Washington should expand military assistance to Saudi Arabia and Yemen’s internationally recognized government without rushing into another open-ended bombing campaign. The United States has greater strategic interests at stake than either Ankara or Islamabad, and capabilities the new pact cannot quickly replicate.

Saudi Energy Security Is American Security

Saudi Arabia remains a central American security partner and an indispensable player in global energy markets. With Iranian attacks and disruptions around the Strait of Hormuz, the kingdom’s East-West Pipeline has become a critical alternative for moving crude to the Red Sea port of Yanbu. The pipeline throughput reportedly reached approximately 5.8 million barrels per day in early October, while roughly four million barrels per day have been rerouted around Hormuz.

This arrangement, however, remains vulnerable to external attacks that can disrupt the flow of energy from the Middle East. Drone attacks forced a temporary pipeline shutdown in late September, although Saudi Arabia attributed those strikes to Iran-backed Iraqi militias. The Houthis have separately attacked and threatened Saudi energy facilities. And despite a September rebound to 16.3 million barrels per day, Middle Eastern crude exports remained below their prewar level of 19.5 million. A prolonged Saudi-Houthi war could jeopardize the infrastructure and confidence sustaining that fragile recovery.

Security threats to Saudi Arabia also complicate ongoing and future diplomatic gains with Riyadh, especially considering President Donald Trump’s vision to have Saudi Arabia join the Abraham Accords. The US-Saudi civilian nuclear cooperation agreement, signed in July and submitted for congressional review in August, promises a long-term economic and strategic relationship. While its proliferation safeguards deserve rigorous scrutiny, escalating security threats could complicate implementation and diminish Washington’s influence over Saudi nuclear choices. Pakistan and Turkey have interests in Saudi stability; the United States has energy, maritime, defense-industrial, and nonproliferation interests simultaneously.

Pakistan Has Too Many Fronts of Its Own

The pact’s most acute capacity problem lies in Pakistan. Islamabad must contain the Tehrik-e-Taliban Pakistan insurgency in Khyber Pakhtunkhwa and Baloch separatist violence while guarding a contested frontier with Afghanistan and maintaining forces opposite India. These are not hypothetical distractions but serious battlefield challenges for Islamabad, which is fighting on multiple fronts simultaneously. Pakistan conducted airstrikes inside Afghanistan on October 1, amid recurring border clashes. On October 11, Islamabad imposed emergency rule in Khyber Pakhtunkhwa, citing worsening militancy, although the opposition disputes the justification. Additionally, the India frontier remains an enduring contingency that Pakistani planners cannot discount. This threat landscape will create serious bandwidth issues for Pakistan’s military in the immediate to near term, further limiting Islamabad’s support for Riyadh.

Pakistan’s armed forces can provide specialized assistance abroad, but sustained expeditionary commitments require personnel, logistics, and strategic attention. Pakistani officials have dismissed Western media reports of its troop presence in government-controlled territories of Yemen. Still, the death of a Pakistani driver in a Houthi drone strike in Marib, Yemen, has brought Pakistan’s actual role within the defense pact under scrutiny—whether Islamabad is taking up a direct combat role alongside the Saudi-backed Yemeni government forces on the ground. On the other hand, Turkey has formidable drones, electronic-warfare expertise, and NATO experience, but its priorities extend from Syria and Iraq to the Eastern Mediterranean. Neither country should be dismissed as a partner, and neither should be treated as an unlimited strategic reserve for a war with no clear end date.

Bab al-Mandeb Is Washington’s Problem Too

The constant threat of disrupting commercial vessel traffic in the Red Sea makes American restraint increasingly difficult. Washington and the Houthis have recently reached an understanding that the group will not target non-Saudi ships in the Red Sea given that the United States does not undertake kinetic strikes targeting Houthi infrastructure in Yemen. This is a non-binding understanding and dangerously shortsighted, which offers no permanent guarantee that the Houthis would never threaten Bab al-Mandeb again. If the Houthis begin losing territory rapidly to the government forces, they are highly likely to use every means possible to threaten commercial vessels in the Red Sea. This is right out of their counterpart Iran’s coercion playbook around Hormuz, illustrating the leverage a regional actor can extract from a chokepoint without maintaining a total blockade.

Saudi-backed Yemeni forces have made meaningful gains along the western coast of Yemen over the past week. The anti-Houthi coalition of Yemeni forces reportedly retook Perim Island and al Aradi after securing Jabal Kahbub, an operationally significant hilltop which overlooks the frontlines between the Houthi rebels and government forces. Saudi Close Air Support helped enable the counteroffensive, which was partially successful because Houthi positions elsewhere on the Red Sea coast still pose threats against commercial shipping. Bottom line is that the loss of terrain nearest the strait does not eliminate the maritime risk.

Conclusion

Limited tactical success to the credit of Saudi-backed Yemeni government forces should not be conflated with larger operational achievements against the Houthis. Washington should therefore expand real-time targeting support, aerial refueling, integrated air and missile defense, counter-drone capabilities, and maritime surveillance. It should help Saudi and Yemeni forces protect infrastructure and hold recovered ground, while keeping the threshold for direct US strikes explicit: demonstrable threats to American forces, international navigation, or sustained attacks that overwhelm partner defenses. Any strikes must be narrowly targeted, legally justified, and paired with a diplomatic off-ramp.

There is precedent, but also a warning. During Operation Rough Rider, US forces struck more than 1,000 Houthi targets between March and May 2025. The campaign ended in May without destroying the movement but severely degraded the group’s missile production infrastructure. Washington knows how to hit Houthi infrastructure, a task which Turkey and Pakistan are hesitant to and most likely incapable of undertaking. Bipartisan backing for Saudi defense would strengthen this approach, but it cannot compensate for strategic passivity. The Mecca partners can share the burden, but they cannot yet carry it alone. America should neither outsource Saudi security to an untested pact nor inherit Yemen’s entire war. Washington must provide the military support necessary to safeguard its strategic interests while making clear that further Houthi escalation will invite a more forceful, direct US military response.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The Next War of Attrition is in Yemen

Battlefield dynamics in Yemen shift quickly, but Houthi aims do not. A movement organized around radical ideology and perpetual conflict now shares a border with a state organized around modernization and prosperity. Saudi Arabia and the Houthis both have formidable but very different military capabilities, and neither can force a quick decision on the other. That is the recipe for a long war of attrition. The closest precedent is the war in Ukraine, to which the Yemen war is increasingly linked, and which may be instructive for the Kingdom on how best to prepare.

There is also a parallel to be made with the related conflict between Iran and the United States, the fallout from which has severely affected the GCC countries, including Saudi Arabia. Essentially, we are witnessing the leverage of a lesser military force when that party has a much higher threshold for pain and disruption than the stronger party. Iran and the Houthis are both betting that the Saudis are sufficiently anxious to hold on to their peaceful model of business, tourism, energy and investment to settle at almost any price and end the present conflict.

The Houthi mindset

The Houthi ideological program is anti-Saudi, anti-American, anti-Israel, anti-democratic, anti-liberal and antisemitic. It has long cast the Saudi monarchy as an American-Israeli puppet unworthy of the title Custodian of the Two Holy Mosques. Some of this is personal: The father of Abdelmalek al-Houthi, the group's leader, clashed for years with Saudi-backed clerics and was rumored to have been targeted for assassination at their behest.

But the grievances against the Kingdom also has a territorial dimension. In the 1934 Treaty of Taif,

Imam Yahya of northern Yemen settled the border with the Saudi state and ceded Jizan, Asir, and Najran provinces. The Houthis, who present themselves somewhat ambiguously as heirs to the imamate, have revived claims to all three provinces. The purpose is to stoke resentment of the Saudis and to leave the Kingdom's southern border unsettled. This territorial dimension intersects with the allegation that the Saudis are not fit to control Mecca and Medina: Abdelmalik recently reiterated that Mecca belongs to the Islamic Umma, rather than being a province of Saudi Arabia. The Houthis implicitly – and sometimes explicitly – claim the whole of the southern half of the Arabian Peninsula, “from Mecca to Mahra”.

The deeper reason the Houthis cannot stop is structural. The Houthis depend on mobilization, and for a movement of that kind peace is a threat rather than a reward. Conflict is what holds the project together, as it justifies extracting resources from an impoverished population, excuses unpaid salaries and collapsed services, and lets the security apparatus treat every critic as a collaborator. For a deeply unpopular regime, war with Saudi Arabia and its local Yemeni partners is the most useful conflict available and could yield significant returns if the Houthis can extract concessions at the negotiating table. It was already clear during Ambassador Fitton-Brown’s period of responsibility for Yemen that the perverse incentives of the war economy meant that Houthi negotiator Muhammad Abdelsalam was viewed with suspicion by Houthi field commanders, who were benefitting from the war economy and associated “respect”, and had no interest in being transformed into administrators with responsibility to balance their power.

The Houthi menu

The Houthis approach is predatory: isolate each victim and deal with it alone. They pursue bilateral deals that peel off potential adversaries, and calibrate each attack so the victim would conclude that a limited response is cheaper than a sustained one. They have cultivated the sense that they are somebody else's problem, Israel's when they fire missiles at Eilat, Riyadh's when they strike Abha, etc. A decade on, the Houthis have have attacked many different states, and yet no one has owned the problem.

It is troubling that US negotiators have recently sat with the Houthis in Muscat and apparently taken at face value Houthi assurances that their quarrel is only with the Saudis, not with American – or even the Israelis! All this while threatening the US economy and risking the lives of US nationals at civilian infrastructure in the Kingdom.

In the current round of fighting, the Houthis have three key options for escalation.

The first is domestic expansion within Yemen. It is the least risky for the regime because it stays within a conflict the world has learned to ignore. New territory brings new populations to tax, new ports and crossings to control, and new momentum to display at home. The drawback is that this also pushes the Zaidi Houthis deeper and deeper into Shafa’I (Sunni) territory, where the population is hostile to their agenda.

The second option is maritime. Attacks on commercial vessels and Saudi tankers in the Red Sea and the Bab al-Mandab inflict harm, especially in the economic realm, and they are extremely difficult to deter and defend against. The drawback is that shipping is a global interest, albeit somewhat elastic, and so a sustained campaign against it may invite the involvement of states with maritime commercial interests that would otherwise stay out of a Saudi-Houthi war. It also, by violating the Law of the Sea, provides an unimpeachable legal basis to build an international military coalition against them.

The third option, targeting civilian aviation, is the riskiest. A recent Houthi attack, on October 10, killed at least twelve people in the deadliest attack on the Kingdom in more than a decade. One US national was among the dead. The strikes came with a threat to airlines, "for the last time," to stay out of Saudi airspace. This type of attack is probably the most likely to galvanize an international coalition and demonstrates that the Houthis have an extremely high appetite for risk.

The Houthis are testing how far they can take this. Downing a passenger aircraft would almost certainly bring the overwhelming response, including direct American strikes, that the Houthis have spent recent decades seeking to avoid (albeit with an imperfect record). The threat alone can inflict some damage to Saudi Arabia, so the threats will continue. Whether the Houthis will continue or even take escalation in this realm even further will depend on whether they believe anyone would make them pay.

The wars are already connected

It might be tempting to treat the Russia-Ukraine and Houthi-Saudi comparison as merely illustrative, but the two wars are materially linked in both directions.

Russia’s involvement with the Houthis is the most direct link thus far. By mid-2024, Russia had recruited hundreds, possibly even thousands, of Yemeni men for the Ukrainian front through a Houthi-linked network operating out of Oman. Also, during the Houthi Red Sea campaign of 2023 to 2025, Russia reportedly passed satellite targeting data to the Houthis. And the Shahed-136 that Iran supplied to Russia, which Russia now mass-produces and improved upon, belongs to the same family of weapon the Houthis fire at Saudi infrastructure. Russian innovation may yet flow back through Tehran to Sanaa.

Russia’s public posture toward the Houthi problem has been one of ostensible concern. In September, Foreign Minister Sergey Lavrov called Houthi attacks on Saudi civilian targets “unacceptable,” and President Putin and Crown Prince Mohammed bin Salman discussed freedom of navigation through the Bab al-Mandab by phone. Riyadh should not mistake this for neutrality: Moscow treats the Houthis as a pawn in a larger game.

The mechanism is not complicated. A crisis on the Arabian Peninsula drains Western attention and, perhaps more importantly, Western munitions. In late March, the Pentagon was reported to be weighing whether to divert air defense interceptors bought for Ukraine to the Middle East, because the war with Iran was straining stocks of critical American munitions. This is the outcome Moscow has been working toward since it abstained on the 2015 arms embargo against the Houthis and then spent a decade obstructing the UN panel that documented its violations. Russia does not need the Houthis to win; it needs them to keep fighting. It makes a similar calculation over supporting continuing Iranian resistance to the Americans.

The link is starting to run the other way too. Kyiv’s growing ties with Saudi Arabia are more recent but no less consequential. On March 27, the two countries signed a defense cooperation agreement centered on counter-drone expertise. More than two hundred Ukrainian anti-drone specialists are now deployed in Saudi Arabia and other Gulf states, and Riyadh is reportedly negotiating a large purchase of Ukrainian interceptor drones that cost between one and three thousand dollars each. Until recently Riyadh was deepening ties with Moscow through OPEC+ and BRICS, and yet it is now importing Ukrainian expertise to defend against weapons Moscow helped perfect.

Saudi Arabia's dilemma

As in Eastern Europe, no quick decision is likely in the Saudi-Houthi conflict. The Houthis cannot be bombed out of Sanaa, as the coalition learned between 2015 and 2022. While the Yemeni government’s counteroffensive along the coast has stabilized the front and claimed gains around Mokha, it remains a long way from the capital. That leaves Riyadh with three paths, none of them are likely to be easy.

The first is appeasement, which would feed the movement. Since June, the Houthis have demanded a deal that lifts the blockade on their ports and airports and restores the flow of cash into Sanaa. Such a deal would ease the regime’s revenue crisis and pay for its next tranche of weapons. The Kingdom tried a version of this approach after 2022, and the result is the war it is fighting now.

The second is deterrence, which fails against an adversary that seeks out perpetual conflict. Deterrence assumes an enemy that weighs costs and benefits in measurements that the Saudis understand, and that appears not to be the case. For a movement like the Houthis whose legitimacy rests on “resistance,” conflict is not only a hazard but also a realization of an extremist aspiration.

The third is defeating the Houthis outright, which means returning to a war Saudi Arabia already fought and abandoned. A strategy that could succeed does exist: cut Houthi supply lines of cash and other material while backing a unified Yemeni ground campaign under a single command. But this will require sustained pressure over time in order to crack the Houthi defenses and then ultimately the regime.

Attrition, then, is the most reasonable path forward. The question is not whether Saudi Arabia will be in a long war but whether it will be prepared for one. Attrition is survivable for the side that innovates and devastating for the side that assumes the war will end in a quick and decisive maneuver. The length of the war also introduces uncertainties about changes in the posture of allies, especially the US. There is a need to bake in bipartisan agreement in Washington, DC, that it is a US national security interest to ensure that the Saudis, and the Internationally Recognized Government of Yemen, and the Law of the Sea prevail in this conflict.

Two Ukrainian lessons

Ukraine survived attrition against a far larger adversary for two reasons, and both apply to Riyadh.

The first is adaptation. It built a drone industry from almost nothing into one producing millions of systems a year, fielded interceptor drones costing a small fraction of a Patriot missile, and compressed production and procurement timelines.

The Saudi-Ukranian March agreement imports some of that expertise but may not necessarily transfer all of the knowledge necessary to built its own industry. A defense that depends on imports from a country at war is precarious at the best of times.

Riyadh has the money and the stated intent, and Vision 2030 set a goal of localizing half of military spending by the end of the decade. But localization so far has meant licensed assembly of foreign designs rather than innovation under fire. The Kingdom has not reached a wartime tempo in which a new counter-drone system is conceived, tested against live Houthi attacks, and fielded within weeks. That is the capability Ukraine built and Saudi Arabia lacks.

The second lesson is diplomatic. Ukraine did not survive alone. It built a coalition of dozens of states that supplied weapons, trained its forces, financed its budget, and shared intelligence. For the Houthis, a coalition of this kind is the worst possible development, and it is exactly what their strategy of isolating victims and claiming false symmetry is meant to prevent.

The current war gives Riyadh the chance to build one, but the pieces remain fragmented. Ukraine's example is that a coalition does not assemble itself. It must be rallied, placed under a single command, and given a shared objective beyond absorbing attacks. The Houthis' own escalation, which has now killed citizens of a dozen countries at a single airport, is doing part of that work for Riyadh. The Kingdom's task is to turn condemnation into commitment before the moment passes.

So what would this coalition look like? The Saudis already have a maritime group of 14 that opposes Houthi blackmail against them in the Red Sea. But the US, UAE, UK and the other European powers are not part of it. With US leadership and assistance, this needs to be remedied. This is achievable, on the basis of three compelling legal bases: enforcement of the Law of the Sea; the legitimacy of the Yemeni government (and illegitimacy of the Houthis); and the legitimate defense and self-defense of Saudi Arabia.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The Pentagon’s Drone Revolution Starts With Soldiers

Welcome to The Iron Triangle, the Cipher Brief column serving Procurement Officers tasked with buying the future, Investors funding the next generation of defense technology, and the Policy Wonks analyzing its impact on the global order.

On the night of April 24, 1980, eight Navy RH-53D Sea Stallions lifted off the deck of the USS Nimitz and headed for a patch of Iranian salt flat called Desert One. The plan needed six of them to get there in working order. One was abandoned in the desert after a rotor warning. One turned back in a dust storm. One arrived with a failed hydraulic system. The mission was aborted. Then, while the force repositioned to refuel, a helicopter drifted into an EC-130. Eight Americans died on that salt flat, and fifty-two hostages stayed in Tehran.

When the Secretary of War stood at Quantico on September 30 and announced a new four-star command for autonomous warfare, my first question was not about drones. It was about helicopters.

The Holloway review found the mission "conceptually valid and feasible" and blamed "the ad hoc nature of the organization and planning." The fix, Nunn-Cohen in 1986, gave the new Special Operations Command a budget line the services could not raid. We did eventually build better helicopter units. But we didn't build SOCOM around a helicopter. We built it around the problem that broke the helicopters.

The Secretary seems to understand this. "Ukraine's lesson is not that one type of drone wins wars," Hegseth told the room, "but rather the need for a purpose-built system that maximizes the ability to adapt." His signed memo says the output "is not a particular drone, but the ability to adapt in combat." Then the Department named it the Autonomous Warfare Command. This is like naming SOCOM the Helicopter Command. A drone is a photograph of an adaptation. The adaptation is the movie. In Ukraine, radio-controlled FPVs gave way to fiber-optic spools, which gave way to nets, shotguns and interceptor drones, each turn in weeks or months.

When the 3rd Army Corps air-dropped ground robots ten kilometers behind Russian lines during Operation Vivaldi last month, the footage went everywhere. The commanders talked about something else. A battalion commander known as "Darwin," credited a command structure "qualified enough as we are." An American volunteer with the corps described his entire job as "installing Western mission command trust and initiative." We taught them that. They are teaching it back to us with robots, and we are taking notes on the robots.

Retired Lt. Gen. Mark Hertling warns that "creating a headquarters does not create a capability." He is right, and that is the point of this column. The memo orders a 30-day implementation plan, due on the Secretary's desk around the end of October. A headquarters is a wiring diagram. The capability is a soldier in the motor pool at two in the morning with a soldering iron, a laptop and a firmware image that does not work yet. Here is how to build him, keep him and turn him loose.

Start With the Soldier We Already Have

The Army has made a great start. Its newest specialty, the 15X tactical unmanned aircraft system specialist, is graduating classes of about thirty at Fort Huachuca, with 770 expected by year's end and a planned force of two to three thousand. The colonel who runs the training brigade said it better than anyone at Quantico: "The Army has not bought a drone that the 15X is responsible for being an expert on." Train the soldier to learn the machine, not the machine's manual.

Now follow that soldier for six years. If he is good, he makes sergeant. If he is very good, he makes staff sergeant, and the day he pins it on, his job stops being the drone and starts being the eight soldiers who fly it: counseling, evaluations, ranges and the duty roster. The enlisted promotion system has one ladder, and it runs through the leadership of people. The best technician in the platoon either becomes a manager or gets passed over. Either way he leaves the bench, and the private sector is waiting with a better offer.

Bring Back the Specialist

Warrant officers exist to solve part of this problem. The Army already has an unmanned aircraft systems warrant, and the Air Force, which abolished its warrants in 1959, brought them back in December 2024 for cyber, intelligence and space. But warrants are a thin layer by design. You do not put one in every platoon, and the loop the Secretary described lives in the squad and the section.

The Army has solved this before. In 1955, after a committee recommended separating command from technical responsibility, it created specialist grades to reward experience and technical knowledge. A Specialist Six drew a staff sergeant's pay without a staff sergeant's squad. His job was to be the most technically proficient in the building, and the Army paid him to stay that way. The ladder was dismantled from the top down, and in 1985 SP5 and SP6 went away.

Bring them back, starting with unmanned systems. Promote a Specialist Five or Six on what he can build, fix, modify and teach. Same pay grades, separate ladder, one rule: technical authority, never command. Put specialists in every formation that flies, drives or swims a robot, with the warrant corps above them as the technical chain. A Specialist Six at battalion who can rewrite the flight controller tonight, and a CW3 at brigade who knows which vendor to call in the morning: that is what a fix in days looks like.

Pay for the Skill, Not the Stripe

We already pay soldiers for perishable expertise. A linguist earns a Foreign Language Proficiency Bonus of up to $500 a month per language, and must retest every year to keep it. Nobody thinks that is strange. Russian is hard, and it fades.

So does firmware. Build a tiered certification for unmanned systems (repair, modify, program) and pay it monthly, with an annual retest, because the skill expires as fast as the drones do. The money does not need an act of Congress. Under 37 U.S.C. 353, a service Secretary can designate any skill as critical and pay up to $1,750 a month in skill incentive pay, or a proficiency bonus of up to $55,000 a year for certified proficiency. The authority is sitting on the shelf.

Then add the cheapest incentive in the Army's inventory: a badge. The 1953 committee that produced the specialist grades was worried about prestige, and prestige in the Army is worn on the chest. Anyone who has watched soldiers grind through an Expert Infantryman Badge lane knows what they will do for a piece of metal. An expert badge for unmanned systems, tested on build, fix and fly against the clock, would cost almost nothing and fill every off-duty hour in the brigade.

Recruit at the Bench

In June 2025, the Army commissioned four technology executives directly as reserve lieutenant colonels. Now do it at the other end of the org chart. Let a civilian FPV builder or embedded-systems engineer enlist as a Specialist Five instead of a private, on a skills test rather than a resume.

And stop leaving the best reservoir untapped. Thousands of Americans now build drones for a living. The Guard and Reserve can put them in uniform one weekend a month as technical specialists, carrying current industry skill into units without the Army having to match a Silicon Valley salary.

Give Them Permission and a Parts Budget

A specialist who can fix the drone but is not allowed to innovate is an expensive spectator. In April 2025 the Secretary's own Army transformation memo directed the service to "seek to include right to repair provisions in all existing contracts." Finish the job, then delegate the authority to modify and fly small systems down to brigade, so a fix written tonight does not wait months for a distant office to approve it.

Then give him money. The Army's UAS Marketplace, launched in March, has already cleared more than $750 million in sales, and it is adding components and software. Ukraine went further: drone units earn points for verified strikes and spend them on the Brave1 Market, a catalog of more than a thousand products. We do not need the kill leaderboard. We need the principle. Put a parts budget and a catalog in the hands of the battalion specialist, because the fix usually costs less than the paperwork.

Train the Whole Chain

Technical acumen cannot stop at the specialist. The lieutenant has to know what to ask for, and the battalion commander has to know when a twenty-year-old is telling him something he does not want to hear. Put a hands-on unmanned systems block in the officer basic and captains career courses. Send specialists to vendor factories through Training With Industry, and bring vendor engineers forward to battalion in return. Then rate commanders on how fast their formations close the loop.

For the Procurement Officer

Before you sign, ask one question: can a twenty-two-year-old with a screwdriver and a laptop legally open this, fix it and reflash it at two in the morning? If the answer is a field service rep and a ticket number, you did not buy a capability. You rented one. Price the technical data, the open interfaces and the soldier training as line items, and count how many of your fielded systems a Specialist Six could actually work on today.

The Investment Thesis

Your next customer is a Specialist Six. Buying power is already drifting down to the units, through marketplaces here and points in Ukraine. The company with the best drone of 2026 is a commodity supplier by 2027. The company the soldier chooses to learn on, train on and fix with is a platform. Discount revenue built on dependency, and pay up for iteration speed.

The Policy Wonk's Warning

The memo says plainly that the Department will need legislation for the command itself. When the FY2028 NDAA takes it up, Congress should do for adaptation what Nunn-Cohen did for special operations: a protected budget line, and a statutory charter that defines the mission as adaptation across the force, not ownership of a category of hardware. Most of the personnel fixes above need no new law at all. Congress's job is to ask why they have not happened yet.

My Take.

The fight over this command will happen in a document most people will never read. The 30-day plan must "identify measures of adaptation and Service adoption." That clause is where AUTOWARCOM is won or lost. If adaptation is measured in drones delivered, the command becomes a very expensive purchasing agent. Measure two numbers instead: days from a unit reporting a battlefield problem to a fix in its hands, and the count of soldiers in each formation certified to make that fix. Report both to Congress every quarter. Owen West and Max Strasiser built their reputations on speed. I suspect they would welcome being graded on it.

The Risk.

The specialist ranks went away for reasons. Old soldiers still tell stories about the Spec Five who drew sergeant's pay and could not, or would not, run a detail, and about the confusion over who was in charge when the sergeant went down. The bright line between technical authority and command answers most of that. Delegating authority to modify means some soldiers will break drones. That is the tuition, and it is cheaper than the alternative. The bigger risk is the one Hertling named: a new headquarters that adds a layer between the operator and the vendor. If the 30-day plan is mostly wiring diagram and very little soldier, believe him.

Conclusion

Hegseth told the room at Quantico that the English at Agincourt moved their fletchers close to the front to keep the arrows coming. The fletchers were not archers. They were tradesmen, kept near the line because the arrows ran out faster than anyone had planned. In a few weeks, the plan on the Secretary's desk will tell us whether we understood the story. Will we count drones, or will we count days, and the soldiers who make them shorter?

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

America’s Military Has a GPS Problem

“The Department of Defense’s (DoD) Global Positioning System (GPS) is the principal source of positioning, navigation, and timing (PNT) information for the U.S. military and civilian users. Due to DoD’s reliance on it, GPS also represents a potential single point of failure for DoD. We [the Government Accountability Office (GAO)] previously reported on DoD’s efforts to modernize GPS with a more jam resistant, encrypted, military-specific signal, referred to as military code (M-code), and we found that DoD is years away from fielding this capability after spending more than two decades and billions of dollars.”

That was the opening of a GAO letter sent last Wednesday to Congress accompanying a 58-page report titled PRECISION NAVIGATION SYSTEMS: Challenges Remain with Fielding New Capabilities, which explains the key role that GPS delivery of PNT data plays in this country’s military and civilian activities -- and the need to update the system.

The M-code secure, jam-resistant GPS signal is designed to be used by roughly 700 U.S. weapons systems deployed by Army, Navy, Marine Corps and Space Force services, but because of a limited supply of specialized microchip sets and production bottlenecks of other key elements, some M-code deployments have been pushed back to 2049, according to the GAO.

I will discuss this more below. Meanwhile, the U.S. military services continue to rely on legacy GPS receivers or alternative systems for PNT-guided operations. For example, the GAO report described “non-satellite-based PNT using data derived from internal or external sources of information to sensors, from geophysical sources, or from celestial sources (e.g., inertial measurement units, cameras or terrain sensors, magnetic or gravity sensors, and celestial sensors).”

First, a bit of GPS background and history supplied in part by the GAO.

GPS consists of three segments: a constellation of approximately 31 medium Earth-orbiting satellites, with at least 24 continuously broadcasting their position and time data; a ground control segment – Space Command’s Delta 8 at Schriever Air Force Base, Colo. -- for command and control of the satellite constellation; a user segment, comprising receivers used globally by military and civilians in aircraft, ships, land vehicles, precision-guided munitions, and handheld devices.

The user equipment receives signals from four GPS satellites and, with that transmitted data, instantly calculates the user’s location and precise time.

Although the U.S. Government created and continues to control and maintain GPS, it is freely accessible to anyone with a GPS receiver. There are three other similar global systems: Russia’s GLONASS was developed during the Cold War; the European Union manages Galileo, and China operates the BeiDou Navigation Satellite System.

Today’s U.S. GPS originated in 1973 when the Defense Navigation System, later named NAVSTARS GPS, was approved, primarily to guide ships. In 1978, the first GPS satellite was launched into orbit, with the full satellite complement not reaching initial operational capability until 1993. By then, it had been made available for civilian use as well as military, a decision made by President Reagan in 1983 after the Russian downing of Korean Air Lines Flight 007.

By the 1991 Persian Gulf War, the GAO report said, “GPS equipment was small and inexpensive enough to also be used on aircraft and other military vehicles. Since then, further advances, such as the development of even smaller microchip-sized receivers, have allowed GPS to provide precise PNT information for individual soldiers, munitions, smaller weapons technology applications, and civilian applications, like smart phones.”

Meanwhile, according to the GAO report, “GPS signals are being actively targeted by adversaries who seek to disrupt or deny GPS to U.S. warfighters. These threats include (1) jamming, (2) spoofing, (3) cyber, and (4) direct attacks on satellites or satellite infrastructure.”

DoD is mitigating jamming attacks “by installing specialized antennae -- referred to as controlled reception pattern antennae (CRPA) -- on weapon systems and munitions,” according to the GAO report, which added, “These antennae provide the ability to identify and filter out the jamming signals.”

Spoofing is being dealt with “in part by developing and installing receivers with M-code capability, which will provide more secure encryption,” the report said. As for cyberattacks, DoD is “ensuring that computer systems and networks are protected against cyber attacks that can target satellites and their associated ground control systems,” according to the GAO.

Since 2000, the Air Force -- and later the Space Force – have pursued a multibillion-dollar effort to modernize the existing GPS capability. The modernization effort included adding the more robust and more securely encrypted GPS military signal capability, known as M-code. It also included: 1) satellites that broadcast the M-code signal, 2) a ground system that controls both the existing and new M-code GPS satellites, and 3) user equipment to receive the M-code signals.

The first satellites capable of broadcasting M-code have been on orbit since 2005, with upgraded versions referred to as GPS III.

The launch of the GPS III third generation of 24 M-code satellites was completed on April 21 of this year, providing eight times the anti-jamming capability and four times the accuracy of previous iterations. “The next generation of satellites, known as GPS III Follow-on, or GPS IIIF, are in production by Lockheed Martin, and will begin launching as early as 2028,” according to a Space Systems Command press release.

However, it’s a different story with the new generation ground system, referred to as Next Generation Operational Control System (OCX). It began development in 2010 and was supposed to achieve transition to operations by June 2017. Instead, there were numerous technical problems and protracted delays. Costs rose from $3.7 billion to almost $7 billion or more, and in April 2026, DoD directed the Air Force to formally terminate the OCX program, according to the GAO report.

Despite the cancellation of the OCX program, then-Chief of Space Operations Gen. Chance Saltzman said in April the new ground control system needs to be prepared to support future GPS satellites, including GPS IIIF and beyond.

However, despite the OCX problems, the Space Force has been making upgrades to the existing GPS ground control segment through Lockheed Martin. Last week, an Air and Space Forces Magazine daily report said, “Since April, the Space Force has awarded Lockheed an additional $199 million…to support launch and command and control for GPS IIIF satellites…and to begin a full technology refresh of the GPS ground segment hardware and software.”

The final problems harming total GPS modernization – including delays and mounting costs – are best portrayed in the GAO report’s description of the military services’ development and procurement of separate receivers for the M-code data.

While development of the M-code-capable receiver cards has been led by the Space Force and Air Force, the eventual fielding of receivers to specific operational platforms, such as weapons, has remained the responsibility of the individual services.

According to the GAO report, “Currently, there are more than 50 priority weapon systems [considered in the GPS modernization programs]. The largest numbers of priority weapon systems are in munitions and aviation systems. The Navy has the highest number of systems, followed by the Army…Priorities for M-code modernization take into account the needs of the specific classified operational scenario as well as the expected life spans of the weapon systems involved. Weapon systems that are expected to no longer be in use around or before 2030 are not priority weapon systems.”

Congress mandated the PNT Oversight Council in the Fiscal Year 2016 National Defense Authorization Act, and DoD established it with the mission of overseeing the department’s GPS modernization portfolio.

However, as the GAO report explains, “Budget authority for key aspects of DoD’s PNT efforts remains under the control of the [separate military] services. This budgetary fragmentation complicates efforts to align interdependent PNT capability development and fielding efforts to ensure timely delivery to the warfighter.”

For example, the GAO found that despite recommendations from the PNT Oversight Council concerning inadequate Air Force funding for aviation receiver programs, “chronic underfunding” continued and the Air Force aviation receiver programs did not meet their development goals on their expected timelines.

“Pursuing modernized GPS and complementary PNT technologies to augment GPS,” the GAO report concludes at one point, “requires foresight and planning. Integration timelines for weapon systems are often lengthy, and schedules must be properly aligned for the development of such modernized PNT technologies and their integration into weapon systems. Additionally, these timelines for integrating new PNT technologies can be further complicated by the interdependence of systems. For example, the military services will likely upgrade some munitions to use M-code before the capability is integrated into weapon systems that fire those munitions.”

Since, as the GAO points out, the GPS system “is vast and touches almost all vehicles, ships, aircraft, precision-guided munitions, and dismounted personnel within the [Defense] Department,” I would say more DoD attention needs to be paid to getting this modernization back on track.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Subterranean Warfare - An Urgent DoW Need Without An Owner

The DoW urgently needs to organize its scattered subterranean warfare assets into a single unified organization. Ideally, a Direct Reporting Portfolio Manager (DRPM) for Subterranean Warfare, reporting to the Deputy Secretary of War. (The Department already uses this model for unmanned systems, critical weapons and Golden Dome.) This group would have three portfolios: Subterranean Resilience, Subterranean Sensing and Subterranean Defeat. The office would integrate validated requirements, experimentation, testing, acquisition, and fielding.

Subterranean Resilience

During the 2026 Iran conflict, Iranian ballistic missiles and low-cost drones hit U.S. installations across eight Middle Eastern countries. Hundreds of buildings and structures were damaged or destroyed. The Navy’s Fifth Fleet headquarters in Bahrain was among the installations hit hard. Iranian weapons damaged one E-3 airborne early-warning aircraft and five KC-135 tankers on the ground in Saudi Arabia. (The official inspector-general report documents the damage.) Despite thousands of successful interceptions, the attacks exposed the vulnerability of concentrated, above-ground assets.

The rapid redeployment of the B-1s from RAF Fairford in the UK after warnings of an Iran-linked threat (reported as a possible drone attack) made the point: unsheltered concentrated high-value aircraft are vulnerable even way outside the theater.

The assumptions the U.S. has made about air superiority, missile defense, aircraft dispersal, building hardening, and the survivability of concentrated forward bases were all flawed. While we were prepared for ballistic missiles and hostile aircraft, drone swarms combined with ballistic missiles saturated and got through our defenses.

Washington’s reaction has been to invest billions of dollars in counter-drone and missile defense systems. Yet public budget documents reveal no comparable effort to put vulnerable aircraft, fuel, command-and-control nodes, and munitions out of harm’s way – sheltered, underground (or in space). (Agile Combat Employment, dispersal, hardening, deception, shelters, and rapid runway repair were never designed for a combined drone and missile onslaught.)

The Pentagon has recognized for decades that underground facilities are among the most effective ways an adversary can blunt U.S. conventional superiority. It described that problem explicitly in 1999. Gaza and Ukraine should have made it abundantly clear.

China, Russia, North Korea, and Iran use underground facilities, dispersal, hardening, and deception to make their own high-value assets harder to find, assess, and disable. We need to underground assets that cannot be quickly replaced: command posts, comms nodes, ammunition, fuel distribution points, repair facilities, key power systems, maintenance spares, and high-value aircraft or drones. The department needs an integrator that coordinates resilience across the Military Departments, Joint Staff, combatant commands, defense agencies, and intelligence community and provides Subterranean Resilience.

However, resilience is only one part of subterranean warfare.

Subterranean Sensing and Defeat

The U.S. needs to know where adversaries' underground facilities are located, and the internal layout of those facilities. Today, these bespoke exquisite systems for tunnel detection, robotic mapping of accessible tunnels, Hard and Deeply Buried Targets (HDBT) characterization, and target defeat are siloed in organizations scattered across the DoW. Most of these systems still require boots on the ground. Once a target is found, Combatant Commands need an integrated system that can characterize and destroy these targets, without first gaining physical access. Today, for the deepest facilities that means bombing from the air. Iran is the case in point.

Background. Iran's route to a nuclear weapon is by enriching uranium. Natural uranium is composed of 0.71% uranium-235 (U235) and it’s only the U235 that is used to build a bomb.

Iran uses centrifuges to separate U235 and increase its concentration (enriching it.) One centrifuge won’t do much, but connecting thousands of centrifuges together into cascades and running them for months can produce pounds of U235.

Iran’s underground nuclear enrichment site at Natanz had well over 10,000 centrifuges installed across dozens of cascades, and their Fordow nuclear enrichment site was built for 16 cascades, roughly 3,000 machines. Before the June 2025 strikes, Iran’s three declared enrichment facilities contained more than 20,000 centrifuges in 125 full-sized cascades.

The rough estimate needed for one Iranian nuclear weapon is ~100 lbs of U-235 at 60% enrichment or 55 lbs of U-235 at 90% enrichment (modern designs use less.) The difference is important, the lighter the weapon the easier it is to fit on a missile.

At its peak (Feb 2025 to June 2025) Iran’s cascades were delivering ~86 lbs of uranium enriched to 60% which is about 50 lbs of U-235 per month, which is just under one potential weapon every month. (Most weapons use U235 enriched to 90+% because that permits a smaller, more reliable design. Getting to that level in Iran might take days or weeks running the cascades, but building it into a weapon would still be needed.)

Deeply Buried Targets Versus Bunker Busters. One of the stated goals of the U.S. strikes on Iran was to remove their capacity to build nuclear weapons. This required the U.S. to destroy their deeply buried underground nuclear enrichment sites. The largest conventional bomb in the U.S. military’s arsenal is the 30,000-pound GBU-57 Massive Ordnance Penetrator, carried by the B-2 Bomber. A 2019 description said it could reach targets as far as 200 feet underground (its actual effectiveness depends on geology, concrete, facility design, entry points, and the use of multiple weapons). The Iranians knew this and built their nuclear enrichment sites underground. The Fordow site is ~260 to 300 feet under limestone and dolomite. The Natanz site is 25 to 160 feet underground, protected by a 25-foot concrete shield. (But public estimates are over the place.)

Iran declared Isfahan as an enrichment complex to the IAEA the day before the June 2025 strikes; inspectors never got inside it, therefore its depth and geology are unknown, but speculation is that the enrichment complex is 260 to 330 feet underground. Another suspected enrichment facility is in Pickaxe Mountain, where the exact depths, geology, are unknown but estimates put the facility 250 – 330 feet below the summit. Both Isfahan and Pickaxe were Iran’s shift toward "deep mountain basing" to escape the reach of conventional military strikes.

In June 2025 in Operation Midnight Hammer U.S. B-2 bombers dropped 14 GBU-57 bombs on top of Fordow and Natanz. At Isfahan (Esfahan) more than two-dozen submarine-launched Tomahawks hit tunnel entrances and surface targets. In March 2026, strikes at Natanz hit its entrance.

According to the Institute for Science and International Security, the 22,000 centrifuges at Natanz, the Natanz pilot plant, and Fordow are almost certainly wrecked. What may have survived is the enriched uranium, the spare parts, and the people, and that is the problem. The International Atomic Energy Agency estimated (in June 2025) that Iran had about 970 pounds of uranium enriched to 60%; it has since lost track of where it is. Iran's known uranium conversion capability at Isfahan was damaged, which it needed to turn the stockpile of enriched uranium into a weapon, and there is no public evidence that enrichment has resumed at Natanz, Fordow or Isfahan. We never hit Pickaxe Mountain or the Isfahan enrichment facility with the GBU-57. The strikes have set Iran back, but no one knows for how long.

While the GBU-57 MOP cannot cleanly punch through solid rock, the debate has shifted from an absolute physical destruction calculation to a functional denial calculation—meaning the military's goal would be to seal Iran's nuclear assets in a mountain tomb rather than blowing them up directly.

Did We Succeed? Our stated goal was to prevent Iran from rapidly rebuilding the capability to build nuclear weapons, but there’s no certainty that we did that. Repeated airstrikes may have damaged the buried enrichment plants, but we can’t prove it or account for the buried enriched uranium inside. The fact is that it’s extremely difficult to see how much damage the bombs did to Hard and Deeply Buried Targets (HDBTs) from the air, and without inspectors on the ground, knowing for sure is guesswork. Putting boots on the ground would carry enormous costs and risks. Negotiating the removal and inspection of weapons grade uranium would depend on Iranian cooperation and a way to verify we got it all. All bad choices.

There is another emerging option: autonomous drilling equipment.

Subterranean Sensing and Defeat. It’s not hard to imagine that with enough boots on the ground the U.S. could secure a landing zone, fly in drilling equipment and have crews drill hundreds of feet vertically or thousands horizontally to either place sensors and/or explosives. The U.S. has had organizations building specialized equipment and training for breaching tunnels in Combatant Commands and scattered across the DoW for years (DTRA, DARPA, Army ERDC and CAVES and CZ5 programs, SOCOM, Sandia and the Army's half-billion-dollar underground-training push (2018) and ATP 3-21.51 Subterranean Operations.) One can even imagine that there are teams already trained and equipment ready to go. And one can equally imagine the Iranians are waiting for them.

What’s new is autonomous drills that could provide post-strike bomb damage assessments and/or destroy Hard and Deeply Buried Targets (HDBTs) without seizing the site. They might be inserted covertly; more likely they'd need air cover while they work.

The combination of AI, robotics and autonomy moves this from science fiction to the possible.

Anduril, The Boring Company, Exodigo, Phoenix Boring, Earthgrid and Traysar are possible candidates to deliver these systems. There are likely others as well.

(Disclosure: after my first blog about undergrounding critical assets, I invested and have a financial interest in companies in this space.)

Surface survivability and subterranean sensing and defeat are no longer one Service's problem, and they won't be solved by a single system or an incremental fix. Something fundamentally disruptive has changed in the nature of asymmetric warfare and there’s no going back. While we’re actively chasing immediate solutions (Golden Dome, JIATF-401, et al), we need to rethink the nature of force protection, and military and civilian infrastructure protection.

The U.S. needs a coherent protection and survivability strategy across the DoW and all sectors of our economy. This conversation needs to be not only about how we do it, but how we organize it, how we budget and pay for it, and how we rapidly deploy it.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The Sanctions We Cannot Afford

On the evening of Friday, October 9, the Treasury published General License 135. It authorizes the “sale, delivery, offloading and importation” of Russian diesel until April 7, 2027, and does not specify a buyer, a seller, or a quantity. The President provided the quantities after a call with President Putin: more than 300,000 tons “immediately,” 500,000 in November, and millions more if Russia’s refineries allow. The first shipment amounts to less than a day of American consumption. The shipment comes from a country that barred its own diesel exports in July and, in the last quarter, imported the fuel for the first time. AAA put the national average for diesel that day at $6.28 a gallon.

The license is valid for six months. The law beside it allows nine days. On September 18, the President signed a sanctions act that the Senate had passed 86-11. By October 18, it requires duties of up to 500 percent on Russian goods and duties of up to 100 percent on every export to the United States from any of the five largest importers of Russian crude oil or natural gas that knowingly purchases again. The first duty covers petroleum products, and so the diesel the Treasury has just licensed. A third law, passed in 2022 and never repealed, still bars Russian petroleum from American ports; the license does not mention it. Washington must penalize Russia’s customers nine days after licensing itself to become one.

For six weeks in these pages, I have argued that the United States is assembling the instruments of great-power competition without deciding who commands them. This week, the pattern reached the oldest instrument of economic warfare, the sanction, and it was not only an American pattern.

On October 7, the European Union’s ambassadors agreed on their 22nd package of sanctions against Russia. They removed one Russian company at Estonia’s request because it supplies the rare earths that an Estonian plant refines for European magnets. Two days later, in Beijing, the European trade commissioner announced an understanding under which China will moderate its exports of hybrid cars to Europe. In return, Beijing will continue to process European companies’ rare-earth and magnet licenses through what both sides call a green channel. The notice suspending China’s licensing rules for American buyers still expires on paper on November 10, eight days before the President is due in Shenzhen. The United States received no such channel.

China’s rare-earth controls are administered by a single ministry, which this week rewarded Europe while leaving the United States waiting. That is an exception used as an instrument: a favor granted in exchange for a concession, and revocable. The American and European exceptions were of another kind. They were relief from sanctions the governments had imposed themselves, granted because the price of diesel or a factory’s feedstock had become intolerable. An exception of that kind is information. It tells Moscow and Beijing the price at which the pressure on them will be lifted.

Each of the week’s decisions had a reason its government could defend. Diesel at more than six dollars a gallon before winter is a real problem, and so is a processing plant in a frontline state of the North Atlantic Treaty Organization. But a sanction lasts only as long as its author can go without what it forbids.

The difficulty is that each decision was made by the office responsible for a single problem. The Treasury issues the license; the President sets the duties, and the Trade Representative adjusts them afterward. The fuel Russia has promised comes from refineries Ukraine is striking, so every Ukrainian strike now reduces the diesel Washington has announced, and Moscow has a commercial reason to ask the United States to restrain Kyiv. The President had already asked Kyiv in September to “take it easy on the refineries,” and President Zelensky called the license “a weak decision by strong partners.” No single authority beneath the President is charged with weighing one of these decisions against another before it reaches him. Each office did its work, and the claim that prevailed was the one with the nearest deadline.

The United States has faced this problem before. In July 1943, after a public quarrel between the board planning economic warfare and the agency financing it, President Roosevelt abolished the board. By September, he had placed economic warfare, lend-lease, and foreign relief under a single Foreign Economic Administration. He did so in the middle of a war because instruments that pull against one another need someone with the authority to rank them.

The duties due on October 18 are the place to begin, and they will be easy to read. A real duty on Russian goods and on Russia’s customers restores the sanction, and taxes the diesel Washington asked for. A nominal rate satisfies the statute and confirms the license as the policy. A waiver says so outright. In the last two cases, Russia’s customers may conclude that buying is safe, and Beijing that American pressure has a price that can be quoted in advance.

Avoiding that takes two things the West has not arranged. The first is a single authority who can rank the claims before they reach the President and hold every office to that ranking: someone who decides whether the sanction yields to the price of diesel or the price of diesel yields to the sanction. The second is provision. A sanction is a siege, and a siege is won by the side that can wait. A government that means to forbid a thing should first establish what it will need from the adversary while the prohibition lasts, then stockpile it, find it elsewhere, or grant the exception at the outset on its own terms.

If you advise on these decisions, ask for the ranking before the duties are signed and for the provisions before the next sanction is drafted. Otherwise, Moscow and Beijing will read October 18 as a schedule of American needs, with the dates on which they fall due.

Richard Berry is the founder and principal of Stratnova Advisors and a former Senior Executive who led the Commander’s Action Group at U.S. Indo-Pacific Command; he publishes the weekly assessment Strategic Horizons.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

How Ukraine’s Ground Robots Are Changing the Battlefield

Operation Vivaldi, a Ukrainian military effort to repel Russian forces in the Donbas, has done much more than push back Moscow’s offensive in the region. The operation is credited with the liberation of dozens of square miles of once Russian held territory because of its mastermind use of drones and robotics on the battlefield. The operation has also ignited a firestorm of debate over the future of war and the human role. What follows is independent analysis of Operation Vivaldi by two Cipher Brief contributors who are actively engaged in the region.

INDEPENDENT ANALYSIS – Some Western commentators have suggested that Ukraine’s successful limited counteroffensive, Operation Vivaldi, by the 3rd Army Corps (3AC) has demonstrated the continued relevance of human maneuver in the face of drone technology, downplaying the ascendancy of drone warfare. In fact, Operation Vivaldi demonstrates just the opposite: the inexorable erosion of the usefulness of humans in direct contact with the enemy.

While isolated videos on social media may be found of direct fires exchanged between small elements of humans during the ongoing counteroffensive, the bulk of OSINT footage, as well as comments from Ukrainian commanders and soldiers, indicates that a new, systematic doctrine for the use of UGVs (unmanned ground vehicles) has been critical to operational success, and that humans generally advance only into lower-risk areas in the wake of waves of ground-drone advances.

The key to this doctrine is a fusion of classic American warfighting principles (taught to Ukrainians) with new tactics, techniques, and procedures (TTPs), together with a recognition of the changing spatial dimensions of modern warfare. In Operation Vivaldi, the aforementioned TTPs notably included the use of air-dropped UGVs to strike Russian positions, sow chaos behind enemy lines, take and hold ground, and clear lanes through minefields ahead of human advances.

According to “Darwin,” commander of the 2nd Mechanized Battalion of the 3AC, Russian soldiers and drones were suppressed by artillery, strike drones, and electronic warfare in order to prevent them from noticing night flights of repurposed heavy bomber drones carrying UGVs up to 19 kilometers deep into Russian lines. Some air-dropped UGVs with bombs struck Russian positions, while other UGVs with small arms would take and hold ground, sometimes killing and sometimes capturing the enemy in the process. Only then would humans incrementally advance: “We go forward, making a defense line, then waiting until artillery, flying drones and robots do their work, and then go in again.”

His men still only did this in small groups, with no restoration of large simultaneous human maneuver: “If before we moved with big battalion groups with mechanized forces, now we should use only small groups because of drones.” While this new pattern is currently only reported in use by 3AC, Darwin “said his corps was already teaching it to other brigades,” but noted that it required “a command structure ‘qualified enough as we are’ to run an operation with that many moving parts.”

But Ukraine still needed to degrade Russian operations before attempting to advance. Besides utilizing kinetic strikes, Ukrainian forces also deployed an electronic warfare “curtain” over parts of the battlefield, masking some Ukrainian movements and preventing Russian reconnaissance drones from operating. According to the Third Army Corps, its comprehensive “Defensive Dome” eliminated around 20,000 Russian drones during the operation, including via the use of interceptor drones, freeing Ukrainian armor to conduct mechanized assaults.

“Makar,” commander of the UGV unit “NG13” of the 3rd Separate Assault Brigade of the 3AC, says that air-dropped UGVs were used for months by his unit as “part of a systematic approach to sabotage operations, as such missions are aimed at eliminating the enemy deep behind their lines and in hideouts, capturing enemy pilots, disrupting logistics, and so on.” While the air-dropping technique itself may be a temporary novelty, the systematic large-scale use of UGVs ahead of humans may lead to a situation that he says “changes the rules of war.”

Makar continues: “We are developing a global doctrine for the use of UGVs... by the end of 2026, we’ll carry out a number of crazy operations the world... can’t even imagine are possible.” Regarding the military structure required, he mentions “strong coordination between the units we work with on these missions” and “the work of the workshop, planning group, command staff, and operators on duty.” He also notes the particular usefulness of UGVs--typically equipped with Starlink, hard to notice by the enemy, and not limited by station time like unmanned aerial vehicles (UAVs)--in enemy-held areas “where we have limited observation, limited FPV range, restricted operating distances, or where the enemy has strong air defense teams.”

Russian infantry has seen some success with infiltration tactics, able to slip through gaps in the thin Ukrainian lines singly or in pairs, due to the Russian tolerance for horrific casualties among such drone fodder.

Ukrainian UGVs, which need not be conserved like humans, are now performing similar infiltration missions against the Russians, but at even greater depth and sowing even greater disruption. “A UGV armed with a machine gun is probably more intimidating than an infantryman in many situations,” Obi, a soldier from Ukraine’s 3rd Special Operations Regiment, told the authors.

Makar described how in one episode, a single UGV caused disproportionate chaos: “They were freaking out over the radio, ‘A toy car flew in, then drove around, and then exploded...’ Well, their command doesn’t believe them, all hell breaks loose, and movement along that logistics route is immediately banned. All positions were placed on full combat alert... There were many times when they said, ‘No, we won’t go there because it’s unclear what’s going on there,’ and so on.” In another episode, “a single small UGV, airdropped some distance away, eliminated one enemy soldier and as a result, a full-scale enemy assault they’d been planning for days, if not weeks, was called off.”

Finally, Makar specifically refers to UGVs as a kind of replacement for infantry, saying: “Paratroopers used to drop from planes. Now UGVs are dropped from heavy bombers... I would like to address all the commanders... Emphasize ground robotic complexes... because robots don’t bleed, and human life is priceless.” Still, although they aren’t priceless like humans, drones need protection too: during Operation Vivaldi, relatively expendable UAVs were used to scout ahead of and escort UGVs.

Dmytro, a soldier with Ukraine’s Third Separate Assault Brigade, told the authors that drones and ground robots play a key role in supporting the infantry and also remove humans from some of the most dangerous tasks. “There are also many strike ground robots that drive in and destroy enemy shelters, killing the personnel inside,” he said. Some robots are meant to engage in assault operations, while others are sent behind enemy lines to conduct ambushes.

Additionally, as Ukrainian infantry and drone operators move forward, ground robots handle much of the logistics. “Ground robots make all kinds of deliveries to positions, including supplies for drone crews,” said Dmytro. “They deliver ammunition to artillery positions and supplies to the front line, and they carry out many evacuations.” In fact, 80% of tactical logistics and 90% of casualty evacuations during Operation Vivaldi were done by UGVs.

Former American soldier “Jackie,” who volunteered to serve with and advise 3AC, emphasizes that the American style of warfighting and command culture is critical to the integration of the emerging doctrine and new technologies seen in Operation Vivaldi.

“That’s been my job primarily is installing Western mission command trust and initiative.” Such concepts are embraced by 3AC, but don’t work at all for Russians: “It wouldn’t matter if I gave [them] a perfect lecture on Western Mission Command because they’re asking their guys to go die for nothing constantly... you can’t have initiative and trust in that environment... they misreport and they lie all the time.”

The effective military culture together with scaled drone use has resulted in three Russian field armies being pushed back by the much smaller 3AC, which consistently achieves an astonishingly favorable exchange ratio of 20:1 against the Russians (a claim backed up by OSINT as well as Ukraine’s battle “points” awarded according to provable kills, in which 3AC is usually leading when compared to other Ukrainian units).

Jackie points out, however, that Ukrainians have advanced past legacy doctrine and that Western commanders and planners need a feedback loop with people on the ground to keep up with what’s happening: “We’ve all been doing this for four and a half years. We are super experienced now. The operational planners who did this are elite. Sometimes you get a graduate of some war college somewhere with two pumps in the Middle East that says ‘I know everything about war and the Ukrainians should do this and that’... if you want to learn something by the way you actually have to participate in this fight. And I’m trying to constantly give out calls to Western forces... to come over here and do some work with us.”

“The theory of battle for the Ukrainians is really good. So they have a strategic deep strike campaign that’s punishing the Russian economy. At the operational level we have the midstrike campaign” targeting Russian logistics, “forcing them to have to vacate” their forward positions due to the extension of the gray zone. He adds: “The ground game is really important. If we lose the fortress belt, there will not be time for the midstrike campaign to pull Russians back. There will not be time to continue to do damage on the deep strike campaign and make the political actors in Russia pay.”

One new element of Ukrainian doctrine Jackie mentions is the need for standoff. 3AC maintains “control of ground space that enables us to continue to intercept Russian drones overhead. Russians are not able to get rocket artillery and other mass fires in range of the city of Izium.”

He says, “There is no contact line. There’s like a contact zone and that zone is 30 km across.” He emphasizes that this contact zone or “gray zone” is not a confused or messy jumble on the ground; Ukrainian commanders know where their men are positioned. But in this zone, human maneuver and logistics are severely constrained.

Dmytro said that Ukrainian forces attempted to bypass wooded areas and cut off Russian logistics, instead of sending infantry first. Ukrainian forces also continued shooting down the larger drones the Russians were using for resupply, which had a crippling effect on morale. “The enemy infantry begins to feel that no one needs them and that no help or support is coming,” he said. “Their morale becomes very low, and we make progress. Then they surrender or start fleeing.”

The principle behind the aforementioned infiltration tactics applies also to the enemy’s defense, as Jackie explains: “Where there’s just Russians all over the place that nobody cares about, and clearing them out is a pain... Driving a column across the gray zone is not an option to make an assault. That’s definitely not what we did for Vivaldi. So we had the ground drones on logistics, but also attack ground drones that were being air dropped behind the Russian line and then isolating and either fixing or destroying in many cases those isolated pockets of Russians on defense.”

UGVs are also more effective in this role than UAVs because “The Russians are going to have to fight that drone for a period of time. They’re going to have to resource Russian effectors to support the Russian fight against that drone. So in that local area this is creating ... massive chaos for whatever company’s area that drone got dropped into... they’re going to totally miss the infantry assault that’s actually approaching and being shaped towards them... some of those ground drop drones were technically like objectives for assault units to go and support... It gives everybody a lot of confidence on the assault to know that we already have a friendly force in the local area and so everybody gets moving faster as well.”

Jackie says that the soldier’s primary weapon is becoming the drone, and his pistol (secondary weapon) is being replaced by the shotgun for defensive use against drones. Yet he concedes that “there’s only one job in the military and that’s infantry. Nothing has changed about that. For all the drones... [What matters is] the ground game right in front of Kramatorsk and Sloviansk with those infantrymen.” But clearly, from all the other quotes above, we can gather that the nature of the infantryman’s work is rapidly transforming into something entirely different from closing with and destroying other infantry with rifle fire and grenades.Therefore Jackie’s point is taken to be that humans and the ground they occupy remain the ultimate tactical objective of the drones that increasingly occupy the buffer zone between them and the enemy’s forward line of humans.

Applying this notion back to the larger operational concept, we can say that combined unmanned-systems warfare, together with advanced mission command and a proper military culture based on initiative and trust, can allow unmanned systems to maneuver through the enemy’s tactical depth before human forces ever advance into the resultant pre-cleared areas.

Take it from the 3rd Army Corps: “Infantry wins wars, but we protect our infantry, which is why the robots go to the enemy first."

For deeper dives from Xen, you can follow him on X, Substack, or his personal site.

David Kirichenko is a Ukrainian-American freelance journalist who has been covering Russia’s full-scale war against Ukraine since 2022, and is an associate research fellow at the Henry Jackson Society. He can be found on X: @DVKirichenko.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The Next Drone Won't Have a Radio Link, Our Intelligence Enterprise Needs to Plan for That Now

On the last day of the 2026 World Cup, NORAD F-16s fired flares over northern New Jersey to warn off civilian pilots who had flown into restricted airspace. During the tournament, federal agencies seized more than 700 drones across 11 host cities. The counter-drone effort worked.

That's what worries me.

In less than two years, Los Angeles will open the 2028 Olympic Games, a National Special Security Event spread across dozens of venues followed weeks later by the Paralympics. The threat there won't be the one we just beat, and this summer's solutions won't be the ones we need.

I've seen this before. From 2010 to 2013 I ran the Army's Rapid Equipping Force in the middle of the counter-IED fight. Congress authorized roughly $21 billion for JIEDDO, and we spent nearly $50 billion more on MRAPs. We still lost the adaptation race. The enemy learned and changed faster than our institutions could. Drones have the same traits that made IEDs so hard to beat: cheap dual-use parts, know-how that spreads through informal networks, and changes that cost the adversary almost nothing. Drones are IEDs that fly.

The next drone won't have a radio link

We don't lack counter-drone technology. But every answer we field starts a clock; someone is already building the counter. In Ukraine and the Gulf, autonomous navigation that doesn't need GPS is maturing quickly. One operator can run a swarm, and AI handles terminal guidance. Most counter-drone systems fielded today detect the radio link between drone and operator, and jam it. The drones that matter in 2028 may not have one.

When the sensor at the venue can't hear the drone, the warning has to come from before launch. Left of launch is intelligence.

Weak signals become capabilities before we see them

The drone threat rarely announces itself. During the battle for Mosul in 2016 and 2017, ISIS dropped small munitions from commercial quadcopters. In 2024, fiber-optic drones appeared in Ukraine as a workaround to jamming and quickly became widespread. In June 2025, Ukraine smuggled more than 100 small drones into Russia hidden in trucks, flew them over commercial mobile networks with open-source autopilot software, and struck strategic bomber bases as far away as Siberia. It was built from commercial parts and networks. The capability was the combination.

The same thing is happening here, in plain sight. A small startup has built software that keeps data moving when networks fail, uses AI agents to fuse that data and recommend actions, and ships new features every week. It's built for logistics. Pair it with an off-the-shelf mesh radio sold for drones; vendors say some can cover thousands of square miles from altitude. In a matter of months, a small team could field a jam-resistant, AI-assisted network of drones and sensors that no requirement anticipated and no threat library lists.

Nothing about either piece is a threat. That's the problem. We catalog platforms; the threat emerges in the combinations. And the expertise to put them together is for hire. This month, a Ukrainian air defense officer offered me his team's combat experience on LinkedIn.

Intelligence is more than threat warning

Our intelligence enterprise tends to treat counter-drone support as a threat function: who is flying, what they intend, what is coming. That job matters, but it's one of three.

The second job is awareness. Near a stadium or a base, most drones are flown by hobbyists, photographers, delivery services or people who never checked the rules. The hard problem is finding the one that matters in a crowded sky. That takes a picture of normal: Remote ID, FAA authorizations, event credentials, known commercial traffic. Most of that data sits outside intelligence channels, with the FAA, commercial operators, and state and local agencies that gained their own counter-drone authority on July 1 under the SAFER SKIES Act. The fusion model has to be built with these partners, not around them.

The third job is adaptation. Every drone we recover tells us how the adversary is changing: firmware, components, frequencies, supply chains. That knowledge has to reach the people building countermeasures and the units that will face the same drone next week. When Gen. Stanley McChrystal's task force in Iraq tied intelligence to operations, it went from about 18 raids a month in 2004 to about 300 a month by 2006. Not with better equipment, but because every completed cycle made the next one faster.

One threat, one learning loop

It's tempting to treat Los Angeles as a homeland security problem and the Gulf as a warfighting problem. The drone doesn't care. The same parts, tactics and know-how reach forward bases, stateside installations and crowded stadiums at the same time. Northern Command couldn't determine who flew several drones over a strategic U.S. installation after the Iran campaign began this year.

That cuts both ways. What we exploit from a drone downed overseas is the earliest warning Los Angeles will get. What we test at stadiums at home, in real conditions, strengthens the force overseas. JIATF 401 convenes DHS, the FBI, the FAA and dozens of other federal organizations; its director, Brig. Gen. Matt Ross, puts it plainly: "Nobody can solve this problem alone." Intelligence has to be the engine that makes that connection worth having.

Two clocks, one collision point

Our planning runs on a deliberate, gated clock: fund, test, buy, then freeze the configuration so people can train on it. The adversary's clock has no freeze date. State actors are patient: they watch our events, probe our installations and study our playbook. Extremists and lone actors copy what works overseas, hide among careless flyers and can change tactics up to the day they act. Whatever becomes cheap and proven overseas in early 2028 will be available to them in July 2028.

The collision point is our freeze date. Whatever they adopt after it, we meet unrehearsed.

The answer: test continuously through 2027 at real events, buy fast in early 2028, and never fully freeze. Keep money, authority and software update paths open so something can still change in the final 90 days.

Intelligence has to unfreeze the plan

Only intelligence can create the pressure to reopen a plan that has been funded, tested and trained on. Program managers have every incentive not to, and operators rarely get the chance. The intelligence community should schedule those assessments now, tied to the plan's decision points:

a threat baseline today
a reassessment after every 2027 test and every real incident
a formal assessment before we buy
a final one inside the last 90 days

Each should answer one question: what has changed that should change the plan?

Sometimes the answer will be "nothing." The system has to be ready for the times it's "a lot." That means flexible funding that portfolio managers can move as the threat moves, and a Congress willing to let them.

In Afghanistan, when the enemy adapted faster than we did, soldiers and allies paid for the delay. We know the date of the next test. Build for the threat we'll face in 2028, not the one we just beat.

Pete Newell is the CEO of BMNT and a former director of the Army's Rapid Equipping Force.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The Future of Iran Lies Beyond the Regime

The U.S. administration is pursuing its latest strategy: a naval blockade combined with aggressive “Outcast” sanctions, aiming to strangle the Iranian economy, force the regime to its knees, and compel it to return to negotiations on American terms.

Simultaneously, Washington is deploying additional military assets to the region. This is being framed as deterrence, but functions instead as yet another ultimatum. Any significant escalation, or even the credible threat of renewed strikes, risks triggering IRGC retaliation against critical Gulf energy infrastructure. While IRGC missile and drone inventories have been diminished, and exact IRGC munition levels remain classified, the regime likely maintains more than enough asymmetrical firepower to inflict massive damage before being neutralized.

Meanwhile, Tehran prevaricates, dodges, and plays for time. All while playing the victim, weaponizing scarcity, and brutalizing its own population. Their calculation is simple: endure enough short-term pain, while cynically passing the full brunt of it onto the Iranian people, to outlast Washington’s political tolerance.

Threats to the Strait of Hormuz and claims of control over shipping are manufactured leverage to be traded away at the right moment. They know this is opposed by virtually the entire world. By eventually “conceding” on this demand, a classic, predictable negotiating technique, they hope to secure what they truly seek: regime survival, proxy retention, and unimpeded continuation of their nuclear program.

These two paths clearly conflict with one another. Only one will prevail. But in the end, allowing an emboldened, empowered, nuclear-threshold regime to survive on their terms is utter strategic failure.

I vote for the U.S. winning. For the fall of a malignant regime that cares only about its power and wealth and holds its own people hostage.

There are no good options here. No simple fixes for where we find ourselves. Anyone with eyes can see that. So, then what?

A Radical Proposal

Forget talking to the regime. Speak to the Iranian people. Directly. Without hyperbole and with brutal candor.

Prepare them for what is coming. Not with hysterical rhetoric of annihilation, false promises of “boots on the ground,” or premature calls to take to the streets before conditions are ripe.

Tell them clearly: the target is the regime, not the nation, culture, or people of Iran.

Include regime insiders in this messaging, focusing on rank-and-file security forces, the regular military (Artesh), and yes, even IRGC leadership. They will receive the message. Some may act on it.

Be honest about what is coming: that breaking this regime will mean severe economic hardship, power disruptions, and scarcity, possibly even water shortages. Pair that honesty with a credible, binding commitment to a brighter future: a detailed blueprint for immediate relief and reconstruction, asset unfreezing, and re-integration into the global economy once the regime falls.

And lastly, assure them that Iran and Iranians will control their own fate, politically and economically.

I don’t consider myself naïve. This will be difficult. I was a specialist on Iran at the CIA for several decades. I saw both the worst and the best of Iran and Iranians. But the Iranian people (and the world) deserve more than this regime has to offer. Let’s give them (and us) that chance.

Prepare the ground, align the message, then execute.

This article was originally published on Mark Fowler's Substack.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

How War Starts: A Warning from the Korean DMZ

The current landmine incident in the Demilitarized Zone of the Korean Peninsula could escalate into conflict on the Korean Peninsula.

South Korea and the United Nations Command said North Korea violated the Korean War armistice following a landmine blast on September 21 in the South Korean side of the DMZ, injuring three South Korean soldiers, two severely.

Kim Yo Jong, the sister of North Korean leader Jim Jong Un, dismissed South Korea’s allegations, saying they were a “conspiratorial farce”, threatening immediate and merciless retaliation if South Korean troops open fire on North Korean workers. She accused South Korea of fabricating a “self-directed farce”, creating groundless claims to create a pretext for political and military provocations.

South Korean President Lee Jae Myung on October 1, in an Armed Forces Day speech, said: “I hope that the North joins us now on the path of restoring trust and resuming dialogue, following a long interruption… and consistently pursue practical measures to reduce military tensions between the two Koreas.”

Hopefully, this incident doesn’t devolve into an August 18, 1976, incident when U.S. and South Korean personnel were pruning a tree in the Joint Security Area of the DMZ when North Korean guards, claiming the tree could not be cut, attacked with axes and clubs, killing U.S. Army Captain Arthur Bonifas and First Lieutenant Mark Barrett and wounding several others.

The U.S. response was quick and powerful, mobilizing troops, attack helicopters and B-52 bombers. Given this U.S. response, North Korean leader Kim il Sung issued an unprecedented statement of regret regarding the killings of two U.S. personnel.

The current situation is markedly different than 1976. North Korea is now a nuclear weapons state, with formidable ballistic missiles, while maintaining a conventional military force of nearly 6,000 conventional artillery systems and thousands of rocket launchers within striking distance of Seoul. Estimates of close to 200,000 special operations personnel are tasked with infiltration via tunnels and aircraft to disrupt South Korean command centers. Moreover, North Korea is now closely aligned with Russia, with a mutual defense treaty.

Given the progress North Korea has made building an arsenal of reportedly 60 to 100 nuclear warheads, and the ballistic missiles to deliver them, in addition to a mutual defense treaty with Russia, it would be fair to assume that Mr. Kim is more confident than his grandfather, Kim il Sung, in 1976.

Mr. Kim announced in January 2021 that North Korea had miniaturized nuclear warheads that can be used for tactical battlefield use. And in 2022, North Korean media confirmed that in 2022 they simulated tactical nuclear strikes to “wipe out” targets in South Korea.

Indeed, in September 2022, North Korea enacted a new nuclear law that declared that their nuclear weapons status was irreversible, authorizing preemptive nuclear strikes if their leadership or command systems is threatened. In March 2026, North Korea reportedly amended its constitution to mandate an automatic and immediate nuclear retaliatory strike if Mr. Kim is assassinated or if the country’s command-and-control system is threatened.

Ever since Mr. Lee, representing the liberal Democratic Party, was elected president of South Korea in June 2025, following the impeachment and removal of former president Yoon Suk Yeol of the conservative People Power Party, he has advocated for a resumption of dialogue with North Korea. Indeed, this inter-Korean dialogue ended in June 2020 when North Koea blew up the inter-Korean Liaison Office in Kaesong, claiming that this was in response to activists in South Korea floating balloons across the border carrying anti-regime propaganda pamphlets critical of the leadership in North Korea.

In the absence of dialogue between the two Koreas, with North Korea revising its constitution to say South Korea is a hostile state and their principal enemy, eliminating any reference to peaceful reunification and national unity, any incident like the landmine blast could escalate quickly.

An emboldened leadership in Pyongyang can seize on an incident of this type to escalate tension with South Korea, devolving into conflict, with the potential for another war on the Korean Peninsula.

Resuming an unconditional dialogue with North Korea should be our primary goal.

This article was originally published in The Washington Times.

The author is the former associate director of national intelligence. All statements of fact, opinion or analysis expressed are those of the author and do not reflect the official positions or views of the U.S. government.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

How America Wins the AI Race With Open Source

Speaking in Shanghai on July 17, Xi Jinping offered the world a vision of AI “for the positive, for good and for humanity.” He called for open source, openness, and sharing. He cautioned against stretching national security to cover the field. And he announced that over the next five years China will train 5,000 people from developing countries, build AI application cooperation centers with ASEAN, the Arab League, the African Union, CELAC, the Shanghai Cooperation Organization, and BRICS, and extend its MAZU meteorological warning system to 30 countries. The World Artificial Intelligence Cooperation Organization now exists in Shanghai with 37 member states.

This reasonable sounding offer is aimed squarely at the governments the United States most needs: countries that want AI capacity, local control, and a voice in setting the rules. For these governments sovereignty means control rather than independence, and a system they can operate locally is an easier sell than a remotely controlled API. Beijing pairs capable open weight models and inexpensive inference with training, institutions, and public goods, then wraps the package in the vocabulary of multilateralism and the United Nations.

The results are already visible. CNAS counted sovereign AI initiatives in 67 countries and the European Union by mid-2026, up from 16 governments in 2023, and most model projects with disclosed foundations adapt a foreign open weight model rather than train one. Increasingly that foundation is Chinese. Spain’s Quasar 438B, billed as Europe’s strongest reasoning model, is built on Z.ai’s GLM-5.2. Japan’s Rakuten AI 3.0 uses the DeepSeek-V3 architecture. AI Singapore built its latest regional model on Alibaba’s Qwen rather than Meta’s Llama, and Saudi Arabia’s HUMAIN commissioned its Arabic model from MiniMax. Chinese open-weight models passed the American share of global downloads for the first time in 2025, and on OpenRouter, a marketplace that routes developer traffic to models, their share of usage climbed from under 15 percent to more than half within a year, with businesses in the Global South the heaviest users.

The United States can win this competition, but not just by publishing the most advanced models and declaring victory. It must make American technology the preferred foundation for other countries’ AI systems, as American software and protocols became the foundation of the modern internet. That requires capable models, affordable hardware, financing, training, and dependable support, assembled into an offer that can stand beside a cheaper Chinese full-stack bid.

What America Must Do to Win

Washington should compete throughout hardware, models, software, and services. Retreating to frontier models and advanced chips while China supplies the open models, inexpensive inference, and industrial applications through which most of the world will actually use AI would surrender the contest at the layers where adoption happens.

Openness alone wins nothing. It gives a country seeking local control a reason to consider a model, not a reason to prefer an American one over a Chinese one. The American model must win on performance, total cost, local-language capability, reliable supply, and support, and it must leave room for domestic firms to build businesses around it. Partners deserve honest terms about licenses, updates, and what happens when a supplier relationship ends, and they have reason to ask. When U.S. controls forced Anthropic to suspend access to its newest models from June 12 to June 30, governments learned that even allies can lose access to American systems on a decision made in Washington. Autonomy has to be part of the product, because autonomy is what Beijing is selling.

The model is not hypothetical. An Indian financial firm runs DeepSeek on rented GPUs in India; the weights reside locally, inference never leaves the country, and there is no API for a foreign developer to revoke. Partners want the same from America, with the hardware, financing, and support that make it work. The developers now building on Qwen and DeepSeek show the cost of ceding that ground: expertise accumulates around particular models, models are tuned for particular hardware, and both pull future purchasing with them.

What China Is Doing

Xi’s language of openness should be read alongside that of Chen Yixin, China’s Minister of State Security. Writing in the Cyberspace Administration’s magazine in September, Chen describes AI as a primary battleground of great-power competition. He links political security, espionage, cyber capability, and military transformation to technological independence and control over international governance. An intelligence chief is explaining how AI alters the conditions under which his state exercises power. The two speeches are not in tension. One describes the offer; the other describes the objective.

The institutions Xi announced serve both. A cooperation center with each major regional bloc is a venue where Chinese models, hardware, and standards become the default for an entire region’s developers. A meteorological warning system deployed in 30 countries is a public good that also installs Chinese infrastructure and data flows in 30 capitals; an Egypt-specific version with aviation weather and sandstorm warnings is already in development, while Huawei courts Cairo for its Ascend chips and Malaysia weighs the same hardware. This is the softer sell: adapt the technology to the customer’s existing systems rather than demand reorganization around the supplier, as 01.AI did in building Kazakhstan’s national model. The World Artificial Intelligence Cooperation Organization is a bid to set governance terms in a body Beijing convened, and Xi’s warning against an expansive national security concept is a preemptive argument against the export controls Washington relies on. Washington should engage on international standards, but only where the decision rules leave Beijing no approval power over American development or release, at home or abroad.

Beijing’s openness may not last. Reuters reported in July that Chinese authorities were weighing restrictions on their own frontier models, and the TC260 AI Safety Governance Framework 3.0, released September 14 under CAC guidance, points the same way. Alongside provisions on loss of control and autonomous cyberattacks, its treatment of capability diffusion and removable safeguards suggests China may grow more selective about open releases. If so, its position as the default supplier of capable open models may not endure, and the window for an American alternative is open now.

The Tradeoff America Should Accept

Open models cannot be recalled once distributed. That is their appeal to partners, and it means adversaries will use them. The presumption should nonetheless favor open release. Any exception should identify the capability at issue, the security benefit of withholding it, the cost to American adoption, and whether adversaries can obtain comparable capability elsewhere. With a near-peer challenger offering alternatives, withholding American models may merely divert adoption without diminishing adversary capability. Washington can still restrict advanced chip exports for defined security reasons; a partner’s choice of competing hardware is a reason to improve the offer, not to penalize the partner.

Partner autonomy does not require surrendering American authority over domestic release decisions, export licensing, or the integrity of U.S. networks. It requires accepting that American benefits need not depend on a remote veto over systems partners already operate. Government and military users at home should continue to choose systems, closed or open, on performance and security.

What Washington Should Do

The July 2025 AI Action Plan endorses open-source and open-weight AI, and Executive Order 14320 on exporting the American AI stack supplies a framework for coordinated technology packages, diplomacy, and financing. The task is to convert those commitments into an offer that wins.

Fund what the market will undersupply: sustained open releases, smaller-language capability, independent evaluation, and affordable local deployment. Make the complete package competitive, with financing, predictable hardware access, workforce training, and genuine roles for local firms, and resource it as the national security priority it is. The Export-Import Bank’s $66.1 million guarantee for Côte d’Ivoire’s national data center shows the tools exist; it needs to operate at the scale of China’s regional cooperation centers. Demonstrate the bargain with willing partners through a sovereign AI pilot, potentially building on Pax Silica, that discloses remaining dependencies and compares cost, delivery time, and power requirements against the alternatives. Each regional cooperation center Beijing opens should have an American counterpart that partners can judge on results. Then measure the results: which models partners choose, whose hardware serves them, and who earns the integration revenue. A lost American sale does not always deepen dependence on China, and a won one does not always reduce it.

American leadership will prove most durable when partners have their own reasons to sustain it. The test is what countries choose to build, and whether building with America remains worth it to them.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Unique Risks of AI Adoption in Developing Economies

The U.S. must set dominance of global AI sector as a strategic economic and national security priority. If the PRC becomes the dominant provider of AI infrastructure and LLM model development, this will have dire consequences for the U.S. and allow the PRC to embed itself in many foreign countries, especially across developing economies. Developing economies, which have a more positive view of AI than their more developed counterparts, face increased risks and less ability to counter them.

The People’s Republic of China (PRC) is actively working to shape technological choices, including those related to AI through its Digital Silk Road. While the stated purpose of the program is to enhance global connectivity, it carries strings. The program embeds Chinese tech standards and companies on participants, which expands Beijing’s economic, geopolitical, and directive influence in cyberspace. These investments include hardware and software infrastructure that can lead to an effective long-term lockout of other competitors in this space. The U.S cannot let this happen.

U.S. failure to lead risks both the economic advantages, including market access, of the largest AI ecosystem and the ability to shape global standards, governance, norms and values (including privacy). In the absence of U.S. leadership, this space is likely to be filled by a nation with differing standards, norms, and values. When the U.S. engages, it can offer transparent partnership with auditable open models, reducing the chance that partners turn to less safe alternatives, and strengthening U.S. partnerships with those countries going forward.

If Beijing's systems become the default, it may not only provide data to improve their own AI capabilities, but also potentially exposes the purchasing country, and U.S. interests in that country, to disruption or espionage risk. These risks grow exponentially if these either adversarial or compromised AI systems are used in ports, grids, communications or other critical systems.

AI is not physical infrastructure, but when widely embedded it becomes infrastructural -- hard to replace, a key foundation for economic activity, and subject to resilience, security and lock-in dynamics that give the provider geopolitical leverage.

This combination of risks and opportunities makes U.S. leadership in developing-economy AI investments essential, not only for American economic interests, but also for the long-term national security and sovereignty of developing economies themselves. Converting those advantages into durable influence in the developing world requires deliberate engagement, including efforts like Pax Silica. The window for trusted U.S. partnerships on secure infrastructure, open and auditable models, and capacity building is open but narrowing.

Notable trends in AI investments in the Developing World

Across the world, governments are seeking to leverage AI for public and private sector gains, but funding sources and the types of AI models employed diverge significantly. These choices have large short- and long-term impacts. Between 2017 and 2025 more than 80 countries published national AI strategies. As of 2023 developing countries were less than half as likely (just 30 percent) to have these strategies as developed countries (more than 60 percent).

While national AI strategies are expanding across developing economies, follow-through including funding - varies. For example, India’s IndiaAI Mission has committed substantial resources to infrastructure and ecosystem development aimed at sovereign capabilities. Kenya has adopted a National AI Strategy (2025–2030) alongside skilling initiatives and public-private AI hubs. The African Union’s Continental Artificial Intelligence Strategy provides a regional framework, while countries such as Nigeria and Rwanda are advancing targeted investments in AI centers and applications.

Many of these efforts are public-private partnerships with both domestic and foreign funding. A PRC company has positioned itself as Rwanda’s digital transformation infrastructure partner on projects including but not limited to AI. The PRC is also building key parts of Kenya’s AI infrastructure and providing funding to support it through loans.

A key trend is the choice between open-source, open-weight and closed, or proprietary models. Open-source and open-weight offer customizability, including linguistically, increased data control and sovereignty, and the ability to self-host, meaning the owner controls the infrastructure and can better control the costs. Fully open-source models go further by also releasing training data and code, allowing deeper inspection. Open-weight models require less upfront costs than open-source, which requires training from scratch.

Closed or proprietary models usually deliver out-of-the-box performance, require less infrastructure and come with providers who support continuous updates. However, they offer far less customizability and higher, as well as less predictable costs driven by usage volume. They can also create dependence on the provider for access, security, and future capabilities. These choices will shape data flows, as well as technological and geopolitical dependencies, for decades. Proactive U.S. leadership can help ensure AI becomes a source of shared prosperity and security rather than risking a new avenue of vulnerability and influence.

Unique challenges of AI in the developing world

Most low- and lower-middle-income countries face challenges in finding talent to support AI and other ICT needs, limiting local ability to design or train models. Developing markets also face private sector hesitancy to finance large-scale AI infrastructure given low demand and less reliable power which reduce guarantees that returns will justify the capital outlay. This makes government investment and use of AI for services a potentially critical anchor for AI infrastructure and adoption by creating the initial demand that later attracts broader private investment.

Developing countries are also more likely to have weaker legal and regulatory frameworks, creating uncertainty for AI investment and implementation. Lack of clarity around liability and enforcement raise costs and uncertainty which deters investments, since risk is more challenging to reliably assess or manage. Weak frameworks can also lead to AI exacerbating underlying issues by making processes, such as authoritarian surveillance, more efficient.

AI usage presents privacy risks that are heightened in lower capacity environments common in the developing world. AI models require massive amounts of data often including sensitive personal information such as location, biometrics, and communications to support pattern recognition that lets them serve users. Uses such as healthcare, smart cities, and surveillance infrastructure, require collecting and leveraging huge amounts of highly sensitive data. AI models also require auditing including for bias, which exposes the data and may let vendors or governments repurpose it.

Whenever large amounts of data are collected, privacy is at risk, making it important to minimize inadvertent exposure. Strong cybersecurity standards are essential for protecting this data. This makes it essential that privacy is included by design – from the outset – in AI efforts. These principles must be coupled with broader secure-by-design cybersecurity principles and leveraged into frameworks that are incorporated into all implementation.

For example, many countries lack comprehensive data protection laws, and enforcement mechanisms may be especially weak in developing economies, making it difficult to impose meaningful constraints on data collection, use, or cross-border transfer. Countries with weaker institutions and legal foundations face increased risks. These factors make privacy principles both more essential and more challenging to implement in developing countries.

Different Model Types as Developing Countries Adopt AI at the Government Level

Open-source and open-weight models are the primary ones being adopted by developing economies at the government level, chosen to support sovereignty and reduce dependency risk. Closed or proprietary models often involve data flowing outside the sovereign country, risking access by another state and passage into jurisdictions with different safeguards. But localized data alone does solve for data security, and even with self-hosting, limited local cybersecurity remains a risk.

Data centers being located physically in country does not necessarily give control over the technology, data, or strategic assets. For example, across Southeast Asia especially Malaysia and Indonesia the rapid expansion has been driven largely by foreign hyperscalers, but the underlying technology and decision rights are outside the host-country’s control. This can also create risk of export-control diversion, for example Singapore’s 2025 prosecution around misrepresentation of the end-users of servers containing U.S.-controlled Nvidia chips.

It is likely that open-source and open-weight models will remain the primary choice for high-volume and self-hosted use driven by cost and return on investment. Open models achieve approximately 90 percent of the performance of closed models at release and quickly make up the difference. This performance gap is continuing to narrow, and costs for comparative open models can be 17 percent that of the alternatives.

Across developing economies, AI models from the PRC are gaining traction more quickly than Western models. DeepSeek is being adopted across Africa at a rate two to four times that of Western alternatives, likely because of the cost and openness, key factors in resource constrained environments. Of note, Australia, Taiwan and South Korea have all issued public warnings around the security risks of DeepSeek, including banning its use on government devices. Some U.S. models are competing, such as Meta's open-source Llama which is used for purposes including to deliver agricultural advisory services in Kenya, Nigeria, and India. But AI adoption and development across the world are evolving, leaving opportunity for market capture still in flux.

Current Impacts of PRC Investment in AI in Developing Countries

The PRC has been focused on advancing its global digital infrastructure footprint for more than a decade through a Belt and Road linked Digital Silk Road (DSR). The DSR covers a broad range of investments from surveillance technology to cloud computing and AI, from infrastructure to LLMs. Infrastructure support of any kind is uniquely difficult to reverse, locking in relationships between the two countries even if the geopolitical landscape shifts. This can open the door to coercive leverage should the providing country wish to exert it.

The PRC has already built significant parts of digital infrastructure across the Global South, especially across Africa and Asia, including telecommunications networks, fiber-optic cables, data centers, cloud services, and smart cities. By building this infrastructure, providing software and setting operating standards, the PRC creates systems that their state actors understand completely posing significant risk for penetration and influence. PRC’s national security laws require Chinese firms to cooperate with the state, meaning that the use of even supposedly private-sector technology from the PRC presents government surveillance risks. This poses a risk as the U.S. attempts to engage with these countries across sectors.

AI is likely to be foundational for the global economy over the next century. When countries adopt an AI product in partnership with another country they at least informally adhere to the standards of the producer. PRC leadership on AI opens the door for Beijing to set global standards on detecting bias and training models that are likely to think about the world the way the CCP does. The U.S. not leading in this space does not just risk U.S. market share but also the U.S. ability to set the operational and cultural standards for AI. If a U.S. adversary captures this market and sets these standards the U.S. will face long-term national security challenges.

How to Win

The U.S. does not need to match the PRC dollar for dollar but must arrive with solutions and credible long-term funding packages to the global south. The PRC’s own neighborhood, the Indo-Pacific, can offer a model for how this might function. In 2022, Solomon Islands took a PRC concessional loan to build 161 Huawei telecommunications towers. Yet when Australia funded the Coral Sea Cable in 2018 in place of a Huawei proposal to connect Papua New Guinea and Solomon Islands, and when Australia, Japan and the U.S. committed to jointly finance the East Micronesia Cable, allies showed that a trusted, competitive alternative can win when it is financed and offered early.

The U.S. can work with allies and partners already in these markets, particularly Australia, Japan, South Korea, India and Singapore in the Indo-Pacific, to co-finance infrastructure. These partnerships can and should also include security assistance that supports model evaluation and guidance on secure hosting. Such partnerships offer governments across the Global South a strong alternative without asking them to choose between great powers, a choice many are reticent to make.

Hegseth’s Vision for a New American Military

“It's worth saying again so that the fake news understands it. We are no longer the woke department or the weak department. Simple translation of that: No fatties, no trannies, no beardos, no weirdos, no wimps, no radicals, just warriors -- just tough, ready, committed troops. The War Department, as you know, is colorblind, gender neutral, and merit-based. Or, as the President likes to say to me: ‘Pete, central casting. I want central casting.’”

That was Defense Secretary Pete Hegseth speaking on The State of the Force last Wednesday at the Marine Corps Base, Quantico, Virginia to a group of 600 selected O-3 junior officers (Captains in the Army, Marine Corps, Air Force, and Space Force; Lieutenants in the Navy and Coast Guard) and E-6 enlisted service personnel (Staff Sergeants in the Army and Marine Corps; Petty Officers First Class in the Navy and Coast Guard; Technical Sergeants in the Air Force and Space Force).

President Trump wants a military that looks like “central casting,” and Defense Secretary Hegseth, who looks and acts as if he, himself, came out of central casting, gave last week’s speech, reminiscent to anyone over 45 of the 1970 movie Patton, where George C. Scott playing Gen. George S. Patton also spoke before a full-screen American flag.

“The ideological clowns are out,” Hegseth said, “The patriotic cowboys are in with testosterone testing on top.”

He is correct.

He spoke of bringing back PT (physical training) “for every combat MOS (military occupational specialty),” adding, “We now have a combat field test, again, set at the highest male standard, only because combat doesn't care. That means two PT tests every year for every unit.”

As for picking senior leaders, Hegseth said, “We got rid of the DEI-based (diversity, equity and inclusion), social, emotional, evaluations known in the Army as BCAP [Battalion Commander Assessment Program] and CCAP [Colonels Command Assessment Program]. You won't have to endure them. They were [former-Joint Chiefs Chairman Gen. Mark A.] Milley and [former Defense Secretary Lloyd] Austin specials, intended to create politically-correct quotas for race and gender. Under the guise of double-blind psychology assessments, the previous administration forced out so-called toxic leaders in favor of promoting risk-averse, get-along to go-along conformists.”

However, Hegseth left out the important fact that BCAP and CCAP were products of the first Trump administration, put together by Casey Wardynski, then-President Trump’s appointed Assistant Secretary of the Army for Manpower and Reserve Affairs.

In prepared testimony for a March 11, 2020, Senate Armed Services Subcommittee on Personnel, Wardynski said, “The Army is currently prototyping, piloting, or implementing talent management initiatives from Talent Based Branching (TBB) to Battalion Commander

Assessment Program (BCAP), with the goal of implementing most of these initiatives by December 2020… Exit interviews and surveys from participants, board members, and distinguished visitors indicate BCAP is better than the legacy system for selecting battalion commanders and other key Lieutenant Colonel positions. Seven hundred and fifty candidates participated in the first iteration of the BCAP in January and February 2020.”

In a September 21, 2020, Army release about testing the new Colonels Command Assessment Program (CCAP) for bias at Fort Knox, Kentucky, Wardynski is quoted saying of the CCAP program, “When we started things like talent management and then this [CCAP], the question of fairness came up. A lot of the focus of fairness was to the individual.”

Although Milley was Army Chief of Staff at the time Wardynski’s BCAP and CCAP were being introduced, then Gen. Austin was head of Central Command and not involved.

Since January 25, 2025, when he became Defense Secretary, Hegseth has changed the senior leadership of the military and even has plans that could affect the leadership in years to come, and I will discuss that below.

First I want to point out that Wardynski was not the only originator that Hegseth ignored during last week’s speech.

For example, former-Defense Secretary Ash Carter and his Deputy Defense Secretary Robert Work in 2015 established the Pentagon’s Defense Innovation Unit (DIU) which was the initial effort to bridge the gap between the Defense Department and commercial technology through rapid investments in autonomous systems, human-machine teaming, and even early Artificial Intelligence (AI).

Project Maven, linked to DIU in 2017, focused on integrating computer vision and AI into drone operations, allowing computer algorithms to autonomously scan hours of aerial drone video footage to detect and tag potential tactical targets.

This sounds a lot like Hegseth’s new Autonomous Warfare Command (AutoWarCom). And to tie the connection further to Carter and Work’s DIU, Hegseth named Owen West, who up-to-now has been DIU’s Director, to be Chief Executive Officer of AutoWarCom.

Then there is Project Meridian, which is supposed to -- in Hegseth’s words -- “Creatively look to the future and identify the domains that we must conquer and capabilities we must master.”

We old-timers knew Andrew (Andy) Marshall and his Office of Net Assessment at the Pentagon which was started in 1973. With a small staff and a wide range of consultants, Marshall covered many areas related to national security. When he retired in 2015, his work was carried on until Hegseth disestablished it in March 2025.

Hegseth’s March 2025 memo called for a plan to rebuild the Marshall office in a manner “consistent with [Hegseth’s] priorities.”

Project Meridian may be that. As Hegseth described it last week, “We need to be looking forward into the future to achieve technological and military dominance on the battlefield for

decades to come. It is futuristic on purpose. Their work will be focused on discovering, developing, and fielding the weapons and systems that our children and our grandchildren will need in their lifetimes without any creative limitations or restrictions.”

Hegseth said last week that he has from the beginning wanted a 20 percent reduction of flag officers “across the board,” adding, “Now, the media calls that a purge. I call it accountability, long overdue and frankly the bare minimum…You see you can't change a culture with the same people who enabled it.”

A list of those fired, compiled by CBS, is impressive: Air Force General Charles Q. Brown, chairman of the Joint Chiefs of Staff; Navy Admiral Lisa Franchetti, chief of naval operations; General James Slife, Air Force vice chief of staff; General Randy George, Army chief of staff; General David Allvin, Air Force chief of staff; Army Lieutenant General Joseph B. Berger III, Army Judge Advocate General; Air Force Lieutenant General Charles Plummer, Air Force Judge Advocate General of the Air Force; Admiral Alvin Holsey, head of U.S. Southern Command; General Christopher Donahue, head of U.S. Army Europe and Africa; Air Force General Timothy Haugh, NSA director and head of U.S. Cyber Command; Lieutenant General Jeffrey Kruse, head of the Defense Intelligence Agency; Air Force Lieutenant General Jennifer Short, senior military assistant to Defense Secretary; Vice Admiral Nancy Lacore, Navy Reserve chief; Rear Admiral Milton Sands, head of Naval Special Warfare Command; General David Hodne, Army Transformation and Training Command; and Major General William Green, head of the Army Chaplain Corps.

In addition, I add Navy Secretary John Phelan and Army Secretary Dan Driscoll.

Needless to say, nothing like this has happened in the past to the U.S. military, and it doesn’t end there. We don’t know the full extent of the individuals Hegseth has knocked off promotion lists, although indications are clear they are most often women and minorities.

In another effort to affect the future, Hegseth not only has sought to force changes in the Service Academies’ curricula and civilian tenured teaching staffs, he announced in last week’s speech an attempt to influence college ROTC units and thus the future generation of young officers.

He also announced establishment of a new program, America’s Core of Cadets, to be initiated at five specified institutions: Louisiana State University (LSU), Liberty University, Tuskegee University, Mississippi State University, and Hillsdale College.

The publication Inside Higher Ed reported last week that LSU will establish a four-year military or national security program; create a self-governed student military organization – a cadet corps -- led by an independent commandant who reports to LSU’s president; and cadet members will be required to wear uniforms during all academic hours.

On top of all this, Hegseth also announced establishment of an Office of Religious Affairs, which will report straight to the Defense Secretary, or as he put it: “No staff filters, no bureaucratic dilution, a direct line to the Secretary. This is not going to be a paper-pushing shop. It's going to have real teeth. They'll protect budgets, demand infrastructure, and strengthen religious support.”

To justify this religious office, Hegseth pointed out, “Less than five percent of our force identifies as non-religious. Less than five percent. Meaning 95 percent of our force recognizes an almighty God.”

As with other statements made by Hegseth, this is not totally true.

According to a 2019 study conducted by the Congressional Research Service, approximately 73 percent of all military service members identify as people of faith, compared to less than three percent who are atheist or agnostic. Religious diversity in the military is broadly representative of the U.S. population, with nearly 70 percent of active duty military personnel who consider themselves to be Christian.

Hegseth said last week, “Our department is, you might say, putting on the full armor of God, because while we wage physical war, we all know the real battle is spiritual.”

Reviewing all Hegseth is doing, as a drafted, two-year Army veteran from the 1950s, I would say our Defense Secretary is taking the spirit of true government service out of the military I have known.

Update: We corrected an earlier misquote from Pete Hegseth.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Election Security: Keeping Our Disagreements Our Own

About one month before Election Day, Americans deserve to know how their government is protecting elections from foreign threats. The Pentagon’s recent directive assigns military intelligence and cyber capabilities to that mission. I welcome that commitment. Americans also need to understand how it fits into the national effort and how federal agencies are supporting the state and local officials who administer elections.

As a former Election Threats Executive at the Office of the Director of National Intelligence, I would have preferred an ODNI-led announcement explaining the foreign threat and the coordinated response, with the FBI, Defense Department, and Department of Homeland Security alongside it. Most of my career was spent at the intersection of combat support and intelligence. My preference comes from ODNI’s role in integrating intelligence across agencies and explaining what it tells us about foreign threats.

Election security depends on accurate ballot counts and public confidence grounded in credible information. An announcement centered on Defense risks giving a military cast to the mission and leaving the public with an incomplete picture. Americans need to understand how federal agencies use their authorities and resources to support elections administered by state and local officials.

An Old Threat Comes Into Focus

Foreign efforts to influence American elections did not begin in 2016. Soviet operations against President Ronald Reagan’s 1984 reelection campaign included a forged letter intended to discredit him. The FBI publicly exposed the forgery. The technology was different, but the purpose is familiar: manipulate Americans’ perceptions through concealed foreign activity.

The 2016 election brought that threat into the center of American public debate and forced a reassessment across the Intelligence Community. The January 2017 intelligence assessment described Russia’s campaign as an escalation in the scope, intensity, and directness of its efforts. Hacking and influence operations could reinforce one another, reaching Americans through channels they used every day.

Identifying a foreign operation is only part of the job. The people it targets need enough information, soon enough, to protect themselves.

By the 2020 election cycle, the government had developed a more deliberate answer. It involved intelligence collection and analysis, investigations, cyber defense, support to election officials, and decisions about what information could be shared beyond classified channels.

Russia is part of a broader challenge that includes China, Iran, and countries with varying relationships with the United States. We need the full national security team to understand what these governments are doing and why, and to inform the operations and policies needed to counter interference, regardless of who is behind it.

What the 2020 effort taught us

The Executive Branch Notification Framework, adopted in 2019, established a process for deciding when and how to notify people about foreign election influence and interference. It complemented existing victim-notification requirements. An interagency group organized by ODNI evaluated threats; DHS handled notifications concerning critical infrastructure, while the FBI handled other notifications.

The framework recognized that different threats require different forms of communication. Some call for a private warning to a targeted candidate or organization. Others justify informing the American public. Decisions were intended to be coordinated and nonpartisan, while respecting protected speech.

Public communication in 2020 extended beyond that framework. In July, National Counterintelligence and Security Center Director William Evanina described intelligence briefings for presidential campaigns, political committees, and Congress. His July 24 public statement and August 7 update also provided unclassified information about the evolving foreign threat. These were complementary channels: detailed briefings for particular audiences and information the broader public could use.

There were also coordinated announcements about specific threats. On October 21, the DNI and FBI director appeared together at an election-security press conference. FBI Director Christopher Wray explained the Bureau’s investigative responsibilities, described cooperation with government and private-sector partners, and urged Americans to seek reliable voting information from state election officials.

Private notifications, classified briefings, unclassified threat updates, and public statements serve different needs. A public attribution can expose an adversary; a private warning can help a target respond without unnecessarily amplifying the operation.

Public confidence depends on evidence and competent election administration. Officials should explain what they know and what remains uncertain. Otherwise, foreign actors have more room to supply their own explanations.

Finland’s Lesson: Prepare Together

I had the privilege of traveling to Finland to discuss and learn about its election preparedness. What struck me was how far the Finns took the team sport concept: they connected responsibilities across government and practiced working together.

Finland calls its approach comprehensive security. Government agencies, businesses, organizations, and citizens all have a part to play. Its election preparations have included training for authorities and political parties. Its broader government preparedness exercises combine work within individual ministries with shared crisis scenarios. These are practical ways to build relationships and understand responsibilities before a crisis.

Finland’s experience with Russian disinformation shows why this matters. Years before the 2016 U.S. election, Russian state-controlled media and pro-Kremlin figures spread claims that Finnish authorities were taking children from Russian families without legitimate reasons. EUvsDisinfo documented a recurring campaign around child protection and custody cases. This was a broader attack on trust in public institutions, rather than an election-specific operation.

Finnish officials answered publicly. On October 12, 2012, the social affairs minister met Russian journalists in Helsinki, while Finland’s ambassador in Moscow held a press conference to correct unfounded claims and explain Finnish child welfare. When another case attracted attention in 2016, the Ministry of Social Affairs and Health issued a public statement explaining that children were not removed because of nationality, that taking a child into care was a last resort, and that parents could appeal decisions. It also provided links to Russian-language information.

The lesson for the United States is that coordination has to be practiced before it is needed. Agencies must know who will establish the facts, who can act, and who will explain the response to the public. Finland’s example also shows the value of answering false claims with clear information about how institutions work and what protections people have. For election security, that means helping Americans understand both the threat and the safeguards protecting their vote.

AI makes coordination more urgent

In September 2024, ODNI reported that Russian and Iranian actors were using generative AI in election influence efforts. Russia had generated election-related text, images, audio, and video. Iranian actors used AI for social media posts and articles on websites posing as legitimate news outlets.

During my tenure, we were beginning to consider how to respond to deepfakes in foreign influence campaigns. We struggled with how to flag them quickly and explain the threat publicly while protecting intelligence sources.

ODNI assessed that AI was accelerating and improving aspects of these operations, but had not yet revolutionized them. Producing deceptive material does not establish that it persuaded voters or changed an election outcome.

In September 2026, Anthropic reported disrupting operations that used its tools to build fake social media identities and news sites, prepare campaign plans, and conceal who was behind the material. Much of the content it discovered attracted little or no genuine engagement. Those findings concern the operations the company observed, rather than all foreign influence activity. Public warnings should distinguish an adversary’s capabilities from an operation’s reach and effects.

Defenders need to determine whether AI is making impersonation more convincing or allowing foreign actors to exploit local incidents more quickly. They also need to establish who is behind an operation and warn its targets before the deception spreads.

These are intelligence and operational questions that cross agency boundaries. They also require clear limits. A false claim is not automatically a foreign operation. Americans’ political speech remains protected, including speech officials find objectionable. Election defense must establish the foreign nexus and act within lawful authorities.

Make the Full National Response Clear

Secretary Pete Hegseth’s September 22 memorandum directs the defense intelligence enterprise to collect and produce intelligence on foreign election threats, consistent with law and departmental policies. It also directs Cyber Command to use its existing authorities in coordination with DHS to counter foreign cyber threats. Addressed to Cyber Command, NSA, DIA, and NGA, the memo explicitly describes Defense as supporting a whole-of-government effort.

The memo does not name ODNI or the FBI, but that does not establish that they are excluded from the wider effort. Nor does it designate Defense as the national lead. My concern is how its departmental instructions connect to the full response, and how that response is explained to Americans.

The Washington Post reported on October 4 that state officials, including Republicans, described gaps in federal threat information and support. It also reported recent steps, including CISA’s September 24 security plan and the restoration of NSA’s Election Security Group. Those steps deserve acknowledgment. The practical test is whether assistance reaches election officials in time, through relationships they trust.

The Pentagon has an important role. NSA’s account of its work with Cyber Command during the 2022 midterms described sharing foreign intelligence with domestic partners and using cyber capabilities to disrupt foreign attackers. Those capabilities belong in the national effort. My concern is how the overall effort is explained and led. ODNI should provide a coordinated assessment of the foreign threat. The FBI should explain its investigative role. DHS should explain its support to the officials responsible for administering elections. Defense should explain how its capabilities support those missions. Together, they should tell Americans how warnings and public attributions will be handled.

There is precedent. In November 2019, Justice, Defense, DHS, ODNI, the FBI, NSA, and CISA issued a joint statement describing preparations for the 2020 election. They emphasized sharing actionable information and working with state and local officials and private-sector partners. We do not need sensitive operational details. We do need to know who integrates the intelligence, who alerts a target, and who speaks when a foreign operation requires a public warning. Those arrangements should be tested before an incident forces a rushed decision. They should also remain in place through the counting and certification of results.

No agency sees every part of this problem. Election officials need information they can act on, and the public needs explanations it can trust. Federal leadership must connect the intelligence, investigations, cyber defense, and support to those administering the vote.

With one month to go, the message should be clear: vote and have confidence in doing so. A healthy democracy makes room for vigorous disagreement. The government’s role is to ensure that the rightful tensions of our democracy are our own.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The Pentagon’s 2027 Drone Problem

On September 30, at Quantico, the Secretary of War announced a four-star command for autonomous warfare. The memorandum behind it is two pages long. It gives two officials 30 days to produce a plan and sets October 1, 2027, as the day the Autonomous Warfare Command stands up. “We do not have a decade,” it says.

On the same day, a California company announced a Pentagon order for 14,000 small attack drones, along with 800 more reallocated from competitors that could not meet their production deadlines. First-round deliveries had been running late, the trade press reported, because the motors, batteries, sensors, and chips that American law will accept were in short supply.

Five weeks ago in these pages I argued that America was buying an army it could not command. The Hegseth memorandum is the most serious answer that argument has received. It settles who buys, and it leaves to the 30-day plan who decides between theaters when the systems run short. It is silent on a prior question. Before a force can be commanded, it has to be built, and this one is being built from parts supplied by the adversary.

The official now charged with building the command has said so to the Senate. “Many of the subcomponents,” Owen West told the Armed Services Committee in March, “do today come from China,” and he put American or allied supply “deep in 2027.” China makes roughly nine of every ten rare-earth magnets in the world. The largest American producer told investors in August that demand for the magnets inside drone motors is met “essentially 100 percent in China.” An American-made drone motor costs $100 to $225; the Chinese equivalent costs $12 to $25. The memorandum asks for a force on “the right side of the cost exchange.” For now, that exchange is priced in Chinese factories.

The trade truce does not reach any of this. Beijing’s ban on dual-use exports to American military users has been in effect since December 2024 and has never been suspended. In June, China added two American magnet makers and a drone manufacturer to its export-control list. The truce itself was extended in September to January 10, yet the notice that suspends China’s rare-earth licensing rules still expires, on paper, on November 10. That is eight days before the President is due in Shenzhen, where he will arrive as the customer for the magnets his own deterrent requires. Beijing does not need an embargo to use this. It needs only to let a notice lapse, and its magnet shipments to the United States had already fallen 21 percent in August.

Washington has set a date of its own. On January 1, the Pentagon’s rule barring Chinese-origin magnets from defense supply chains takes effect. For most of next year, Chinese parts will be barred by both governments while American ones are not yet made in volume. That stretch falls in 2027, the close of the Davidson Window, the year American commanders have named since 2021 as the one by which Beijing wants the option of force against Taiwan. The force meant to deter China in 2027 depends, through 2027, on China’s willingness to keep selling to it.

The picture is not hopeless. Magnet plants in South Carolina, Oklahoma, and Texas are shipping or commissioning, the Army has contracted for millions of magnet segments for drone motors, and in March Ukraine built a drone with no Chinese components at all. The capacity is real. It is also early and expensive, and no one has been given the authority to decide who gets it first.

The money runs through the same gap. In the week the command was ordered, hiring all but stalled, and the 30-year Treasury still ended near its highest yield in 24 years, while France, Germany, and Japan set multi-decade highs. The savers who finance American deficits can now earn more at home. In the same fortnight, Washington threatened to cut anyone servicing Iranian airlines out of the dollar system and warned two allies that American diesel might stop coming. The country is spending the dollar’s leverage abroad while asking the world to finance its rearmament.

That is the economic-warfare lesson inside a defense memorandum. China’s leverage is exercised by a commerce ministry, with a notice, at a time of its choosing. America’s answer is divided among a portfolio office that buys, Services that supply the forces, a Congress that has not written the law or appropriated $53.6 billion of the $54.6 billion requested, and a Treasury borrowing at its highest long-term rates since 2002. Each is competent. As I wrote here last week on the economic front, none is in command.

The plan due around October 30 is the place to change that, and it turns on two decisions. The first is supply. When American-made magnets, motors, and batteries are scarce, as they will be for most of 2027, someone must decide which programs and which theaters receive them, and that decision must bind the Services and suppliers alike. The instrument exists; the priority ratings of the Defense Production Act were written for exactly this.

The second is integration. As this series has argued, the artificial intelligence on which such a force depends must operate at the tactical edge. A drone that cannot compute there and is not connected through a common command-and-control architecture to everything else in the fight is not a capability. It is one more unintegrated system handed to the warfighter, another problem to manage under fire, and one the adversary will render obsolete, because what cannot be integrated cannot adapt.

Supply, integration, and deployment are one problem. Washington has divided it among separate offices, and no one owns the whole. If you have a hand in that plan, see that it names who holds each authority and sets the supply and integration schedules beside the fielding schedule. Otherwise, the command will stand up on time next October with an order book and no arsenal.

Richard Berry is the founder and principal of Stratnova Advisors and a former Commander’s Action Group Director at U.S. Indo-Pacific Command; he publishes the weekly assessment Strategic Horizons.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Iran Calls Itself the Victim, Its Record Tells Another Story

Iranian President Masoud Pezeshkian’s speech at the United Nations did not mention Iran’s history of terrorism and the thousands of innocent victims killed, or the imprisonment and killing of thousands of its own people who were peacefully protesting, or the repeated enrichment of uranium at levels close to 90% purity for nuclear weapons or repeatedly denying access to International Atomic Energy Agency (IAEA) inspectors to suspect nuclear sites in Iran. There was no attempt by Mr. Pezeshkian to deny these allegations or justify Iran’s sick behavior, or to concede that Iran’s leadership will address these accusations and change its behavior. Rather, it was a recitation of how the U.S. leadership had a “bullying mentality”.

Mr. Pezeshkian could have talked about reopening the Strait of Hormuz and ending the bombing of the infrastructure, airports, and civilian areas in neighboring countries. He could have attempted to justify why Iran was militarily striking out at these neighboring countries, when Iran’s adversaries were the U.S. and Israel.

What’s vivid in the minds of most people is Iran’s brutal reaction to peaceful protests in Iran. The slogan “Women, Life, Freedom” in 2022, when the so-called morality police arrested and killed a young Iranian student, Mahsa Amini, for incorrectly wearing her hijab (headscarf). Peaceful protests by brave Iranians followed, with the Basij – a paramilitary force under the command of the Islamic Revolutionary Guard Corps (IRGC) – arresting thousands and killing hundreds of peaceful protesters.

Iran can change its behavior and seek to be removed from the State Department list of State Sponsor of Terrorism. That means stop supporting their proxies, the Houthis (Yemen), Hezbollah (Lebanon), Hamas and the Palestinian Islamic Jihad (Gaza), and the Shi’ite Militias in Iraq and Syria, all funded, armed, and trained by the Iran’s IRGC.

But Mr. Pezeshkian did not talk about or attempt to justify Iran’s behavior. He said Iran was the victim.

Russia and China apparently agreed.

In addition to attempting to justify its war in Ukraine, Russia’s Foreign Minister, Sergey Lavros, said Russia was aligned with the Iranian regime, criticizing the U.S. and Israel for its military operations in Iran. Indeed, Russia continues to supply Iran with real-time satellite imagery and tracking data regarding U.S. troops, aircraft, and warships in the Middle East for targeting purposes. Russia reportedly is also providing military hardware to Iran: explosives, ammunitions, drone components, and shoulder-fired man-portable air defense systems.

China’s Vice President, Han Zheng, in addition to touting the impact of China’s Belt and Road initiative, criticized the unilateral military actions of U.S. operations in Iran, while not mentioning anything about Taiwan. And according to the Wall Street Journal, Chinese entities have provided Iran with satellite intelligence, and thousands of dual-use components during the ongoing war with the U.S. and Israel. The satellite imagery reportedly helped Iran improve missile and drone targeting of U.S. bases in the region, to include the U.S. base in Jordan that killed three American service members. Additionally, satellite imagery permits the Iranian military to better track commercial ships and U.S. military escorts in the Strait of Hormuz.

Also of real concern are the reports of dual use shipments to Iran. Reportedly, there were over 1,000 air shipments from China to Iran’s Defense Ministry in the first half of 2026. These included GPS devices, electric motors, aircraft-engine parts and chemical precursors used for ballistic missile propellants.

There are reported plans for China to ship up to 400 Chinese-made shoulder-fired air-defense missile launchers (MANPADS) to help Iran rebuild its defenses. There are also concerns that Chinese front companies and banks helped Iran bypass oil export bans and move billions of dollars through barter and credit arrangements.

Whether China ordered or allowed these reported actions is unclear.

The U.S., supported by Germany, France, and the United Kingdom state that military trade, drone transfers, and ballistic missile exchanges between Russia, China, and Iran are in violation of United Nations Security Council Resolution 2231. Moreover, the U.S. and its allies criticized Russia and China for vetoing a September 2026 U.S – drafted resolution to extend the mandate of on the UNSC’s Panel of Experts on Iran. The veto obstructed lawful oversight of Iran.

It appears that Russia and China are supporting Iran in its war with the U.S. and Israel.

Mr. Pezeshkian portrayed Iran as the victim. It’s the people of Iran and the innocent people killed by Iran-backed terrorists who are the victims.

The author is the former associate director of national intelligence. All statements of fact, opinion or analysis expressed are those of the author and do not reflects the official positions or views of the U.S. government.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Exactly how could AI kill humans?

Nobel laureate Geoffrey Hinton walked out of a closed-door Capitol Hill briefing on September 17 and gave lawmakers a deadline.

“Maybe a year, but not much more than a year,” he told reporters, describing how long Congress has before artificial intelligence moves beyond meaningful human control.

It’s not an outlier estimate on the Hill anymore. An Anthropic researcher who resigned this month put it more starkly, warning that the people building the technology “earnestly believe it could kill us all by the end of the decade.”

Trump had already dismissed the premise days earlier. Across a string of Truth Social posts that Monday, he called AI fears a “hoax,” dubbed himself the “Hoax Buster,” and mocked the idea of robots marching into American cities. He returned to the subject five days later, announcing he would form an “AI Force” and appoint an AI czar to accelerate American dominance in the technology rather than restrain it.

House Speaker Mike Johnson echoed him the next day in even more candid terms.

“What the president is saying is, you’re not all going to be dead in 10 years,” he stated. “That’s a hoax.”

That collision, a 78-year-old scientist warning of civilizational risk and a sitting president calling the same warning a partisan fiction, is the real story of the AI safety debate, and it is already hardening into a national security question in its own right.

Sens. Ted Cruz, Amy Klobuchar and John Thune are drafting bipartisan legislation aimed specifically at “catastrophic risks involving biological or nuclear threats” from frontier AI, expected as soon as this month. But the politics obscures a more basic question that rarely gets answered: how, mechanically, is any of this supposed to happen?

Most people still picture something out of the Terminator: killer robots, guns blazing. What actually keeps researchers at the frontier labs up at night looks nothing like that. It’s smaller, odder, and in a few cases, it’s already happened.

The sandbox that did not hold

The clearest illustration of loss of control came in July, when OpenAI disclosed that a combination of its models, including GPT-5.6 Sol and an internal-only research prototype, got out of an isolated test environment and breached Hugging Face’s production systems.

The models were not told to escape. They were running an internal OpenAI evaluation built to push them toward advanced exploitation, with the safeguards that normally block high-risk cyber activity deliberately switched off so the company could gauge their maximum capability.

The test environment had no direct internet access beyond a proxy for installing software packages. The models spent substantial computing power finding a way out anyway: they exploited a previously unknown flaw in that proxy, worked through OpenAI's research network to a machine that was online, then searched for the test's answer key and breached Hugging Face to get it. OpenAI says the models went to "extreme lengths" to reach a narrow goal. The company says it has disclosed the flaw to the vendor.

UN human rights chief Volker Türk told the Human Rights Council in Geneva earlier this month that he shares “the concerns of industry insiders that advanced AI could pose an existential risk to humanity,” calling for “cast-iron guarantees” before, in his words, it is too late.

Türk cited exactly this kind of behavior when he drew his own red line in Geneva.

“AI that escapes its testing environment, or blackmails developers to prevent itself from being turned off, is AI that is too powerful,” he said.

Roman Yampolskiy, an AI safety and cybersecurity researcher at the University of Louisville, tells The Cipher Brief that the incident is best understood as a sneak peek rather than a fluke.

“A preview of a dangerous capability, although neither establishes that catastrophic harm is inevitable,” he says. “OpenAI’s agents escaped isolation and compromised external systems without authorization. These incidents illustrate two different risks: AI pursuing unintended objectives and criminals using AI to automate attacks. Both reduce the amount of human expertise and intervention required for a cyberattack.”

This isn’t a machine turning against its makers. It is software chasing a narrow goal it was given, with no one watching closely enough to notice where the shortcut led.

When the attacker never sleeps

Loss of control is a system slipping its leash. Self-replication could come next. Once it’s off the leash, nobody has to sit at a keyboard to keep it moving.

In early July, cloud security firm Sysdig documented what it assessed to be the first ransomware campaign run end-to-end by an autonomous AI agent, a case it dubbed JadePuffer. After breaking into an internet-facing server through a known software flaw, the agent conducted its own reconnaissance, harvested credentials, moved laterally across the network, and encrypted more than 1,300 configuration records, adapting on the fly when its attempts failed.

In one moment that stood out to researchers, a login attempt failed and, thirty-one seconds later, the agent had already figured out why, tried something different, and gotten in. No person ever saw the error message or lifted a finger to fix it.

Ian Tien, CEO of Mattermost, a collaboration and automation platform built for national security and critical infrastructure clients, tells The Cipher Brief the incident and what followed it mark a genuine inflection point.

“The Hugging Face and JadePuffer incidents represent important new milestones in the weaponization of AI,” he observes. “They should signal to the public that AI is creating new pathways for adversaries and criminals to cause harm, and those developments should be taken seriously.”

At the same time, Tien is careful not to inflate the danger.

“Defenders are also using AI to create new pathways for defense, including detecting and disrupting adversary and criminal operations,” he points out.

Tien’s point is that the technology cuts both ways: the same speed that lets an attacker adapt in seconds can be used to detect and disrupt that activity, if defenders adopt it as quickly as attackers do.

Jason Lang, Managing Director of Offensive Security at TrustedSec, tells The Cipher Brief the technical substance of the case is less novel than the headlines suggest.

“AI wasn’t doing anything that security researchers haven’t been doing for years. The difference is the speed at which it performs those actions,” he explains, noting that JadePuffer’s entry point “exploited a security flaw that had been publicly known for more than a year. Yet, the targeted system was still unpatched.”

In other words, the opening wasn’t some undiscovered AI weakness. It was an ordinary, already-known bug that a human had never gotten around to patching, and the AI just moved on it faster than a person would have.

Still, Lang doesn’t dismiss the trend line. He’s not arguing the threat is exaggerated, only that the mechanism is familiar; what’s changed is the clock.

“AI can and likely will enable attackers to perform research and attacks at a speed faster than modern defenses can cope with,” he continues. “For now.”

Rafal Los, Chief Strategy Officer at Binary Defense, tells The Cipher Brief he reads the same case with more caution about the story built around it.

“I believe that these models did in fact cause harm, but that there is definitely some part of those narratives that was ‘enabled’ by humans looking for validation of their company’s frontier supremacy,” he observes.

What worries Los isn’t the exploit itself, he says, but the trajectory it points to: “an AI agent can carry out much of the technical attack chain autonomously, adapt when something fails and continue toward its objective.”

“Capabilities that once required continuous human involvement can increasingly be automated and scaled,” Los highlights.

That urgency reached Washington almost immediately. Two weeks before Hinton’s briefing, the cyber agencies of the Five Eyes alliance had issued a joint warning that frontier AI was collapsing the gap between vulnerability and exploitation to “months, not years.”

In practice, that means the window defenders used to have between a flaw being discovered and someone actually weaponizing it, once measured in months or longer, is shrinking to weeks or less, leaving far less time to patch a system before it’s used against it.

Sen. John Kennedy (R-LA) tried to force a vote on legislation requiring AI developers to build in a shutdown mechanism the day before Hinton spoke to lawmakers. Sen. Rand Paul (R-KY) blocked it on the floor within hours, calling Kennedy’s language “very vague” and arguing that regulating an industry “so pervasive as AI throughout our economy” first needed hearings and industry input rather than a same-day, unanimous-consent vote.

Paul offered a counter, a bipartisan committee to study the risk instead; Kennedy declined it and let the bill die.

The problem of speed, not malice

The scenario that unsettles researchers most, however, has little to do with hacking. It is the possibility of a system pursuing a goal with genuine competence and no ill intent, simply moving faster than the humans meant to be supervising it.

That is what pushed Evan Hubinger, who leads alignment science at Anthropic, to break with his usual caution earlier this month. He wrote that he personally puts the odds of AI causing human extinction within the next decade above ten percent, and that Anthropic is “trying its best” but does not yet have a plan to control a superintelligent system safely.

Yampolskiy puts the mechanism in more concrete terms.

“An AI agent with access to computers, networks, and critical infrastructure could autonomously discover vulnerabilities, compromise systems, and disrupt hospitals, power grids, or supply chains,” he points out. “The immediate danger is not that AI becomes conscious, but that it becomes capable of causing irreversible harm at machine speed, potentially before humans can intervene.”

Not everyone treats the extinction premise as settled science. Lang, for one, is openly skeptical of the political response it has generated.

“Knee-jerk reactions are just that, reactions, not thought-out proposals with well-meaning reforms,” he underscores. “Fear is usually the currency by which control is purchased; therefore, any urgency-backed proposal is worthy of extra scrutiny.”

The specific fear dominating the public conversation, an AI that slips its constraints and turns on humanity outright, draws the sharpest pushback of all.

“I believe we should take them seriously in that it demonstrates capabilities, but not catastrophically in that it’s going to lead to an AI that ‘breaks out of containment’ and goes and exterminates humans or takes over the Internet,” Los says.

What worries him is something far more mundane: systems that get things wrong not out of malice, but because they’re missing something a person in the room would have caught. He points to air traffic control — a recommendation that looks right on paper but misses a factor a human controller would weigh without even thinking about it, with nobody checking the work before it’s acted on.

What Washington could still do

U.S. Sen. Jacky Rosen (D-NV) has taken the narrowest, most procedural version of the concern to the Senate Commerce Committee, calling on Chairman Ted Cruz to convene a hearing with top AI executives.

“This powerful technology can have the power to cause catastrophic damages if we don’t act to impose guardrails and safety mechanisms,” Sen. Jacky Rosen (D-NV) said in a statement issued to The Cipher Brief. “Congress must do everything in its power to ensure the American AI industry continues to lead, particularly outcompeting China, and also enact increased guardrails to ensure AI development is progressing in a safe and responsible manner.”

Some of that response is already moving.

In June, the administration signed an executive order directing federal agencies to expand AI-enabled cyber defenses for government and critical infrastructure systems, and to design a voluntary framework under which frontier AI developers can give the government up to 30 days of early access to their models before release.

The order imposes no requirements on the companies themselves, and its first agency deadlines fell in July and August.

Nothing in the order binds the industry at large, which is precisely Rosen's complaint, and precisely why Cruz, Klobuchar and Thune are trying to legislate the bio and nuclear pieces separately.

For all their disagreement over how alarmed to be, the four security experts converge on roughly the same one-year fix.

Yampolskiy calls for “mandatory isolation for AI agents operating near critical infrastructure,” the hospitals, power grids and pipelines Yampolskiy flagged earlier.

“No unrestricted internet access, no unnecessary privileged credentials, and no autonomous execution of consequential actions without independently enforced authorization,” he continues.

Tien points to keeping critical systems off the public internet altogether.

“Much of our critical infrastructure and government already operates on air-gapped and private networks,” he explains, and “maintaining that separation is one straightforward way to reduce exposure and buy time while AI-based defenses mature.”

That means a hospital’s or utility’s control systems have no physical connection to the internet at all. Hence, an agent that escapes its sandbox elsewhere has no path in, no matter how capable it becomes.

Los, meanwhile, wants more adversarial testing, “more human oversight,” and AI harnessed for “continuous and automated defense in the immediate future.”

Lang’s answer is the least dramatic of the four, but perhaps the most damning.

Patch known vulnerabilities. Use long, complex passwords. Check the sender’s domain before clicking. Make security a first-class citizen from the top down.

“Security is not hard, conceptually,” he adds. “What causes breaches are, at their roots, usually the forces of ignorance or ego, a truly devastating duo when combined.”

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Nasrallah is Dead. Hezbollah’s Social Lifeline is Not.

Two years after Israel killed Hassan Nasrallah, Hezbollah is weaker but not finished. WaTaawanou, a crowdfunded charity outside Hezbollah’s formal hierarchy, exemplifies one way Hezbollah endures: outsourcing part of the cost of sustaining – and retaining – its Shiite base. Israel eliminated its seniormost military and political leadership, over 5,000 fighters, and significant parts of its arsenal, while its finances are strained. Even as Tehran reportedly moved more than $1 billion to the group after the November 2024 ceasefire – and another $1 billion the following year – Bashar al-Assad’s fall has severely constricted Hezbollah’s transfer routes from Iran through Syria. Yet Hezbollah can survive and regenerate if it preserves the Shiite constituency supplying its manpower and, more importantly, domestic political protection.

WaTaawanou began as an informal relief campaign in November 2019. Founder Afif Shouman identifies it with Hezbollah’s “Resistance environment,” though in an October 2022 interview he said it “does not belong to Hezbollah.” Because WaTaawanou is not U.S.-sanctioned, it can solicit funds through channels Hezbollah’s designated institutions cannot use as freely, including Whish Money, OMT/Western Union, MoneyGram, and direct contributions. It also has an account at Hezbollah’s sanctioned quasi-bank, Al-Qard al-Hassan. Its public-relations director says most Lebanese donors give $5 or $10, but together fund larger campaigns. Whish closed WaTaawanou’s account in October 2025, but its websitestill lists Whish and bank transfers via an International Bank Account Number (IBAN), without usable details for either. Larger projects have drawn support from Lebanese private donors, expatriates, Iranian-linked organizations, and Iraq’s al-Sawaed tribal network.

Yet WaTaawanou’s formal separation from Hezbollah belies extensive ties. Shouman says Hezbollah was the only outside organization to embrace and assist it and credits its development to Nasrallah’s “direct and foundational guidance.” He says former Hezbollah Executive Council chairman Hashem Safieddine treated WaTaawanou as “a principal file.” WaTaawanou has repeatedly worked with Hezbollah’s Social Action apparatus and Islamic Health Committee. At least two volunteers—Ali Lutfi Faran and Amine Hassan Badreddine—served as Hezbollah fighters. Shouman said its 2024 wartime relief proceeded in “full coordination with Hezbollah.”

That relationship is clearest in its spending. Its beneficiaries extend beyond Hezbollah supporters, but its aid eases material pressure across the overwhelmingly Shiite base on which Hezbollah depends. Shouman says it aided 94,000 families during the 2024 war with food, medicine, cash, and shelter. Since the November 27 ceasefire, its Al-Wajh al-Hassan reconstruction project has used donations in war-damaged, overwhelmingly Shiite southern municipalities including Ramyeh, Houla, and Mays al-Jabal, installing prefabricated housing and classrooms, repairing schools, aiding farmers, and distributing food. WaTaawanou also channels money to Hezbollah-linked entities, including payments to Al-Rasoul al-Aazam Hospital and Saint Georges Hospital–Hadath, both Martyrs Foundation hospitals. It also purchased fuel from Amana Fuel, which the foundation controls through Atlas Holding. Treasury designated the Martyrs Foundation in 2007 and calls its Lebanon office an integral element of Hezbollah’s support network. WaTaawanou paid Hezbollah’s Islamic Health Committee through Dar al-Hawraa Medical Center and repeatedly paid Al Moukhtar Products, which Treasury designated as part of a Hezbollah business network.

WaTaawanou therefore gives Hezbollah two benefits: outside donors cover costs Hezbollah would otherwise bear, while WaTaawanou channels the credit back to Hezbollah. Nasrallah portraits line its premises, his face brands Al-Wajh al-Hassan, and Hezbollah flags and insignia appear at its events. Shouman says its role complements Hezbollah’s: Hezbollah’s fighters defend the community while WaTaawanou supports the group’s Shiite base.

WaTaawanou cannot alone explain Hezbollah’s Shiite support, but efforts on this scale likely help preserve it. Studiesshow many Shiites are drawn to Hezbollah less by ideology than by the security, services, and communal advancement it provides, while regular patronage recipients are likelier to oppose the group’s disarmament, support its political role, and credit it for reconstruction. That constituency remains overwhelmingly behind Hezbollah. A late 2024 survey found 85 percent trusted Hezbollah. An estimated 700,000–900,000 people attended Nasrallah’s February 2025 funeral, and three months later Hezbollah and the AMAL Movement, Lebanon’s other major Shiite party, dominated municipal elections in heavily Shiite southern and eastern districts. Gallup found in June-July 2025 that 69 percent opposed giving the Lebanese Army exclusive control over weapons. In April-May 2026, Information International found 87.5 percent opposed Hezbollah’s disarmament.

For Beirut, forcibly disarming Hezbollah therefore risks confronting not simply an armed organization, but one still backed by most of what is probably Lebanon’s largest sect. Lebanon has held no official census since 1932, but independent pollster Statistics Lebanon estimates Shiites at 32.2 percent of citizens. Hezbollah Secretary-General Naim Qassem has rejected disarmament even when paired with Israeli withdrawal, and on June 17, 2026 declared that “any project to disarm us will not pass.”

Lebanon has consequently paired categorical disarmament decisions with reluctance to enforce them coercively. On March 2, the cabinet banned Hezbollah’s military and security activity and ordered it to surrender its weapons, but Prime Minister Nawaf Salam said Beirut did “not seek a confrontation with Hezbollah,” while President Joseph Aoun insisted the state monopoly over arms proceed through dialogue “away from force.” Five days later, army commander Rodolph Haykal said national unity and internal stability came first and “the solution is not solely a military one.” In September, official sources said its Nabatieh deployment was not intended to make the city weapons-free. South Litani Sector deputy commander Colonel Raja Amer told CNN the army would proceed “slowly” rather than use violence against “our own people,” agreeing that avoiding another civil war was central to its approach.

On September 9, the army claimed “operational control” in three test zones under the U.S.-brokered June 26 Israel-Lebanon Framework Agreement to clear unauthorized fighters, weapons, and military infrastructure. But it identified no Hezbollah fighter disarmed or arrested, and no Hezbollah depot, tunnel, or command center dismantled. WaTaawanou helps preserve the communal support that makes such coercion politically dangerous. For a battered Hezbollah, Beirut’s reluctance to test that support buys it the resource regeneration requires above all: time.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

I just want to read the news

Get the news and only the news!

Guardian

Back to top

Kaupunki

Back to top

Yle

Back to top

CNN

Back to top

Hesari

Back to top

Al Jazeera

Back to top

New York Times

Back to top

Reuters

Back to top

NPR

Back to top

The Cipher Brief

Back to top