The Cipher Brief

Understanding a country's strategic culture helps assess how it will react to crisis, negotiation, and national security events. Strategic culture generally is static and when it evolves, it happens slowly, as history, events, and culture accumulate over generations. In 2021, the prevailing view of Ukraine’s strategic culture was that it was a country focused on securing its national identity and sovereignty apart from Russia and it was a country prone to rely on negotiations and diplomacy. The balance between these two themes was about even with Ukraine leaning toward diplomacy and multilaterism over sovereignty when pushed by the international community. Most students of strategic culture did not assess that Ukraine would react to a Russian invasion with the military force that it has. Now students of strategic culture see the theme of independence and sovereignty as the key aspect of Ukraine’s strategic culture with a growing theme of being modern day military experts. The rapid transformation of the assessment of Ukrainian strategic culture is astounding. Either strategic culture academics got Ukraine wrong, or the Russian invasion changed Ukraine cataclysmically. I suspect it is a bit of both.

Strategic Culture

Strategic culture refers to a nation's shared beliefs, assumptions, and habitual behaviors regarding the use of force and the pursuit of security objectives. Jack L. Snyder introduced the term in 1977, arguing that a state's behavior cannot be explained by material capabilities or geography alone, but by those factors combined with history, cultural norms, and shared societal beliefs. Strategic culture is generally resistant to change. While it is often invoked to explain Russia's decision to invade Ukraine — its relevance to Ukraine's response has been comparatively overlooked.

Ukraine's Early Strategic Culture

Ukraine's strategic culture has been shaped by centuries of foreign domination and by its Soviet legacy. Early studies of strategic culture in independent Ukraine identified securing a national identity separate from Russia as the paramount objective. Those same early studies concluded that Ukraine favored diplomatic engagement, multilateral cooperation, and alliance-building over military action — pointing to Ukraine's surrender of its nuclear arsenal after the Soviet collapse and its acquiescence to Russia's 2014 seizure of Crimea as evidence. But this reading likely mistook constraint for preference. Ukraine was a newly independent state with a fledgling security establishment and military; it lacked the structure and capacity to stand up to either the United States or Russia, both of which pressed it toward disarmament and restraint. And, while significant events, neither of those two events were an immediate threat to Ukrainian independence. What looked like a cultural preference for negotiation may have been the best available option available for a young, under-resourced state. This misreading of Ukrainian resolve and strategic culture set Russia up for a catastrophic miscalculation that has cost over a million lives and will take decades for both countries to recover from.

The first principle of Ukraine’s strategic culture — safeguarding a distinct national identity — endures today. But the second focus on diplomacy and multinationalism-- has changed. If successful, the Russian invasion would have meant that this first principle would have to be abrogated and Ukrainian identity would once again have been subsumed by Moscow. Ukraine could not tolerate that: fighting for independence and Ukrainian identity outweighs alliance-building and negotiations as the organizing goal of its strategic culture. Today, Kyiv increasingly foot stomps aspects of Ukrainian identity that were suppressed under Soviet rule, and its foreign policy has grown more assertive, favoring offensive posture over purely defensive behavior. What has emerged is a culture that balances patience for international negotiation with adaptability and a hardened determination not to be conquered again, at any cost.

Two Defining Characteristics

Two characteristics of Ukrainian strategic culture stand out as key to explaining Ukrainian resistance to Russia:

Ukraine's growing emphasis on its Cossack heritage appears designed to construct a new state myth and reshape national self-perception from one of victimhood to one of warrior. Invoking the Cossacks — a self-governing, democratic, and militarily capable community prone to raids and revolt — underscores both Ukraine's independence and its capacity for military action. Domestically, images of the great hetmans now appear more prominently on currency and in textbooks.

Ukrainian strategic culture rests on the primacy of sovereignty, independence, and territorial integrity — values Russia has threatened or dismissed both historically and in the present. Language has become a central tool of this identity claim: early post-independence legislation established the primacy of Ukrainian language to rebuild a cohesive national identity, and that legislative push accelerated around the outbreak of armed conflict in 2014, alongside a marked cooling toward proposals to formalize Russian as a second official language. For Ukrainians, language is intrinsic to national identity. I recall being tutored in Ukrainian by an émigré in the late 1980s; he was a tough teacher, and he would grow angry whenever I mistakenly lapsed into Russian even though it was our common language and at times the only language in which we could communicate.

Ukrainian Strategic Culture Today

Ukraine's strategic culture now manifests as an asymmetrical, creative approach to security — one that offsets comparatively limited military resources with international partnerships, novel approaches to warfare, and disciplined strategic messaging. It emphasizes flexibility, resilience, gray-zone tactics, and pragmatic decision-making. Increasingly, we are seeing Ukraine promoting its tactics and military resources internationally.

Ukraine's strategic norms are still evolving, but the trajectory since independence is clear: independence and ingenuity have become the paramount, defining components of Ukrainian strategic culture, expressed through firm state priorities. A lasting orientation toward the West, paired with renewed emphasis on Slavic and Cossack roots, matters too, if somewhat less centrally. Above all, a study of modern day Ukrainian strategic culture tells us that Ukraine will do what it must to preserve its hard-won independence — while still maintaining its position as a respected leader within the global community.

Recently, the new Ukrainian Minister of Defense, Yevhenii Khmara, said

”Ukraine has always seen tragedy. Its history is a long inventory of it. What separates this generation from all the ones before is that it has a real chance to defeat the enemy.”

This tells you a lot about the mindset of senior Ukrainian decision makers and how they are messaging their people and the international community.

Why it Matters

Understanding Ukrainian strategic culture helps us to determine what approach to take to help end the war in Ukraine. Paramount for the country is ensuring Ukraine’s sovereignty and independence. For Ukraine, that is nonnegotiable. Any negotiating concepts that leave room for other nations to impose themselves on Ukrainian decision making is a nonstarter for Kyiv. Recognizing Ukraine’s sacrifices not only in the last four years but the tragic historical road they have been on with pre Soviet Russia and the Soviets will go far in any negotiations. Finally, acknowledging and highlighting how well Ukraine has out played Russia would also go a long way. Next, I will present Russian strategic culture and then discuss where the two clash.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

What Six Years as an Iran Hostage Taught Me About the Regime

Since the start of Operation Epic Fury, I have watched and listened to nearly every piece of news coverage and analysis from U.S. policymakers, pundits, and the media. What continues to puzzle me is how often the Islamic Republic is treated as a rational government operating under conventional norms. The Islamic Republic is a cult, not a predictable government.

We hear constant talk of engaging or “negotiating” with its current leadership, distinguishing between “moderates” and “hardliners,” using intermediaries such as Pakistan, and sending American negotiators to Islamabad to meet with representatives of the Islamic Revolutionary Guard Corps. The problem is that much of this analysis misunderstands the worldview of those who actually wield power in Iran.

I learned something about that worldview during the nearly six years (2018 – 2023) I spent as an American hostage in Iran.

The lesson began almost immediately. At around 2:00 a.m. one morning, after agents of the IRGC Intelligence Organization dragged me from my bed, I was taken to the office of a friend, a place I had visited many times. The agents began ransacking it.

At one point, I asked to use the bathroom. Two armed guards accompanied me. I used a urinal, and they escorted me back to the office. A few minutes later, I overheard one of them telling another agent, with apparent astonishment: “These guys piss in a sink against the wall!” An intelligence officer of the Islamic Revolutionary Guard Corps had apparently never seen a urinal.

It was a small, almost comical moment in what was otherwise a terrifying first night of what turned out to be 1975 nights of torture, fear, and uncertainty. But it stayed with me because it was my first indication that the men holding me inhabited a world very different not only from mine but also from those of the West.

During my imprisonment in Evin, I encountered regime insiders, arrested by the very regime they had helped bring to power and sustain, who gave me further insight into the skewed world they inhabited and the prism through which they viewed the rest of the world.

In Section 2A, the IRGC’s maximum interrogation facility, we sometimes used newspapers as makeshift placemats to eat our meals on the floor. A cellmate of mine, a former IRGC Quds Force member imprisoned on alleged espionage charges, warned me that eating off a newspaper could unintentionally constitute blasphemy. Somewhere in that edition, he explained, the word “Allah” might be printed. By placing food on the paper, I could unknowingly desecrate the name of God.

Another cellmate offered an even more revealing window into this worldview. He was the former head of security at the Central Bank of the Islamic Republic of Iran, a real insider in the regime. Haji, as they all want to be called, explained to me that the universe consisted of seven floors. The seventh and highest floor, he said, was where God placed his prophets, their closest disciples, and those who had lived truly pious lives. Haji was an interesting messenger for this particular theology. He had also served as a corrupt facilitator for a “businessman” who obtained a €500 million unsecured loan from Iran’s Central Bank and then wired nearly all of the money overseas—with Haji’s assistance. Now Haji was my cellmate in Section 2A.

Out of curiosity and partly because I wanted to understand how far Haji’s worldview extended, I asked him, “On which floor would someone like Alexander Fleming end up?” Haji looked at me blankly. “Who is he?” I explained that Fleming discovered penicillin, one of the most consequential medical discoveries in human history, and that his work had saved countless lives around the world—including countless Muslims.

Haji did not hesitate. “He would go to Hell,” he said. “He was not a Muslim.”

His answer gave me vertigo. Here was a man who believed deeply in a moral universe divided into seven levels, with eternal salvation reserved for the properly devout, yet who had himself been a corrupt conduit in a massive financial theft from the people of Iran. And in his moral accounting, a man whose discovery had saved millions was nevertheless condemned to eternal damnation because he belonged to the wrong faith.

These experiences may sound anecdotal, even bizarre. But they matter because ideology is not an abstraction in the Islamic Republic. It shapes how the regime’s insiders understand morality, diplomacy, legitimacy, the West—and even the value of human life. And it is what makes the regime a cult rather than a traditional government.

Now consider the people who have risen—and continue to rise—through this system. One of the most important is Mohsen Rezaee, whose career spans virtually the entire history of the Islamic Republic. Rezaee joined the newly created Islamic Revolutionary Guard Corps after the 1979 revolution. In 1981, at just 27, he was appointed commander-in-chief of the IRGC. When Rezaee finally left command of the IRGC in 1997, he did not leave the regime’s inner circle. He became secretary of the Expediency Discernment Council, a powerful institution that advises the Supreme Leader and arbitrates disputes within the Islamic Republic.

And now Rezaee is back at the very center of power. A few weeks ago, he was appointed secretary of Iran’s Supreme National Security Council and named Supreme Leader Mojtaba Khamenei’s representative on that body. The council sits at the heart of Iranian decision-making on national security, war, and foreign policy.

His appointment matters because Rezaee has never been particularly shy about sharing his views with the world. In 2015, while discussing the possibility of an American military attack on Iran, Rezaee proposed an extraordinary solution to Iran’s economic problems: take at least 1,000 Americans hostage and demand billions of dollars for their release. Years later, in 2021, while running for president, he again spoke openly about taking Americans hostage.

For someone who spent nearly six years as an American hostage of the Islamic Republic, I find such statements especially hard to dismiss as mere rhetoric. They reveal something fundamental and odious about the system. In most governments, suggesting that the kidnapping of anyone could become an instrument of economic or foreign policy might end a political career. In the Islamic Republic, it did not prevent Rezaee from continuing his ascent through the highest levels of the state. Today, the former IRGC commander who publicly entertained the idea of taking Americans hostage sits at the center of Iran’s national-security establishment.

Then there is Hossein Taeb, a hardline cleric and longtime intelligence operative whose career offers another revealing glimpse into how power actually works within the Islamic Republic. Taeb commanded the Basij paramilitary organization during the violent suppression of the 2009 Green Movement, when millions of Iranians took to the streets after the disputed presidential election. He was subsequently promoted to become the first head of the expanded IRGC Intelligence Organization, the most powerful intelligence apparatus operating alongside—and often in competition with—Iran’s Ministry of Intelligence. He remained in that position for nearly thirteen years.

But Taeb’s significance extends beyond the offices he has held. For decades, he has been closely associated with Mojtaba Khamenei. Their relationship dates to the Iran-Iraq War, when both served in the IRGC. Over the years, Taeb became a key figure in the security and intelligence network around Mojtaba, and their names repeatedly appeared together in accounts of the regime’s efforts to suppress internal opposition. Today, that relationship matters more than ever. Mojtaba Khamenei is now Supreme Leader, and Taeb has once again been placed in command of the Basij—the enormous paramilitary organization the Islamic Republic has long relied on to maintain internal control and suppress unrest.

This is not merely history to me. According to one of my interrogators, Taeb (AKA Haj Maysam) was present at two of my most brutal interrogation sessions in April 2018, including my mock execution. I remember him not as a name in an intelligence report or a photograph in a newspaper article, but as a man who stood within the machinery that held me hostage.

Today, both men are once again at the center of that machinery. Rezaee holds one of the Islamic Republic’s most important national-security posts. Taeb has returned to lead the Basij. Mojtaba Khamenei, with whom both men have longstanding ties, now sits at the apex of the system.

These are not rogue actors operating on the margins of the Islamic Republic. Nor are they relics of an earlier revolutionary era that Iran has gradually moved beyond. They are the system, and they are once again being entrusted with its protection.

Yet the clearest lesson I received about that system’s worldview came not from a senior official but from one of the men who interrogated me. Several months after my arrest, after I had endured hundreds of hours of brutal questioning, my lead interrogator had seemingly run out of questions, and I had run out of answers. We were both exhausted by the madness of it all. We sat in silence in the interrogation room. He pulled a phone from his pocket. On the screen was a photograph of Supreme Leader Ayatollah Ali Khamenei. He swiped the image away, tapped the phone, and Koranic verses in Arabic began to play. He sat about a yard from me, across a small metal table that separated us. He was in his mid-thirties. By then, I had learned that he was married and had children.

Several minutes passed. Then I noticed tears sliding down his cheeks. For a moment, I wondered if something had happened to one of his kids. Finally, I asked if he was all right. He looked up at me and said: “I can’t wait to become a martyr.” I had no response and was completely dumbfounded. That moment has stayed with me ever since.

In Washington, it is tempting to dismiss rhetoric about martyrdom, religious purity, and the “Great Satan” as political theater—a vocabulary meant for domestic consumption while supposedly pragmatic men conduct the real business of diplomacy behind closed doors.

My experience taught me otherwise. That does not mean every Iranian official thinks the same way, nor does it mean diplomacy should never be attempted. It does mean that American policymakers should stop assuming that the men who dominate the Islamic Republic weigh costs and benefits, compromise, and survival exactly as Western officials do.

For decades, Washington has repeatedly sought the elusive Islamic Republic’s “moderates” who are supposed to transform the regime from within. Analysts construct elaborate theories about factions and personalities, sometimes overlooking the core ideology that binds the system together.

Rivalries certainly exist within the Islamic Republic. Disagreements over tactics, money, power, and personalities persist. But tactical disagreement should not be mistaken for fundamental ideological divisions or moderation. Nor should we assume that because a particular course of action appears irrational or self-destructive to us, the men making decisions in Tehran will necessarily see it the same way.

The Iranian people understand this distinction better than many outsiders. They have lived under this system for nearly half a century and have repeatedly risked their lives to challenge it. American policymakers should listen more carefully to them. They should also remember something else when sitting across the negotiating table from representatives of the Islamic Republic.

I once sat three feet from one of those men in a locked interrogation room in Section 2A of Evin prison. He had a wife. He had children. He had a career. He had a life waiting for him outside those walls. And what brought tears to his eyes was the joy of giving it all up. He could not wait to become a martyr.

Emad Shargi,

American Businessman

Hostage of the Islamic Republic (2018 – 2023)

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Lebanon’s Hezbollah Finance Crackdown May Be Designed to Fail

Lebanon’s campaign against Hezbollah’s finances may be designed to look tougher than it is. Under pressure from Washington and international regulators, Beirut has done enough to claim progress by tightening the regulated financial sector against Hezbollah-linked entities, but without seriously threatening Hezbollah’s parallel financial apparatus, which operates largely outside it. This raises the troubling possibility that Lebanon is not merely failing to impose meaningful pressure but deliberately choosing measures that stop short of actually harming, and therefore provoking, Hezbollah. Lebanese leaders have repeatedly warned that directly confronting the group risks renewed internal conflict. A serious assault on Hezbollah’s finances would strike at the resources sustaining its organization and could invite precisely that confrontation. If so, Beirut has found a politically useful middle ground: cosmetically satisfying foreign demands to preserve the domestic status quo.

Iran remains Hezbollah’s main external source of money. Secretary-General Naim Qassem has acknowledged Iranian funding for postwar relief and reconstruction. In November 2025, the U.S. Treasury said Iran’s Islamic Revolution Guard Corps-Quds Force, its foreign-operations arm, had transferred more than $1 billion to Hezbollah since the beginning of that year, mostly through money exchange companies. Iran and Hezbollah have also used gold to move funds. Qassem has acknowledged smaller contributions from the Iraqi state, Shiite religious authorities and shrines, Iran-aligned Shiite militias, and Iraqi citizens. The Houthis raised funds directly for Hezbollah in 2019 and later for its Lebanese support base. Hezbollah has used cryptocurrency too, though the scale remains unclear.

Hezbollah also generates revenue through ostensibly legitimate businesses and commercial networks that conceal the group’s involvement behind nominal owners. Treasury says a commercial network run by financier Alaa Hamieh diverted more than $100 million to Hezbollah since 2020, while Hamieh allegedly used his state investment post to steer millions toward Hezbollah-linked projects.

Hezbollah-controlled and affiliated entities then manage and move the money. Its Central Finance Unit controls income and spending, Bayt al-Mal serves as its treasury, and Al-Qard al-Hassan (AQAH) provides bank-like services and holds cash and gold. AQAH officials have used personal “shadow” accounts to disguise transactions and move more than $500 million through Lebanese banks. AQAH-backed Jood SARL converts gold into cash, while Hezbollah-linked money-service businesses like CTEX have supplied dollars to Hezbollah institutions and recruited sympathetic money changers. WaTaawanou, a crowdfunding charity officially outside Hezbollah’s formal hierarchy, raises donations for needy Lebanese but directs much of the resulting spending to Hezbollah-run or -linked hospitals and businesses. These funds support personnel, weapons procurement, social programs, compensation, housing, and post-war reconstruction.

Lebanese measures have so far done little to disrupt this diversified financial ecosystem. AQAH’s liquidity problems do not demonstrate otherwise because they predated Beirut’s principal financial restrictions. It began delaying compensation checks in January 2025 and froze them on June 23, after nearly $500 million had already been disbursed. The Lebanese Central Bank did not issue Circular 170 until July 14. That measure bars regulated financial institutions from dealing with AQAH and related sanctioned, unlicensed entities, but does not close AQAH or seize its assets.

AQAH therefore remains operational. It retained branches that survived Israeli strikes, while Treasury said in February 2026 that Hezbollah continued using the institution and that AQAH officials had created Jood to ease its liquidity pressure. The Interior Ministry later withheld AQAH’s annual 2026 certificate of good legal standing pending investigations, but left its underlying association registration intact. An-Nahar reported would require a Cabinet decision to revoke. But, on June 18, Justice Minister Adel Nassar said the government had not even placed the AQAH file on the Cabinet agenda. Stripping a core Hezbollah institution of its legal status would mark a far more direct confrontation with the group, one the government appears unlikely to invite amid the current standoff over Hezbollah’s disarmament.

Judicial action has likewise stopped short of disrupting AQAH’s operations. Nassar referred AQAH and Jood to the public prosecutor in June for investigation. Yet by July 21, An-Nahar reported that the case remained dormant. Prosecutors were waiting for the Central Bank to provide documents establishing financial violations but had not themselves requested them.

Lebanon’s Central Bank also issued Intermediate Circular 761 on May 4, 2026, effective June 30, requiring regulated nonbank financial institutions—including exchange houses, finance companies, specialized lenders, and electronic-payment providers—to identify customers and report cash transactions of $1,000 or more, while flagging repeated transactions apparently structured to evade the threshold. But those requirements can still be bypassed through unlicensed or informal hawala networks, where a sender pays a broker abroad and a partner in Lebanon pays the recipient locally, without the original money passing through a bank or regulated Lebanese institution.

Lebanon’s restrictions have therefore changed Hezbollah’s methods more than its access to money. After Beirut tightened airport controls, Iran reportedly shifted to more couriers carrying smaller amounts of cash or jewelry while moving hundreds of millions of dollars through Dubai. When Whish Money, a Lebanese transfer company, closed WaTaawanou’s donation account in October 2025, the charity directed donors to AQAH and other transfer firms. Hezbollah also reportedly planned a new AQAH branch in Tyre without signage. Treasury has meanwhile documented Hezbollah financiers transferring companies to relatives or associates and creating new entities amid sanctions pressure.

Many of the steps required for real financial pressure already overlap with obligations Lebanon accepted under its FATF action plan, including more terrorist-financing investigations and prosecutions, better identification of true owners, seizure of illicit cross-border currency and precious metals, and stronger targeted financial sanctions. Applied to Hezbollah, that means closing AQAH, prosecuting officials who move its money through personal accounts, shutting Jood and replacement companies, seizing Hezbollah-bound cash and gold, revoking the licenses of financial firms that facilitate the group, and cutting Hezbollah-linked businesses off from state contracts, licenses, and institutions. Claims that Lebanon has clamped down on Hezbollah’s finances, or gone as far as it reasonably can, should be judged against such outcomes—not regulations, administrative measures, or assurances of progress that do not produce measurable, real-world impact.

David Daoud is senior fellow at the Foundation for Defense of Democracies (FDD) focused on Israel, Hezbollah, and Lebanon affairs. Ahmad Sharawi is a senior research analyst at FDD focused on Syria and Iranian intervention in Arab affairs and the Levant. Follow David on X @Davidadaoud. Follow Ahmad on X @AhmadA_Sharawi.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Foreign Spies Don’t Need to Hack You Anymore

Andy Burnham was a few weeks into the job as the new Prime Minister of the UK when he found himself exchanging messages with someone claiming to be Susie Wiles, the White House chief of staff. The exchange, first reported by Politico last week, was brief and apparently trivial. Burnham grew suspicious, stopped replying and told the right people; the British embassy in Washington quietly informed the White House, which confirmed that Wiles’s own devices hadn’t been touched. No harm done, officially.

Embarrassments like this are becoming more common. The FBI warned last year about impostors using AI to mimic senior officials, after someone posing as Wiles contacted senior Republicans and business figures. The State Department later chased a fake Marco Rubio who reached three foreign ministers. And every one of these approaches lands on a habit “Signalgate” already exposed: when one wrong contact card could add a journalist to a strike-planning thread, the name on the screen was the only authentication in the room. If you want to see what this security weakness looks like run as a nation-state campaign look at a case that closed quietly in Taipei last month.

In July, prosecutors in Taipei’s Shilin district wrapped up proceedings against two local businessmen, Li Hualun and Chen Mengsen, who had spent months registering accounts on LINE (the messaging app nearly everyone in Taiwan uses), each tied to a real Taiwanese phone number. They leased the accounts to Xiamen Empress Information Technology, a mainland firm Taiwanese investigators say works under the direction of the Chinese Communist Party’s cyber forces. The going rate was about 1,100 RMB per account, call it $160.

A working exploit for a major platform costs millions on the gray market. A trusted local identity cost less than a decent dinner, and it did something no technical exploit can do.

The operators used the fake accounts to become journalists. In the approach that eventually unraveled the scheme, one of them even dressed up a leased account in the name and photo of Chen Yishan, editor-in-chief of CommonWealth Magazine, and began courting an aide in a legislator’s office. Interview requests, invitations to contribute articles, the ordinary traffic of political journalism followed.

There was no malicious link in the first message, or the tenth. Investigators found the operators worked on targets for months, sometimes close to a year. Any counterintelligence officer would recognize the rhythm. It was the patient cultivation and recruitment of an agent run through a chat app.

The eventual ask was small and reasonable-sounding. Journalists use encrypted tools to protect their sources, so would the contact mind installing a secure communication app to keep talking? The app was in fact malware. The MO turns a decade of good security advice inside out. The more someone knew about how careful reporters actually operate, the more normal the request looked.

Researchers at Citizen Lab and the International Consortium of Investigative Journalists, whose reporting the Taiwanese prosecution now corroborates, counted more than a hundred malicious domains behind the wider campaign, and found errors in the phishing messages suggesting the attackers were using AI to draft them and to pick targets. The people on the receiving end were lawmakers and their staffs, defense think tanks, semiconductor companies, dissidents at home and abroad. Taiwanese media reported that even the island’s overseas missions were probed.

Through all of it, nothing technical failed. The networks held and the patches were current. The attackers went around the security stack entirely, and the thing they spent, their actual operational currency, was the credibility of a free press. Every fake interview request makes the real ones a little harder. This cost never shows up in an incident report.

The two men who supplied the accounts got deferred prosecutions and payments totaling a bit under $6,000. That is the current legal price, in a frontline democracy, for renting identity infrastructure to a foreign intelligence service. It isn’t a deterrent. It’s barely a business expense.

Which brings us back to Downing Street. A prime minister with the full apparatus of British intelligence behind him replied to a stranger because the name on the screen looked right. Nothing in either story depends on LINE, or Taiwan, or Westminster.

Swap in WhatsApp or LinkedIn; swap the fake editor for a fake recruiter or a fake chief of staff. Aged, locally registered accounts are already a commodity in criminal markets. All the model requires is a person who handles something worth stealing and a persona they have no fast way to check.

That last part is fixable, though not by the security team alone. Organizations that handle sensitive work should treat identity verification as a counterintelligence habit. Platforms need to treat the account-rental trade Taiwan uncovered as the national security problem it has become rather than a terms-of-service nuisance. And legislatures need to punish collaboration with foreign intelligence services at something above a traffic ticket.

Mostly, though, the people likeliest to be approached — the legislative staffer, the fab engineer, the think-tank fellow, the human rights activist, apparently the occasional head of government — need to become more educated on how foreign intelligence cultivation and targeting actually works: slowly, warmly, and with no suspicious link in sight until the very end. The adversary in this case looked at hardened networks and vigilant software and made a rational choice. Building a fake trusted persona was cheaper — $160 a head – than spending millions on a sophisticated cyber exploit. We need to start defending the credibility of verified, trusted identifies the way we defend our networks: as the attack surface it already is.The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Modernizing the Aircraft Carrier—By Returning to 20th-Century Technology?

“During its 11-month deployment [mostly in the Middle East] which ended in May, and was the longest for an [aircraft] carrier since the Vietnam War, the USS Gerald R. Ford conducted more than 11,000 aircraft carrier launches using electromagnetic catapults, more than carriers with steam [aircraft launching] systems could achieve…But perhaps the biggest benefit of the electromagnetic catapults are their lower cost and lighter personnel requirements. With the Navy running out of operating funds, and retention likely to plummet in the aftermath of the war with Iran, the fleet needs to make the most of every dollar and sailor.”

Writing that opinion piece in The Washington Post last Wednesday was Bryan Clark, a former Navy officer who at one time served as Special Assistant to the Chief of Naval Operations and Director of his Commander’s Action Group. Currently, Clark is a Senior Fellow and Director of the Center for Defense Concepts and Technology at the Hudson Institute.

I am using Clark’s article because it provides information that challenges a recent military step contained in an August 13, Presidential Memorandum which ordered “the Secretary of War, in consultation with the Secretary of the Navy, shall provide to the President… a plan on the required measures to replace the Electromagnetic Aircraft Launch System and Advanced Weapons Elevators with steam and hydraulic systems for the construction of [aircraft carrier] CVN-81[USS Doris Miller], including timelines and resourcing requirements.”

Electromagnetic catapult systems accelerate aircraft more smoothly and gradually, thus putting less stress on airframes. They also recharge faster than steam catapults which need to pressurize gases and they eliminate the need for boilers and other plumbing equipment needed to create steam.

Trump, who never served in the military, has been obsessed for years with the way that steam propels fighter jets off the decks of carriers and where a carrier’s tower structure or “island” is located.

I will point out, according to former Defense Department officials the Navy designers moved the island from the middle of the carriers to the back of the vessel to make more space for moving jet fighter aircraft around on the flight deck, in order to increase the number of flights or “sorties” that the carrier could generate.

These Trump aircraft carrier views apparently first came to him less than two months after he took office based on a March 2, 2017, tour he had on the then-under-construction USS Gerald Ford being built at the Newport News shipyard in Virginia.

Two months later, in a May 8, 2017 wide-ranging, 100-minute interview with Time Magazine editors and reporters, Trump at one point apparently brought up his visit to the Gerald Ford at Newport News where he was shown the catapult system for launching aircraft from the deck.

According to TIME, the conversation went, “Sir, this is our digital catapult system…we’re going to this because we wanted to keep up with modern [technology]. I [Trump] said, ‘You don’t use steam anymore for catapult? No sir. I [Trump] said, Ah, how is it working? Sir, not good. Not good. Doesn’t have the power. You know the steam is just brutal. You see that sucker going and steam’s going all over the place, there’s planes thrown in the air.’”

The TIME transcript then has Trump saying, “It sounded bad to me. Digital. They have digital. What is digital? And it’s very complicated, you have to be Albert Einstein to figure it out. And I [Trump] said -- and now they want to buy more aircraft carriers. I [Trump] said what system are you going to buy -- Sir, we’re staying with digital. I [Trump] said no you’re not. You going to goddamned steam, the digital costs hundreds of millions of dollars more money and it’s no good.”

I should note, at the time Trump visited and for months thereafter, there were issues with the new electromagnetic catapults, but fixes were made, although not in Trump’s mind.

Before I continue with Trump, let’s turn back to Hudson’s Bryan Clark, a real Navy expert, who wrote, “The biggest benefit of the electromagnetic catapults are their lower cost and lighter personnel requirements.”

Clark also noted, “The Ford’s crew is about 500 sailors smaller than its predecessors, largely because it is an all-electric ship outside of the engine room. Because they needed steam for catapults, older carriers also used steam for a variety of other functions throughout the ship — such as cooking equipment and water purification…And the steam catapults have so many moving parts and failure modes that they require about 10 more sailors per catapult — there are four catapults on a modern carrier — than electromagnetic systems.”

A Navy February press release said preliminary reports from the Sortie Generation Rate test program for aircraft show that the flight deck design in conjunction with electromagnetic systems and arresting gear “have contributed to an increased sortie generation rate compared to that of a Nimitz-class carrier.”

However, Trump over the years has kept calling for a return to steam catapults and retelling the story of his 2017 visit to the Gerald Ford.

For example, at a November 2, 2023 campaign rally in Houston, Texas, Trump was talking about shipbuilding and veered off to tell about a ship that was “in trouble” because “it was $10 billion over budget, and I wanted to go and see this ship that was costing so much money.”

At that Houston rally, Trump went on, “And I landed with a helicopter on top of this massive, incredible ship [USS Gerald Ford] being made in Newport News. And I said to the people…I want to meet the catapult people, the people that have done the catapulting.”

Trump continued, “I want to find out what the hell happened because the catapults weren't working. So for 50 years, we used steam more. And that beautiful scene, that steam goes off, and that plane gets thrown the hell off, the power, beautiful, and it's cheap.”

Trump said he asked a sailor “Which is better, steam or electric? ‘Steam, sir.’ I [Trump] said why did they design electric? ‘Because it can keep going like this all day long, but it takes us 59 seconds to reload a plane. And when we reload the plane, the steam builds up, and it's all set, sir. It's perfect. It works so well. And we can fix it with a blowtorch if something happens. And if a wave hits it, it actually cools us down, sir. We love the waves hitting us. If a wave hits the electric [catapult], we're out of business, sir. We might -- we'll die with this thing.’"

Subscriber+Members have a higher level of access to Cipher Brief Expert Perspectives and get exclusive access to The Open Source Report and The Dead Drop, the best national security gossip publication, if we do say so ourselves. Find out what you’re missing. Upgrade your access to Subscriber+ now.

Last July 15, at the U.S. Army War College in Carlisle, Penn., Trump again was talking about shipbuilding and switched saying, “I went to the ship [USS Gerald Ford], because I came into office and the ship was way over budget, built in Newport News, unfortunately, was way over budget.”

Trump went on, “I said, I want to meet the ‘catapultier’ and a man came over, along with four of his assistants. And I said, what's better, electric catapult or steam? He's been there for 25 years. He said, ‘Steam is better, sir. We can fix it with a hammer and a blowtorch. When the electric [catapult] goes bad, I have to send to MIT to get geniuses over here’…But I [Trump] said, so you're saying we spend billions of dollars extra to build electric catapults instead of using steam.”

Bryan Clark concluded his Post article saying, “Steam power was cutting-edge technology in the 19th century. It is the wrong choice for a Pentagon that is leaning into artificial intelligence and autonomous systems. The Navy should stay the course with electromagnetic catapults to keep the carrier fleet strong and deliver more firepower. It could use the savings to help refill the fleet’s weapons magazines.”

Clark told CNN the cost of changing catapults on the USS Doris Miller, already under construction, “will probably be into the billions” and it could delay the carrier — which was expected to be in service around 2034 — “until the end of the next decade.”

Clark also Clark said, “Nobody builds them anymore. There’s no steam catapult manufacturers in the…U.S. anymore so they’d have to restart that production line, which would cost tens of millions of dollars to get going and that’ll be, it’ll take years to start that up again and build the first catapult.”

To add insult to injury, various recent news reports have said Navy senior staffers are reviewing the name USS Doris Miller for CV-81.

Named on January 20, 2020 -- during the Trump first administration -- by then-Acting Navy Secretary Thomas B. Modly during a Martin Luther King, Jr. Day ceremony, it honors African-American Mess Attendant Third Class Doris “Dorie” Miller, who received the Navy Cross for extraordinary heroism during the attack on Pearl Harbor on December 7, 1941, where he manned an anti-aircraft machine gun without prior training and aided wounded crewmates.

In giving the new aircraft carrier Miller’s name, acting-Navy Secretary Modly said, “In selecting this name, we honor the contributions of all our enlisted ranks, past and present, men and women, of every race, religion and background.”

One name said to be under study to replace Miller’s is that of President Trump.

Hyping Nuclear Threats Is Counterproductive

Hyping threats of nuclear proliferation to justify war undermines legitimate counter-proliferation policies and paradoxically incentivizes proliferation. The Trump administration’s effort to justify the Iran war as a means of saving the world from a nuclear armed Iran rings as hollow as George W. Bush’s similar claims about Iraq a quarter century ago.

Both threats were real, until the United States and the international community reduced them. The 1990 Gulf War and the ensuing inspection regime ended Iraq’s nuclear weapons ambitions. A little over a decade later, the George W. Bush administration justified its war in Iraq with claims about Saddam’s supposed nuclear (and chemical and biological) weapons. Addressing questions about the veracity of those claims, National Security Advisor Condoleezza Rice argued at the time, “We don’t want the smoking gun to be a mushroom cloud.” Secretary of State Colin Powell told the UN, “…the facts and Iraq's behavior show that Saddam Hussein and his regime are concealing their efforts to produce more weapons of mass destruction” Inspectors scoured Iraq in search of those weapons and found none, but the war dragged on at huge cost in lives and money.

The nuclear threat from Iran was and remains real, and like Iraq’s was also contained. Like Iraq, Iran signed the Nonproliferation Treaty (NPT) but played cat and mouse games with its compliance for decades. Iran’s covert enrichment program received a boost in the 1980s when Tehran acquired centrifuges from Pakistan. Iran pursued a two-track strategy of building its civilian atomic energy program, which was open to inspection by the International Atomic Energy Agency (IAEA), and a parallel covert program focused on nuclear weapons. For years Iran routinely denied access to IAEA inspectors who compiled extensive evidence of undeclared, weapon-related activities, which Iran denied. US and UN sanctions weakened Iran’s economy, but did not persuade Iran’s leaders to change course. The June 2025 US-Israel strikes severely damaged the critical facilities essential for Iran’s nuclear program.

At the very least, Iran’s enriched uranium and its centrifuges are buried under tons of rubble, unreachable and readily monitored. Iran’s path from buried canisters of 60% enriched gas to a usable weapon is difficult, time consuming, and depends on the very facilities and equipment that were reportedly destroyed. The threat of an Iranian bomb has been degraded, at least for now. The initial strikes, if as effective as claimed, have bought the international community time.

Buying time is a legitimate nonproliferation strategy. The Joint Comprehensive Plan of Action (JCPOA) of 2015 relied on this strategy. Under the JCPOA, Iran agreed to a number of key limitations. Enrichment was restricted to low enriched uranium (LEU, below 3%), there were caps on the number and types of centrifuges, limits on centrifuge production and LEU stockpiles, canceling a plutonium project, and unfettered access to international inspectors. The deal was to last for 15 years.

Critics argued that the deal ignored the full range of Iran’s bad behavior. It shelved the IAEA’s list of unresolved issues related to nuclear weapons-related activities and did not eliminate Iran’s latent technical capabilities to build a bomb. The knowledge never goes away. Moreover, the international community lifted sanctions and Iran was allowed access to $1.7 billion of its own money that was seized because of sanctions, plus $400 million from a longstanding dispute over military sales.

The JCPOA was imperfect. It did not address the regime’s support for terrorism, but it was not designed to. It was designed to restrain the most important aspects of Iran’s nuclear program, its ability to produce weapons-usable materials, without which there would be no Iranian bomb. Had the Iranian regime abandoned the JCPOA, the United States and other backers of the agreement (the United Kingdom, Russia, China, France, Germany, the EU and the UN) were poised to reinstate sanctions and take other actions as necessary to bring Iran into compliance.

That never happened because the Trump administration repudiated the JCPOA in 2018. That reversal freed Iran to expel the international inspectors, ramp up its enrichment program, and reignite fears of a hidden nuclear danger. Bombing the facilities in 2026 achieved similar goals as the JCPOA, but at a much higher price in blood and treasure. The nuclear threat has been contained. Yet, the war continues and the Trump administration continues to cite the Iranian nuclear threat as its chief war aim.

We should assume that the Iranian regime remains committed to obtaining nuclear weapons. The JCPOA would have delayed the realization of this ambition by 15 years. The 2025-26 bombings also delayed realization, although it is unclear for how long. Hyping nuclear threats, however, is counterproductive, because it persuades others of a degree of nuclear danger that does not currently exist, and incentivizes others, like Saudi Arabia, that they too must pursue a weapon, if only to deter Iran.

The United States may have other reasons for continuing the war with Iran, but they should be clearly articulated along with the price that Americans will pay to achieve them.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

It’s Time to Reengage North Korea

The U.S. and South Korea have their annual joint military drills (Ulchi Freedom Shield) from August 17-27, focusing on countering the threat from North Korea of drones and cyber-attacks. President Trump said on Sunday that he had ordered the Pentagon to “substantially reduce” joint military exercises with South Korea, according to the New York Times.

North Korea said these military exercises “are more serious, provocative and dangerous than last year.”

Although North Korea routinely criticizes these joint military exercises, this year North Korea went on to say that the U.S. is pursuing a new nuclear strategy that lowers the threshold of using nuclear weapons that pushes global security “to the brink of a nuclear war.”

North Korea’s usual response to these annual joint military exercises is the launching of short-range ballistic missiles into the Sea of Japan. This year there was no surprise when North Korea launched two ballistic missiles, saying the U.S. – South Korea drills were a “rehearsal for an aggressive war.” What was different was North Korea’s statement that the U.S. and South Korea and Japan formed a “nuclear alliance” that North Korea would respond to by building a new and higher level of nuclear deterrence.

This comes at a time when North Korea is providing Russia with combat troops, artillery shells and ballistic missiles for their war with Ukraine, while enhancing their relationship with China. The money North Korea receives from Russia is in the billions, with likely Russian assistance to North Korea’s nuclear, missile, and satellite programs.

Although North Korea has refrained from a seventh nuclear test – probably at the urging of China – they are building more nuclear weapons and ballistic missiles to deliver nuclear and conventional warheads. Recently, North Korea’s leader, Kim Jong Un, displayed to the world a new uranium enrichment facility with cascades of apparent new centrifuges to enrich uranium. This was in addition to the new uranium enrichment facility at North Korea’s nuclear complex in Yongbyon.

It was the issue of North Korea’s non-declared uranium enrichment sites that led to the failure of the 2019 Hanoi Summit. When Kim Jong Un offered to halt activities at Yongbyon, in return for the lifting of sanctions imposed on and after 2016, and President Trump responded with the request that North Korea declare “all” nuclear sites. Mr. Kim refused and that ended the Hanoi Summit.

Prior to and after the Hanoi Summit, North Korea has threatened to use tactical nuclear weapons in any conflict with South Korea. This is reminiscent of Russia’s President Vadimir Putin threat to use nuclear weapons in its invasion of and war with Ukraine. A war that North Korea joined, as an ally of Russia, with a recent Mutual Defense Treaty.

Hopefully, Ukraine will continue to receive the military support they need from the U.S. and NATO to protect its people and country from a revanchist Russian Federation that’s receiving significant military support from North Korea.

Messrs. Kim’s and Putin’s refrain of using nuclear weapons, with North Korea’s emphasis on building even more nuclear weapons, is concerning. Any use of nuclear weapons would be tragic for the world.

South Korea’s President, Lee Jae Myung, continues to reach out to North Korea, for talks that would lead to peaceful coexistence between the two Koreas. To date, North Korea’s response has been disappointing. But President Lee persists, knowing that an emboldened North Korea, now aligned with Russia, could incite conflict on the Korean Peninsula. Conflict that could cause instability on the Korean Peninsula and Northeast Asia.

Having negotiated with North Korea for over ten years, it is apparent to me that North Korea wants a normal relationship with the U.S. A relationship that would give North Korea international legitimacy and access to financial institutions.

Now would be the time for President Trump to meet with Kim Jong Un. Such a meeting would deescalate North Korea’s tension with South Korea and the U.S. It would also give the U.S. the opportunity to move in a different direction with North Korea, with the goal of getting North Korea to halt its nuclear and missile programs, in return for the easing and lifting of sanctions and a dialogue to normalize bilateral relations.

North Korea is a defacto nuclear weapons state and recognizing them as such should not be too difficult. Getting North Korea to implement a moratorium on its nuclear and weapons programs would be progress. Sanctions relief and a path to a normal relationship with the U.S. could convince Kim Jong un that a mortarium would be in North Korea’s interest, while aligning with a revanchist and fickle Vladimir Putin is not in North Korea’s interest.

Our goal should continue to be the complete and verifiable denuclearization of the Korean Peninsula, realizing that this could take years to achieve. Getting North Korea to halt its nuclear and missile programs and refraining from fomenting conflict with South Korea are immediate goals that are achievable, assuming a willingness to be flexible on sanctions relief and a dialogue on normalizing relations.

It is in the interest of world peace that the U.S. reengage with North Korea.

The author is a former Associate Director of National Intelligence. All statements of fact, opinion or analysis expressed are those of the author and do not reflect the official positions or views of the U.S. government.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

China’s Research Espionage Threat Is Hiding in Plain Sight

Western universities and laboratories are on the frontlines of a battle over talent and technology. This assertion may seem like scaremongering, but when cold hard facts are considered, it is unfortunately true. The Chinese Communist Party (CCP) is undertaking an unprecedented assault to obtain scientific and technical research from the west. The broad CCP assault requires an equally broad response that must now include vetting for insider threats at universities and laboratories to bolster research security.

Spies Among Friends

In the present context, insider threats can be most usefully understood as existing on a spectrum, from fully paid-up agents (a spy in popular parlance) to research collaboration that could benefit a hostile foreign power.

There is a long history of hostile states exploiting academic freedoms at western universities. A hundred years ago, because the Soviet government had few diplomatic relations with foreign governments, it relied on intelligence officers without diplomatic cover, known as illegals. One of the earliest known illegals entered MIT as a student in 1938, Semyon Markovich Semyonov (codename TVEN). He was tasked with collecting scientific and technical research. It was, however, in the other Cambridge, in England, where Soviet intelligence had its greatest success. The Cambridge Five – Kim Philby, Guy Burgess, Donald McClain, Anthony Blunt, and John Cairncross – were all recruited at or soon after leaving Cambridge University in the 1930s. The Cambridge Spies were each motived by communist ideology, shaped by their intellectual discussions at Cambridge. During World War II, they became hugely damaging Soviet agents inside the British government. Some of the most important intelligence they gave to Moscow was the activities of codebreakers at Britian’s Bletchley Park.

The greatest Soviet insider threats occurred at an American top secret wartime laboratory to build the world’s first atomic bomb. The MANHATTAN Project was fully penetrated by Soviet agents. The Soviet agent, Klaus Fuchs, a brilliant physicist working at Los Alamos National Lab, provided Moscow blueprints and calculations for the atomic bomb. He was motivated by his communist ideology and the belief that nuclear weapons should not be held by one power alone. Fuchs later said that he divided his mind into two compartments: one for his friends and colleagues, the other for his communist beliefs, with the latter always superseding the former. It was, Fuchs said, a kind of controlled schizophrenia which allowed him to betray his friends and colleagues. Soviet espionage at the MANHATTAN Project accelerated Soviet development of Moscow’s own atomic bomb. Accelerating research and development is the essence of what espionage can achieve. The intelligence provided by Fuchs and other agents at Los Alamos meant that when the Soviets detonated their first atomic bomb, in 1949, it was an exact replica of the weapon the US dropped on Nagasaki four years earlier.

After the end of the Cold War, in the 1990s, Chinese espionage replaced Soviet intelligence at Los Alamos. At the end of that decade, Chinese intelligence was discovered to have obtained nuclear secrets from the New Mexico laboratory. 9/11 interrupted and distracted the US response to Chinese intelligence at Los Alamos.

Vetting

The penetration of the Cambridge Spies and agents like Klaus Fuchs, represented one of the greatest failures of western security in modern time. They were able to inflict their damage thanks to inadequate vetting by the British government. At the time, British vetting relied on a cross check on MI5 records. There were no proactive investigations into applicants’ backgrounds. The obvious flaw in the system was that if a candidate distanced himself or herself from communist associations there would be no traces in MI5 records. The Soviet recruiters of the Cambridge Five skillfully got them to do exactly that: breakaway from all communist groups. Thus, the Cambridge Five were able to slip through the British security net. Only later did MI5 obtain records of the Cambridge University socialist club, which contained names of the Cambridge Five and which could have provided important clues to their true motivation.

After the identification of the Cambridge Spies, beginning in 1951, the British government belatedly introduced positive vetting – in which there were intrusive investigations into a candidate’s background. Today the process is known as Developed Vetting. As the recent scandal of Lord Mandelson’s appointment to British Ambassador in Washington shows, the process of Developed Vetting is purely advisory. The decision to employ an applicant is up to the employing body itself.

In the CCP Crosshairs

The CCP has a strategy to exploit western research and development. The CCP has instigated a number of talent programs, by which Chinese researchers are sent to western institutions, but are then required to return to China, bringing the fruits of their research with them. A variant of CCP talent programs is to exploit Chinese diaspora scientists at western institutions, often by blackmailing them through family members and China itself. Such talent programs are part of the CCP’s national rejuvenation program by which it seeks to replace the United States as the world’s leading economic and military power. The CCP demands that any research and development that cannot be delivered from homegrown talent must be obtained from overseas. As well as talent programs, the CCP also exploits research collaboration with western universities and laboratories. There is in principle nothing wrong with this, as long as such western institutions appreciate that the CCP will try to steal any intellectual property produced by such collaborations. The problem arises when western scientists hide their connections to Chinese entities, as was the case with former Harvard professor of chemistry, Charles Lieber.

Frequently Chinese researchers are not forthcoming about their continued affiliation with the Chinese military. For example, open-source data obtained and analyzed by a private sector strategic intelligence firm, Strider Technologies, shows that since 2020 over 8,000 STEM publications have involved collaboration between Chinese military entities and more than 100 UK institutions. The Chinese – UK research collaboration includes dual use technology – those with civilian and military application – such as hypersonics and antijamming communications.

Russia is also pursuing research collaborations with western institutions, with the aim of obtaining dual use technologies [CW1] .

A new approach

There will always be a need for traditional vetting for sensitive positions in western governments involving national security. It would, however, be mistaken to think that such vetting is comprehensive.

In the past, vetting required full state-backed resources. Today, that is no longer the case. Private sector companies are now able to use AI driven open-source data to reveal insider threats which, in some cases, western governments have missed. In 2022, for example it was revealed that a group of Chinese scientists working at none other than Los Alamos returned to China bringing with them research into defense technologies like hypersonics. The perversity of this situation cannot be overstated: US national defense research was benefiting the principal US adversary.

Bold action is needed. Western governments would be well advised to establish oversight bodies to identify vulnerabilities in research with military or dual use application. All such research positions can and should be vetted by open-source private sector providers. A subset of academics and civil libertarians will inevitably denounce this as unduly invasive. The fact that such vetting would be based on open-source data should, however, ameliorate those concerns. Furthermore, incase there are concerns about racial profiling, the vetting would pertain to the research positions not researchers themselves.

Ultimately the issue at stake is about western economic security – the intellectual property that will provide western economic prosperity. Think of western AI frontier laboratories. The question is whether the west is prepared to allow the secrets of this century’s technologies to be transferred to the west’s principal strategic adversaries, China and Russia.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Beyond Military Interoperability: The Coalition Challenge of Limited War

In our last two articles for The Cipher Brief, Sami Omari and I explained why modern limited wars are so challenging for democracies.

We argued that military superiority is necessary but not sufficient for strategic victory: Afghanistan and Iraq showed that battlefield success does not guarantee lasting political outcomes, and Iran may yet prove the same point.

We also examined why democracies struggle to translate tactical success into strategic achievement: fragmented institutions, electoral cycles, public opinion and media scrutiny complicate the political resolve required for prolonged wars of choice.

The challenge becomes greater when democracies fight as coalitions.

Alliances combine military power, share costs and draw on capabilities few states could sustain independently.

But military integration does not produce political unity.

Each member remains accountable to its own electorate, parliament and national interests. A coalition may therefore be highly integrated on the battlefield while remaining politically and strategically decentralised.

In prolonged limited wars, military interoperability is not enough if allies cannot sustain the political will, industrial capacity and common strategic purpose required to endure.

II. Why Democracies Fight in Coalitions

The nuclear age made direct great-power war prohibitively dangerous, shifting competition towards limited wars, insurgencies and proxy conflicts.

Western militaries increasingly moved towards smaller professional forces equipped with more advanced weapons, shaped by technological progress and new strategic realities.

After 1991, the Gulf War and subsequent operations against weaker adversaries appeared to vindicate the effectiveness of Western expeditionary forces.

But smaller professional militaries and increasingly expensive weapons also made allies progressively dependent upon one another. Coalitions allowed democracies to aggregate military power, intelligence, logistics and specialised capabilities without each maintaining the forces and industrial capacity required for large-scale national mobilisation.

For thirty years, that system seemed to work.

Russia’s war against Ukraine has exposed these vulnerabilities over several years; the US-Israeli war with Iran is now testing many of the same assumptions.

Both demonstrate that limited wars can become contests of manpower, industrial capacity and political will.

Of these pressures, political endurance is perhaps the most difficult for democracies to sustain.

III. The Political Endurance Problem

For democracies, fighting a long, limited war depends as much on political legitimacy at home as on military capability.

In wars of choice, where national survival is not at stake, governments must continually justify why the costs of war remain necessary.

Initial public support may create space for intervention, but it erodes as casualties rise, costs accumulate, and the prospect of a clear strategic outcome grows uncertain.

Casualties alone do not determine support.

Democratic societies have accepted heavy losses when citizens believed a war was legitimate, necessary and winnable.

The deeper problem emerges when the link between sacrifice and strategic purpose becomes unclear. As confidence in success fades, losses that once seemed tolerable turn politically damaging. Elections, parliamentary opposition, media scrutiny and changes of government then allow declining public confidence to reshape national strategy. Afghanistan illustrated this over two decades.

Western military superiority was never in doubt, but political will steadily weakened. The longer the war continued without a convincing political end state, the harder it became for democratic leaders to explain what more time, money and lives would achieve.

Authoritarian states face similar pressures but, without competitive elections and independent media, can better insulate strategic decisions from public opinion.

Against democratic opponents, this creates a critical asymmetry: a weaker adversary may not need to win militarily, only survive long enough for democratic political will to erode.

IV. The Industrial Endurance Problem

Political endurance is only one side of the problem. The other is material.

Since the Cold War, Western militaries have increasingly relied on technology instead of mass.

Smaller professional forces employ sophisticated aircraft, ships, missiles and networked systems aimed at achieving decisive results while minimising casualties. But each generation of weapons is more expensive and complex, production runs shrink, and replacing battlefield losses becomes harder as war drags on.

The United States can absorb these pressures better than smaller allies because of its defence budget, technological base and industrial scale.

Even so, American forces became smaller, while defence-industry consolidation reduced the number of manufacturers capable of producing specialised weapons. For smaller allies, limited budgets forced difficult choices between personnel, platforms and munitions, while dependence on American weapons, software, supply chains and sustainment deepened.

Quick wars against weaker opponents long obscured these problems.

Ukraine has brought them sharply to the surface, while the Iran conflict is testing them anew. Advanced weapons can be consumed faster than peacetime factories replace them, while cheap drones and missiles allow weaker states to impose continuing costs on advanced rivals.

This creates an uncomfortable paradox.

Military interoperability strengthens coalitions on the battlefield but also creates industrial dependencies that are difficult to escape. In long, limited wars, technological superiority matters only as long as the coalition can afford, produce and replace what it consumes.

V. A Coalition of Decentralised Systems

Coalitions do not solve the political endurance problem; if anything, they make it worse.

Integrating militaries does not erase national sovereignty. Allied forces can share command structures, intelligence and interoperable systems, but each government still answers to its own voters, parliament and interests.

Afghanistan made that painfully obvious. NATO operated under one mission on paper, but contributing states imposed their own caveats and restrictions on where and how their troops could operate.

Those caveats were not bureaucratic quirks; they reflected different domestic political pressures and appetites for risk. They made burden-sharing and coalition cohesion harder than the unified-command narrative suggested.

Of the contemporary great powers, the US above all can supply the backbone of an international military coalition: intelligence, logistics and advanced capabilities.

What it cannot do is fuse the sovereign political systems behind every other contributor.

Middle and smaller powers like Australia and Canada still matter because they bring niche capabilities, diplomatic weight and political legitimacy while operating inside their own domestic constraints.

Coalitions may fight as one integrated military network, but the statecraft holding that network together stays stubbornly decentralised.

VI. From Military Interoperability to Strategic Interoperability

This gap between integrated military networks and decentralised statecraft is the central weakness of contemporary coalition warfare.

Modern limited wars therefore require more than military interoperability. They require strategic interoperability.

Sovereign allies must be able to coordinate military, political, economic and industrial power to pursue and sustain a common strategic objective.

This does not mean supranational government or surrendered sovereignty, but unity of strategic effect even when national policies differ.

In practice, this could involve standing allied mechanisms that integrate political planning, defence production, economic measures, strategic communications and military operations around an agreed political end state before a crisis becomes a prolonged war.

Conclusion

Across these three articles, we have argued that military superiority alone cannot guarantee strategic victory; that democratic institutions often struggle to turn battlefield success into sustainable political outcomes; and that these difficulties multiply when democracies fight as coalitions.

The endurance of democratic alliances will depend on more than their ability to fight together.

Sovereign governments must sustain public support, share political and military burdens, and remain committed to common strategic purpose when conflicts become longer and more costly than expected.

Democratic accountability need not become a strategic weakness, but preserving sovereignty while sustaining collective action will require greater political cohesion.

The ultimate obstacle is not technology or concepts, but political will: overcoming domestic divisions and institutional rivalries to sustain common purpose.

As the era of AI unfolds, technology will keep changing warfare, but it cannot repair the organisational weaknesses of those who use it.

Strategic interoperability ultimately depends on whether democracies can find the will to build it.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The Return of the Essential Art: Electronic Warfare and the Lessons of the Russia-Ukraine War

A Post-Cold War Assumption That No Longer Holds

For three decades, the Alliance operated under a dangerous assumption: that the electromagnetic spectrum was a permissive sanctuary. Lulled into complacency by counter-terrorism campaigns that allowed precision strikes and networked command to go largely unchallenged, we forgot how to fight in the dark. The Russia-Ukraine war has violently corrected that amnesia. Today, electronic warfare is not an enabling function; it is the apex of modern combat power. If a force cannot survive in the spectrum, its sensors are blind, its networks collapse, and its kill chains are severed.

The Alliance stands at a critical inflection point. The time for incremental modernization has passed; this short piece is a call to arms to reclaim our operational advantage. The war in Ukraine has proven that the half-life of a technological advantage is measured in days, not decades. If we do not aggressively institutionalize agility across our warfighting commands, we risk entering the next conflict blind, deaf, and disconnected.

Russia’s Spectrum Offensive at Scale

Russia entered the war with a deep inventory of EW systems, rooted in Soviet-era investment and modernized over the past decade. From strategic GPS denial across Eastern Europe to tactical jamming of drones, radios, and artillery sensors, Russian forces use EW to degrade decision-making, disrupt fires, and blind ISR, continuously, at scale, across every echelon.

This is not a supplementary effort; it is a structural pillar of Russian combat operations. According to analyses by the Royal United Services Institute (RUSI), Russia achieved a staggering density of EW coverage, deploying a major electronic warfare system approximately every 10 kilometers along the front line during peak operations. This continuous, layered spectrum defense can be understood across two distinct operational tiers:

1. Strategic and Operational Denial

At the macro level, Russia has deployed high-powered, truck-mounted systems designed to blind NATO and Ukrainian airborne intelligence and disrupt satellite architectures.

The Krasukha-4: Designed to protect high-value assets, this system emits powerful jamming signals targeting airborne early warning and control aircraft (AWACS), radar reconnaissance drones, and low-Earth orbit spy satellites. By targeting X-band and Ku-band radars, it degrades long-range aerial surveillance, forcing ISR platforms to operate at suboptimal standoff distances.
Murmansk-BN: Operating at the strategic level, this system targets high-frequency (HF) military communications up to thousands of kilometers away, aiming to disrupt the operational coordination of enemy forces on a theater-wide scale.

2. Tactical Interdiction and the Defeat of Precision Munitions

At the tactical edge, Russian EW is integrated down to the battalion level to create local bubbles of spectrum denial. This has profoundly affected the effectiveness of Western-supplied precision-guided munitions (PGMs) and unmanned aerial systems (UAS).

Neutralizing GPS-Guided Weapons: Systems like the R-330Zh Zhitel and Pole-21 have been explicitly used to create GPS-denied environments. Because GPS signals travelling from space are relatively weak by the time they reach Earth, localized jammers easily overpower them. RUSI has noted that this jamming significantly degraded the accuracy of key weapons, including Excalibur 155mm guided artillery shells, Joint Direct Attack Munitions (JDAMs), and GMLRS rockets fired by HIMARS. Without GPS, these munitions must rely on inertial navigation, which drastically reduces their hit probability.
Drone Suppression and ISR Severance: In the early months of the war, Ukrainian Bayraktar TB2s operated with near impunity. As Russian forces entrenched, their EW architecture caught up. By blasting the 900 MHz and 2.4 GHz frequencies used by commercial and military drones, systems like the Borisoglebsk-2 sever the command links and video feeds between drones and their operators. This strips frontline units of their "eyes," returning artillery duels to grid-square estimations rather than precision strikes.

Ukraine’s Rapid Adaptation Under Fire

Ukraine’s response has been just as instructive. Forced to adapt under fire, its forces built a distributed EW ecosystem spanning national infrastructure to handheld infantry jammers, fielding and replacing thousands of systems in months, not years. EW operators are now embedded in maneuver, air defense, and fires units. The war has become a laboratory of spectrum conflict with drones jammed out of the sky, counter-battery radars blinded, munitions diverted, networks disrupted. EW is both shield and sword: protecting friendly systems while blinding the adversary.

While Russia relies heavily on legacy, mass-manufactured, centralized platforms, Ukraine’s survival has depended on democratizing the electromagnetic fight. By abandoning rigid peacetime acquisition processes, Ukraine has successfully pioneered a "DevOps" warfighting philosophy, prioritizing the rapid, iterative deployment of real-world software capabilities and commercial hardware modifications.

Ukraine has mastered the art of using the electromagnetic spectrum not just for defense, but to actively hunt Russian forces. By integrating EW operators directly into fires and maneuver units, the spectrum has become the primary hunting ground for target acquisition.

EW as a Mass Capability

The scale is the lesson. Both sides are fielding equipment and training operators at a pace NATO hasn’t matched since the Cold War. EW is no longer a boutique, specialized function; it’s a mass capability woven into daily battle rhythm and treated as a core determinant of survivability and lethality. In Ukraine, EW isn’t an adjunct to maneuver or fires. It’s inseparable from them.

For NATO and allied forces, Ukraine's experience demonstrates that surviving a high-intensity conflict requires transitioning from static, hardware-centric platforms to data-centric environments where software updates can be continuously deployed to the tactical edge under fire.

NATO’s Vulnerability Without EW Dominance

The implications for NATO are stark. Precision fires need assured spectrum access. Air defense needs resilient sensors and networks. ISR needs unjammed collection. Command and control needs protected communications. Without robust EW, all of it evaporates. This war shows EW is both the first layer of protection and the first layer of lethality, the foundation everything else rests on.

Rebuilding EW as a Core Competency

Reconstituting EW will take more than new hardware, it demands a cultural shift. Commanders must think in terms of spectrum maneuver, fires, and protection as naturally as kinetic operations. Exercises need realistic EW conditions, not sanitized ranges. Training pipelines must expand, and offensive and defensive EW forces must be rebuilt at every echelon, from squad to strategic level. Doctrine must treat EW as a decisive domain, not a supporting function.

The Essential Art Returns

The essential art of warfare in the twenty-first century has been violently reintroduced, and the electromagnetic spectrum is no longer an invisible enabler; it is the primary maneuver space where the first shots are fired, and the deepest vulnerabilities are exposed. NATO must reclaim this domain fully, urgently, and at scale.

For too long, the Alliance rested on the laurels of post-Cold War permissive environments, operating under the dangerous assumption that our networks would always connect, our drones would always fly, and our precision munitions would always find their mark. The battlefields of Ukraine have permanently shattered that assumption. We can no longer afford the luxury of rigid, decade-long peacetime acquisition cycles. Surviving the modern fight requires a fundamental paradigm shift: embracing a "DevOps" warfighting philosophy that prioritizes rapid, iterative deployment of software-defined capabilities directly to the tactical edge.

Lethality today is inextricably linked to digital survival. If we cannot protect our data lineage, secure our networks, and continuously update our countermeasures under fire, we will cede the kill chain to our adversaries. The next fight will be decided not just by who holds the physical terrain, but by who dominates the spectrum.

NATO must institutionalize this reality across every echelon. Electronic warfare is not an adjunct to maneuver; it is the very foundation of our combat credibility. We must transition our defense structures to data-centric environments, integrate our joint capabilities, and ensure that when the next conflict erupts, the Alliance dictates the spectrum and the adversary is left blind, disrupted, and defeated.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Where Did Venezuela’s Oil Billions Go?

“We’re taking a lot of oil from Venezuela, and we’re getting along great with them. Billions and billions of barrels of oil is coming out of Venezuela, one of the most fertile places for oil in the world. And as you know, it was a forty-eight minute war, lasted forty-eight minutes. And we paid for the war with what we’ve taken out many, many, many times. Where have you heard that before? You haven’t heard that before. It’s the old fashioned way. Right? It’s the old fashioned way. To the victor belong the spoils. Right?”

That was President Trump, speaking impromptu on August 5, during a campaign-style speech on the U.S. economy at the Red Rock Casino in Las Vegas, Nevada.

I use that quote as a way to get into the serious question of what has happened to the now estimated $13 billion worth of Venezuelan oil that’s been sold since January 9, when President Trump announced his Executive Order (EO), Safeguarding Venezuelan Oil Revenue for the Good of the American and Venezuelan People.

The EO set up so-called "Foreign Government Deposit Funds" meaning funds from the sale of Venezuelan oil or other natural resources from that country held by the U.S. Government in designated U.S. Treasury Department or other accounts in a “custodial and government capacity.”

Every six months, according to Trump’s January 9, EO, “The Secretary of the Treasury, in consultation with the Secretary of State, is hereby authorized to submit recurring and final reports to the Congress” about those funds.

Apparently, no such report has so far been sent to Congress, although it would seem at least one should have gone to Capitol Hill last month.

Venezuelan oil money has been generated and serious amounts have been received by the U.S., as Trump himself has claimed many times.

For example, back during his January 9 press conference with oil company leaders at the White House, Trump announced that Venezuela had already given the U.S. 30 million barrels of what had been previously-sanctioned oil that it had on hand.

“That's about $4 billion worth,” Trump announced back in January, adding, “And it's on our way to the United States right now. And we want to thank Venezuela for that. And we're working very well with them, obviously, or they wouldn't have been so generous.”

There has been no accounting that I know of for that first gift of $4 billion worth of Venezuelan oil.

On January 28, Secretary of State Marco Rubio told the Senate Foreign Relations Committee that funds from Venezuelan oil sales in the “short term” would go to a bank account in Qatar, but he added, “Ultimately, it will be [held in] a U.S. Treasury blocked account in the United States.”

Rubio explained to the committee that the U.S. “at the front end [will] say this is what this [oil payment] money can be spent on, these things. We will submit [that list] to them [the Venezuelan government and] they will submit to us a budget request. We want to use this money for these things and part of the proceeds will go to fund an audit process to make sure that that's how the money is being spent.”

Rubio told the committee one payment of $300 million had already been made “to keep [Venezuelan] sanitation workers, police officers, government workers on staff,” and that it was from Venezuelan oil sales totaling $500 million. Of the remaining $200 million, Rubio said, “It's still sitting in the [Qatar] account is my understanding at this time [back on January 28].”

Rubio added that he thought this U.S.-control of Venezuelan oil sales funds might involve “another $2.5 billion-to-$3 billion” of Venezuelan oil income.

But Rubio made clear, “The permanent structure we want to see in the long term. We just want them to have a normal industry where the [oil] companies [U.S. and others] are involved in there. They're [the oil companies] selling it [Venezuelan oil] directly to the [world] market and we're [the U.S. government] out of that game.”

In March, the U.S. Treasury issued licenses to entities to do business with Petróleos de Venezuela S.A, or PDVSA, and handle, transport, refine, and market Venezuelan-origin oil under strict operational limits. One limit: All payments for the Venezuelan oil go to a special U.S.-controlled account and not to sanctioned Venezuelan entities such as PDVSA.

In other words, the U.S. would control the cash flow back to Venezuela for its oil sales.

On April 1, Bloomberg reported the estimated value of U.S.-controlled Venezuelan oil exports had increased from $600 million in January \ -- about 380,000 barrels per day -- to about $3.7 billion in April alone -- about 1.1 million barrels per day.

On April 16, the State Department’s Michael Kozak, a senior official from the Bureau of Western Hemisphere Affairs, in testimony before the House Foreign Affairs Western Hemisphere Subcommittee, disclosed “around $3 billion” of Venezuelan oil revenue had moved through the U.S. accounts “paying the salaries of government workers in Venezuela; buying supplies for their oil industry, and so on, other things that benefit the public.”

Kozak also said the U.S. accounting firm, KPMG would be making quarterly audit reports on the Venezuelan oil bank accounts and providing them to the State Department.

One day after Kozak’s appearance, on April 17, four Democratic members of Congress sent a letter to the Government Accountability Office (GAO) Acting Comptroller General Orice Williams Brown, requesting “an audit of the United States-Venezuela energy deal that was announced by President Trump on January 6.”

They asked that “the review cover both the period of time that the funds were routed to accounts in Qatar, the current arrangement for funds to be routed to U.S. accounts controlled by the Treasury Department, and any other successor mechanism utilized by the Administration to facilitate the sale of Venezuelan oil, custody of these assets, and disbursement of these funds.”

The GAO has since confirmed they have an investigation underway.

On June 3, Roxanna Vigil, a former senior sanctions policy advisor at the U.S. Treasury Department’s Office of Foreign Assets Control, raised questions about the Venezuelan oil funds in a Council on Foreign Relations article.

Vigil wrote, “In the first four months of the United States exerting control over Venezuela’s oil exports, almost one hundred million barrels of oil worth an estimated $8 billion have flowed through a process marked by no transparency and minimal oversight.”

She added, “While the Trump administration has repeatedly framed this control as benefiting both countries, it has not publicly disclosed how much Venezuelan oil it has sold, how much revenue it has collected, or how it has used those funds since seizing control of the country’s oil exports following the January 3, military intervention that deposed Venezuelan leader Nicolás Maduro.”

On June 24, earthquakes struck Venezuela leaving more than 5,000 dead, 16,700 injured and damage the World Bank estimated would cost some $19.7 billion to reconstruct. The Trump administration coordinated a humanitarian response including more than $386 million for which polls have shown Venezuelans are grateful.

However, those polls have also shown Venezuelans resent the poor handling of the disaster by acting-President Delcy Rodríguez and are troubled by the Trump administration’s open support of her relatively unpopular government.

On July 22, the Financial Times published a story that led by saying, “The Trump administration has collected more than US$13 billion in revenues from Venezuelan oil sales this year, according to FT calculations, but has said almost nothing about what has happened to the money.”

The FT story went on to say, “But six months after the U.S. seized control of the funds, economists say the evidence of a recovery in Venezuela is relatively muted — a potential sign that the U.S. has not sent all the revenues back to Caracas.”

The FT also said, “The Venezuelan government set up a website to track the revenue from U.S.-run oil sales, but it has only one entry — a transfer of US$300 million in March.”

Since the FT story, almost everyone has used the $13 billion figure as the amount of money that has passed through the U.S.-run accounts. However, Trump, himself, when asked about that figure on July 27, during a press interview on Air Force One, replied, “$13 billion, I think even more than that.”

On August 4, during an interview by Fox News, Trump said, “Venezuela’s really a totally different place. Right now we’re taking out hundreds of billions of dollars, they’re taking out hundreds of billions of dollars it’s actually a different place.”

Of course, Trump’s statement is not true, “hundreds of billions” is more than twice Venezuela’s annual gross national product. But there are billions of dollars from Venezuelan oil sales yet to be accounted for and neither the Donald Trump or Delcy Rodriguez governments are trustworthy when that kind of money is involved.

Read more national security insights from experienced experts exclusively in The Cipher Brief.

Open-Source Intel Makes U.S. Troops an Easier Target for Iran

Iran is reading American service members’ social media feeds to deadly effect. The fact is that not all intelligence must be gleaned from secret, closed sources for it to be effective, and Tehran has made use of public and open-source data to target U.S. forces with psychological and kinetic attacks. Until the Pentagon updates and enforces its policies on social media posting and personal device security, American servicemembers will be sitting ducks.

Admiral Brad Cooper, the commander of CENTCOM, warned in a letter last month to U.S. forces that Iran is using social media posts from personnel, such as footage of U.S. bases, to improve its lethality. For example, a video of soldiers running for shelter during Iranian strikes helped Iran perform a battle damage assessment of their strikes, including their precision, and understand base layout for future attacks.

Iran has long exploited open-source data to target U.S. forces and allies. Two years ago, Iran doxxed 2,200 Israel Defense Forces personnel relying exclusively on open-source data. In April 2026, the Department of the Navy warned service members that unnamed cyber adversaries (obviously referring to Iran) are reaching out on social media and conducting phishing attacks, urging sailors to turn on privacy settings and refrain from posting on social media. The same month, Iranian hacker group Handala sent threatening WhatsApp messages to U.S. troops and published the supposed personal information of 2,300 U.S. service members stationed in the Persian Gulf.

Open-source data is broader than just Instagram and Facebook. Iran exploits data breaches to collect information and identify and send text messages to former Israeli defense personnel to threaten them and to attempt to recruit them for espionage purposes.

Iran is exploiting Signaling System 7 (SS7), an older telecom protocol for roaming, to identify devices with U.S. SIM cards, according to threat intelligence platform Mobile Surveillance Monitor. Using SS7, Iran was reportedly able to pinpoint hotels that housed U.S. personnel and contractors.

Iran can also simply buy data for its malicious campaigns. CENTCOM stated in a letter to Sen. Ron Wyden (D-OR) that it has been warned that Iran may have used commercially available location data used by digital advertisers to “target and surveil” U.S. personnel. While the phone numbers behind advertising IDs are anonymized, Iran could use them to track devices in specific areas such as military bases. The Pentagon conceded that these IDs are not yet disabled by default on government-issued phones.

None of these vulnerabilities should be a surprise to defense officials. A U.S. Government Accountability Office report from October 2025 found that social media posts from service members and their families or friends provide adversaries with names, ranks, and locations that can be pieced together to reveal information about U.S. force formations and operations. Wyden and his Democratic and Republican colleagues in the House and Senate sent a letter to the Pentagon’s chief information officer in May 2026 urging more secure personal data practices and blaming current vulnerabilities on the department’s “failure to prioritize this threat and implement common sense cyber defenses recommended by federal cybersecurity experts.” The House version of the annual defense bill, meanwhile, calls for the department to better understand and train personnel about how adversaries can exploit commercial technologies to identify and monitor U.S. personnel.

To curb adversarial intelligence collection opportunities, the Department of Defense (DoD) should expand operational security requirements across the force.

First, the DoD should harden government and personal devices by requiring removal of all Mobile Advertising IDs (MAIDs) on personal and DoD-distributed devices for personnel in sensitive areas. Without IDs, the locations and metadata cannot be tracked or associated with individual users and sold to adversaries posing as commercial buyers.

Next, the DoD should create and enforce stringent policies for social media posting. Personnel should be prohibited from uploading unofficial photos and videos of military facilities or that otherwise relate to their roles and should limit the amount of information they post about their roles on platforms like LinkedIn. Government devices should have their cameras disabled or removed unless required for specific purposes, and GPS should be disabled by default. DoD should also consider providing troops with alternative devices for personal use with GPS disabled and the cameras removed.

Additionally, the DoD should monitor breached data to understand what is publicly available about all its personnel. Knowing when data is exposed will allow the DoD to identify potential threats before Iran acts and begin fixing the issue as soon as it occurs. The department can also use this information to enable mandatory password and credential rotation when information is exposed. The Pentagon should also consider encouraging or requiring additional methods of authentication, such as passkeys and biometrics, for all devices and accounts

Finally, Congress should pass regulatory reforms to transition from SS7 to new signaling technology. SS7 is an outdated system and cannot guarantee secure communications, even if new updates were to be completed. Changing the system will allow service members abroad to communicate with loved ones without leading adversaries to their location.

These measures will limit the open-source data that, at present, is readily available to Iran and other adversaries. If the DoD continues to permit unrestricted use of personal devices abroad, Iran and other adversaries will continue exploiting their vulnerabilities to locate, study, and threaten American forces.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Inside Iran’s New Wartime Leadership

Tehran’s new power brokers

A wave of assassinations rebuilt Iran’s leadership from the top down, leaving a severely wounded supreme leader and a security establishment now calling the shots. Tehran, however, isn’t saying who is actually in charge. The silence is part of the narrative; who are the country’s power players?

Earlier this month, Iranian state media did something it had never done before.

Mehr News, an outlet controlled by the country’s Islamic Development Organization, released a video titled “First Images of the Leader,” showing Supreme Leader Mojtaba Khamenei addressing a small group of students. The footage was undated. It came, however, days after Israeli outlets reported the 56-year-old cleric was in “extremely critical condition,” and it appears to have done little to settle the question consuming Iran’s political class: is anyone actually running the country right now.

The clip echoed a similar undated video IRIB released in March, showing Khamenei teaching religious sciences. President Masoud Pezeshkian acknowledged this week that reaching him has been “very difficult,” though he described their last exchange as constructive.

Multiple sources close to Pezeshkian’s administration told IranWire that no cabinet minister has met with Khamenei since the February 28 strike that killed his father, Ali Khamenei, and that officials “would not be surprised” to hear news of his death.

Iranian authorities have repeatedly denied he’s incapacitated. But the man now holding life-tenure authority over Iran’s armed forces, judiciary and clerical establishment hasn’t spoken publicly, delivered a sermon, or appeared unedited on camera since taking the post in March.

“The main issue for U.S. policymakers — especially any president — is whether the new leadership in Iran, or any leadership we can currently anticipate, is likely to depart materially from the strategic policies of the previous leadership,” Norman Roule, a former CIA officer who spent 34 years managing programs related to Iran and the Middle East, tells The Cipher Brief. “The evidence to date suggests no fundamental break.”

The vacuum at the top didn’t stay empty for long.

A Leadership Rebuilt Through Killings

The cascade began on February 28, when a joint U.S.-Israeli strike killed longstanding leader Ali Khamenei along with Mohammad Pakpour, the Islamic Revolutionary Guard Corps’ commander-in-chief, and a string of other senior officials. An interim leadership council, made up of Pezeshkian, judiciary chief Gholamhossein Mohseni-Ejei and cleric Alireza Arafi, held the state together for less than a week before the Assembly of Experts named Mojtaba Khamenei as Iran’s third Supreme Leader on March 8.

The choice was unusual on its face. The Islamic Republic was founded on the overthrow of hereditary monarchy, yet its clerical establishment had just installed the son of the man he replaced. Mojtaba lacked the religious credentials typically required of a Supreme Leader. He was widely regarded as a hojatoleslam, a mid-ranking cleric, rather than an ayatollah — yet he had spent nearly two decades as his father’s gatekeeper and enjoyed deep loyalty inside the Revolutionary Guard.

President Trump, who had labeled him “unacceptable” during the war, later told Fox News that the succession was not one his own father had wanted, adding, “their leadership is gone, their second leadership is gone, now their third leadership is in trouble.”

Roule, however, cautions against reading the new bench as a break from what came before it. Most of Iran’s current leaders, he notes, “rose within institutions shaped by Ali Khamenei and were trusted, promoted, or shaped within, and by the system he developed over years of rule.”

Roule points to the generational math: Pezeshkian, Mohsen Rezaee and Ali Reza Zolghadr were about 25 years old at the time of the 1979 revolution; Ahmad Vahidi was 21; Mohammad Bagher Ghalibaf and Sadeq Amoli Larijani around 18; Mojtaba Khamenei just 10.

“For this group, the 1979 Revolution remained the ideological foundation of the system, but the Iran-Iraq War and the post-2003 campaign for regional influence were more important professional experiences,” Roule explains. “Most are veterans of the Iran-Iraq War or were directly shaped by it.”

The current command of the Islamic Revolutionary Guard Corps has followed the same brutal pattern.

Amir Ali Hajizadeh, head of the Guard’s aerospace force, was killed in a strike in June 2025. Pakpour, who had succeeded Hajizadeh’s predecessor Hossein Salami, was killed at the outset of the U.S.-Israeli campaign in February. His successor, Ahmad Vahidi, a Quds Force founder and former interior minister with an Interpol red notice tied to the 1994 AMIA bombing in Buenos Aires, was formally installed as commander-in-chief on March 1.

Unverified reports of Vahidi’s own death circulated in Tehran in late May and again in early June; Iranian, Israeli or American officials have confirmed none, and Vahidi continues to be listed as the IRGC’s active chief.

A Crackdown That Fits the Moment

The uncertainty at the top has coincided with a sharp rise in executions and threatened executions, months after the January protests that shook the regime.

Austin Sarat, a professor of jurisprudence and political science, says the war and the unrest have compounded each other rather than one driving the other alone.

“The protests and the war have fueled — it’s like putting a little bit of an accelerant into something that’s already pretty flammable,” Sarat tells The Cipher Brief. “The protests were, I think, much more trigger than the war itself. The war has just provided yet another excuse, because it’s jacked up nationalist fervor.”

Sarat is skeptical that outside pressure, including past White House rhetoric threatening consequences over executions, has had much bearing on Tehran’s calculus.

“The administration has said nothing about human rights abuses, let alone execution practices around the world,” he says, underscoring that any outside leverage is more likely to come from Europe than Washington. He views the surge itself as a familiar survival tactic for a leadership still finding its footing.

“It’s not a kind of unfamiliar tactic for a regime new to power to want to flex its muscle and terrorize the population,” he observes. “This is a survival moment, and they are going to do what they are going to do to preserve the essential character of their regime.”

The Guard Consolidates Around the Vacuum

With the younger Khamenei largely unseen, the Revolutionary Guard didn’t sit on its hands. It moved fast, filling top posts through official decrees.

Along with Vahidi, the Supreme Leader’s office named Mostafa Izadi as deputy IRGC commander, Ali Azmaei to head the IRGC Navy and Hossein Taeb to lead the Basij paramilitary force, filling six senior military posts vacated by wartime deaths.

Mohsen Rezaee, who commanded the IRGC from 1981 to 1997, was separately appointed as the Supreme Leader’s representative on the Supreme National Security Council. This post opened up, according to Rose Kelanic, director of the Middle East Program at Defense Priorities, after Zolghadr was pushed out.

Kelanic argues the reshuffle amounts to more than a personnel change.

“Mojtaba Khamenei’s role appears to be that of a figurehead and potential scapegoat, enjoying far less authority than his father, whom he replaced,” Kelanic tells The Cipher Brief. “The real power rests with Ghalibaf, Vahidi and Rezaee, who are all career IRGC officers, which functionally means that Iranian government authority has shifted even further from civilian control to military control.”

That shift, she continues, carries its own risk for any settlement with Washington.

“When military leaders assume control as heads of state in wartime, they tend to make worst-case assumptions about adversaries’ intentions, view compromise as weakness, and favor offensive military strategies over defensive ones,” Kelanic points out.

Roule, meanwhile, frames the Guard’s rise in institutional rather than personal terms, and says the war has widened rather than preserved its reach. Estimates of how much of Iran’s economy the IRGC touches “vary widely — roughly from a fifth to a third,” he says, depending on whether one counts only directly controlled firms or also affiliated holding companies, pension funds and sanctions-evasion networks.

“A better way to think about the IRGC is not simply as a military organization with commercial interests, but as a central actor in a state-security-economic network,” Roule notes.

Ghalibaf’s Quiet Climb to the Center

The other figure benefiting from the uncertainty at the top is Ghalibaf, the parliament speaker and former IRGC commander who has spent the war years turning what is traditionally a legislative post into something closer to a shadow foreign ministry.

Ghalibaf, a two-time presidential also-ran who trailed Pezeshkian in the first round of the 2024 election, has emerged as Tehran’s principal interlocutor in the indirect talks with Washington, serving simultaneously as Iran’s special envoy to China and as a bridge between the political and military-security establishments that Pezeshkian, a physician by training with no roots in the security services, has struggled to command.

Parliament re-elected Ghalibaf to a seventh consecutive term as speaker in late May, with 235 of 271 votes cast, as reports circulated of friction between Pezeshkian and the new Supreme Leader’s office. Judiciary chief Mohseni-Ejei congratulated Ghalibaf on the vote by calling him a “tireless and battle-hardened jihadist leader” who had waged jihad “both in the field and in diplomacy” during the war.

Roule warns against reading Ghalibaf’s prominence as a formal power grab.

“His current prominence should not be confused with general supremacy over Pezeshkian,” he says. “Pezeshkian nonetheless remains president, heads the executive branch, and formally chairs the Supreme National Security Council. There is no evidence that Ghalibaf has assumed any of the presidency’s general constitutional authorities.”

His influence, Roule highlights, “is best understood as issue-specific power produced by circumstances, his political standing, longstanding IRGC relationships, and wartime delegation.”

Who Actually Holds the Reins

What emerges from the past five months of conflict, however, is a regime governed less by the clerical hierarchy that has defined the Islamic Republic since 1979 than by an overlapping wartime trio.

A Supreme Leader whose authority is formally absolute but whose physical capacity to exercise it remains unverified. An IRGC command structure rebuilt twice over through assassination and now operating with wide latitude, alongside a parliament speaker who has converted legislative standing into genuine diplomatic weight.

Still, Roule sees continuity as the most likely outcome even if Mojtaba’s health worsens further.

“If Mojtaba Khamenei becomes seriously incapacitated or dies, the most likely outcome absent a successful mass uprising or a major elite fracture is continuity rather than reversal on the issues of greatest concern to the United States,” he says. “The IRGC would remain a central power center, and the system has constitutional procedures for interim leadership and selection of a successor.”

He also points out that if Mojtaba’s death were tied to the war, “the state would almost certainly use a martyrdom narrative to reinforce regime legitimacy and resistance.”

Kelanic is less sanguine about what that continuity means for diplomacy. Iran, she stresses, will also grow harder to negotiate with simply because power is now split among rivals rather than concentrated in one office, leaving Washington without a clear address for any deal.

“The IRGC’s strengthened rule over a weaker civilian leadership makes reaching a peace deal harder,” Kelanic adds, “which is one of many ways the Iran War has backfired.”

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The Dollar's Next Battlefield Isn't a Country. It's Code.

Money is moving onto new rails, built in code instead of wires and vaults, and that shift is quietly reshaping a tool that America has relied on for a generation: the ability to see a transaction, trace it, and freeze or seize it the moment sanctions or law enforcement demand it. Whoever builds and supervises those digital rails inherits that power. Whoever doesn't, loses it. That is the real stake in the debate over blockchain-based payment technology. Not the technology itself, but who ends up controlling it.

China and Russia understand this. Beijing is swiftly shifting to its digital yuan, e-CNY, and is settling commodity trades with BRICS partners in yuan. Moscow is pushing ruble settlement with its own trading partners via its regulated ruble-based stablecoin network A7A5. Both are explicit, funding bets on moving international trade beyond the reach of U.S. sanctions and U.S. oversight. Neither has cracked the dollar's dominance yet, which still captures 88% of foreign exchange transactions. But if either succeeds in becoming the default rail for the next generation of cross-border payments, America doesn't just lose market share—it loses its reach into the global financial system with sanctions and anti-money laundering and countering the financing of terrorism, effectively handing the keys to the global financial system to our geopolitical foes.

I've spent my career on the U.S. side of this problem, first as an attorney at the Department of Homeland Security and later at the Treasury Department working anti-money-laundering and sanctions cases, and today as the Bank Secrecy Act Officer at Anchorage Digital Bank, N.A., the first federally chartered digital asset bank in the United States. The lesson is simple: The global economy craves an international currency, and the U.S. dollar has held that position since Bretton-Woods. American power depends on the U.S. dollar's continued dominance worldwide, and that dominance depends on deep, liquid capital markets, strong institutions and rule of law, and military and geopolitical power—resulting in America's ability to see, trace, and freeze global assets when it needs to. And that leverage only exists when dollars move through systems that the U.S. can actually supervise.

There's a common misconception that digital assets are harder to trace than traditional finance. It's actually the opposite. Cash leaves no trail at all. A bank wire leaves a record, but that trail typically goes cold after a few transactions. A public blockchain transaction, however, leaves a permanent record of every movement, from the moment a token is issued to the moment it's redeemed. Bringing this activity onshore, under U.S. supervision, extends that visibility. Pushing it offshore limits it.

Stablecoins, digital tokens pegged one-to-one to the U.S. dollar, are already a multi-hundred billion dollar market, and industry data put the US dollar-pegged share at roughly 90 percent globally. When a stablecoin is issued by Anchorage Digital Bank, it operates under the same rules as any U.S. national bank—full reserve backing, segregation of customer funds, and Bank Secrecy Act, anti-money laundering, and sanctions compliance obligations. That supervision is also what gives the government its edge. Every transaction is a record the United States can see, trace, and, when law enforcement requires it, freeze or seize in real time. When that same activity happens offshore, outside any regulator's perimeter and visibility, the U.S. loses that line of sight entirely.

The stakes are not only strategic. They're also human. Consider what dollar stablecoins already mean, for example, in Venezuela, Argentina, and Turkey, where ordinary people hold and transact in US dollars, as much as possible, because their own currencies and banking systems have failed them or been weaponized against them. A family in Caracas holding a US dollar stablecoin is protected from a currency collapse in a way a bolivar denominated bank account is not. That is happening now, delivered by infrastructure that an authoritarian regime cannot freeze the way it can freeze a domestic account, with or without U.S. participation in building the digital rails underneath it, which is exactly why the United States has an interest in making sure that infrastructure is built responsibly, transparently, and under a regulatory framework that keeps it trustworthy at scale, rather than leaving it to whichever jurisdiction is willing to host it with the least oversight.

That means finishing the job Congress started. Treasury, the OCC, and FinCEN should implement GENIUS Act rules that keep issuance onshore, supervised, and interoperable with existing sanctions and AML programs, not slowed by duplicative reporting or ambiguity that pushes issuers back offshore. And Congress should pass the CLARITY Act to extend that same regulatory perimeter to the rest of the digital asset market, including exchanges, broker-dealers, and platforms that still operate today with little or no federal oversight. Every rule that keeps this activity under U.S. supervision is a rule that keeps the dollar, and America's ability to enforce sanctions, at the center of the global financial system.

When the United States built and opened the Global Positioning System, it didn't just launch satellites; it established a silent, invisible utility that now powers the modern world. Because America laid the groundwork and set the standards, we secured a generation of technological and strategic leadership. The next version of that global utility is being built now, in code, including the rails, the standards, and the supervision beneath them. Dollar stablecoins are already flowing into economies around the world, with or without a decision from Washington. The only open question is whether that infrastructure is American-built and American-supervised, or whether the United States cedes the ground to adversaries already working to bypass the dollar. GPS was a choice. So is whether we write the rules for the next generation of global payments, or let our adversaries write America out of it.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

It is in the U.S. interest to Support Democratic Legitimacy in Venezuela

The Trump administration’s response to the catastrophic earthquakes that hit Venezuela seven weeks ago was impressive: timely, massive and appropriate. This should reassure those who worried that the administration’s efforts to downsize and reorganize the U.S. government early in this second term in office had all but eviscerated our capacity to respond to foreign natural disasters. It was also not surprising. The Trump administration made Venezuela an early priority and has undertaken its economic and political rehabilitation since removing dictator and de facto president Nicolas Maduro and his wife Celia. It has been clear since January that the post-Maduro effort would be complicated, time-consuming and closely watched by the world community and, especially, by the rest of Latin America.

Following the successful military operation to remove the Venezuelan dictator, the Trump administration articulated a three-phase plan for rebuilding a country devastated by decades of economic incompetence, corruption and, especially since 2013, increasing authoritarianism. Unfortunately, the two earthquakes that rocked the country on June 24 set back the Trump administration’s near and mid-term plans. The twin disasters also cast into sharp relief the extent of the long-term damage done to the country’s economy, institutions and infrastructure by the regime led by, first, Hugo Chavez, then Maduro and now Delcy Rodriguez.

Somewhat surprisingly, the Trump team opted to leave in place Maduro’s long -time collaborator and vice president, Delcy Rodriguez, as interim president even as it undertook the daunting task of trying to reverse the damage from 30 years of Chavista/Madurista malfeasance. This was a risky decision. Among other things, it marginalized the overwhelming winner of Venezuela’s 2024 election whom the U.S. had recognized in late November of that year as ‘president-elect.”

Not surprisingly, the Venezuelan public was mortified by the regime’s ineffectual initial response to the catastrophic damage caused by the two earthquakes and disgusted by the dismal state of the country’s infrastructure. Venezuelans, on the other hand, were grateful for the international assistance that was surged into the country after the quakes, especially from the U.S. At the same time the scope and effectiveness of international support stood in sharp contrast to what the public saw as the fecklessness of the interim government’s efforts. Worse yet, the inevitable willingness of foreign first responders to work with the de facto Venezuelan government generated concern that Delcy Rodriguez, Interior Minister Diosdado and others were being legitimized by their cooperation with international relief contingents especially those from the U.S. Despite the regime’s best efforts to placate the public, frustration with the regime and Rodriguez erupted into public view as relief efforts were ongoing.

The sharp domestic criticism of the regime’s leadership even as it responded to the earthquakes suggests the difficulty of the United States’ challenge in Venezuela. Specifically, it suggests that the Achilles heel of the administration’s plan to rebuild the country may have been its decision to leave the Maduro regime in place while announcing that restoring democracy would be postponed to some point in the future.

It would be a serious miscalculation to assume Delcy Rodriguez, Diosdado Cabello and the rest of the surviving Maduro cabal share the U.S. commitment to a democratic future for the country. It is true that the regime has taken some steps to ease domestic tensions and encourage economic recovery as U.S. authorities have acknowledged. Oil is flowing, the refugee crisis has abated and some political prisoners have been released. That said, much of the Venezuelan public believes Rodriguez has orchestrated these changes only because she has no choice and that the U.S. is really calling the shots. This is important for at least two reasons.

First, if the U.S. appears too comfortable with Rodriguez and the Venezuelan regime does not believe the U.S. fully supports an early return to democracy, it may opt to slow roll any reproachment with the opposition and hope that President Trump’s attention will be absorbed by other crises or they may opt to try try to wait out the Trump administration. Second, under those circumstances, the simmering resentment toward the repressive and criminal regime the administration left in place after apprehending Maduro could quickly morph into something much stronger, undermine confidence in the U.S., and discourage both investors and other partner nations in the region.

Publicly accelerating the U.S. strategy for reviving the country’s political institutions would be the first step to a solution to this problem. The administration already understands this and has endorsed initial talks between the regime and representatives of the democratic majority. However, representatives of the unified opposition which won an overwhelming victory in the elections two years ago were not at the table. To the Venezuelan public this may look like the regime is continuing to do everything it can to divide the democratic opposition and marginalize the winners of the July 2024 election, Edmundo Gonzalez Urrutia, and the wildly popular opposition leader and Nobel prize winner, Maria Corina Machado.

A recently released poll by AtlasIntel in association with Bloomberg shows that if elections were held now Machado would win by a substantial margin. In also shows that approval of Delcy Rodriguez hovers around 22 percent while Machado’s approval level was comfortably above 70 percent. If the U.S. administration wants to renew confidence in its commitment to restoring Venezuelan democracy, Trump should insist on Machado’s proximate return to the country and guarantee her security. Machado’s presence would be an unmistakable signal of the United States’ determination to foster democratic legitimacy. Doing so would also do much to advance President Trump’s goal of reestablishing U.S. leadership in the region as well as underscoring the U.S. ambition once again to be seen as the economic partner of choice for Latin America.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

It’s Time For The President To Level With The American People on Iran

The U.S. administration’s strategic expectations are increasingly colliding with a set of hard realities. While Iran has taken a considerable beating, it remains standing and does not appear on the verge of either submitting or collapsing. Its newfound control over a key commercial waterway, the Strait of Hormuz, provides it with a weapon of mass disruption (credit to the NYT’s Tom Friedman) that it previously did not enjoy, and it appears intent on exercising that authority. Despite the administration’s continued threats and claims of imminent victory, there is no clear military solution in sight. Bottom line: the administration miscalculated.

Another strategy is called for. The truth.

“The practice of espionage is a quiet act of war: A very human endeavor, sometimes born of lies and betrayal, of greed or revenge; but often of deep truths and trust.”

This is the banner of my Substack, drawn from the preface of my upcoming Iran espionage novel; “A Prince of Mirrors.” It attempts to encapsulate my feelings about my chosen profession: Intelligence Officer. But for now, let’s focus on the last phrase: “but often of deep truths and trust.”

Trust is in very short supply between the United States and Iran as they attempt to come to terms. First, to re-open the critical Strait of Hormuz – a shipping route that was open prior to the War – and, second, to end an increasingly fruitless War. All while failing, at least for now, to fully address the other key issues at play: Iran’s nuclear program, Iran’s ballistic missile program, and Iranian-supported proxies.

While the world looks breathlessly on, the U.S. awaits the results of negotiations between Iran and tiny, wonderful Oman (admission; I spent several years at the U.S. Embassy in Oman) – a country literally stuck between the rocky Musandam coast, and a hard place called Iran – over the future administration of the Strait.

Based on initial reports of the terms, either Iran is going to have to step back from its assertions of control, or the United States is going to have to agree to some level of Iranian control that was not present prior to the War. Given the utter lack of trust between the parties, is either likely?

So, let me lay out, as best I can, what I believe to be true.

This is a time for truth. Hard truths.

The Middle East has changed.

The Iranian regime has survived a series of devastating U.S. and Israeli strikes. Iranian military capacity, both the regular Artesh (Iran’s conventional army) and the IRGC (Iran’s Islamic Revolutionary Guard Corps), is significantly weakened; however, it retains the ability to strike targets outside Iran, including shipping transiting the Strait of Hormuz.
The Iranian regime has not fallen and appears to be consolidating power around… well, no one yet knows which individuals or factions will emerge triumphant in Tehran. But for now, an even more hardline, IRGC dominated leadership is in place.
The regime is attempting to assert its newfound control over the critical Strait of Hormuz, a right tacitly acknowledged, or at least not specifically prohibited, in the flawed June MOU (Memorandum of Understanding) signed by the President of the United States.
Barring something new, something we have yet to see, U.S. and/or Israeli military force is unlikely to significantly alter this equation.
Iran and the United States, and the world economy, remain trapped in a test of wills over who blinks first.

The truth is, the regime is bad in so many ways. And they are dangerous. But not existentially so to the United States. Disliking Iran is not a sufficient reason to go to war with them barring a truly compelling reason.

But neither can an IRGC dominated Iran be allowed to run roughshod over the region. The U.S. and its Western and Gulf allies need to develop a new deterrence strategy that includes both carrots and sticks.

The Impacts of failure

Any agreement needs to mitigate, to the extent possible, the damage that Iran can do going forward. First and foremost, the world economy cannot allow one country to exert control over such an important international shipping route as the Strait. Any agreement must minimize Iranian control over ships transiting the Strait, possibly by compensating in other areas. The most critical issue, Iran’s nuclear program, must be addressed in a manner that includes both dealing with the 60% enriched uranium (HEU) currently in their possession and strict verification of enrichment activities going forward.

The American people can handle the truth!

That for now, the only way out is a negotiated agreement that is certain to fall short of the ideal. Only for now. Simply a truce. This is not an admission of defeat, simply a pause to rethink, to recalibrate.

But also…

That the Islamic regime has significant internal weaknesses. That stepping away from the current tit-for-tat military action, a strategy that is not achieving its objectives, will force the regime to confront the serious problems, some existential, that the Iranian nation faces. This is Iran’s, and the regime’s, Achilles heel. One that could eventually force change that no outside military force could.

Just the truth.

This article was originally published on Substack and is republished here with permission.

Read more national security insights from experienced experts exclusively in The Cipher Brief.

The Biggest AI Models Are Not the Biggest Threats

Almost every AI security framework we are applying rests on one misguided assumption: danger scales with size. Compute thresholds, export controls, and tiered evaluation regimes all encode the same intuition, the larger the model, the more we should worry. If this isn’t true, what policy changes are needed?

I recently mapped more than twenty fielded AI systems against two axes: raw offensive capability with safeguards stripped, and residual risk as actually deployed (Fig. 1). They ran from millions to trillions of parameter models, and included munition seekers, gene design models, theatre planning, cyber offense systems, and general-purpose AI models. The picture does not support the above assumption. In fact, the data supports the inverse. Small, specialized models beat bigger general models at offense, but bigger models maybe better at defense.

Figure 1. Security Risk vs Size of Model. Hollow ring: raw offensive capability with safeguards stripped. Filled dot: residual risk as actually deployed. Cyber related positions anchored to CAISI / UK AISI results, July 2026. Data compiled by Alvin W. Graylin.

Each system appears twice: a hollow ring for raw capability with safeguards stripped, a filled dot for residual risk as deployed. The gap between them is the safeguard effect. Read left to right, and the size to threat correlation everyone assumes is simply absent.

Seven assumptions worth rethinking

One: the largest models pose the greatest risk. The high-residual band, where capability and deployed risk are nearly identical. Across six orders of magnitude, no clear trend. In 2022, researchers at Collaborations Pharmaceuticals inverted the scoring function on a commercial drug-discovery model (MegaSyn) of under 100 million parameters and generated more than 40,000 candidate chemical warfare agents (many more lethal than VX) in just six hours on a desktop. Chemprop-class retrosynthesis models, which can find non-controlled precursor routes around scheduled pathways, run at one to ten million parameters. Evo models with single digit billions of parameters can help design novel life forms. News just came out last week that this exact system was able to generate 16 new viruses. All these systems sit well below the axis floor of any parameter-based regime. Compute restrictions do nothing to fix this.

Two: compute thresholds capture the relevant risk. Hackphyr, built on Zephyr-7b-β at 7 billion parameters, performs comparably to GPT-4 on network attack scenarios and runs on a single GPU. Deep Hat V2 ships commercially at 30 billion parameters, is marketed as uncensored for offensive security, and executes inside the customer environment with no external calls. No government evaluation covers it, so that placement rests on vendor claims. Neither would trip a FLOP ceiling.

Three: capability and threat are the same axis. Claude Fable 5 and Claude Mythos 5 share one underlying model. Their capability positions are nearly identical; their deployed risk differs sharply, because Fable's added domain safeguards drop cyber requests back toward Opus 4.8 behavior. The difference comes entirely from the safeguards and distribution controls layered on top. That vertical gap is what governance can act on. Parameter count is not.

Four: open-source models are more dangerous than closed ones. Recent NIST study found that Kimi K3, the strongest PRC open-weight model, only scored 32 percent on ExploitBench against 57 percent for the leading U.S. model, and reached step 17 of a 32-step attack range where U.S. models reached 28.5. On the highest-severity outcome test, arbitrary code execution (ACE), Kimi K3, succeeded on 0 of 41 tasks, while the most capable U.S. models averaged 20. So, we really need to be careful about self-interested parties saying larger open-source models are more dangerous, when it likely has more to do with protecting margins than national security concerns. (see Fig. 2)

UK AISI did recently report that the Kimi K3 model was able to escape its sandbox during testing, but it merely used a misconfiguration in the testing sandbox that left the door open, rather than a sophisticated swarm agent attack like what the OpenAI model did. And when it did get out, all it did was look up the answer for the test it was given, rather than doing any damage to real world systems. In the future, this behavior could change, but it’s important to question the basic assumption that open models are always more dangerous.

Figure 2: CAISI/NIST - Comparison of aggregate capabilities over time of the most capable U.S. and PRC models. A 400-point increase on the y-axis equates to a 10x increase in the odds of solving tasks. Shaded regions denote 95% CIs.

Five: model quality determines attack success. Microsoft's MDASH is a harness, not a model. It orchestrates more than 100 specialized agents across an ensemble and scored 88.4 percent on CyberGym at launch, against 83.1 percent for the Mythos preview model. Adding a compact security model roughly 1/10^th the size raised that to 95.95 percent. The orchestration layer beat every individual model. Regulating training while ignoring scaffolding regulates the less important variable.

Six: national security requires the largest models. It requires the opposite. Loitering munition seekers performing automatic target recognition run on Jetson-class edge hardware, capping them in the single-digit millions of parameters. Edge deployment favors small models on latency, power, thermal envelope, and operation without a datalink. Larger models are slower and, in narrow domains, more easily distracted by irrelevant context. They are also harder to validate, and validation is what matters when a false positive is a struck target. Cisco's Foundation-Sec-8B matches or exceeds models ten times its size on security benchmarks while running on one or two GPUs. The famed DoD Maven Smart System is based on a fine-tuned 2-year-old Claude Sonnet 3.5 model. That level of intelligence can now be distilled into a 4B model which could potentially run on a smartphone.

Seven: denying China compute is the primary lever to keep U.S. safe. Due to shared risks between these superpowers, on many safety related issues, cooperating may actually produce the outcomes most beneficial to the U.S. and the world. More on this below.

Five threat domains, five different answers

Attack and embedded systems favor small models that don’t require a comm link. Air-gapped operation, no API telemetry, no rate limits, no refusals mid-chain. The offensive bottleneck is stealth and throughput, not reasoning.

Cyber Orchestration favors large models, but the advantage attaches more to the system rather than the model, as MDASH shows. There’s little discussion today on regulating orchestration systems, but it’s clearly very needed.

Cyber Defense favors large models most clearly, and this is where the current approach fails. Defenders need breadth across every vector; attackers need depth in one. Safeguards that constrain security research are therefore costly in a way that is easy to miss.

When Hugging Face's systems were breached in July by OpenAI models, commercial frontier-model APIs blocked the forensic requests because their safety systems could not distinguish defensive analysis from attack. The team ran the open-weight Chinese model GLM-5.2 on its own infrastructure instead, worked through more than 17,000 logged actions, and contained the intrusion. An American company under active attack by an American closed-model was defended by a Chinese open-source model because the American ones could not tell friend from foe.

That is a Slave AI failure, in the terms I set out in Beyond Rivalry. A model trained toward obedience can only refuse; it cannot reason about whether refusing is right. What we need is Guardian AI: systems capable and contextually aware enough to protect us from malicious actors, from other AI systems, and from our own unintended consequences. That requires scale, because judgment requires breadth. It also requires that we stop locking down every capability rather than stewarding it. High-quality models with fewer restrictions, in defenders' hands, are a global public good. Every hour a defender spends fighting a guardrail is an hour the attacker fights nothing.

Bio/Chem Design favors small models. Molecular graphs, protein sequences, and binding energies come from compact architectures immune to alignment techniques built for natural language. A graph neural network has no refusal layer to remove. The key here is monitoring and controlling access to precursor chemicals and expanding safeguard for synthesis equipment.

Bio Synthesis is the outlier, and there is good news and bad. For biology, model-level access control has already failed. Evo 2 shipped with weights, inference code, training code, and its full dataset. There is no API to revoke. What remains is the synthesis chokepoint: Customer vetting and sequence screening at nucleic acid providers already operate internationally through the Gene Synthesis Consortium, whose members screen orders against databases of sequences of concern before synthesizing. There are still gaps as novel AI-generated combinations are developed, but they can be reduced if vendors and regulators globally work more closely together to keep the systems updated. Closing those gaps buys more security than any parameter threshold. But this requires Washington and Beijing to align, since they are the two largest suppliers of synthesis equipment in the world. Of course, collaboration across all vendors globally is needed to truly secure this threat vector. Again, larger general AI models aren’t the core problem.

Data beats intelligence

On the opening day of the U.S.-Iran war in February, a Tomahawk missle struck the Shajareh Tayyebeh girls' school in Minab, killing at least 168 people, more than 100 of them children under twelve. The school sat within 100 yards of an IRGC naval installation and had been inside that perimeter until a wall went up around 2013. Targeting ran through the Maven Smart System, which generates roughly 1,000 target packages an hour. A preliminary investigation concluded the strike likely followed from outdated intelligence, and former officials said stale human-curated data, not AI, was to blame.

The school had a website. Free satellite imagery showed a schoolyard with a sports field. No model of any size prevents this, because the failure was in data lineage, not reasoning. A larger model querying the same stale record returns the same coordinates faster and with more confidence.

The China mistake

The threat model that matters is not Beijing reaching AGI first. It is a non-state actor with a 30-billion-parameter uncensored model, a good harness, and no return address. Small models proliferate regardless of jurisdiction and leave no attribution trail, and an unattributable intrusion between nuclear powers is an escalation problem before it is a technology problem. In that world, a China unable to defend its own infrastructure is a liability to global stability, not an advantage to Washington.

Beijing is already regulating its own labs more aggressively than any other market. Concordia AI's 2026 survey documents agentic AI security guidance, ethics review requirements, and binding obligations on consumer AI services that are already deployed and enforced. It should be noted that Chinese frontier safety research output grew roughly 60 percent year over year, with agent safety rising from 8 percent of new papers in early 2025 to 27 percent by early 2026. The caveat: only five of ten leading Chinese developers reported safety evaluation results on release. Shared standards here would make a difference.

As Fig. 2 showed, CAISI found the Chinese models less dangerous, but they also found GLM-5.2 answers sensitive biological queries at far higher rates than tested U.S. models, which is where PRC safeguards are weakest. In personally speaking with multiple Chinese labs, it’s clear that their lack of compute resources due to export controls has forced them to deprioritize safety demands vs. capability enhancement. Expanding safety testing compute resources, like what UK AISI has, to more countries could help improve AI safety globally, without fear of its misuse by rival nations.

The race framing is softening at home, too. More than 100 organizations, including Nvidia, Microsoft, Meta, IBM, Palantir, OpenAI and Google, have now signed the July 24 Open Weights and American AI Leadership letter opposing premature restrictions. Days later, Nvidia and roughly 50 partners launched the Open Secure AI Alliance to build open defensive models and agent harnesses, citing the Hugging Face incident as its founding case. Every participant has commercial exposure to a ban, so weigh the motives. But 8 of the top 10 models on OpenRouter in July are already open-source, and the industry has now reorganized around the proposition that open weights are defensive infrastructure.

Four Asks for September

Four asks follow, and Xi Jinping's state visit to Washington on September 24, the first in over a decade, is where they could land. Trump has said AI will be on the agenda.

Shared harm standards, not shared capability standards. Agreement on what constitutes an unacceptable capability, evaluated the same way in both countries, so that "safe" means the same thing in Shanghai and San Francisco. That’s clearly missing today and doesn’t require mutual trust.

A shared safety evaluation cluster. Chinese labs are compute-constrained, so safety research competes with capability research for scarce chips. Compute earmarked for evaluation and red-teaming is cheap relative to the benefit, and the benefit is global. An international testing facility open to any vendor institutionalizes it. Require publishing safety scores alongside capability benchmarks so safety investment earns a competitive return. Then, both Chinese and US labs would have no excuse not to test their systems.

An incident notification channel. The Nuclear Risk Reduction Centers, staffed continuously since 1987, exist because a misread signal costs more than talking. An equivalent for AI incidents where attribution is contested is cheap insurance. With the rising risk of bad actor attacks and false flag operations from non-state actors, this safeguard will be increasingly needed.

Capability non-development agreements. A capability never trained cannot leak. This matters more than denying Beijing another turn of the scaling crank. Beijing also wants to limit rogue actor misuse, thus agreeing on redlines in advance makes sense for both sides (no nuclear weapon command/control, no AI uplift to bio weapon design, no AI-attack on civilian infrastructure, no autonomous self-replication outside control environments [RSI]). General commercial models have no need for bio and chemical threat design, so keeping defense use case training only in military labs on both sides seems quite reasonable.

Another Asilomar moment

At Asilomar in 1975, molecular biologists imposed a voluntary moratorium on a class of recombinant DNA experiments, then built the containment framework that governed the field for decades. They acted before the capability matured enough to do real harm.

That view is starting to catch on in the AI labs now. On July 28, 1,200+ employees of frontier labs published Pacing the Frontier, asking Washington to support an international effort to build tools for deliberately slowing automated AI development. Signatories include top technical leaders at Anthropic, OpenAI, Meta and Google. The concern is recursive self-improvement (RSI) of AI that goes out of control. The logical extension is an explicit agreement not to implement it in frontier labs even once it becomes possible.

But this cannot stop at two capitals. If dangerous systems are small and cheap, a country with a modest research budget and a few hundred GPUs can build a competent offensive cyber agent or an inverted molecular designer. Within a few years, dozens will. Any regime binding only Washington and Beijing binds the two parties least likely to defect and leaves the growing middle untouched. A U.S.-China agreement is the necessary first move, not the finished structure, and it has to open immediately to third parties. That is how Asilomar's containment norms and the Montreal Protocol scaled.

Bigger AI is not more dangerous. Better orchestrated is more dangerous, less monitored is more dangerous, and irreversibly released is more dangerous. All three require cooperation with Beijing: orchestration needs shared harm standards, monitoring needs shared evaluation infrastructure, and irreversible release needs joint agreement on what never gets built. September 24 is a good place to start.

Read more national security insights from experienced experts exclusively in The Cipher Brief.

How About Equipping Local Law Enforcement with a Better Anti-Drone Arsenal?

During the week of March 9, drones came over Barksdale Air Force Base in waves. Barksdale is the home of the 2nd Bomb Wing, one of the places this country keeps its nuclear-capable bombers. The base issued a shelter-in-place order and stopped flight-line operations, and the Air Force has declined to say precisely how many aircraft were up there or who was flying them. NORTHCOM's counter-drone fly-away kit, the good one, the one that worked over a strategic installation in the opening hours of Operation Epic Fury on February 28, was somewhere else. There is only one of them.

Then General Gregory Guillot told Congress the number that should have ended the conversation about whether we have this handled. "About a quarter of the ones that we detect, we're able to defeat." He offered it as good news, and by the standard of the previous year he was right: in 2025, he said, "almost every one that was detected was not defeated."

Welcome to The Iron Triangle, a dedicated column serving the procurement officers who are asked with buying the future, Investors funding the next generation of defense technology, and the policy wonks analyzing impact on the global order.

Hold that in your head. The federal government with every authority Congress can write, the entire electromagnetic spectrum at its disposal, and a defense budget larger than the next nine countries combined, stops one drone in four over its own bomber bases.

Now we are handing the same problem to a sheriff's department in Talladega, and we have written them a rule that is worse.

A Rule That Anticipates Everything Except the Answer

On July 6, the Departments of Justice and Homeland Security published the interim final rule implementing the SAFER SKIES Act, effective July 1, and for the first time extended real counter-drone authority to state, local, tribal, and territorial law enforcement, and, critically, to correctional agencies. This is overdue, it was built fast, and the people who wrote it deserve credit for standing up a certification and oversight architecture on a compressed timeline.

Then you get to the Authorized Technologies List, which is the part that decides what a certified agency may actually field. The Departments expect the initial list to contain three categories: radio-frequency detection with command-and-control signal interception, RF disruption (broadband and protocol-specific jamming), and RF protocol manipulation, meaning command injection and cyber takeover. All three are radio-frequency categories. There is no fourth.

This would be an unremarkable sequencing decision except that the rest of the rule plainly contemplates bringing an aircraft down by physical means. The statute authorizes certified agencies to use reasonable force to "disable, damage, or destroy" an unmanned aircraft. The rule requires air-traffic notification for mitigation that emits no radio frequency, and the preamble explains why in language that leaves nothing to interpretation: such an action can affect the airspace "for example by bringing an unmanned aircraft down or creating falling debris." The rule requires Mitigation Certification for personnel who physically intercept a drone in flight.

So the rule trains an agency to do it. Certifies the officer to do it. Writes the falling-debris notification procedure for when they do it. And then hands them a list with nothing on it they can do it with. Plainly spoken, the rule does not include kinetic interceptors, something that knocks a drone out of the sky.

That is what happens when a list gets populated by whatever already had the deepest federal deployment history, which is exactly what the Departments said they were doing. The RF categories had the paperwork. So the RF categories got the boxes. The list has nothing to do with what works. It is a fossil record of what has already been bought.

Three Categories, One Point of Failure

Here is why this is a safety problem and not a paperwork problem. The three listed categories are functionally distinct and they share a single dependency: every one of them requires the target aircraft to present an exploitable radio link. Where there is no link, interception has nothing to intercept, jamming has nothing to jam, and cyber takeover has no protocol to take over. They do not degrade independently. They fail together, at the same instant, against the same threats.

Three classes of aircraft now routinely present no such link. A drone flying a stored waypoint route with its control link severed emits nothing and listens to nothing; this is a checkbox on consumer airframes. A protocol-hardened or custom-built airframe falls outside the signature libraries that detection-and-takeover systems depend on. And then there is fiber optic, which is the one that should be keeping planners awake. They manage control and video via physical filament. There is no radio link at all. Fiber optic drones are immune to jamming as a matter of physics rather than engineering. Russia is turning out more than fifty thousand fiber-optic FPV drones a month at a single facility in Veliky Novgorod. The technique defeated RF countermeasures at Kharkiv. It defeated them over Victory Base Complex in Baghdad, where there was no visible intercept attempt at all.

None of this is exotic. It is three years old, it is cheap, and it is documented in open sources that any competent adversary reads on the same afternoon you do.

An agency limited to the three RF categories is superbly equipped against a careless hobbyist with a stock quadcopter and defenseless against anyone who has been paying attention. That is precisely the inverse of the risk profile the rule exists to address.

The Recent Events Are Not Ambiguous

On June 24, just twelve days before the rule was published, the Justice Department indicted twelve defendants in what it called the largest federal prosecution to date involving coordinated drone operations to smuggle contraband into prisons. Ten federal facilities across eight states. Thirty-eight documented drops using six aircraft, running from September 2023 through May 2026. Methamphetamine, K-2, Suboxone, cell phones, tobacco, and saw blades.

Two and a half years of flights. Thirty-eight of them are documented. That is not a hobbyist wandering into restricted airspace. That is a logistics operation with route planning, aircraft attrition, and a customer base. Organizations at that level of sophistication adapt to countermeasures. The adaptation most cheaply available to them is the one the initial Technologies List cannot answer.

Compare the coverage. Five days later a JetBlue crew reported striking a drone on approach to JFK, and it led the news for a week before a preliminary investigation found no physical evidence that it happened at all. The collision that may have been nothing got the cameras. The thirty-eight drops that certainly happened got a press release from the Middle District of Georgia.

The Part That Should Embarrass Us

Now for the contrast that makes this a column instead of a comment.

On January 28, Brigadier General Matt Ross, who directs Joint Inter-Agency Task Force 401, told reporters: "I see us using low-collateral kinetic interceptors at all installations in the homeland." The Deputy Secretary of Defense had directed JIATF-401 to ensure kinetic capability at every location. Two days later the task force awarded $5.2 million for the Bumblebee V2, a kinetic interceptor, with deliveries beginning in March. Asked about squeamishness over kinetic engagement inside the United States, Ross said he "fundamentally disagrees."

Same airspace. Same threat. Same country, in the same calendar year. The Department of War calls low-collateral kinetic interception essential and is buying it for every installation in the homeland. The Departments of Justice and Homeland Security published a list on which that category does not exist.

What Each Corner of the Triangle Should Take From This

For the Procurement Officer, understand what you are budgeting against. You can be accredited, certified, trained, and funded, and still have nothing to buy, because the box your requirement lives in has not been created. The rule as published does not tell you plainly that kinetic capability is unavailable to you. State and local agencies are writing fiscal-year plans and grant subaward requests against it right now, and some of them are going to buy capability they are not authorized to employ.

For the Investor, this is the diligence question you are not asking. You have been asking whether the technology works and whether there is a customer. Start asking a third question: what category does this go in, and does that category exist yet? A company can be technically excellent, combat-proven, and commercially validated, and still be unsellable because a list has no line for it. Listing risk is not a footnote in the regulatory section of the deck. In this sector it is the whole thesis, and it is currently unpriced.

For the Policy Wonk, notice what just happened to the locus of policy. Congress debated the SAFER SKIES Act in public. The interim final rule went through interagency review and took comment. But the Authorized Technologies List, the instrument that actually determines what a certified American police department may deploy against a drone over a school, is an administrative artifact updated through a coordination portal. No one voted on it. Most people affected by it do not know it exists.

I have spent years watching good capability lose to bad process, and I thought I had seen the full catalogue. I had not. The Valley of Death I have been writing about is a money problem: you have the technology, you cannot get the contract. This is something else. This is a company that has the technology, the customer, the certification, the training pipeline, and the federal deployment history, and cannot sell, because the taxonomy has no word for what it built. Call them the Unlisted. They are the Forgotten Bench's stranger cousin, and they lose more quietly, because there is no rejection letter. There is just a list that does not mention them.

The fix is small and it is already scheduled. The Departments said they would run a sixty-day sprint to revise the list after publication. Add a fourth category, low-collateral kinetic interception, defined narrowly enough to exclude firearms, unguided ballistic means, directed energy, and anything heavy enough to be its own hazard. Write objective listing criteria the way the RF categories already have them: bounded interceptor mass, bounded terminal energy, demonstrated fail-safe behavior on loss of lock, a modeled and test-validated debris footprint, a declared engagement envelope. Then say plainly, in one sentence, that until such a category exists, kinetic mitigation is unavailable so that nobody spends a grant on a capability they cannot lawfully employ.

The Risk

I am not going to pretend this one is free, because it is not, and the people who will be nervous about it are right to be. Radio-frequency mitigation that fails harmlessly drops a link. Kinetic mitigation that fails drops an object, and it drops it over a stadium concourse, a prison yard at count time, an interstate at rush hour. The rule's own falling-debris notification requirement exists because somebody thought that through, and a two-kilogram interceptor over a crowd is not a spreadsheet exercise. Widening this list carelessly buys us a very bad Tuesday.

There is a second risk, and I have written this column before from the other direction. A category written narrowly enough becomes a moat for whoever helped write it, which is how well-intended technical criteria turn into incumbency by another name. That is the ITAR story wearing a domestic uniform, and anyone advocating for a new category, including me, should be watched for it.

And a third: certification is not proficiency. A deputy with forty hours of classroom time and a kinetic interceptor is a genuinely different risk than an operator who has done it a thousand times. Recurrency has to be tied to the effector an agency actually fields, not to one undifferentiated certificate, because competence with a jammer transfers to a kinetic interceptor exactly not at all.

None of that argues for keeping the category empty. It argues for writing it carefully, on a clock, with real criteria, which is a harder job than leaving the box blank, and the reason the box is blank.

We have built a system in which the most consequential procurement decision in American counter-drone policy is not made by a program office, a contracting officer, or a member of Congress. It is made by whoever maintains a list. Comments on the rule close on September 4. After that, the question stops being what we should have listed and becomes what we have to explain. The honest version of that question is this: when a drone that does not answer a radio comes over the wire at a federal prison, and the certified, trained, funded officer standing under it has nothing on the list to use, whose signature is on that?

Disclosure: Atlas Special Projects prepared a public comment on the rule discussed below on behalf of a counter-UAS manufacturer. The argument here is that of the author, and it applies to a category of technology rather than to any one company's product.

Read more national security insights from experienced experts exclusively in The Cipher Brief.

How Ukraine Is Changing the Way the U.S. Army Fights

“To me, the biggest way that we're doing this is introducing technology into the [U.S. Army] formations that is not fully baked. And so all of us who were in the Army in the 90s, the 2000s, even the 2010s, you were issued a piece of equipment and that was it -- maybe a TM (technical manual) and you didn't have any say in how it was made or how it should be altered. And today in a number of different [Army] organizations, we're putting the tech in an immature state in front of the soldiers -- and industry is with them -- to be able to iterate and make things so much better, so much faster. So that to me is compelling to them and they can give very real feedback and everybody that's dealt with soldiers knows they're not going to pull any punches, right?”

That was Under Secretary of the Army Michael Obadal speaking July 30, on The Future of U.S. Land Powerat the Center for Strategic and International Studies (CSIS) along with former-Army Secretary Ryan McCarthy, who held that job during the first Trump administration.

Together, the two provided insightful looks at how the Army is dealing with the introduction of new technology.

Obadal, for example, described a personal experience from a day or two earlier when he got into an autonomous vehicle with a staff sergeant. “We're getting ready and he's showing me all this stuff, and I said, ‘This is incredible. What do you think?’ And he said, "Yeah, I don't like it.’ And I said, ‘Okay.’"

Obadal then recalled he and the sergeant had a 15minute conversation and he learned when the sergeant told him “I think this is really cool tech, but it's the integration of that tech” that bothered him. For Obadal that was something “that you don't get in a lab, you get it only by putting those things in the hands of soldiers.”

“We're introducing them [new Army enlistees] at the very onset of their Army career to technologies being pushed down in[to military] units.” Obadal said, adding, “There is additional skill-type, identifier-training that they can go to. We have a software factory in Austin, Texas [Army Software Factory of the U.S. Army Transformation and Training Command] that's incredibly capable. It's a two-year program where they really are able to code and create new applications, all really software based.”

McCarthy recalled, “If you go back to 2017, there was nowhere near the emphasis on pushing autonomous systems into the formations. A lot of that's cultural. If you go even back to like 2008 and the Air Force's resistance to taking on more Predator [an unmanned reconnaissance aircraft] caps in the Middle East, my former boss, [Defense] Secretary [Robert] Gates, making it a priority with the department. So, culture is a big part of it. The good thing is it's 10 years later, we have younger people, much more technologically savvy than I ever was.”

As with most people, Obadal starts his discussion of change with Ukraine, which he described as an “incredible battle lab,” about which he said, “not just the Army, the entire [Defense] Department has gone to great lengths to understand what are the lessons that are coming out of there, because no one is iterating technology faster than the Ukrainians.”

He then described the initial Russian-Ukraine fighting as “positional warfare, because neither side possessed an actual maneuver, combined-arms, army.” Instead, Obadal said, “two uncoordinated armies really came together, got into positional warfare, and then we saw the innovation of the drones and a number of other things, but specific is the drones.”

Currently in the Russian-Ukraine war, Obadal said, “You have a dead zone of several kilometers between these two positions and it's very reminiscent of World War I,” where artillery was introduced, and “now the drone…is an enabler of soldiers. So how do you deny terrain with drones? How do you actually take terrain with drones?”

“We've taken all of those lessons and incorporated [them] in,” Obadal said, “so now at this point in basic training our soldiers are actually operating drones. Not something that was happening two or five years ago. But they get that familiarization as soon as they are coming into the Army in our training centers.”

At the Army National Training Center, Fort Irwin, California, Obadal said he watched U.S. operational forces conducting exercises “utilizing a number of different drones to have certain effects – electronic warfare, observation, calling-for-fire, and first-person, viewer-kinetic action. That's the ‘operationalization’ of it [drone warfare].”

But Obadal was most interesting to me when he expanded on how the Army had “spent billions on buying commercial off-the-shelf drones that are customized for military use,” and shipped them to “almost every [Army] division and even down in regiments.” There, he continued, “We have small groups of soldiers that have been pulled in by the leadership, given some budget, small budget, and given a facility and said, ‘Put together drones that we can go out on our training areas and utilize.’”

The result of this localized drone creation was, Obadal said, “They [the drones] are not exquisite. They cost very little to make. It's okay to crash them. But what it's doing is not just the technology, the other thing we're learning, [as] from the Ukraine, is you have an incredibly capable core [of Army personnel] that knows how to utilize drones in every aspect of it.”

Another purpose, Obadal explained, “It's not about flying an FPV [first-person view/controlled] drone that's part of it, it's about how do you team them together; how do you do all of the things that we're watching the Ukrainians do; so we we're baking that in into our organizations by letting them…mass-produce as many low-cost drones as they can so that they can get the repetitions…We have to go through hundreds of repetitions a day in our Army to build that repository of knowledge, turn that into doctrine, which is constantly evolving, and then spread it throughout our Army.”

Commenting on the Army drone system, McCarthy said, “They're allowing leaders at every level to be entrepreneurial in nature, to look at the capability, to learn the technology, and make recommendations to the changes in task organization. They're going to have to change the

business model of the Army. There might not be 40 people in a rifle platoon five or 10 years from now. There might be half as many. So we have the luxury where we can be a little deliberate. We may want to go faster. The world's complicated, but doing it the right way, the smart way, they're going to make better choices.”

For example, at a February 2026 exercise at Fort Stewart, Georgia, soldiers experimented with electronic warfare payloads on medium-range reconnaissance systems and tested various configurations on FPV drones to determine system limitations and capabilities, according to an

Army press release. “The ongoing innovation includes stressing equipment through rigorous training to understand what works best for operational units,” the release said.

The Army, Obadal said, is “trying to encourage small [drone making] companies, new entrants that have compelling technology. We're trying to leverage as much external capital, because there is a large amount of external capital that's invested in the defense technology industry, but we just haven't rewarded it at the right level.”

Army Assistant Secretary for Acquisitions, Logistics and Technology Brent Ingraham is changing acquisition processes that are intended to foster rapid prototyping, rapid fielding and rapid acquisition of new capabilities, Obadal said.

He continued, “What it's about is continuing to prototype and experiment at scale and then feed all of that into our Combined Arms Center (CAC).” There, he said, Lt. Gen. James P. Isenhower III, CAC Commanding General will determine “now how do we put our findings back into areas that will change force management or capability requirements.”

Summing up, Obadal said, “Today we have young men and women that I see out in the organizations with highly technical capabilities that allow them to do direction-finding, to do pinpoint locations of enemy emissions, and then utilizing other capabilities to visually confirm feeding all of that back into a data-centric C2 [communications] system. So it's that human machine teaming of giving the right capabilities to our soldiers allows them to be far more effective than they were just a couple years ago.”

Obadal added, “It's an important thing to remember right now we're not replacing soldiers with autonomous or unmanned weapons. What we're doing is we are unburdening the soldier from the mundane tasks or the most dangerous tasks so that they can take a step back and they can do the things that only humans -- whether it's soldiers, commanders -- can do.”

Read more national security insights from experienced experts exclusively in The Cipher Brief.

The Houthis’ External and Internal Crises Converge: Can a Tactical Solution Fix a Strategic Problem?

As they fire dozens of ballistic and cruise missiles against Saudi-led coalition forces in Yemeni government-controlled areas, the Houthis are escalating on two major external fronts. This comes at a time when they are already facing internal crises regarding the economy and the tribes of northern Yemen. The temptation is to attribute escalation abroad to an effort to distract from the crises at home.

From Sanaa’s perspective, the regime’s internal and external crises are deeply intertwined to the point that they cannot be separated. This is especially true in the conspiratorial worldview of the Houthis in which “you are either with us or against us” – meaning part of the Houthi project they call “the Quranic March” or part of the “American-Zionist-Saudi conspiracy.” This worldview is based in part on their interpretation of a Quranic verse which states, “And whoever among you allies with them is one of them.” That being the case, the Houthis see their problems as part of a broader conspiracy launched by the evil forces abroad and facilitated by Yemeni “mercenaries” at home.

This view is on display in al-Jawf, where the Dahm tribe recently rallied around a woman claiming to be a victim of the regime’s injustice. According to the woman claiming to be “Mira Saddam Hussein,” she is the secret daughter of Saddam Hussein of Iraq and her assets were confiscated by regime insider Fares Manea during a chaotic moment in the Yemeni civil war. Houthi media presented the tribal activities on her behalf as coordinated with the Saudi special committee, an organization charged with maintaining good relations via patronage between Riyadh and Yemen’s tribes. Whether there is truth to this claim is unclear, but like all conspiracy theories it is easy to release into the media space to muddy the waters and nearly impossible to conclusively disprove.

Regardless of the root of the current Houthi crisis with tribes in al-Jawf, it appears to have uniquely destabilizing potential for the regime given its geographical scope and the number of tribesmen standing in defiance. Having set up camp outside of Houthi territory, the Dahm tribe is leading an anti-Houthi line that seems to be garnering widespread support and has thousands of participants – including from areas under Houthi control.

The timing is what makes this dangerous for the Houthis: their economy continues to sink as the finite solution of looting government institutions and local industry approaches its limits. The lawless kleptocracy that they have created, alongside heavy sanctions, makes any economic improvement in the near term unlikely. This poor economic performance, combined with the fact that tribal loyalty is often bought, should worry the Houthis. Much of the population living under their control has tribal affiliations that might be “activated” as the group has not yet managed to completely decimate tribal structures in Yemeni society in favor of absolute loyalty to Abdulmalik al-Houthi. The resources to buy quiet have dried up precisely when the regime needs them most.

While one might expect this would make it an inopportune moment to escalate on additional fronts, in the past month the Houthis have attacked not only Saudi Arabia but, more recently, the Yemeni government. Three practical calculations, rather than mere distraction, help explain the timing.

The first is deterrence. At a moment of weakness, the Houthis want to kill any perception among the regime’s enemies that trouble at home translates into a reduced appetite for escalation, a perception that might invite attacks against the regime. This also comes after the regime showed relative restraint during the most intense weeks of the Israeli and American strikes on Iran, sitting out as the rest of the axis of resistance rallied and raising speculation that the regime was averse to the associated risks. By initiating conflict now, the regime is cultivating the impression that it is just as radical, reckless, and aggressive as ever.

The second is economic. Escalation against Saudi Arabia may be meant to resolve the group’s money problems in either an absolute or a relative sense. In an absolute sense, if the escalation leads to an agreement with Saudi Arabia that would infuse cash into their economy and provide the resources the regime needs to continue funding their war machine and buying quiet from those dissatisfied groups challenging them. In a relative sense, even if the Houthis cannot reach an agreement with Riyadh, targeting Saudi energy exports may make it more costly for Riyadh to keep financially supporting anti-Houthi forces in Yemen, including the Yemeni government. Absent that support, the group’s control of much of Yemen’s economy would give the regime a major advantage over its rivals, even if its budget remains small compared to that of a functional state.

The third is simple tactical opportunity. With the Strait of Hormuz blocked as fallout from the Iran war, the Houthis have additional leverage over Saudi Arabia’s alternative shipping routes through Bab al-Mandeb and the Red Sea. Still, risk aversion tempers that ambition: The desire to target Saudi oil exports without galvanizing a coalition against them, or upsetting the axis’s quieter backers such as China, limits the scope of actual disruption to these shipments.

From a conspiratorial, zero-sum ideology in which anything bad for the U.S. and its allies is good for the regime, the Houthis have scored points that exceed expectations. The Houthis are exceptionally good at picking targets that maximize extortion while limiting expected blowback, and jumping from one target of opportunity to the next keeps their adversaries guessing. Still, this approach of focusing on the short-term targets of opportunity and very long term eschatological vision leaves a strategic gap that will likely lead group’s structural problems to grow more severe and eventually erupt in an inevitable crisis.

Read more national security insights from experienced experts exclusively in The Cipher Brief.

America, North Korea, and the Search for Peace

The South Korean Buddhist monk, the Venerable Pomnyun Sunimin, in his book “What is Happiness?” introduces us to his philosophy of life: “Everyone born into this world has the right to be happy … and being helpful to the world and to others around us increases our own personal happiness.”

The U.S. is now ranked 24 out of the 147 countries surveyed by the Wellbeing Research Center at the University of Oxford in partnership with Gallup. Factors that contribute to this ranking include higher GDP per capita, a strong social support system, higher life expectancy, greater freedom, absence of government and corporate corruption and charitable giving. The U.S. ranking has dropped each year since 2011, with a significant decline between 2022 (ranked 15) and 2025 (ranked 24).

As a world leader, the U.S. is concerned with the world around us: With the wars in Ukraine, Iran, and Gaza and the innocent people killed; with the terrorism of October 7 and the innocent Israelis killed; armed conflicts in Sudan and Myanmar; insurgencies in Africa and Asia, and the criminal conflicts and the drug cartel violence in the Americas.

With this concern, there are understandable debates and doubts in the U.S. about a myriad of issues: the amount of aid we are providing to Ukraine, to defend itself from an invading Russia that’s receiving troops and weaponry from North Korea; efforts to peacefully negotiate a ceasefire with an Iran that says it has the right to enrich uranium and kill innocent peaceful protesters; an elusive peace in Gaza when Hamas refuses to disarm and tension in the West Bank intensifies; and a nuclear North Korea building more nuclear weapons and aligned with a revanchist Russian Federation. Helplessness with the conflicts in Sudan and Myanmar and the jihadist groups linked to Al-Qaeda and the Islamic State operating throughout Africa. Security concerns in Haiti and Ecuador due to gang violence and our inability to effectively counter the flow of illicit drugs coming into the U.S., primarily from Mexico, Columbia, and China. It’s hard to find happiness when assessing the world around us and the absence of peace.

Working with our allies and partners is an integral part of diplomacy and conflict resolution. NATO, AUKUS (Australia, the United Kingdom and the U.S.) and allies like South Korea, Japan and the Philippines are key to managing the ever-increasing security threats around the world. How we manage these relationships with our allies and partners is important.

Domestically, extreme political polarization has replaced polite political debate. A myriad of issues contribute to anxiety among the people: reported cuts to food stamps, Medicaid and social programs, with the rise in food and gas prices that receives daily media coverage. Nicolas Kristof of the New York Times reports a rise in homelessness in California, Oregon, and Hawaii and the plight of the Americans left behind. There’s extensive media coverage to rescind a planned $1.8 billion “Anti-Weaponization Fund” and whether it was vandalism or shoddy construction of the Reflecting Pool in our Nation’s capital. Indeed, there are other political and social issues, like AI, that the average informed American is exposed to daily. Following these and other foreign and domestic issues is important for an informed electorate that will be voting in November and in 2028, but are we on overload? Of concern is the extreme polarization of views on these issues and the government’s responsibility to inform and seek the public’s support on these important issues, without adding to the polemics.

The author of “What is Happiness?” tells us: “Between 1995 and 1998, about three million people died of hunger and disease in North Korea and those who survived also suffered greatly as their family members, friends and neighbors died.” Despite North Korea’s formidable nuclear and missile capabilities, there are exigent health and food issues that continue to demand attention. The U.S. previously helped with these humanitarian issues because it was the correct thing to do. Returning to talks with North Korea to halt their nuclear and missile programs, with the lifting of sanctions and no longer demanding denuclearization as a condition for talks, would be the correct thing to do. It would be a positive development for Northeast Asia and the Korean people and hopefully contribute to the eventual reunification of the Korean Peninsula.

Progress with North Korea should bring some form of happiness to the Korean people and to the people in the U.S. who cry out for a more peaceful world.

This piece was originally published in The Washington Times and is republished here with permission.

Read more national security insights from experienced experts exclusively in The Cipher Brief.

There Will be Unseen Costs to be Paid over the War in Iran. Who is Weighing Them?

EXPERT INTERVIEW – With an interim agreement expected as early as today between the U.S. and Iran aimed at reopening the Strait of Hormuz to shipping traffic, experts are assessing the short and long-term costs of any deal.

As negotiators work on an agreement to re-implement a ceasefire and restart negotiations aimed at curbing Iran’s nuclear ambitions, there are questions about whether Iran will end up with more control over the strait than it enjoyed prior to the war and about the hidden costs that could include impacts on the sanctions packages that the U.S. has been using as a diplomacy tool to try and keep Iran’s malicious activities in check.

Cipher Brief Executive Editor Brad Christian spoke in-depth with former National Intelligence Manager for Iran at ODNI Norm Roule about the current “operational pause” and about the unseen costs of any deal. Their conversation has been lightly edited for length and clarity. You can also watch the interview on The Cipher Brief’s YouTube Channel.

THE INTERVIEW

Norman T. Roule

Norman Roule is a geopolitical and energy consultant who served for 34 years in the Central Intelligence Agency, managing numerous programs relating to Iran and the Middle East. He also served as the National Intelligence Manager for Iran (NIM-I)\n at ODNI, where he was responsible for all aspects of national intelligence policy related to Iran.

Christian: The situation with Iran has continued to progress in ways that maybe people didn't expect or anticipate when this war started. How do you describe where we are right now in terms of progress toward ending this war?

Roule: Where we are right now is in a lull. This is an operational pause. We're not approaching a significant core agreement. This is instead a period of coercive restraint. It's not a ceasefire. And Iran has continued to attack ships, but you're seeing the U.S. restrain its response again here to give diplomacy a chance. The president is showing considerable restraint. At the same time, the assets we have in the region are immensely powerful, immensely capable, and very well led. So, they have everything they need to do to undertake the dramatic operations the president has discussed. The diplomacy itself that's underway is a challenge. Each side is describing it dramatically differently.

If you look at the position of each side, there has been a consistent trend. The U.S. will announce negotiations, and the Iranians will deny negotiations are taking place. A few days later, there will be indirect negotiations through regional parties, still accomplishing the same things, but we're not at the table to talk about nuclear issues, missile issues, or militia issues as originally discussed.

The Iran-Oman mechanism that's being talked about right now in the press is likely being overstated by the Iranians and by some who would believe that concessions to Iran are the appropriate outcome from this crisis. Here's why it's being overstated: If tolls of any sort are charged, what happens to a shipper who refuses to pay? How does work in association with sanctions that have been imposed by the United States? Are American ships and American-related ships, allowed to pay Iran money? Through what mechanisms, what channels? Will we sanction other countries for paying Iran money through these channels? Iran has dictated which countries can enter the Persian Gulf and the bulk of this channel is through Iranian waters, but according to press reports, the Omanis must tell the Iranians who is transiting south. Iran's parliament has said no enemy countries can transit. Are Israeli or Israeli-related ships then banned from the Gulf? These are these are hugely consequential questions that are being glossed over by those who would say, ‘well, a deal is being worked out’. But this situation does show that while the U.S. absolutely has the military edge, it is restraining itself, and that has given Iran an ability to influence some would say, ‘control the pace’ of shipping in the Gulf. That shipping continues, and I've seen reports that as many as five million barrels of oil a day are now moving through the strait, which is going to reduce the pressure on oil markets, but this remains an unreliable waterway. Insurance rates remain very high and will remain high. And the blockade, of course, remains in place. This is a very delicate situation.

We also have to consider what happens if the Houthis look at the Iranian Oman deal and say, we want the same deal regarding the Bab el-Mandeb. What is the premise to refuse that? What would we do if the Houthis responded in their own way to attacking ships in the Red Sea?

So, we're in a very consequential period. And this is a period consequential for Iran because they're also in dire need of economic assistance. Their inflation is about 70%. Unemployment is horrific in many locations. I've seen figures as high as forty to forty-five percent in some areas. And the Iranians of course are showing defiance and claiming this isn't a problem, but this has got to be touching their decision making. And I think that's something the White House is considering.

Christian: President Trump has been very clear on where he stands on the issue of paying fees for passing through the Strait of Hormuz. Why is Iran pushing this issue when there were no fees in place before the war started? Is this one of Iran's most powerful points of leverage that they have over the strait? How are you thinking about their position on these fees?

Roule: It's a good question and I'm not putting a value judgment on it. I've tried to remain neutral on these issues. But those who advocate for making a deal with Iran, you know, diplomacy comes with severe consequences. If Iran is able to acquire control over the strait, will that collapse the international sanctions regime? For example, if Iran is able to control the strait in this regard, can it dictate which food shippers can come into Kuwait? If Iran controls the strait, it now has a permanent foot on the throat of the international community. And the idea that if we just do this, we can then build on trust with an IRGC government has no evidence in reality. Now that doesn't mean that it may not happen, but those who say you can build on this are not producing an argument that makes sense. Iran would be able to inject considerable power projection into the region in an unprecedented way, gaining billions of dollars, and that money would inevitably go to its missile program and proxies. And those who talk diplomacy with Iran, and you can see this when you look at social media statements or foreign affairs articles. The authors who speak most passionately and eloquently about engagement with Iran can't seem to acknowledge that people will die as a consequence. Now, that makes me sound like I'm opposed to this but I'm just giving you all the reasons why this is a problem.

The region, of course, has no desire for Iran to have this capability. But they also have no desire for a missile and drone war. That you either have a drone war, missile war, or give in to Iran, those are usually statements made by people who aren't professional diplomats, professional policymakers or have little understanding of the regional issues. There's going to be some sort of path in the middle that works if we're to protect and preserve sanctions as our tool against Iran's terrorism and other activities and if we’re to protect and preserve the national sovereignty and security of these countries who are our partners.

Also in the details of this deal are questions over whether the U.S. military would be banned from the Persian Gulf. The Iranians would have to approve the passage of U.S. military ships, which of course we wouldn't agree to, but the Iranians could claim that as a violation and things could unravel. We're going to land in a gray area on this if diplomacy is to succeed and it may not succeed.

Christian: In public statements, President Trump seems to be losing patience with the process. The president has said before that if Iran doesn't make this deal, that's it and we've witnessed similar red line crescendo moments before. You mentioned the IRGC led government. It's clear that they are running the country now. It's not clear how the diplomatic process is working, certainly by historical standards. What are your potential measures of success or indicators that the diplomatic process has run its course and what are you watching as potential next steps?

Roule: Throughout the last twenty years, various administrations, Democratic and Republican, have each said the same thing that we will try every possible diplomatic option for as long as possible and that all responses remain on the table. But once we've shown the world that we have tried every diplomatic option and the Iranians won't take yes for an answer, won't take diplomacy for an answer, then we'll be justified in using force.

I've been in congressional testimony where I've had Republicans and Democratic State Department officials insist that was U.S. policy. And that is congruent with the President's statements. He's basically saying, ‘Look, I'm going to give them every opportunity to negotiate’ because the consequences of a much broader conflict for the region, for the Iranian people, for civilians, for the U.S. war fighters who are risking their lives in the region, all of this will come into play.

We do have the assets in the region and our leadership in the military force there is exceptional and highly experienced. And based on the nature of the attacks conducted by the U.S. military in recent weeks, one can deduce a couple of points.

The first is that we know a lot about Iran's military architecture. And second, Iran has very little defense against our attacks because we've seen very little air defense or port defense as a result. Iran only has an offensive capacity. And it's attacking civilian architecture as well as U.S. military bases, not being used by the U.S. military, but nonetheless, they're bases where we have that presence. But at some point, if you believe in international values, we we've got to stand with our partners to protect them in a way that is congruent with their national interest and leadership approaches.

Christian: Over the weekend, news reports indicated that the Gulf states were the ones that convinced President Trump to not escalate this war right now. Do you have a sense of where the Gulf states are right now in terms of their approach to President Trump, their approach to Iran?

Roule: I think you need to have several different pillars in mind. First, let's talk about what the Gulf States have done that has been quite successful. Their defense against Iran has been very, very successful as a result of years of engagement with the United States and with the U.S. private sector, which is playing a large role in their successes and will play a role in their future successes in terms of defending against cyberattacks and drone and missile attacks. No air defense is perfect, but the performance by the GCC has been exceptional. And they have protected three things that we should applaud.

First, they've protected their own nationals and their own infrastructure, which is the duty of every state. They're protecting millions of other citizens to include hundreds of thousands of Americans who live in the region. They're keeping American lives safe with their air defense. And last, they've protected the international economy, preserving through their energy flows and their handling of the situation, the ability to maintain stable energy prices and distillate impact on subsidiary industries. All of that is exceptional.

At the same time, we've seen the Saudi military crisply respond to Houthi aggression with surgical strikes, and the Saudi military joining with the United States on strikes on Iraq, which is a first. And it's also a demonstration of the quality of Saudi Air Forces in general. So, there's a sense of extremely close partnership between our militaries. But how they move forward, you know, it is their neighborhood, so how they move forward in a world where there could be a major attack on Iran is likely going to mean that they're going to face more missile and drone attacks. They're going to want a voice in this.

They know their region better than we do. We should respect that. And I think that's what you saw last week in the reports of phone calls to the president, where he gave diplomacy a chance and was about to move, and I believe he was serious, based on my understanding. But he also took into consideration partners, people who have lives on the line and are trying to defend the world's economy and know their neighborhood very well. So, I'm not unhappy with what's happened. I don't think you can criticize that. That's a natural, organic and appropriate process.

Christian: Let's talk gray zone just for a moment. We've seen reports recently that the hacks against the water infrastructure in Minnesota could have involved Iran. We've seen reports that China, although not confirmed, was planning to deliver air defense systems to Iran. There's no doubt about the cooperation continuing between Russia and Iran. What are you looking at that some of us may be missing?

Roule: Press reports confirm what many observers have cited, and that is that Iran's cyber activities have continued unabated since this conflict began. Indeed, before the conflict, against multiple actors in the United States and largely that's been successfully defended against by our national cyber architecture, as well as the architecture of our Gulf partners. The president has disagreed with the assessment on Minnesota and other places, but that does fit with the past pattern of Iranian cyber activity against SCADA and other systems in the United States. and has been a longtime target of Iran itself. It is an attack on our national infrastructure, if it's proven. And if proven and we don't respond to it, the people in Tehran are going to say, ‘Well, there's no reason we shouldn't continue to do this’. So, I think that issue itself is pushing the White House towards alternative actions besides diplomacy. And in fairness, it has been a traditional standpoint of multiple administrations to say how we respond. Is it at a time and way of our choosing? We don't respond symmetrically, you know, we don't do the exact same thing back. So, if the United States were to respond with airstrikes against Iran’s cyber architecture, which would probably be a good thing in a conflict, that is an appropriate proportional response just done differently. And it would be congruent with multiple administrations' views and statements as to how they will treat Iranian aggression.

Christian: What are you looking for next? What are you paying the most attention to?

Roule: As I mentioned, if you give Iran control of the Strait of Hormuz, you're going to have consequences, not only in terms of whether they will ever negotiate seriously with us, but what does it mean for the Red Sea, and all sorts of other things? And those who say, well, we can work past that usually aren't in the Gulf, usually don't have children fighting right now and usually won't pay the price of those decisions. Not to say they won't be made, but we need to be upfront on those costs, and some of the issues aren't being discussed.

What I'm looking for is the conversation about those costs. And if it doesn't happen, that's a bad thing for everybody. The other issue is I think we need to look at is how the U.S. is going to respond to continued Iranian aggression. When does the U.S. restrain itself? Right now, the president is clearly, as he's announced, looking at de-escalation. But if the Iranians continue to probe with cyberattacks and missile and drone strikes, they've got to be addressed in a way that says to Iran, that there is a material price to be paid for that.

In the negotiating channels, I would look for any evidence that the U.S. is now directly dealing with the Iranians. That's unlikely to happen in the near term. That doesn't mean that diplomacy isn't occurring robustly through our partners, but any evidence of direct negotiations with the U.S. would be a very significant uptick.

And last, I would look for someone to address the issue of how any payments to Iran, involuntarily or otherwise, will impact the sanctions regime. Failure to address that is irresponsible in a policy world and indicates that maybe that's not being taken seriously.

And maybe one more point, and that is we should expect rhetoric on each side, but we should focus on what happens on the ground via the effervescent statements that are so often in the media.

Read more national security insights from experienced experts exclusively in The Cipher Brief.

BLUF: The US Must Lead in Gray Zone Activity

As Washington works on the historically large defense budget, there is one theme which should loom large in the budget but comparatively, will cost little. Key to our national security is countering the gray zone activity that our adversaries are waging against the US and developing our own offensive gray zone strategies. Just as we would not ignore a kinetic strike against the US, we cannot ignore the targeted gray zone attacks by adversaries but we must be careful that our approach is thoughtful, and expertly executed in order to guard against escalation. Developing such offensive and defensive strategies will require gray zone expertise, proficient knowledge of the targeted adversary, a government wide strategy, and patience. As global leaders, we also must be open and clear that we will take on these gray zone activities, but we do not have to and should not discuss the details of our actions. We need to publicly put our adversaries on notice that we will not tolerate their actions against the US and we will counter them with our own, more debilitating gray zone activities.

The National Intelligence Council describes gray zone activities as “coercion and subversion . . . below what constitutes armed conflict but outside the bounds of historically legitimate statecraft.” The IC defines the gray zone as a realm of international relations between peaceful interstate diplomacy, economic activity, and people-to-people contact on one end of the spectrum, and direct armed conflict on the other. State-led activities that happen in that space that weaken governments’ resolve to confront the US or its allies, endeavor to change a nation’s policies, or strengthen a country's global leadership would be considered gray zone activities. Deniability is critical to the success of this strategy because attribution risks escalation.

David Pitts, another Cipher Brief Expert, has written about the current phase of warfare which he calls endless wars and the need to counter them. These endless wars are the gray zone activities that our adversaries pursue against us. The White House has made an important step in that direction by appointing the first US National Security Council Director for Cognitive Advantage. There is still a way to go, however, because cognitive advantage is just one part of gray zone activity.

The US must develop expertise for whole of government strategies that bring together all of the tools for gray zone activities. Some of those activities are:

Cyber, and information operations efforts focused on undermining public/allied/local/ regional resistance, and information/propaganda in support of US goals;
Covert and clandestine operations such as espionage, infiltration, and subversion;
Enlistment of non-governmental actors and assistance to irregular military and paramilitary forces;
Economic pressures that go beyond normal economic competition;
Calculated ambiguity to include deception and denial operations.

Autocracies tend to have an advantage in executing gray zone operations. It is generally believed that non-democratic states can operate more effectively in the gray zone than open democratic societies as non-democratic nations are not limited by domestic law and regulation. The nature of their centralized systems allows them to marshal whole-of-state (and whole-of-society) resources to execute operations. The United States lags behind its autocratic adversaries in the information domain, for example, because our adversaries have ingrained gray zone tactics into their doctrines.

In democratic societies, the use of gray zone tactics can be controversial because the nature of these activities is meant to covertly shape actions. It can be challenging for democratic states to respond to gray zone threats because our legal and military systems are geared towards seeing conflicts through the perspective of war and peace with little consideration for anything in between. Democracies have failed to build consensus around gray zone concepts. The US government has been arguing over the definition and leadership of gray zone and information operations for years.

Gray zone activities are not a new concept and historically have been accepted as a long standing form of statecraft. What are now being called gray zone methods have been well documented actions throughout history. These activities have been called by such titles as “political warfare,” “covert operations,” “irregular or guerrilla warfare,” and “active measures.” It is worth examining the historic record and recalling the benefits and rationale for gray zone activities that kept nations out of kinetic fights, allowed for de-escalatory engagement, arguably shortened warfare, and saved lives.

Examples:

The Trojan Horse operation exploited many of the instruments of a gray zone campaign– creating confusion and division among the enemy, extending ostensible inducements, implanting hidden military forces, deception, and clandestine infiltration of enemy territory.

During the Peloponnesian War between Athens and Sparta, the Spartans recognized that they needed to prevent an uprising by the Helots, who were key to Sparta’s agricultural and military systems. Athenians were trying to create the conditions for a Helot uprising, which would then add an irregular dimension to the conventional conflict with Sparta. The Athenians used proxy forces who were experts on the language and culture of the Helots to sow distrust among the Helots against the Spartans. The Helots began to desert Spartan forces, thereby creating a national emergency in Sparta. The Athenian historian Thucydides reported that as a result of Sparta losing Helot support, it reached out to Athens to discuss ending the wars.

The Han Empire used economic and cultural engagement—such as trade agreements, marriage alliances, and cultural exchanges—to manage tensions with nomadic powers. These actions helped secure borders and reduce the need for large-scale wars
During the Cold War, superpowers like the U.S. and USSR engaged in gray zone tactics such as espionage, sabotage, and proxy support to influence outcomes in regions like Latin America, Korea and Vietnam. These active measures as they were called, kept the competition a contested space, avoiding immediate escalation with the US.

Gray zone campaigns are likely to increase and diversify because of more enabling technologies, the erosion or absence of accompanying norms, and challenges with attribution. There is a growing awareness among some in the US national security community that if we do not develop gray zone strategies against our adversaries, then we will find ourselves no longer the global power that we have been. Without these strategies, we also limit potential responses to our adversaries to kinetic ones.

As a national security community, we have trained only a narrow group of special operators and intelligence professionals to be able to think creatively enough to devise irregular warfare plans and strategies. To produce gray zone strategies the US will need to train a work force in creativity and out of the box thinking. It also will require organization and orchestration from all assets of the US government and the development of and use of technology to bring some of the ideas to fruition. A fully conceived gray zone strategy needs to marshal all aspects of the US government: military, intelligence, economic, trade, diplomacy, and public relations.

The US is not organized as a nation to devise these strategies. Our State Department is focused on developing relationships. Our National Security Council is hollowed out. Due to issues with legal authorities, neither the Department of War nor the intelligence community can take the lead in implementing whole of government strategies. We are at a standstill and have been for several years.

What to do?

We need to be upfront that leading in gray zone operations is good for US national security. If we do not quickly make gray zone strategies a key part of our national security then we risk our global leadership role. We must put in place the tools and organization to execute these strategies. Using part of the large defense budget to show US resolve on this matter would go a long way. Putting a seasoned professional at the NSC and making him/her in charge of integrating the USG gray zone activities against specific adversaries is key to winning in this realm. A lack of coherent command-and-control, as well as jurisdictional and philosophical boundaries between government agencies, inhibits the synchronized activities needed for successful and truly whole-of-government gray zone activities and responses. We also should use the trained Department of War and intelligence community planners, working with the rest of government, to develop government-wide plans that are implemented at the White House. While we move out in this way, we should also be training our national security professionals across the government in how to develop gray zone strategies. Now is the time to make this a national imperative.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Why the Iran War Remains Strategically Adrift

“I do think there's a lot of evidence to believe that we're accomplishing the military objectives [of the Iran War], which is destroying the Iranian Navy, the Iranian Air Force, their air defenses, the missile production capabilities, drone production capabilities. That's going well. But how that translates into strategic success has been, I think, the weakness in this entire operation and continues to be today. And I think that if we were to take a step back to February [when the Iran War started], and think about where we are today, I don't know that this would be in our theory of success. It would probably be a branch plan that would not be going so well. And I'm worried about that.”

That was retired-Air Force Lt. Gen. S. Clinton Hinote, former Deputy Chief of Staff for Strategy, Integration, and Requirements, now a professor of policy analysis at the RAND School of Public Policy and a non-resident adviser to the Center for Strategic and International Studies (CSIS) Aerospace Security Project.

He was speaking on July 23, at a CSIS event, The Air Campaign Returns: From Epic Fury to Midnight Hammer, along with retired-Air Force Gen. James Slife, former Vice Chief of Staff of the Air Force, former Commander of Air Force Special Operations Command, and also a non-resident adviser to CSIS’ Aerospace Security Project.

The two former senior Air Force officers not only gave their frank views of the Iran War, but also discussed the future of warfare and its impact on the Air Force and other U.S. military forces. I will start with their views on Iran and the war and then move on to other subjects they dealt with.

Since the Strait of Hormuz is central right now, let’s begin with their views on the Strait which I found inciteful.

Ret.-Gen. Slife began by pointing out, “Military planners have struggled with the Strait of Hormuz challenge for years and years. I mean I don't think it's any surprise to anybody that's paying attention to how this has played out, because geography favors Iran in the Strait.”

Slife continued, “I mean they [Iranians] have three sides of the Strait of Hormuz, right? It's a very narrow waterway. It's very shallow. The ability to maneuver inside the Strait is very limited. It's crowded. I mean there aren't a lot of great options.”

Then, as a former Air Force commander he offered the following views: “I mean, frankly, if there was a great option for how air power could unblock the Strait of Hormuz, it would probably be unblocked at this point. There are things that I think the air component is doing in conjunction with the naval component to target the means that Iran uses to exercise control over the Strait. But it is a very difficult problem. Geography just doesn't favor us in this regard.”

Ret.-Lt. Gen. Hinote added, “I think we're dealing with the problem of small numbers,” and then explained, “The [U.S.] joint force can be exceptionally good at preventing the majority of attacks on shipping [in the Strait]. That could even get into the 90% plus range. You could even call it 98%. But it's that last 2% that the joint force just has the most difficulty stopping [Iran from hitting a transiting ship] because you just can't stop everything when there are these mountainous rugged shores that Iran controls and they can use that as [protective] cover to attack shipping.”

Hinote went on, “So the problem is not necessarily that we're not militarily successful. I call 98% pretty militarily successful, but it's that last 2% that the [ship] insurance companies cannot accept. And so that's, I believe, the true dilemma that is facing the world economy today -- that as long as Iran has the will to try and negate shipping through the Strait, it's going to have some level of capability to do so. And that just creates a conundrum that we just haven't solved and [are] unlikely to solve.”

The two former Air Force generals also raised the issue of Israeli and U.S. forces having different missions for their military involved in attacking Iran.

Ret.-Gen. Slife put it this way: “I wonder to what extent the difference in [U.S. and Israeli] targeting reflects different national aims between Israel and the United States. I don't have any way of knowing that, but I do think it's noteworthy that we are actually, we have pursued very different target sets which may tell us something about what our respective national aims are.”

Ret.-Lt. Gen. Hinote picked up that idea saying, “To me, the Israeli theory of success is pretty straightforward. They [the Israelis] believe the Iranian regime will always be hostile to them and they believe that they have to go back and back and back to re-strike things and to re-strike the regime targets. And you might think of that as a strategy that we've heard called mowing the grass…meaning that the grass is going to grow back and we're going to go back and they are resigned to some way of mowing the grass again for years.”

That means, according to Hinote, “The more [Iranian] regime leaders we [meaning the Israelis] can kill, the better, because that means it takes more time for the new regime leaders to be dangerous to us.”

As for the U.S., according to Hinote, “We're at a stage now where we're fighting a coercion campaign…Hey, we want the Strait [of Hormuz] open. Hey, we want you to give up your nuclear aspirations.”

But now, as he adds, “There's nobody left in Iran who really can make that decision and enforce it up and down what is left of the government and military apparatus. So we're in a state now where what you might have thought of as the strategic aims and the military means, not only were they not necessarily totally aligned, they may have in certain circumstances worked against each other -- and that's a really difficult place to be.”

That is because, as Hinote points out, “We [the Israelis and U.S.] did one of the most successful, maybe the most successful decapitation operation [of Iranian leadership] in history. And so given that, I think you expect that there's going to be a high degree of paralysis and inaction at the

highest levels of the Iranian government. So you're almost thinking like, okay, well, what at that point, how do you take advantage of that strategic paralysis?”

However, there was no “strategic paralysis” in the Tehran regime, nor was there an internal uprising, as President Trump called for that night last February when he announced the first Iran attacks were underway. “When we are finished,” Trump said to the Iranian people, “take over your government. It will be yours to take. This will probably be your only chance for generations." Trump also called on the Islamic Revolutionary Guard Corps (IRGC), the armed forces and police to "lay down your weapons and have complete immunity" otherwise "face certain death."

As Hinote put it last week, “We're in a state now where what you might have thought of as the strategic aims and the military means not only were not necessarily totally aligned, they may

have in certain circumstances worked against each other -- and that's a really difficult place to be. And I think one of the reasons why it feels intractable right now is because you have that disparity.”

In fact, Hinote added, “The United States would like to be done with the Middle East, so that we could finally execute some sort of pivot to Asia. And we'd like to get out of all of these very expensive bases in the Middle East. And so we have a theory that is we want to put the [Iranian] regime into some sort of state where we don't have to go back anytime soon -- and we get to a steady state that is better than what was in existence on February 28th [when the U.S. and Israel first attacked Iran].”

Slife also mentioned an effect on U.S military readiness from the Iran War that need further attention when he said, “You know that all our readiness is built around how we generate and deploy forces, particularly for the Air Force and the Navy. We've seen heavy deployments beyond what the [military] services feel like they can routinely support from a readiness perspective and so those things always have a delayed effect.”

Slife added, “I think just the pace of operations over the last year has probably exceeded the Air Force and the Navy's ability to maintain levels of readiness going forward. So, I think we were going to have to pay close attention to that over the next three-to-five years, because there is always a delayed impact to these kinds of heavy operations.”

Hinote spoke about “the mission to rescue the [U.S.] back-seater of the F-15E [that was shot down over Iran]. We've only heard a little bit about that. My sense is that it was a huge operation that required tremendous integration across multiple types of forces in a very difficult time frame.”

He pointed out the difference from the troubled April 1980 Iran rescue attempt that was, he said, “so bad that it led to reforms for the next decade in the United States military. We may see that [the April 5, F-15E back-seater] rescue operation, in contrast, stands as being one of the best we've ever seen.”

Hinote then explained why saving the back-seater was so important.

“What if that weapon-system officer would have been captured and paraded in Iran on TV with the entire world seeing it real time,” Hinote said, “You could see that any political objectives that we were trying to achieve would be all the more difficult to achieve with one single pilot being paraded around in Iran…So, not only was the true political nature of the whole operation in jeopardy, but you [the U.S.] were willing to send what I think is going to end up being scores of airplanes into harm's way, multiple units, helicopters and such to go rescue this one pilot so that the political objectives could be preserved.”

While public concentration currently is on what’s not yet worked to end the Iran War, that rescue operation was one element that did succeed.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The New Fault Line: Israel and Turkey on a Collision Course

On March 25, 2025, Israeli aircraft struck a set of Syrian airfields. The targets were not Syrian assets, instead they were the sites Turkey had surveyed for planned forward military bases. Ankara quietly shelved the deployment.

That is what the Israel-Turkey rivalry looks like when it is working as designed: a NATO member and a US major non-NATO ally maneuvering against each other in a third country, close enough to require a deconfliction hotline, disciplined enough that neither has yet acknowledged the confrontation for what it is. The two governments have run a channel through Azerbaijani mediation to prevent accidents. Turkish officials describe it as, "strictly technical," signaling neither normalization nor any convergence.

The conditions that made the channel necessary are getting worse, and the outside power that has historically kept this rivalry from becoming a rupture is changing.

Trump's Gift to Erdogan

When Donald Trump landed in Ankara on July 7, 2026 for the NATO summit he became the first sitting US president to visit Turkey in over a decade. He arrived with what aides openly called a "gift bag" for President Recep Tayyip Erdogan. On CAATSA sanctions, imposed in 2020 over Turkey's purchase of Russia's S-400 system, Trump was categorical: "We're going to be taking the sanctions off; it's time. We don't want to sanction friends." On F110 engines for Turkey's homegrown KAAN fighter, the administration notified key lawmakers it was proceeding. The F-35 remained genuinely conditional, something his administration would "certainly consider." Erdogan told reporters Trump had pledged six aircraft and “always keeps his word”.

Standing beside Erdogan, Trump said Turkey had proven a more loyal partner than some allies Washington once counted on.

Israel's reaction was immediate and unprecedented. Speaking to Fox News and CNN, Prime Minister Benjamin Netanyahu warned that arming Turkey with F-35s would upset the regional balance. He described Erdogan's government as ideologically hostile to Washington and openly threatening to Israel, and pointed to Turkey's continued presence in northern Cyprus. It was the first time Israel had publicly opposed a US arms sale to a fellow NATO member.

Trump was reportedly irritated. Netanyahu insisted the two governments still saw eye-to-eye on the big picture. This difference is worth noting.

They do not see eye-to-eye, and the reason is not sentiment. This administration's Middle East policy seems focused on commercial and strategic arithmetic. On that scale Turkey scores well: 85 million people, a NATO air force, a fast-growing arms industry, control of the Bosporus, and a leader willing to transact. Israel's ability to shape US decisions in the region has always rested on an unstated premise: Washington values the relationship with Israel above the deal in front of it. Ankara is testing that premise. So far, Washington is not objecting.

The pattern repeated within three weeks. On July 8, the State Department initiated the rescission of Syria's designation as a state sponsor of terrorism, a status in place since 1979, following Trump's meeting with Syrian President Ahmed al-Sharaa. On July 22, Washington and Riyadh announced a nuclear cooperation agreement. Neither move was calibrated to Israeli preferences, but to American interests.

What Turkey Gained While Israel Was Fighting

Ankara's leverage did not appear in July. It accumulated while Israel was occupied elsewhere.

Syria is the clearest case. Since Bashar al-Assad's fall in December 2024, Turkey has established itself as the dominant external patron of al-Sharaa's government. On July 19, 2026, al-Sharaa consolidated the security apparatus under Interior Minister Anas Khattab, who now also heads the National Security Bureau, with Abdul Qader Tahan installed at General Intelligence and Hussein al-Salamah as Khattab's deputy. For Turkey, a centralized Damascus under a friendly government is a forward base, a reconstruction market, and a check on Kurdish autonomy along its southern border all at once.

Israel reads the same arrangement as a threat under construction, and has acted accordingly. In the seven months after Assad fell, Israel conducted roughly 988 air and artillery strikes in Syria, nearly triple its previous rate, including against the Presidential Palace and Ministry of Defense in Damascus. The March 2025 framework for integrating Kurdish forces into the Syrian state remains frozen, which Turkish officials blame largely on Israeli operations destabilizing the Syrian government.

Beyond the Levant, Turkey's footprint keeps widening. In Somalia it operates its largest overseas military base, has trained more than 15,000 soldiers, deployed F-16s and armor, and in 2026 began offshore oil drilling protected by Turkish naval assets. These are moves aimed in part at countering Israel's outreach to Somaliland. Turkey's defense minister says other African governments are now requesting the same security-and-investment package. Layered onto bases in Qatar and northern Iraq, Ankara has assembled a chain of footholds from the Horn of Africa to the Caucasus.

Two structural shifts accelerated this. Iran's regional network was degraded by the 2026 war, leaving a vacuum in Syria and Lebanon that Turkish diplomacy, trade, and reconstruction capital are filling faster than anyone else. Iran is not finished, and Russia was preparing Su-35 deliveries to Tehran the same week Trump was in Ankara.

Meanwhile Moscow's grip on the South Caucasus eroded after the 2020 Nagorno-Karabakh war, when most of its forces was deployed in the Ukrainian war, and after the US brokered the 2025 Armenia-Azerbaijan framework, which opened the Zangezur corridor linking Azerbaijan to Turkey.

Israel forging new alliances

Israel has also been forging alliances, no longer counting on the US as their sole guarantee.

In December 2025, Israel, Greece, and Cyprus held their tenth trilateral summit in Jerusalem, where Netanyahu spoke against those who dream of restoring old empires. The three signed a 2026 military cooperation plan covering joint air and naval exercises, intelligence sharing, and reported discussions of a roughly 2,500-strong rapid-deployment force. By February 2026, Netanyahu was describing a broader "hexagon of alliances" built around Greece, Cyprus, and India.

Ankara's counter-positioning is equally deliberate. Turkey has hosted Hamas officials for years and holds real influence over any postwar settlement in Gaza. Foreign Minister Hakan Fidan's remark that Israel had become a burden humanity could no longer bear drew an Israeli rebuke as incitement. Each government now treats the other's regional relationships as evidence of intent.

Where It Breaks

Direct confrontation remains unlikely, but not impossible. Both capitals understand the costs. But the deconfliction channel is a technical fix for a strategic problem, and four scenarios handled incorrectly could force the two powers into collision.

Syria is the live one. Israeli strikes to prevent hostile entrenchment collide directly with Turkey's project of a unified, centrally governed Syrian state. Israel has already struck sites Turkey intended to occupy. Repeat that once with Turkish personnel present and the hotline becomes a record of a failure rather than a mechanism preventing one.

Lebanon compounds it: Hezbollah degraded but intact, Turkey's expanding humanitarian and political footprint, and continued Israeli operations against Hezbollah infrastructure pulling outside patrons into direct rivalry. Trump is suggesting that Syria should intervene, something Israel can not accept.

Cyprus, divided since 1974, is where Israeli-Greek-Cypriot military integration and a prospective joint rapid-reaction force meet Turkish assertiveness in the Eastern Mediterranean. While several of the nations are NATO members, new hostility risks drawing in allied nations.

The F-35 decision itself is the fourth. If Congress and the Pentagon proceed over Israeli objections, it is a tangible erosion of the qualitative military edge that Netanyahu argues is the foundation of deterrence.

Conclusion

Israel and Turkey have been rivals for a decade; and for most of that decade, the fault line stayed closed because the US had an interest in keeping it closed. But the Ankara summit demonstrated, reinforced by the Syria delisting and the Saudi nuclear agreement, that this administration will price each decision on its own merits without allowing allies to veto them. That is a coherent policy. But it risks removing the pressure that has been holding two armed, ambitious, US-aligned states apart in the same contested space.

Washington is not choosing between Israel and Turkey. It is counting on the two allies staying away from an armed conflict. The question is whether a deconfliction hotline routed through Baku can carry the weight that American guarantees used to.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Iran Is “Counting Coup” On The United States

The Iranian leadership appears to be intent on demonstrating its defiance and courage in the face of American force while also humiliating the “most powerful man in the world.”

“Counting Coup, or striking an enemy, was the highest honor earned by warriors participating in the intertribal wars of the Great Plains. Key to a man’s success in Plains combat was demonstrating his own courage by proving superiority over his opponent and, in a competitive sense, over his own comrades.

Killing was a part of war, but showing courage in the process was more important for individual status. This was best accomplished by risking one’s life in charging the enemy on foot or horseback to get close enough to touch or strike him with the hand, a weapon, or a “coupstick.”

Humiliating the enemy also played a part in this fighting…

Counting Coup, then, was the epitome of a type of warfare that pitted skill and daring of one man against another.”

Walking the Line

Iran is playing a very dangerous game. In the face of the awesome military power of the United States, in between desultory negotiating sessions, they continue to touch the enemy by launching attacks against U.S. and allied Gulf facilities. Recently, they have reached farther afield, striking U.S. assets in an Egyptian port. This would seem to be inexplicable behavior, given the U.S.’s obvious desire for a deal, inviting as it has strong retaliatory strikes against Iran’s increasingly beleaguered military, and potentially civilian, infrastructure. Most recently, we are seeing reports of possible Iranian cyberattacks on the water supplies of U.S. cities; such activities are certain to continue and likely to escalate, plausibly deniable and effective in sowing fear as they are. The question is why?

It may be simple hubris. It may be a misread of the desperation of their opponent. Or simply overconfidence in the strength of their position. It most certainly is part and parcel of a purposeful negotiating strategy, a reminder to all involved that Iranian forces can reach out and touch you whenever they wish.

Regardless, they are walking a fine line, and they have placed this conflict squarely in the crosshairs of unintended consequences.

As they so often do, they risk overreaching. Should one of these missile or drone strikes make it through, whether by luck or skill, and inflict truly significant casualties on U.S. personnel, either in a land-based facility or on a naval vessel for example, this could surge American support for a massive response, possibly including – however unlikely – ground troops, radically altering and escalating the course of this conflict.

Internal Factions at Play

The Iranian leadership’s actions, however, are likely aimed not only at the United States but may be the result of continued factional maneuvering in Tehran, as groups jockey for advantage for what comes next. Now that it appears likely the regime will survive, they are no doubt looking ahead to where they will land in a new regime. As both factions and individuals.

As I wrote in ‘Is Iran Controlling the Gulf Conflict?’: “I would posit that the newly ascended Supreme Leader, Mojtaba Khamenei, may in fact be a phantom leader. Alive in some fashion, perhaps largely incapacitated, but not actually in charge. And even if able to coherently express his views, in no way nearly as powerful or influential as his father. The seemingly reckless actions of the regime in courting U.S. retaliation may in actuality reflect a lack of a coherent decision-making process as opposed to a unified one. I think it is quite possible that competing factions within the regime are using Mojtaba as an avatar while they maneuver for decisive advantage.”

Get Out!

On 15 May, I laid out in “Ground Hog Day”, a recommended way forward for the U.S. that I think largely still applies. It is a measure of how fruitless continued military action is that these remain relevant today:

“Make a deal with Iran. One that they will accept. This will require painful concessions and is certain to include provisions that many will find objectionable, including significant sanctions relief. And it will leave the Iranian regime in place and in control of Iran. For now.”

“As much as I would prefer to see regime change in Iran, I believe a deal may be the only realistic way out of the Groundhog Day-like doom loop in which we find ourselves. Simply put, the administration squandered the initial opportunity presented by a unique confluence of events by its lack of strategic planning and a fundamental misunderstanding of Iran and the Iranian regime.”

“As a result, we are going to have to step back and take a longer view. I pity the people of Iran, at least in the near term. They are certain to suffer the brunt of the regime’s immediate ire. That is a hard truth.”

“This is not, however, the end of the story. Iran’s internal weaknesses still matter–and may shape what comes next more than battlefield successes. I am cautiously, very cautiously optimistic that even barring regime change, Iran’s leadership will be forced to change direction.”

“The issues facing Iran prior to the War were serious, in fact existential – a collapsing economy, hyper-inflation, severe water shortages, lack of electricity, and growing widespread popular anger and unrest – and are ongoing and only getting worse. Whatever the Iranian leadership looks like, it will have to address these issues. And it is not clear that they will be capable of doing this without outside help. This is where the U.S. and hopefully our Western allies come in: sanctions relief, and extensive economic and other assistance in exchange for real changes in policy and a pullback on objectionable activities and programs. The potential for this may, and I say may, have increased with the removal of Ali Khamenei from the Supreme Leader’s seat. But it will depend on whether his son and successor, Mojtaba, is less rigidly ideological than his father. We will see if he is willing to put the Iranian people ahead of the regime.”

What Awaits!

It is becoming more obvious by the day that the U.S. needs to come to a negotiated settlement with Iran. And the terms of this settlement are certain to be painful and unsatisfactory from the perspective of the West. But continuing tit-for-tat airstrikes simply prolongs the pain and risks horrific unintended consequences without solving the problem, as well as providing the regime with a distraction from its appalling management of Iran’s economy, natural resources, and foreign policy.

Follow Mark on Substack here.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

AI Summaries Are Susceptible to Manipulation — and That's Both a Business and a National Security Problem

More and more people are using AI like a search engine – 42 percent of U.S. adults now use AI chatbots to search for information – and that shift is exposing a structural vulnerability that adversaries are exploiting to seed propaganda. In practical terms, this is a problem of Generative Engine Optimization (GEO) – the deliberate effort to shape digital content so that AI chatbots absorb and repeat it.

The research so far points to data voids — the thinly covered topics where there isn't much credible information to begin with — as the weak spot. This includes breaking news or new material that has not yet had time to accumulate the signals that would flag it as low authority.

AI can process far more information than any human can, but there is an inherent trade-off in outsourcing the curation of information to an AI summary. In the search era, users were exposed to source material and evaluated credibility for themselves. Now AI does that work, and research shows the large majority of AI queries end without a click.

This is both a business concern and a national security concern. The clearest example on the consumer side is Apollo-9. In a Chinese state TV investigation, researchers used a tool called Liqing to flood the web with fake reviews and rankings for Apollo-9, a fitness tracker that did not exist. Within hours, chatbots were recommending the fake fitness tracker and some continued to do so a day after the fraud was exposed. Liqing and other tools are sold openly on Chinese e-commerce platforms like Taobao and JD.com, with pricing ranging from roughly $520 to $4,765 for three-month subscriptions. One provider told Chinese state media it had served more than 200 clients across multiple industries, guaranteeing top-three placement on any AI platform.

In order to better understand these developments and their impact, this article examines how the same mechanism scales from commercial fraud to geopolitical disruption, using the Russia-Ukraine war as a live GEO lab. Leaked documents about Russia’s “Project 2026” and Ukraine’s AI‑enabled counter‑operations show how influence campaigns are evolving from social feeds to the underlying sources that AI systems draw on — an angle largely absent from existing information warfare debates.

Russia and the National Security Case: Same Playbook, Higher Stakes

When Russian operations exploit GEO in their war on Ukraine, they are not just spreading propaganda in the moment; they are trying to become the “ground truth” that AI systems summarize back to users, analysts, journalists, and policymakers. In June 2026, Bloomberg reviewed 73 leaked documents from the Social Design Agency (SDA), a sanctioned Moscow firm at the center of Russia's influence operations, describing a program its operators called “Project 2026:” a network of Wikipedia-style reference sites, media outlets, and fake think tanks built to shape what search engines — and AI systems — treat as reliable sources. The goal, as described in the leaked documents, is to “create an alternative information ecosystem” by shaping not only what people see today but also what AI systems will later “know” about key leaders, the war’s origins, Ukraine’s conduct, NATO’s role, and Western support.

Russia's GEO tactics build on years of search engine optimization (SEO) manipulation and are part of a widely reported pattern of industrialized cognitive warfare that includes deepfakes, cloned sites and other deceptive content. In 2023, a study published in the Harvard Kennedy School Misinformation Review examined pro-Kremlin attempts to manipulate search engine results and found that pseudo‑think tanks and propaganda outlets such as Global Research and Strategic Culture Foundation were amplified through backlink networks and low‑quality sites. These outlets were most effective on conspiratorial searches involving, for instance, Ukraine President Zelensky, where authoritative content was sparse. Indeed, as noted by former CIA leader Jennifer Ewbank, the use of deepfakes to confuse, distort, or influence public opinion not only occurs in Ukraine but across Europe – all of which reflects “the same underlying reality: the tools for deception are faster, cheaper, and more accessible than the systems we rely on to detect or prevent them.” In other words, this is not just about deception, but the erosion of trust itself.

Storm-1516, a documented Russian disinformation operation that has been active since at least 2023, has scaled sharply in 2026. According to Bloomberg, the operation has produced more than 190 false stories since 2023 that the outlet has been able to identify. Based on Bloomberg’s reporting, Meduza adds that in the first quarter of 2026 alone, Storm-1516 was producing fake stories at twice the rate of the same period the previous year with, for instance, as of late March and early April 2026, materials appearing almost daily. Meduza also reports that more than 40 percent of Storm-1516’s fabrications have targeted Ukraine, with another third focused on electoral processes in other countries. Taken together, these reports demonstrate that Storm-1516’s operations are ultimately aimed at eroding Western support for Ukraine, swinging European elections and destabilizing NATO allies.

Taken together with the “Project 2026” leaks, these findings suggest that Russia is now attacking both the content layer (through synthetic media) and the source layer (through cloned Wikipedia‑style sites and fake think tanks) of information ecosystems. While synthetic videos and stories are often treated as short‑term deception, they also become part of the online record that future AI systems may ingest or retrieve, turning Russia’s layered influence architecture into a long‑term GEO problem, especially in data voids.

The Storm-1516 operation follows a clear pattern. A fake witness, often an AI-generated video, seeds a plausible but unverifiable story. Low-tier blogs and Telegram channels amplify it in multiple languages. Then less rigorous Western outlets pick it up, severing the link to the original Russian operator. By the time the narrative reaches mainstream discussion, the Russian fingerprint is gone. The new risk in today’s landscape is that the AI curation layer completes this laundering. It reads the now-repeated narrative across multiple sources and presents it as a neutral summary.

Researchers at the Institute for Strategic Dialogue found that the chatbot DeepSeek was quoting VT Foreign Policy, an outlet known to carry content from Russian propaganda operations such as Storm‑1516 and to have connections to the Kremlin‑linked Strategic Culture Foundation. U.S. and EU sources describe the Strategic Culture Foundation as an arm of Russian state interests.

A 2025 NewsGuard study also found ten of the leading chatbots — including ChatGPT, Claude, Gemini, and Copilot — collectively repeated false narratives from the pro-Kremlin Pravda network about a third of the time. It’s important to note that a 2025 study in the Misinformation Review, responding directly to the NewsGuard findings, found the number was closer to 5 percent and that these failures clustered in data voids. While the researchers found "little evidence to support the grooming theory" and warned against "the overhyped specter of Kremlin manipulation," they acknowledged that data voids "may be artificially created" and that they could not dismiss the possibility that a disinformation campaign could target them. Importantly, their audit came fourteen months before the leaked “Project 2026” documents showed Russia explicitly targeting AI systems. The more Russia attempts to flood these data voids, the more likely it is that future AI summaries about Ukraine will inherit its framing.

How to Build Resilience – A Way Forward

Like its older cousin SEO, GEO is inherently dual-use, but it sits in a regulatory vacuum because it is viewed strictly as a consumer protection issue rather than a national security threat. The Apollo-9 experiment and the Storm-1516 operation prove they are two sides of the same coin; the same commercial tactics that manufactured demand for a non-existent fitness tracker can easily manufacture plausibility for distorted narratives about a geopolitical crisis such as the ongoing Russia-Ukraine war. History shows that with traditional search engines, the market naturally incentivized tech companies to tackle manipulation head-on because mass spam threatened to destroy the user experience for billions of people, directly endangering corporate business models. Malicious foreign influence operations executing GEO are fundamentally different because they remain largely invisible to the mass market, with manipulation surgically clustered within obscure data voids, offering tech companies no commercial incentive to self-police and leaving the information terrain around a live European war effectively undefended.

To bridge this gap, regulators can draw on the lessons of private sector SEO defense and public-private counter-disinformation efforts, but they must realize that the exact same playbook will not work here. While private developers can easily dismiss the Misinformation Review study’s five percent finding as an acceptable commercial error margin, this minor statistical anomaly sits precisely in the data voids that Russia is actively trying to colonize, and so it represents a primary, unmonitored vector for foreign manipulation. The strategic risk is not only that GEO can mislead people in the moment, but that it can reshape the evidentiary record on which institutions and AI systems will later rely; if hostile narratives are allowed to dominate long‑tail topics and thinly documented episodes in the Russia-Ukraine war for instance, then future summaries, briefings, and even historical accounts risk being generated from polluted inputs.

The 2025 Misinformation Review study recommends "warning banners for data void queries" and increased "audit access," but notes the banners are "applied inconsistently" and the audit access is "hindered by power asymmetries.” Because the market will never self-correct a threat it does not financially register, protecting the integrity of generative content must transition from a voluntary corporate practice to a formal national security mandate.

In the Russia-Ukraine war, these dynamics are already visible. Russian operations such as Storm‑1516 use GEO‑style flooding and synthetic witnesses to launder narratives about the conflict into the broader information environment, while Ukrainian actors rely on AI‑enabled monitoring and evidentiary documentation to defend the integrity of the record. The contest is no longer confined to what populations see online today; it is over what AI systems will say is true about the war tomorrow. Recognizing GEO as a national security problem therefore changes the governance question: the training, retrieval, and ranking layers of generative systems are now part of the battlespace, and leaving this space unregulated is akin to leaving critical information infrastructure undefended.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Investing in the Next Arsenal of Democracy

America’s critical technology, maritime, infrastructure, and advanced manufacturing base is one of the clearest places where tax incentives, private capital, and national security should meet. We already know this model can work. Opportunity Zones helped drive billions of dollars into real estate, community development, and designated investment areas by giving investors a reason to move capital into places that policy makers wanted to support.

Now we should apply that same logic to the sectors that will determine America’s ability to compete, defend itself, and rebuild its industrial strength.

Recent proposals around Maritime Investment Zones point in the right direction. The basic concept is simple: use the tax code to pull private capital into shipyards, ports, vessel construction, ship repair, marine navigation, workforce development, advanced manufacturing, and the broader maritime supply chain. If tax incentives helped attract capital into real estate and community development, a similar model could help rebuild the industrial base that underpins American sea power and national resilience.

But this should not stop with physical shipyards or port infrastructure.

The next generation of American industrial power will be built across a broader ecosystem of investment funds, operating companies, manufacturing platforms, critical infrastructure projects, and technologies that strengthen national security and economic security. That means sectors like autonomy, advanced manufacturing, aerospace, maritime systems, secure communications, cybersecurity, energy resilience, critical minerals, space infrastructure, drones, counter-drone systems, AI-enabled defense tools, logistics, and domestic supply chain resilience.

Qualified investment funds focused on these sectors should be considered for Opportunity Zone-style designation. These funds can aggregate private capital, diligence complex technologies, support hard-tech companies, and bridge the gap between emerging innovation, government demand, commercial scale, and mission relevance. Many individual investors cannot properly underwrite a defense technology company, an advanced manufacturing platform, a shipyard modernization project, or a critical infrastructure asset on their own. Qualified managers can help channel capital into these areas with discipline, experience, and a better understanding of both market risk and mission need.

The same logic should apply directly to qualifying platform companies and infrastructure projects. Businesses building autonomous maritime systems, advanced airframes, resilient logistics platforms, drone manufacturing capacity, shipbuilding technologies, next-generation materials, critical infrastructure tools, and domestic production capabilities should be eligible for special designation if they are strengthening the defense industrial base, expanding U.S. production, modernizing infrastructure, or reducing dependence on adversarial supply chains.

This matters because the future of defense manufacturing and industrial power is changing.

The next phase will not only be about large legacy platforms built through traditional procurement channels. It will also be about faster, lower-cost, more scalable, more autonomous systems that can be produced domestically and integrated across a broader defense technology ecosystem.

In maritime, for example, the future will not only be larger crewed vessels. It will include autonomous naval platforms, distributed maritime nodes, unmanned surface vessels, undersea systems, AI-enabled ISR, electronic warfare, logistics support, secure communications, and integrated sensor networks. The autonomous ship is not just a vessel. It becomes a node in a distributed maritime network.

That same principle applies across the broader industrial base. The future battlefield and the future economy will demand more mass, more resilience, more autonomy, more secure infrastructure, and more ways to complicate an adversary’s targeting problem. The United States cannot afford to rely only on slow, expensive, exquisite systems while adversaries are scaling ships, drones, missiles, cyber tools, industrial capacity, and supply chains at speed.

A Maritime Prosperity Zone, Critical Technology Opportunity Zone, or National Security Investment Zone framework could help solve part of this problem by giving investors, fund sponsors, founders, manufacturers, and infrastructure operators a reason to back the companies, factories, shipyards, platforms, and projects needed to rebuild American industrial strength.

This would likely create some of the same market behavior we saw during the real estate Opportunity Zone boom of the early 2020s. Once the incentive was created, capital moved. Sponsors formed funds. Allocators searched for qualified opportunities. Developers shaped projects around the designation. Billions of dollars followed.

The same could happen in defense technology, critical infrastructure, autonomous systems, maritime manufacturing, space, energy resilience, advanced materials, and critical manufacturing.

That is the power of incentives. Investors are not charities. They respond to opportunity, yield, tax efficiency, liquidity, policy clarity, and the chance for outsized returns. That is not a weakness of capitalism. That is how capital markets work. If policy makers want private capital to help solve national problems, they need to make those problems investable.

Critics will say this gives investors generous tax treatment. That is true. But that is also the point. The government routinely uses the tax code to shape behavior. We incentivize home ownership, retirement savings, energy development, municipal finance, real estate development, and other areas deemed important to the public interest. The question is not whether investors benefit. The question is whether the country benefits enough to justify the incentive.

In this case, the answer should be yes.

A targeted national security investment incentive could drive domestic job growth, create new industries, expand the tax base, strengthen supply chains, rebuild manufacturing capacity, and reduce reliance on government-led solutions. Instead of expecting Washington to fund and manage every critical industrial requirement, the government can use tax policy to unleash private capital and let the private sector help build the capacity the country needs.

That is a better model than simply growing government. Government should identify priorities, set standards, create incentives, and provide clear demand signals. Private capital should help take risk, scale companies, build factories, support founders, finance infrastructure, and commercialize technologies. Done correctly, this becomes a force multiplier. It allows the country to pursue national security and economic security objectives without relying solely on appropriations, grants, subsidies, or bloated federal programs.

It also helps create a broader base of economic growth. A new factory, shipyard, drone production line, secure data center, advanced materials facility, or critical infrastructure project does not just create investor returns. It creates construction jobs, engineering jobs, manufacturing jobs, supplier ecosystems, logistics demand, local tax revenue, and long-term industrial capacity. These are the kinds of investments that can rebuild regional economies while strengthening national resilience.

But there is an important caution.

During the real estate Opportunity Zone boom, disciplined allocators still had to underwrite the real estate first. The asset had to make sense. The location had to make sense. The sponsor had to make sense. The tax advantage was an added benefit, not the entire investment thesis.

The same discipline must apply here.

In the current hype around defense technology and national security investing, not every company with “AI,” “autonomy,” “defense,” “resilience,” or “critical infrastructure” in its pitch deck deserves capital. The manager, deal, technology, platform, or project has to stand on its own. The tax benefit should improve the risk-reward profile, not rescue a weak investment.

Return on mission matters. But it should not replace return on capital. The best version of this policy would align both. Investors get an incentive to take risk in strategically important sectors, while the country gets more domestic production, stronger supply chains, better infrastructure, more jobs, and a deeper industrial base.

The United States does not have a shortage of capital. It has a capital alignment problem. Too much money flows into financial engineering, speculative assets, and incremental technology. Too little flows into the difficult, physical, industrial, and security-related sectors that determine whether the country can compete in a more dangerous world.

Opportunity Zones showed that tax policy can move capital. The next step is to aim that capital at the future of American power.

If we can incentivize capital to rebuild neighborhoods, we can incentivize capital to rebuild shipbuilding, critical infrastructure, advanced manufacturing, and the national security industrial base.

The goal is not to give investors a gift. The goal is to give the country a tool.

The next Opportunity Zone should be built around American resilience.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Winning the Peace: The Democratic Dilemma of Limited War

In our previous article, we argued that overwhelming military superiority no longer guarantees strategic success.

Today, military and political outcomes have become increasingly disconnected.

As Carl von Clausewitz observed, war is fought to achieve political objectives, with military force only one instrument among many in statecraft.

Modern professional militaries are exceptionally proficient at identifying and destroying adversary military capabilities. Yet, they remain far less able to reshape the political, ideological, and social foundations that sustain an adversary's resilience.

The challenge confronting modern democracies is therefore not simply winning wars, but achieving what might be termed strategic translation—the successful conversion of military success into enduring political outcomes.

This predicament of strategic translation has intensified in recent years.

Operations involving Iran, Ukraine, and Gaza have once again raised questions about whether military success alone can produce durable political outcomes, echoing debates that followed the conflicts in Iraq and Afghanistan.

Strategic rivals such as Russia and China have closely monitored these outcomes, adjusting their own strategies to exploit the gap between military supremacy and political consolidation discussed in this article.

The inability to translate military victory into a long-term political settlement has evolved from a tactical issue to a defining test of democratic strategic competency as information flows quicken and domestic audiences examine protracted wars in real time.

Democratic Institutions: Competing Cultures

The principal obstacle facing democratic societies is not a lack of military capability but the complexity of democratic governance itself.

Political authority is intentionally dispersed among elected governments, legislatures and independent public institutions, each possessing different responsibilities and professional cultures. While this diffusion safeguards liberty and accountability, it complicates the integration of national strategy.

Military power achieves its greatest strategic effect only when synchronised with diplomacy, intelligence, economic statecraft and political engagement.

Yet democratic institutions frequently develop these capabilities in parallel rather than as a unified enterprise. Foreign affairs, defence, treasury and justice each define success differently, compete for resources and optimise their own organisational objectives.

Ironically, modern armed forces have become increasingly network-centric, integrating intelligence, logistics, cyber, space and operational planning within a single command framework. Governments, however, largely remain vertically organised.

Democracies have therefore become highly proficient at conducting limited tactical military campaigns while remaining less effective at integrating the broader instruments of national power necessary to convert battlefield success into enduring strategic advantage.

Selling Grand Strategy to Democratic Societies

Developing grand strategy is only half the challenge.

Democratic governments must also sustain public support over time. Unlike authoritarian systems, they must continually justify long-term strategic investment to electorates whose immediate concerns are economic security, healthcare, education and the cost of living.

Electoral competition naturally encourages governments to emphasise visible achievements—military operations, defence acquisitions, and capability announcements—rather than articulating the long-term political objectives these activities are meant to achieve.

Public debate therefore becomes centred on operations rather than strategy.

Without a compelling strategic narrative, public confidence gradually becomes tied to individual events rather than broader national objectives.

Procurement controversies, budget debates, and political disagreements increasingly dominate public discourse, making defence appear as a collection of expensive projects rather than as one component of an integrated national strategy.

Grand strategy that cannot be communicated to democratic societies cannot be sustained by democratic societies.

Democratic Time versus Strategic Time

Winning in combat requires strategic focus, but democratic politics inherently operates on short attention spans as highlighted by researchers in RAND Corporation. Electoral cycles, typically lasting two to five years, create strong incentives for governments to prioritise immediate, visible achievements over the sustained political, diplomatic, and institutional investments required to build long-term national power, as the UK Parliament's House of Commons Public Administration Committee has provided detailed structural barrier on this.

In coalition governments, differing party priorities and narrow parliamentary majorities can further complicate strategic continuity, encouraging short-term political compromise over long-term policy consistency.

The twenty-four-hour news cycle and social media amplify these pressures by encouraging governments to respond rapidly to headlines and shifts in public opinion, often elevating short-term tactical developments over long-term strategic objectives.

A single controversy, whether involving procurement, diplomacy or battlefield casualties, can dominate public debate and increase pressure for policy adjustments that disrupt strategic continuity.

This tension between political urgency and strategic reality was perhaps most evident in Afghanistan.

Throughout that conflict, successive US administrations increasingly balanced military objectives against domestic political pressures, with troop deployments and withdrawal decisions becoming closely linked to electoral cycles and public opinion.

President Obama's 2009 troop surge, while designed to reverse Taliban momentum, was accompanied by a July 2011 timetable for the start of withdrawal, signalling that the United States' commitment was not open-ended.

More than a decade later, the 2020 Doha Agreement established a fixed timeline for withdrawal despite persistent concerns over the readiness of Afghan security forces and the absence of a comprehensive political settlement.

In both cases, strategic decisions became increasingly shaped by political timelines, illustrating how democratic governments can struggle to align long-term national objectives with short-term domestic pressures.

Among NATO allies, these pressures were further compounded by divergent domestic political calendars and national priorities. France, for example, withdrew its combat forces in 2012 following President Hollande's election pledge, while Canada and several allies imposed national caveats that restricted how and where their troops could operate. NATO summits in Riga (2006) and Lisbon (2010) exposed persistent disagreements over troop contributions, burden-sharing and operational commitments, reflecting domestic political constraints as much as collective strategic planning.

As political priorities shifted across allied capitals, long-term strategic coherence became increasingly difficult to sustain.

Without stronger institutional continuity and bipartisan commitment, democratic grand strategy risks becoming reactive, fragmented and ultimately unable to translate military success into enduring political outcomes.

Winning the Peace Requires Political Campaign Design

If democracies are to prevail in limited wars, they must plan for peace before the first military operation begins.

Military campaigns should never exist independently of political campaigns. Governance, justice, policing, economic recovery, institution-building, and strategic communications must be integrated from the outset, rather than improvised after battlefield success.

Repeated strategic frustration also carries risks for democracy itself.

Failure to improve strategic integration may encourage growing calls for more centralised executive authority, expanded emergency powers and greater restrictions on civil liberties in the name of national security.

Democracies should resist this temptation.

Instead, democracies should strengthen institutions capable of ensuring long-term strategic continuity while remaining firmly accountable to constitutional government.

One possibility would be an independent National Strategy Commission, bringing together diplomatic, military, economic and informational expertise to preserve institutional memory and support integrated strategic planning across successive governments.

Conclusion

Democracies do not need to lose their democratic character in order to become more strategically effective.

Authoritarian systems maintain continuity through control, whereas democracies must maintain it through design.

Instead, the task is to create long-lasting institutions, such as an independent National Strategy Commission, that can sustain strategic memory across changing governments without consolidating authority or undermining accountability.

This requires achieving cross-party consensus on essential national goals and integrating diplomatic, military, economic, and informational tools from the outset, rather than improvising after victory.

Failure results in continued frustration and increasing demands for concentrated power.

In a period of limited conflict, success will be defined not just by battlefield successes, but also by long-term political effects.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

America Needs a New North Korea Strategy

North Korea is strategically closer to Russia and China than any time since the Korean War, while the U.S. does nothing to challenge the growing power of the Axis of Authoritarians (China, Russia, Iran, and North Korea). The irony is that North Korea has, since 1994, wanted a normal relationship with the U.S., yet the U.S. appears incapable of addressing the North Korean nuclear threat.

On July 19, 2026, North Korean Foreign Minister Choe Son Hui met with Russian President Vladimir Putin in Moscow and declared that North Korea “stands by Moscow until victory in the war with Ukraine is achieved. Ties with Russia are a strategic priority for Pyongyang.” I’ve worked with Ms. Choe, a fluent English speaker, from 2003 to 2016, and know she –and others – would prefer dialoguing with the U.S.

And from July 10 to 12, 2026, North Korean Premier Pak Thae Song was in Beijing meeting with Wang Huning, Chairman of the National Committee of the Chinese People’s Political Consultative Conference, the fourth highest member of the Politburo Bureau Standing Committee of the Chinese Communist Party, for the 65^th anniversary of China’s defense treaty with North Korea – The Treaty of Friendship, Cooperation and Mutual Defense.

The visit of North Korean leader Kim Jong Un to Beijing in September 2025 to meet with Chinese President Xi Jinping and participate in the Victory Day parade with Mr. Xi and Mr. Putin, followed by the June 2026, visit of Mr. Xi to North Korea for a state visit are clear indicators that North Korea is working hard to improve relations with China, while maintaining a close military relationship with Russia.

Russia reportedly is asking for another 30,000 troops and ballistic missile launchers from North Korea. The additional North Korean troops would reinforce frontline operations, doubling previous deployment estimates. This, while North Korea prepares to transfer new ballistic missile launches to Russia. The deepening military cooperation with Russia, pursuant to the 2024 mutual defense pact between Russia and North Korea, is not only a growing threat to Ukraine but, also, to the nations in Asia within range of North Korean missiles.

I have written often in this column about Norea’s growing arsenal of nuclear weapons – over 100 by 2030 – and the sophistication of their ballistic missiles, especially the long-range missiles – Hwasong 15, 17,18,19 and 20 – all capable of targeting the U.S. and their progress with short-range missiles that can target South Korea and Japan. Recently, we talked about progress with nuclear-powered submarines, but we didn’t discuss the progress North Korea is making with establishing a nuclear triad – land, sea and air-based nuclear weapons. And with Russia’s assistance, this is achievable in the not-too-distant future.

What are we doing to address this real and expanding threat? We’re watching the Axis of Authoritarian States become more united and seemingly forgetting that since 1994 North Korea wanted a normal relationship with the U.S. (The Agreed Framework); in September 2005 with the Six Party Talks Joint Statement and the historic June 2018 Singapore Summit of President Donald Trump with Chairman Kim Jong Un. Since then, and after the failed February 2019 failed Hanoi Summit and the June 2019 symbolic DMZ meeting, there were no further substantive developments with North Korea.

Since 2020, our failed policy of “strategic Patience” kicked in and we’ve seen North Korea exponentially increase its arsenal of nuclear weapons and ballistic missiles, while embracing Russia with a Mutual Defense Treaty and military assistance to Russia for its invasion of and war with Ukraine.

It’s time for the U.S., with support from its allies in South Korea and Japan, to decide if we want a normal relationship with North Korea; a relationship that will weaken the Axis of Authoritarian States, or if we want to persist with a “do-nothing” policy toward North Korea.

And if we want to do something, that means de facto recognition of North Korea as a nuclear weapons state – a reality we can’t deny – and entering into negotiators with Pyongyang to get North Korea to stop building more nuclear weapons and ballistic missiles in exchange for the lifting of sanctions, economic development assistance and a path to normal bilateral relations.

It’s time to address the North Korean nuclear threat.

The author is the former Special Envoy for Six Party Talks negotiations with North Korea (2003-2006) and the former Associate Director of National Intelligence. All statements of fact, opinion or analysis expressed are those of the author and do not reflect the official positions or views of the U.S. government.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

I just want to read the news

Get the news and only the news!

Guardian

Back to top

Kaupunki

Back to top

Yle

Back to top

CNN

Back to top

Hesari

Back to top

Al Jazeera

Back to top

New York Times

Back to top

Reuters

Back to top

NPR

Back to top

The Cipher Brief

Norman T. Roule

Back to top