//
OFFLINE — VIEWING CACHED CONTENT
← Back to Archive

IC BRIEF — 22 March 2026

Current as of 1228 EDT (UTC-4), Sunday 22 March 2026

Contents

7 stories from 10 sources across 10 organizations

BOTTOM LINE UP FRONT

The IC's credibility gap on Iran widened this weekend as SpyTalk and Salon documented how Director of National Intelligence (DNI) Gabbard and the White House are publicly dismissing pre-war intelligence assessments that predicted exactly the retaliatory scenario now unfolding. CIA and Mossad remain unable to confirm whether Iran's new Supreme Leader Mojtaba Khamenei is actually exercising command authority after failing to appear for Nowruz, raising the possibility the Islamic Revolutionary Guard Corps (IRGC) is running the country without civilian oversight.

On the counterintelligence front, FBI and CISA issued a joint alert revealing Russian intelligence services have compromised thousands of Signal and WhatsApp accounts belonging to U.S. officials, military personnel, and journalists through social engineering, not cryptographic exploitation. Separately, DOJ charged three individuals in a $2.5 billion AI server diversion scheme to China, the largest such case by dollar value.

Section 702 reauthorization remains stalled with 29 days until expiration, the National Counterterrorism Center (NCTC) directorship is vacant, and the 2026 threat assessment's unprecedented omission of foreign election interference has drawn sharp bipartisan criticism. Treasury Secretary Bessent claimed Sunday the U.S. has 'plenty of money' for the Iran war while the $200B supplemental request faces growing congressional resistance.

Leadership & Organization

DNI Gabbard's Iran Pivot Exposes Deep Contradictions Between Past Anti-War Stance and Current Posture

DNI Gabbard, who campaigned on 'No War With Iran' and sold branded merchandise to that effect, is now publicly supporting the administration's military action. Trump claimed to be shocked by Iran's retaliatory strikes despite multiple prior IC warnings, widening the gap between the president and his agencies. In March 18-19 Senate Select Committee on Intelligence (SSCI)/House Permanent Select Committee on Intelligence (HPSCI) testimony, Gabbard distanced herself from IC assessments that Iran posed no imminent nuclear threat, instead echoing Trump's claims about obliterated enrichment capacity. Sources describe Gabbard as 'sidelined' from substantive decision-making; the NCTC directorship remains vacant five days after Kent's resignation.

Analyst Note: Today's PDB reported CENTCOM claiming Day 23 as the largest naval elimination since WWII with 8,000+ targets struck. SpyTalk's reporting that Trump was 'shocked' by Iran's retaliation directly contradicts the IC's pre-war National Intelligence Council (NIC) assessment (leaked March 9) which predicted exactly this scenario, suggesting intelligence was available but not heeded at the principal level.

Sources:

CIA and Mossad Search for Signs of Iran's New Supreme Leader as Mojtaba Khamenei Remains Unseen

CIA, Mossad, and allied intelligence agencies are intensely monitoring for signs of Iran's new Supreme Leader Mojtaba Khamenei, who has not appeared publicly since being declared successor to his father on March 9. Intelligence agencies watched Nowruz on March 21 expecting a traditional video address; only a written statement was issued, deepening uncertainty. Defense Secretary Hegseth has claimed Mojtaba was 'wounded and likely disfigured' in the strike that killed his father, but U.S. and Israeli intelligence suggests he remains alive based on evidence of Iranian officials attempting to schedule in-person meetings with him. A U.S. official said the intelligence community cannot confirm whether Mojtaba is actually exercising command authority, raising the possibility the IRGC may be running the country.

Analyst Note: Today's PDB reported Iran conducting mass executions amid the war and Iranian missiles penetrating Israeli air defenses near Dimona. If the IRGC is effectively governing without a functioning supreme leader, the IC's pre-war assessment that the regime would maintain 'continuity of power' is technically correct but functionally misleading; power may have shifted from clerical to military hands.

Sources:

Watch Items - NCTC director replacement nomination: no successor announced 5 days after Kent resignation - DNI Gabbard role in Situation Room: monitor whether she is included in next principals committee meeting on Iran - CIA Director Ratcliffe's Havana Syndrome review: retraction of 2023 ICA could come this week

Operations & Intelligence Failures

FBI and CISA Issue Joint Alert on Russian Intelligence Phishing Campaign Compromising Thousands of Signal and WhatsApp Accounts

Russian Intelligence Services (RIS) are conducting a global phishing campaign against Signal, WhatsApp, and other encrypted messaging platforms, compromising thousands of accounts. Primary targets: current and former U.S. government officials, military personnel, political figures, and journalists. Attack vector is social engineering, tricking users into sharing verification codes or PINs, not cryptographic exploitation. Once compromised, actors read messages, harvest contact lists, and launch secondary phishing from trusted identities.

Analyst Note: Today's PDB covered the same Russian phishing campaign from a cybersecurity angle. The IC-specific concern is that compromised accounts of current and former government officials could yield operational intelligence, contact networks, and material for secondary targeting, particularly dangerous given the 200,000+ federal employees who have departed their roles and may have relaxed security postures.

Sources:

Three Charged with Conspiring to Divert $2.5 Billion in AI Servers from U.S. to China

DOJ charged three individuals, Shyan Liaw (U.S. citizen), Ruei-Tsang Chang, and Ting-Wei Sun (both Taiwanese citizens), with conspiring to divert $2.5 billion in high-performance AI servers to China between 2024-2025 using false documentation. Liaw and Sun arrested. The case is the largest AI technology diversion prosecution by dollar value and illustrates the scale of illicit compute transfer that the 2026 threat assessment flagged as a top counterintelligence concern under the China technology competition heading.

Sources:

Watch Items - Russian Signal phishing campaign: monitor for reports of compromised IC personnel accounts specifically - China AI server diversion: watch for additional indictments or seizures in export control enforcement - FBI CI-12 unit reconstitution: no reporting on whether gutted Iran counterintelligence capacity has been rebuilt

Congressional Oversight & Policy

Treasury Secretary Claims 'Plenty of Money' for Iran War as $200B Supplemental Request Splits Congress

Treasury Secretary Bessent claimed March 22 that the U.S. has 'plenty of money' for the Iran war while the Pentagon seeks a $200 billion supplemental, four times the original estimate. At the Day 1-6 burn rate of $1.88B/day, this funds roughly 106 days of operations. Bipartisan resistance is mounting; even Republican members question funding a war without formal Authorization for Use of Military Force (AUMF). IC testimony undercut the war's stated rationale: Gabbard told SSCI that Iran could only 'begin to develop' an Intercontinental Ballistic Missile (ICBM) before 2035, directly contradicting the administration's urgency framing.

Analyst Note: Today's PDB reported the Pentagon preparing ground force options including Kharg Island seizure with 82nd Airborne and three Marine units deploying. The $200B supplemental and ground escalation planning suggest a longer conflict than originally presented to Congress, consistent with the pre-war NIC assessment that neither limited nor prolonged campaigns would achieve regime change.

Sources:

2026 Threat Assessment Omits Foreign Election Interference for First Time in Nearly a Decade

The 2026 Annual Threat Assessment omits foreign election threats for the first time since 2017, breaking from years of IC findings that Russia, China, and Iran actively targeted U.S. elections. Gabbard told SSCI the IC has found 'no foreign threats' to November's midterms. Warner challenged this, noting the committee's briefing requests have gone unanswered. The omission is compounded by CISA operating at 38% staffing with its Election Security Program eliminated under the DHS shutdown.

Sources:

Watch Items - FISA Section 702 expiration in 29 days (April 20): House vote timeline remains unclear after GOP leadership punted to April - Iran war supplemental markup: watch for House Appropriations Committee scheduling on the $200B request - SSCI response to threat assessment election interference omission: Warner has demanded classified briefings

Technology & OSINT

Court Filing Reveals Pentagon Told Anthropic Sides Were 'Nearly Aligned' Before Supply Chain Risk Designation

Anthropic filed sworn declarations in California federal court challenging its 'unacceptable risk to national security' designation. Key revelation: on March 4, the day after the Pentagon finalized the supply-chain risk label, Under Secretary Michael emailed CEO Amodei saying the two sides were 'very close' on the disputed issues, autonomous weapons and mass surveillance of Americans. Michael publicly denied any active negotiations one day later. The government's case rests on the claim that Anthropic's ethical red lines could lead it to disable its technology during military operations. Judge Rita Lin hears the preliminary injunction March 24.

Analyst Note: Today's PDB reported Claude overtaking ChatGPT in market share after the Pentagon ethics clash, framing Anthropic's refusal as a competitive advantage. The court filing's revelation that the Pentagon was privately 'nearly aligned' while publicly branding Anthropic a security risk suggests the designation may have been politically rather than operationally motivated, a distinction the March 24 hearing will likely probe.

Sources:

Watch Items - Anthropic v. Pentagon preliminary injunction hearing: Judge Rita Lin, March 24 in San Francisco - Pentagon classified AI training initiative: watch for formal policy announcement on allowing AI models to train on classified data

COLLECTION GAPS

UNCLASSIFIED // OPEN SOURCE