//
OFFLINE — VIEWING CACHED CONTENT
← Back to Archive

IC BRIEF

Current as of 1800 EDT (UTC-04), Wednesday 25 March 2026

Contents

6 stories from 7 sources across 7 organizations

BOTTOM LINE UP FRONT

Cybersecurity and Infrastructure Security Agency (CISA) Acting Director Andersen testified March 25 that 60% of the agency is furloughed and six threat hunters resigned in a single day, while Department of Homeland Security (DHS) approved 329 mission-critical hires in a sharp policy reversal. The Anthropic supply chain risk case heads toward a ruling this week, with broad industry amicus support and a skeptical judge signaling the designation may not survive.

Russia-Iran intelligence sharing continues to escalate: CIA Director Ratcliffe confirmed Iran is seeking signals intelligence from Moscow and Beijing, while Zelenskyy accused Russia of attempting to blackmail the US by offering to halt intel to Tehran in exchange for cutting Ukraine off from US intelligence. NSA and Five Eyes partners released joint guidance on Low-Earth Orbit (LEO) satellite vulnerabilities, reflecting wartime urgency in the space domain.

Leadership & Organization

CISA Acting Director Warns DHS Shutdown Creating Accumulating Cyber Risk; Six Threat Hunters Resign in One Day

CISA Acting Director Nick Andersen testified before the House Homeland Security Committee on March 25 that risks are "accumulating across the system" due to the DHS shutdown, now in its 40th day. Andersen reported 60% of CISA workforce is furloughed, 1,000 positions are vacant, and six members of a specialized threat hunting and incident response team resigned in a single day. The agency is restricted to responding to immediate threats and maintaining its 24/7 operations center, with proactive assessments, coordinated planning, and partnership engagement paused. Andersen warned the shutdown will create "downstream impacts" on future recruitment, compounding retention losses during active Iranian cyber threats.

Analyst Note: Prior IC Brief reported CISA at 33% capacity; today Andersen testified it has risen to 38% through excepted personnel designations, but six specialized threat hunters resigning in one day signals the shutdown damage is deepening rather than stabilizing. The 329-hire approval and Maxiflex reinstatement represent a policy reversal, but cannot execute while two-thirds of staff remain furloughed. The timing, during active Iranian cyber campaigns against US critical infrastructure, compounds the operational risk.

Sources:

Watch Items - DHS shutdown deal expected before congressional recess; watch for CISA funding restoration timeline - Gabbard IQT oversight shift decision; could reshape IC technology scouting - Mullin first public directive as DHS Secretary on shutdown priorities

Operations & Intelligence Failures

Zelenskyy Accuses Russia of Sharing Signals Intelligence with Iran; CIA Director Confirms Tehran Seeking Help from Moscow and Beijing

Ukrainian President Volodymyr Zelenskyy accused Russia of providing signals intelligence and electronic intelligence to Iran to prolong the Middle East conflict, claiming Ukraine military intelligence has irrefutable evidence. Zelenskyy alleged Russia offered to stop sharing intelligence with Iran if the US would cut intelligence support to Ukraine, characterizing the proposal as blackmail. CIA Director John Ratcliffe told Congress that Iran has sought intelligence assistance from Russia, China, and other adversaries, declining to confirm publicly whether Moscow had provided the requested information. Russia denied the allegations, with Kremlin spokesman Dmitry Peskov dismissing them as false.

Analyst Note: Zelenskyy framing of the Russia-Iran intelligence link as blackmail is strategically significant: it positions Ukraine as a stakeholder in the US-Iran conflict and creates political costs for any US consideration of the Russian offer. Ratcliffe confirmation that Iran is seeking intelligence from Russia and China represents the first public CIA acknowledgment that the conflict has become a multi-party intelligence competition, not a bilateral US-Iran affair.

Sources:

Prior Reporting - [Ukraine has 'irrefutable evidence' of Russia providing intelligence to Iran, Zelensky says](https://kyivindependent.com/ukraine-has-irrefutable-evidence-of-russia-providing-intelligence-to-iran-zelensky-says/) (2026-03-23)
Watch Items - NORTHCOM attribution findings on Barksdale drone incursions; any Iran or foreign actor linkage - Ratcliffe classified briefing on Russia-Iran intelligence cooperation - DIA post-mortem on Minab school strike intelligence failure

Congressional Oversight & Policy

HPSCI Votes to Release Classified 2019 Transcripts of Former IC Inspector General Atkinson

The House Permanent Select Committee on Intelligence voted March 24 to release two transcripts from classified 2019 hearings with former Intelligence Community Inspector General Michael Atkinson. One transcript will undergo Office of the Director of National Intelligence (ODNI) classification review before public release; the second unclassified transcript will be released directly. Chairman Crawford stated the vote reflects the American peoples complete and warranted mistrust of the Intelligence Community, framing the release as part of ongoing accountability efforts into the handling of the 2019 whistleblower complaint that led to the first Trump impeachment proceedings. Atkinson was fired by Trump in April 2020 for forwarding the complaint to Congress.

Analyst Note: Chairman Crawford framing this as evidence of IC mistrust, rather than oversight of the IC, signals the transcript release is part of a broader effort to delegitimize the Intelligence Community Inspector General (ICIG) whistleblower pathway that Atkinson used. The ODNI classification review could take weeks or months, during which the political narrative around the transcripts will be shaped without public access to the actual content.

Sources:

Tech Industry Files Broad Amicus Support for Anthropic as Judge Signals Ruling This Week on Pentagon Supply Chain Designation

Microsoft, OpenAI employees, Google DeepMind engineers, and multiple think tanks filed amicus briefs supporting Anthropic in its challenge to the Pentagon supply chain risk designation, the first time such a designation has been applied to a domestic company. U.S. District Judge Rita Lin called the government conduct troubling and questioned why the Pentagon could not simply stop using Claude rather than applying a designation reserved for foreign adversaries. Al Jazeera reported legal analysts believe the case could create momentum for AI weapons policy development before the 2026 midterm elections. Lin asked both sides to file additional evidence by Wednesday and indicated she would rule before end of week. The ruling directly affects Maven targeting operations currently using Claude AI.

Analyst Note: The breadth of industry amicus support, including from Anthropic competitors Microsoft and OpenAI employees, suggests the defense technology sector views the supply chain designation as a precedent threat to any AI company that imposes use restrictions. If Judge Lin issues a preliminary injunction, the Pentagon faces an immediate operational question: Maven runs on Claude with Impact Level 6 (IL-6) accreditation, and there is no drop-in replacement at that classification level.

Sources:

FBI Director Patel Declines to Stop Warrantless Purchase of Americans Location Data; 130 Groups Urge FISA Fix

FBI Director Kash Patel declined at a Senate hearing to commit to stopping the FBI purchase of Americans cell phone location data from commercial data brokers, stating the FBI uses all tools and purchases commercially available information consistent with the Constitution. The NPR investigation, published March 25, documented that FBI, DOD, and ICE maintain contracts for tools relying on cell phone location data sourced from data brokers, bypassing warrant requirements. Some 130 civil society organizations signed a letter urging Congress to close the data broker loophole in the upcoming FISA Section 702 reauthorization, citing unprecedented expansion of warrantless mass surveillance combined with AI-powered surveillance capabilities.

Analyst Note: Patel statement that the FBI uses all tools including commercial data purchases directly contradicts the privacy reforms Congress intended in FISA 702 reauthorization. The 130-organization letter to close the data broker loophole gains urgency with 26 days to the Section 702 sunset, but the Safeguard American Voter Eligibility Act (SAVE Act) poison pill and conservative revolt make legislative action before April 20 increasingly unlikely.

Sources:

Watch Items - Judge Lin ruling on Anthropic supply chain designation expected by end of week - FISA 702 expiration April 20; any HPSCI or SSCI markup announcement - ODNI classification review of Atkinson transcripts; timeline for public release

Technology & OSINT

NSA and Five Eyes Allies Issue Joint Advisory Warning of Expanding Cyber Attack Surface in LEO Satellite Constellations

The NSA joined Australia Signals Directorate, Canadian Centre for Cyber Security, New Zealand NCSC, and Australian Space Agency in releasing a cybersecurity information sheet titled Securing Space: Cyber Security for Low Earth Orbit Satellite Communications. The advisory warns that growing LEO constellations are expanding the attack surface for malicious cyber actors, with systems vulnerable to jamming, spoofing, and interception due to distributed architecture and reliance on radio frequency links. The agencies identified risk vectors spanning satellites, ground stations, user terminals, communication links, and supply chains. The guidance is significant as LEO Satellite Communications (SATCOM) systems increasingly underpin national security communications and emergency response capabilities.

Analyst Note: The Five Eyes joint advisory reflects wartime urgency: LEO SATCOM constellations increasingly serve as backup communications for military and emergency services when terrestrial infrastructure is degraded. The advisory timing, amid active GPS spoofing and jamming in the Persian Gulf, suggests NSA has observed or anticipates adversary cyber operations targeting these specific systems.

Sources:

Watch Items - Follow-on Five Eyes advisories on specific LEO SATCOM threat actors - Maven operational impact if Anthropic ruling forces Claude removal from IL-6 environments

COLLECTION GAPS

UNCLASSIFIED // OPEN SOURCE