//
OFFLINE — VIEWING CACHED CONTENT
← Back to Archive

IC BRIEF

Current as of 1923 EDT (UTC-04), Thursday 26 March 2026

Contents

10 stories from 29 sources across 27 organizations

BOTTOM LINE UP FRONT

The Department of Homeland Security (DHS) shutdown entered its 41st day with Cybersecurity and Infrastructure Security Agency (CISA) at 38% operational capacity, six threat hunters resigning in a single day, and Acting Director Andersen warning Congress the compounding risk will cause real damage, the most explicit admission yet that IC-adjacent cyber defense is degrading in real time.

On the congressional front, House Permanent Select Committee on Intelligence (HPSCI) released hidden 2019 Intelligence Community Inspector General (ICIG) Atkinson transcripts while Director of National Intelligence (DNI) Gabbard moved to declassify a Sensitive Compartmented Information Facility (SCIF)-restricted impeachment-era document, and a bipartisan bloc introduced the only bicameral FISA 702 reform bill 25 days before expiration. FBI Director Patel faces scrutiny on multiple fronts: a former National Counterterrorism Center (NCTC) director alleging he blocked a foreign angle in Kirk's assassination investigation, and newly released subpoenas showing the Smith probe sought two years of his phone and financial records.

Four former NSA directors publicly warned at RSA Conference (RSAC) 2026 that the U.S. has become numb to cyberattacks and is losing its offensive edge, while the federal boycott of the same conference severed the primary public-private threat intelligence sharing channel.

FBI Leadership & Accountability

Former NCTC Director Kent Alleges FBI Director Patel Blocked Investigation of Foreign Angle in Kirk Assassination

Former National Counterterrorism Center Director Joe Kent, who resigned March 17 over opposition to U.S. military strikes on Iran, alleged in a March 25 Daily Caller exclusive that FBI Director Kash Patel directly ordered his team to stop investigating a possible foreign intelligence angle in Charlie Kirk's assassination case. Kent said Patel blocked NCTC access to FBI case files over concern that intelligence community review could generate discoverable material for suspected shooter Tyler Robinson's defense team. Kent clarified he does not claim proof of foreign involvement but said leads, including individuals who appeared to post about Kirk's killing before it happened at Utah Valley University in September 2025, were not fully pursued, and that he would testify for the defense if called. Patel had stated on X in September 2025 that the FBI investigation is 'thorough and exhaustive, pursuing every lead to its conclusion'; when the New York Times first reported the Kent-Patel rift in October 2025, an FBI source told Fox News the dispute was 'exaggerated.' Kent is separately under FBI investigation, predating his resignation, for allegedly leaking classified information.

Analyst Note: Two independent primary sources present directly contradictory accounts: Kent, in a Daily Caller exclusive, alleges Patel ordered his team to stop investigating foreign leads, while Patel's own September 2025 statement on X asserts the investigation is 'thorough and exhaustive, pursuing every lead to its conclusion.' Kent's credibility as a source is complicated; he resigned over policy disagreements with the administration and is separately under FBI investigation for leaking classified information, giving both sides motive to discredit the other. The Fox News report obtaining its own FBI source to characterize the rift as 'exaggerated' adds a third independent data point but comes from within the institution Kent is accusing.

Sources:

Prior Reporting - [Joe Kent Says FBI Director Kash Patel Blocked Further Investigation Into Charlie Kirk Murder Case](https://dailycaller.com/2026/03/25/joe-kent-fbi-director-kash-patel-blocked-investigation-charlie-kirk-murder-case/) (2026-03-25) - [FBI source disputes Charlie Kirk investigation rift after report of tension between agencies](https://www.foxnews.com/us/fbi-source-pushes-back-report-internal-rift-over-charlie-kirk-case-files) (2026-03-25) - [FBI Blocked Probe Into Possible Foreign Role in Charlie Kirk Assassination, Says Joe Kent](https://thenewamerican.com/us/crime/fbi-blocked-probe-into-possible-foreign-element-of-charlie-kirk-assassination-joe-kent/) (2026-03-25)

FBI Indicts Siblings in IED Plot at MacDill Air Force Base; One Suspect Fled to China

A federal grand jury indicted Alen Zheng, 20, and Ann Mary Zheng, 27, for an Improvised Explosive Device (IED) planted near MacDill Air Force Base's visitor center on March 10 that went undiscovered for six days until an airman found it March 16. Alen Zheng allegedly called 911 after planting the device, stating a bomb was present but refusing to provide the exact location; investigators traced the call to a burner phone purchased at Best Buy and recovered IED components from his home. Both siblings fled to China on March 12; Ann Mary returned and was arrested at Detroit airport March 17, facing up to 30 years for allegedly destroying a vehicle to obstruct the investigation. Prosecutors stated there is no immediate evidence Alen Zheng was acting on behalf of the Chinese government or any foreign power.

Analyst Note: Three listed sources, Newsweek's independent reporting plus syndicated wire coverage carried by WRGA and WCHS-TV, corroborate the core facts and align with broader independent reporting from ABC News, Tampa Bay Times, Fox News, and WUSF, all drawing from the same federal indictment and FBI press conference. MacDill hosts CENTCOM directing Operation Epic Fury; a professional-grade IED that sat undetected for six days at the installation's visitor center raises force protection questions during active wartime operations. The primary suspect's flight to China will test Beijing's willingness to cooperate with U.S. law enforcement, though prosecutors have stressed no evidence of foreign government direction. That distinction will determine whether this tracks as domestic extremism or a potential state-nexus case.

Sources:

Subpoenas Reveal Special Counsel Sought Two Years of FBI Director Patels Phone Records and Financial Data

Newly released grand jury subpoenas show Special Counsel Jack Smith's Arctic Frost investigation of Kash Patel was more extensive than previously reported, with two Verizon subpoenas seeking phone records, text message metadata, IP addresses, and bank account information spanning October 2020 through early 2023. Court-authorized nondisclosure orders prevented Verizon from notifying Patel of the data collection. Republican Senators Grassley, Johnson, and Cruz released the documents ahead of a subcommittee hearing titled Arctic Frost: A Modern Watergate, which also revealed Smith's team sought private communications data on 14 Republican members of Congress in connection with the January 6 and classified documents probes. FBI spokesman Ben Williamson said the records show the FBI under prior leadership was weaponized in ways the American people are only now beginning to fully grasp.

Analyst Note: Multiple independent outlets corroborate this story based on the same primary documents released by the Senate Judiciary Committee on March 24, with Reuters filing an exclusive wire report and Fox News, Newsweek, Washington Examiner, and several other outlets producing original reporting from the released subpoenas. The subpoena date ranges, October 2020 through early 2023, cover Patel's tenure as acting SecDef chief of staff, his time as a private citizen advising Trump, and the period of the Mar-a-Lago classified documents investigation, making the investigative scope broader than any single case. Major legacy outlets including the New York Times, Washington Post, CNN, and AP had not published coverage as of March 26, creating a partisan skew in the reporting ecosystem that warrants monitoring for whether broader coverage introduces contested framing.

Sources:

Watch Items - Alen Zheng's extradition: whether DOJ pursues Interpol red notice or Chinese cooperation - Any additional Kent-Patel public exchanges on Kirk investigation's foreign angle - Senate subcommittee follow-up on Arctic Frost investigation records

IC Workforce & Operational Posture

DHS Shutdown Day 41: CISA at 38% Staffing While TSA Callout Rates Surge to 25-38% at Major Airports

The DHS partial shutdown entered its 41st day with CISA operating at 38% staffing and 1,000 vacancies. Transportation Security Administration (TSA) officer callout rates surged to 25-38% at JFK, ATL, and IAH, forcing lane consolidations and threatening small airport closures. Over 450 TSA officers have resigned since mid-February. The Senate held a test vote on DHS funding as Democrats weighed a GOP offer. DHS headquarters approved CISA's critical hire list of 329 mission-critical positions, announced by Acting CISA Director Nick Andersen on March 23. CISA's acting chief warned the shutdown is increasing cyber risks and causing irreversible retention damage as the agency remains in a reactive-only posture.

Analyst Note: Four independent primary sources (CBS News, MeriTalk, Axios, AirlineGeeks) converge on the core staffing figures: CISA at 38% capacity with ~1,000 vacancies, TSA resignations exceeding 450, and major-airport callout rates above one-third. DHS data reported via Axios and corroborated by AirlineGeeks places actual callout rates at JFK, ATL, and IAH closer to 37-42% on peak days (March 22), slightly above the briefing's stated 25-38% range; the lower bound appears drawn from airports like PIT and PHL rather than the three named hubs. The six-in-one-day threat hunter departures, sourced from Andersen's March 25 House Homeland Security Committee testimony covered by MeriTalk, represent an irreplaceable loss in nation-state intrusion detection capability with a 12-18 month reconstitution timeline. The approved 329-position critical hire list is a positive signal but does not offset the retention hemorrhage while the shutdown persists and two-thirds of the workforce remains furloughed.

Sources:

CISA Acting Director Warns Congress Compounding Risk Will Cause Real Damage as Six Threat Hunters Resign in Single Day

CISA Acting Director Nick Andersen testified to Congress March 26 that the DHS shutdown is creating compounding systemic risk, warning that at some point the dynamic threat landscape is going to cause real damage to the American people. He disclosed that six members of a highly technical threat hunting and incident response team submitted their resignations in a single day. The agency has delayed binding operational directives, reduced coordination with industry partners, and constrained incident response capacity. Andersen flagged specific risks ahead of America 250 and the FIFA World Cup, noting that 60% of the workforce remains furloughed with 1,000 vacancies. The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) cyber incident reporting final rule, originally due in May, will likely be further delayed.

Analyst Note: Three independent outlets, MeriTalk, SC Media, and BankInfoSecurity, each covered Andersen's House Homeland Security Committee testimony and corroborate the same workforce figures, resignation details, and operational constraints, producing a high-confidence factual foundation. Andersen's flagging of America 250 and the FIFA World Cup reflects standard threat calculus: high-visibility events with fixed timelines create targeting windows that adversaries plan against months in advance, and degraded defensive posture cannot be surged back to full capability overnight. The CIRCIA final rule delay removes the incoming mandatory reporting framework precisely when visibility into critical infrastructure incidents matters most. The six same-day threat-hunter resignations signal accelerating brain drain; losing offensive-trained incident responders represents irreplaceable capability loss that cannot be backfilled on short timelines.

Sources:

ICE Deploys Armed Officers to 14 Major Airports as Untrained Agents Backfill Hemorrhaging TSA Screener Ranks

DHS deployed armed ICE and HSI officers to at least 13 major airports including JFK, ATL, and O'Hare to assist TSA teams amid callout rates peaking above 40% at Atlanta and 55% at Houston Hobby; ICE officials confirmed agents cannot operate magnetometers or X-ray machines and are limited to ID checks and queue management. TSA Acting Administrator Ha Nguyen McNeill testified March 25 that over 480 officers have resigned, nearly $1 billion in payroll remains unpaid after 87 days without pay, and wait times at Houston Bush Intercontinental reached 6 hours, the longest in TSA history. A third missed paycheck hits March 27; McNeill warned TSA may be forced to close smaller airports if staffing continues to deteriorate.

Analyst Note: Single aggregator source: TravelTourister synthesized McNeill's March 25 House Homeland Security Committee testimony, AP wire reporting, and segments from CNN, NBC, CBS, NPR, and Democracy Now without original reporting. The underlying facts are well-corroborated across congressional testimony and multiple major outlets, but the briefing's sole cited source introduces imprecision: the 25% callout floor appears to conflate a separation-rate statistic with callout data, and bulletproof-vest details attributed to Democracy Now actually originated from ABC7 Chicago coverage. Core claims, 480+ resignations, record wait times, ICE deployment limitations, and airport closure warnings, all trace directly to McNeill's sworn testimony and are independently confirmed.

Sources:

Watch Items - Third missed TSA paycheck March 27: whether additional resignations accelerate - Senate DHS funding vote outcome and whether it includes CISA-specific provisions - Any CISA binding operational directive delays leading to exploited vulnerabilities

Congressional Oversight & FISA

Fourteen Senate Republicans Demand Briefing from Bondi and Patel on Oct. 7 Task Force Amid Broadening Threat Environment

Fourteen Senate Republicans formally requested a congressional briefing from Attorney General Pam Bondi and FBI Director Kash Patel on the progress and future priorities of the joint federal October 7 task force, which targets Hamas financing, logistical networks, and legal accountability. The letter, led by Sen. Jerry Moran, cited a broadening threat environment and the task force's role in coordinating with international partners. A Washington Post investigation reported the task force has shed much of its staff and resources amid the administration's broader Department of Justice (DOJ) purge, with only one individual charged under its auspices despite the administration's stated priority of fighting antisemitism. A DOJ spokesperson said the task force 'has evolved, but its mission remains the same.'

Analyst Note: Two independent primary sources corroborate diminished task force capacity from distinct vantage points: Jewish Insider's original reporting details the bipartisan legislative demand for accountability, while the Washington Post's investigation documents operational hollowing: staff purged, resources redirected, and only one prosecution to date. Secondary outlets (JTA, Forward, Jerusalem Post, Times of Israel) are rewrites of the Post investigation, not independent confirmation. The convergence of congressional concern with investigative findings on institutional decay strengthens confidence that the task force's operational status has deteriorated despite the administration's stated antisemitism priorities.

Sources:

HPSCI Votes to Release Hidden 2019 ICIG Atkinson Transcripts; DNI Gabbard to Declassify Schiff-Era SCIF Document

The House Permanent Select Committee on Intelligence voted along party lines March 24 to release two transcripts from closed 2019 hearings with former IC Inspector General Michael Atkinson, who processed the whistleblower complaint that triggered the first Trump impeachment. Democrats objected, citing insufficient review time. Chairman Rick Crawford stated the 'great deal of widespread speculation about the Atkinson classified hearing transcript is indicative of the American people's complete and warranted mistrust of the Intelligence Community.' One classified transcript goes to Office of the Director of National Intelligence (ODNI) for classification review; one unclassified transcript will accompany it upon release. Separately, reporter Paul Sperry claimed March 25 (citing anonymous sources) that DNI Gabbard will soon declassify a top-secret document from the first impeachment era that former Chairman Schiff restricted to SCIF-only access; this claim has no official ODNI confirmation. Conservative media analysis connects the document to CIA analyst involvement in both the 2017 Intelligence Community Assessment (ICA) and the 2019 whistleblower complaint, but this characterization originates from editorial frameworks, not the HPSCI release or official statements.

Analyst Note: The HPSCI party-line vote is confirmed by the Committee's official press release on intelligence.house.gov, making it the sole verified element of this story. The Gabbard declassification claim is single-source: Paul Sperry's March 25 X post citing anonymous sourcing, with Gateway Pundit and at least six other conservative outlets rewriting his post without independent corroboration. No official ODNI statement, congressional confirmation, or mainstream outlet has verified the claim.

Sources:

Watch Items - FISA 702 expiration April 20: whether the Government Surveillance Reform Act gains traction or a clean extension is forced - ODNI classification review of Atkinson transcript: release timeline and any redactions - Senate Oct 7 task force briefing scheduling and any public disclosures

IC Technology & Cyber

Four Former NSA Directors Warn US Becoming Numb to Cyberattacks and Losing Offensive Edge at RSAC 2026

Four former NSA directors and US Cyber Command leaders, retired Gens. Paul Nakasone, Keith Alexander, Tim Haugh, and Adm. Mike Rogers, warned at RSAC 2026 that the U.S. is losing its offensive cyber edge. Nakasone stated we have become numb to intrusions at a scale that is incredible. Rogers said the government is unwilling to expend political capital to drive fundamental change in cyber and that the nation has not achieved deterrence. Alexander warned about China's advancement in AI and pre-positioning within critical infrastructure. Rogers cited the absence of federal privacy or cyber legislation. The panel cited Volt Typhoon, Salt Typhoon, and the Stryker wiper attack as evidence of accelerating threats.

Analyst Note: Four former NSA/CYBERCOM commanders appearing as private citizens, with no current official on the panel, exposes the leadership vacuum in U.S. cyber policy. Rogers's admission that deterrence has not been achieved is the sharpest public indictment from a former senior cyber official, directly supported by CyberScoop's on-site primary reporting. The Lets Data Science source covers a separate RSAC presentation by Rob Joyce on AI-automated cyberattacks, not this panel, narrowing listed-source corroboration; however, web verification confirms at least four additional independent outlets with on-site reporters corroborating all key claims.

Sources:

Atlantic Council Report Finds Spyware Market Grew to 561 Entities as Intermediaries Circumvent Export Controls

An Atlantic Council report published March 18 and covered by Dark Reading on March 26 documented that the global commercial spyware ecosystem has expanded from 435 to 561 organizations, with intermediaries serving as the operational backbone that circumvents export controls and trade bans. Brokers and resellers provide exploit engineering, operational training, and deployment infrastructure while maintaining legal paper trails that obscure origins. The market is fueled by government demand for law enforcement, espionage, and surveillance of political opponents. The report found intermediaries facilitate sales to countries lacking in-house technical capabilities regardless of size, enabling proliferation to regimes that would otherwise be blocked by sanctions.

Analyst Note: The 29% growth in documented spyware entities (435 to 561 across 46 countries) is drawn from a single primary source, the Atlantic Council's Mythical Beasts series, with both Dark Reading and TechPolicy.Press rewriting that dataset rather than independently corroborating it. The finding that intermediaries form the operational backbone, evidenced by cases like Predator sales routed to Bangladesh through shell companies despite trade bans, directly challenges the current enforcement model targeting manufacturers rather than the brokers circumventing controls. The report's policy recommendations, including "Know Your Vendor" disclosure requirements within the 27-state Pall Mall Process, signal that a regulatory shift toward intermediary accountability is being socialized at the multilateral level.

Sources:

Watch Items - Judge Lin's ruling on Anthropic preliminary injunction expected by March 28 - Any nation-state cyber incident exploiting CISA's reactive posture or RSAC intelligence gap - Spyware intermediary sanctions or export control actions following Atlantic Council report

COLLECTION GAPS

UNCLASSIFIED // OPEN SOURCE