//
OFFLINE — VIEWING CACHED CONTENT
← Back to Archive

IC BRIEF

Current as of 1628 EDT (UTC-04), Thursday 21 May 2026

Contents

10 stories from 44 sources across 40 organizations

KEY JUDGMENTS

Western intelligence institutions are absorbing concurrent Islamic Revolutionary Guard Corps (IRGC) escalation across cyber, kinetic, and counterintelligence domains without proportional counterpressure. At least one Western government beyond Germany will likely file espionage or assassination charges naming IRGC officers by year-end 2026. No EU member state will likely expel an Iranian ambassador by year-end. High confidence on the prosecution forecast rests on active judicial pipelines across multiple European jurisdictions. Moderate confidence on non-expulsion reflects a 45-year European precedent of restraint, though a major IRGC attack on EU soil or renewed nuclear diplomacy could break the pattern.

US IC oversight faces simultaneous weaponization against former officials and vacancy-driven inaction on current ones. The Brennan probe has moved from May's interview phase to career-to-loyalist personnel replacement, while the structural IG vacancy precludes investigation of current FBI leadership. An additional senior IC official will likely resign citing policy disagreement by year-end. Congress will very likely reauthorize Section 702 before end of FY2026, but whether House Permanent Select Committee on Intelligence (HPSCI)'s bipartisan 9/11 review produces formal reform recommendations remains genuinely uncertain.

IC Oversight & Authorities

DOJ Veterans Warn Criminal Probe of Former CIA Director Brennan Being Stacked With Trump Loyalists

BLUF: Stacking the Brennan probe with Trump loyalists has already poisoned any future prosecution on bias grounds, though an indictment before year-end 2026 remains unlikely given thin evidence and operational disarray.

Career prosecutor Maria Medetis Long was removed from the Brennan probes last month after raising evidence concerns and replaced by Joseph DiGenova, a former Trump campaign attorney 12. On Tuesday, DiGenova's wife Victoria Toensing was sworn in as a Southern District of Florida federal prosecutor; a source confirmed to CBS News she is working the Brennan cases 1. CBS News identified two agents assigned to the probes, Rose Marketos and Jack Eckenrode, who both served on a Patel-established FBI advisory group; Marketos previously pursued a discredited satellite-hacking conspiracy theory, and Eckenrode publicly endorsed Patel's bureau nomination 1. The Daily Beast reported DOJ issued and then withdrew several subpoenas last weekend, with agents subsequently seeking voluntary interviews from the same witnesses 3.

Analyst Note: Systematic replacement of career prosecutors with Trump-aligned personnel has stripped the Brennan probe of the credibility needed to survive appellate bias challenges, though an indictment by year-end 2026 remains unlikely. Career prosecutors in two separate reviewing offices found the evidentiary foundation insufficient, and the weekend subpoena reversal signals operational disorder that complicates near-term grand jury action. The senior-leadership appointments could instead reflect legitimate principal-trust requirements, but the simultaneous neutering of IG oversight of current IC officials leaves no functioning independent check on either front. We hold moderate confidence: personnel reporting is well-sourced though dependent on CBS News and unnamed DOJ sources, and the charging decision remains inside deliberations invisible to open-source collection. Its absence shifts pressure to congressional oversight committees to investigate DOJ personnel conduct.

Sources:

1: DOJ veterans fear probe into ex-CIA director is being stacked with Trump loyalists - AOL

2: Brennan probes face new scrutiny as Trump allies take charge - Prism News

3: DOJ Makes Embarrassing U-Turn Over Donald Trump Enemy Probe of John Brennan - The Daily Beast

DOJ veterans fear criminal probe into ex-CIA Director John Brennan is being stacked with Trump loyalists - CBS News

HPSCI Holds Full Committee Hearing on 9/11 Commission Intelligence Recommendations Ahead of 25th Anniversary

BLUF: Converging degradation of FBI training depth, National Counterterrorism Center (NCTC)'s domestic blind spot, and Section 702's June 12 cliff leaves the counterterrorism architecture exposed precisely as militant manpower remains undiminished.

The HPSCI on May 20 held its fifth hearing on 9/11 Commission reforms as part of a year-long bipartisan review, with Chairman Rick Crawford and Rep. Elise Stefanik, who chairs the panel's 9/11 review, presiding 12. Bruce Hoffman of the Council on Foreign Relations warned the post-9/11 security architecture "is either diminishing, being dismantled or falling into disrepair" and flagged a reported FBI agent training cut from 21 to 16 weeks 3. Jamil Jaffer of George Mason's National Security Institute told the committee combined al-Qaeda and ISIS strength stands at 30,000 to 50,000 fighters worldwide and called current Section 702 temporary authorization "a train wreck," urging Congress to make it permanent 3.

Analyst Note: Three structural vulnerabilities are converging with limited legislative runway. At 30,000–50,000 fighters, combined al-Qaeda and ISIS strength does not justify institutional rollback, yet FBI training regression from 21 to 16 weeks and the NCTC's statutory bar on domestic terrorism activity move in the opposite direction. Section 702's June 12 expiration is the most compressive pressure point: telecom cooperation degrades during authorization gaps, and the civil liberties dispute blocking permanent reauthorization remains unresolved. All sourcing derives from witness statements at a public proceeding, carrying no independent corroboration. If Section 702 reauthorizes before the committee concludes, the year-long review risks producing a report of largely symbolic weight rather than actionable reform.

Sources:

1: Chairman Crawford and Rep Stefanik Open Full Committee Hearing to Review Progress on 9/11 Commission Intel Recommendations - House Permanent Select Committee on Intelligence

2: LIVE NOW: House Intelligence Committee Holds Hearing on 9/11 Commission, Intelligence Reform - The Epoch Times

3: Counterterrorism experts warn national security eroding 25 years after 9/11 - The Washington Times

Committee Schedule for the Week of May 18 - 24, 2026 - Congress.gov

Crawford-chaired U.S. House committee continues review of 9/11 report as 25th anniversary nears - Northwest Arkansas Democrat-Gazette

Senator Blumenthal Formally Requests DOJ Inspector General Investigation Into FBI Director Patel

BLUF: Blumenthal's referral is procedurally clean but politically inert: a public Office of Inspector General (OIG) investigation into Patel is very unlikely by 30 September 2026, leaving any genuine readiness risk unchecked.

Sen. Richard Blumenthal (D-CT) on May 18 formally requested that Deputy Inspector General William Blier investigate FBI Director Kash Patel on two grounds 12. The first concerns Patel's alleged excessive drinking and unexplained absences, including what The Atlantic reported in April as a security-detail request for SWAT-style breaching equipment because Patel was unresponsive behind locked doors 31. The second draws on a May 13 MS NOW report alleging Patel changed how arrests are catalogued to inflate bureau numbers and added fugitives to the Most Wanted list days or hours before anticipated captures 134. The DOJ IG's office is currently led in an acting capacity by Blier following President Trump's removal of federal inspectors general in early 2025 3. Patel rejected the statistics allegations as "unequivocally, categorically false," with the FBI officially dismissing the MS NOW report without providing methodological specifics.

Analyst Note: Sourced to Blumenthal's press release and letter to Blier, the referral carries procedural legitimacy but negligible political traction: the DOJ OIG is very unlikely to open a public investigation into Patel by 30 September 2026. Blier holds his post because Trump fired his predecessor in the 2025 IG purge, and Trump-aligned watchdog offices have avoided politically sensitive probes against loyalists. Patel's simultaneous defamation suit and criminal leak probe signal the administration treats these as political attacks, not compliance matters. Blier may open a limited administrative review to signal institutional independence without committing to a full public investigation. We have moderate confidence in this assessment; structural constraints on the acting IG are documented, but internal OIG deliberations are not observable. Democrats gain subpoena-backed findings only if the probe opens; absent that, no independent corrective mechanism exists before the November 2026 midterms.

Sources:

1: Blumenthal Calls for IG Investigation into Impact of Kash Patel's Reported Irresponsible Behavior on FBI Readiness & Public Safety, Alleged Manipulation of Arrest Statistics - U.S. Senator Richard Blumenthal (Official Senate Press Release)

2: Letter to DOJ OIG Re: Patel Misconduct and Stat Manipulation - U.S. Senator Richard Blumenthal / DOJ Office of Inspector General (Official Letter)

3: Senator makes the one move that could end Kash Patel FBI career - Raw Story

4: Blumenthal urges DOJ probe into FBI chief Kash Patel - MSN News

Adversary Intelligence

Cipher Brief Analysis Documents IRGC Cyber Campaign Against US Critical Infrastructure Following February Strikes

BLUF: Additional public attribution of IRGC-affiliated disruptive attacks on US critical infrastructure is likely by August 19, 2026, even as Cybersecurity and Infrastructure Security Agency (CISA)'s gutted staffing threatens to delay the warning pipeline.

The Cipher Brief reports that since U.S. and Israeli strikes on February 28, IRGC-affiliated hackers moved beyond reconnaissance into confirmed disruptive attacks on U.S. soil 1. On March 11, Handala, assessed as a front for Void Manticore, wiped roughly 80,000 Windows devices at Stryker, stole 50 terabytes of data, and severed Maryland Emergency Medical Services (EMS) electrocardiogram relay access; the FBI subsequently seized two Handala data-leak domains 1. A CISA advisory issued April 7, cited by the Cipher Brief, confirmed that CyberAv3ngers, an IRGC-affiliated group, was actively exploiting programmable logic controllers across U.S. water, wastewater, energy, and government facilities 1. Foundation for Defense of Democracies (FDD) on May 20 reported that Iran-linked hackers breached fuel tank gauge systems at gas stations in multiple states, exploiting absent or default passwords to manipulate display data 2.

Analyst Note: CISA, FBI, or NSA will likely issue at least one additional public attribution of IRGC-affiliated disruptive attacks on U.S. critical infrastructure by August 19, 2026. High confidence rests on a multi-sector evidentiary record anchored by CISA's April Programmable Logic Controller (PLC) advisory and corroborated by Cipher Brief and FDD analysis across non-overlapping source networks. A concurrent German prosecution of IRGC Quds Force agents for plotting assassinations of Jewish leaders confirms Tehran is running parallel kinetic and cyber campaigns against Western targets. CISA's one-third staffing reduction and $600 million budget cut create a lag risk in attribution against an accelerating threat tempo. The campaign may instead reflect opportunistic exploitation of soft targets, with IRGC-affiliated groups optimizing for psychological effect over strategic coherence. Congressional appropriators weighing CISA funding restoration and water and healthcare operators holding unpatched PLCs cannot price that possibility favorably.

Sources:

1: Irans Digital War Machine Targeting U.S. Infrastructure - The Cipher Brief

2: U.S. Needs To Upgrade Critical Infrastructure To Counter Iranian Hackers - Foundation for Defense of Democracies

Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure - CISA (Cybersecurity and Infrastructure Security Agency)

Germany Indicts IRGC Quds Force Agent and Accomplice for Plot to Assassinate Head of German Jewish Council

BLUF: Berlin is unlikely to expel Iran's ambassador or impose bilateral sanctions by August 19, leaving IRGC assassination networks in Europe to operate against Jewish targets with limited deterrent cost.

German federal prosecutors on May 7 filed indictments in Hamburg state court against two suspects for plotting to kill Josef Schuster, head of Germany's Central Council of Jews, Volker Beck of the German-Israeli Society, and two Jewish grocers in Berlin 1234. Danish national Ali S., arrested in Denmark in June 2025, faces charges of espionage and attempted participation in murder and arson; prosecutors allege he worked for the IRGC intelligence service and maintained close contact with the Quds Force 123. Afghan national Tawab M., arrested in Denmark in November 2025, faces attempted murder charges after allegedly offering to procure a weapon for a third party to kill Beck 14. Iran's embassy denied the allegations, and the German-Israeli Society on Thursday called for the Iranian ambassador's expulsion and sanctions on Iran-linked financial institutions 24.

Analyst Note: Germany is unlikely to expel the Iranian ambassador or impose bilateral sanctions by August 19. High confidence rests on Berlin's documented post-arrest restraint and the federal government's silence on any punitive follow-through inside the assessment window. The ambassador was summoned but not expelled after the June 2025 arrest. The prosecution's IRGC nexus, grounded in independent primary sourcing from the Generalbundesanwalt and The Washington Post, remains untested at trial, leaving open that Ali S. overstated his official tasking to inflate his value as an operative. If Berlin does not act, Tehran learns that assassination plots on German soil incur no formal bilateral diplomatic cost; if it does, EU governments face pressure to align on Iran sanctions.

Sources:

1: Germany charges Dane in alleged Iranian plot to kill Jewish leader, three others - JNS

2: Alleged IRGC operative charged with plotting to kill German Jewish leader - The Times of Israel

3: Germany charges alleged Iranian agent for scouting out Jewish figures with a view to attacks - The Washington Post

4: Two men charged for plot to assassinate German Jewish leaders on behalf of Iran - The Jerusalem Post

Anklage wegen geheimdienstlicher Agententätigkeit sowie versuchter Beteiligung an Mord und Brandstiftung erhoben - Generalbundesanwalt (German Federal Public Prosecutor General)

Germany charges alleged IRGC agent over plots against Jewish figures - Iran International

Iran Executes Two Iraqi Nationals on Espionage Charges Bringing Wartime Spy Execution Total to Eight

BLUF: Tehran's expansion of espionage executions from Israeli to Arab-state charges signals a widened counterintelligence dragnet that will likely produce at least two more executions by 31 August 2026.

IranWire and Norway-based Hengaw Organisation for Human Rights reported that Iran executed Ali Nader al-Obaidi, 27, and Fadel Sheikh Karim, 29, both from Amarah, Iraq, at Karaj Central Prison at dawn on April 6 on espionage charges for alleged cooperation with an unspecified Arab state 1. Both men had been held roughly 11 months by the Ministry of Intelligence and then IRGC Intelligence before a Revolutionary Court trial, with Hengaw citing informed sources who reported torture and denial of independent counsel 12. Iran Human Rights NGO reported the executions raise to at least eight the total executed on espionage charges since the Iran-US-Israel war began, with the prior six convicted of alleged Israeli spy work 12. Iranian state media and judicial authorities had not confirmed the executions as of May 21 12.

Analyst Note: Baghdad faces mounting pressure to respond formally, complicating both governments' fragile post-ceasefire posture. The expansion from Israeli to Arab-state charges signals widened counterintelligence targeting, and Revolutionary Court proceedings, uniformly coerced, impose no institutional constraint on further cases. Confidence is moderate, reflecting single-source Hengaw reporting without official corroboration. Iran will likely carry out at least two additional espionage executions by 31 August 2026, with eight documented since late February establishing a tempo persisting through the ceasefire. If these prosecutions instead reflect a discrete Arab-state network, the pace slows once that penetration is dismantled. Arab governments with nationals in Iranian detention face compounding pressure to demand consular access and condition diplomatic normalization on prisoner releases if Iran crosses that threshold before 31 August.

Sources:

1: Execution of Two Iraqi Nationals in Karaj on Espionage Charges - Shabtab News

2: Iran executed two Iraqis convicted of spying for Arab country, rights groups say - The National

Iran secretly executes two young Iraqi nationals on alleged espionage charges - Hengaw Organisation for Human Rights

Iran secretly executes four as it hits global death sentence record - Euronews

Iranian Regime Secretly Hangs 2 Iraqis and 2 Kurdish Political Prisoners - Arab Times Online

IC Workforce & Leadership

Senior ODNI Official Amaryllis Fox Kennedy Resigns Two Intelligence Posts Over Iran War Opposition

BLUF: Back-to-back anti-interventionist exits at Office of the Director of National Intelligence (ODNI) and NCTC signal a widening Iran rift inside the IC that the administration cannot dismiss as personal, though Kennedy likely keeps her President's Intelligence Advisory Board (PIAB) seat through 21 August 2026.

The Washington Post, citing five people familiar with the matter, reported that Amaryllis Fox Kennedy resigned as ODNI deputy to DNI Tulsi Gabbard and Office of Management and Budget (OMB) associate director overseeing classified intelligence budgets, effective this week 12. In an internal May 8 email reviewed by the Post, Kennedy cited family priorities and a move to the private sector; she wrote that she intends to keep her seat on the President's Intelligence Advisory Board 13. One of those five sources told the Post that opposition to the Iran war was also a factor in her departure 12. Kennedy denied the war framing in a post on X, calling the Post's characterization "hogwash," while Gabbard's public confirmation statement made no mention of the conflict 23.

Analyst Note: Kennedy likely retains her PIAB seat through 21 August 2026, with the principal risk being escalating public dissent on Iran that raises the political cost of continued advisory service. Moderate confidence rests on the convergence of Gabbard's public confirmation and Kennedy's own written statement of intent. Her exit follows Joe Kent's March departure from NCTC, the second named anti-interventionist resignation at senior IC level over Iran within two months, a compounding pattern the administration cannot credibly attribute to individual circumstance. The Washington Post's Iran-opposition framing rests on a single anonymous source Kennedy directly contradicted; personal-career priorities may have been the primary driver. Should Kennedy exit the PIAB before 21 August, the coalition's break runs deeper and is less managed than current framing suggests.

Sources:

1: Top intelligence official Amaryllis Fox Kennedy, a Gabbard ally, resigns - The Washington Post

2: Tulsi Gabbards Closest Intelligence Ally Amaryllis Fox Kennedy Quits Two Senior Posts Over Iran War - Foreign Policy Journal

3: RFK Jr.'s Daughter-in-Law Amaryllis Fox Kennedy Quits Two Jobs Over Disagreement on Trump's War - The Daily Beast

RFK Jr.'s Daughter-in-Law Exits Intelligence Post - Newsmax

Counterintelligence & Tradecraft

Kosovo Jails Serb Policeman for Six Years for Spying for Serbian Intelligence Agency BIA

BLUF: Three Bezbednosno-informativna agencija (Security Information Agency, Serbia) (BIA) convictions inside Kosovo's security services in under a year point to entrenched Serbian penetration, and the plea-driven prosecutions leave the wider agent network intact.

The Pristina Basic Court on May 19 sentenced Kosovo Police lieutenant Bojan Jevtic, in detention since July 2025, to six years for espionage and a 2,000-euro fine for illegal weapon possession under a guilty plea deal 12. DTT-NET reported the deal spared Jevtic a sentence otherwise ranging from ten years to life 3. Prosecution records seen by Balkan Insight state that Jevtic, as operations head at the Dheu i Bardhe/Bela Zemlja border crossing, granted a BIA agent remote access to his official police computer via TeamViewer and transmitted Kosovo Police operational plans related to state security 1. The court additionally imposed a five-year post-sentence ban from public administration functions, to run after his prison term 12.

Analyst Note: Three BIA espionage convictions inside Kosovo's security apparatus within eleven months, drawn from a single Prishtina courtroom with no independent sourcing beyond parallel Balkan Insight coverage, establish a pattern of systematic Serbian intelligence penetration rather than opportunistic recruitment. TeamViewer access Jevtic granted gave BIA real-time visibility into Kosovo Police border operations; how long that access ran before his July 2025 detention remains undisclosed. Guilty pleas across all three cases prioritize prosecutorial efficiency over network mapping, leaving BIA's current operational footprint unresolved. Jevtic's long tenure at a single low-grade crossing may instead mark him as a peripheral asset, making the three-conviction pattern an artifact of aggressive prosecution rather than deep institutional penetration.

Sources:

1: Kosovo Jails Serb Policeman for Spying for Serbian Intelligence - Balkan Insight

2: Kosovo Jails Serb Policeman for Spying for Serbian Intelligence - Prishtina Insight

3: Kosovo Serb policeman sentenced on charges of spying for Serbia - DTT-NET

Allied Intelligence

Austrian Ex-Intelligence Officer Egisto Ott Convicted of Spying for Russia and Passing EU Security Hardware to Moscow

BLUF: Ott's conviction is likely to survive appeal through May 2028, locking in a judicial finding that Marsalek ran Austrian assets for Moscow and compounding EU communications exposure via Iran.

A Vienna jury convicted Egisto Ott, 63, a former Austrian domestic intelligence officer, on espionage and corruption charges on May 21 and sentenced him to four years and one month; he has appealed 123. Prosecutors told the court Ott extracted classified records from police databases from 2015 to 2020 and passed them to Jan Marsalek, the fugitive Wirecard executive believed to be in Moscow, and to Russian intelligence officers in exchange for payment 13. The indictment, as reported by The Local Austria, also charged Ott with delivering to Russia's Federal Security Service (Russia) (FSB) an encrypted laptop carrying EU secure-communications hardware, which was subsequently sold to Iran, and with passing interior ministry officials' phones retrieved from the Danube 21. Prosecutors drew partly on evidence provided by a Western country, and a British witness testified at trial 2.

Analyst Note: Corroborated by two independent primary outlets and amplified through secondary chains, the conviction is likely to survive appeal by May 21, 2028. High confidence grounds that judgment in the unanimous jury verdict, foreign-provided evidence, and a British witness's corroborating testimony. The FSB's onward sale of the compromised EU secure-comms hardware to Iran extends active exposure beyond the Russia vector. The Marsalek nexus confirms Moscow directed active intelligence through a commercial-sector controller, a pattern reaching across his pan-European network. Ott's claim that he acted on a Western partner-service mandate rather than Moscow's remains a live appellate posture; if upheld, it would reopen questions about partner-shared evidence reliability. A sustained conviction lets allied services press Vienna for structural counterintelligence reforms from a position of legal finality.

Sources:

1: Austrian ex-intelligence officer found guilty of Russia spying charges - BBC News

2: Austrian ex-agent given jail term for spying for Russia - The Local Austria

3: Austrian Former Domestic Intelligence Officer Spied for Russia, Court Finds - Reuters / U.S. News & World Report

Austria convicts Egisto Ott of spying for Russia - NewsNation

IC Technology & Surveillance

Palantir Sues Pentagon Over Key DIA Intelligence Data Analytics Contract

BLUF: Palantir's protest puts unprecedented executive pressure on Machine-Assisted Analytic Rapid-Repository System (DIA) (MARS), but cancellation or restructuring toward competitive commercial bidding within the next twelve months remains genuinely uncertain absent a binding directive from Hegseth or General Services Administration (GSA).

Palantir filed a formal protest with the Defense Intelligence Agency demanding the right to bid on MARS, the DIA's eight-year data analytics modernization program, according to a filing obtained by Axios . In the protest, Palantir argued the DIA is wasting taxpayer money and violating the law by refusing to consider commercial solutions, instead building the system from scratch with unreliable results 1. A senior Trump national security official told Axios the White House supports open competition and said GSA, DIA, or Defense Secretary Pete Hegseth could cancel MARS and "fundamentally reimagine the program" in light of AI advances since its inception 1. Palantir declined to comment and DIA did not immediately respond .

Analyst Note: The White House posture backing open competition is explicit, but a senior official's comments do not constitute a binding acquisition decision, and cancellation or competitive restructuring of MARS is genuinely uncertain within the next twelve months. Proprietary programs of this scale rarely reverse course on a protest alone absent a formal directive from Hegseth or GSA. The assessment rests on a single Axios report, which captures executive disposition clearly but cannot access DIA's internal deliberations; confidence is therefore moderate. DIA may allow the protest to exhaust its procedural timeline while MARS advances, producing neither cancellation nor meaningful vendor access. Competing analytics vendors deciding now whether to invest in MARS-compatible positioning face a different calculus if Hegseth cancels the program and opens a fresh solicitation.

Sources:

1: Palantir Protests Exclusion from U.S. Military Intelligence System Project - The Asia Business Daily

Scoop: Palantir fights Pentagon over key intelligence contract - Axios

Why Palantir Stock Is Falling On Thursday? - Benzinga

Palantir Makes Case for DIA Data Upgrade - TradingView (via GuruFocus)

COLLECTION GAPS

UNCLASSIFIED // OPEN SOURCE