//
OFFLINE — VIEWING CACHED CONTENT
← Back to Archive

IC BRIEF

Current as of 0534 EDT (UTC-04), Monday 25 May 2026

Contents

8 stories from 34 sources across 34 organizations

KEY JUDGMENTS

The NSA's operational dependence on Anthropic's Claude AI will very likely persist through 2026. High confidence reflects the absence of classified-network alternatives and $800 million in irreversible chip procurement commitments. Iran is likely to execute at least one additional defense-sector espionage defendant within 90 days, raising risk for allied human sources inside Tehran's aerospace and missile programs. Moderate confidence rests on the judiciary's stated intent balanced against limited visibility into case dispositions.

The contract's data-use restriction on Americans' data establishes a procurement template the White House intends to replicate. Congressional authorization of the full $9 billion AI infrastructure package before year-end is unlikely, leaving a gap between executive commitment and funded capacity. Chinese collection against NATO air infrastructure in northern Norway, exposed in two Politiets sikkerhetstjeneste (Norwegian Police Security Service) (PST) arrests near military installations, indicates an organized campaign predating detection.

NATO public fusion of Russian Intelligence, Surveillance, and Reconnaissance (ISR) coercion and Chinese collection into a coordinated-campaign characterization is unlikely within 90 days. Whether a Western government designates Chinese satellite supply as an intelligence enabler by late November is genuinely uncertain. The RAF will likely resume Black Sea RC-135 surveillance within 90 days; extended suspension would indicate coercive success.

Counterintelligence & Tradecraft

Iran Executes First Person for Wartime Espionage After Spy Shared Defense Industry Coordinates During US-Israel Conflict

BLUF: Kian's swift execution signals at least five more wartime espionage executions are likely within 90 days, as Tehran weaponizes accelerated capital prosecutions to deter defense-sector collaboration with foreign intelligence.

Iran's judiciary hanged Mojtaba Kian on May 24, the first known execution for espionage committed during the war with the US and Israel, the judiciary's Mizan Online website reported 123. Mizan said Kian transmitted coordinates and information on defense industry facilities to "hostile networks affiliated with the Zionist-American enemy" via satellite television networks, and that one Iranian location was subsequently struck after he passed on its position 13. The execution took place less than 50 days after his arrest and his assets were confiscated, Mizan added 12. The UN rights office, cited by the Times of Israel, counted at least 34 executions on political and national security charges since the conflict began in late February 2.

Analyst Note: The sub-50-day arrest-to-execution timeline in the Kian case establishes a deterrent template Iran's judiciary will apply to subsequent wartime espionage cases, raising the immediate physical cost for any defense-sector informant considering collaboration with foreign networks. Iran is likely to carry out at least five additional executions publicly attributed to wartime espionage or collaboration within the next 90 days. Moderate confidence rests on the judiciary's public declaration of continued punishment and the existing pipeline of wartime arrestees, though internal case dispositions remain opaque to outside collection. Tehran's concurrent executions on separatist and rebellion charges, and the UN count of at least 34 politically motivated executions since late February, demonstrate broad institutional use of lethal coercion to suppress wartime dissent across multiple threat categories.

Sources:

1: Iran hangs man for spying during war with US Israel judiciary - The New Arab

2: Iran executes first man accused of espionage during current war with US and Israel - The Times of Israel

3: Iran Hangs Man for Spying during War with US, Israel, Says Judiciary - Asharq Al-Awsat

Iran hangs man for spying during war with US, Israel: Judiciary - Al Arabiya English

Norway PST Arrests Chinese Man Near Bodø Military Air Station in Expanding Espionage Investigation

BLUF: Though PST is unlikely to confirm an operational link by mid-November 2026, the Bodø and Andøya arrests together signal a sustained Chinese campaign targeting NATO air operations infrastructure across northern Norway.

Norway's PST arrested a 46-year-old Chinese man on May 15, charging him with attempted unlawful intelligence activity after he was found in a bunker at Bodø Air Station, home to NATO's Combined Air Operations Centre 12. PST prosecutor Kathrine Tonstad told NRK the investigation will determine what information he may have collected on the military section; the Salten and Lofoten District Court remanded him for four weeks on May 17, the first two in full isolation 12. A 29-year-old Chinese woman arrested earlier on Andøya is suspected with two others outside Norway of planning to deploy a 22-ton satellite receiver to intercept navigation and communications data; the device is now held by Oslo police, Aftenposten reported 1. PST states it sees no confirmed connection between the two cases; both suspects deny criminal guilt 12.

Analyst Note: PST is unlikely to publicly confirm an operational connection between the Bodø and Andøya cases by mid-November 2026, but the physical and logistical signatures of both operations indicate a Chinese collection campaign against NATO air operations infrastructure that predates detection. Moderate confidence rests on two-outlet corroboration of core facts but limited visibility into classified investigative findings. The satellite receiver's ship delivery and the suspect's extended bunker residence each required sustained organizational support, contradicting the tourist explanation defense counsel has offered. Oslo now faces competing pressures to prosecute aggressively and preserve a functional relationship with Beijing.

Sources:

1: PSTs spy hunt yields more suspects - News in English Norway

2: Chinese spy suspect was living in a bunker at Bodø airport - Document News

Federal Judge Allows Defamation Suit Over Claims FBI Director Patels Girlfriend Is Former Mossad Agent

BLUF: Resolution before trial within 18 months remains genuinely uncertain, as discovery hands Wilkins subpoena leverage over Seraphin's communications while his vow to probe Patel's alleged role invites protracted litigation into 2027.

Judge David Alan Ezra (W.D. Tex.) on May 22 denied former FBI special agent and podcaster Kyle Seraphin's motion to dismiss a defamation suit filed by Alexis Wilkins, girlfriend of FBI Director Kashyap Patel 12. The suit stems from Seraphin's August 22, 2025 podcast statements accusing Wilkins of being a "former Mossad agent" and intelligence "honeypot" targeting Patel 1. Ezra rejected Seraphin's satire defense, finding the podcast's "uncomfortable truths" branding and its surrounding factual discussion of FBI honeypot operations would lead a reasonable viewer to read the claims as statements of fact 1. On actual malice, the court credited Wilkins's allegation that Seraphin had met her before Patel took office and therefore knew she was American and unaffiliated with any foreign intelligence service 1.

Analyst Note: Resolution before trial within 18 months is genuinely uncertain, as the Motion to Dismiss (MTD) denial launches discovery that gives Wilkins subpoena access to Seraphin's communications and revenue records, tools that directly feed a court-credited actual-malice claim. Seraphin's compounding legal costs create settlement incentive, but his publicly stated intent to use discovery to probe Patel's alleged direction of the suit anchors a path to protracted proceedings through 2027. Moderate confidence rests on the primary court order and corroborating independent legal analysis, though the parties' private settlement calculus is not observable. A concurrent MTD denial against Elijah Schaffer on materially similar honeypot allegations, cited as supplemental authority in this proceeding, forecloses Seraphin's clearest procedural off-ramp.

Sources:

1: FBI Director Kash Patel's Girlfriend's Defamation Suit Over Allegations She Was Israeli Spy Can Go Forward - Reason (Volokh Conspiracy)

2: Judge rejects podcaster's effort to dismiss lawsuit filed by girlfriend of FBI Director Kash Patel - Just The News

Wilkins v. Seraphin, Case No. 1:2025cv01375 — Order Denying Motion to Dismiss - U.S. District Court for the Western District of Texas (via Justia)

Defamation Claim Can Go Forward Based on Allegations That FBI Directors Girlfriend Is a Former Mossad Agent and Honeypot - Reason

Right-Wing Influencer Can't Shake Lawsuit from FBI Director's Girlfriend - Headline USA

Allied Intelligence

RAF Suspends Black Sea Surveillance Flights After Russian Su-27 Passes Within 19 Feet of Rivet Joint Spy Plane

BLUF: Despite the temporary pause, RAF Rivet Joint flights over the Black Sea will likely resume within 90 days, leaving the more consequential risk of emboldened Russian intercepts upon return.

The UK Ministry of Defence announced on May 20 that two Russian jets had "repeatedly and dangerously" intercepted an unarmed RAF RC-135 Rivet Joint over the Black Sea in international airspace in April 12. A Russian Su-35 flew close enough to activate the Rivet Joint's emergency systems and knock out its autopilot; a Su-27 made six passes, closing to within six metres of the aircraft's nose 13. Defence Secretary John Healey publicly condemned the actions as "dangerous and unacceptable" and UK defence and foreign officials formally protested to the Russian embassy 1. Flight-tracking data cited by GB News shows no RAF Rivet Joint activity in the Black Sea since April 21; military sources told the Mail on Sunday the aircraft typically flies two missions per week to the area 32.

Analyst Note: The RAF will likely resume RC-135 surveillance over the Black Sea within 90 days of the May 20 announcement, closing a SIGINT gap that NATO planners are currently absorbing through alternate collection. High confidence reflects the UK's public pledge against deterrence, persistent operational demand, and the institutional norm across NATO of restoring paused ISR after intercept incidents. The RAF's deliberate transponder-on policy frames Black Sea overflight as a strategic signal, making indefinite suspension both operationally and politically self-defeating. Whether Russia interprets the pause as coercive success and escalates intercept aggressiveness upon resumption is the consequential open question.

Sources:

1: Russia 'dangerously' intercepts British spy plane over Black Sea: Ministry - Al Jazeera

2: Has the RAF paused Black Sea spy flights? - Defence Eye

3: RAF suspends surveillance flights over Black Sea after Russian warplanes fly dangerously close to British spy plane - GB News

RAF aircraft dangerously intercepted by Russian jets over Black Sea - UK Ministry of Defence (gov.uk)

South Korea Former NIS Deputy Chief Denies Delivering Message Backing Yoons Martial Law Declaration

BLUF: Hong's shift from whistleblower to suspect signals the probe is reaching National Intelligence Service (South Korea) (NIS) operational leadership, and the special counsel will likely indict at least one of the six former officials within 90 days.

Hong Jang-won, a former NIS first deputy director who had acted as a whistleblower in earlier martial law proceedings, appeared Friday as a suspect before the special counsel team led by Kwon Chang-young 123. Prosecutors allege the NIS contacted US intelligence agencies after former President Yoon's martial law declaration to justify the measure, and that Hong was central to the alleged insurrection 213. After nine hours of questioning, Hong denied all charges, said he was unaware of documents uncovered in an April NIS raid, and declined to answer whether NIS overseas officers had contacted US counterparts 23. Kwon's team has booked Hong, former NIS chief Cho Tae-yong, and four other former NIS political appointees on insurrection charges, citing April raid documents and testimony from about 40 NIS officials 12.

Analyst Note: Kwon's special counsel team will likely formally indict at least one of the six booked former NIS officials within 90 days of 25 May 2026. Hong Jang-won's crossing from cooperating whistleblower to criminal suspect marks the probe's extension into NIS operational leadership, not merely its political appointees. The team's evidentiary foundation, built from April raid documents and testimony from approximately 40 NIS officials, substantially exceeds the threshold typically needed at this charging stage. Hong's refusal to address whether overseas officers contacted US counterparts preserves a live diplomatic thread that prosecutors appear to be actively developing. Moderate confidence reflects the depth of the documentary record balanced against the inherent discretion prosecutors retain over indictment timing.

Sources:

1: Ex-NIS deputy chief grilled over alleged role in insurrection - Korea Times

2: Ex-NIS deputy chief denies allegations of delivering message backing Yoons martial law - Korea Herald

3: South Korea's ex-NIS deputy chief denies allegations of delivering message backing Yoon's martial law - ProKerala

IC Technology & Surveillance

Pentagon Releases Second Batch of 222 Declassified UAP Files Including Senior Intelligence Officer Testimony

BLUF: Institutionalizing insider testimony as a document category, the Pentagon Unidentified Anomalous Phenomena (UAP) Records and Submissions Under Evaluation (PURSUE) program likely yields a third release before end of 2026, sustaining oversight pressure that All-domain Anomaly Resolution Office (AARO)'s no-extraterrestrial-evidence floor will struggle to contain.

The Department of War on Friday published a second tranche of 64 declassified UAP files under the PURSUE program, comprising 51 videos, seven audio recordings, and six documents posted to WAR.GOV/UFO 12. Among the documents is a late-2025 memo filed through the Office of the Director of National Intelligence by a currently serving senior intelligence officer who described helicopter encounters with orange orbs that approached within ten feet of the aircraft 32. The officer wrote that fighter jets were scrambled but the orbs matched their speed and appeared to "chase" them, leaving the crew "virtually speechless" 243. The Pentagon's All-domain Anomaly Resolution Office stated it has found no evidence of extraterrestrial origin in any of the reported incidents but acknowledged many cases remain unresolved 4.

Analyst Note: A third UAP file release is likely before the end of 2026, adding documentary pressure on oversight institutions that must absorb and analyze each new tranche. The Department of War has publicly committed to a third release, an institutional statement that carries cost to retract in the current political environment. The senior intelligence officer account is analytically significant beyond its content: an Office of the Director of National Intelligence (ODNI)-filed memo from a serving principal normalizes insider reporting as a document category, raising the value of future releases. AARO's position that no extraterrestrial evidence exists remains the authoritative institutional floor even as the volume of unresolved cases grows with each publication. High analytic confidence reflects the explicit PURSUE rolling-release framework and a public demand signal exceeding one billion site visits in under three weeks.

Sources:

1: Department of War Publishes Second Release of Unidentified Anomalous Phenomena Files on WAR.GOV/UFO - U.S. Department of War

2: Pentagon releases more UFO files including videos and senior intelligence officer testimony - CBS News

3: Unexplained aerial encounter left U.S. intelligence officer 'virtually speechless' - NBC News

4: Pentagon releases more declassified UFO files, including intelligence officer's account of seeing 'orbs' - ABC News

Anthropic to Continue Supplying Claude AI to NSA Despite Pentagon Supply Chain Risk Designation

BLUF: Hardware scarcity, not policy preference, is driving this decision, making formal execution of the Mythos contract likely within 90 days and cementing a data-use template across intelligence AI procurement.

White House Chief of Staff Susie Wiles authorized the NSA to continue using Anthropic's Claude despite the Pentagon's supply chain risk designation of the company, the New York Times reported 12. The arrangement was driven by a shortage of Nvidia Grace Blackwell chips on classified networks; Anthropic's "Mythos" model runs on older hardware and is, per the Times report, the only near-term option available for those systems 12. A contract being finalized includes a clause barring the model from processing Americans' data and omits the "any lawful use" language that had blocked earlier negotiations 1. The White House also approved a $9 billion emergency package for AI chips and specialized classified data centers, with Congress still required to vote; $800 million is being redirected from existing budgets to begin purchases immediately 2.

Analyst Note: Formal execution of the NSA-Anthropic "Mythos" contract is likely within the next 90 days, establishing a data-use restriction template the White House intends to apply across future intelligence AI procurement. Moderate confidence rests on a single primary source, but White House authorization at the chief-of-staff level and the absence of a near-term hardware alternative leave limited room to reverse course. The $800 million already redirected to chip purchases creates institutional momentum that would be costly to unwind before classified networks gain access to alternative frontier models.

Sources:

1: Anthropic may keep supplying Claude to the NSA despite being flagged as a supply chain risk by the Pentagon - The Decoder

2: The US blacklisted Anthropic as a security threat. Its spy agencies are using Claude anyway. - The Next Web

White House Approves $9 Billion for Spy Agencies to Catch Up on AI - The New York Times (Dustin Volz & Julian E. Barnes)

White House approves $9B for spy agencies to catch up on AI - The Philadelphia Inquirer

White House Pushes $9B AI Chip Plan for U.S. Spy Agencies - Newsmax

White House approves 9B for US spy agencies AI adoption - Crypto Briefing

Adversary Intelligence

IRGC Used UAE Network to Acquire Chinese Satellite Equipment for Missile and Drone Programs

BLUF: Whether Office of Foreign Assets Control (OFAC) designates Telesun and its UAE network by late November 2026 is genuinely uncertain, and targeting downstream nodes alone leaves the Islamic Revolutionary Guard Corps (IRGC)'s Chinese procurement infrastructure intact and operational.

The Financial Times reported Sunday, based on leaked contracts, customs records, and satellite imagery, that the IRGC Aerospace Force obtained approximately 1.8 metric tons of Chinese satellite communication equipment, specifically a 4.5-meter motorized antenna manufactured by StarWin, in late 2025 through Telesun, a company registered in Ras al-Khaimah 1234. Telesun acquired the equipment on behalf of Ertebatat Faragostar Kish (EFK), an Iranian telecommunications firm acting as intermediary to end-user Saman Industrial Group 1. The shipment traveled from Shanghai to Dubai's Jebel Ali port, arriving August 28, before transfer to the Iranian vessel Rama III for delivery to Bandar Abbas in November 124. FT maritime analysis found Rama III broadcast false Automatic Identification System (AIS) coordinates near Oman during transit; satellite imagery on November 29 placed a matching vessel at Shahid Rajaee Port 124. Contracts reviewed by the FT identified Saman Industrial Group, sanctioned by US Treasury in December 2023 as an IRGC Aerospace Force front for ballistic missile, drone, and electronic warfare development 14.

Analyst Note: The FT disclosure creates public pressure for OFAC to designate Telesun and its UAE network principals, but action by late November 2026 is genuinely uncertain. Public reporting has generated prior OFAC action, but UAE diplomatic considerations and Treasury's evidentiary timeline have repeatedly deferred designation of Gulf-registered intermediaries. The 2023 designations of Saman and Blue Calm failed to close the acquisition chain, indicating that targeting downstream nodes leaves procurement infrastructure above them intact. This assessment carries moderate confidence; the FT's documentary sourcing is credible but lacks corroborating signals intelligence. The satellite equipment's application to IRGC missile and drone command architecture means allied planners must now account for advanced Chinese communications capability in the Aerospace Force's inventory. Tehran's accelerated counterintelligence tempo, reflected in the Kian execution, directly raises risk for any human source positioned inside IRGC procurement networks.

Sources:

1: IRGC Used UAE-Based Network to Acquire Chinese Satellite Equipment for Missile and Drone Programs - The Defense News

2: Iran purchased military satellite equipment from China through UAE company - report - The Jerusalem Post

3: Iran bought drone tech through UAE, then used it to attack it - Israel Hayom

4: Iran Uses UAE Shell Companies to Buy Missile and Drone Components - Militarnyi

China's Covert Satellite Trail to Iran's Revolutionary Guards - Financial Times

COLLECTION GAPS

UNCLASSIFIED // OPEN SOURCE