//
OFFLINE — VIEWING CACHED CONTENT
← Back to Archive

IC BRIEF

Current as of 1601 EDT (UTC-04), Thursday 28 May 2026

Contents

9 stories from 35 sources across 31 organizations

KEY JUDGMENTS

The Pentagon's first official confirmation that adversaries exploited commercial location data to target deployed U.S. forces in an active theater, combined with Lithuania's exposure of 600,000 government registry records via compromised credentials, presents two independent personnel-data collection vectors that neither DoD nor NATO is likely to address through a coordinated protective mechanism within 12 months. Moderate confidence reflects both organizations' documented pattern of producing guidance without binding implementation, offset by limited visibility into classified operational mitigations already in place.

No Senate-confirmed Director of National Intelligence will likely be in office when the Fiscal Year 2027 (FY27) National Defense Authorization Act (NDAA)'s cyber-governance provisions reach House-Senate conference this fall, leaving the most substantial proposed DoD cyber realignment to advance without confirmed IC oversight. The Navy's fragmentation of its information warfare directorate into three separate organizations is very likely to persist through year-end, as the NDAA's consolidation mandate is unlikely to survive conference in binding form.

A NATO ministerial establishing a personnel-data protection framework, or a publicly announced Director of National Intelligence (DNI) nominee entering Senate confirmation, would shift these assessments.

IC Oversight & Authorities

Declassified Pentagon Memos Reveal How Rumsfeld and Cheney Deliberately Weakened DNI Position That Gabbard Inherited

BLUF: Whoever succeeds Gabbard inherits the same statutory budget ceiling Rumsfeld and Cheney embedded in 2004, making Trump unlikely to name a permanent DNI before her June 30 departure.

Gabbard submitted her resignation effective June 30, 2026, citing her husband's rare bone cancer diagnosis 1. CNN separately confirmed via multiple officials that Gabbard was excluded from deliberations on the U.S.-Israel strike on Iran's nuclear sites (Operation Midnight Hammer) and the Venezuela raid, and that Trump publicly rebuked her congressional testimony that Iran was not actively pursuing a nuclear weapon on the same day he greenlit the strikes, independently corroborating the Iran policy sidelining that Morning Honey attributed to unnamed sources and Klippenstein dismissed as casting Gabbard 'as a martyr' 12. Klippenstein, drawing on publicly available Pentagon memos in a May 26 Substack post, reported that Rumsfeld sent Bush a private September 11, 2004 memo opposing full budget authority for the new DNI and proposing instead a coordinator role stripped of operational and collection responsibilities 23. Cheney personally delivered the final compromise language to House Armed Services Chairman Duncan Hunter to secure passage of the bill in its weakened form 2. Former DNI Clapper wrote in the CIA journal Studies in Intelligence that the resulting changes 'effectively neutered' the 2004 intelligence reform act 2.

Analyst Note: Trump is unlikely to announce a permanent DNI nominee before Gabbard's June 30 departure, as the administration has repeatedly used acting arrangements to defer Senate-confirmable vacancies. The 2004 statutory constraints Rumsfeld and Cheney locked in remain in force. Clapper later characterized the resulting legislation as having been "effectively neutered," and any successor inherits the same structural ceiling. Moderate confidence rests on a single primary source drawing on declassified documents, without corroborating reporting on active White House succession deliberations. The structural explanation competes with a more pointed one: Gabbard may have been actively marginalized for opposing the Iran strikes rather than simply constrained by statute. Absent a nominee before June 30, Senate Intelligence Committee members lose the confirmation hearing at which to force public debate on the DNI's authority gaps; that lever disappears through at least the fall recess.

Sources:

1: Secret Memos Reveal Trump's Pentagon Set Up Tulsi Gabbard For Failure Before Her Untimely Exit: 'Never Had a Chance' - Morning Honey

2: The Real Reason Tulsi Gabbard Resigned - Ken Klippenstein (Substack)

3: Pentagon memos reveal Tulsi Gabbard was set up to fail analysis - Raw Story

House NDAA Directs Major Realignment of DOD Cyber Responsibilities With Single Accountable Official and AI Provisions

BLUF: Despite convergent trade reporting on House language, the single-official cyber consolidation is unlikely to survive conference intact by year's end, while the lower-friction AI incident reporting mandate stands a better chance.

The House Armed Services Committee released its $1.15 trillion FY27 NDAA chairman's mark on May 26, scheduling full committee markup for June 4 1. According to Inside Defense, the bill directs the Secretary of Defense to review and reorganize DOD's cybersecurity, IT, network defense, and defensive cyber operations under a single accountable official to reduce duplication, with studies also directed on zero trust, open-source software, and agentic AI 2. Federal News Network reports a companion provision would require DOD to establish a department-wide AI incident and vulnerability reporting program, with the Secretary designating an oversight official and submitting annual unclassified reports to Congress 3.

Analyst Note: The cyber-consolidation directive, a single accountable official over DOD cybersecurity, IT, network defense, and defensive cyber operations, is unlikely to survive conference intact by December 31, 2026. Reorganization mandates threatening established bureaucratic equities carry elevated attrition risk in House-Senate conference, and the Senate has not yet released its FY27 mark. The AI incident reporting program, which imposes reporting obligations rather than forcing structural realignment, faces lower institutional friction and may survive even if the governance provision is substantially modified. Congressional frustration with documented DOD cyber fragmentation could press Senate conferees to preserve the single-official mandate, narrowing the gap to enactment. Moderate confidence reflects convergent trade reporting on the House language but limited visibility into Senate intent and DOD institutional posture. Enactment compels DOD commands to restructure cyber accountability before year-end. Failure pushes consolidation to the FY28 NDAA cycle with no near-term structural change.

Sources:

1: HASC $1.15T Defense Policy Bill Takes Aim at Industrial Base Challenges - Breaking Defense

2: House policy bill features realignment of DOD cyber responsibilities ZT provisions and open-source software - Inside Defense

3: House NDAA Would Set Up Protected Disclosure Program for AI Incidents - Federal News Network

H.R. 8800 — National Defense Authorization Act for Fiscal Year 2027 (Chairman's Mark) - House Armed Services Committee

HASC Panel Includes AI Oversight, Bolstered Cyber Partnerships For DoD In NDAA Markup - Defense Daily

Allied Intelligence

Senior Netanyahu Aide Urich to Be Charged With Security Offenses Over Bild Leak

BLUF: Whether prosecutors actually file against Urich within the next 90 days is genuinely uncertain, but the indictment announcement alone pressures Netanyahu to formally sever his adviser amid compounding Qatargate exposure.

Israel's Attorney General Gali Baharav-Miara announced Thursday her office will indict senior Netanyahu adviser Yonatan Urich in Tel Aviv on charges of transmitting classified information with intent to harm state security, possession of classified information, and destruction of evidence 12. The charges stem from the September 2024 leak of a classified IDF intelligence document to German newspaper Bild, which was passed through intermediaries to bypass Israel's military censor 13. Baharav-Miara's office stated the leak was intended to influence public opinion regarding Netanyahu and skew public discourse surrounding the murder of six hostages in August 2024 1. Urich's lawyers Amit Hadad and Noa Milstein called the decision erroneous, denying he held or transferred classified information 13.

Analyst Note: Formal filing against Urich is genuinely uncertain within the next 90 days: Israeli procedural rules require a defense hearing first, and his legal team has signaled aggressive contestation. Drawing on official Attorney General (AG) documentation rather than independent reporting, the announcement marks the most direct judicial challenge to Netanyahu's inner circle on national security grounds. Concurrent Qatargate exposure compounds reputational damage independent of this case's timeline. The prosecution may instead reflect partisan overreach long attributed to the AG by Netanyahu's coalition allies rather than genuine security enforcement. Analytic confidence is moderate, resting on consistent official AG documentation but limited visibility into prosecutorial scheduling and defense strategy. If the indictment files within 90 days, Netanyahu faces immediate pressure to formally bar Urich from Prime Minister Office (PMO) access; if it stalls, the AG's credibility weakens materially.

Sources:

1: Senior Netanyahu aide Urich to be charged with security offenses over Bild leak - Times of Israel

2: Israel prosecutors announce indictment of Netanyahu aide - Al Arabiya English

3: Former Netanyahu aide to be indicted with conveying secret information with intent to harm state security - i24NEWS

PM Aide Yonatan Urich Charged With Sharing Classified Documents With 'Intent to Harm State Security' - Haaretz

Netanyahu aide to be charged with leaking secret information with intent to harm state security - The Washington Post

Israeli Committee Chairman Asked Mossad Chief During Hearing if Prominent International Figure Is a Secret Agent

BLUF: Though the named figure's identity is unlikely to surface publicly within six months, Grunis's deliberate halt of the recording raises a sharper question about his fitness to judge Mossad candidates impartially.

Journalist Avishai Grinzaig reported Tuesday night on i24News that retired Supreme Court Justice Asher Grunis, chairman of Israel's senior appointments committee, asked Mossad director-designate Roman Gofman whether a prominent international figure, whose identity is subject to Israeli military censorship, is a Mossad agent 123. The question came at the close of Gofman's formal testimony; Grinzaig reported Wednesday that Grunis had ordered the session recording halted before posing it 14. Gofman did not respond and was described by those present as visibly flustered, with others in the room characterized as stunned 123. Grunis told reporters he had "explicitly said I did not want an answer" and directed journalists to consult the military censor before publication, though Grinzaig reported the disclaimer came only after Gofman had already gone silent 12.

Analyst Note: Grunis halted the recording before posing the question, eliminating any claim of inadvertence, and his disclaimer that he wanted no answer came only after Gofman had already fallen silent. Public confirmation of the named figure is unlikely within six months; Israeli censorship has reliably suppressed this category of operational detail, and all current coverage traces to a single broadcast rather than independent hearing access. Grunis may have had no intelligence basis at all and been testing Gofman's operational security or projecting personal influence. Confidence is moderate, reflecting the documented effectiveness of Israeli censorship in comparable cases offset by residual uncertainty over foreign press exposure. Officials overseeing the appointment must now assess whether a chairman who may hold or claim sensitive operational knowledge can evaluate candidates impartially; continued suppression of the identity forecloses that accountability entirely.

Sources:

1: Committee Chairman Stopped the Recording Then Asked Mossad Chief Is Name Censored a Mossad Agent - JFeed

2: Embarrassment at the Committee: Grunis Asked Gofman if an International Figure Is a Mossad Agent - JDN

3: Grunis's Question That Embarrassed Gofman - Arutz Sheva (Channel 7)

4: Grunis Asked to Stop the Recording Before Turning to Gofman with the Strange Question - B'Chadrei Chareidim

Adversary Intelligence

SVR Director Naryshkin Declares Nuclear Deterrence Era Has Not Yet Begun at International Security Forum

BLUF: Naryshkin's nuclear-AI framing is calculated signaling designed to raise the perceived escalation threshold around advanced weapons transfers to Ukraine, complicating allied decisions while preemptively foreclosing any settlement built on economic normalization with Russia.

Speaking at an international security forum in Skolkovo on May 28, Russian Foreign Intelligence Service (SVR) Director Sergey Naryshkin rebutted Western claims that "the era of nuclear deterrence is over," countering that it "has not even begun yet" 123. He attributed those claims partly to unnamed IT corporations predicting that AI would alter the strategic nuclear balance, and warned Western "hawks" not to test the assertion 1. Naryshkin also described NATO as de facto conducting practical preparations for large-scale armed conflict "in the East," naming the UK as pushing continental allies toward direct confrontation with Russia 34. On Ukraine, he accused European governments of deliberately prolonging the conflict, sabotaging Russian peace efforts, and expecting to recover their losses through future "plundering" of Russia 34.

Analyst Note: Naryshkin's explicit linkage of AI to nuclear deterrence framing, drawn from state-controlled Russian outlets only and limiting independent sourcing weight, signals Moscow is incorporating Western advanced-capability discourse into its strategic threshold calculus, positioning any AI-enabled precision system transferred to Kyiv as a challenge Russia frames at an elevated nuclear threshold. This reads as deliberate signaling rather than a doctrinal shift, though the rhetoric may instead be primarily domestic and partner-state reassurance with no genuine message intended for Western capitals. Singling out the UK as Europe's primary instigator sustains consistent SVR narrative pressure on Franco-German solidarity, while framing European motives as future Russian asset plunder preemptively forecloses any settlement premised on economic normalization.

Sources:

1: Нарышкин прокомментировал заявления о конце эпохи ядерного сдерживания - RIA Novosti

2: Нарышкин: ЕС не стоит проверять, закончилась ли эпоха ядерного сдерживания - Argumenty i Fakty

3: Гибель "от меча", небезопасный мир и угроза НАТО. Заявления Нарышкина - Rambler

4: Key takeaways from SVR Director Naryshkins statements at 14th International Meeting of High Representatives for Security Issues - Pravda NATO

Lithuania Investigates State Registry Breach of 600000 Records That May Expose Intelligence Officers to Hostile States

BLUF: Despite opposition claims of Russian involvement, Lithuania is unlikely to formally attribute the breach within twelve months, leaving exposed government personnel vulnerable to surveillance, coercion, and sabotage pre-positioning.

Lithuania's Prosecutor General's Office is investigating the theft of more than 600,000 Centre of Registers records via compromised institutional credentials, with access suspected to originate from abroad 12. Stolen data from the Real Estate and Legal Entities Registers includes names, dates of birth, national identification numbers, and property addresses; no financial or contact data was exposed 1. The breach was detected in early April, publicly disclosed Friday, and prompted the resignation Monday of Centre chief Adrijus Jusas 1. Conservative opposition leader and former defense minister Laurynas Kasciunas alleged the incident bears "the hallmarks of a Russian intelligence operation," warning that residential data on government personnel could be exploited; prosecutors have neither confirmed nor denied Russian involvement 1.

Analyst Note: The breach creates an actionable targeting dataset for any state service that acquired the records, enabling surveillance profiling, coercive contact, and sabotage pre-positioning against Lithuanian government personnel. Lithuania is unlikely to formally attribute the intrusion to Russian state actors within 12 months of public disclosure. Baltic states have rarely translated hybrid-operation allegations into formal government attribution, and independently corroborated reporting surfaces no technical indicators linking the intrusion to a named actor; moderate confidence rests on those two foundations. A financially motivated criminal actor seeking data for identity fraud is equally consistent with the available evidence, given the compromised paid-access credentials and the €111,000 assessed financial damage. Formal attribution would compel NATO partners to coordinate protective relocation and counter-surveillance; its absence leaves those measures at ministry discretion without alliance burden-sharing.

Sources:

1: Lithuania investigates theft of 600000 state registry records by foreign actor - The Record

2: Lithuania probes theft of 600,000 records from state registry - LRT (Lithuanian National Radio and Television)

IC Workforce & Organization

Navy Disestablishes N2-N6 and Splits Information Warfare Into Three New Directorates for Intelligence Cyber and Warfighting

BLUF: Dispersing information warfare across three coequal directorates trades unified integration for tighter resourcing alignment, a bet that lateral coordination can replace the single fusion node N2N6 once provided.

Chief of Naval Operations (CNO) ADM Daryl Caudle announced on May 21, via Naval Administrative Message (NAVADMIN) 123/26, that Office of the Chief of Naval Operations (OPNAV) N2N6 was disestablished effective May 4, redistributing its information warfare functions across three new OPNAV organizations 12. The NAVADMIN designated Steve Parode, a retired rear admiral and most recently deputy director of naval intelligence, as Director of the new OPNAV Intelligence Division (N2), reporting to the Deputy Chief of Naval Operations (DCNO) for Intelligence, Operations, Plans, Strategy, and Warfighting Development 13. Jennifer Edgin, the former deputy N2N6, was named Assistant DCNO for Information Warfare (IW) Requirements and Capabilities (N6N9C) and will concurrently serve as Department of the Navy Deputy Chief Information Officer (CIO) 1. RADM Susan Bryer Joyner was designated Director for IW (N99), with resource sponsorship for the Navy's full IW portfolio spanning tactical warfighting intelligence, electronic warfare, cyber, networks, space, oceanography, meteorology, PNT, Nuclear Command, Control, and Communications (NC3), and Maritime Operations Center and maritime headquarters staffs 13.

Analyst Note: Splitting N2N6 removes the single integration node that fused intelligence production, cyber-space policy, and IW resource sponsorship, replacing it with three directorates whose coherence depends on lateral coordination with no structural guarantee. The design explicitly mirrors the Navy's TYCOM-to-resource-sponsor model, embedding IW requirements directly in the warfighting resource process, concentrating friction at the seams between N2, N6N9C, and N99. Edgin's concurrent DoN Deputy CIO designation extends that policy reach into the broader departmental IT enterprise. On NAVADMIN 123/26 alone, the split may instead reflect bureaucratic capture by established OPNAV power centers absorbing functions from a rival directorate rather than any maturity-driven logic.

Sources:

1: NAVADMIN 123/26: Realignment of OPNAV N2N6 Roles and Responsibilities - U.S. Navy / MyNavyHR

2: Realignment of OPNAV N2N6 Responsibilities - Naval Intelligence Professionals

3: Navy splits major information warfare post across three new directorates - Breaking Defense

IC Technology & Surveillance

Pentagon Confirms Adversaries Using Commercial Location Data to Target US Troops in Active War Zone

BLUF: Despite formal acknowledgment of the threat, the Pentagon is unlikely within a year to enact any of the three technical fixes Congress demanded, citing existing Force Protection Condition (FPCON) controls and procurement inertia.

U.S. Central Command told Sen. Ron Wyden in an April 14 letter that it had received "multiple threat reports concerning adversary exploitation of commercial location data to target or surveil US personnel in theater" 123, with CENTCOM's area of responsibility including the Gulf where U.S. forces face off against Iran over the Strait of Hormuz. On Thursday, a bipartisan group of more than a dozen lawmakers cited that disclosure in a letter to the Pentagon as the first official confirmation adversaries had used commercial location data against U.S. forces in an active war zone, warning the data could enable missile, drone, and IED attacks as well as counterintelligence operations against U.S. personnel 34. The lawmakers urged the Pentagon to disable advertising IDs on military-issued devices, automatically suspend location sharing for deployed personnel, and replace Chrome with privacy-focused browsers 34. Sen. Wyden, who shared the CENTCOM letter, said the adtech industry should be treated as "a national security threat" 23.

Analyst Note: The three technical mandates Congress demanded are unlikely to materialize within 12 months of Thursday's letter. The Pentagon's deliberately narrow framing of the CENTCOM disclosure and its refusal to engage press inquiries signal institutional resistance, while browser and device management overhauls at scale require procurement cycles that routinely exceed a year even under leadership priority. Reuters holds the primary exclusive, with downstream outlets amplifying from the same letter, limiting independent corroboration. CENTCOM's February 28 imposition of FPCON Delta's most restrictive geolocation controls gives DoD standing grounds to argue existing mitigations render the mandates redundant; if Congress fails to legislate, the identified targeting risk persists by default. Moderate confidence rests on the documented pattern of DoD delay in adopting technical privacy mitigations, offset by limited visibility into current internal deliberations.

Sources:

1: Exclusive: Pentagon Says US Military Personnel Are Reportedly Being Targeted Using Location Data - Reuters / U.S. News & World Report

2: U.S. says troops were targeted with location data, as senator warns ad industry is a 'national security threat' - TechCrunch

3: US troops are reportedly being targeted using location data, Pentagon says - Military Times

4: Federal lawmakers demand stronger protections for troops location data - Stars and Stripes

Counterintelligence & Tradecraft

Mossad Influence Unit Revealed to Have Leaked Compromising Photo of Senior Iranian Minister Triggering 2022 Resignation

BLUF: Mossad's disclosure of this template signals that Iranian officials now face a sustained, low-cost coercion campaign, and the classified targeting history suggests further scandal-driven resignations are likely already in motion.

Israel Hayom reported on May 28 that the Mossad leaked a compromising 2011 photo of senior Iranian official Rostam Ghasemi through Iran International in November 2022, timed to the height of the Mahsa Amini protests 12. The photo showed Ghasemi embracing a woman without a hijab during a Malaysia trip; he resigned as Minister of Roads and Urban Development within days as it circulated across Iranian social media 12. Both Israel Hayom and JFeed identify the operation as the work of a Mossad influence branch established by Director David Barnea in 2021 and not previously publicly disclosed 12. A Mossad official identified only as "O.," who founded the branch, told Israel Hayom that removing officials through influence operations is "much cheaper and simpler than an assassination operation" 1.

Analyst Note: The Ghasemi operation establishes a template Mossad's influence branch, founded in 2021 and only now disclosed, has had four years to replicate across an unfinished mandate against Iran: material held in reserve, released at peak domestic stress, zero agent exposure. Barnea's characterization of the branch as an "unconventional weapon" capable of "decisive" outcomes, from Israel Hayom's on-record interview with founding officer "O.," without independent corroboration, confirms influence operations now sit alongside kinetic strikes as primary instruments against Tehran's leadership. Publication timed to Barnea's scheduled departure may reflect authorized legacy management rather than inadvertent disclosure, meaning the Ghasemi case selectively understates the branch's active reach and current targeting.

Sources:

1: Secret Mossad branch revealed: 'We are not done with Iran. We are just getting started' - Israel Hayom

2: Mossad Leaked Compromising Photo of Senior Iranian Minister - JFeed

How deeply are Israel's Mossad spymasters involved in Iran protest crisis? - analysis - The Jerusalem Post

COLLECTION GAPS

UNCLASSIFIED // OPEN SOURCE