//
OFFLINE — VIEWING CACHED CONTENT
← Back to Archive

IC BRIEF

Current as of 0423 EDT (UTC-04), Sunday 21 June 2026

Contents

10 stories from 41 sources across 38 organizations

KEY JUDGMENTS

Russian multi-vector targeting of European defense supply chains will very likely produce additional publicly reported security incidents before October 31, while NATO collective attribution to Russian state direction will very likely remain absent over the same window. Fidan's meetings with all three Russian intelligence chiefs deepened Turkey's Moscow engagement, complicating the unanimity a formal alliance statement requires. A second national-level attribution following France's would narrow this consensus gap.

Whether US-Iran nuclear talks resume in a formal session before mid-August is genuinely uncertain. Israel's continued Lebanon operations violate the Memorandum of Understanding (MOU) cessation clause, and Iran is likely to cite the Ilam sabotage arrests as evidence of American bad faith before September 30. The linchpin assumption is that Washington continues withholding material leverage over Israeli operations; conditioning security assistance on Lebanon restraint would alter the calculus.

The Department of Justice (DOJ) Inspector General will likely not review FBI Director Patel's bonus payments by year-end. Democratic minority powerlessness, a politically aligned incoming IG, and the administration's non-compliance record are compounding barriers. The statutory salary cap allegations remain the most actionable trigger for career financial officers with personal liability exposure.

Adversary Intelligence

Acronis Uncovers Khmer Shadow Espionage Campaign Targeting Cambodia Defense Intelligence Bureau With Custom NIGHTFORGE Loader

BLUF: Targeting of Cambodia's primary defense intelligence collection organ with fabricated Beijing cooperation lures indicates an actor with prior organizational access conducting sustained Southeast Asian military espionage.

Acronis TRU identified two espionage campaigns against Cambodia's Information Collection Bureau, subordinate to the Ministry of National Defense, and the Ministry of Public Works and Transport, attributing both to a previously unreported cluster it calls Khmer Shadow 12. Both operations delivered NIGHTFORGE, a custom loader, via spear-phishing self-extracting archives that sideloaded it through a legitimate VMware-signed binary; the loader performs NTDLL unhooking and Hell's Gate syscall resolution before injecting a Havoc Demon implant into memory 12. The first campaign's lure was a letter addressed to a named Information Collection Bureau (Cambodia) (ICB) officer, purportedly from a Beijing-based "Development and Investment Division" contact, with neither individual traceable in public records 1. Havoc Demon C2 routes to sharingfile.cloud over HTTPS, with origin infrastructure hosted in Kyiv, Ukraine, fronted by Cloudflare; Acronis identified a second domain, linkednewsapi.top, sharing near-identical server characteristics 12.

Analyst Note: The lure's construction, a named ICB officer and "EOD Administrative team" reference embedded in a fabricated Beijing bilateral coordination request, implies prior reconnaissance rather than generic targeting. Infrastructure and payload reuse across both campaigns without retooling points to either low operational tempo or high confidence in detection immunity. On either reading, the undetected presence extends beyond the discovery window. Acronis TRU holds the only primary analysis; secondary sources introduce factual divergences. Kyiv-hosted C2 origin does not support China attribution, and the cluster remains unlinked to any known group. The Beijing-signed lures may instead represent deliberate false-flag construction, designed to implicate China while an unrelated actor collects against one of its close regional partners.

Sources:

1: Behind Khmer Shadow: Targeted espionage against Cambodian government entities - Acronis Threat Research Unit

2: Hackers Abuse VMware-Signed Binary to Deploy NIGHTFORGE Loader - GBHackers

Hackers Abuse VMware-Signed Binary to Sideload NIGHTFORGE Loader in Espionage Attacks - CyberSecurityNews

Khmer Shadow Espionage Campaign Targets Cambodian Government - Security Online

Turkish FM Fidan Confirms Meetings with All Three Russian Intelligence Chiefs FSB SVR and GRU During Moscow Visit

BLUF: Fidan's direct engagement with all three Russian intelligence chiefs repositions Ankara from neutral mediator to active intelligence interlocutor, making a formal Turkey-hosted negotiation session by year-end 2026 genuinely uncertain.

Fidan confirmed the full scope of his June 16-17 trip in a post-visit statement on X, listing sessions with Putin in Kazan, Foreign Minister Lavrov, Ukraine negotiator Vladimir Medinsky, Security Council Secretary Sergei Shoigu, Federal Security Service (Russia) (FSB) Director Alexander Bortnikov, Foreign Intelligence Service (Russia) (SVR) Director Sergey Naryshkin, and Main Directorate of the General Staff (Russia) (GRU) chief Igor Kostyukov 1. At a joint press conference on June 16, Lavrov cited concern over Ukrainian strikes on grain-transport vessels bound for Turkey and threats to the TurkStream and Blue Stream pipelines, saying the two sides agreed to collaborate on Black Sea security, the South Caucasus, and the Middle East 2. Fidan reaffirmed Turkey's readiness to host further Russia-Ukraine talks and expressed support for the 3+3 South Caucasus regional cooperation platform 12.

Analyst Note: Meeting all three Russian intelligence chiefs in one visit shifts Turkey's mediation role from diplomatic facilitation toward active intelligence brokerage, a distinction Allied capitals will press when assessing Ankara's neutrality. Whether Turkey hosts a formal Russia-Ukraine session by year-end 2026 remains genuinely uncertain; the binding constraint is Moscow's willingness to bring Kyiv to the table, not Turkish readiness. Low confidence reflects the absence of any confirmed negotiating framework, compounded by sourcing drawn exclusively from Russian state channels with no independent confirmation of the intelligence-chief roster, equally consistent with protocol deference to Fidan's Millî İstihbarat Teşkilatı (MIT) background over substantive mandate. Lavrov's pairing of grain-vessel strikes with TurkStream threats indicates Russia is conditioning Black Sea cooperation on Ankara accepting a shared threat narrative, committing Allied diplomatic resources to a genuinely uncertain return.

Sources:

1: Turkey, Russia to continue efforts to strengthen bilateral ties — top diplomat - TASS

2: Foreign Minister Sergey Lavrov's statement and answers to media questions at a joint news conference following talks with Foreign Minister of the Republic of Türkiye Hakan Fidan, Moscow, June 16, 2026 - Russian Ministry of Foreign Affairs

Why Hakan Fidan met the heads of the FSB, SVR and GRU - News.az

Fidan Meets Russia Spy Chiefs: What Was Really Discussed in Moscow - Caspian Post

Türkiye's top diplomat meets Putin, receives honorary doctorate in Moscow visit - Türkiye Today

Indian Court Frames Espionage Charges Against Senior DRDO Missile Scientist Accused of ISI Honey-Trap

BLUF: Procedural vulnerabilities in the prosecution's Official Secrets Act (OSA) compliance may collapse the case before any merits ruling, but the unresolved question of how deeply Inter-Services Intelligence (ISI) penetrated Defence Research and Development Organisation (DRDO)'s missile program carries greater strategic weight than the trial's outcome.

A Pune magistrate court framed charges under the Official Secrets Act, 1923 against Dr. Pradeep Kurulkar, a former DRDO director held since his Anti-Terrorism Squad (ATS) arrest on May 4, 2023 12. He is accused of sharing sensitive national security information with Zara Dasgupta, described by investigators as a Pakistani intelligence operative who approached him through a honey trap 23. The ATS chargesheet ran to approximately 2,000 pages, and the case was transferred from Sessions Court to magistrate court in March 2026 after the defense challenged compliance under Section 13 of the OSA 3. Substantive hearings are scheduled to begin in the second week of July 2026 2.

Analyst Note: The proceeding's trajectory turns on a Section 13 procedural question: whether the ATS obtained mandatory government authorization before filing its chargesheet, not on evidentiary merit. A ruling against authorization voids three years of proceedings without a merits ruling. Regional Indian outlets, without independent court or intelligence-community access, cannot establish what Kurulkar transmitted or how long the penetration persisted. Analytic confidence is correspondingly low. If the chargesheet accurately characterizes the communications, DRDO's missile program sustained a honey-trap penetration that India's counterintelligence apparatus failed to detect for an unestablished period. The prosecution's substantive case may collapse even sooner if the defense's public-domain argument is credited, rendering the Section 13 authorization question moot.

Sources:

1: Espionage Trial to Begin for DRDO Scientist After Pune Court Frames Charges - The420.in

2: Pradeep Kurulkar DRDO Espionage Case: Charges Framed, Trial to Begin Second Week of July 2026 - The Focus India

3: Pune DRDO Scientist Pradeep Kurulkar Espionage Case Moved to Magistrate Court - The Bridge Chronicle

Charges confirmed against Dr. Kurulkar; trial hearing begins today - Saamana

New Antenna Array at Cuba Bejucal SIGINT Site Now Fully Operational 145 Kilometers from Florida

BLUF: Bejucal's completed Circularly Disposed Antenna Array (CDAA) delivers persistent High Frequency (HF) intercept coverage over southeastern U.S. military corridors, but full triangulation capability remains constrained because active construction at the paired El Salao site is unlikely within the next twelve months.

Commercial satellite imagery analyzed by Center for Strategic and International Studies (CSIS), published June 18, shows a new 32-antenna circularly disposed antenna array (CDAA) at Cuba's Bejucal SIGINT facility has completed construction and very likely begun operations 12. The array, comprising 19 outer and 13 inner antennas, is larger than any Cuban CDAA previously identified by CSIS and provides high-frequency direction finding coverage across the southeastern United States, the Gulf of Mexico, the Caribbean, and portions of the Western Atlantic 1. CSIS assesses Bejucal is likely among three Cuban sites that U.S. officials have acknowledged China operates, though no publicly available evidence directly confirms Chinese involvement 1. A second suspected CDAA site at El Salao showed little development in CSIS imagery from May 2026, and a newly repositioned access road now runs through the center of the antenna array footprint, a placement that would degrade CDAA performance; whether the site will proceed as originally designed is unresolved 1.

Analyst Note: Bejucal's CDAA completion converts Cuba's HF intercept posture from latent to persistent, with continuous coverage across southeastern U.S. military corridors, the Gulf of Mexico, and the Caribbean. Without a paired eastern node, the triangulation gap over the Atlantic approaches remains open; El Salao's dormancy is the limiting constraint. Active construction at El Salao is unlikely within the next twelve months; vegetation reclaiming graded areas and absent antenna hardware indicate stall, not delay. Analytic confidence is low: CSIS's analysis rests on commercial imagery alone, with no corroborating SIGINT or human reporting on operator intent. A repositioned access road absent from prior imagery cycles may instead signal active engineering revision of the footprint, accelerating any restart timeline. If El Salao resumes, United States Southern Command (SOUTHCOM) faces a two-node network closing the southeastern Caribbean coverage gap, changing the counter-ISR resource allocation timeline.

Sources:

1: New Activity at Possible Chinese Intelligence Facilities in Cuba - Center for Strategic and International Studies

2: At the Doorstep: A Snapshot of New Activity at Cuban Spy Sites - Center for Strategic and International Studies

China-linked spy site in Cuba is now fully operational - Defence Blog

The Peoples Liberation Army spy satellite site is now fully operational in Cuba - Global Defense Corp

Prior Reporting - [Cuba Completes Major Signals Intelligence Antenna Array Just 90 Miles from Florida CSIS Says](https://www.thedefensenews.com/Cuba-Completes-Major-Signals-Intelligence-Antenna-Array-Just-90-Miles-from-Florida-CSIS-Says/) (2026-06-19) - [At the Doorstep: A Snapshot of New Activity at Cuban Spy Sites](https://features.csis.org/hiddenreach/cuba-china-cdaa-base/) (2026-06-18) - [New Activity at China-Linked Spy Sites in Cuba](https://www.newsweek.com/new-activity-at-china-linked-spy-sites-in-cuba-12094852) (2026-06-19) - [Report: Chinese Intelligence Center in Cuba Operational](https://www.breitbart.com/national-security/2026/06/19/report-chinese-intelligence-center-in-cuba-operational/) (2026-06-19)

Iran Ministry of Intelligence Arrests 17 in Western Iran Alleging US-Israeli Sabotage Network

BLUF: Iran's wartime-combatant framing of protest participants likely drives formal charges by year's end, serving to insulate domestic repression from diplomatic pressure during nuclear negotiations.

Iran's Ministry of Intelligence announced on June 20 the arrest of 17 suspects in Ilam province, describing three as alleged network leaders and 14 as members of what officials called a US-Israeli sabotage network 12. Fars News Agency reported the group was accused of organizing street unrest and sabotage; the ministry also stated that some detainees had participated in protests during January 2026 12. Islam Times, citing the ministry's statement, reported seizure of explosives, a Kalashnikov rifle, a grenade, and cold weapons from the group 2. The United States and Israel have denied supporting efforts to destabilize Iran 1.

Analyst Note: The "Third Imposed War" framing, absent from last Sunday's 131-person sweep, reclassifies the Ilam detainees as wartime combatants, raising legal jeopardy and insulating proceedings from diplomatic interference during the US-Iran negotiating window. Iranian courts are likely to announce charges against at least one detainee by end of 2026, driven by the ministry's public weapons record and Iran's consistent prosecutorial practice on weapons-possession cases. Low confidence attaches: all reporting traces to a single ministry statement via Iranian state broadcast with no independent corroboration of the evidentiary basis. Ilam's Iraq-border position, combined with the recovered Kalashnikov and explosives, leaves open that the network included genuine cross-border armed actors rather than rebranded protesters. Whether charges materialize tells US negotiators how far the judiciary will move before prisoner-release terms enter the nuclear agenda.

Sources:

1: Iran Says 17 Arrested Over Alleged Links to US-Israeli Sabotage Network - Khaama Press

2: Iran Intelligence Ministry Detains 17 Members of US-Israeli Sabotage Network in Western Province - Islam Times

Dozens of terrorists, spies and saboteurs arrested during US-Israeli aggression on Iran - Press TV

Prior Reporting - [Dozens of terrorists, spies and saboteurs arrested during US-Israeli aggression on Iran](https://presstv.ir/Detail/2026/06/14/770428/Iran-intelligence-ministry-arrests-terrorists-spy-aggression) (2026-06-14) - [Intelligence Ministry Arrests Spy, Terror Cell in Iran](https://www.tasnimnews.com/en/news/2026/06/14/3616932/intelligence-ministry-arrests-spy-terror-cell-in-iran) (2026-06-14) - [Iran says it arrested foreigner spying for US, Israel](https://www.jpost.com/middle-east/iran-news/article-889500) (2026-06-14) - [Iran arrests dozens for alleged espionage amid wartime crackdown](https://www.newarab.com/news/iran-arrests-dozens-alleged-espionage-amid-wartime-crackdown) (2026-06-14)

IC Operations & Tradecraft

US Intelligence Agencies Warn Trump Administration That Israel May Act to Undermine Emerging Iran Peace Agreement

BLUF: Formal US-Iran framework collapse remains unlikely within 90 days, but unchecked Israeli operations in Lebanon create steady attrition pressure that Washington's verbal warnings alone cannot arrest.

The Washington Post reported Friday, citing current and former US officials, that intelligence agencies warned the Trump administration Netanyahu is likely to take steps that undermine Trump's Iran peace effort 12. The central concern is Israel's continued military operations in Lebanon: the recently signed US-Iran memorandum of understanding requires an end to hostilities on all fronts, and a US official told the Post that without a full Israeli withdrawal from southern Lebanon, fighting between Israeli and Hezbollah forces is "all but certain" 2. On Friday, Israel struck southern Lebanon after a Hezbollah drone killed four soldiers, as US and Iranian officials postponed planned talks in Switzerland 1. Vice President Vance separately warned Israel not to alienate Trump, calling him "the only head of state in the entire world who is sympathetic to the nation of Israel" 2.

Analyst Note: Friday's airstrike in southern Lebanon confirmed Israel Defense Forces (IDF) operations will run independent of diplomatic timelines. Formal collapse of the US-Iran framework is unlikely within 90 days, but attrition rather than public withdrawal is the failure mode to watch. The MOU's cessation clause is structurally incompatible with Netanyahu's domestic incentives to hold the Lebanon campaign. Vance's warning that Trump is the only world leader sympathetic to Israel reflects leverage Washington has not yet applied in material terms. Israel may instead be establishing facts on the ground to extract security commitments from a final framework rather than to kill diplomacy. Confidence is low, given this assessment rests on a single primary source. If talks formally collapse, conditioning security assistance on Israeli restraint becomes the White House's unavoidable decision.

Sources:

1: US intel warns Israel may undermine Iran peace deal - Washington Post - Iran International

2: US intelligence warns Israel could undermine Iran peace deal: Report - Middle East Monitor

U.S. intelligence warns Israel is likely to undermine Iran peace deal, officials say - The Washington Post

US intelligence reportedly warns Israel could threaten Iran peace deal as tensions remain high - Business Upturn

Prior Reporting - [US intel reportedly says Netanyahu's actions in Lebanon expected to undermine Iran deal](https://www.timesofisrael.com/liveblog_entry/us-intel-reportedly-says-netanyahus-actions-in-lebanon-expected-to-undermine-iran-deal/) (2026-06-19) - [Report: US intelligence feared Netanyahu would try to undermine Iran deal](https://www.ynetnews.com/article/rkckjx7mfx) (2026-06-19)

IC Workforce & Leadership

FBI Director Patel Faces Expanded Investigation Over One Million Dollar Bonus Payments to Inner Circle Advisory Team

BLUF: Absent Republican defections or a leaked financial trail, a formal federal investigation into Patel's bonus payments remains unlikely before the end of 2026, leaving congressional Democrats with no compulsion mechanism beyond public pressure.

Rep. Jamie Raskin, ranking member of the House Judiciary Committee, sent Patel a letter on June 15 demanding records on more than $1 million in bonus payments to agents on his "Director's Advisory Team" and security detail 12. The Washington Times reported that some recipients collected five consecutive payments of $8,000 every two weeks, with individual totals approaching $40,000, and that some awards exceeded statutory salary caps 2. Raskin's letter described the payments as a "personal slush fund," alleged the payment volume depleted FBI reserve accounts to the point of causing disbursements to bounce, and raised the further allegation that bonuses may have functioned as hush money for security-detail agents who witnessed Patel's conduct during personal outings, naming specific venues including the Poodle Room, Rao's, and the Strip 2. Patel has denied the underlying drinking allegations, which build on an April 2026 Atlantic investigation by Sarah Fitzpatrick; Raskin set a June 29 deadline for Patel to produce a full accounting of payments and related communications 12. House Democrats currently lack unilateral subpoena authority to compel records, and neither the FBI nor any federal oversight body has issued a finding that the payments violated federal law 12.

Analyst Note: A formal federal investigation before end of 2026 is unlikely: Democrats lack unilateral subpoena authority, Senate Republicans control oversight committee calendars, and the administration's documented pattern of non-compliance with minority requests eliminates Raskin's only compulsion mechanism. The record derives entirely from the Judiciary Committee Democrats' press release, with IBT and the Washington Times providing secondary amplification. Secondary coverage added that some individual awards exceeded statutory salary caps, sharpening legal exposure without altering the disclosure calculus. The payments may represent legitimate operational compensation for high-tempo protective assignments, with reserve account depletion reflecting scheduling compression rather than deliberate mismanagement. Moderate confidence reflects the absence of any cross-aisle coalition capable of compelling disclosure. Senate Republicans scheduling oversight hearings is the only move that converts Raskin's letter into compelled discovery with a criminal referral pathway.

Sources:

1: FBI Director Kash Patel Hit With Unlawful 1M Bonus Investigation - International Business Times

2: Kash Patel accused of giving bonuses to FBI loyalists - Washington Times

Ranking Member Raskin Launches Investigation Into Kash Patel's Misuse of FBI Funds for Unlawful Bonus Payments to Inner Circle - House Judiciary Committee Democrats

Prior Reporting - [Even Kash Patel Seems to Have His Own Secret Personal Slush Fund](https://newrepublic.com/post/211931/kash-patel-secret-personal-slush-fund-fbi) (2026-06-16) - [Democrats slam Kash Patel over FBI team's lavish bonuses](https://www.courthousenews.com/democrats-slam-kash-patel-over-fbi-teams-lavish-bonuses/) (2026-06-16) - [Kash Patel Hit With Claim From Jamie Raskin of Secret FBI Bonus Scheme](https://www.thedailybeast.com/kash-patel-hit-with-claim-from-jamie-raskin-of-secret-fbi-bonus-scheme/) (2026-06-16)

IC Technology & Surveillance

CISA Issues Emergency Advisory After FortiBleed Campaign Compromises 86644 Fortinet Credentials Across 194 Countries Including Government Networks

BLUF: Full device-configuration extraction across roughly half of all internet-facing Fortinet firewalls demands remediation well beyond credential rotation, yet public confirmation by affected government networks remains unlikely within 90 days of the June 18 advisory.

On June 18, Cybersecurity and Infrastructure Security Agency (CISA) confirmed that threat actors were actively using FortiBleed credentials against Fortinet firewalls and VPN gateways across government and private-sector organizations in 194 countries 12. Hudson Rock's analysis of data first discovered by researcher Bob Diachenko on an exposed server counted 73,932 unique firewall URLs across 21,632 domains, with named entries including Foxconn, Samsung, Siemens, PwC, and multiple government agencies 23. Diachenko's review of tooling the attackers inadvertently left accessible attributed the campaign to a Russian-speaking multi-operator group that ran approximately 1.16 billion credential attempts against FortiGate targets, with a Turkish NATO defense contractor named among alleged victims from which classified documents were reportedly stolen 23. Researcher Kevin Beaumont independently verified credentials at multiple listed organizations and concluded the data originated from exported device configurations rather than credential interception, covering roughly half of all internet-facing Fortinet firewalls 23.

Analyst Note: The configuration-export origin, confirmed by Beaumont's independent verification at named organizations, extends remediation beyond credential rotation to backdoor accounts and configuration tampering, since full device-level access was required to produce the dataset. A US or Five Eyes government agency publicly confirming unauthorized access within 90 days of the June 18 CISA advisory is unlikely, since disclosure culture and classification constraints consistently suppress public acknowledgment well past remediation milestones. Moderate confidence reflects the CISA primary advisory and Beaumont's verification, constrained by the unresolved initial access vector and no confirmed government victim statements. The dataset may originate from a previously patched Fortinet vulnerability rather than a new undisclosed flaw, in which case patched organizations face only historical credential exposure. Absent public government confirmation, credential rotation stands as the remediation ceiling; confirmed access would trigger mandatory reporting, backdoor hunts, and hardware replacement.

Sources:

1: CISA Urges Hardening Fortinet Devices After Reports of Credential Exposure

2: CISA Warns of Active Exploitation Following FortiBleed Leak - Security Affairs

3: FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices - BleepingComputer

FortiBleed: 86000 Fortinet Device Credentials Compromised - SecurityWeek

Prior Reporting - [Active FortiBleed Campaign Impacting Fortinet Devices Across 194 Countries](https://arcticwolf.com/resources/blog/active-fortibleed-campaign-impacting-fortinet-devices-across-194-countries/) (2026-06-18) - [CISA warns Fortinet users to secure devices after FortiBleed leak](https://www.bleepingcomputer.com/news/security/cisa-warns-fortinet-users-to-secure-devices-after-fortibleed-leak/) (2026-06-18)

Allied Intelligence

DGSI Probes Multiple Russian Sabotage and Espionage Operations on French Soil Targeting Defence Industry and Rail Infrastructure

BLUF: Coordinated Russian physical sabotage of European defense supply chains marks an escalation beyond influence operations, and French formal state attribution is likely before the end of 2026.

Direction Générale de la Sécurité Intérieure (DGSI) arrested a 48-year-old Belarusian man, resident in Spain, at Delair's drone factory in Labège on June 3 after catching him filming a prototype; investigators established he had transmitted the footage to a contact in Russia 12. The factory had been struck by Molotov cocktails two days before the arrest, prompting a separate arson investigation in Toulouse; Delair supplies drones to both French and Ukrainian forces 1. The Paris prosecutor confirmed his indictment on June 19 on charges of delivering information to a foreign power and criminal conspiracy 1. French authorities are also investigating suspected Russian-linked sabotage of rail infrastructure and the late-December 2025 discovery of a remote-control device aboard an Italian ferry that had docked in France, which the Interior Minister characterized as "very grave" 13.

Analyst Note: The Paris prosecutor's indictment naming Russia as the receiving power, combined with Brussels summit condemnation of hybrid attacks, makes French formal state attribution of the Delair operation likely before end of 2026. Analytic confidence is moderate: the proxy recruitment model obscures the Moscow command chain, state-level attribution requires a higher evidentiary standard than a prosecutor's filing, and the factual record rests on a single AFP wire with no independent corroboration. The arson that preceded the arrest fits European anti-drone-activism targeting defense contractors on both sides of the conflict and need not signal Russian coordination. Without formal attribution, allied governments cannot invoke hybrid-attack response mechanisms, leaving suppliers like Delair without a defined security escalation posture.

Sources:

1: Un droniste français visé par une tentative d'espionnage au profit de la Russie - France 24

2: France Arrests Suspected Russian Spy in Drone Plant - Kyiv Post

3: France Probes Suspected Russian Sabotage and Espionage Cases - Defence Matters

Un fleuron français des drones militaires visé par une tentative d'espionnage au profit de la Russie - AFP

IC Oversight & Authorities

DOJ Inspector General Nominee Berthiaume Refuses to Call January 6 an Attack During Senate Confirmation Hearing

BLUF: Berthiaume's confirmation as DOJ Inspector General is likely within 90 days, installing a watchdog whose definitional flexibility on January 6 signals deference to administration equities over statutory independence.

Don Berthiaume, Trump's nominee for DOJ Inspector General, told the Senate Judiciary Committee on June 17 that he would not call January 6 an "attack" 12. He described the events as "protest activity," acknowledged unlawful entry into the Capitol, and said the term "attack" implies "a coordinated effort to attack specific things," while conceding that physical violence occurred outside the building 12. Sen. Richard Blumenthal (D-CT) told Berthiaume the questioning was designed as "a test of your prospective independence" and that the nominee was "failing that test" 13. The Senate Judiciary Committee advanced the nomination 14-8 on Thursday, with all Republicans and two Democrats voting in favor 4.

Analyst Note: The 14-8 committee advance, with two Democrats joining all Republicans, gives Berthiaume bipartisan floor cover that has cleared comparable nominees, and full Senate confirmation within 90 days is likely. Analytic confidence is moderate, resting on the vote pattern and the absence of organized floor opposition. The hearing record carries the sharper signal: a watchdog who categorizes documented Capitol violence as "protest activity" will apply the same definitional flexibility to politically sensitive referrals, compressing whatever independence Congress built into the IG statute. Berthiaume's phrasing may instead reflect lawyerly precision rather than political accommodation, and tenure could prove more independent than hearing testimony implies. Oversight advocates should treat the distinction as unresolved and route sensitive DOJ referrals through alternative mechanisms from confirmation forward.

Sources:

1: Nominee for DOJ watchdog refused to call Jan. 6 violence an 'attack' on the Capitol - CNN

2: Nominee for DOJ watchdog says violence on January 6 wasn't an 'attack' on the Capitol - Yahoo News

3: Justice Department inspector general nominee refuses to call Jan 6 an attack - MSNBC

4: DOJ Inspector General Pick Moves Closer to Senate Confirmation - Bloomberg Law

COLLECTION GAPS

UNCLASSIFIED // OPEN SOURCE