//
OFFLINE — VIEWING CACHED CONTENT
← Back to Archive

IC BRIEF

Current as of 0424 EDT (UTC-04), Wednesday 24 June 2026

Contents

8 stories from 29 sources across 29 organizations

KEY JUDGMENTS

At least one additional EU or NATO state will likely announce a counterintelligence action, whether investigation, expulsion, or prosecution, against foreign intelligence operations under diplomatic cover before August 1. Moderate confidence reflects the sustained Eastern European CI disclosure tempo since 2022 and political cover from Britain's ten-year sentencing and Moldova's Federal Security Service (FSB) officer detention, though no state has publicly committed to imminent action.

NSA is likely to remain without Anthropic's Mythos 5 through late October, as the unresolved Chinese-access suspicion, an active Pentagon lawsuit, and irreconcilable White House-Anthropic accounts each block restoration. High confidence rests on two independent primary reports confirming the termination. Whether Pulte's directed 400-person National Counterterrorism Center (NCTC) reduction executes within 90 days remains genuinely uncertain. Moderate confidence reflects multi-outlet corroboration of the directive against single-source reporting on internal timelines. His "sufficient for now" direction to deputies is a deliberate pause that congressional pressure has not overcome in comparable IC workforce actions.

The observable that would alter both IC capability assessments is whether congressional intelligence committees publicly frame the workforce and AI access losses as compounding threats before the Clayton confirmation hearing. Absent that linkage, each disruption remains siloed in separate oversight channels with lower political weight.

IC Technology & Surveillance

Parts of NSA Lose Mythos 5 Access After White House Imposes Export Limits on Anthropic

BLUF: NSA will likely operate without frontier Anthropic model access through late October, degrading the agency's ability to red-team AI-enabled cyber threats at a period of accelerating risk.

Parts of the NSA lost access to Anthropic's Mythos 5 model on Friday after the Trump administration imposed export controls on Anthropic this month, Defense One and Nextgov/FCW reported, citing two people familiar with the matter 12. The agency may retain access to earlier model versions under prior arrangements; the terminated access had come through Project Glasswing, an April program giving select security researchers early access to Mythos Preview 12. Semafor reported, citing a person familiar with the matter, that the controls stemmed partly from suspicions a China-linked group had accessed Mythos 3. Trump adviser David Sacks separately said Amazon CEO Andy Jassy alerted the administration to a Fable 5 jailbreak that Anthropic CEO Dario Amodei declined to fix, an account Anthropic disputed by stating the White House never raised Chinese access in those conversations 3.

Analyst Note: NSA is likely to remain without Mythos 5 through late October. Three overlapping barriers make concurrent resolution improbable: the unresolved Chinese-access allegation, the disputed jailbreak account, and Anthropic's active Pentagon lawsuit. High confidence rests on two independently sourced primary reports confirming the termination, with named actors on both sides publicly committed to irreconcilable accounts. The access loss reverses the May procurement push that was designed to preserve that capability. The termination may instead reflect political leverage over Anthropic's litigation posture rather than a response to a verified intelligence breach. NSA and CYBERCOM face a materially different cost and lead-time calculus depending on whether they stand up alternative frontier AI contracts or wait on restored access.

Sources:

1: Parts of NSA lose Mythos 5 access after White House imposes limits - Defense One

2: Parts of NSA lose Mythos 5 access amid Anthropic supply chain dispute - Nextgov/FCW

3: White House move to limit Anthropic linked to concerns about Chinese access to Mythos - Semafor

Prior Reporting - [White House backs $9 billion chip plan and Anthropic deal to keep spy agencies at AI frontier](https://cryptobriefing.com/trump-anthropic-ai-spy-agencies-deal/) (2026-05-23) - [White House, Anthropic Near Deal For Spy Agencies to Use AI](https://www.theinformation.com/briefings/white-house-anthropic-near-deal-spy-agencies-use-ai) (2026-05-22) - [White House Approves $9 Billion for Spy Agencies to Catch Up on AI](https://gvwire.com/2026/05/22/white-house-approves-9-billion-for-spy-agencies-to-catch-up-on-ai/) (2026-05-22) - [White House clears $9B for spy agencies' AI chips](https://www.arkansasonline.com/news/2026/may/23/white-house-clears-9b-for-spy-agencies-ai-chips/) (2026-05-23) - [White House Approves $9 Billion for Spy Agencies to Catch Up on A.I.](https://www.nytimes.com/2026/05/22/us/politics/spy-agencies-ai-chips-shortage.html) (2026-05-22)

Lawfare Analysis Warns Adversaries Exploiting Commercial Big Data to Track US Forces as Iran War Exposes Intelligence Vulnerability

BLUF: Confirmed adversary exploitation of commercial location data against US forces in a war zone has not overcome the institutional inertia blocking department-wide mobile security directives since 2016.

United States Central Command (USCENTCOM) told Congress on April 14 it received multiple threat reports of adversary exploitation of commercial location data against U.S. personnel in Operation Epic Fury, the first confirmed case of this threat in an active war zone 1. A Lawfare analysis published June 22 assessed Iran as the likely actor and noted that Chinese firm MizarVision marketed AI-fused tracking of U.S. military positions in the Middle East, per the Washington Post 2. CENTCOM's response also disclosed that advertising IDs remain enabled on DoD smartphones despite NSA and CISA recommendations, with USCENTCOM only gaining administrative location-sharing controls in May 1. Fourteen bipartisan lawmakers wrote to DoD Chief Information Officer (CIO) Kirsten A. Davies in late May demanding advertising ID disablement, browser replacement, and data broker opt-out enrollment for service members 1.

Analyst Note: Force protection doctrine must now account for commercial data broker pipelines as a state-level targeting vector, not a theoretical risk. Moderate confidence rests on CENTCOM's direct disclosure to Congress, though the specific Iran attribution derives from Lawfare's policy analysis without independent corroboration. Advertising IDs have remained active on government smartphones despite NSA and CISA guidance for years, and USCENTCOM only gained location-sharing administrative controls in May. Chinese commercial firms actively marketing AI-fused military position tracking to conflict zones confirms the threat ecosystem has scaled beyond any single adversary actor. Whether bipartisan congressional pressure produces directive-level DoD action turns on a bureaucratic calculus that has resisted escalation since 2016.

Sources:

1: In letter to DoD, Heinrich Reveals That Foreign Adversaries Are Using Commercial Location Data to Target U.S. Servicemembers in the Middle East, Calls on DoD to Adopt Commonsense Safeguards to Protect U.S. Troops - U.S. Senator Martin Heinrich

2: Iran War Shows Adversaries Can Exploit Big Data, Too - Lawfare

Prior Reporting - [Not So Smart! Pentagon Knew Servicemembers Could Be Tracked by Phones](https://nationalinterest.org/blog/buzz/not-so-smart-pentagon-knew-servicemembers-could-be-tracked-by-phones-ps-060326) (2026-06-03) - [Troops' phones gave away location data to foreign adversaries](https://www.theregister.com/security/2026/05/28/troops-phones-leaked-location-data-to-foreign-adversaries/5248108) (2026-05-28) - [Commercial location data is being used to target US servicemembers, lawmakers warn](https://www.nextgov.com/cybersecurity/2026/05/commercial-location-data-being-used-target-us-servicemembers-lawmakers-warn/413851/) (2026-05-29) - [Foreign Adversaries Are Using Commercial Location Data to Target U.S. Servicemembers In the Middle East, Wyden, Harrigan and 12 other bipartisan Members of Congress, Reveal; Members Call on Department to Adopt Commonsense Safeguards to Protect U.S. Troops](https://www.wyden.senate.gov/news/press-releases/foreign-adversaries-are-using-commercial-location-data-to-target-us-servicemembers-in-the-middle-east-wyden-harrigan-and-12-other-bipartisan-members-of-congress-reveal-members-call-on-department-to-adopt-commonsense-safeguards-to-protect-us-troops) (2026-05-29)

Adversary Intelligence

UK Jails Two Men Including Border Force Officer for Spying on Pro-Democracy Activists for Hong Kong and Chinese Authorities

BLUF: Judicial confirmation of Hong Kong Economic and Trade Office (HKETO) as a tasking node for intelligence collection on UK soil forces London into a binary choice between restricting the office's diplomatic footprint or accepting the precedent.

On June 18, an Old Bailey judge sentenced Border Force officer Chi Leung Wai to ten years and Chung Biu Yuen, a former Hong Kong police superintendent, to eight years for breaching the National Security Act 2023 by assisting a foreign intelligence service 12. Prosecutors established that Yuen, operating as an office manager at the Hong Kong Economic and Trade Office, received tasking requests from Hong Kong authorities and directed Wai to surveil UK-based pro-democracy campaigners 12. Targets included former lawmaker Nathan Law, activists the network called "cockroaches," and British politicians critical of Beijing 2. Wai drew an additional four years, served consecutively, for misconduct in public office after investigators established he had queried Home Office systems on individuals of interest to Hong Kong authorities 1.

Analyst Note: The four-year consecutive term for Wai's Home Office database exploitation signals UK courts treat institutional access abuse as a distinct aggravating category, not a sentencing footnote. Judge Cheema-Grubb's findings place the HKETO tasking relationship in judicial record, converting Beijing's allegation framing into established courtroom fact that constrains British diplomatic positioning. The Pontefract flat entry under maintenance-worker cover confirms the network ran physical intimidation alongside passive collection. No confirmed link above the HKETO office-manager level leaves open that the cell operated with substantial local initiative rather than as a formally tasked arm of China's principal intelligence services. No public indicator suggests the government will move against HKETO's institutional presence beyond what the conviction alone compels.

Sources:

1: UK Border Force officer jailed for Hong Kong spying - UK Defence Journal

2: UK border official and former Hong Kong cop jailed for spying on behalf of China - ABC News

Prior Reporting - [UK jails Chinese-Brits for spying on Hong Kong dissidents for Beijing](https://hongkongfp.com/2026/06/19/uk-jails-chinese-brits-for-spying-on-hong-kong-dissidents-for-beijing/) (2026-06-19) - [A U.K. border official and a former Hong Kong cop are sentenced for spying on China's behalf](https://www.nbcnews.com/world/asia/uk-border-official-former-hong-kong-cop-sentenced-spying-china-rcna350721) (2026-06-18) - [A U.K. border official and a former Hong Kong cop sentenced for spying on China's behalf](https://www.washingtontimes.com/news/2026/jun/18/uk-border-official-former-hong-kong-police-officer-sentenced-spying/) (2026-06-18) - [A UK border official and a former Hong Kong cop sentenced for spying on China's behalf](https://www.washingtonpost.com/world/2026/06/18/uk-china-spying-trial-sentences/9ea02a18-6b20-11f1-830e-133d20cadd28_story.html) (2026-06-18) - [UK warns against foreign intimidation over Hong Kong-linked spying convictions](https://www.scmp.com/news/hong-kong/politics/article/3353026/uk-warns-against-foreign-intimidation-over-hong-kong-linked-spying-convictions) (2026-05-08) - [2 UK-Chinese dual nationals convicted of spying on Hong Kong dissidents](https://hongkongfp.com/2026/05/08/2-uk-chinese-dual-nationals-convicted-of-spying-on-hong-kong-dissidents/) (2026-05-08)

Moldova Detains Suspected Russian FSB Officer for Collecting Intelligence on Transnistria

BLUF: Formal espionage charges are likely before late July, giving Chisinau documented grounds to pursue diplomatic expulsions and strengthen its EU accession security credentials.

Moldova's Security and Intelligence Service (SIS) detained a Russian national at Chisinau International Airport on June 23, identifying him as a Federal Security Service officer who entered under a monastery-visit cover story with the left bank of the Dniester as his actual destination 123. SIS stated his purpose was to collect data on the Transnistrian security zone for use against Moldova's sovereignty, territorial integrity, and defense capability 12. A court remanded him for 30 days at the request of Moldova's Prosecutor's Office for Combating Organised Crime and Special Cases 134. SIS also disclosed that the same individual had been present in Moldova from September 2017 to September 2019 using an unaccredited Russian diplomatic passport, in violation of the Vienna Convention 124. Russia's embassy in Moldova called the detention unlawful, claimed consular access has been denied, and raised health concerns about the detainee.

Analyst Note: The 2017-2019 access under an unaccredited diplomatic passport marks this as recurring multi-year tasking against the Transnistrian perimeter rather than an isolated mission. Formal espionage charges are likely before the 30-day remand expires around 23 July, giving Moldova documented standing to pursue diplomatic expulsions and bolster EU accession security credentials. Confidence is moderate, with sourcing resting entirely on SIS's institutional account and limited visibility into how robustly Prosecutor's Office for Combating Organised Crime and Special Cases (PCCOCS) can prosecute conduct nearly a decade old. Moldova may instead be staging a high-profile counterintelligence arrest primarily to signal security-sector competence to EU evaluators rather than to advance a case of exceptional operational significance. Whether formal charges materialize governs whether EU partners treat this as actionable counterintelligence evidence or a political detention, shaping what diplomatic measures Moldova can credibly request.

Sources:

1: Russian national detained in Moldova for collecting intelligence on Transnistria - Ukrainska Pravda

2: Russian national detained in Moldova for collecting intelligence on Transnistria - European Pravda

3: In Moldova, an officer of the Russian FSB who was collecting data on Transnistria has been detained - Ukrainian News Network (UNN)

4: Moldova detains Russian FSB officer for unauthorized intelligence gathering - Mezha.net

SIS: A fost reținut un cetățean al Federației Ruse, ofițer FSB, la intrare în Republica Moldova - Security and Intelligence Service of Moldova (SIS)

Iran Arrests More Than 3000 Citizens Accused of Cooperating With Israel in Sweeping Counterintelligence Crackdown

BLUF: Tehran is converting wartime emergency authority into a permanent repression architecture, routing political dissent through espionage statutes designed to execute at scale without standard evidentiary safeguards.

Iran's judiciary spokesman Asghar Jahangir announced 3,292 citizens detained for "collaboration with the enemy," of whom 684 face charges of "operational activities" for Israel, 1,258 for political propaganda, with 1,061 indictments already filed 12. Parliament this week passed an emergency bill to prosecute espionage suspects under wartime legal provisions, and Iran International named three men as executed for espionage over the past two weeks 3. Newsweek reported Islamic Revolutionary Guard Corps (IRGC) ground forces killed two people and arrested over 50 in Sistan-Baluchestan under Operation "Martyrs of Security," with authorities pledging continued pursuit of "potential accomplices" 4. Amnesty International described the proceedings as "expedited and grossly unfair," and Norway-based Iran Human Rights reported at least 40 politically motivated executions since January, including 19 protesters 124.

Analyst Note: Parliament's wartime espionage bill routes defendants through accelerated proceedings that bypass the ordinary penal code's evidentiary floor, embedding a durable repression mechanism rather than authorizing a temporary sweep. Three executions completed in two weeks and 684 defendants charged with operational activities establish both capacity and institutional mandate to sustain that tempo. The arrest breakdown, concentrated on propaganda and social media activity rather than tradecraft, suggests the primary driver is domestic consolidation against opposition networks under a counterintelligence label rather than a genuine counterespionage response to Israeli penetration. Official tallies derive from PressTV carrying judiciary statements directly, with secondary coverage converging without independent corroboration of the arrest counts.

Sources:

1: Iran Arrests More Than 3,000 Citizens Accused Of Cooperating With Israel - Worthy News

2: Iran to charge thousands with 'treason' over alleged Israel ties - Israel Hayom

3: Iran arrests over 700 accused of spying for Israel amid espionage crackdown - Iran International

4: Iran Escalates Crackdown on Accused Israeli Spies With Mass Raid - Newsweek

Iran's Judiciary: Legal proceedings launched against 3,121 for cooperating with enemy - PressTV

Allied Intelligence

Shin Bet Chief Warns Next October 7 Style Attack Could Target Eilat From Jordan or Sea

BLUF: Zini's warning without a disclosed intelligence basis forces Israeli southern command to resource against a structurally plausible but unsubstantiated threat vector at the expense of validated priorities.

Haaretz reported on June 22, citing several unnamed security sources, that Shin Bet chief David Zini warned in closed-door discussions that "the next October 7 will be in Eilat" 1. According to the report, Zini directed senior agency officials to prioritize attack scenarios on the city, warning specifically of ground infiltration from Jordan and a possible maritime approach from the Red Sea 23. Security officials quoted in the reporting questioned the intelligence basis, with some within the Shin Bet characterizing the scenario as speculative and saying they did not know what information Zini was relying on 24. The Shin Bet subsequently issued a public statement saying there is "no concrete information or warning" of an attack on Eilat, describing the Eilat visit as routine threat study conducted as part of Zini's assumption of office 23.

Analyst Note: The disconnect forces Israeli southern command into a planning dilemma: resource against scenarios the Shin Bet publicly disclaims, or accept under-investment risk if the chief's private assessment proves prescient. When Zini's own staff cannot identify his intelligence basis, the assessment reflects conceptual vulnerability mapping rather than collected threat reporting. Eilat's structural exposure through the Jordanian corridor and Red Sea approaches remains genuine regardless. Haaretz's single-source framing, citing unnamed security officials, may have elevated doctrinal planning language into a specific warning, making the agency's disclaimer accurate rather than a retraction. The Iran mass-arrest wave meanwhile threatens the collection architecture that would produce the warning Zini's staff says is absent.

Sources:

1: Shin Bet chief believes 'next October 7' attack will be in Israel's Eilat - Haaretz

2: Shin Bet chief warns Eilat could be target of next Oct. 7-style attack - Ynet News

3: Next October 7 attack may happen in Eilat, Shin Bet head David Zini says - report - The Jerusalem Post

4: Shin Bet chief said to fear Oct 7-style attack on Eilat, despite no intel on threat - Times of Israel

Pro-Palestine Groups Sue German Domestic Intelligence Service BfV Over Surveillance and Extremist Designations

BLUF: Germany's Interior Ministry is unlikely to appeal the Berlin court ruling within 90 days, as re-designation in the forthcoming 2025 Bundesamt für Verfassungsschutz (Federal Office for the Protection of the Constitution) (BfV) report offers a lower-cost path to preserving surveillance authority.

The European Legal Support Centre filed legal challenges on behalf of Thawra Hamburg, BDS Berlin, and Jewish Voice for a Just Peace against Germany's Verfassungsschutz, contesting the designation of all three as "proven extremist endeavors" under the category "secular pro-Palestine extremism" 12. The Hamburg Administrative Court on January 26 ordered surveillance of Thawra Hamburg suspended, finding the authority had not provided sufficient legal justification for monitoring the group's political activities 2. At the end of April, the Berlin Administrative Court ordered the BfV to remove its designation of Jewish Voice from the 2024 annual intelligence report, finding no demonstrable connection between the group's statements and actual violence 34. The ruling does not extend to future reports, and the Federal Interior Ministry may appeal to the Higher Administrative Court 4.

Analyst Note: The Federal Interior Ministry is unlikely to file a formal appeal within 90 days. The decision point shifts to the forthcoming 2025 BfV annual report, where re-designation of Jewish Voice for a Just Peace preserves surveillance authority without contesting a ruling limited to an already-published document. Analytic confidence is low: Interior Ministry deliberations are not observable through open-source collection, and all available reporting originates from the litigant (ELSC) and outlets sharing explicit ideological alignment with the plaintiffs. The ministry may nonetheless prefer an appeal because the Berlin ruling contradicts the NRW Higher Administrative Court's 2024 upholding of the Palestine Solidarity Duisburg ban, creating an opportunity for binding appellate precedent. If it appeals, civil society organizations must fund Higher Administrative Court proceedings; if not, resource allocation shifts to monitoring the 2025 BfV report for re-designation.

Sources:

1: Pro-Palestine groups sue German intelligence for spying - The New Arab

2: ELSC is taking legal action against German Domestic Intelligence Services for surveilling Palestine solidarity groups - European Legal Support Center

3: Victory for Jewish Voice – and a heavy blow to the German Staatsräson! - The Left Berlin

4: Jewish Voice for a Just Peace wins partial success in its case against the German Secret Service - World Socialist Web Site

IC Workforce & Organization

Acting DNI Pulte Fires 6 ODNI Staff and Sends 45 Back to Home Agencies With 400 NCTC Cuts Planned

BLUF: Pulte's planned NCTC workforce cuts of roughly 400 remain genuinely uncertain within 90 days, as bipartisan congressional resistance and operational equities in counterterrorism coordination constrain execution.

Acting Director of National Intelligence (DNI) Bill Pulte on Friday terminated six staff and returned 45 joint-duty career officials to their home agencies, three sources told CBS News and CNN 12; CNN identified the six as political appointees installed by former DNI Tulsi Gabbard 2. No NCTC personnel were included, and Pulte told deputies the 51 removals were sufficient for now, per CBS News 1. Prism News separately reported Pulte has directed staff to identify roughly 400 NCTC employees for termination in coming weeks, a round distinct from the initial 51 removals 3. Senate and House Intelligence Committee ranking members Warner and Himes sent Pulte a letter Monday warning that large-scale cuts risk jeopardizing the organization's post-9/11 coordination mission, according to CNN and CBS News 12.

Analyst Note: Formal separation actions affecting 200 or more NCTC employees within 90 days remain genuinely uncertain. Pulte holds a documented presidential mandate and has tasked staff to identify candidates, but NCTC's core counterterrorism functions represent institutional friction that has historically absorbed comparable Office of the Director of National Intelligence (ODNI) reform proposals before completion. Moderate confidence reflects the corroborating weight across outlets set against the absence of primary-source reporting on internal execution timelines. Republican alignment on NCTC's operational capacity and the Section 702 lapse both create countervailing pressure, constraining the political viability of executing full cuts within the window.

Sources:

1: ODNI under Pulte fires 6 staff, sends 45 back to home agencies - CBS News

2: Trump's acting chief of national intelligence fires 6 political appointees, removes dozens of career officials, sources say - CNN

3: Pulte cuts 51 staffers from intelligence office after Trump order - Prism News

Bill Pulte's first days as acting DNI set off alarms with lawmakers - The Hill

Prior Reporting - [Trump directs interim US intelligence chief Bill Pulte to downsize agency](https://www.aljazeera.com/news/2026/6/10/trump-directs-interim-us-intelligence-chief-bill-pulte-to-downsize-agency) (2026-06-10) - [Trump primes Pulte to 'execute the immediate and needed downsizing' of ODNI](https://www.washingtonexaminer.com/news/white-house/4602536/trump-bill-pulte-execute-immediate-needed-downsizing-odni/) (2026-06-10)

COLLECTION GAPS

UNCLASSIFIED // OPEN SOURCE