//
OFFLINE — VIEWING CACHED CONTENT
← Back to Archive

IC BRIEF

Current as of 0345 EDT (UTC-04), Thursday 02 July 2026

Contents

8 stories from 33 sources across 32 organizations

KEY JUDGMENTS

Allied counterintelligence services disrupted Iranian, Russian, and Cuban intelligence operations across five nations this cycle. Additional Iranian intelligence disclosures against Western or allied targets are very likely within the next three months, driven by concurrent exposure of Islamic Revolutionary Guard Corps (IRGC)-directed university cyber infiltration and transactional HUMINT recruitment in Israel. Moderate confidence reflects the breadth of activity across both modalities, though each subsequent disclosure depends on independent prosecutorial decisions. At least one of the four adversary networks exposed will likely be linked publicly to additional operatives in the same window.

CIA faces parallel records demands from three branches of government: a federal preservation order the court will likely grant by October, career officials resisting Office of the Director of National Intelligence (ODNI)'s directive to centralize espionage-target lists, and a House task force with sworn testimony that CIA misled Congress on MKUltra's scope. A simultaneous formal demand for compartmented material from two or more of these tracks is unlikely before January, since neither the task force nor the Brennan litigation has escalated to compulsory process. A task force subpoena or discovery motion in the Brennan case before September would shift that assessment.

IC Oversight & Policy

Former CIA Director Brennan Sues Trump Administration to Preserve Investigation Records

BLUF: Brennan's preservation suit will likely secure a court order by October 1, freezing the evidentiary record and constraining prosecutorial discretion before any charging decision materializes.

Former CIA Director John Brennan filed suit against the Trump administration in the U.S. District Court for the District of Columbia on Tuesday, seeking a court order to preserve records from investigations targeting him 12. The 46-page complaint names President Trump, acting Attorney General Todd Blanche, FBI Director Kash Patel, and Florida-based prosecutors as defendants 2. Brennan's attorneys stated that investigators are examining alleged "phantom criminal conduct," including whether he made false statements to Congress about the 2016 Russian interference assessment, and separately whether former officials conspired to undermine Trump 12. No charges have been filed, and the Justice Department, while declining to confirm or deny an investigation, called Brennan's retribution claim "rich" 12.

Analyst Note: The court will likely grant Brennan's preservation motion by October 1, 2026, since such orders carry a low evidentiary bar and minimal government burden. A grant locks in the record ahead of any charging decision and strengthens a future vindictive-prosecution defense, while denial leaves retention entirely at DOJ's discretion. Confidence is high, given that preservation motions are procedurally routine and courts rarely demand proof of an active prosecution first. Coverage rests on the underlying filing as sole primary source, with three secondary outlets converging independently for broad corroboration. DOJ has now placed a named on-the-record response into the case, calling the retribution claim "rich" while still declining to confirm or deny a probe. The filing may function chiefly as public rebuttal to years of presidential criticism rather than anticipation of imminent charges, since no active investigation has been confirmed, and a grant would compel Florida prosecutors to formally preserve investigative records before deciding whether to indict.

Sources:

1: Former CIA chief John Brennan sues to preserve Trump probe records - Axios

2: Former CIA Director John Brennan sues Trump administration to preserve records from investigations into him - NBC News

Brennan v. Trump, et al. — Complaint for Declaratory and Injunctive Relief (Case 1:26-cv-02323, Document 1) - U.S. District Court for the District of Columbia

Brennan Sues Trump Administration to Preserve Records in DOJ Criminal Probe - Bloomberg

Prior Reporting - [Ex-CIA Director John Brennan seeks court order requiring records from investigations be preserved](https://ktar.com/national-news/ex-cia-director-john-brennan-seeks-court-order-requiring-records-from-investigations-be-preserved/5885132/) (2026-07-01) - [Former CIA Director John Brennan sues Justice Dept., Trump officials over criminal probes](https://www.cbsnews.com/news/former-cia-director-john-brennan-sues-justice-dept-trump-officials/) (2026-07-01) - [Trump foe John Brennan sues administration demanding investigative records into him be preserved](https://www.cnn.com/2026/07/01/politics/trump-foe-john-brennan-sues-administration-records) (2026-07-01) - [Former CIA director John Brennan sues over Justice Dept. investigation](https://www.washingtonpost.com/national-security/2026/07/01/former-cia-director-john-brennan-sues-over-justice-dept-investigation/) (2026-07-01)

US Spy Agencies Resist White House Plan to Create Master List of Foreign Espionage Targets

BLUF: Full CIA and FBI compliance with the ODNI consolidation directive is very unlikely by October 1, 2026, as institutional security imperatives outweigh White House pressure to centralize compartmented espionage rosters.

The Trump administration directed intelligence agencies, through the Office of the Director of National Intelligence under acting director Bill Pulte, to compile a single master list of foreign spies, suspected spies, and potential recruits operating in the United States 12. The CIA and FBI have declined to turn over their lists, with senior counterintelligence officials warning that a centralized database could leak and compromise sensitive operations 12. The FBI's list would include individuals it wants to investigate or arrest, while the CIA's would cover potential recruitment targets, according to reporting on the interagency dispute 2. The New York Times first reported the order on June 29, with officials telling the paper the effort was meant to reduce duplication of effort and provide "transparency," while an official in Pulte's office separately cited National Security Presidential Memorandum 7, the administration's national security strategy targeting alleged "anti-American activity" on the left, as justification 13.

Analyst Note: Full CIA and FBI compliance with ODNI's directive to submit espionage-target rosters into a single database is very unlikely by October 1, 2026, since a single leak of a consolidated list would expose recruited assets and ongoing investigations across both services, and Pulte's lack of prior intelligence experience deepens career officials' reluctance to place compartmented identities under his custody. Moderate confidence reflects consistent resistance across all four accounts, though none identify a White House countermeasure capable of forcing compliance before the deadline, and reporting rests on a single primary account from the New York Times, with other outlets amplifying rather than independently confirming. The FBI's list targets individuals for investigation or arrest while the CIA's covers recruitment assets, a distinction absent from initial reporting on the rift, and Trump's motive may extend beyond streamlining redundant recruitment to identifying which Russia- and Ukraine-linked figures could corroborate the 2016 election-interference findings he has sought to discredit. Continued refusal keeps recruitment and investigative targeting authority compartmented within the operating agencies rather than centralized under Pulte.

Sources:

1: US spy agencies resisting White House plan to create master list of espionage threats - IntelNews

2: Clash erupts after Trump orders CIA and FBI chiefs to hand over 'spy list' of every US agent amid safety fears - LBC

3: Donald Trump spy list: This may be the most bizarre order of Trump's presidency. What's going on? - Slate

Inside Intelligence Agencies, a Fight Over Building a Master List of Spies - The New York Times

Prior Reporting - [Trump Demands Master List of Espionage Targets Tracked by U.S. Intel](https://newrepublic.com/post/212535/trump-master-list-espionage-targets-tracked-us-intel) (2026-06-30) - [Trump Administration Seeks Single Database of Foreign Espionage Targets - Reports](https://sputnikglobe.com/20260630/trump-administration-seeks-single-database-of-foreign-espionage-targets---reports-1124378589.html) (2026-06-30)

House Declassification Task Force Holds MKUltra Hearing as Ex-CIA Officer Warns Temptation to Replicate Program Still There

BLUF: Luna's task force now holds sworn testimony strong enough to compel CIA declassification, but Helms's 1975 document destruction ensures any resulting accounting remains permanently incomplete.

The House Oversight Committee's Task Force on the Declassification of Federal Secrets held a hearing on June 30 titled "Mind Control and Accountability: Uncovering the Truth of the CIA's MKULTRA Project," examining the 1953 program's history and continued classification 12. Brown University senior fellow Stephen Kinzer testified that MKULTRA officers were authorized to obtain "expendables" from foreign CIA stations, human subjects who would not be missed if they disappeared, and characterized the resulting experiments as medical torture 13. Investigative journalist Tom O'Neill testified that the CIA misled Congress in 1977, stating that documents he reviewed show related passages were removed from what Congress received, and told Rep. Scott Perry that 149 known subprojects existed with victims potentially numbering in the tens of thousands 14. Task Force Chairwoman Anna Paulina Luna said former CIA Director Richard Helms ordered destruction of MKULTRA records before the 1975 Church Committee investigation 13. Retired CIA operations officer Rick De La Torre told NewsNation the temptation for a similar program to recur remains absent adequate oversight, while The Hill reported he does not believe the agency's related research ever fully stopped 56.

Analyst Note: The hearing converts prior investigative reporting into sworn testimony, giving Luna's task force documented grounds to compel further CIA declassification or draft mandatory-disclosure legislation, though Helms's pre-1975 destruction of MKULTRA records means any resulting victim count or damage assessment stays structurally incomplete regardless of what the CIA now releases. O'Neill's claim that Congress received an altered 1977 report undercuts the agency's credibility on self-reporting the program's scope, sourcing that rests primarily on the committee's own hearing record but converges broadly with independent outlet coverage of the live proceedings. The task force's parallel mandates on the Kennedy assassination, COVID origins, and UAP will compete for committee time over the six-month review, slowing MKULTRA follow-through, and the Crane-Ginexi exchange on COVID-era NIH conduct suggests the hearing also serves broader anti-institutional messaging beyond narrow MKULTRA accountability.

Sources:

1: Hearing Wrap Up: Declassifying Information is Important for Preserving Public Trust - House Committee on Oversight and Government Reform

2: WATCH LIVE: House declassification task force holds hearing on MKULTRA - Washington Examiner

3: Congress tries to crack open CIAs secret MKUltra program - Straight Arrow News

4: Task Force holds hearing on CIA's MKULTRA project and calls for declassification - Federal Newswire

5: MK-Ultra hearing: ex-CIA officer says temptation to replicate program "still there" - NewsNation

6: Ex-CIA officer questions end of MK-Ultra research - The Hill

Prior Reporting - [Congressional Hearing on MKULTRA Scheduled for Tuesday](https://jfkfacts.substack.com/p/congressional-hearing-on-mkultra) (2026-06-28) - [Mind Control and Accountability: Uncovering the Truth of the CIA's MKULTRA Project](https://oversight.house.gov/hearing/mind-control-and-accountability-uncovering-the-truth-of-the-cias-mkultra-project/) (2026-06-28) - [Luna Announces Hearing on MKULTRA Experiments and Its Impact on Public Trust](https://oversight.house.gov/release/luna-announces-hearing-on-mkultra-experiments-and-its-impact-on-public-trust/) (2026-06-28) - [What to know about MK-Ultra as Rep. Luna ramps up scrutiny](https://thehill.com/homenews/administration/5878330-luna-mkultra-cia-history-hearing/) (2026-06-28)

IC Technology & Cyber

CISA Establishes ANCHOR-CI Advisory Council Replacing Trump-Disbanded CIPAC for Critical Infrastructure Cybersecurity Coordination

BLUF: DHS's deliberate omission of liability protections from Alliance of National Councils for Homeland Operational Resilience-Critical Infrastructure (ANCHOR-CI) makes it very unlikely by December 31, 2026 that critical infrastructure operators will share incident data at levels Critical Infrastructure Partnership Advisory Council (CIPAC) sustained.

DHS published a Federal Register notice on Wednesday establishing the Alliance of National Councils for Homeland Operational Resilience-Critical Infrastructure, or ANCHOR-CI, to replace the Critical Infrastructure Partnership Advisory Council that then-Secretary Kristi Noem disbanded in March 2025 12. Cybersecurity and Infrastructure Security Agency (CISA) will manage the program and its director must approve membership across four council types: sector, cross-sector, industry, and regional 234. DHS exempted ANCHOR-CI from the Federal Advisory Committee Act, citing the sensitive nature of the risk assessments involved, and is establishing the body for an initial two-year term renewable in two-year increments 34. Secretary Markwayne Mullin said the council will "ensure we have the right people in the room" to keep critical infrastructure secure 4. Cybersecurity Dive reported the new framework omits the liability protections that shielded industry information-sharing under CIPAC, a gap flagged by the Health-ISAC and WaterISAC 2.

Analyst Note: DHS is very unlikely to amend ANCHOR-CI to restore CIPAC-style liability protections before the initial two-year term expires in December 2026, leaving the gap Health-ISAC and WaterISAC flagged unresolved; the Federal Advisory Committee Act (FACA) exemption paired with the CISA director's expanded membership authority signals DHS traded liability shielding for administrative control, a design choice unlikely to reverse without legislative pressure. Sector operators are likely to keep withholding sensitive incident data in response, narrowing the threat intelligence CISA can draw from the councils and leaving it reliant on mandatory regulatory reporting rather than voluntary sharing. High confidence rests on DHS's filing addressing risk-assessment secrecy while omitting liability language entirely, pointing to deliberate policy rather than oversight, though the gap could instead reflect unresolved interagency antitrust disagreement DHS might still close through subsequent guidance. Multiple independently corroborating outlets, anchored to the primary Federal Register notice, support the reading.

Sources:

1: Establishment of the Alliance of National Councils for Homeland Operational Resilience—Critical Infrastructure (ANCHOR-CI) - Federal Register / DHS

2: DHS proposes new system for public-private infrastructure security collaboration - Cybersecurity Dive

3: DHS to unveil replacement council for critical infrastructure cybersecurity - CyberScoop

4: DHS Launches ANCHOR-CI Critical Infrastructure Councils - GovInfoSecurity

Allied Intelligence

Israel Arrests American Citizen in Jerusalem for Conducting Espionage for Iranian Intelligence

BLUF: Tehran's pattern of recruiting disposable foreign nationals for low-dollar collection tasks inside Israel forces Israeli counterintelligence to screen a far broader population than traditional espionage tradecraft would demand.

Israeli Police and the Shin Bet arrested a US citizen in his 20s in Jerusalem earlier this month on suspicion of spying for Iran, with an indictment expected in the coming days after prosecutors filed a declaration against him on Tuesday 12. Police said the joint operation followed indications from international security bodies and that the suspect faces charges of contact with a foreign agent and harming state security 1. Investigators allege he carried out missions for Iranian intelligence officials, including documenting and photographing sensitive sites, in exchange for payments ranging from tens to hundreds of dollars per mission 1. Police investigations officer Amichai Fanta said several other suspects have been exposed in recent months on similar espionage allegations, some tied to wartime activity 1.

Analyst Note: Israeli Police and Shin Bet's disclosure fits a pattern of Iran running disposable, low-cost recruits inside Israel rather than trained officers, paying tens to hundreds of dollars per mission for photographing sensitive sites instead of cultivating long-term penetration agents. Fanta's reference to several similar cases surfacing in recent months, some tied to wartime activity, points to sustained recruitment pressure rather than an isolated incident, and widens the pool of low-profile foreign nationals Israeli counterintelligence must screen given Tehran's apparent tolerance for minimal vetting and tradecraft training. Ynetnews and Times of Israel report independently but draw on the same police briefing, so the convergence reflects one official disclosure rather than separate investigative confirmation; the public rollout during wartime may double as deterrence messaging as much as case reporting.

Sources:

1: American citizen arrested in Israel on suspicion of spying for Iran - Ynetnews

2: 20-year-old US citizen arrested in Jerusalem, to be charged with spying for Iran - The Times of Israel

Israeli authorities arrest 20-year-old American citizen in Jerusalem on suspicion of conducting espionage missions for Iranian intelligence - OAN

Canadian CSE Discloses First Offensive Cyber Operation Against Fentanyl Supply Chain in Annual Report

BLUF: Communications Security Establishment (Canada) (CSE)'s selective disclosure of an unverifiable fentanyl operation functions more as a domestic budget narrative than as a measurable disruption to precursor supply chains.

CSE's 2025-26 annual report, released Monday, disclosed for the first time that Canada's signals-intelligence agency completed an active cyberoperation against foreign criminals brokering fentanyl precursor chemicals, stating the operation "disrupted and diminished their ability to operate" while CSE also supported law enforcement 12. The report withholds the brokers' identities, country of origin, and the specific disruption techniques used 1. CSE said it held three ministerial authorizations for active cyberoperations in 2025-26, the same number as the prior year 1. The agency also reported taking concurrent action against 10 major ransomware groups and, working with Five Eyes partners, conducted an operation against a ransomware-as-a-service group tied to more than 25 incidents against Canadian transportation, health care, pharmaceutical and business-sector targets, rendering its infrastructure inoperable and deleting stolen data the group had advertised for sale on the dark web 12.

Analyst Note: CSE's public confirmation of a completed offensive operation against fentanyl precursor brokers, its first such disclosure, reads as an institutional move to justify the agency's expanding budget and workforce through visible active-cyber outcomes rather than evidence of a broadened mandate, since authorized cyberoperations held flat at three for a second consecutive year. Withholding the brokers' identity, geography, and disruption method leaves the operation's actual effect on precursor flows unverifiable from open reporting, a gap sharpened by single-source reliance on Globe and Mail reporting drawn directly from CSE's own annual report. The shift from last year's account of developed campaigns to this year's disclosure of an executed operation could equally reflect political messaging answering sustained US pressure over fentanyl trafficking rather than a genuine escalation in tempo, leaving policymakers unable to independently assess whether disruption claims translate into reduced precursor supply.

Sources:

1: Canadas electronic spy agency conducted cyberattacks on criminals brokering fentanyl ingredients, report says - The Globe and Mail

2: Canada's spy agency goes offensive - The Icebreaker

Communications Security Establishment Canada Annual Report 2025-2026

Prior Reporting - [The Communications Security Establishment turns 80](https://wesleywark.substack.com/p/the-communications-security-establishment) (2026-06-29) - [Communications Security Establishment Canada releases its 2025-2026 Annual Report](https://www.canada.ca/en/communications-security/news/2026/06/communications-security-establishment-canada-releases-its-2025-2026-annual-report.html) (2026-06-29) - [CSEC Unveils 2025-2026 Annual Report](https://www.miragenews.com/csec-unveils-2025-2026-annual-report-1701132/) (2026-06-29)

Counterintelligence

State Department Deports Cuban Intelligence Influence Agent Who Operated Through ICAP Front Group in US for Over a Decade

BLUF: Lloga Dominguez's removal to Cuba by October 1 remains genuinely uncertain, leaving the administration's broader legal-status revocation campaign against Cuban Institute of Friendship with the People (ICAP)-linked operatives without a proven template.

Secretary of State Marco Rubio terminated the legal status of Cuban national Carlos Antonio Lloga Dominguez, whom the State Department said spent more than a decade working as a foreign subversive for the Cuban Institute of Friendship with the People (ICAP), Havana's "premier influence and intelligence front group" in the United States 12. Federal agents detained Lloga Dominguez along with his wife and son this week, and the three are in federal custody pending removal to Cuba 234. State Department spokesman Tommy Pigott said Lloga Dominguez maintained ties to the "transnational communist subversion network" throughout his time in the country and described ICAP as the central node of an intelligence and influence operation spanning more than 2,000 organizations in over 150 countries 12. Rubio sanctioned ICAP earlier in June under Executive Order 14404, freezing its US assets and barring Americans from transacting with it; ICAP has denied wrongdoing and calls itself a civil society organization 34.

Analyst Note: Removal of Lloga Dominguez and his family to Cuba by October 1 is genuinely uncertain, since standard immigration litigation, habeas petitions, or Cuba's acceptance protocols for deportees can stall a case that appears administratively closed. Confidence in this assessment is moderate, reflecting the case's dependence on unresolved legal and diplomatic mechanics that current reporting does not address. The action signals Treasury and the Justice Department intend to accelerate removals of other ICAP-linked individuals identified in the wider 145-organization influence probe, testing whether legal-status revocation can outpace court challenges. Cuba's historically inconsistent acceptance of deportees will determine whether this case becomes a workable template for the broader campaign.

Sources:

1: Secretary Rubio Terminates Legal Status of Cuban Communist Foreign Influence Operative - U.S. Department of State

2: Marco Rubio orders deportation of Cuban communist influence agent - Washington Times

3: Alleged Cuban influence operative, family in federal custody after Rubio revokes legal status - Fox News

4: Rubio Rescinds Legal Status of Cuban Influence Operative - The Epoch Times

Adversary Intelligence

Iranian Hacker Arrested in Montenegro for IRGC-Directed Economic Espionage Against 150 US Universities

BLUF: Arresting one operator will not disrupt what appears to be a decade-long IRGC academic theft network, and extradition to US custody is very unlikely by January 2, 2027.

Montenegrin police, working with the FBI, arrested a 39-year-old Iranian-Turkish national in Kotor last week; authorities named him only as A.B., though Turkish media identified him as Amir Barati 12. A New York court has charged him with computer fraud, hacking, identity theft and organized crime 1. Police allege hacking attacks dating to 2013 targeted US infrastructure, including more than 150 universities, and caused an estimated $3.4 billion in damage benefiting Iran's Islamic Revolutionary Guard Corps and other Iranian recipients 1, though authorities have not disclosed how the figure was calculated 2. He is due before a Podgorica court on the US extradition request 1. US authorities have not said whether the case connects to a 2018 federal indictment that charged nine other Iranian nationals in a similar university-hacking campaign 12.

Analyst Note: Montenegro's extradition process is very unlikely to reach a final Podgorica court ruling by January 2, 2027, given the multi-stage appeals typical of Balkan cases and the defendant's incentive to contest transfer absent an Iran-US treaty. Moderate confidence reflects reliance on a single detailed police account, with no public New York indictment yet anchoring the charges or timeline, and wire and analytical outlets adding framing rather than independent confirmation of the damage figure or identity. The case suggests Iran has extended its hacking playbook from infrastructure disruption into sustained IP theft for IRGC-linked recipients, echoing China's economic-espionage model, though the arrest may simply reflect Montenegro executing a years-old US request rather than any recent escalation, since the underlying conduct dates to 2013. Universities and prosecutors gain access to IRGC tasking and stolen-research pathways only if extradition succeeds; a blocked transfer leaves the 150 targeted institutions without confirmation of what was taken.

Sources:

1: Montenegro police arrest Iranian accused of hacking US universities - Euronews

2: Arrest of Iranian Hacker Spotlights Iran's Movement into Economic Espionage and IP Theft - Zero Day

Kotor: Uhapšen pripadnik Iranske revolucionarne garde, hakerskim napadima oštetio SAD za 3,4 milijarde dolara - RTCG (Radio Televizija Crne Gore)

COLLECTION GAPS

UNCLASSIFIED // OPEN SOURCE