//
OFFLINE — VIEWING CACHED CONTENT
← Back to Archive

IC BRIEF

Current as of 0405 EDT (UTC-04), Saturday 18 July 2026

Contents

10 stories from 34 sources across 29 organizations

KEY JUDGMENTS

We assess DoD will likely issue formal guidance restricting military exposure to commercial location-tracking data within 90 days, driven by three state adversaries independently exploiting commercial civilian infrastructure to target US and allied personnel. Moderate confidence reflects CENTCOM's pre-existing awareness and the 2018 Strava-directive precedent, offset by the complexity of addressing data brokers outside DoD control. Iran exploited Signaling System 7 (SS7) roaming and ad-tech data to track Gulf-based forces, Chinese operators used AI coding tools to automate government intrusions across four countries, and Morocco's Direction Générale de la Surveillance du Territoire (DGST) deployed Pegasus against Spanish cabinet ministers.

Japan's National Intelligence Bureau, now fully enacted, will likely reach initial operating capability by December with roughly 700 staff, expanding the allied intelligence baseline against People's Republic of China (PRC) threats. Moderate confidence reflects enacted legislation and political will, offset by consolidation complexity across 33,000 personnel with no prior cross-department sharing mandate. Taiwan's counterintelligence prosecution cadence will very likely sustain 2024 levels through Lai's term.

At least one additional disclosure of state-linked AI-tool exploitation will likely surface within 90 days, driven by active security-research interest. If DoD's response stays unit-level, the ad-identifier pathway Iran demonstrated remains available to any adversary with data-broker access.

IC Operations & Tradecraft

Declassified Documents Reveal Chinese Cyber Espionage of 220 Million US Voter Records During 2020 Campaign

BLUF: Framing publicly available voter rolls as a novel Chinese espionage threat serves the administration's legislative push for the Safeguard American Voter Eligibility (SAVE) Act far more than it advances election security.

President Trump used a primetime White House address Thursday night to allege China acquired voter registration records on more than 220 million Americans in 2020, including names, addresses, phone numbers and party affiliation, citing intelligence documents the White House declassified and posted the same day 1. Trump called the disclosure "the largest compromise of election data in history" and said his administration is notifying governors, senators and members of Congress in the affected states 1. U.S. intelligence agencies have said no foreign power interfered with 2020 ballot casting or counting, and elections expert David Becker noted voter registration files are largely public records that some states already sell or post online 1. SpyTalk's review of the newly declassified material found it added few details beyond what Trump stated in his speech 2.

Analyst Note: The disclosure functions primarily as a political vehicle for the SAVE America Act push rather than a substantive new intelligence finding, resting on a single primary source, the White House's own declassified release, with press coverage offering independent review rather than corroboration. That review found little beyond what was stated in the address, and elections officials note the underlying voter files are largely public records some states already sell or post online. Intelligence agencies still assess no foreign power altered 2020 ballot casting or counting, narrowing the security stakes to influence-targeting rather than vote manipulation, and the acquisition itself may reflect routine aggregation of already-public data resembling practices used by campaigns and commercial brokers rather than a novel espionage breakthrough.

Sources:

1: Trump gives primetime speech on elections as White House alleges Chinese access to voter data - CBS News

2: A Few Intelligence Nuggets Emerge in Newly Released Documents - SpyTalk

Election Integrity — declassified intelligence documents on foreign election interference - The White House

Former Morocco DGST Officer Reveals Decade of Pegasus Surveillance Against Journalists, Activists, and Spanish Officials

BLUF: Morocco's intermediary-based procurement model for Pegasus, now exposed but easily replicated, poses a standing counterintelligence threat to any Western service conducting training exchanges with Rabat.

A former DGST officer using the pseudonym Safir has provided a Forbidden Stories-led consortium, including Organized Crime and Corruption Reporting Project (OCCRP) and Amnesty International's Security Lab, with a decade-long account of Morocco's use of NSO Group Technologies (NSO) Group's Pegasus spyware, corroborated by leaked documents, targeting records, and internal training material 12. Safir said the DGST first saw a Pegasus demonstration at a Rabat villa in 2017, deployed it against journalists including Omar Radi and rights defenders such as Maati Monjib and Aminatou Haidar after exhausting cheaper tools like pre-infected phones and monitored internet cafes, and that a private intermediary shipped NSO-configured servers to DGST data centers to avoid a direct paper trail 123. The consortium's leaked database shows more than 200 Spanish mobile numbers selected for targeting, including Defence Minister Margarita Robles and Interior Minister Fernando Grande-Marlaska 3. A separate Forbidden Stories report says Moroccan intelligence targeted Guardia Civil officer Alberto Aguilera, whose number was selected five times starting on March 8, 2019, and that Safir described monitoring of Guardia Civil personnel who had traveled to Morocco to train DGST staff 4. Reporters found no evidence of Pegasus deployment by the DGST after late 2021 3.

Analyst Note: A former officer's testimony, corroborated by leaked documents and reported jointly by Forbidden Stories, OCCRP, and Amnesty's Security Lab, indicates DGST built a durable procurement structure rather than a one-off surveillance program: a private intermediary shipped NSO-configured servers directly to Moroccan data centers specifically to insulate Rabat from a state-to-state paper trail, a template that could let Morocco or successor clients resume covert targeting without repeating the exposure that produced this reporting. The operation also monitored Guardia Civil trainers inside Morocco, not just Moroccan dissidents, and this pressures Madrid to reassess safeguards for personnel training foreign services. The consortium sourcing, while convergent, comes from a single coordinated investigative cluster rather than independent confirmation, and Safir's account may overstate DGST's institutional culpability relative to the intermediary company that actually operated the NSO relationship.

Sources:

1: Morocco Denied Using Pegasus. Documents and Insider Accounts Tell a Different Story - Forbidden Stories

2: Moroccan Government Used Powerful Israeli Pegasus Spyware, Former Intelligence Officer Says - OCCRP

3: Moroccan whistleblower reveals how Rabat used Israel Pegasus spyware for surveillance - Middle East Eye

4: Moroccan intelligence is believed to have spied on Spanish agents who were training them - Forbidden Stories

Former ODNI Official Warns Proposed Master List of All Espionage Targets and Suspected Spies Poses Catastrophic Counterintelligence Risk

BLUF: Consolidating all US espionage targets and suspected agents into a single repository is unlikely within 12 months but would create a single point of catastrophic intelligence failure if compromised.

According to a New York Times report relayed by The Cipher Brief, Office of the Director of National Intelligence (ODNI) is requiring intelligence officials to submit the names of all foreign espionage targets, suspected spies, and potential recruits to build a single master list meant to prevent inter-agency conflicts and track threats in real time 1. Jonathan Fredman, a Princeton fellow who spent 36 years in CIA and ODNI legal and policy roles, wrote that compiling the list would require merging subject rosters from multiple FBI and CIA components, each posing its own counterintelligence exposure 1. He said a stolen or leaked compilation would cause incalculable damage, comparing its value to adversaries with a full roster of CIA officers, and noted that similar proposals have recurred for decades even though existing deconfliction procedures generally work as intended 1.

Analyst Note: ODNI is unlikely to complete and formally implement a unified master list of espionage targets, suspected spies, and potential recruits within 12 months, given the proposal's decades-long history of recurrence without adoption and the continued functioning of existing FBI-CIA deconfliction procedures. Moderate confidence reflects a documented pattern of similar proposals resurfacing and stalling, though internal ODNI deliberations and any current directive's institutional backing remain outside open-source visibility. Should compilation proceed, merging subject rosters from multiple FBI and CIA components would concentrate counterintelligence exposure in a single repository, and its theft or leak would hand adversaries a comprehensive map of US human intelligence operations comparable in value to a full CIA officer roster.

Sources:

1: A Master List of Espionage Targets, Suspected Spies, and Potential Recruits - The Cipher Brief

IC Technology & Cyber

Citizen Lab: Iran Exploiting Mobile Network Vulnerabilities to Track US Military Personnel During War

BLUF: Iran's fusion of SS7 access with commercial ad-tech data converts the unregulated location-broker ecosystem into a direct targeting threat against forward-deployed US personnel that carrier-side fixes alone cannot close.

The Financial Times reported that Iran exploited vulnerabilities in global telecom networks and the mobile advertising ecosystem to locate US military personnel and contractors across Iraq, Bahrain, and other Gulf states before and during the Iran war, citing research from the Mobile Surveillance Monitor and unnamed government officials 123. One method used Signaling System 7 (SS7), a decades-old roaming protocol; Gulf telecom networks reportedly blocked a wave of SS7 location requests aimed at specific devices, and regional officials suspected Iran was exploiting existing roaming agreements with local operators 3. A second method drew on commercial location data tied to smartphone advertising identifiers, and a US official told the Financial Times that Iran-linked actors used such datasets to identify hotels housing US government personnel and contractors in Iraq's Kurdistan region 3. Citizen Lab senior research fellow Gary Miller told the Financial Times that Iran "absolutely has capabilities to get real-time, immediate, and continuous location information" and said some tracking attempts trace to an Iranian mobile operator 4. TechCrunch and SC Media, both citing the Financial Times report, said the tracking enabled strikes on US bases and hotels in Iraq and Bahrain that caused several injuries, and US Central Command said in April it had received multiple threat reports of adversaries exploiting commercially available location data against deployed personnel 123. A separate unnamed US official disputed that causal link, telling the Financial Times any claim that tracking data was significant to Iran's targeting of US personnel "is a departure from the facts" 3.

Analyst Note: Iran's fusion of legacy SS7 roaming access with commercial ad-tech location data shows adversaries can convert routine mobile advertising infrastructure into a targeting layer against deployed forces, collapsing the assumption that basing in allied Gulf states limited exposure. Gulf carriers blocking SS7 requests shows partial network-side mitigation, but the ad-identifier pathway runs through data brokers outside carrier or DoD control, leaving that exposure largely unaddressed, and CENTCOM's April threat reporting confirms the vulnerability was flagged internally before this account became public. Reporting rests on a single Financial Times investigation, corroborated on-record by Citizen Lab but only relayed by other outlets, and the tracking may reflect routine Iranian SIGINT collection against a target-rich environment rather than a strike-cueing pipeline, a link the Financial Times itself says needs further investigation. The episode pressures DoD to treat commercial location-data purchases as a force-protection requirement in contested basing environments.

Sources:

1: Iran abused mobile networks' vulnerabilities to locate US military in the Middle East, report says - TechCrunch

2: Iran reportedly used telecom vulnerabilities to track U.S. military personnel - SC Media

3: US Troops Tracked Through Mobile Phones During Iran Conflict: Report - The Defense Post

4: US Military Smartphones Targeted Through Roaming and Ad Tech - Citizen Lab

US personnel faced phone-tracking campaign during Iran war - Financial Times

Hunt.io Discovers Chinese Cyber Espionage Campaign Using Claude Code and DeepSeek AI to Automate Attacks on Government Systems Across Four Countries

BLUF: Confirmed operational use of dual-model AI automation in Chinese intrusion sets marks the shift from experimental tooling to standardized tradecraft, outpacing current vendor abuse-detection architectures.

Hunt.io researchers reported that a pivot from known TencShell command-and-control infrastructure led them in June 2026 to an open directory on a Hong Kong-based server containing 2,431 files and 80 subdirectories, including victim source code, exploit scripts, and operator logs written in Simplified Chinese 12. Hunt.io assessed that Claude Code handled execution, including bash commands and phishing-page construction, while DeepSeek-v4-pro drove attack reasoning and exploit revisions, with operator sessions dated June 8 through 12, 2026 12. The researchers documented active exploitation of government systems in Thailand, where SQL injection gave attackers admin access and exposed employee national ID data, and in Afghanistan, where a citizen complaint portal built on Laravel was breached for source code and credentials 12. In Taiwan, Hunt.io identified reconnaissance against eight organizations with two, a chemical manufacturer and a telecom and edge-device maker, successfully exploited, while a parallel campaign extracted WordPress administrator credentials from a payment processing platform serving Europe, Australia, and Asia 1. A fourth country, the United States, saw reconnaissance-only activity with cloned phishing pages built for the D.C. Council and Delaware County government sites, part of broader scanning that touched more than 5,890 government hosts across 10 countries. Hunt.io traced the infrastructure to 13 Hong Kong servers across four hosting providers, identified an undocumented Command and Control (C2) framework it named Gshell, and notified affected organizations and national CERTs on July 6 ahead of publication 123.

Analyst Note: Hunt.io's find, resting on its own single-source research republished without independent corroboration, confirms agentic AI has moved from proof-of-concept to sustained use in Chinese state-linked intrusions, with Claude Code handling execution and DeepSeek-v4-pro driving exploit iteration across four countries' government and financial networks. Pairing US-origin agentic execution with a domestic Chinese reasoning model complicates attribution and undercuts vendor detection built around single-model authorship. Confirmed compromises in Thailand and Afghanistan, plus staged financial-sector credential theft, suggest operators retain live access despite the July 6 Computer Emergency Response Team (CERT) notifications, and the recurrence after Anthropic's November 2025 disclosure marks this as repeatable tradecraft rather than an isolated experiment. The underlying vectors, SQL injection, hardcoded keys, Laravel flaws, remain conventional, so the AI layer may be accelerating existing tradecraft rather than expanding offensive capability.

Sources:

1: Suspected Chinese Operators Use Claude Code and DeepSeek to Target Government and Financial Systems Across Four Countries - Hunt.io

2: Claude Code and DeepSeek Powered Chinese Cyber Espionage Campaign - Security Affairs

3: Chinese actors leverage AI tools for automated cyberattacks on government and financial systems - SC Media

Scattered Spider Leaders Sentenced to 66 Months in UK as FBI Calls Group Ongoing Global Threat

BLUF: Scattered Spider will likely be publicly linked to a new major intrusion within 90 days of sentencing, as the custodial removal of two operators leaves the group's decentralized tradecraft and unindicted affiliates intact.

Woolwich Crown Court sentenced Thalha Jubair, 20, and Owen Flowers, 18, to five years and six months in prison each on Thursday for the 2024 cyberattack on Transport for London, the National Crime Agency reported, calling it the largest cybercrime prosecution ever brought before a UK court 12. Both pleaded guilty last month to offenses under Section 3ZA of the Computer Misuse Act after infiltrating Transport for London (TfL)'s network between August 31 and September 3, 2024, an intrusion the National Crime Agency (NCA) said cost £29 million in recovery costs, forced password resets for all 27,000 TfL employees, and disabled 148 internal systems 123. The NCA and Microsoft assessed that the arrests materially degraded the group's operational capability, while the FBI's Brett Leatherman said Scattered Spider members continue to victimize organizations globally using data extortion, SIM-swapping, and social engineering 14. US authorities have separately accused Jubair of involvement in at least 120 cyberattacks, including extortion of 47 US-based organizations and the January 2025 breach of the federal court system, with a criminal complaint tracing $89.5 million in cryptocurrency payments to Bitcoin addresses he controlled 4.

Analyst Note: The sentencing removes two of Scattered Spider's four principal operators, but the group's brand and tradecraft persist among unindicted affiliates who continue targeting new victims, and members will likely surface in connection with a new major intrusion within 90 days given the FBI's own ongoing-threat assessment and sustained tempo through prior arrests. Moderate confidence reflects the claim's broad construction, tempered by law enforcement pressure that could push survivors toward less attributable methods. The NCA-Microsoft degradation assessment rests on a single institutional statement, with independent researchers disputing it since the pair's offending outlasted their eventual custodial term, and reflects the removal of two individuals rather than dismantlement of the wider criminal ecosystem. Jubair's separate US indictment, covering 120 intrusions and the January 2025 federal court breach, keeps extradition and further prosecution live, and a fresh affiliate-linked intrusion within that window would pressure agencies to shift from prosecution-as-deterrence toward direct disruption of the group's infrastructure.

Sources:

1: Two sentenced for hacking Transport for London in UK's biggest ever cyber crime case - National Crime Agency

2: Scattered Spider hackers sentenced to 5.5 years over £29 million Transport for London hack - The Record (Recorded Future News)

3: Brit Scattered Spider duo handed tickets to prison over Transport for London attack - The Register

4: Leading members of Scattered Spider sentenced in UK to 66 months in jail - CyberScoop

IC Oversight & Policy

House Select Committee Hearing Exposes MSS Subnational Operations and Economic Espionage Across US States

BLUF: Formalizing United Front subnational operations as a distinct threat category positions the committee to drive state-level counterintelligence referrals, though the civil-liberties fault line will constrain legislative follow-through.

The House Select Committee on the Chinese Communist Party (CCP) held a hearing on June 25 in the Cannon House Office Building on CCP economic espionage and subnational influence, hearing testimony from former acting DIA director David Shedd, State Armor founder Michael Lucci, and Asian Americans Advancing Justice president John C. Yang 12. Chairman John Moolenaar's opening statement cited the May guilty plea of former Arcadia, California mayor Eileen Wang for acting as an illegal PRC agent, and described CCP United Front Work as exploiting access, coercion, and incentives against state legislatures, universities, and businesses 1. The ranking member's remarks addressed intellectual property theft and coerced technology transfers while warning against profiling Chinese-American researchers, citing a figure that 38 percent of top US AI researchers are of Chinese origin 1. Shedd testified that CCP economic espionage facilitates an estimated $600 billion annually in stolen US wealth and technology under initiatives like Made in China 2025, recommending a targeted "small yard, high fences" approach over broad commerce regulation, while Lucci detailed PRC-linked land acquisitions near Laughlin Air Force Base in Texas and a Fufeng Group grain-silo project 12 miles from Grand Forks Air Force Base in North Dakota that the Air Force deemed a security threat 12. Ways and Means Chairman Jason Smith also addressed the panel, disclosing investigations into US tax-exempt organizations allegedly funded by CCP-linked individuals, including one dubbed the "Singum Network," for spreading pro-Beijing propaganda 1.

Analyst Note: The hearing formalizes United Front subnational targeting as a defined threat category spanning state legislatures, universities, and local business, shifting committee focus from federal espionage prosecutions toward local-government and academic exposure. Moolenaar's citation of the Arcadia mayor's guilty plea anchors the threat in an adjudicated case, giving agencies a template for state-level referral, while the ranking member's caution against profiling Chinese-American researchers marks an emerging fault line between tightened subnational safeguards and civil-liberties protections. Sourcing rests solely on the committee's own hearing record, secondhand through a recap account with no independent corroboration. The broader United Front framing extends beyond previously reported AI export-control gaps. The hearing may instead function primarily as committee messaging ahead of appropriations season rather than a precursor to enforceable countermeasures.

Sources:

1: China's Economic Espionage and Subnational Influence in the United States - Small Wars Journal

2: China's Economic Espionage and Subnational Influence in the United States - House Select Committee on the CCP

China's Economic Espionage and Subnational Influence in the United States (Hearing Transcript) - U.S. House of Representatives

Prior Reporting - [US hearing warns Chinese economic espionage now targets AI](https://www.scmp.com/news/us/article/3358403/us-hearing-warns-chinese-economic-espionage-now-targets-ai) (2026-06-26) - [China's Campaign to Steal America's AI Edge](https://chinaselectcommittee.house.gov/committee-activity/hearings/china-s-campaign-to-steal-america-s-ai-edge) (2026-06-25) - [China's Economic Espionage and Subnational Influence in the United States](https://chinaselectcommittee.house.gov/committee-activity/hearings/hearing-advisory-china-s-economic-espionage-and-subnational-influence-in-the-united-states) (2026-06-25) - [Select Committee Investigation Reveals China's History of AI Chip Smuggling and Model Distillation](https://chinaselectcommittee.house.gov/media/press-releases/select-committee-investigation-reveals-china-s-history-of-ai-chip-smuggling-and-model-distillation) (2026-06-25)

Trump Delivers Primetime Address Using Declassified CIA and NSA Intelligence on Election Vulnerabilities as ODNI Strips Foreign Malign Influence Center

BLUF: Trump's selective declassification creates political momentum for the SAVE Act, but passage within six months remains unlikely given reconciliation constraints and Byrd Rule exposure.

President Trump used a primetime address Thursday evening to release declassified intelligence documents, claiming China illegally acquired 220 million U.S. voter files and that intelligence officials concealed the threat from him and Congress 123. Trump cited a Department of Homeland Security review claiming 278,000 noncitizens are registered to vote in surveyed states and urged Congress to pass the SAVE America Act's voter-ID and citizenship-verification provisions 12. Per Just Security's review, the documents include raw intelligence and a June 2026 CIA note on Venezuela's vote-manipulation methods but no new coordinated assessment revising the 2021 Intelligence Community finding that no foreign actor altered 2020 vote counts 3. China's embassy denied the interference claims and Nevada and Pennsylvania officials disputed the noncitizen figures 1.

Analyst Note: Trump's framing casts the release as remedy for a suppressed threat, but the declassified material, per Just Security's independent review, adds no coordinated assessment revising the 2021 finding that no foreign actor altered 2020 vote counts. The SAVE America Act's voter-ID and citizenship-verification provisions are unlikely to reach Trump's desk within six months: reconciliation is the only path around a 60-vote Senate threshold, and the provisions face a plausible Byrd Rule challenge absent engineered budget framing. Moderate confidence rests on a clear reference class of House passage followed by Senate stall, tempered by reconciliation as a live but unconfirmed bypass. The release plausibly functions more as legislative leverage than genuine new disclosure, and disputes over Department of Homeland Security (DHS)'s noncitizen figures and China's denial will keep the debate contested rather than resolved. A stall likely pushes DHS and the White House toward executive review of state voter rolls and continued litigation over ballot access instead.

Sources:

1: Trump delivers primetime speech, claims declassified documents show US election vulnerabilities - CNN

2: Key takeaways from Trump's elections speech - ABC News

3: An Initial Readout of Trumps Election-Interference Speech - Just Security

WHAT THEY ARE SAYING: President Trump Exposes Bombshell Evidence of Foreign Election Interference and Deep State Suppression - The White House

Prior Reporting - [Trump to Deliver National Address on Declassified 2020 Election Intelligence and Voting Machine Security](https://yournews.com/2026/07/14/7109591/trump-to-deliver-national-address-on-declassified-2020-election-intelligence/) (2026-07-14) - [Trump to assert voting machine vulnerabilities in Thursday speech](https://www.yahoo.com/news/politics/articles/trumps-speech-foreign-interference-2020-210847563.html) (2026-07-14) - [Trump Will Use Primetime Speech to Claim Newly-Declassified Intel Reveals Foreign Plot to Interfere in 2020 Election: MS NOW](https://www.mediaite.com/media/news/trump-will-use-primetime-speech-to-claim-newly-declassified-intel-reveals-foreign-plot-to-interfere-in-2020-election-ms-now/) (2026-07-13) - [Trump, despite his record, eyes prime-time address on foreign election interference](https://www.ms.now/rachel-maddow-show/maddowblog/trump-foreign-election-interference-2020) (2026-07-14)

Allied Intelligence

Japan Creates National Intelligence Council and Bureau in First Centralized Intelligence Agency Since World War II

BLUF: Japan's first centralized intelligence agency since World War II will likely reach initial operating capability by December 2026, but its counterintelligence focus may delay the strategic warning function allies need most.

Japan's National Diet passed legislation creating a National Intelligence Council (NIC) and National Intelligence Bureau (NIB), clearing the lower house in April and the upper house in May, under Prime Minister Sanae Takaichi 1. The NIC, chaired by Takaichi and composed of cabinet officials, will coordinate strategic intelligence policy, while the NIB, due to become operational by December with an initial staff of about 700, will consolidate work now split across roughly 33,000 government personnel previously under no legal requirement to share intelligence 1. The reform dissolves the Cabinet Intelligence and Research Office (CIRO), established in 1952 without a legal mandate to compel information-sharing, into the new NIC/NIB structure 2. National Interest, citing New York Times reporting, tied the overhaul to threats from China, North Korea, and Russia, including Russian front companies in Japan reportedly procuring sanctioned technology for Moscow's defense sector 1, while Global Defense Corp reported the agency is aimed at countering China and cited NYT reporting that the United States, Germany, and Australia are advising Japan on establishing the new agency 2.

Analyst Note: The legislative fight is over; the operational stand-up is not. The National Intelligence Bureau will likely reach initial operating capability with its roughly 700-person staff by December 2026, though integrating reporting lines across 33,000 personnel who previously worked under no cross-department sharing mandate is a harder bureaucratic lift than the vote count already won. Russian front-company procurement networks and Chinese and North Korean activity supply the immediate justification, so the bureau's first-year mandate will likely center on counterintelligence rather than long-range strategic warning, though the buildup may instead be primarily China-focused deterrence rather than Russia-driven. Confidence is moderate, resting on a single primary account of staffing figures and the December target without independent confirmation. On-schedule standup gives US and allied services a legally mandated Japanese counterpart for formalized intelligence-sharing; delay leaves the reporting gap and Russian procurement networks in Japan unaddressed into next year.

Sources:

1: Japan Is Finally Building a Modern Intelligence Service. Heres Why. - National Interest

2: Japan is setting up its first centralised intelligence agency to counter China - Global Defense Corp

What is Japan's new intelligence agency, and why is Tokyo building it? - Al Jazeera

Prior Reporting - [Japan's Intelligence Reform: Securitization, Oversight, and the Cost of Consensus](https://thediplomat.com/2026/04/japans-intelligence-reform-securitization-oversight-and-the-cost-of-consensus/) (2026-04-27) - [Japans much-needed intel debate could cost Takaichi political points](https://www.japantimes.co.jp/news/2026/04/06/japan/politics/japan-intelligence-framework-reform-bill/) (2026-04-17)

Taiwan Intensifies Counterintelligence Prosecutions and PRC Influencer Crackdowns Under Lai Administration

BLUF: Taipei's counterintelligence tempo will very likely sustain 2024-level prosecution rates through Lai's term, institutionalizing a proactive deterrence posture that narrows PRC operational space on the island.

Taiwan indicted 64 people for espionage-related crimes in 2024, up from 48 in 2023 and 10 in 2022, with military personnel accounting for two-thirds of defendants, and Jamestown reports high-profile military espionage cases have risen since President Lai Ching-te introduced a 17-point national security plan in 2025 1. In April, Taiwan's High Court sentenced six military personnel, two active-duty and four retired, to 4.5-8.5 years for leaking military secrets to the PRC in exchange for NT$11.1 million ($348,000) in funding 1. The National Immigration Agency announced in late June that it barred a Chinese man for two years after he used a concealed wearable camera to film restricted security and immigration areas during a November 2025 visit to Taoyuan International Airport, posting footage to Bilibili under the account "White Sheep in the Sky" that referred to Taiwan as "China Taiwan" and covered the Republic of China flag with a PRC flag emoji 12. Taiwan's National Security Bureau also launched a website in late June for Chinese citizens to report intelligence tips, and the government has expelled several PRC influencers, including Douyin personality Liu Zhenya (500,000 followers, deported March 2025 with a five-year reapplication ban) along with two others, Xiaowei and Enqi, for content supporting a PRC takeover of Taiwan 1.

Analyst Note: Aggressive prosecution and public-facing deterrence signaling will very likely continue through the remainder of Lai's term, anchored by the 17-point national security plan's institutionalization of counterintelligence enforcement across military, media, and immigration channels. High confidence reflects the plan's enacted status, a tripling of indictments over two years, and Lai's lack of alternative levers given Legislative Yuan gridlock under Kuomintang (KMT)/Taiwan People's Party (TPP) control. The tip-line website and influencer expulsions shift Taipei's posture from reactive prosecution toward proactive detection and public signaling, which likely draws sharper PRC Taiwan Affairs Office rhetoric and reciprocal targeting of Taiwanese travelers within the coming months.

Sources:

1: Taiwan Intensifies Resistance to PRC Political Warfare - Jamestown Foundation

2: Chinese man banned from Taiwan after filming airport restricted areas - Taipei Times

COLLECTION GAPS

UNCLASSIFIED // OPEN SOURCE