//
OFFLINE — VIEWING CACHED CONTENT
← Back to Archive

IC BRIEF

Current as of 1655 EDT (UTC-04), Sunday 02 August 2026

Contents

8 stories from 32 sources across 29 organizations

KEY JUDGMENTS

Section 702 surveillance authority will likely remain lapsed through September 30, constraining IC collection for attribution precisely as Iran-linked attackers holding stolen Programmable Logic Controller (PLC) engineering files from at least seven states' water utilities retain the capability to tailor follow-on intrusions to each plant's control logic. We assess with moderate confidence that the three-way political deadlock blocking reauthorization is structurally unresponsive to the escalating operational threat: Trump's SAVE Act signing condition, the bipartisan warrant-reform bloc, and August recess each independently block floor action.

New Cuba-related sanctions will likely follow within the coming weeks even as FBI domestic terrorism capacity contracts: the entire Domestic Terrorism Operations Section has been dissolved and the National Security Division cut by nearly 38 percent, institutional knowledge losses that cannot reverse on the same timeline as the sanctions they parallel. Moderate confidence reflects Rubio's sustained Cuba-enforcement record and the pattern of pairing published threat narratives with follow-on Treasury or State actions.

Formal attribution of the Minnesota intrusions to Iran within 60 days is unlikely given seven-state jurisdictional complexity and deliberate agency withholding despite matching TTPs. Attachment to must-pass September legislation is the principal mechanism that could alter the 702 assessment, and it requires resolving the SAVE Act condition that currently lacks 60 Senate votes.

IC Oversight & Policy

Section 702 Reauthorization Stalls Despite Clayton Confirmation as Bipartisan Coalition Demands Warrant Reforms

BLUF: Clayton's confirmation removed the stated Democratic precondition for reauthorization but exposed it as a pretext, leaving Section 702's structural deadlock intact through at least September.

The Senate confirmed Jay Clayton as director of national intelligence on Tuesday by a party-line 51-47 vote 123. Section 702 of FISA, which lapsed on June 12, remains unrenewed; Senate Minority Leader Chuck Schumer told the Daily Caller News Foundation that Democrats would not consider reauthorization until acting Director of National Intelligence (DNI) Bill Pulte leaves office and said "many of us want to get 702 enacted, but it needs some reforms" 4. Sen. Mark Warner said "nothing has changed" on reauthorization after the confirmation vote 3. Trump has said he will not sign a Section 702 reauthorization unless it is attached to the SAVE America Act, and Senate Republicans acknowledge that legislation lacks the votes to clear a 60-vote cloture threshold 3. Sens. Elizabeth Warren and Chris Murphy separately told the Daily Caller News Foundation they oppose reauthorization, with Murphy citing the absence of a warrant requirement as an "underlying problem" 4.

Analyst Note: Clayton's confirmation clears the personnel precondition Schumer had set, but the underlying policy dispute stays frozen: Trump still conditions his signature on attaching the SAVE America Act, and the Warren-Murphy-Lee bloc still demands a warrant requirement Republicans lack the votes to overcome. Collection continues under the Foreign Intelligence Surveillance Court (FISC)'s March certification, a backstop that holds only so long as providers decline to challenge their compulsion in court. With the Senate leaving for August recess and the House already out, no floor vehicle exists before September, extending both the lapse and the litigation exposure providers face absent statutory cover. Republican leadership casts the blockade as Democratic deference to their base rather than a resolvable reform dispute. Moderate confidence reflects broad corroboration across four outlets on the vote and the deadlock.

Sources:

1: Senate votes to confirm Jay Clayton as director of national intelligence - ABC News

2: Senate confirms Jay Clayton as Director of National Intelligence - Washington Times

3: Senate Confirms Jay Clayton as Intelligence Chief, But Section 702 Deadlock Holds - Tech Times

4: Will Confirmation Of Trump s New DNI Revive Feds Favorite Warrantless Spying Tool? - Daily Caller

Prior Reporting - [Crucial U.S. spy powers will stay dark until September](https://www.deseret.com/politics/2026/07/29/clayton-nomination-mean-for-fisa-authorization/) (2026-07-29) - [Jay Clayton Confirmed By Senate, Sets Up Possible Vote On Warrantless Spying Tool](https://dailycaller.com/2026/07/28/jay-clayton-confirmed-by-senate-sets-up-possible-vote-on-warrantless-spying-tool/) (2026-07-28) - [Senate confirms Jay Clayton as Trump's next intelligence chief](https://www.cbsnews.com/news/senate-confirms-jay-clayton-trump-intelligence-chief-dni-bill-pulte/) (2026-07-28)

DOJ Subpoenas New York Times Freelancer to Identify Sources for Classified North Korea Mission Story

BLUF: Department of Justice (DOJ)'s mixed record of folding under pressure on press subpoenas makes Cole's case the bellwether for whether this administration will sustain the political cost of compelling reporter testimony.

The subpoena was issued by federal prosecutors in Virginia rather than a New York-based U.S. Attorney's office, according to the Times and Reuters 12. FBI agents delivered the subpoena to Cole's New York residence and, finding him absent, forwarded it to his attorney, David A. O'Neil, who is defending Cole with the Times paying his legal costs 12. The 2025 story co-written by Cole and Times national correspondent Dave Philipps, citing roughly two dozen unnamed sources, reported that Navy SEALs killed several unarmed North Koreans after their mission to plant a listening device near the coast collapsed 1. Times spokesperson Charlie Stadtlander called the subpoena "another brazen and illegal attack" and said it is "part of the government's escalating attacks on journalists," while a DOJ spokesperson said the department "will use all available legal tools to uncover those who unlawfully disclose national defense information" 12. The disclosure follows the DOJ's since-withdrawn subpoenas of three Times reporters over Air Force One security coverage and a March subpoena of Wall Street Journal reporters over Pentagon-Iran war reporting 2.

Analyst Note: The subpoena tests whether DOJ's public vow to deploy "all available legal tools" against reporters' sources will hold once litigation actually begins, since the Times has already moved to contest the demand in court. Two prior press-subpoena episodes point in opposite directions: the Air Force One subpoenas of Times reporters were withdrawn under pressure, while the Wall Street Journal's Pentagon-Iran subpoena remains outstanding months after issuance. Cole's case turns on whether Southern District of New York (SDNY) judges credit reporter-privilege arguments against a leak investigation tied to a lethal, unauthorized SEAL mission. Moderate confidence rests on converging primary accounts from Reuters and the Times' own disclosure, though sealed grand jury proceedings limit visibility into DOJ's internal posture on whether to persist or negotiate.

Sources:

1: US Justice Department Subpoenas New York Times Freelancer Over North Korea Story, Paper Says - Reuters (via US News)

2: New York Times reveals Trump administration subpoena over North Korea story - Al Jazeera

Brazen and illegal: Trump DOJ stuns with chilling subpoena - Raw Story

Department of Justice Subpoenas a New York Times Reporter - Yahoo News

Former CIA Director Brennan Warns Trump Administration Misdirecting Counterterrorism Professionals Toward Political Targets

BLUF: Dissolving the FBI's domestic terrorism section while redirecting its personnel toward political targets erodes collection against far-right networks that remain the deadliest domestic threat category.

A Senate Homeland Security Committee report by Democratic staff, obtained by MS NOW, found the Trump administration has cut more than 15,000 DOJ and FBI employees and reassigned the FBI's entire Domestic Terrorism Operations Section, reduced DOJ National Security Division staffing by nearly 38 percent, removed over 1,300 counterterrorism personnel from DHS, and cut close to $1 billion in national security and public safety grants to state and local agencies 1. The report states the administration has directed law enforcement and intelligence personnel toward immigration enforcement and has concentrated domestic terrorism attention on left-wing groups while giving less scrutiny to far-right and white supremacist threats 1. Former CIA Director John Brennan, in a Thursday interview with MS NOW's Michael Steele, said counterterrorism professionals are being redirected away from significant threat groups and toward undocumented workers and groups such as Antifa 2. Brennan also said the administration has expanded terrorist-organization designations to include gangs, cartels, and Antifa while not confronting neo-Nazi groups active in the United States and abroad 2.

Analyst Note: Reassigning counterterrorism resources toward political opponents rather than assessed risk leaves established far-right and neo-Nazi networks, historically the source of the deadliest domestic attacks, comparatively unwatched, while dissolving the FBI's Domestic Terrorism Operations Section erodes field-office liaison relationships and institutional knowledge that cannot be rebuilt quickly even if staffing is later restored. Expanding terrorism designations to cover protest movements and loosely organized ideological labels builds enforcement tools that persist structurally and could target a broader range of domestic groups beyond this administration. The account rests on a single primary MS NOW report, with Alternet amplifying the same Brennan interview rather than independently corroborating it, and the administration could counter that the changes reflect lawful reprioritization toward an active immigration enforcement mandate rather than deliberate defunding of counterterrorism capacity.

Sources:

1: Trump has been dismantling post-9/11 counterterrorism protections, Senate report says - MS NOW

2: Trump torn apart by former CIA head for ignoring right-wing extremists - Alternet

Allied Intelligence

Leaked MI5 Emails Reveal Directors Orchestrated Campaign to Designate IRGC as Terrorist Organization While Acknowledging Limited Operational Benefit

BLUF: Leaked emails, if authenticated, expose Military Intelligence Section 5 (UK Security Service) (MI5) leadership driving proscription and surveillance policy for institutional leverage rather than operational necessity, undermining the government's stated rationale for both measures.

Leaked correspondence reviewed by The Grayzone shows current MI5 Director General Ken McCallum and former director Baroness Eliza Manningham-Buller privately coordinated, beginning in 2023, to push then-Shadow Home Secretary Yvette Cooper toward proscribing the Islamic Revolutionary Guard Corps (IRGC) as a terrorist organization, a step the UK government took on July 13 1. McCallum's public case for designation rested on his claim the IRGC sought to assassinate ten British citizens in 2022, which drove a unanimous January 2023 parliamentary vote urging proscription, even as he privately told Cooper the "direct operational benefit" was likely "modest" but "sensible to contemplate" 12. The emails also show McCallum weighing whether to extend proscription powers beyond the IRGC to other "state-affiliated factions" such as the defunct Russian Wagner Group, and crediting Manningham-Buller's "support (and stamina)" for passage of the National Security Act, legislation that criminalizes unauthorized disclosures of state information 123. Press TV and Islam Times, both citing The Grayzone's reporting, note the correspondence links McCallum's public warnings about Iranian threats to a subsequent seven-percent increase in UK intelligence spending, after Manningham-Buller praised the media coverage his October 2024 threat briefing received 23.

Analyst Note: Leaked correspondence, sourced solely to The Grayzone and unauthenticated by the two outlets republishing it, indicates MI5 shaped rather than merely informed the IRGC proscription and the National Security Act rather than responding to independently justified operational needs, undercutting government framing of both as threat-driven decisions. McCallum's admission that proscription's direct benefit was modest, set against Manningham-Buller's explicit link between his public threat briefings and the subsequent spending increase, suggests budget and legislative advocacy drove threat messaging rather than followed from it. The underlying Iran-linked plot claims remain evidentially unresolved and could still be vindicated by further corroboration, and the leak itself may reflect a source seeking to discredit MI5's surveillance and proscription agenda through selective release rather than a neutral policy disclosure.

Sources:

1: MI5 directors who plotted IRGC terror ban exposed in leaked emails - The Grayzone

2: MI5 chiefs secretly lobbied UK government to designate IRGC as 'terrorist' organization: Report - Press TV

3: Report: MI5 Chiefs Privately Pressed UK Gov't to Proscribe IRGC, Expand Security Powers - Islam Times

GAO Finds Intelligence Agency Classification Barriers Impeding Five Eyes Space Cooperation at Vandenberg Working Group

BLUF: Persistent classification friction and DOD's rejection of the key organizational-clarity recommendation make completion of both concurred fixes by December 2026 unlikely, leaving Five Eyes space integration structurally constrained.

U.S. and other Five Eyes personnel gathered at Vandenberg Space Force Base in late June for the 2026 Space Tactics Analysis Team Working Group, studying adversary tactics and building a shared coalition response playbook, the Space Force said in a press release 1. A July 2025 Government Accountability Office (GAO) report found classification and foreign-disclosure processes continue to impede combined space operations, with intelligence agencies sometimes requiring extra approval before U.S. Space Command could pass already-releasable information to allied space operations centers 2. Canadian and Japanese officials told GAO that overlapping DOD organizational responsibilities make it difficult to identify the correct point of contact, and in one instance the Space Force conducted an activity with a European partner without notifying U.S. European Command 2. GAO made three recommendations: set integration milestones under the International Space Cooperation Strategy, address Space Force staffing shortfalls in security cooperation, planning and foreign-disclosure roles, and clarify security cooperation responsibilities department-wide. DOD concurred with the first two, targeting completion by September and December 2026 respectively, but rejected the roles-clarification recommendation, arguing existing DOD Directive 5132.03 already suffices. GAO disputes that rejection as of June 2026 234.

Analyst Note: DOD is unlikely to complete both accepted recommendations, Space Force staffing fixes and allied-integration milestones, by their September and December 2026 targets, and GAO's rejection of the roles-clarification fix leaves the organizational confusion driving allied contact-point failures unaddressed regardless. Classification friction and overlapping DOD responsibilities will likely keep constraining real-time information sharing with Five Eyes partners over the next 12 months. Moderate confidence rests on a single GAO report corroborated only by DOD's own June 2026 status update, which shows no additional progress against either deadline; secondary outlets amplify GAO's findings rather than independently corroborating them. DOD's rejection may instead reflect genuine confidence that the January 2025 update to Directive 5132.03 already resolves the ambiguity. Missed deadlines would give the Armed Services Committees grounds to compel the classified briefing FDD recommends and press the unresolved roles issue.

Sources:

1: Space Force Is Deepening Allied Cooperation. Congress Should Track the Results. - FDD

2: Space Operations: DOD Is Pursuing Efforts to Collaborate with Allies and Partners but Needs to Address Key Challenges - U.S. Government Accountability Office

3: Space Force unveils first international strategy, while GAO flags barriers to space cooperation - SpaceNews

4: Classification Remains Barrier to DoD Space Information Sharing with Allies - Defense Daily

IC Technology & AI

Federal Judge Says Government Record Worsened in Anthropic Supply Chain Risk Dispute as Court Probes IC Deployment of Mythos AI

BLUF: DOD's expanded classified deployment of the same AI models it labeled a supply chain risk hands the court a factual contradiction that may prove fatal to the government's defense.

U.S. District Judge Rita Lin said Thursday the government's record supporting Anthropic's "supply chain risk" designation "has gotten worse," finding no evidence in the record that Anthropic could alter or disable delivered AI models via a "kill switch" 1234. Lin called the government's position that public criticism of DOD by a contractor justifies distrust and retaliation "really troubling" and "at odds with the First Amendment" 34. DOJ attorney James Harlow told the court DOD is winding down Anthropic's use with a completion target of September 30, while a separate multi-agency pilot program is set to lapse in late August absent renewal 5. Anthropic attorney Michael Mongan said the company is unaware of contract cancellations since March's preliminary injunction, aside from one Pentagon Chief Digital and AI Officer (CDAO) contract terminated before that ruling. Lin pressed the government on undisclosed expanded use of Anthropic's Mythos model in national security applications, which Harlow initially resisted addressing on grounds it involved nonpublic information 5.

Analyst Note: DOD's near-simultaneous wind-down of Anthropic use and expanded, undisclosed deployment of Mythos in national security applications undercuts the government's litigation posture. Lin's questioning signals she views continued Mythos use as inconsistent with the supply-chain risk designation, strengthening the evidentiary basis for a summary judgment ruling against the government, with moderate confidence given consistent judicial signaling across two hearings though no ruling has yet issued. Bloomberg, Axios, and TechCrunch filed independent primary accounts of the hearing, with FedScoop and Courthouse News Service corroborating without shared-wire dependency. The wind-down may instead reflect a genuine agency shift toward alternative vendors unrelated to the litigation. A ruling for Anthropic would force DOD to abandon the September 30 wind-down and justify continued Mythos deployment under the same trust rationale used to bar Claude; a ruling for the government lets agencies proceed with divestment as the OneGov pilot lapses in late August.

Sources:

1: Judge Voices Doubt US Has Justified Its Ban on Anthropic AI - Bloomberg

2: Judge says government's case got "worse" in Anthropic fight - Axios

3: Judge says Trump admin still lacks evidence for Anthropic 'supply-chain risk' label - TechCrunch

4: Judge likely to rid Anthropic of Pentagon's 'supply chain risk' label - Courthouse News Service

5: Record has gotten worse for the government in Anthropic dispute judge says - FedScoop

Prior Reporting - [Federal Judge Temporarily Blocks the Pentagon from Branding AI Firm Anthropic a Supply Chain Risk](https://www.military.com/daily-news/2026/03/27/federal-judge-temporarily-blocks-pentagon-branding-ai-firm-anthropic-supply-chain-risk.html) (2026-03-27) - [Judge blocks Anthropic 'risk' designation, in a win for AI firm](https://www.semafor.com/article/03/27/2026/judge-blocks-anthropic-risk-designation-in-a-win-for-ai-firm) (2026-03-27)

IC Technology & Cyber

CISA Issues Emergency Directive to Remove Internet-Exposed PLCs After Iran-Linked CyberAv3ngers Attacks Expand to Seven States

BLUF: Exfiltrated PLC project files give attackers a blueprint for precision follow-on strikes against water infrastructure, while formal federal attribution within 60 days remains unlikely.

Cybersecurity and Infrastructure Security Agency (CISA)'s advisory AA26-097A, originally published April 7 and updated July 22 and again in late July, warned that Iranian-affiliated actors are exploiting internet-exposed programmable logic controllers across the water and wastewater sector 1. Minnesota IT Services reported that a coordinated attack disabled Operational Technology (OT) systems at more than 30 community water utilities on July 26 and 27 by modifying operator passwords and reassigning controller IP addresses, with Braham's water plant taken fully offline and restored within about two hours, and Maple Plain, Plymouth, and South St. Paul also affected 2. The FBI confirmed utilities in at least seven states have reported PLC-related incidents, and CISA said the exploited devices now include Schneider Electric and Siemens hardware in addition to Rockwell Automation controllers, with attackers stealing PLC project files for the first time 2. No agency has formally attributed the Minnesota intrusions to a specific actor 2.

Analyst Note: Attackers now hold exfiltrated PLC project files across at least seven states, enabling follow-on intrusions tailored to each plant's actual control logic rather than opportunistic default-credential access. Formal federal attribution to CyberAv3ngers or Iran within 60 days is unlikely, since Minnesota officials and CISA have withheld attribution despite ongoing forensic work; the intrusions may instead reflect opportunistic exploitation of long-known default-credential weaknesses by financially motivated or unaffiliated actors rather than a coordinated state campaign. Moderate confidence reflects a single primary CISA advisory corroborated by state-level incident reporting but no independent signals or human-source access to attacker identity. Confirmed device scope has widened from Rockwell controllers alone to include Schneider Electric and Siemens hardware. Formal attribution to Iran, if it comes, would shift the federal response from utility-level OT-hardening guidance to a state-actor deterrence posture, triggering sanctions consideration and coordinated defense across all seven affected states.

Sources:

1: CISA Urges Water Sector to Protect OT After Coordinated Attacks on PLCs - SecurityWeek

2: CISA Urges Utilities to Remove Internet-Exposed PLCs After Minnesota Attacks - Security Affairs

Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure (AA26-097A) - CISA

Prior Reporting - [Trump blames Minnesota water hacks on Walz, while evidence points to Iran](https://www.politico.com/news/2026/07/31/trump-minnesota-water-hacks-iran-01021161) (2026-07-31) - [CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs](https://www.cisa.gov/news-events/alerts/2026/07/30/cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs) (2026-07-30)

Adversary Intelligence

Rubio Calls Cuba Espionage Superpower as State Department Releases 100-Page Report on Cuban Influence Operations

BLUF: Rubio's coordinated media rollout of the State Department report likely presages new Cuba sanctions or designations within the coming weeks, positioning Havana's espionage history as justification for escalatory policy.

Secretary of State Marco Rubio, in a Saturday interview on "My View with Lara Trump," said Cuba is the only country that has "systematically implanted and embedded spies" in US institutions without paying them, calling the island an "influence and espionage superpower" 12. His remarks followed a State Department report, released July 20 and titled "Cuba: The Capital of 21st Century Communism," that ties Havana to Antifa and campus activism and links Cuban intelligence facilities to China and Russia 23. Rubio cited former ambassador Manuel Rocha, sentenced to 15 years for spying for Cuba since 1973, and former Defense Intelligence Agency (DIA) analyst Ana Belén Montes as the two largest US penetrations by Cuban intelligence 12. He further alleged Cuba funds and organizes protest networks behind pro-Hamas, anti-ICE and pro-Maduro demonstrations 14. Cuban Foreign Minister Bruno Rodríguez called the report a "fallacy," and President Miguel Díaz-Canel labeled it a "neo-McCarthyist pamphlet" 23.

Analyst Note: Rubio's public linkage of an official State Department report to a media rollout signals the administration intends the Cuba espionage narrative as an active policy instrument rather than archival record, likely feeding into further Treasury or State sanctions actions within the coming weeks. Havana's rejection through Rodríguez and Díaz-Canel forecloses any near-term acknowledgment or negotiation opening. Confidence in this judgment is moderate, resting on a single administration voice amplified across secondary outlets without independent corroboration of the protest-funding claims.

Sources:

1: Rubio warns Cuba has infiltrated US with spies, calls communist regime an espionage superpower - Fox News

2: Marco Rubio: "Cuba is the only country that has systematically implanted spies in the U.S." - CiberCuba

3: Marco Rubio: "Cuba Systematically Plants Spies in the U.S." - Cuba Headlines

4: 'Espionage superpower': Rubio warns Cuba poses a 'national security threat' the US can't ignore - MEAWW

Prior Reporting - [State Department Report: Cuba Foments Far-Left Extremism, Runs Spy Rings in the US](https://www.military.com/state-department-report-cuba-foments-far-left-extremism-runs-spy-rings-in-the-us) (2026-07-20) - [Cuba: The Capital of 21st Century Communism](https://www.state.gov/cuba-the-capital-of-21st-century-communism) (2026-07-20) - [US accuses Cuba of sweeping spy campaign](https://www.jamaicaobserver.com/2026/07/20/us-accuses-cuba-sweeping-spy-campaign/) (2026-07-20) - [US State Department Accuses Cuba of Waging a 'Revolution Against Western Civilisation Itself' in 100-Page Report](https://www.ibtimes.co.uk/us-accuses-cuba-decades-long-infiltration-revolutionary-campaign-1809597) (2026-07-20)

COLLECTION GAPS

UNCLASSIFIED // OPEN SOURCE