Foreign Interference Research Center

The 2007 ONCIX report is blunt: the U.S. is the top target, full stop. Foreign intelligence services aren't probing randomly. They're running coordinated campaigns against defense contractors, research labs, and tech firms, because stealing is cheaper than inventing. The goal is closing capability gaps without paying the R&D bill. foreigninterference.org/post/u-s-remai… #foreigninterference #EconomicCoercion #TechnologyTransfer

The Institute for National Security Studies in Tel Aviv does not typically spend its analytical bandwidth on American domestic institutional politics. When it does, pay attention. The INSS published a strategic assessment on the Trump administration's rollback of counter-foreign-interference infrastructure, and the framing matters: this isn't a civil liberties argument or a partisan one. It's a deterrence argument. The question they're asking is straightforward. When you dismantle the apparatus that detects, attributes, and responds to foreign influence operations, what signal does that send to the actors running those operations? The answer is obvious, but the details are worth walking through. The specific institutional moves the INSS flags: dismissals tied to the Global Engagement Center, restructuring of election security functions within CISA, and a broader political de-prioritization of foreign interference as a national security category. These aren't just personnel shuffles. The GEC, whatever its real-world limitations, was the primary U.S. mechanism for coordinating counter-disinformation efforts across State and interagency partners. CISA's election security work was the closest thing the U.S. had to a centralized clearinghouse for threat information sharing with state-level election officials. Degrading both simultaneously removes two distinct layers of the response stack. The deterrence logic here is not complicated. Foreign interference operations are not free. They carry attribution risk, diplomatic cost, and occasional operational exposure. The infrastructure that generates those costs, the people who track campaigns, build attribution cases, coordinate with platforms, and pass intelligence to allies, is what makes interference expensive for adversaries. Remove it, and the cost-benefit math shifts. The INSS assessment is essentially saying: Russia, China, and Iran are capable of reading this correctly, and they will. On the Russia side, there's a long documented record of operations specifically designed to amplify political polarization in Western democracies. The operational model doesn't require inventing divisions; it requires finding existing fault lines and pouring resources into them. American political discourse in 2025 offers no shortage of material. With reduced detection risk, the rational move is to expand throughput. More accounts, more narratives, more coordination with domestic amplifiers who don't know or don't care what they're carrying. China's interference infrastructure has been maturing steadily. The operations documented in 2022 and 2024 targeting diaspora communities, coordinating inauthentic social media behavior, and building influence relationships with local political figures represent a more patient, longer-horizon approach than Russian active measures. But that patience depends on low detection risk. The INSS assessment puts China squarely in the "will interpret this as opportunity" category, and based on operational history, that reading is hard to dispute. Iran is the more acute near-term concern in some respects. The 2024 cycle already produced documented Iranian cyber-enabled influence operations targeting the U.S. election, including the hack-and-leak attempt against the Trump campaign and separate efforts to influence down-ballot races. Iran has shown a willingness to run higher-risk operations than either Russia or China, which means reduced U.S. response capacity matters more at the margins. When the institutional architecture that would generate a response is compromised, the deterrent effect of potential exposure drops. The alliance dimension is where the INSS assessment gets analytically interesting, and where the Israeli authorship is probably not coincidental. U.S. counter-interference capabilities have historically flowed outward through Five Eyes and NATO channels. Threat intelligence, attribution support, platform coordination, early warning on active campaigns: allied democracies have depended heavily on American institutional capacity here, particularly smaller democracies without the resources to build equivalent national programs. European partners have been vocal about this, and the INSS is essentially formalizing the concern from a non-European allied perspective. Israel runs its own robust intelligence apparatus, but even Israeli strategic planners have skin in the game when it comes to whether American counter-interference infrastructure exists and functions. The most analytically durable point in the INSS piece is the structural versus personnel distinction. Personnel changes are reversible. You can rehire people, reconstitute units, rewrite mandates. Structural degradation is a different problem. Counter-interference work requires institutional memory: years of accumulated knowledge about adversary tactics, source networks, analytic tradecraft, inter-agency relationships, and coordination protocols with private sector partners including platforms and researchers. That knowledge lives in people, and when those people leave, it disperses. The networks and relationships that made the work possible take years to build. A future administration that wants to reconstitute these capabilities doesn't get to start from where things stood in January 2025. They start from wherever things are when they arrive. This temporal problem is the one that should get the most attention and largely doesn't. The political conversation focuses on the personnel dismissals, which are concrete and newsworthy. But the harder problem is what happens to institutional capability over time when the investment stops, the experienced people scatter to the private sector or academia, and the coordination frameworks with allies and platforms atrophy. By the time the next major interference campaign makes headlines and someone in a future administration asks "why didn't we see this coming," the answer will be: because we spent several years systematically removing the people and structures whose job it was to see it coming. The INSS is not a neutral actor. Israeli strategic interests don't map perfectly onto American ones, and their analysis deserves the same critical read any think tank assessment does. But the analytical frame here, deterrence degradation, adversary opportunity cost, structural versus reversible capability loss, is sound and it's the right frame. The fact that an allied foreign security institute is publishing strategic assessments on American institutional dismantlement is itself worth registering. These aren't observations being made by domestic political opponents. These are being made by people who watch adversaries for a living and are concerned about what they're seeing. foreigninterference.org/post/inss-docu… #foreigninterference #InstitutionalDismantlement #CounterDisinformationFrameworkElimination #StrategicCommunicationReduction

In September 2021, Chinese state-sponsored actors breached at least ten Indonesian government ministries simultaneously. The operation ran quietly. That's the point. The target selection tells you everything about the intent. Indonesia controls the Lombok Strait, the Sunda Strait, the Malacca approaches. It chairs ASEAN rotating presidencies. It has active South China Sea boundary disputes that never quite make the news the way the Philippines' disputes do. A sustained presence inside Jakarta's administrative networks gives Beijing something more valuable than a single document dump: it gives them the ability to read Indonesian negotiating positions before Indonesia sits down at any table. Ten ministries at once isn't a fishing expedition. That's a coordinated campaign with pre-mapped targets, which means the reconnaissance preceded the intrusion by a meaningful stretch of time. Someone built a list. Where this goes from here is the part worth watching. The tradecraft in operations like this one tends to evolve in a specific direction: toward persistence over spectacle. The breach wasn't designed to embarrass Jakarta or demonstrate capability. It was designed to stay. That means the next phase, if it hasn't already happened, is deeper lateral movement into networks that connect the breached ministries to each other and to external partners. Defense procurement offices. Foreign affairs communications. Anything touching bilateral coordination with the United States, Australia, or Japan. Indonesian government infrastructure is the entry point, not the destination. For defenders in the region, the structural problem here is detection lag. Espionage operations built on persistence rather than disruption can sit inside a network for months or years before anyone notices. The Indonesian breach became public in 2021, but the question of when access was first established and how long it ran before discovery has never been fully answered publicly. That gap matters. Every week of undetected access is another week of harvested communications. For other ASEAN member governments, the Indonesian breach is a reference point, not an outlier. The same targeting logic applies to Vietnam (South China Sea disputes, border history), the Philippines (active ICJ arbitration and US basing agreements), Malaysia (hydrocarbon overlaps in contested waters), and Myanmar (ongoing instability that Beijing monitors closely). If the technical indicators from the Indonesian operation match patterns in other regional networks, and there's no public evidence that anyone has done that comparison systematically, the map of compromised governments probably doesn't stop at Jakarta. The Five Eyes joint advisories on Chinese cyber espionage have been consistent and detailed. They've named tools, named actors, named specific vulnerabilities. The gap isn't information. The gap is that the governments most directly targeted by these operations, developing-nation administrations in the Pacific and Southeast Asia, have the least capacity to act on that information. Jakarta isn't Canberra. The network hardening resources are not equivalent. Beijing knows this. The targeting pattern reflects it. One thing to watch specifically: Indonesia's 2024 presidential transition brought Prabowo Subianto into office with a foreign policy posture that is, at minimum, more ambiguous toward Beijing than his predecessor. If Chinese intelligence services maintained persistent access through the 2021 breach, they had front-row seats to internal Indonesian deliberations during a major political transition. That's not a hypothetical intelligence benefit. That's significant. The operational lesson for anyone paying attention is that the sophistication ceiling on these campaigns keeps rising while the detection and attribution capacity of targeted nations stays relatively flat. Closing that gap is a resource problem, a technical problem, and a political problem, because attribution means naming China, and naming China has bilateral consequences that smaller economies weigh very carefully. The hackers count on that calculation. They're usually right. foreigninterference.org/post/chinese-h… #foreigninterference #AdvancedPersistentThreatOperations #CyberEspionage #PersistentNetworkInfiltration #GovernmentInfiltration

The 2007 ONCIX report is blunt: the U.S. is the top target for state-sponsored economic espionage, full stop. Multiple foreign intelligence services running coordinated ops against defense contractors, research institutions, tech companies. The goal is simple, steal what took Americans decades and billions to build. Skip the R&D bill, collect the prize. foreigninterference.org/post/u-s-remai… #foreigninterference #EconomicCoercion #TechnologyTransfer

Beijing's playbook in the Philippines isn't subtle: Chinese nationals run the operation, Filipino recruits provide the access, and everyone pretends the two tiers are unconnected. Philippine counterintelligence caught the pattern anyway. First the handlers, then the locals. The Marcos government's decision to deepen U.S. basing rights handed Beijing's services a motive, and apparently they acted on it fast. What's notable across Week 26's digest is how consistent the architecture is. Japan, Taiwan, the Philippines. Different targets, same two-tier structure. Industrial scale is the right phrase for it. foreigninterference.org/post/spy-news-… #foreigninterference #AssetRecruitment #CorporateInfiltration #CommunityBasedIntelligenceOperations #GovernmentInfiltration #DeepCoverOperations

Section 702 has been quietly renewed again, this time on a short-term basis, and the pattern here is worth sitting with before the legislative machinery grinds forward again. The authority itself targets foreign nationals located outside the United States. That is the statutory premise. What makes it genuinely complicated, and genuinely contested, is that foreign communications frequently involve American interlocutors, pass through American infrastructure, and get swept into the collection apparatus as a result. "Incidental" is doing a lot of legal work in that sentence, and critics are not wrong to pull at that thread. The FBI made this harder to defend. Repeated documented misuse of Section 702 query authorities, specifically running searches for American communications without individual warrants, gave the civil liberties coalition something concrete to point to beyond abstract Fourth Amendment concerns. That coalition is not ideologically coherent in the normal sense. It includes the ACLU crowd and a meaningful slice of congressional Republicans who read the same FBI audit findings and arrived at the same place through a different door. Clean reauthorisation was never going to happen after those findings became public, and it did not. So instead Congress does what it does when it cannot resolve a structural disagreement: it extends, defers, and hopes the next Congress figures it out. That strategy has operational costs that are rarely discussed with any specificity in the coverage of these votes. Intelligence agencies doing long-range collection planning against foreign targets need statutory certainty. Short-term extensions create planning horizons that are, to put it plainly, incompatible with the timelines of serious collection operations. You do not build a sustained collection architecture against MSS front companies or FSB-linked infrastructure on a foundation that requires reauthorization every few months. Assets, relationships, technical access, all of it requires sustained legal authority to sustain the operational investment. The adversary angle on this is underappreciated. Russian and Chinese intelligence services monitor U.S. legislative cycles not as an academic exercise but as an operational input. Periods of statutory uncertainty about Section 702 are periods where sophisticated foreign services have an empirical basis for adjusting their communications security posture. They know American collection continuity is in question. They act accordingly. The intelligence community's argument that restriction or gap in 702 authority creates blind spots exactly when adversary activity is peaking is not spin. The documented escalation in Chinese infrastructure targeting and Russian election interference operations is not in dispute, and the timing correlation with legislative uncertainty is a real operational problem even if it gets flattened into a talking point by the agencies pushing for clean reauthorization. The FISA Court oversight mechanism is the other piece that keeps not getting resolved. Critics of Section 702 have argued, with supporting evidence, that the Court's ex parte review process is structurally unsuited to serving as a genuine check on query practices. The Court reviews targeting and minimization procedures but does not have the adversarial input that might catch the pattern of misuse the FBI was running. Defenders of the current architecture argue that adding warrant requirements for 702 queries involving Americans would functionally cripple the tool's utility by slowing response times in exactly the scenarios where speed matters. Both of those things can be true simultaneously. Congress has not found the procedural architecture that threads that needle, which is why it keeps not finding a long-term reauthorization. The 2026 midterm environment is going to make this harder, not easier. These debates are already being inflected by partisan dynamics that have less to do with the actual surveillance architecture than with which coalition gets to claim the civil liberties win. That is not new, but it tends to produce bad legislation when it drives the process. The underlying tension is real and is not going to resolve itself through additional short-term extensions. The FBI query problem requires a structural fix, not audits and promises. The FISA Court oversight gap requires institutional reform with actual adversarial input. The incidental collection question requires a statutory clarification of what "incidental" is permitted to encompass before it becomes something the Fourth Amendment no longer tolerates. None of that is in a short-term extension. All of it accumulates as unresolved debt on the long-term reauthorization ledger. The intelligence community is right that Section 702 is genuinely productive. The critics are right that the current oversight architecture has documented failures. The question is whether Congress has the institutional capacity to hold both of those things at once and produce legislation that addresses them. The track record on that is not encouraging. foreigninterference.org/post/u-s-senat… #foreigninterference #LegalAuthorizationExpansion #MassSurveillanceOperations #CounterintelligenceOperations #LegislativeSurveillance

Canada's Government House leader said in late June 2026 that he "expects news" on a public inquiry into foreign interference "very soon." That's the statement. After years of classified CSIS assessments, parliamentary committee reports, and sustained opposition pressure, the Carney government appears to be moving toward actually formalizing accountability for what Canadian intelligence has documented about foreign state operations in Canadian politics. The backstory matters here, so let's go through it properly. CSIS assessments documenting Chinese government attempts to influence federal elections have been circulating in classified form for years. The National Security and Intelligence Committee of Parliamentarians (NSICOP) and the National Security and Intelligence Review Agency (NSIRA) have both produced reporting, some of it public, on the scale of these operations. What they've documented is not subtle: attempts to support preferred candidates, interference in nomination processes, and transnational repression targeting diaspora communities in Canada. The interference file expanded beyond electoral manipulation to include revelations about the NDP leadership race, questions around Chinese-linked political donation networks, and CSIS warnings that multiple Canadian parties were vulnerable to foreign state cultivation at the nomination level. None of that produced a formal public inquiry. What it produced was classified briefings that frustrated parliamentarians who couldn't discuss them publicly, oversight reports that documented serious problems without generating binding accountability, and a years-long political argument about whether existing mechanisms were sufficient. Critics said they weren't. The government of the day generally resisted a formal inquiry. That resistance accumulated its own political cost. The architecture of whatever gets announced will matter as much as the announcement itself. A few specific design questions will determine whether this inquiry has real teeth. First: will it have full access to classified CSIS assessments, or will intelligence agencies be able to wall off material on source-and-method grounds? That tension is not hypothetical. Previous attempts to give parliamentarians access to classified interference assessments ran into classification barriers that effectively neutered the accountability function. An inquiry that can only see sanitized summaries is an inquiry that cannot hold anyone responsible for decisions made on the basis of actual intelligence. Second: will testimony from intelligence officials and political figures be public or in camera? The public accountability argument for this inquiry rests heavily on sunlight. An inquiry conducted substantially behind closed doors would satisfy almost none of the pressure that generated it. Third: does the mandate extend beyond Chinese interference? Canadian intelligence reporting has documented operations by Iranian, Indian, and other state actors targeting Canadian political processes and diaspora communities. India's operations against the Sikh community in Canada have been particularly documented and politically charged given the broader Canada-India relationship collapse following the Nijjar killing. An inquiry scoped narrowly to China, while perhaps more politically convenient, would produce an incomplete and somewhat misleading picture of the actual threat environment. These aren't abstract design preferences. Each choice represents a real decision about how much accountability the government is actually willing to absorb, versus how much it wants to appear to absorb. The comparative context is worth keeping in mind. Australia implemented the Foreign Influence Transparency Scheme after its own sustained public reckoning with Chinese Communist Party influence operations. The UK's Russia Report, produced by the Intelligence and Security Committee, documented FSB operations and the British government's failure to investigate them adequately, and that report's release was itself delayed in ways that became a political scandal. European states including Germany, the Netherlands, and others have commissioned parliamentary investigations into foreign interference operations from multiple state actors. Canada has watched all of this happen and until now has produced the oversight bodies and the classified reporting without the formal public inquiry that allies have used to create public records, assign accountability, and generate legislative responses. The Canadian trajectory has been slower, partly because the politics of accusing a major trading partner of election interference are genuinely complicated, and partly because previous governments judged the political risk of a public inquiry to be higher than the political risk of not having one. That calculation appears to have shifted. A "very soon" signal from the House leader in late June 2026 does not guarantee a well-designed inquiry. It guarantees an announcement. The announcement will be scrutinized immediately by opposition parties, civil society groups, and journalists who have been tracking this file for years and who know exactly what questions to ask about scope, mandate, access, and independence. The gap between what gets announced and what those observers conclude it actually does will tell you most of what you need to know about whether this resolves anything. foreigninterference.org/post/canada-s-… #foreigninterference #ElectionInterference #PoliticalInfiltration #InfluenceOperations #TransnationalRepression #CounterInterferenceLegislation

UNICRI just announced the fourth edition of its Summer School on Misinformation, Disinformation, and Hate Speech, running July 6-10, 2026, hybrid out of Rome. Fourth edition means this is no longer an experiment. They're locking it into the curriculum. The detail worth sitting with is where this is housed. UNICRI is the UN's criminal justice and crime research institute. Not a media literacy NGO. Not a journalism school. The fact that this programme lives there is itself a policy statement: disinformation is now formally in the same institutional neighborhood as transnational crime and security threats. That framing has real downstream consequences for how governments build their response architectures. So what does the trajectory look like from here? The shift from "media literacy problem" to "criminal justice and national security challenge" has been happening gradually for a few years, but formalising it inside the UN system is different. It creates pressure on member states to align their own domestic frameworks. Countries that have been treating FIMI as purely a platform moderation issue, or a journalism education issue, are going to face increasing institutional friction if they don't develop law enforcement and intelligence-side capacity to match. That's a slow process, but UNICRI running this annually is part of what normalises the expectation. The hybrid format is doing something specific. In-person in Rome plus global online access isn't just a pandemic-era convenience they forgot to roll back. It's a capacity-building pipeline aimed explicitly at practitioners in regions where Russian and Chinese information operations have operated with significantly less resistance. Sub-Saharan Africa, Southeast Asia, parts of Latin America: these are environments where the counter-interference infrastructure is thin, platform enforcement has been deprioritized (Meta's own transparency reports have documented the disparity in non-English content moderation), and the local civil society organisations that would normally serve as early detection nodes are underfunded and understaffed. Graduates of these programmes go back to government agencies, courts, regulatory bodies. That's the point. The 2026 cohort is going to be operating in a genuinely chaotic information environment. The U.S. midterm cycle will be in full swing. The U.S.-Iran conflict has already generated an active information warfare layer, and the disinformation operations around that conflict have been running hot since the first strikes. AI-generated synthetic content has dropped the production cost for influence operations to near zero for any actor with moderate technical capacity, which means the volume problem is getting worse faster than the detection infrastructure can scale. Practitioners walking into that summer school in July 2026 won't be doing historical case studies. They'll be dealing with live operational conditions. Here's what I'd watch for as a direct result of this institutionalisation trend: The legal and definitional pressure is going to intensify. One of the core problems in prosecuting or sanctioning state-sponsored disinformation is that the legal frameworks in most jurisdictions weren't built for it. You can sanction individuals for specific acts, but coordinated inauthentic behaviour spread across hundreds of fake accounts operated by a state intelligence service doesn't map cleanly onto existing criminal statutes in most countries. UNICRI bringing together law enforcement practitioners, researchers, and policymakers in the same room, repeatedly, with a criminal justice framing, is going to accelerate the push for cleaner legal definitions. Expect more proposals at the EU level (the Foreign Information Manipulation and Interference framework is already further along than anything in the U.S.) and some movement in national legislation in the countries whose officials attend. The Global South capacity gap is going to become a more explicit strategic battleground. Russia and China have both invested heavily in information operations targeting African, Southeast Asian, and Latin American audiences precisely because the counter-interference environment is weaker there. Wagner's Africa-focused operations, documented extensively by the Stanford Internet Observatory and the EU DisinfoLab, exploited exactly this gap. Programmes like this one are part of the international community's belated recognition that you can't defend democratic information environments only in Brussels and Washington while leaving the flanks open. Whether the capacity building actually keeps pace with the offensive operations is a different question, and the honest answer is: not yet, not even close. The private sector pressure will increase. Platforms have been able to treat content moderation in lower-priority markets as a resource allocation problem. That calculus gets harder as more governments have officials trained in FIMI-specific frameworks, because those officials ask different questions in regulatory conversations. They're not asking about community standards violations. They're asking about coordination infrastructure, account network analysis, and attribution. That's a different conversation, and platforms are not uniformly prepared to have it. One thing that doesn't get said enough: the people who attend these programmes matter. Not in an abstract "capacity building is good" way, but specifically. The analyst at a West African electoral commission who goes through a UNICRI summer school and learns how to read a coordinated inauthentic behaviour disclosure report is going to make different decisions during the next election in her country than she would have otherwise. Multiply that by a few hundred practitioners a year across a few years and you actually start to shift the baseline. It's slow. It's not dramatic. But it's the mechanism by which international norm-setting eventually becomes operational capacity. The counter-move from the actors being targeted by this capacity building is already visible. Russia and China have both invested in their own counter-narratives around "information sovereignty," framing Western counter-disinformation efforts as censorship infrastructure. That framing has real purchase in some of the same Global South contexts where UNICRI is trying to build capacity. It's not a coincidence that RT and CGTN have been expanding their footprint in exactly those regions while simultaneously pushing the narrative that Western fact-checking and platform enforcement are forms of ideological control. The competition for the definitional frame, what counts as disinformation versus what counts as sovereign information policy, is going to run alongside the technical and legal capacity building, not separately from it. The summer school being in its fourth edition is, on its own, a mundane administrative fact. The trajectory it represents is not. foreigninterference.org/post/unicri-la… #foreigninterference #CounterDisinformationFrameworkDevelopment #DisinformationCampaigns #ForeignInformationManipulation

The 1998 State Department press archive is not exciting reading. It should be. Bosnia, Afghanistan, the former Soviet space: U.S. diplomats were watching the same playbook across three separate theaters simultaneously. Proxies standing in for external patrons. Election boycotts coordinated from outside the country. ISI and Taliban. Russia's ruble collapsed in August and its intelligence services got more active, not less. What the record shows is that the tools for responding were basically rhetorical. Bilateral pressure. Public statements. The sanctions architecture and multilateral frameworks came later. The interference didn't wait. foreigninterference.org/post/state-dep… #foreigninterference #ElectionInterference #InfluenceOperations #ProxySupport #GovernmentDestabilization #DiplomaticCoercion #RegionalInfluenceOperations

June 30, 2026. Meta's Oversight Board announces it is formally scrutinizing Iranian state-backed influence operations on the platform. That date matters because it lands in the middle of an active U.S.-Iran military conflict, which is not a coincidence and not a neutral context. Here is what the Board is actually looking at. Iranian state media and affiliated accounts have been running coordinated campaigns against American domestic audiences throughout the June 2026 escalation. The goal is straightforward: shape how Americans perceive the conflict, erode confidence in the Trump administration's military credibility, and do it through Facebook and Instagram at scale. Meta's own threat intelligence teams have documented this. Independent researchers have documented this. It is not a contested premise. The specific question before the Board is whether Meta's content decisions in this environment were appropriate enforcement or overreach. That framing is worth sitting with for a second. When a state actor is running an active information warfare campaign during a shooting conflict, and a platform takes action against it, the Oversight Board's job is to evaluate whether the platform went too far. That is the system working as designed. Whether it is the right design for this threat environment is a different question. Iranian networks have gotten good at this. The operational security has improved considerably over the years. Coordinated inauthentic behavior is harder to attribute cleanly when the networks are disciplined about compartmentalizing accounts, varying posting patterns, and using enough authentic-seeming activity to create legal and reputational risk for anyone who moves to take them down. Meta faces a genuine problem: act too aggressively and you hand the regime a propaganda win about censorship; act too cautiously and the campaign runs. Iranian state media understands this dynamic and exploits it deliberately. The Oversight Board was built to handle contested individual content decisions, not to adjudicate the upstream enforcement philosophy of a platform operating inside an information war. Its jurisdiction over questions like "how aggressively should Meta pursue CIB networks linked to a foreign government during an active military conflict" is genuinely murky. The Iran case may push the Board into territory it was not originally designed to occupy. That is not a criticism, it is just the reality of what happens when independent governance structures meet adversarial state actors who have studied those structures carefully. What comes out of this matters beyond the immediate case. November 2026 midterms are on the calendar. European regulators running Digital Services Act enforcement are watching platform consistency on foreign information manipulation as a live compliance question. U.S. election security officials want to know whether Meta's enforcement holds up or whether influence operations can use the Oversight Board process as a tool to slow enforcement, challenge removals, and buy operational time. That last scenario, where adversaries learn to weaponize appeals and review mechanisms, is the one that keeps people up at night. Iranian state-linked networks targeting diaspora communities is not new. The suppression of counter-regime content through coordinated reporting campaigns has been documented for years. Amplifying regime narratives to Persian-speaking audiences abroad is a long-running operation. What is new is the Oversight Board being asked to weigh in on enforcement decisions made during an active shooting conflict between the U.S. and Iran, with midterm elections five months out. The precedent being set here is real. Independent platform governance intersecting with live national security questions is not something most governance frameworks anticipated at this scale. Whatever guidance the Board produces will land in a document that researchers, regulators, foreign governments, and adversarial state actors will all read carefully. foreigninterference.org/post/meta-over… #foreigninterference #ComputationalPropaganda #ForeignInformationManipulation #StateMediaCoordination #DisinformationCampaigns #PlatformTakedown

The August 1998 embassy bombings and the U.S. retaliatory strikes matter less as a historical event than as a template. What happened: al-Qaeda simultaneously detonated truck bombs outside U.S. embassies in Nairobi and Dar es Salaam on August 7, killing over 220 people, and thirteen days later the Clinton administration hit Afghan training camps and the Al-Shifa plant in Sudan. Now look at what that sequence actually produced. Start with the attribution problem, because it's the part that keeps recurring. Berger said at the August 20 press conference that "further intelligence strengthened the case" while military preparations were already underway. That's not a small detail. Strike decisions ran parallel to intelligence consolidation, not downstream of it. The administration wasn't lying, exactly. They believed what they were saying. But the sequence mattered enormously because it meant the public case was being constructed while the operational machinery was already moving, which creates structural pressure to fit the evidence to the decision rather than the other way around. Al-Shifa is what happens when that pressure meets an ambiguous soil sample and a facility whose owner had every reason to deny weapons connections. Sudan then spent years using the contested strike as a diplomatic lever. The information warfare benefit flipped. This is the trajectory worth watching: states and non-state actors have learned, explicitly, that contesting U.S. intelligence assessments used to justify strikes is its own strategic tool. You don't have to win the factual argument. You just have to generate enough ambiguity that the attribution loses political force. That lesson got absorbed. We saw it in the debates over Syrian chemical weapons strikes. We've seen it in the long tail of disputes over drone strike casualty counts. The playbook now includes proactive information operations designed specifically to preempt attribution credibility before the first press conference happens. The simultaneous coordination across Nairobi and Dar es Salaam, cells separated by hundreds of miles running synchronized operational security without detection, was a serious intelligence failure. The 9/11 Commission documented it thoroughly. But the more interesting analytical thread is what that coordination demonstrated about network architecture. Al-Qaeda in 1998 was running overt organizational infrastructure in Afghanistan and Sudan alongside covert operational cells in East Africa, all under active signals intelligence collection, and the cells didn't surface. The lesson drawn by successor organizations and state sponsors paying attention was that compartmentalization worked, and the lesson drawn more recently has been that digital compartmentalization (encrypted comms, operational separation between financing and logistics and execution nodes) can extend that model further than the 1998 version could manage. The 9/11 Commission traced analytical continuity from the embassy bombings directly to the August 6, 2001 PDB warning about bin Laden's intent to strike inside the United States. Three years of dots. The intelligence community had the thread but couldn't pull it fast enough. What changed between 1998 and now is volume, not structure. The analytical challenge of connecting transnational cells running under signals collection without surfacing has gotten harder, not easier, because the surface area is larger and the encryption is better. For defenders watching this trajectory, the specific thing to track is how attribution contestation has professionalized. In 1998, Sudan's counter-narrative was reactive and largely diplomatic. It worked in a limited way but required resources most actors didn't have. Current state actors (Russia after Salisbury, Iran across various proxy operations) run proactive attribution interference as a standard feature of the operation, not a cleanup step afterward. You see coordinated messaging timed to break within hours of an incident, designed to flood the zone before official attribution can consolidate public opinion. The goal isn't to convince sophisticated analysts. It's to give domestic political audiences in Western countries a permission structure to doubt. That's a calibrated operation, and it's been refined considerably since the Al-Shifa controversy showed what was possible. The transnational architecture point deserves more attention than it usually gets. In 1998, the analytical frame for counterintelligence was still primarily state-to-state. The CIA, NSA, and FBI were structurally optimized for Soviet-style state competition. Al-Qaeda's architecture was designed, whether deliberately or by necessity, to exploit exactly the seams in that framework. The organization spanned Afghanistan, Sudan, Kenya, Tanzania, and multiple European support nodes simultaneously, using a mix of legitimate organizational presence and covert cells. Traditional counterintelligence had no good model for this. The response, post-9/11, was to build new institutional structures (the NCTC, fusion centers, the entire IC reorganization) to address the gap. Here's what hasn't been adequately addressed: the hybrid version of that architecture, where a state actor provides resources, cover, and occasionally operational direction to a nominally non-state network specifically to exploit the attribution ambiguity the non-state label provides. Iran and Hezbollah are the clearest case. Russia and various cutout organizations are another. The 1998 moment matters because al-Qaeda demonstrated the vulnerability, but the exploitation of that vulnerability by state actors running plausible-deniability networks is the current threat. Attribution to a non-state actor, even correct attribution, doesn't close the loop if a state three steps back in the logistics chain is insulated from consequences. Officials and election-adjacent watchers should focus on two near-term indicators. First, watch whether states that have observed the Al-Shifa lesson begin investing more explicitly in pre-positioning counter-attribution assets inside Western information environments before they conduct operations, not after. The shift from reactive to proactive information operations in the attribution space is already partially visible. The next development is tighter integration between the operational cell and the information warfare cell, so that counter-narrative infrastructure is seeded into target-country media and political networks before the operation executes, leaving no clean window for attribution to stick. Second, watch for the hybrid architecture to migrate further into cyber operations, where the non-state cutout model is already mature and attribution is technically harder. The 1998 template showed that a non-state actor with state-level logistics could generate strategic effects while complicating response options. That architecture, adapted for cyber and influence operations with state backing and non-state cover, is the version intelligence services are currently trying to track and mostly finding difficult. The Berger-Albright press conference is a useful artifact not because the Clinton administration did something uniquely wrong but because it shows the structural problem clearly. You're trying to make a classified intelligence case publicly credible fast enough to shape international opinion, justify legal authority, and deter the next attack, all simultaneously. That tension hasn't gone away. It's gotten more acute because the information environment is faster, the adversaries have studied the pressure points, and the domestic political cost of getting it wrong has risen. Any future administration facing a comparable moment is going to face exactly the same tradeoff between moving quickly and getting it airtight, except the counter-attribution operation will already be running before they call the press conference. The 9/11 Commission found that intelligence from the 1998 response period informed the analytical thread that eventually surfaced in the August 2001 PDB. The dots were there. What that tells you about the current environment is that the dots are almost certainly there on the next event too. The question is always the same: whether the institutional structure, the analytical frameworks, and the political will to act on ambiguous but accumulating signals are in place before the operation executes. In 1998, they weren't quite. The commission documented what that cost. foreigninterference.org/post/u-s-strik… #foreigninterference #DisinformationCampaigns #InfluenceOperations #CoordinatedCyberWarfare #InformationDomainOperations

The BfV dropped its annual report in July 2026 and the picture it paints is not subtle. Four distinct adversary vectors, all active on German soil at the same time. Russian saboteurs. Chinese intelligence operatives. Iran-backed militant networks. Domestic neo-Nazi cells with potential foreign connections. The Germans are dealing with all of it simultaneously, and they're now saying so publicly. Start with Russia, because Russia is the most kinetic. The BfV documents active Kremlin recruitment of saboteurs inside Germany. Physical disruption operations targeting logistics infrastructure, railway networks, and defense industry facilities. This has been going on since the full-scale invasion of Ukraine in 2022, but Germany is a particular priority because it became the primary logistics hub for Western military assistance to Kyiv. You move weapons through Germany, Germany becomes a target. The recruitment model is worth understanding: the BfV is not just talking about GRU officers operating under diplomatic cover. It's Russian-directed recruitment of German residents, including diaspora community members with economic vulnerabilities, as witting or unwitting sabotage assets. Some of these people know what they're doing. Some probably think they're doing something smaller than they actually are. Either way, the effect is the same. German intelligence is calling this hybrid warfare, and they're explicitly noting that it blurs the line between intelligence operations and acts of war. That framing is deliberate and it matters. The China section is less dramatic but in some ways more structurally damaging. Escalating Chinese espionage targeting German technology companies, research institutions, and political networks. Germany's advanced manufacturing sector is the main target. Automotive, chemical, precision engineering. The goal is dual-use technologies and proprietary production methods, meaning the kind of industrial knowledge that takes decades and enormous capital investment to develop organically. Chinese state-sponsored actors are acquiring it through espionage instead. The BfV assessment here tracks closely with Five Eyes warnings and European partner reporting. This is not a new problem but the BfV is documenting continued escalation, not stabilization. Germany's specific exposure is structural: it has exactly the kind of high-value industrial knowledge base that Beijing's strategic competitive priorities require, and it has been somewhat slower than Anglo-American partners to fully reckon with the scale of the penetration. Iran is the section that reflects the most recent geopolitical turbulence. The BfV identifies Iran-backed Islamist networks operating in Germany as a growing threat, specifically linking the threat elevation to the 2026 U.S.-Iran military exchange and subsequent Iranian proxy activation across the Middle East and Europe. Tehran's European architecture works two ways simultaneously. European diaspora communities are surveillance targets, meaning Iranians living in Germany who are dissidents, activists, or simply people the regime wants to monitor. And they're potential operational assets, meaning people Tehran can pressure, recruit, or activate for external operations. The BfV is documenting this as transnational repression combined with external operations capability. That combination is what makes the Iranian threat distinct from a pure espionage threat. It's coercive, it reaches into immigrant communities, and it can turn lethal. A few things stand back from the specifics. Germany publishing this at the level of detail it has is itself a policy choice. Intelligence services don't typically volunteer detailed threat assessments to the public. When they do it in this much specificity, they're doing several things at once: hardening public resilience, warning potential recruitment targets, signaling to adversaries that their activities have been observed, and contributing to a coordinated European posture of intelligence transparency that partners have been building toward. This isn't Germany panicking. It's Germany being deliberate about making the threat landscape legible to its own citizens and to allied governments. The convergence is the real headline. Each of these threat vectors would be a significant intelligence problem on its own. Running counterintelligence against Chinese economic espionage while simultaneously trying to detect and disrupt Russian sabotage networks while tracking Iranian proxy activation while monitoring domestic extremist networks with potential foreign connections requires enormous institutional bandwidth. Germany's domestic intelligence service is effectively operating on a four-front internal security problem. The report's publication is an acknowledgment that the public needs to understand this is the environment they're in. foreigninterference.org/post/germany-s… #foreigninterference #CyberEspionage #IndustrialSabotage #AssetRecruitment #TradeSecretTheft #TransnationalRepression

China's ambassador just walked into ASIO's house and called ASIO a liar. Publicly, in Canberra, on behalf of Beijing. Mike Burgess has spent years building a deliberate transparency strategy around foreign interference, explaining it plainly to Australians rather than keeping it in classified drawers. That's exactly what this attack targets. Not the intelligence itself, the credibility of the people presenting it. The coercion is the point. Bilateral relationship at risk, the ambassador says. Retract, or pay a price. foreigninterference.org/post/china-s-a… #foreigninterference #AntiInterferenceRhetoric #DiplomaticCoercion #DisinformationCampaigns

Most spies during this period weren't recruited. They walked in. That's the central finding buried in the Defense Personnel Security Research Center analysis archived through DTIC and the DNI's National Counterintelligence and Security Center, and it matters more than it might initially seem. Volunteer rates ran between 79 and 85 percent across rank categories, from lower enlisted grades through the officer corps. The foreign intelligence services weren't hunting these people down. American servicemembers and cleared civilians were proactively approaching Soviet handlers, often with material already in hand. The counterintelligence community in the early 1980s was structured around a fundamentally different assumption: that the KGB and GRU were the active party, identifying targets, cultivating relationships, and eventually pitching them. Catch the foreign intelligence officer, disrupt the recruitment pipeline, protect the cleared workforce. Standard doctrine. The PERSEREC data said that model was backward. The threat wasn't coming from the outside in. It was already inside, sitting on its own motivations and waiting for an opportunity. This is the kind of finding that sounds obvious in retrospect and was apparently very difficult to act on in real time. The motivation shift is equally significant. During the 1940s and 1950s, the dominant driver was ideology. The Rosenbergs, Alger Hiss, the Cambridge Five on the British side, these were true believers who understood themselves to be advancing a cause. Whatever you think of their politics, there was a coherent internal logic to what they were doing. By 1982, that framework had largely collapsed. The PERSEREC analysis establishes financial motivation as the primary driver in this later period. Not principle. Not grievance with American policy. Not coercion or blackmail, at least not predominantly. Money. Personal financial stress combined with access to classified material had become the defining high-risk profile. That requires a different response than the ideological threat model. You can't screen for financial desperation the way you screen for Communist Party membership or foreign contacts. People's financial circumstances change after they're cleared. The behavioral indicators are subtler and more dynamic. The cases active around the 1982 period illustrate the pattern clearly enough. Edwin Gibbons Moore II was a CIA officer whose espionage ran 1976 to 1977, reflecting the broader penetration operations Soviet services had been running against the intelligence community throughout the late 1970s and into the early 1980s. Samuel Loring Morison was a Navy civilian analyst who began passing classified imagery intelligence in 1984. Morison is worth pausing on because he's a genuinely strange case: he leaked photographs from a KH-11 satellite showing a Soviet aircraft carrier under construction at the Nikolayev shipyard, and he passed them not to a foreign government but to Jane's Defence Weekly, where he also worked as a part-time editor. The motivation wasn't straightforwardly ideological or straightforwardly financial. It was something messier, a combination of wanting recognition in his professional field and believing the information should be public. He was convicted under the Espionage Act in 1985, the first person to be convicted under that statute for leaking to the press rather than a foreign power, and he received a presidential pardon from Clinton in 2001. The Morison case is a useful reminder that the PERSEREC categories, tidy as they are, don't fully capture the range of human rationalizations people bring to betrayal. Still, as a statistical framework for the broader population of espionage cases, financial motivation really did dominate. What came after 1982 bore this out completely. John Walker had been spying for the Soviets since 1967, but the ring he operated, which included his brother Arthur, his son Michael, and Jerry Whitworth, was discovered in 1985. Walker's motivation was essentially entrepreneurial. He treated the relationship with Soviet intelligence as a business arrangement, recruited family members as subagents, and ran it for nearly two decades. Robert Pelton, a former NSA employee, approached Soviet intelligence in 1983, motivated by financial difficulties following his bankruptcy. He was arrested in 1985. Edward Lee Howard, a CIA officer dismissed from the agency in 1983, walked into the Soviet embassy in Vienna and began providing information about CIA operations in Moscow. He fled to the Soviet Union before the FBI could arrest him, in 1986, and died there in 2002. All three cases fit the volunteer-financial archetype the PERSEREC research had identified. None of them were recruited in the traditional sense. None were ideological converts. All of them initiated contact themselves, and all of them were substantially motivated by money or financial grievance. The Reagan administration used the PERSEREC data framework to develop enhanced security clearance procedures during this period. The Personnel Reliability Program for nuclear weapons custodians drew directly on this research. The idea was to systematize behavioral monitoring in ways that could catch the internally-driven threat that the old recruitment-focused counterintelligence model was poorly positioned to detect. Whether those procedures were adequate is a separate question. The Walker ring had been active for eighteen years when it was finally rolled up, and it was surfaced not by counterintelligence work but by Walker's ex-wife contacting the FBI. Pelton was identified after a Soviet defector provided information. Howard escaped entirely. The apparatus that PERSEREC's analysis was meant to improve kept getting beaten by luck, defectors, and personal animosities rather than systematic detection. That's the thing about the volunteer problem. If you're waiting to catch a foreign intelligence officer running a recruitment operation, you have an external event to detect. If the threat is a cleared employee who has already decided to make contact and is doing so on their own initiative, the detection window before damage is done is extremely narrow. The PERSEREC framework moved counterintelligence thinking toward monitoring internal behavioral indicators, which was the right direction. But the gap between having the right analytical framework and actually catching people before they cause serious damage remained wide throughout the decade. The Andropov era context matters here too. Yuri Andropov became General Secretary in November 1982 after fifteen years running the KGB. He knew the intelligence game at a granular level in a way none of his recent predecessors had, and Soviet intelligence operations in the early 1980s reflected institutional sophistication and operational tempo that made the American volunteer problem more consequential. You didn't need to mount a risky recruitment operation when cleared Americans were approaching Soviet residencies on their own schedule. The KGB's counterpart problem was vetting and managing a flood of walk-ins and volunteers, some genuine, some dangled by U.S. counterintelligence. Andropov's KGB was experienced at that problem. The intelligence services of a country that had spent decades worrying about internal enemies knew something about distinguishing genuine traitors from provocateurs. The PERSEREC analysis is a period document. It reflects what was known and thinkable in 1982 about American espionage patterns, and its limitations are real. The sample sizes for some categories are small. The categories themselves reflect the assumptions of the era. But the core finding, that the cleared workforce was generating espionage cases from within rather than being victimized primarily by external recruitment, held up. The 1985 arrests confirmed it. The post-Cold War cases would continue to confirm it. Aldrich Ames approached Soviet intelligence in 1985. Robert Hanssen started in 1979. Both volunteers. Both financially motivated in significant part, though Hanssen's psychology was genuinely more complex. The volunteer problem didn't go away when the Soviet Union collapsed. It just acquired new recipients. foreigninterference.org/post/defense-p… #foreigninterference #AssetRecruitment #MilitaryEspionage #IntelligenceSelling #PersonnelSecurityEnhancement

Yuri Andropov ran the KGB for fifteen years before he ran the Soviet Union. That fact alone tells you something about what November 1982 was going to look like. Brezhnev died on November 10th. Andropov was confirmed as General Secretary on the 12th. The speed of it was not accidental. The man had spent 1967 to 1982 building the apparatus, the networks, the doctrine. He didn't need a transition period. He already knew where everything was. The CED Museum's 1982 timeline is interesting precisely because it's contemporaneous. It's not retrospective analysis cleaning things up for a tidy narrative. It captures what the technology and security landscape actually looked like during those October-November weeks, before anyone knew how the Andropov period would unfold or what the intelligence community's concerns would later be validated as. And the landscape was genuinely complex. You had Reagan's arms reduction overture from the Eureka College address in May sitting awkwardly alongside NATO missile deployment debates that were tearing up European parliaments. The nuclear freeze movement hit its political peak in November 1982, ballot initiatives across multiple U.S. states, parliamentary pressure building in West Germany and the Netherlands. Moscow was not unaware of this. Active measures operations had been feeding that pressure for years. The technology piece is where the timeline becomes most useful for understanding the period's actual stakes. Personal computing, semiconductors, telecommunications: all of it was moving fast in 1982, and Soviet intelligence was not watching from the sidelines. KGB Directorate T and the GRU's technical intelligence units ran what the Soviets called Liniya T, the Technology Line, which was a systematic acquisition effort targeting Western industrial and military technology. Not opportunistic. Systematic. There were target lists. We know about the target lists because of FAREWELL. The French intelligence operation, known internally as Farewell Dossier, had recruited Vladimir Vetrov, a KGB officer who handed over documentation of Soviet technology acquisition priorities. The CIA received this material. The target lists showed exactly which Western technologies Soviet intelligence was tasked to obtain, by what methods, and through which front organizations and cutouts in Western Europe. The Reagan administration used this intelligence to feed compromised and degraded technology into channels the Soviets were using to acquire it. The pipeline became the vulnerability. FAREWELL wasn't publicly revealed until years later. But in October-November 1982, the counterintelligence operations it enabled were running quietly in the background, alongside tightened COCOM restrictions on dual-use technology exports to the Soviet bloc. COCOM, the Coordinating Committee for Multilateral Export Controls, was the multilateral framework Western governments used to restrict technology transfer. The Reagan administration pushed hard on enforcement. Not everyone in Western Europe was enthusiastic, partly because their companies wanted the business and partly because the nuclear deployment politics made any U.S. pressure feel loaded. That friction mattered. Soviet acquisition networks in Western Europe ran partly through legitimate commercial channels, through third-country intermediaries, through academic and scientific exchanges. Tightening the controls was harder than announcing them. What Andropov's elevation specifically meant for this environment is worth sitting with. The declassified U.S. intelligence assessments from this period, documented later, show genuine concern about what KGB-influenced leadership meant for Soviet information operations targeting Western institutions. Andropov had built the active measures infrastructure. He understood it from the inside. Giving that person control over Soviet foreign policy was not, from an American counterintelligence standpoint, a neutral development. The RYAN system is also worth mentioning here. RYAN was a Soviet intelligence collection program, Raketno-Yadernoye Napadenie, nuclear missile attack, designed to provide early warning of a Western first strike. Andropov had overseen its development at the KGB. By 1982 it was generating significant collection requirements against NATO targets, which in turn was producing some genuinely alarming misreadings of Western military exercises and deployments. The 1983 Able Archer exercise would bring this tension to a head. But the architecture for that near-miss was already in place by November 1982. The illegals programs were also Andropov's work. Deep-cover Soviet intelligence officers operating under false identities in the United States and Western Europe had been developed and expanded under his KGB tenure. The counterintelligence challenge those programs presented to the FBI and allied services was substantial. You're not looking for someone behaving suspiciously. You're looking for someone who has spent years building a legend that holds up to scrutiny. None of this was new in November 1982. The machinery had been running for a long time. What changed was that the man who built it was now running Soviet foreign policy, and the competition over technology, information, and strategic positioning was, if anything, accelerating. The CED timeline documents a moment, not a revelation. But moments matter. The October-November 1982 window is one of those points where several things were happening simultaneously that would compound into something larger. The succession, the freeze movement, the technology acquisition operations, the FAREWELL intelligence, the RYAN collection pressure. None of it was visible in its totality to any single observer at the time. That's usually how it works. foreigninterference.org/post/ced-timel… #foreigninterference #InfluenceOperations #DisinformationCampaigns #TradeSecretTheft #TechnologyTransfer

Someone pointed me to an academic paper this week tracing state-sponsored cyber operations from 1982 through 2014, and the framing is actually useful for something people keep getting wrong about where this is all heading. The short version of what the paper covers: the 1982 CIA-linked Siberian pipeline sabotage via compromised SCADA code, the KGB's recruitment of West German hackers from the Chaos Computer Club in the mid-80s (Cliff Stoll's Cuckoo's Egg documents this in detail), and then the long arc through Stuxnet and Chinese APT campaigns against the U.S. defense industrial base. Continuous escalation, documented inflection points, 32 years of it. Here's why the framing matters for what comes next, not just what already happened. The paper makes a point about institutional continuity that most technical threat reporting glosses over. The organizations running aggressive cyber espionage today are not new. The SVR is the KGB's foreign intelligence successor. The PLA's cyber mission grew directly out of doctrine developed in the 1990s around what Chinese military theorists called "informationized warfare." These aren't startups. They have forty-plus years of muscle memory around what they want, who has it, and roughly how to get it. That's a different problem than stopping a novel actor who's still figuring out their targeting priorities. So when you think about trajectory, start there. The targeting logic is mature and stable. What's still evolving is the method, and the method is evolving fast in a particular direction. The 1982-to-2014 arc the paper documents moved from one-off physical sabotage and opportunistic network intrusion toward persistent access and scalable intellectual property theft. Stuxnet in 2010 was the public landmark for the physical effects side. The PLA Unit 61398 indictments in 2014 (the five officers DOJ named, Gu Chunhui, Wang Dong, Sun Kailiang, Wen Xinyu, Huang Zhenyu) were the public landmark for the industrial-scale IP theft side. Those two lines haven't converged yet. They will. What does convergence look like? It looks like persistent access to critical infrastructure combined with the willingness to use it, not as a standalone attack, but as leverage or as a component of a broader operation during a geopolitical crisis. Russia already pre-positioned in U.S. energy and water infrastructure, that's documented in multiple DHS and CISA advisories going back to 2018. China's Volt Typhoon activity, which CISA and NSA flagged in 2023, is explicitly pre-positioning in communications and transportation networks. Neither of these is the attack. Both of them are the setup. The trajectory the paper traces from 1982 forward ends in 2014, but it points directly at where we are now: actors who have moved past the question of "can we get in" and are sitting on persistent access they acquired years ago, deciding when and whether to use it. For defenders, the actionable read is that the threat model has to account for accesses that were established years before they become relevant. A network intrusion that happened in 2019 might matter enormously in 2026 depending on what happens in the Taiwan Strait or in Ukraine. Incident response framing, which is built around detecting and ejecting an active threat, is structurally underequipped for this. You need to be hunting for dormant implants and legacy access paths that nobody tripped an alert on because nothing happened after they were placed. That's a different workflow and a significantly more expensive one. For officials and policymakers, the paper's point about strategic motivation is the part that doesn't get enough attention. These operations persist because the underlying strategic goals haven't changed. China wants defense technology, advanced manufacturing processes, and political intelligence about U.S. decision-making. Russia wants to degrade Western cohesion, maintain leverage over energy-dependent states, and preserve its ability to escalate. Patching vulnerabilities and indicting individual operators addresses none of that. The 2014 PLA indictments didn't slow Chinese IP theft in any measurable way. The operations just shifted to different infrastructure and different cover organizations. The next move for both actors is going to be further laundering of state operations through proxies and criminal-adjacent groups. Russia is well down this road already. GRU and FSB have used criminal hackers as cutouts since at least the early 2010s, and the overlap between the Sandworm cluster and EvilCorp-linked infrastructure has been documented by researchers at Mandiant and others. China is catching up. The Winnti cluster has commercial-facing components. The operational benefit is obvious: it adds a layer of deniability, it makes attribution harder, and it lets state agencies access criminal capability (ransomware infrastructure, money laundering, logistics) that they don't have to build themselves. For voters and for anyone trying to understand what election-period operations look like going forward: the escalation arc in this paper ends before the 2016 interference operations, before the GRU's hack-and-leak campaign through DCLeaks and Guccifer 2.0, before the IRA's social media operation. Those weren't departures from the historical pattern. They were the historical pattern applied to a new target set using updated tools. The same institutional actors, the same underlying motivation (degrade U.S. influence and internal cohesion), updated methods. The 2024 cycle saw Iranian actors targeting both campaigns, Chinese actors probing congressional and campaign infrastructure, and ongoing Russian influence activity. None of that is surprising if you've read the 1982-to-2014 arc. What should concern people about 2026 and 2028 isn't that foreign actors will try to interfere. They will, they always have, the paper literally documents 40 years of it. The concern is that the access they've already pre-positioned in U.S. infrastructure gives them a coercive option that goes beyond information operations. Disrupting election administration systems, degrading communications, creating enough visible chaos to undermine confidence in results without actually changing vote tallies. That's the next level, and the access to attempt it exists right now in networks that defenders haven't fully mapped. The paper frames 2014 as operational maturity. That's right. What we're in now is the deployment phase. foreigninterference.org/post/cyber-war… #foreigninterference #CyberEspionage #AdvancedPersistentThreatOperations #CriticalInfrastructureMapping #TradeSecretTheft

The playbook is older than most people realize. A declassified October 1982 State Department cable, sitting in Jack Matlock's files at the Reagan Library, shows the NSC already running systematic tracking of Soviet active measures against Western Europe. Front groups, TASS amplification, KGB targeting of West German opinion ahead of the Bundestag missile vote. The whole stack. This predates the Active Measures Working Group by roughly four years. The infrastructure for countering Soviet disinformation didn't appear in 1986 because someone had a new idea. It appeared because the groundwork was already there. foreigninterference.org/post/reagan-er… #foreigninterference #DisinformationCampaigns #InfluenceOperations #ComputationalPropaganda #ForeignInformationManipulation

Election interference isn't a new threat. It's a permanent feature of the competitive landscape that powerful states have exploited for decades. The Heinrich Böll Foundation just mapped the architecture across multiple actors: Russia's IRA-style propaganda operations, Iran's disinformation network (the U.S. seized 36 of their websites in June 2021 alone), covert campaign finance laundering, domain impersonation. Different players, same toolkit. The part that should stick with you: the U.S. has been systematically dismantling the defensive infrastructure that counters this stuff, right as the offensive capabilities of adversaries are well-documented and intact. foreigninterference.org/post/heinrich-… #foreigninterference #CampaignFinanceViolations #CounterDisinformationFrameworkElimination #CovertMediaFunding #DisinformationCampaigns #ElectionInterference

42 years ago today, the Reagan administration was quietly building a playbook for something they didn't have clean language for yet: what do you actually do when a hostile foreign intelligence service has dug into your country so thoroughly that normal law enforcement responses aren't enough? The answer, apparently, was a 17-option framework. CIA documents, later declassified, show that Judge William Webster, then FBI Director, brought this proposal to the table as part of a broader effort to get the government's arms around Soviet-bloc intelligence activity on U.S. soil. Seventeen specific options to limit and control what they were calling "hostile foreign presence." That's a phrase worth sitting with. Not "suspected spies." Not "illegal activity." Presence. The problem had grown large enough that it needed its own category. The Cold War context matters here. By 1984, Soviet intelligence operations in the United States had been running for decades. The KGB and GRU had assets in government, in academia, in industry. The Walker spy ring, which handed over U.S. Navy cryptographic secrets for years, wouldn't be rolled up until 1985. Robert Hanssen was already inside the FBI. The problem was not hypothetical. What made the Webster framework notable wasn't that the government was trying to counter foreign spies. Obviously they were doing that. What stood out was the scale of the coordination problem they were acknowledging. Seventeen options suggests they didn't have one clean answer. Multi-agency review processes, jurisdictional questions, resource allocation across the intelligence community. The documentation points to a government realizing that compartmentalized responses weren't cutting it anymore. You couldn't just have the FBI handle it on the law enforcement side while CIA handled the foreign intelligence side and hope the picture came together. That coordination failure, by the way, didn't get solved in 1984. It was still a central complaint in the 9/11 Commission report nearly two decades later. The framework also reflects something specific to that moment: the tension between operational effectiveness and constitutional guardrails was live and contested. These weren't theoretical concerns. COINTELPRO had ended just over a decade earlier, and the Church Committee had exposed what unchecked domestic intelligence operations looked like. The Reagan administration was trying to be more aggressive about foreign intelligence threats while operating in a post-Church Committee legal environment. That's a genuinely hard problem, and the documentation's emphasis on "legal and constitutional safeguards" wasn't just boilerplate. It was a direct response to recent history. Forty years on, the operational problem has metastasized in ways Webster's framework wasn't built to anticipate. "Hostile foreign presence" in 1984 meant people. Human intelligence, recruited assets, illegal officers running networks. The physical presence of foreign intelligence officers under diplomatic cover. The framework was designed around that world. The presence problem now includes infrastructure that has no physical footprint in the traditional sense. Influence operations running through domestic social platforms. Capital flowing through investment structures that obscure beneficial ownership. Academic exchange programs that function as technology transfer pipelines. Legal entities registered in the United States that serve foreign intelligence objectives without a single foreign national ever setting foot in a sensitive facility. The jurisdictional headaches Webster was navigating in 1984 look almost manageable compared to what counterintelligence agencies are dealing with now, where the question of which agency owns a particular threat vector is genuinely unresolved in some cases. Treasury, FBI, ODNI, DHS, DOJ's National Security Division. The interagency coordination problem that prompted a 17-option memo four decades ago spawned a permanent bureaucratic ecosystem that still hasn't fully cracked it. One concrete thing that did change coming out of this era: FISA, the Foreign Intelligence Surveillance Act, had passed in 1978 and was just settling into operational use by 1984. The Webster framework was being built in the early years of a legal structure that would later become central to every major counterintelligence debate, including the ones about surveillance overreach in the 2000s and beyond. The institutional architecture we fight about now has roots in exactly this period. The 17 options themselves remain classified in their specifics. What we know is the shape of the problem they were designed to address, and that shape is familiar. Foreign intelligence services treating American institutions as operational terrain. The question of how aggressively to respond without becoming something you'd rather not be. The bureaucratic friction of getting multiple agencies to work a problem together. Some things don't change. The terrain does. foreigninterference.org/post/reagan-ad… #foreigninterference #CounterintelligenceOperations

43 years ago today, a forged NSC memorandum was circulating in the Spanish press claiming the CIA had been secretly coordinating with Poland's Solidarity movement. The forgery ran in Tiempo on February 7, 1983. By July of that year, the Reagan administration had pulled together enough documentation to map out the operation in detail, and the picture that emerged was methodical. The Soviet playbook at this stage wasn't subtle so much as it was disciplined. Fabricated documents seeded into sympathetic or simply credulous outlets. Existing political fractures in Western Europe, particularly the fierce domestic debates over NATO missile deployments, treated as distribution infrastructure. You don't need to create the tension if it's already there. You just need to feed it something that looks like a document. The Solidarity angle was shrewd targeting. By 1983 the movement had enormous moral credibility across Western Europe's left. If you could tie it to the CIA, you didn't just discredit Solidarity. You handed every Western peace activist who was already suspicious of American intentions a reason to look away. The forgery wasn't aimed at Poles. It was aimed at West Germans, Italians, Spaniards. The people whose governments Washington needed to keep in line on the intermediate-range missile question. What the NSC files actually captured, beyond any single operation, was the architecture. How Soviet active measures units coordinated across multiple European outlets. How timing was calibrated to political moments. How the feedback loop worked between initial placement and secondary amplification. That analytical work mattered. The framework the Reagan team built for cataloging these techniques became the template for how Western counterintelligence thought about state-sponsored disinformation for the next decade, and honestly the conceptual vocabulary hasn't changed as much as people assume. The threat did change, though. Dramatically. What required a foreign intelligence service running a forgery operation through a Madrid newspaper in 1983 now takes an afternoon, a few synthetic accounts, and a news cycle willing to move faster than verification. The discipline is largely the same. The barrier to entry collapsed. That's the uncomfortable throughline from those NSC files to the present: the doctrine aged well. The infrastructure costs did not. foreigninterference.org/post/reagan-ad… #foreigninterference #DocumentForgery #MediaImpersonation #StateMediaCoordination