//
OFFLINE — VIEWING CACHED CONTENT
← Back to Archive

IC BRIEF

Current as of 0329 EDT (UTC-04), Sunday 13 September 2026

Contents

9 stories from 39 sources across 36 organizations

KEY JUDGMENTS

Russia's GRU is running concurrent sabotage and espionage operations against European defense-supply-chain infrastructure, from a logistics hub in Germany to drone-manufacturing sites in the United Kingdom. A formal NATO or EU collective statement referencing Russian intelligence sabotage is likely before December 12. Moderate confidence reflects Skripal and SolarWinds collective-attribution precedents but no communiqué drafting process in motion. Germany's formalization of arrest warrants against the named GRU officer would strengthen the judicial basis for collective attribution.

China will very likely absorb dual counter-espionage pressure from the CIA Deputy Director's identification of Chinese firms as intelligence targets and South Korea's new foreign-espionage statute without imposing a concrete retaliatory countermeasure before Xi Jinping's US visit. Moderate confidence reflects Beijing's pre-summit restraint pattern across comparable windows since 2017. A Chinese enforcement action naming a US or South Korean entity would signal that restraint has broken.

At least one member of Congress will likely cite both the bipartisan House Permanent Select Committee on Intelligence (HPSCI) 9/11 review's 20 recommendations and the documented elimination of more than 1,300 DHS terrorism-prevention positions in a formal legislative or oversight action before December 12. Low confidence reflects the conjunction requirement, since no member has publicly signaled intent to link the bipartisan recommendations to the staffing reductions.

Adversary Intelligence

China Warns US to Stop All Spying After CIA Deputy Director Declares Chinese Firms Legitimate Intelligence Targets

BLUF: Beijing's demand to halt espionage is rhetorical posturing ahead of Xi's planned US visit, and concrete countermeasures against named US targets before that visit concludes remain very unlikely.

China's Ministry of Commerce on Friday demanded the US "immediately cease all espionage activities against China," including against Chinese enterprises, and warned it possesses "the firm will and ample means" to punish such acts under laws including the Counter-Espionage Law 1. The statement responded to CIA Deputy Director Michael Ellis, who said in a public speech Tuesday that the US is expanding intelligence work on China and that Chinese firms in AI, semiconductors and biotechnology are "legitimate targets" for espionage 12. The ministry called the US claims "gangster logic of hegemony," according to South China Morning Post (SCMP)'s rendering 2, or "bandit logic of hegemony," per Xinhua's translation 1, and characterized economic competition as normal commercial activity dependent on technology, talent and innovation 2. The exchange precedes a planned Xi visit to the US in coming weeks 2.

Analyst Note: Beijing's Counter-Espionage Law invocation converts Ellis's remarks into an explicit legal warning rather than an operational pivot, and China is very unlikely to impose a concrete countermeasure, such as a sanction, asset freeze, or exit ban, against a named US individual or entity before Xi's planned US visit concludes, since Beijing has strong incentive to preserve the summit's atmospherics. We hold high confidence in this judgment given China's consistent pattern of channeling such disputes into statements rather than enforcement actions ahead of high-level exchanges, though sourcing rests entirely on secondary accounts of a single ministry release, with SCMP and People's Daily Online converging on identical language without independent corroboration. The statement marks a shift from silence to named rebuttal, but may function primarily as domestic-facing, pre-summit positioning. Absent a concrete countermeasure, US agencies can hold current travel-security guidance and personnel-exposure posture unchanged through the visit.

Sources:

1: China slams U.S. espionage against Chinese enterprises - People's Daily Online

2: China urges US to stop all spying or face retaliation, slams gangster logic - South China Morning Post

Prior Reporting

German Intelligence Links GRU to Foiled Drone Bomb Plot at Leipzig Airport Targeting Ukrainian Cargo Aircraft

BLUF: Germany's naming of a GRU officer and a linked Belarusian operative makes a formal indictment likely within 90 days, converting political attribution into a judicial record Moscow cannot easily dismiss.

German investigators have identified two suspects in the August 4 drone-bomb attempt on a Ukrainian An-124 at Leipzig/Halle airport, citing secret investigation files obtained by Welt am Sonntag 12: Russian national Oleg Le., attributed to the GRU military intelligence agency and believed to have organized logistics, and Belarusian national Andrei Ka., suspected of carrying out the attack 34. Le. entered Germany via Turkey and departed through Berlin-Brandenburg airport for Serbia before returning to Russia; investigators knew of his GRU ties on entry but did not place him under surveillance 45. DNA on glove remains at the drone's antenna control site matched traces on file in Finland and Lithuania tied to Ka., whom Polish authorities separately link to a 2024 hardware-store fire in Łódź treated as sabotage 36. About 1.8 kg of Semtex, packed in a vegetable can, failed to detonate against the fueled Antonov after a detonator tore loose; German officials cited these findings as the basis for publicly blaming Russia on September 1 and closing Russia's Bonn consulate and Berlin cultural center, prompting Moscow to shutter Germany's St. Petersburg consulate and the Goethe-Institutes 23.

Analyst Note: An arrest warrant or indictment against Le. or Ka. is likely within the next 90 days, now that Berlin has moved from a diffuse "Russian services" attribution to a named, prosecutable GRU officer. DNA linkage, travel records, and the political momentum from the September 1 attribution and consulate closures all point the Federal Prosecutor General toward formalizing the case. Moderate confidence reflects reliance on a single leaked-document source not yet corroborated by court filings. Neither suspect is in German custody, so any warrant would be symbolic rather than enable extradition, but it would lock the GRU attribution into a judicial record Moscow cannot dispute through diplomatic channels alone.

Sources:

1: Germany Identifies Russian Agent Behind Drone Attack, WamS Says - Bloomberg

2: Drohnenvorfall in Leipzig: Ermittlungen führen offenbar direkt zum russischen Militärgeheimdienst GRU - Tagesspiegel

3: A Russian intelligence operative and a Belarusian petty criminal: Germany names the Leipzig bomb-drone suspects - Euromaidan Press

4: Mutmaßlicher Leipzig-Attentäter wohl wieder nach Moskau geflohen - t-online.de

5: German security officials reportedly suspect Russian GRU agent helped plan failed Leipzig airport attack - The Times of Israel

6: Drone attack on Leipzig: clues apparently point to Russian intelligence service - Euronews

Sabotage: Deutsche Behörden identifizieren russische Agenten hinter Drohnenangriff von Leipzig - Welt am Sonntag

Ermittler identifizieren mutmasslichen GRU-Logistiker hinter Drohnenanschlag auf Leipzig - Welt am Sonntag (Die Welt)

Drohne mit Sprengstoff am Flughafen Leipzig: Was wir zum mutmasslichen Anschlag wissen - Neue Zürcher Zeitung

German intelligence services identify organizers of attempted explosion in Leipzig - DW - Ukrinform

Prior Reporting

UK Charges British Man With Assisting GRU Military Intelligence in Drone Factory Espionage

BLUF: GRU proxy recruitment of UK nationals for sabotage against drone-manufacturing sites signals an operational escalation beyond intelligence collection, and Cammidge is unlikely to enter a guilty plea at or shortly after the September 25 Old Bailey hearing.

British authorities charged Joshua Cammidge, 31, of Swindon, with assisting a foreign intelligence service and preparing an act of sabotage under Sections 3 and 18 of the National Security Act 2023 12. The Crown Prosecution Service says Cammidge communicated with a person linked to the GRU Volunteer Corps, which UK authorities describe as controlled by Russia's GRU military intelligence directorate 13, and allege he shared Google Maps screenshots of five drone-manufacturing sites in Swindon, researched a Wi-Fi-jamming device, and offered to carry out sabotage himself between late March and September 5 23. He was arrested September 4 by Counter Terrorism Policing London with Wiltshire Police support, further detained September 5 under the National Security Act, and appeared at Westminster Magistrates' Court on September 10 without entering a plea before being remanded to the Old Bailey for September 25 123. The Crown Prosecution Service (UK) (CPS) says the case followed a Counter Terrorism Policing investigation and that sufficient evidence exists to proceed 2.

Analyst Note: The case shows GRU proxy networks recruiting vulnerable UK nationals with criminal records to conduct physical reconnaissance and sabotage planning against defense-industrial sites, extending the same operational pattern visible in the Leipzig airport plot into Britain's expanding drone-manufacturing base. Cammidge is unlikely to plead guilty at the September 25 Old Bailey hearing or within about two weeks after, since no plea was entered at the magistrates' hearing and National Security Act defendants contest charges through committal. Low confidence reflects the absence of any defense statement, leaving the assessment reliant on prosecutorial characterizations rather than defendant signals. The Section 18 charge, covering preparatory conduct rather than completed sabotage, indicates prosecutors are testing the Act's lower evidentiary threshold to intercept proxy recruitment before facilities are attacked.

Sources:

1: UK charges man previously convicted for violent robbery with assisting Russian military intelligence - The Insider

2: Brit accused of feeding Russian military intelligence details of UK drone factories - Euronews

3: Who Is Joshua Cammidge? Brit Charged Over Alleged Russia-Linked Plot to Sabotage UK Drone Factory - IBTimes UK

Man charged with assisting GRU Volunteer Corps - Crown Prosecution Service (CPS)

Man allegedly prepared to sabotage Swindon drone factory on behalf of Russian Intelligence Services - ITV News West Country

IC Operations & Tradecraft

US Expands Intelligence Sharing with Saudi Arabia Through Joint Command to Counter Houthi Threat

BLUF: Washington's embedded advisory presence gives it direct influence over Saudi targeting while maintaining deniability, though direct U.S. participation in strikes remains unlikely over the next 90 days.

More than 100 US military advisers are working in Saudi Arabia providing intelligence and targeting support to the Kingdom's campaign against the Iran-backed Houthis, CNN reported citing multiple sources familiar with the effort, with a US official putting total troop numbers at roughly 200 1234. The personnel operate under a joint forces command established in recent weeks as Iran stepped up support for Houthi attacks on Saudi Arabia, according to a US official 1. The US is providing a real-time battlefield targeting tool one official compared to the Pentagon's Maven system, and separately supplying "geospatial" targeting support for Saudi strikes, sources told CNN 14. US forces are not participating directly in strikes or refueling Saudi aircraft, sources said, and a Defense Department official declined to comment, citing a practice of not discussing intelligence matters 1234.

Analyst Note: US personnel embedded in a newly established joint command now have visibility into and influence over Saudi targeting decisions against the Houthis, even as Washington insists it isn't conducting strikes itself. Direct US participation in kinetic strikes is unlikely over the next 90 days, with officials citing firm limits on refueling and strike involvement plus forces already stretched by six months of Iran operations. Confidence in that judgment is low, resting on a single CNN sourcing chain that three other outlets merely repackaged without independent confirmation. The command may reflect institutionalized routine support recast as new only because reporters gained access to it, and Iranian Islamic Revolutionary Guard Corps (IRGC) presence in Yemen remains the variable most likely to force a reassessment. Should the limits hold, US exposure stays confined to advisory and intelligence channels, shaping how much airlift, munitions, and political cover the Pentagon extends to Riyadh; crossing into direct strikes would open co-belligerent liability on a second front alongside Iran.

Sources:

1: EXCLUSIVE: US expands intel, targeting support for Saudi campaign against Iranian ally - CNN

2: US expands intelligence sharing with Riyadh amid conflict with Houthis — CNN - TASS

3: US expands intelligence sharing with Riyadh - APA.az

4: Report: US deploys troops to Saudi Arabia amid Houthi threat - Israel National News (Arutz Sheva)

CIA Releases 71 Declassified Presidential Daily Briefs Revealing Warnings About al-Qaeda Before September 11

BLUF: CIA's largest-ever Presidential Daily Brief (PDB) declassification on 9/11 serves as curated institutional narrative management, not a disclosure that reshapes the historical record of pre-attack warning failures.

On Friday, the 25th anniversary of the September 11 attacks, CIA Director John Ratcliffe declassified 71 President's Daily Brief products on Osama bin Laden and al-Qaeda, calling it the agency's largest-ever release of PDB material related to 9/11 12. The documents, spanning a February 1998 brief on "terrorists seeking Weapons of Mass Destruction (WMD) capability" to a September 12, 2001 report describing two years of attack planning that also targeted the U.S. Capitol, total more than 100 pages 23. A final pre-attack warning, dated August 6, 2001 and titled "Bin Ladin Determined To Strike in US," said al-Qaeda members had lived in or traveled to the U.S. "for years" and cited 70 ongoing FBI field investigations into bin Laden-related activity 3. The White House, asked for comment, pointed to a separate National Archives release the same day of interviews with Clinton- and Bush-era national security officials compiled by the 9/11 Commission 24.

Analyst Note: The release functions as institutional messaging rather than new intelligence history, since the documents reportedly do not alter historians' existing understanding of the pre-9/11 warning failures the 2004 9/11 Commission already documented. Framing the disclosure as transparency tied to a presidential initiative signals the CIA is shaping its own narrative on 9/11 accountability, and the same-day National Archives release of Commission interviews points to coordinated interagency messaging rather than an independent decision. Sourcing rests on the CIA's own release notice and a largely single wire account, with only one outlet offering independently framed analytical detail: strong factual convergence but limited independent verification of interpretive claims. The "exceptional transparency" framing may serve as much to rehabilitate the CIA's institutional standing on the anniversary as to inform historical understanding, particularly since the White House itself declined direct comment and redirected to the Archives release. Whether this scale of declassification becomes a recurring template for future PDB releases is genuinely uncertain.

Sources:

1: CIA Releases President's Daily Briefs in Commemoration of the 25th Anniversary of 9/11 - Central Intelligence Agency (CIA.gov)

2: CIA releases dozens of presidential daily briefs on bin Laden and al-Qaida before Sept. 11 - Bangor Daily News

3: CIA declassifies intel warnings to White House prior to 9/11 attack - CNN

4: CIA releases dozens of presidential daily briefs on bin Laden and al-Qaida before Sept. 11 - PBS News

Allied Intelligence

South Korea Espionage Law Takes Effect Expanding Spy Crimes Beyond North Korea to Protect Chip Technology

BLUF: Seoul's new foreign-espionage statute gives prosecutors a dedicated tool to criminalize state-backed chip technology theft, and an initial indictment under the provision is likely within 12 months.

South Korea's expanded espionage law took effect on Sunday, broadening espionage offenses beyond acts benefiting North Korea to cover all foreign countries, according to Reuters 1. The National Assembly passed the revised Criminal Act on February 26, and the amendment creates a new offense for espionage on behalf of a foreign country or equivalent organization, carrying a minimum three-year prison sentence. Existing "enemy state" provisions remain unchanged 12. The National Intelligence Service said the change would strengthen its ability to prevent leaks of strategic technologies including semiconductors, displays, batteries and AI 2. The law follows last year's indictment of five former Samsung Electronics employees accused of transferring Dynamic Random-Access Memory (DRAM) chip technology to China's ChangXin Memory Technologies (CXMT) 12. Asked whether the law targets Beijing, Chinese foreign ministry spokesperson Mao Ning said China expects other countries to provide a "fair, just, and non-discriminatory business environment" for its enterprises 2.

Analyst Note: South Korea's new foreign-espionage offense hands prosecutors a stand-alone charge for non-North Korea technology transfers, ending reliance on lighter trade-secret statutes whenever a foreign state or its proxy is involved. Read alongside Beijing's Counter-Espionage Law warning this cycle against US espionage, the legislation positions Seoul in an increasingly explicit allied counterintelligence alignment on semiconductor security. Prosecutors will likely secure a first indictment under the new foreign-espionage provision within 12 months; last year's Samsung-CXMT case already supplies an investigative template prosecutors can port onto the new charge. We have low confidence in this timing judgment, reflecting the absence of any announced pending case built on the new statute rather than the pre-existing enemy-state clause.

Sources:

1: South Korea's expanded espionage law takes effect amid push to protect chip technology - Reuters (via Yahoo News Canada)

2: South Korea expanded espionage law takes effect amid push to protect chip technology - AsiaOne

Prior Reporting

Spanish Official Resigns After Government Declassifies 40 CNI Documents Revealing Pre-Crisis Intelligence Warnings

BLUF: Moncloa's framing of Sanz's departure as personal rather than institutional makes it unlikely that additional officials will face accountability for the intelligence-warning failures within 90 days.

The Spanish government on September 9 declassified roughly 40 police and intelligence documents covering July 1–August 1, including a Centro Nacional de Inteligencia (Spain) (CNI) note sent to Moroccan intelligence services (Direction Générale de la Sécurité du Territoire (Morocco) (DGST) and Direction Générale des Études et de la Documentation (Morocco) (DGED)) at 18:26 on July 29 warning of social-media calls for crossings by sea and over the Ceuta fence during Morocco's Throne Day 12. The CNI separately told the government delegation in Ceuta the same day of online calls for a crossing at 20:00 the following evening 1; the CNI has said it did not anticipate the "magnitude and nature" of the eventual arrival of roughly 72,000–80,000 people 12. Gonzalo Sanz, chief of staff to the government's delegate in Ceuta, resigned on September 11 after disclosure that he received CNI WhatsApp messages and an 11-minute call from a CNI agent on July 29, and he said he passed the warning to ministries the same day 3. Delegate Miguel Ángel Pérez Triano denied receiving that information and called the exchange informal, while Moncloa has characterized Sanz's resignation as a personal falling-out rather than an accountability matter and says no officials will be dismissed 34.

Analyst Note: Moncloa's push to cast Sanz's exit as a personal rift rather than an accountability failure signals it intends to absorb the political cost without further personnel changes, insulating Pérez Triano and ministers from the disclosure. Sanz's departure may instead reflect a pre-existing personal clash with his delegate that predates the CNI warning. A second resignation, dismissal, or formal disciplinary action against another CNI or government official is unlikely within the next 90 days, as no source names a pending referral, inspector-general inquiry, or judicial order targeting additional officials, though continued CNI-government friction over who briefed whom raises the odds of further leaks eroding Sánchez's account without new departures. Confidence is high, given consistent primary-source reporting that Moncloa has explicitly ruled out dismissals and no indicator pointing to a second target. Absent further departures, Sánchez's no-dismissals line holds and opposition efforts to force a censure motion or inquiry targeting Marlaska or Robles lack a fresh trigger.

Sources:

1: Ceuta files reveal advance intelligence warnings as Madrid disputes what they foretold - EU Today

2: Desclasificación de los informes de Ceuta, en directo: el Gobierno publica 40 documentos policiales y de inteligencia sobre la entrada masiva - Infobae

3: Dimite el jefe de Gabinete del delegado del Gobierno en Ceuta que mantuvo llamadas con el CNI - El Debate

4: Moncloa presenta la dimisión del jefe de Gabinete que era el contacto del CNI en Ceuta como una desavenencia personal - El Español

Spanish official resigns as questions grow over intelligence warnings ahead of Ceuta migrant influx - Euronews

Prior Reporting

IC Workforce & Organization

Trump Immigration Push Shifts DHS and FBI Resources Away From Counterterrorism as 1300 Terrorism Prevention Staff Eliminated

BLUF: Reassigning seasoned counterterrorism investigators to immigration enforcement degrades post-9/11 threat coverage in ways that will only become visible after a missed plot.

A Democratic staff report from the Senate Homeland Security and Governmental Affairs Committee, released July 30, found the Trump administration has removed more than 1,300 DHS personnel from roles preventing, countering, and responding to terrorism, and cut 15,000 positions across Department of Justice (DOJ) and the FBI 1. Politico reported that hundreds of Homeland Security Investigations agents have been reassigned to immigration enforcement since January 2025, alongside staffing cuts to cybersecurity, disaster response, and chemical-biological-nuclear threat prevention units 2. Former DHS Secretary Jeh Johnson told Politico the reassignments risk missed threats, while DHS said in a statement that "counterterrorism and immigration enforcement go hand in hand" and that the department remains equipped for current threats 23. The FBI disputed the report's characterization, stating its counterterrorism work "is as successful as it ever has been" and citing more than 1,000 disrupted terrorists and 4,000 arrests tied to foreign terrorist organizations 2.

Analyst Note: The realignment strips experienced investigators, cyber specialists, and WMD-prevention staff from post-9/11 counterterrorism missions and concentrates that expertise in immigration enforcement instead, with Homeland Security Investigations' outsized Joint Terrorism Task Force role narrowing federal reach even as FBI arrest and disruption totals show no corresponding decline yet. Sourcing rests on two independent primary threads: the committee's own findings and Politico's reporting drawing on roughly ten current and former officials, though secondary outlets merely relay Politico rather than independently corroborating it. Congressional staff have now quantified DHS's toll at 1,300 eliminated positions and extended the pattern to Cybersecurity and Infrastructure Security Agency (CISA), WMD-prevention, and National Counterterrorism Center (NCTC)'s cartel-focused shift, prompting the FBI's first public rebuttal. The staffing shifts may instead reflect deliberate reprioritization toward threats DHS judges more urgent, such as cartel networks, and Congress lacks the annual domestic-terrorism reporting required by law to independently arbitrate which framework better describes current exposure.

Sources:

1: Peters Report Finds Trump Administration Has Dismantled Critical Counterterrorism Infrastructure and Weaponized What Remains Against Political Opponents, Leaving Americans Vulnerable to Terror Threats - Senate Homeland Security & Governmental Affairs Committee (Democratic staff / Sen. Gary Peters)

2: The department created to stop another 9/11 may no longer be equipped for counterterrorism work - Politico (via Yahoo News)

3: Trump Immigration Push Shifts DHS Resources Away From Counterterrorism - Tickle The Wire

Prior Reporting

IC Oversight & Policy

HPSCI Completes Yearlong Review of 9/11 Commission Report and Votes Out Updated Assessment

BLUF: HPSCI's bipartisan 9/11 review reframes legacy counterterrorism oversight as a vehicle for shaping Intelligence Community (IC) posture on AI, cyber, and foreign influence threats going forward.

The House Permanent Select Committee on Intelligence voted out its bipartisan yearlong review of the 9/11 Commission Report on August 31, following a field hearing at the Flight 93 National Memorial near Shanksville, Pennsylvania 1. The review, led by task force co-chairs Rep. Elise Stefanik and Rep. Josh Gottheimer alongside Chairman Rick Crawford and Ranking Member Jim Himes, issued 20 bipartisan recommendations on intelligence sharing, congressional oversight, and emerging threats from China, Russia, cyberattacks, foreign influence operations, and artificial intelligence 2. The task force concluded that post-9/11 reforms, including creation of the National Counterterrorism Center and the Office of the Director of National Intelligence, have strengthened security but require continued adaptation 2. Crawford's committee also held a Pentagon wreath-laying on September 1 and a public discussion with Stefanik and Gottheimer at the National September 11 Memorial & Museum in New York on September 3 1.

Analyst Note: The 20 recommendations set a congressional benchmark for measuring IC information-sharing and oversight practices rather than a self-executing reform, since implementation depends on follow-on legislation or executive-branch adoption that the report itself cannot compel. Sourcing rests entirely on HPSCI's own report release, with the committee's anniversary statement and outside coverage merely recapitulating that single product without independent corroboration. Folding AI, cyber, and foreign-influence threats into a 9/11 retrospective signals HPSCI's intent to use this as a running authorization and oversight vehicle for NCTC and Office of the Director of National Intelligence (ODNI) rather than a one-time review; that same breadth may instead reflect an effort to justify continued funding and relevance for those agencies rather than a narrowly evidence-driven reassessment. Bipartisan sign-off from Crawford, Himes, Stefanik, and Gottheimer narrows near-term political friction over adoption but does not guarantee agency compliance timelines.

Sources:

1: House Intelligence Chairman Crawford Marks 25th Anniversary of 9/11 - HPSCI

2: Gottheimer-led 9/11 task force warns intelligence gaps persist 25 years after attacks - New Jersey Globe

House Intel Committee Releases Bipartisan 9/11 Commission Review Report Ahead of 25th Anniversary - House Permanent Select Committee on Intelligence (HPSCI)

Prior Reporting

COLLECTION GAPS

UNCLASSIFIED // OPEN SOURCE