DCIA Ratcliffe, ramblin’ man (Reuters)
INTEL LEAK ON IRAN ATTACK PLAN: The New York Times reported that Israel planned to strike Iranian nuclear sites as soon as next month, but was waved off by President Trump in recent weeks in favor of negotiating a deal with Tehran to limit its nuclear program. Israel, in coordination with American officials, considered several strike options against Iran in May, including an ambitious plan combining airstrikes and commando raids, but then shifted focus to a large-scale bombing campaign before calling the whole thing off. Israel was furious. Channel 12 quoted a senior Israeli security official as saying, “The heart of the secret with respect to Iran was leaked — the methods of operation, the timing, the coordination mechanisms, and the element of surprise. This does real harm to Israeli interests regarding Iran.” The Kan public broadcaster reported that Israel believes the U.S. leaked the information in order to pressure Iran in the negotiations.
Foreign Minister Abbas Araghchi and President Trump’s special envoy, Steve Witkoff, are set to hold a second round of talks in Rome on Saturday.
Director of National Intelligence Tulsi Gabbard is emerging as one of the voices counseling against an attack. In a meeting this month about Israel’s plan, the Times reported that Gabbard presented a new intelligence assessment that said the buildup of American weaponry in the Middle East could potentially spark a wider conflict with Iran that the United States did not want. The U.S. military has sent two U.S. carriers—the USS Carl Vinson and Harry Truman—to the Middle East and deployed at least six B-2 bombers with 30,000-pound bunker-busting bombs to Diego Garcia as a not-so-subtle warning to Iran if it doesn’t make a deal. Trump has sided, for now, with the doves and opted for direct talks, which, as SpyTalk editor-in-chief Jeff Stein reported, is a magnet for spies.
Axios reported that Gabbard installed William Ruger, a former vice president of the Charles Koch Institute and a skeptic of military action against Iran, as Deputy DNI for Mission Integration, a key position in the intelligence community that puts him in charge of the President’s Daily Brief. or PDB. Oddly, last month Gabbard decided not to give the same job to Daniel Davis, a similar skeptic of foreign interventions—and critic of Israel.
Earlier this month, Trump sent CIA Director John Ratcliffe to Jerusalem for discussions about what to do about Iran. The New York Times reported that Ratcliffe met with Israeli Prime Minister Benjamin Netanyahu and David Barnea, the head of the Mossad. “In addition to talks and strikes, other options were discussed, including covert Israeli operations conducted with U.S. support and more aggressive sanctions enforcement,” the Times reported.
As diplomacy hangs by a thread, the shadow war over Iran’s nuclear ambitions edges closer to daylight—with Washington and Jerusalem at odds over how, and when, to strike. (It’s amazing to us how much of this highly sensitive debate is being played out in the media.)
Meanwhile, someone leaked an internal Ratcliffe memo to the New York Post in which he maintains that "no adversary in the history of our Nation has presented a more formidable challenge or a more capable strategic competitor than the Chinese Communist Party."
TRUMP’S RED LINES: In the wake of SignalGate and Laura Loomer’s bizarre Oval Office appearance, we were relieved to hear that there is at least one national security red line that President Trump will not cross. Axios reported that Trump personally killed a Top Secret briefing that Elon Musk was set to receive on the Pentagon’s war plans for China.. "What the fuck is Elon doing there? Make sure he doesn't go," Trump said, according to Axios. Initially, Trump called it “Fake News” when The New York Times reported on the Pentagon’s plans to brief Musk (who has significant business in China, including factories producing Teslas and batteries, and other investments). Of course, the Times report was accurate, and Trump made sure to post his message after the plans for the classified briefing were scrubbed. Musk still attended a briefing at the Pentagon with Defense Secretary Pete Hegseth on March 21. But China wasn't discussed, reportedly. A White House official told Axios that the president “still very much loves Elon, but there are some red lines." Good.
Loomerpolooza.
MISSING SIGNALS: Turns out those Signal chats, which should be properly classified as government records, have gone missing. American Oversight, the nonpartisan watchdog that sued the Trump administration for using the private messaging service to share military strike plans against Houthi rebels in Yemen, has gathered new evidence of “the administration’s disdain for federal record-keeping rules and basic accountability.” It found that “the CIA revealed that not only did the agency fail to preserve any messages, but that someone had proactively deleted messages—potentially even after a court order.” It’s looking for whodunnit.
PENTAGON LEAKS: In related news, the Pentagon placed three top political appointees on leave this week as part of an investigation into press leaks, including that planned briefing for Elon Musk on China war plans. Dan Caldwell, a senior adviser to Hegseth; Darin Selnick, the secretary’s deputy chief of staff; and Colin Carroll, chief of staff to Deputy Defense Secretary Stephen Feinberg, were removed from the Pentagon this week, The Washington Post reported. According to Politico, the leaks under investigation also include “military operational plans for the Panama Canal, a second carrier heading to the Red Sea, Elon Musk’s controversial visit to the Pentagon and a pause in intelligence sharing with Ukraine.” The leak inquiry had authorized the use of polygraphs, but it was unclear whether a lie detector had been used in the investigation.
CRUSHING CARTELS: The CIA is ramping up its focus on international drug cartels, preparing to apply its counterterrorism expertise to dismantle trafficking networks. Deputy Director Michael Ellis told Breitbart that the spy agency is set to launch the Americas Counternarcotics Mission Center, merging Western Hemisphere and counternarcotics teams for faster, tighter coordination against cartels, which the Trump administration has labeled as foreign terrorist organizations. Ellis says he is building a “finely tuned machine” to destroy the cartels by shifting resources traditionally aimed at hunting down jihadist threats in the Middle East toward drug traffickers in Latin America. Ellis’ first trip as deputy director took him to the U.S.-Mexico border in San Diego. Relatedly, the House Intelligence Committee has created a Cartel Task Force led by Rep. Dan Crenshaw, R-Tex., who says he will “identify the tools and authorities needed to empower U.S. agencies and allies to defeat” transnational drug cartels.
This is just the latest iteration of CIA anti-drug efforts. In 1989, the agency created a Counternarcotics Center to support other U.S. government efforts in this realm. In 1994, its name was changed to the Crime and Narcotics Center to reflect its expanded mandate to include all international crime issues. No word on whether the Trump initiatives will subsume or replace it.
SPYING WITH AI: In other Langley news, the CIA is arming its intel-gathering systems with artificial intelligence. At a Vanderbilt University summit, the agency’s AI chief, Lakshmi Raman, said the CIA has “deployed generative AI tools on its Top-Secret systems” that help U.S. intelligence officers process vast amounts of data, spot patterns, and refine their analysis. According to The Washington Times, Raman described a future where AI “assistants” supercharge spycraft, slashing the time it takes to sift intelligence and exposing blind spots in analysts’ thinking. But Raman made clear: machines won’t replace human instincts anytime soon. “We understand when it’s important to have a human in the loop,” she said. The CIA is also watching the horizon for artificial general intelligence systems that could surpass human capability. For now, it’s a “known unknown.”
UNCLOAKED CIA VETERAN TO ODNI: President Trump’s nominee for principal deputy director of the Office of the Director of National Intelligence is a veteran CIA operations officer. Aaron Lukas, 53, has been with the spy agency since 2004. He remained with the agency while holding senior positions in the first Trump administration, including chief of staff at the DNI and deputy senior director for Europe and Russia at the National Security Council. (Previous reports, and Lukas’s own LinkedIn bio, describe him as a foreign service officer, so his appointment was a coming-out of sorts. “For the past 20-plus years, I’ve worked in the shadows as a CIA operations officer, most often overseas on the front lines of intelligence work,” Lukas said in his statement to the Senate Intelligence Committee. Most recently, he was “a CIA Station Chief/DNI Representative in a former Soviet country.” If confirmed, Lukas says DNI Tulsi Gabbard has asked him to review intelligence community programs to ensure they stay focused on core missions — collection, analysis, and covert action — and reconsider those that don’t.
CHINA FINGERS U.S. TAPPERS: China flipped the script on the United States, accusing three officials with the National Security Agency of hacking into systems tied to the 2025 Asian Winter Games in Harbin. China’s official Xinhua News Agency, citing Chinese investigators, said the three members of the NSA’s Tailored Access Operations targeted sensitive personal data just before the event’s opening ceremony in February, which was attended by Chinese President Xi Jinping. The NSA agents were identified by Xinhua as Katheryn A. Wilson, Robert J. Snelling, and Stephen W. Johnson. Chinese investigators said the operatives are "suspected of activating specific pre-installed backdoors" in Microsoft Windows operating systems. The American trio is accused of using front organizations and anonymously rented servers to cover their track. Chinese police linked the University of California and Virginia Tech to the operation (Cal didn’t comment; Virginia Tech denied the charges). The U.S. dismissed the claims as fabricated.
DOGE-RUSSIA INTRIGUE: A team of advisors from Elon Musk’s DOGE set off alarms at the National Labor Relations Board when a sharp spike in data was spotted flowing out of the small federal agency that deals with complaints about unfair labor practices. NPR spoke to the whistleblower, later identified as IT staffer Daniel Berulis, who said that minutes after the DOGE team accessed the system, a Russian IP tried logging in, armed with the correct username and password. DOGE team members acted like spies, disabling monitoring tools and deleting access logs to cover their tracks—a behavior that cybersecurity experts say mirrors tactics used by criminal or state-sponsored hackers. On Thursday’s PBS Newshour, Berulis and his lawyer, former CIA officer Andrew Bakaj, said the whistleblower received a chilling warning following his disclosures. “Somebody went to Dan's home and taped a threatening note, a menacing note on his door with personal information,” said Bakaj, which Berulis confirmed. Berulis told PBS that all he wanted was “just a full investigation. That's all I have wanted, is just somebody to come in and validate, tell me why I'm wrong. Just come in and say this is because of this.”
GABBARD THREATS: A 24-year-old Georgia man was arrested and charged with transmitting interstate threats against Director of National Intelligence Tulsi Gabbard and her family. According to federal prosecutors, Aliakbar Amin sent a series of violent threats via text and social media, including images of a firearm pointed at photos of Gabbard and her husband. Court records revealed that Amin had sent cellular text messages to Gabbard’s husband, Abraham Williams. Meanwhile, CNN reported that Gabbard declared under oath last year that she and her husband were residents of Texas. Then she voted in Hawaii. (CNN)
ISIS ELECTION PLOT FOILED: An 18-year-old Afghan citizen and U.S. Green Card holder pleaded guilty to charges of receiving and conspiring to receive firearms and ammunition intended for use in an Election Day terrorist attack. According to the Department of Justice, Abdullah Zada and co-conspirator Nasir Tawhedi, 27, obtained two AK-47-style rifles and 500 rounds of ammunition for a November 2024 attack on behalf of ISIS. The two men were arrested in October 2024. Zada, arrested at 17, pleaded guilty as an adult and faces up to 15 years in federal prison. Tawhedi, also an Afghan citizen, awaits trial on charges including conspiracy to provide material support to ISIS and receiving firearms for a terrorist act. Their intended target was not identified, but local, state, and federal law enforcement authorities in Oklahoma directed the case.
“Somebody went to Dan's home and taped a threatening note, a menacing note on his door with personal information,” the whistleblower’s lawyer said.
BEWARE DEEPSEEK: A new report from the House Select Committee on the Chinese Communist Party exposes AI chatbot DeepSeek as “a profound threat to our nation’s security.” The committee’s report, "DeepSeek Unmasked," reveals that the AI app covertly transmits American user data to China via infrastructure linked to China Mobile, a company designated by the U.S. as a Chinese military entity. DeepSeek collects extensive personal data on Americans who use the chatbot, including chat history, device details, and even typing patterns. The report also found that the AI model covertly manipulates outputs to align with Chinese Communist Party propaganda, suppressing topics like democracy and human rights.
NO DONNY, THESE MEN ARE NIHLISTS: Pardon the reference to The Big Lebowski, but we think it’s appropriate given what journalist Ken Klippenstein unearthed in some court documents. The Trump Justice Department has coined a new term for domestic terrorists: Nihilistic Violent Extremists. The FBI defines NVEs as “individuals who engage in criminal conduct within the United States and abroad, in furtherance of political, social, or religious goals that derive primarily from a hatred of society at large and a desire to bring about its collapse by sowing indiscriminate chaos, destruction, and social instability.” The new term was created to replace the Biden administration's post-January 6 focus on anti-government extremism, offering a more neutral-sounding label that shifts attention away from MAGA and white supremacists while avoiding the appearance of targeting anti-Trump groups.
IRAN SPY BUSTED: A former contractor with the Federal Aviation Administration pleaded guilty to secretly acting as an agent for Iran. Abouzar Rahmati of Virginia funneled aviation and solar energy data to Iranian intelligence, including “sensitive access-controlled” FAA files. He met with Iranian operatives, used a cover story to mask his activities, and even hand-delivered stolen data during trips to Iran, the DOJ said. Sentencing is set for August.
TARGETING DISSENT: Former Trump cybersecurity official Chris Krebs is pushing back against what he calls a “novel and expansive” effort by Donald Trump to punish critics, according to The Wall Street Journal. Krebs, who was fired in 2020 from the Cybersecurity and Infrastructure Security Agency after publicly declaring the election secure (i.e., not “stolen”), was recently targeted in a Trump executive order that suspended any of Krebs’ active security clearances and directed the Justice Department to investigate him. Krebs resigned from SentinelOne, a cybersecurity firm, after Trump suspended clearances of all its employees. On the same day, Trump signed a similar executive order targeting Miles Taylor, the former chief of staff at the Department of Homeland Security and prominent Trump critic.
THIN BLUE SPY: A retired NYPD sergeant was sentenced to 18 months in prison for acting as an illegal Chinese agent. Michael McMahon, along with co-defendants Zhu Yong and Congying Zheng, was convicted in June 2023 for harassing and stalking a U.S. resident and his family to coerce their return to China to face corruption charges. Between 2016 and 2019, McMahon was hired as a private investigator and provided sensitive information about the victim’s whereabouts to Chinese officials. His co-defendants pleaded guilty and are awaiting sentencing. (For more on this subject, see Jeff Stein’s 2022 piece, “How Foreign Spies Infiltrate US Police.”)
Michael McMahon: Only 18 months for selling out his country
DISINFO OFFICE DISMANTLED: Secretary of State Marco Rubio announced the closure of the State Department’s office dedicated to countering foreign disinformation, claiming it had been used to “silence and censor” Americans. The Counter Foreign Information Manipulation and Interference office, known as R/FIMI, was a successor to the Global Engagement Center (GEC), which was established under President Obama to combat online extremism and later expanded to address foreign election interference. Rubio told MAGA influencer (and former State Department employee) Mike Benz that he had authorized an investigation into how the program had been used to “deplatform” people from social networks. “We had government-sponsored censorship in the United States through the State Department,” Rubio said. Benz revealed that the closure would eliminate 50 positions and cut $65 million, as the Trump administration moves to scale back efforts to thwart clandestine foreign influence ops across multiple agencies.
DOMESTIC TERRORISM PLAN: The Director of National Intelligence, Tulsi Gabbard, has released the Biden administration’s plan for countering domestic terrorism as part of what she calls an effort to “restore trust” in the U.S. intelligence community. The 15-page plan emphasized the intelligence community’s central role in several priorities, including a push to “illuminate the transnational aspects of domestic terrorism” by analyzing foreign intelligence for links between U.S.-based extremists and overseas actors. The plan also calls for examining how foreign governments and non-state groups use disinformation campaigns to fuel domestic extremism. Another key focus is preventing violent extremists from infiltrating the ranks of the U.S. military and government contractors through better screening and monitoring efforts. While critics on the right are likely to seize on the intelligence focus as government overreach, the reality is hard to ignore: the threat from homegrown extremism remains very real.
NO HAY CARACAS-TREN DE ARAGUA LINK: The National Intelligence Council concluded in a secret assessment this month that Venezuela's government is not directing the Tren de Aragua gang to invade the U.S., contradicting a Trump claim that has been the linchpin of his extreme deportation operations. (The Washington Post)
POCKET LITTER:
Shaun Walker, the British journalist who has extensively covered Russia and Ukraine, has a new book out on Moscow’s agents living in the West, the kind dramatized in The Americans, the riveting espionage TV series featuring a KGB couple living undercover in the Washington suburbs. Writing in the New York Times, Joseph Finder called THE ILLEGALS: Russia’s Most Audacious Spies and Their Century-Long Mission to Infiltrate the West “fascinating and meticulously researched.”
The Sunday Times of London reported that there was "credible intelligence" that superyachts owned by Russian oligarchs had been used before Russia invaded Ukraine to carry out underwater reconnaissance close to the United Kingdom. A number of the superyachts were fitted with "moon pools," or protected openings in the hull of a ship used to access water under the ship. Moon pools can be used to deploy equipment for deep-sea reconnaissance. (via Newsweek)
Richard Armitage, the barrel-chested No. 2 official at the State Department from 2001 to 2005, has died at 79. Armitage later admitted that he was the main source of a 2003 news account that revealed the secret identity of a Central Intelligence Agency operative, Valerie Plame Wilson, shortly after the invasion of Iraq. (NYTimes)
A spokesperson for the European Commission confirmed that it does provide “burner phones” to top officials traveling to the United States, but denied a report that the practice was new and connected to a recent security appraisal of the risks posed by the Trump administration. The Financial Times reported that the EU was issuing burner phones and basic laptops to some US-bound staff to “avoid the risk of espionage,” a measure traditionally reserved for trips to China. (The Record)
FBI Director Kash Patel has been quietly removed as acting director of the Bureau of Alcohol, Tobacco, and Firearms after he stopped showing up for work. He was replaced by Daniel Driscoll, who also holds a second job—Army Secretary. (The Daily Beast)
More than 250 former Mossad officers have signed a statement calling on the Israeli government to ensure the return of the hostages held by Hamas in Gaza, even at the cost of ending the ongoing war against the terror group. The signatories to the letter, which was organized by former top hostage negotiator David Meidan, include ex-Mossad chiefs Danny Yatom, Efraim Halevy, and Tamir Pardo. (Times of Israel)
Jeff Stein contributed to this story.
Is there something we missed? Or something you would like to see more of? Send your tips, corrections, and thoughts to [email protected].
Enjoying Seth Hettena’s SpyWeek? You’re not alone—it’s popular! But you should know that we can only afford to produce it—and other quality reporting—through the financial support of paying subscribers. So how about a free trial?.