Defense One - Threats

After 40 days of combat, Navy destroyer returns home

Jennifer Hlad — Tue, 29 Sep 2026 13:38:00 -0400

JOINT BASE PEARL HARBOR-HICKAM, Hawaii—Some 300 days after leaving Hawaii, the guided-missile destroyer Frank E. Petersen Jr. was welcomed home Monday with delighted cheers, jangling cowbells, handmade posters, and fresh flower leis.

The ship—part of the Abraham Lincoln carrier strike group—did 40 days of combat operations and spent six months in an active combat zone. It started its deployment in December with operations in the South China Sea, but in late January was redirected to the Middle East, shortly before President Donald Trump launched Operation Epic Fury.

The Petersen took part in the war’s initial strikes on Iran, firing Tomahawk missiles at land targets on Feb. 28. Then, as the strike group’s air and missile defense commander, the destroyer warded off more than 100 Iranian missiles and drones launched against its group and other ships in the region.

We made sure that we kept dozens of ships safe against a variety of different attacks—missile attacks, drone attacks,” said Capt. Casey Mahon, the ship’s commander.

The destroyer, commissioned in 2022, sailed more than 85,000 nautical miles during the deployment and conducted 45 replenishments at sea. At one point, the ship spent 106 days at sea between port calls, Mahon said.

It also was the first ship to enter the Strait of Hormuz after the end of major combat operations, he said, which was “quite a voyage.”

“Obviously there was stress we had to face when we did that…on the sea, under the sea, and in the air.”

Though some of the adversary technology the crew faced was new, he said, “air defense really hasn’t changed a lot of ways since World War II: You have a radar, you find the thing, you’ve got to track it.” Still, “how these things fly, how they do their missions are very different, and so the crew showed a lot of adaptability to that,” and the ship’s systems were also “very effective in that adaptability.”

The Petersen learned lessons both in “how to stay at sea for a long time” and in how to defend against new tactics, Mahon said, and has passed on those lessons to other ships that are in the region now.

“Like any good Navy ship, you know, you’re ready for that next mission,” Mahon said. “It wasn’t what we expected to happen on deployment, but for the crew, you know, whether you’re in the north Arabian Sea or the South China Sea, you’re at sea, and so we do the operations that we’re directed to do.”

Clutching ti leaf lei as she waited on the pier with her two children, Alysha Nishikawa said she was worried at times during the deployment, but she tried to “throw out positive energy” to her husband and reassure him that they were OK so he could continue to do his job.

Petty Officer 1st Class Ryhean Tucker, who was one of the first sailors to reunite with his family as the recipient of the “first kiss,” said the deployment was “stressful” and challenging. His wife, Taylor Tucker, said it was also challenging for her, taking care of their two children and moving from Virginia to Hawaii.

“It was a big job, but we did it,” she said.

]]>

Hegseth orders cyber, intelligence agencies to prioritize election defense

David DiMolfetta — Mon, 28 Sep 2026 18:15:00 -0400

Defense Secretary Pete Hegseth directed U.S. Cyber Command and military intelligence agencies to prioritize countering foreign threats to the upcoming elections, ordering intelligence collection and coordination with the Department of Homeland Security.

The Sept. 22 memorandum was released publicly Monday and instructs the defense intelligence enterprise to gather and analyze information on foreign election threats. It separately directs Cyber Command to use its existing authorities and capabilities to counter potential cyberattacks by foreign actors targeting the elections.

“I am therefore directing the entire [Defense Intelligence Enterprise] to mobilize every authorized asset, capability, and partnership under your command to defend our election infrastructure from foreign malign influence,” Hegseth wrote.

The memo is addressed to the leaders of Cyber Command, the National Security Agency, the Defense Intelligence Agency and the National Geospatial-Intelligence Agency. It calls protecting elections a “no-fail mission,” but does not identify particular adversaries or operations, specify additional staffing or funding, or set implementation deadlines.

The directive notably comes amid a broader retreat from dedicated federal efforts to track foreign influence and disinformation. The second Trump administration has dismantled the FBI’s Foreign Influence Task Force, reorganized the intelligence community’s coordination of that work and reduced election security support at the Cybersecurity and Infrastructure Security Agency.

At the Office of the Director of National Intelligence, an overhaul shifted many responsibilities of the Foreign Malign Influence Center to other offices. ODNI has subsequently assigned two officials to coordinate election threat intelligence.

Foreign election threats can range from attacks on voting-related computer systems to campaigns intended to manipulate public opinion.

The NSA collects foreign signals intelligence, including intercepted communications, to understand adversaries’ plans and capabilities, while also helping protect sensitive U.S. systems. Cyber Command conducts military cyber operations, including missions to disrupt foreign hackers and the infrastructure they use.

The organizations have previously combined those capabilities through a joint Election Security Group. In a description of its work during the 2022 midterms, NSA explained that intelligence about an attack originating abroad could be shared with domestic agencies to help them defend against it, while Cyber Command could use offensive operations to disrupt the foreign attacker.

Hegseth’s memo does not specify whether the same organizational model will be used this year. It directs intelligence work to comply with applicable laws and policies and tells Cyber Command to operate under its existing authorities.

The directive also emphasizes cooperation with DHS as that agency’s civilian cyberdefense agency outlines how it will assist election officials following staffing and program reductions.

Two days after Hegseth signed the memo, CISA—housed within DHS—released an election security plan identifying its 10 regional directors as election security advisers and describing a free threat-sharing platform connecting election officials, state intelligence hubs and federal partners. That plan followed warnings from state officials that earlier cuts had weakened their access to federal security expertise.

The 2026 elections come as rapid advances in AI allow foreign influence operators to automate more of their work. Such capabilities could let adversaries run larger campaigns with fewer people, adding to the challenge of identifying coordinated manipulation ahead of the midterms.

]]>

Anthropic loses legal fight to shed DOD's designation as a 'supply-chain risk'

John Croxton — Fri, 25 Sep 2026 17:57:36 -0400

Anthropic will remain a Pentagon-designated supply-chain risk, thanks to federal judges who ruled that the Defense Department can prohibit its employees and contractors from using the AI company's products for DOD business.

The designation has been in force since March, when the department sought to alter its contract with Anthropic to replace prohibitions on using its tools for domestic mass surveillance and fully autonomous weapons with allowances for “all lawful use."

The department has used two statutory justifications for labeling Anthropic a supply-chain risk, a designation typically applied to firms suspected to be working for adversarial governments. Anthropic beat back one of the justifications in an August ruling in the Northern District of California, but did not prevail in a lawsuit heard by the D.C. Circuit Court of Appeals.

Friday's ruling was issued by Judges Gregory Katsas and Neomi Rao, both appointed during the first Trump administration, with a dissent by Judge Karen LeCraft Henderson, who was appointed by the first President Bush.

“This was not an unexpected outcome given the composition of the panel that heard the case” said Charlie Bullock, senior research fellow at the Institute for Law & AI think tank. “Historically, both Katsas and Rao have shown a great deal of deference to the Trump administration's assertions of executive authority on matters of national security. If Anthropic had drawn almost any other two judges from the D.C. Circuit for that panel they would have stood a good chance of winning, because I think their legal position is overwhelmingly strong.”

“I think Anthropic’s chances on appeal if they get to appeal either to the en banc D.C. Circuit or the Supreme Court are good. But they’re not guaranteed to be heard, because the appeals process is discretionary,” Bullock said.

In a statement to The Washington Sun, an Anthropic spokesperson said, “We respectfully disagree with the court’s decision. Another federal court has already held the government’s parallel designation unlawful.”

Anthropic added, “We remain confident in our position and are considering all options, including further review.”

Defense Undersecretary Emil Michael wrote in a statement on X, “The hammer of justice has smashed @AnthropicAI arguments. They are a supply-chain risk to the defense industrial base serving the @DeptofWar. Warfighters will sleep better knowing that no private company will insert their opinions in the chain of command. @SecWar was right!”

The ruling will likely keep the Pentagon and its other contractors reducing their use of Anthropic's products, such as its Claude tools. Overall, however, the company's revenue is growing about tenfold per year, and plans an IPO in November that some expect to value the company at a record $2 trillion.

Michael and Defense Secretary Pete Hegseth have been critical of Anthropic in public statements. In January, Hegseth stated in remarks at a SpaceX event, “Department of War AI will not be woke. It will work for us. We're building war-ready weapons and systems, not chatbots for an Ivy League faculty lounge.”

DOD issued an ultimatum on Feb. 24 demanding the company permit its AI to be used for all legal purposes by Feb. 27, which Anthropic refused. Hegseth announced his direction that DOD designate Anthropic a supply-chain risk Feb. 27, and it was formally announced on March 3.

]]>

Stolen FBI data reveals employees’ roles in intelligence and surveillance

David DiMolfetta — Wed, 23 Sep 2026 23:33:00 -0400

Data stolen in a major hacking group’s alleged intrusion into FBI systems is believed to contain personal information on hundreds of FBI intelligence analysts and other employees involved in clandestine intelligence-gathering and surveillance, according to two people familiar with the matter.

The analysts focus on myriad subject areas like Russia, China, Hezbollah, and cartel-related intelligence, said the people, who spoke on the condition of anonymity because the exposures are sensitive. The employees’ roles only offer a small picture of their duties, but may still help outsiders identify people working in sensitive parts of the bureau.

ShinyHunters claimed responsibility for the breach Monday, threatening to release what it described as two to three terabytes of FBI employee data unless the bureau retracted a public warning about its tactics within a week.

On Tuesday, the group sent Nextgov/FCW and other news outlets an apparent sample of that data containing roughly 5,000 entries listing employees’ names, home addresses, phone numbers and information about their spouses and siblings.

Multiple individuals also work on human intelligence-gathering, as well as roles involving electronic surveillance activities that make use of telecom interception techniques and other covert access mechanisms. Some employees work in the FBI’s Remote Operations Unit, which builds specialized tools to target computers and networks.

One person works in the bureau’s FISA Management Unit, which handles the processing of applications and renewals under the Foreign Intelligence Surveillance Act that governs surveillance and search standards used to collect foreign intelligence.

The FBI said it was aware of “a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information” and added that it is investigating the matter.

The agency said the cause of the breach was still undetermined. ShinyHunters previously said it exploited vulnerabilities in Amazon and Oracle services to access the bureau data. Neither company has returned a request for comment.

Reuters and 404 Media previously reported details regarding the intelligence roles and the ROU staff.

The language ShinyHunters wants removed appears in a May 15 FBI public service announcement that describes practices the hacking group contests. The group has built a global reputation for various hacking achievements. In May, it claimed responsibility for accessing Canvas, the popular education tech platform used by thousands of U.S. institutions.

The direct claim of an FBI breach is “an unusually provocative move” and should be taken seriously, said Etay Maor, the vice president of threat intelligence at Cato Networks.

Exposure of sensitive bureau staffing data could pose profound counterintelligence risks. For employees who do not publicly identify themselves as working for the FBI, the exposure could reveal both their jobs and how to reach them outside secure work environments. Linking that information to home addresses and relatives’ details could make it easier for nation-state groups and cyber criminals to target employees and their families with harassment, scams or threats.

The breach would be “troubling news” for both FBI employees and applicants, said Doc McConnell, a former cyber policy official at the White House and the Cybersecurity and Infrastructure Security Agency.

McConnell, who now heads policy and compliance at Finite State, compared the incident to the OPM hack a decade ago.

“The breach of OPM’s personnel records in 2015 resulted in a decade of credit monitoring for millions of affected individuals, and the full counterintelligence impact will likely never be known. This breach appears to contain similar data, creating potential security concerns for the victims if it is made publicly available,” he said.

The bureau will likely work more assertively to crack down on ShinyHunters. When any group directly targets the agency, “they should expect that the FBI is going to marshal additional resources to bring them more quickly to justice,” said Cynthia Kaiser, the SVP of Halcyon’s Ransomware Research Center and former deputy director of the FBI’s Cyber Division.

The incident follows other cyberattacks involving the bureau and its leadership this year. In March, pro-Iran hacking group Handala published material from FBI Director Kash Patel’s personal email account, which the bureau said contained historical information unrelated to government business. Separately, a suspected China-linked intrusion into an FBI system exposed surveillance targets’ phone numbers.

]]>

Trump's FBI shut down investigation into defense contractor's alleged bribes

Kirsten Berg, Molly Redden, Avi Asher-Schapiro, and William Turton, ProPublica — Tue, 22 Sep 2026 13:38:39 -0400

In the final weeks of 2019, a top fundraiser for Sen. Susan Collins walked into a perilous meeting at a Corner Bakery in Washington, D.C.

For the first time in her two-decade Senate career, the Republican lawmaker from Maine was in danger of losing her seat. President Donald Trump’s dismal approval ratings were dragging her down in the polls, and she was falling behind her likely 2020 Democratic challenger in fundraising.

Scott Reed, head of the Collins super PAC, was on a mission to close that gap. Reed was meeting that day with three executives from a Hawaiian defense contractor, Navatek. A year earlier, Collins had helped their company land a multimillion-dollar Navy research contract in Maine. Now, seated at a coffee shop not far from the U.S. Capitol, Reed asked them for a $500,000 donation.

Government contractors are banned from making political contributions. More consequentially, for the company to offer donations to Collins in exchange for an official action, or for Collins to accept, would constitute criminal bribery.

But the company did have such a proposal: Navatek was hungry for more government contracts in Maine. If they cut a big check, the CEO told Reed, Navatek wanted Collins to guarantee tens of millions of dollars in additional federal funding.

To skirt campaign finance laws and conceal the source of the funds, Navatek planned to funnel the donation through a shell company. The CEO wanted assurance that Collins would know where the money came from. Reed confirmed that she would, the executive said — and that Navatek would get its government contracts.

After the Corner Bakery meeting, Navatek’s CEO, Martin Kao, sent an initial $150,000 to the Collins super PAC using the shell company. Two months later, he told Navatek executives that Collins committed to getting the company $32 million in naval contracts, according to an internal company email reviewed by ProPublica.

Three years later, Kao holed up in a conference room to recount the Corner Bakery meeting to a group of four FBI agents and federal prosecutors. The FBI had seen through his shell company ruse, and in 2022 a grand jury indicted him for making illegal campaign contributions. No one working for Collins was charged.

Facing years in prison, Kao hoped to do less time by revealing the entire scheme.

What he told them has never before become public. The Corner Bakery meeting, he asserted, was just one episode in a sprawling pay-to-play operation that embroiled some of the most powerful figures in Congress.

Over three days at the U.S. attorney’s office in Honolulu, Kao laid out in devastating detail how his operation worked. He gave agents a 50-page document naming dozens of lobbyists, congressional staffers and members of Congress who he said helped him trade cash for contracts. Kao and his close associates had donated nearly $900,000 to dozens of politicians, allowing Navatek to establish operations in half a dozen states with over $40 million a year in government funding.

Most damningly, Kao told FBI agents and prosecutors, the company’s work for the government was of no real value. Navatek’s research under his stewardship never resulted in products the military wanted to buy, ProPublica found.

Kao’s tell-all interviews with the FBI lasted into late 2024. His confessions opened up an entirely new phase of the investigation. Agents sifted through hundreds of thousands of records seized during Kao’s arrest and found that many were consistent with his account of widespread influence peddling.

Kao had credibility issues. He was now a felon trying to avoid a lengthy prison sentence. And there were other challenges. Building a corruption case against elected officials requires extraordinary proof of a quid pro quo arrangement, in part because the Supreme Court has narrowed what counts as bribery.

Even so, by the end of 2024, the agents had enough evidence to pursue a sweeping bribery probe that could ensnare top lawmakers of both political parties. They asked their supervisors to approve a new investigation and contemplated using undercover operatives to gather more evidence. Although their effort was in its early stages, and it was unclear where it would lead, FBI agents asked Kao extensive questions about his dealings with Collins and her office.

Then Trump returned to the White House. Consumed by a campaign of vengeance, he stacked the Department of Justice with his personal lawyers and demanded a purge of anyone who had ever investigated him.

The specialized FBI and DOJ teams handling public corruption investigations, some of which were involved in Trump-related cases, were eviscerated. One of the agents who had taken Kao’s confession was pushed out as retribution for her role in investigating Trump’s attempt to overturn the 2020 election. Dozens of agents and prosecutors quit amid the department’s destruction, including the career attorney assigned to Kao’s case.

Trump’s Justice Department no longer takes on public corruption in any meaningful fashion, former officials said. The investigation sparked by Kao’s revelations is dead. And the government is no longer talking to an informant who had offered a road map to corruption in Congress.

The White House referred ProPublica to the FBI.

FBI spokesperson Ben Williamson said the agency had investigated claims against Collins years ago “and ultimately found nothing implicating Senator Collins or Senator Collins’ campaign. Any suggestion otherwise is totally false.” Williamson said the Trump administration has removed agents only “if they have been found to have acted unethically, undermined the mission, or engaged in weaponization of law enforcement.”

Williamson did not respond to questions about the new investigation launched in 2024 based on Kao’s previously unreported cooperation with the FBI.

ProPublica is revealing the existence of the case for the first time. We reviewed a trove of evidence gathered by the FBI and thousands of pages of legal records, and interviewed dozens of people familiar with Navatek, its Washington operations, and the FBI inquiry to conduct our own investigation. We independently corroborated much of Kao’s account. Whether or not Kao’s dealings with politicians amount to criminal bribery, the Trump Justice Department has little interest in finding out, and his sheer success reveals how easily influence is purchased in Washington today. This is the first in a series of stories drawn from our reporting.

Of all the politicians Navatek courted under Kao’s leadership, Collins was its most important patron. The senator’s office steered government contracts worth millions toward the company while her campaign was pumping Kao and his network for donations, according to emails seen by ProPublica. Sometimes they cut checks within 24 hours of the annual defense spending bill, which funds military contracts, clearing a key Senate hurdle.

Collins’ office did not specifically address questions about the Corner Bakery meeting, the senator’s relationship with Kao and the millions she helped appropriate for Navatek.

Annie Clark, Collins’ deputy chief of staff, told ProPublica in an email that Collins’ office “vigorously” denies allegations of bribery and pay-for-play made by Kao, calling his claims “outlandish.” Collins’ campaign was not part of the discussions between Kao and the super PAC, and her office “fully cooperated” with the FBI investigation, Clark said.

“The fact that the FBI and Biden-led Department of Justice thoroughly examined the Navatek matter demonstrates this,” Clark wrote. “These issues were resolved in 2021 and concluded when the Collins campaign disgorged the illegal contributions that Martin Kao had made without our knowledge.”

Collins is once again fighting to keep her seat, in a race that could determine control of the Senate. On the campaign trail, she spotlights the funding she directs to Maine while leading the appropriations committee, which she calls “the most powerful committee in the Senate.”

She demonstrated that power with Navatek. After the budgets became law, Collins’ office pushed the Navy to award specific contracts to Navatek, emails seen by ProPublica show, even though awards are supposed to be competitive.

“I spoke with Sen. Collins office regarding the $8M,” a naval official wrote in an email on Feb. 6, 2019. “The interested company is Navatek.”

In a meeting with Collins and two campaign officials, Kao said, the officials told him the senator expected his ongoing support. Collins told him: “You’ve seen me deliver,” Kao said.

Reed knew Kao was behind the $150,000 anonymous donation, emails showed, because Kao told Reed he planned to donate through a shell company. “Very smart,” Reed replied in an email viewed by ProPublica.

Reed did not respond to detailed questions about the Corner Bakery meeting, the $150,000 donation and Kao’s allegations. “I understand Martin Kao is now sitting in federal prison,” Reed wrote in a brief email. “I never had any communications with Senator Collins [or] her staff about Martin Kao and/or Navatek.”

But an email seen by ProPublica suggests that someone must have relayed the news of Kao’s donation to Collins, just like Reed promised to do in Kao’s recounting of the Corner Bakery meeting.

Seven days after the super PAC cashed the check from Kao’s shell company, one of Reed’s subordinates emailed a Navatek lobbyist asking for Kao’s phone number: “Senator Collins would like to call Martin to thank him.”

The Navatek Method

Before Kao’s doomed reign as CEO, Navatek was a sleepy Hawaiian engineering company with a few dozen employees. It was founded in 1978 by Steven Loui, a talented engineer and scion of a powerful Hawaiian shipping family. Navatek was not a profit center but a vehicle for Loui’s passion projects, like an experimental catamaran for navigating Hawaii’s choppy waters.

The company benefited from the largesse of the legendary Hawaii Sen. Daniel Inouye, multiple former Navatek executives and employees said, whose family had been close to the Loui family for generations. Inouye was a master of earmarks, a practice that allowed lawmakers to insert funding for specific companies by name in the federal budget. The self-styled “King of Pork” steered hundreds of millions in federal dollars to Hawaii. Former Navatek employees say he was affectionately referred to as “Uncle Dan.” “Before Inouye took an interest, Congress didn’t even know our companies existed,” a longtime Loui lieutenant wrote in a 1998 op-ed.

In response to ProPublica questions, Loui said that money appropriated by Inouye made up “a minority” of Navatek’s revenue.

Inouye’s death in 2012 made the company’s future uncertain. Not only was Navatek’s direct line to Capitol Hill gone, but Congress was doing away with the abuse-riddled earmark process. Now companies would nominally have to compete on the merits for government contracts.

Kao joined Navatek in 2008 as its chief financial officer. Loui charged him with replacing Navatek’s rainmaker and eventually named Kao CEO. He sold Kao the company in return for a share of the profits.

Kao was an unusual figure among the company’s low-key naval engineers and boat aficionados. He seemed to be aping a Wall Street tycoon, telling employees they could either be “a beast or a bitch,” a former executive said. He drove to work in a Ferrari and abruptly fired subordinates who displeased him — one time, in the middle of the night. “He had very little interest in the technology,” one former employee recalled. “Martin was only interested in dollar signs.”

Kao also exaggerated and lied. He told different people he had stepbrothers whose parents died in a fishing accident or an avalanche, a former employee recalled. He lied to Loui about having law degrees from both the University of California, Los Angeles and New York University. He once told a lobbyist who raised quarter horses that he owned a herd of polo ponies, just to one-up him.

Despite his erratic behavior, former employees agree Kao hit upon an effective way to replace the lost earmarks. If the company could not rely on a benefactor like Inouye, it would develop a stable of them.

Navatek targeted the powerful members who sat on the House and Senate appropriations committees. These members could no longer earmark money for specific military contractors. But they retained the power to budget millions of dollars for equipment or bespoke research and development. Because Pentagon budgets run thousands of pages and are largely prepared in secret, it is easy for appropriators to add a line item intended for a contractor like Navatek without leaving any fingerprints.

Soon, Kao had refined a playbook. Navatek would concoct a research project in partnership with a university in a member’s district or home state, and Kao would make a large initial campaign donation. Working with a team of pricey, well-connected lobbyists, Navatek would get meetings on Capitol Hill to pitch the research to congressional staff. Navatek kept spreadsheets, reviewed by ProPublica, that listed members of Congress as the “specialty” of certain lobbyists.

Separately, Kao later told the FBI, there would be a meeting of just the key players. One engineer, who traveled with Kao to D.C. to explain the technical side of a project, recalled being sent out of the room once the subject of money came up. Sometimes in these smaller meetings, members of Congress directly asked Kao for donations, he told the FBI. In other cases, he said, Navatek’s lobbyists would relay a request from an intermediary for a specific dollar amount.

Kao told the FBI that the lawmakers, lobbyists and Navatek brass understood these donations were bribes and that the payments were essential to the entire scheme. Kao believed he was buying Navatek’s way into the annual defense budget, not winning over members with innovative engineering proposals.

“I’m not red or blue, I’m green,” he would tell congressional staffers, a former Navatek employee recalled.

While a deal was being struck, Navatek and congressional staffers worked closely on the legislative process. Every year, Congress prefaces the defense budget with massive reports describing the purpose of inscrutable line items. Staffers would include a project description so specific that Navatek would be the only logical pick.

Often, Navatek composed language that ended up, word for word, in Senate funding requests, former employees said. In 2019, for example, Navatek’s priorities were tucked into page 185 of the 307-page report released by the Senate Appropriations Committee. The committee set aside $21.5 million for “hybrid composite structures research for enhanced mobility,” “electric propulsion for military craft and advanced planing hulls” and a “test bed for autonomous ship systems.” Although Navatek’s name does not appear on the page, these were all projects the company requested, according to internal documents and interviews with former employees.

Once the budget passed, lawmakers’ staff leaned on Navy officials to award Navatek the money. Former contracting officers told ProPublica they felt pressure to go along because money from those contracts funded their office — and because members of Congress had confronted dissenting naval officials in the past. “There’s only so many battles you can fight,” one said. So Congress sometimes got its way even when Navatek’s projects made little sense.

Inside Navatek, employees referred to this strategy as “the method.” And it enabled the company to string together tens of millions of dollars in contracts. The result was the same as getting earmarks: a reliable, growing revenue stream bankrolled by U.S. taxpayers.

“It was a simple enough play. Let’s find the small states that have complementary universities … [and] let’s get access to their senators,” Eric Schiff, a former Navatek executive, told ProPublica. “I’ve met Susan Collins. You can get access to Susan Collins. Once we got the first things working with Maine, then we said, ‘Well, let’s keep reaching.’ And so we did.”

In a statement to ProPublica, Navatek founder Loui said Kao’s “unethical and illegal method of winning contracts” was a departure from how he operated the company prior to Kao’s ownership.

Kao boosted Navatek’s annual revenue from $10 million around the time Loui sold him the company to almost $40 million when he was arrested in 2020. In the second half of 2019 alone, Navatek paid a roster of five lobbying shops more than $500,000.

Even Navatek’s executives were surprised at how far their money went in D.C. “It was eye-opening for me, frankly. ‘Oh my God, all of it is for sale. It’s all for sale,’” Schiff said.

The key players in Kao’s pay-to-play deals went to great lengths to meet in person and leave no trace of an actual quid pro quo, he told agents. “That is why I literally had to fly to D.C. almost every week,” Kao later told the FBI. “Sometimes for a 15-minute meeting.”

But the FBI compiled emails, which ProPublica reviewed, that were suggestive of illegal bargains. Navatek executives and lobbyists spoke openly as if they were buying lawmakers’ assistance. In one back-and-forth, a lobbyist and a company executive described another senator as “fundamentally transactional” and having “a reputation as a pay-to-play office.”

In another message, Andy Winer, who former executives said was Navatek’s chief strategist, reminded Kao to budget money for political contributions based on how much the company wanted in congressional funding the following year.

Winer was his guide to the political underbelly, Kao said. A consummate insider, Winer had parlayed six years as chief of staff to Democratic Sen. Brian Schatz of Hawaii into a lucrative lobbying career with a firm called Strategies 360. One of Winer’s former colleagues compared him to the slick lobbyist on the Netflix show “House of Cards” who toggles between the political and corporate worlds.

In another email exchange scrutinized by the FBI, Kao asked Winer about making a $5,600 donation to nudge along a senator who seemed keen to work with Navatek: “Would that ‘help?’”

Winer, who had already donated himself, replied, “With my contribution, I think it sends the right message.” He suggested Kao split up his donation to be “less conspicuous.”

The method didn’t always work. Once, Kao complained that a senator had reneged on a deal and he ought to get his donations back.

“You should not feel aggrieved nor should you ever put that in writing,” Todd Webster, another lobbyist Navatek hired, replied. Webster did not respond to detailed questions.

Winer said he stopped working with Navatek following Kao’s arrest. “The political contributions I discussed with Kao were understood by me to be lawful political contributions. I never participated in, witnessed, or had knowledge of any illegal political contribution, bribe, or agreement to exchange a political contribution for an appropriation, contract, or other official action,” Winer said in an email to ProPublica. “I never advised Kao to make a contribution in exchange for official action.”

Strategies 360 has new ownership that did not oversee Winer while he represented Navatek, its CEO, John Oceguera, said.

Navatek employees began to notice members of Congress visiting their East Coast offices. “You would be like, ‘Oh, there’s this senator walking around,’ and we would get a picture with them,” one engineer recalled.

While some projects involved potentially meaningful research, Navatek’s bread and butter was R&D that went nowhere. As a slideshow prepared by an executive explained, “We thrive in the valley of death,” the term for the bureaucratic gap where research languishes without being developed into a product. The slideshow noted that none of the technology had ever actually been deployed.

The Office of Naval Research did not respond to a request for comment.

In Maine, Navatek was studying ways to modify small boats to reduce the “slamming” impact felt by passengers at high speeds. With the help of the University of Maine’s giant 3D printer, Navatek made a prototype and unveiled it at a press conference where a Guinness World Records representative declared it the world’s largest 3D-printed boat. But Navatek executives knew the Navy had no plans to use the new design, former employees said.

“[The work] got rolled into a few PowerPoint slides and a white paper, and that was the deliverable,” recalled one who worked on the project. “The boats weren’t delivered to the Navy — the Navy didn’t even want them.”

Kao to Collins: “Here to Help”

The first time Kao came face-to-face with Collins, in 2018, he told the FBI, he had to pay for the privilege.

Collins would not meet unless he agreed to donate to her campaign, he said. While it is not illegal for politicians to exchange face time for contributions — in this case, just a few thousand dollars — it was not the last time Collins would seek Kao’s support.

Navatek had been eager to expand beyond Hawaii, and Maine was a perfect beachhead — a small, coastal state hungry for high-tech jobs that happened to be represented by a senior member of the Senate Appropriations Committee. Collins, more than most appropriators, likes to trumpet the dollars she brings home.

To work with Collins, Navatek hired a lobbyist, Glen Mandigo, who also lobbied for the University of Maine and was tight with her office. Mandigo asked how much Navatek wanted in funding and how much Kao was willing to support Collins, Kao told the FBI. The University of Maine did not reply to a request for comment.

In that first meeting with Collins and her staff, Kao pitched an $8 million boat hull research project for Navatek and the university. Collins seemed supportive. Not long after, Mandigo called Kao and said Collins wanted him to bundle tens of thousands of dollars for her reelection, suggesting Navatek throw a fundraiser, Kao said.

In an email to ProPublica, Mandigo denied taking part in a pay-to-play arrangement.

“I did not advise Navatek officials, nor would I advise any client, that support from Sen. Collins was contingent on campaign donations,” Mandigo wrote. He said that in his 25 years of working with Collins and the Maine delegation, “I never saw or heard of such behavior from the Senator or her staff.” Clark, Collins’ deputy chief of staff, told ProPublica it was “wholly inaccurate” to say Mandigo was close to their office.

FBI agents had collected voluminous corporate records and email correspondence between Navatek and Collins’ inner circle. Much of that evidence aligned with the story they were now getting directly from Kao.

The FBI had spotted his out-of-the-blue donations in the summer of 2018, just before Collins included $8 million for Navatek’s proposal in the defense budget. Emails showed her staff made it clear to the Navy that it should send the money to Navatek. FBI agents also had evidence of Kao and Mandigo planning a fundraiser starting in April 2019. Their emails — with her scheduler and her campaign’s finance director — freely mixed talk of Navatek’s Collins-backed contract with plans to raise money for her.

The principals settled on hosting Collins for a publicity event at Navatek’s Maine headquarters in August 2019, where she posed for pictures with Kao and a model of the company’s experimental boat. Behind the scenes, the FBI saw in emails and company records, Kao orchestrated over $40,000 in donations from extended family in advance of the event. To avoid the legal cap on individual campaign contributions, the emails show, he told Collins’ team to reallocate his excess contributions to his father — which an agent highlighted and noted is against election law in a presentation to prosecutors — and sent them his father’s full name and address.

“This is perfect,” Amy Abbott, the reelection campaign finance director, emailed Kao after discussing his father’s contribution. “We are so grateful for ALL the Kao support!”

Before the event, Kao said, Collins, Abbott and another staffer met with him in private. One of the staffers told Kao the campaign expected more donations. It was in this meeting that Collins said, “You’ve seen me deliver,” he told the FBI.

Less than one month after the event, the Senate released a draft of the defense budget containing $21.5 million for Navatek’s pet projects in Maine. Kao emailed a Collins campaign fundraiser — who would in theory have nothing to do with a government contract — four days later, saying, “Thanks again for all the support from Sen Collins.”

“I’ve been involved in many tight races in the past and understand last minute ‘needs’ come up,” he continued. “We are here to help anyway we can … financially or whatever.”

Kao’s desire to donate even more money led to the fateful Corner Bakery meeting with the head of the Collins super PAC, called the 1820 PAC, Kao told the FBI. Unlike Collins’ campaign, which could accept only $5,600 per election from individuals, the super PAC could accept unlimited contributions.

The super PAC emailed Kao a memo before the meeting stressing the need to raise money with “urgency.” At the meeting, Kao and Reed, the super PAC’s chair, hammered out a deal for a six-figure donation, Kao told the FBI. Over email, Kao informed Reed of his shell company scheme, saying he had cleared it with his lawyer. “They are super vague and very difficult to get any background info on,” Kao reassured him. “Thanks for doing this,” Reed replied.

Emails

Here are quotes from emails between Martin Kao and Scott Reed, discussing contributions to the Susan Collins Super PAC, 1820 PAC:

“Hi Scott: Had a chance to discuss 1820 with my CFO and attorney last night. They are suggesting setting up a separate new LLC to make the donations. Name of new LLC: Society of Young Women Scientists and Engineers. In my personal real estate investments, we often use LLCs that can be set up to “facilitate” transactions. They are super vague and very difficult to get any background info on. Totally legal and typically used in real estate transactions to conceal the identity of buyer/seller. Wanted to get your thoughts/concerns.”—email from Martin Kao to Scott Reed, Nov. 22, 2019

“Very smart and glad your counsel understands. Thanks for doing this.”—email from Scott Reed to Martin Kao, Nov. 22, 2019

“Great! We will proceed on getting this set up ASAP. Have a nice weekend.”—email from Martin Kao to Scott Reed, Nov. 22, 2019

The FBI spoke to the other Navatek executives at Corner Bakery, who confirmed the meeting took place. One of them, David Kring, the company’s top scientist, told ProPublica he had no memory of what was discussed.

The other, Duke Hartman, told an FBI agent it was just “a get-to-know-you meeting” with the chair of the super PAC and they did not discuss the “particulars of a donation.” Agents, records show, came to believe Hartman was lying about his role in Kao’s pay-to-play operation and would name him as a formal subject of a future investigation. Hartman was not charged. He did not respond to a detailed request for comment.

A few weeks after the $150,000 check to the Collins super PAC cleared, in February 2020, Kao and his team met with Collins’ office and secured a new round of funding.

“We were very warmly received,” Kao reported to his colleagues in an email obtained by the FBI. “Excellent meeting. Total of $32M will be supported.” Records show the Senate allocated at least $10 million that year based on Navatek’s proposals.

Navatek’s ambitions peaked in mid-2020. As the company waited to see if Collins would survive her reelection campaign, executives prepared to ask their champion on the appropriations committee for even more funding the following spring, internal documents show.

Other documents from that time show the company was courting senators from seven additional states and gunning for more than $200 million in new appropriations. Navatek expected to have offices in more than a dozen states by the end of the following year, including a new 15,000-square-foot facility in the Portland, Maine, harbor.

Kao, meanwhile, closed on a $4.5 million beachside home in an exclusive Honolulu neighborhood; the backyard pool had a waterfall feature. He renamed the company Martin Defense Group after himself, joking that it would simplify his future takeover of Lockheed Martin.

“It was working well, and it would have continued to work well,” said Schiff, the former executive. “Martin got greedy. Just got damn greedy.”

Downfall, Cover-up

In early 2020, the Campaign Legal Center, a nonprofit good government group, noticed something strange in the public filings for the Collins super PAC. The PAC had received a $150,000 donation from a newly created LLC with a typo in its name: the Society of Young Women Scientist and Engineers, with no S at the end of “Scientist.”

This was the $150,000 Kao donated after the Corner Bakery meeting. The money had come from Navatek’s account, not Kao’s, violating a ban on government contractors making donations.

The center suspected the society was not a real group but a pass-through to hide the identity of a major political donor. It filed a complaint with the Federal Election Commission. It took only a few days for a Hawaii journalist to discover Kao’s wife’s name on the society’s paperwork, linking the shell company to Navatek.

Inside Navatek, Kao shifted into damage control mode. He spoke to Reed and the super PAC’s lawyer, Cleta Mitchell, and began to hatch a cover-up. In an email released in civil litigation, Mitchell suggested the society make charitable donations — preferably in Maine — which would make it seem like a legitimate nonprofit. “I want to be sure that the LLC proceeds with the ideas we discussed — giving scholarships and recognition to women in engineering, etc.,” wrote Mitchell. “That would help both of us, I think.”

Mitchell added, “We should develop a plan and timetable, so there are some scholarships given over the next several months, and particularly, perhaps in Maine, where the bad press was.”

Mitchell, who later played a major role in Trump’s attempts to overturn the results of the 2020 election, did not respond to requests for comment.

Kao and his team settled on donating scholarships to women in STEM. They offered between $5,000 and $25,000 apiece to state universities where they were angling to win government contracts — that way, the cover-up would benefit them politically, too.

But Navatek’s and Kao’s problems were just beginning. Undeterred by scrutiny from the FEC, Kao defrauded the COVID-era Paycheck Protection Program newly passed by Congress. He inflated Navatek’s payroll to amass loans of $13 million, according to a federal indictment. The Navatek founder, Loui, had long since soured on his chosen successor. This was the final straw. He reported Kao to federal authorities.

“This is not how Navatek behaved or conducted business before I sold the company to Martin Kao,” Loui wrote to ProPublica. He said Navatek was successful before Kao’s ownership and had many sources of government funding. After Kao’s arrest, he added, the company fully cooperated with law enforcement.

Loui has since regained control of the company and renamed it PacMar. He is dedicated to restoring its reputation and ability to execute government contracts, he continued. Loui said he fired employees hired during Kao’s tenure who were “not capable of performing quality, professional engineering and science tasks.”

“The company received no Collins-supported funding after Martin Kao’s arrest, nor should it,” Loui added. “What Martin Kao and his cabal did was wrong.”

On Sept. 30, 2020, law enforcement raided Navatek’s Honolulu offices and arrested Kao for fraud. Federal agents in windbreakers seized his laptop and ordered the company’s IT staff to copy the company’s internal servers.

Navatek’s public flameout attracted the attention of Michelle Ball and Kevin Gounaud, two experienced agents in the FBI’s elite anti-corruption unit. Gounaud was a 20-year FBI veteran who had worked on elaborate undercover operations. Ball had made a name for herself taking on politically sensitive cases. In 2018, she led the investigation into Maria Butina, the Russian agent convicted of infiltratingthe National Rifle Association in an attempt to influence the Trump campaign.

The agents began digging through thousands of records for details of Navatek’s lobbying operation, donation strategy and ties to politicians.

They zeroed in on Kao’s relationship with Collins. In a 60-slide presentation agents prepared for prosecutors, they highlighted contributions that Kao and his wife made to the senator in 2018, right before Collins placed the $8 million in research funding into the federal budget. Kao had also given Navatek money to various relatives to donate to Collins in 2019, sending her around $33,000 through these illegal straw donors, the indictment said. Kao’s wife and father did not reply to requests for comment.

The government charged Kao in two separate cases: one for defrauding the loan program and another for his campaign finance crimes. His love of talking like a wheeler-dealer — including over email — was a gift to investigators. In one email, he all but admitted the scholarships to young women were a diversion. “Whatever… just a pack of bitches getting free $,” he wrote.

In the face of overwhelming evidence, Kao pleaded guilty in both cases in the fall of 2022. Navatek by then was under court-ordered new management. Awaiting sentencing, Kao worked as a line cook at a Cheesecake Factory.

He began meeting with the same FBI agents and prosecutors who brought him down. For the agents, he was a rare witness: a contractor with deep ties to elected officials saying he would speak candidly about how Washington works.

Kao faced nearly a decade in prison. “My world and life imploded,” he would later recall in a letter to the Hawaii U.S. District Court. “I was fooled and foolish enough to believe that the power elected officials wielded, and [were] actively willing to sell to anyone wealthy enough to pay, was….‘smart business.’”

Over the next two years, Kao sat with agents for at least three dayslong interviews. He told them that politicians, Collins in particular, had been willing participants in his scheme. “It takes two to tangle,” he told them.

Taxpayers funded Navatek’s entire political operation, Kao said. “Most companies of our size do not have the resources to endlessly hire expensive lobbyists and make political donations,” he told the FBI. Navatek solved this by using money from government contracts to hire lobbyists and make campaign contributions, according to interviews, court testimony and internal company records. Diverting money from contracts for lobbying and political donations can be illegal.

For their final meeting, in September 2024, Kao handed the FBI the 50-page document detailing Navatek’s dealings with more than a dozen members of Congress and their staff. It was not only a confession but a road map, with the email addresses and phone numbers of people Kao thought agents ought to subpoena.

Last year, Kao was sentenced to 87 months in prison. The judge in his case offered no leniency based on his cooperation with the FBI. Loui is battling Kao in court to recover the millions he contends Kao stole from the company.

Both Scott Reed and Amy Abbott remain in Collins’ inner circle. Abbott is the finance director for her 2026 reelection effort, and Reed again chairs the main Collins super PAC. Abbott, who is married to Collins’ campaign manager, referred questions to the senator’s communications staff. Clark told ProPublica that Abbott and other campaign staff were interviewed by the FBI and that the campaign was never a target of the investigation.

Earlier this year, Kao agreed to meet a ProPublica reporter at the Federal Prison Camp in Yankton, South Dakota, where he is incarcerated. But on two occasions when guards summoned Kao over the intercom, he refused to enter the visitation room. Over email, he said he was no longer willing to meet, citing the ongoing litigation. He declined through his lawyer to respond to detailed questions.

By late 2024, Ball and Gounaud, the FBI agents, had come to believe there was enough evidence to warrant a broader investigation into bribery of members of Congress, according to a memo seen by ProPublica.

Before they could embark on their new mission, however, they became casualties of Trump’s retribution campaign.

Ball and Gounaud worked for the FBI’s elite anti-corruption unit known as CR-15, which specialized in investigating misconduct by elected officials. When Trump retook power, his new FBI director, Kash Patel, purged the unit agent by agent.

Ball was targeted for her work on the special counsel investigation of Trump’s failed bid to overturn the 2020 election. She was fired in October 2025 in a one-page letter stating she had “weaponized” the Justice Department. She is challenging her firing in a lawsuit. Gounaud was pushed out in early 2026. Both agents declined to comment through their attorney.

Trump also targeted the Justice Department attorneys who worked with CR-15. The team, known as the Public Integrity Section, collapsed spectacularly in February 2025 after staff were ordered to drop a case against New York City Mayor Eric Adams, a Trump ally. The unit’s leadership quit en masse. Trump appointees ordered the remaining prosecutors to halt new corruption cases, just months after Kao made his detailed confession.

Before Ball was fired, however, she managed to take a key step forward.

Based on all the evidence, she persuaded her supervisors to approve a new investigation. It centered on South Carolina, one of the states Navatek eyed for a rapid expansion. The FBI had questions about a steak dinner Kao shared with Sen. Lindsey Graham.

]]>

Space Force braces for stalled progress amid lack of full funding

Lauren C. Williams — Thu, 17 Sep 2026 19:33:19 -0400

NATIONAL HARBOR, Md.—Space Force modernization efforts could slow if Congress doesn’t pass a full budget at the end of the year, the service’s leaders said.

“We're on this ramp-up, right, consistent with our overall strategy and the recognition that the space domain is a critical domain, in and of itself, but also for the joint force,” Erich Hernandez-Baquero, the Space Force’s top buyer, told reporters Tuesday. “Now we're going to run into [fiscal year 2027]—and you saw that our budget request was to continue on that—and this [continuing resolution] is definitely going to put the brakes on that for a time period.”

The Space Force has requested $71.1 billion for 2027, including $19.1 billion for procurement. But with little time remaining before fiscal 2027 begins on Oct. 1, Congress has passed stopgap legislation—a continuing resolution—to keep funding the Pentagon at 2026 levels through Dec. 11. The CR permits no new programs to begin.

“We certainly appreciate at least not being shut down. So…that's a good thing, but on the CR, it really does pace us at a time where we really need to go faster. So we are obviously encouraging Congress to do what they can to help support the president's budget on that,” Hernandez-Baquero said. “In the meantime, we'll just do what we always do: prioritize the things that will yield the most mission capability soonest, and make sure we're executing on those.”

Hernandez-Baquero, who was sworn into the chief space acquisition role last month, declined to specify which priorities could be most affected by a continuing resolution because things were “pre-decision at this point.”

Gen. Doug Schiess, the chief of space operations, said about 10 percent of the service’s programs could be slowed down due continuing resolution.

“About 90 percent of the programs we have are programs from last year—so we can still get after those,” but there’s a remaining 10 percent of programs that require full budget funding, Schiess said. “It's going to slow us down, and the threat is not slowing down.”

Amid a broader push for acquisition reform, Hernandez-Baquero said he’s focused on streamlining and speeding up military purchasing. And when it comes to technology initiatives, there will be a new senior leadership role dedicated to it.

The Air Force’s new program acquisition executives, or PAEs, are “establishing those pathways for onboarding new technology, but I'm just conscious that that by itself is not going to support drawing in the right technologies,” he said. “I want somebody that's focused—100 percent—on looking at the most promising tech and driving the prototyping initiatives that are going to help mature it to the level where a PAE can say, ‘Ah, it meets my criteria for this onboard path, and I can go do that’.”

That person is a technology portfolio executive, who “will have the most promising technology coming out of the [research and development] side, and…will work with industry to ensure that we have the right pathways to do that. Conceptually, there would be prototype efforts that get executed out of that to support the mission areas.”

The technology portfolio executive office already exists but the role hasn’t yet been filled, he said.

“When I designate a TPE, for example, that person is going to report directly to me and represent my authority when it comes to the technology transition,” Hernandez-Baquero said. “I cannot do this without the buy-in of the PAEs that are executing the mission areas, and so my charter to them is going to be not only to deliver on those missionaries, but be part of the enterprise team that's going to deliver on those cross-cutting capabilities.”

]]>

The Pentagon must prepare for battles around the moon: Joint Chiefs chair

Thomas Novelly — Wed, 16 Sep 2026 13:11:23 -0400

NATIONAL HARBOR, Md.— The U.S. military’s top uniformed leader says U.S. forces must be ready for war near or possibly even on the moon, a rhetorical leap that comes as service leaders are still wrestling with the legal frameworks surrounding its newly revealed orbital weapons.

“Our task, my friends, is to adapt right now, so the Joint Force is prepared to fight, endure, and win, in global contested environments, from the seabed to cislunar space,” Joint Chiefs Chairman Gen. Dan Caine told airmen, guardians, and industry figures during his keynote address at the Air, Space, and Cyber Conference.

Caine later repeated the thought—“today’s modern battlefield operates from the seabed to cislunar space”—but he did not clarify whether he meant on the moon’s surface. U.S. law is ambiguous, defining cislunar space as “the region of space from the Earth out to and including the region around the surface of the moon.” At least one Harvard Law Journal article interprets the clause to mean on the moon itself, and the White House’s National Cislunar Science and Technology Action Plan explicitly said in late 2024 that it includes the lunar surface. But the Air Force Research Laboratory’s 2021 “Primer on Cislunar Space” appears to treat space and the moon’s surface as two different domains.

Caine pointed to recent comments made about orbital weapons by the Air Force secretary and the Space Force’s chief of space operations. Top space force officials have been hesitant to provide more details on how they would operate in that domain and how they’d responsibly use space weapons in future conflicts.

While top Space Force officials have provided few details about how U.S. forces would fight between the Earth and its moon, they have been vocal about adding sensors and capabilities to watch adversary movements there. Aaron Brynildson, a space law professor at the University of Mississippi said it’s understandable why the military would want to increase awareness within that region.

“There’s a fear that recent Chinese activity on the moon and in cislunar space might outpace the United States,” Brynildson said. “China has a relay satellite in cislunar space and is performing robotic missions on the far side of the moon.”

The Outer Space Treaty of 1967, which the U.S. signed, outlaws certain military behaviors on the Moon and states that it shall be used “exclusively for peaceful purposes.”

“The establishment of military bases, installations and fortifications, the testing of any type of weapons and the conduct of military manoeuvres on celestial bodies shall be forbidden. The use of military personnel for scientific research or for any other peaceful purposes shall not be prohibited.”

Space Force Lt. Gen. Gregory Gagnon, the head of Combat Forces Command, told reporters during a media roundtable that the 18th and 19th Space Defense Squadrons are now both sharing the cislunar mission among each other.

“Our adversaries, our potential adversaries, such as the PRC, are actively pursuing activities in the cislunar parts of space. So that's sort of the expansion, if you will, of I would say the end zone, if you will, in the football game,” he said.

When asked if the Outer Space Treaty limits the military’s cislunar ambitions, Gagnon said it did not limit orbital operations.

“The United States Space Force will continue to execute safe and responsible space operations in all regions of space and in all orbits,” he said.

Brynildsonn said that while the treaty forbids the creation of military bases on the moon, “The U.S. needs better capabilities in cislunar space to ensure China complies with that obligation and doesn’t militarize the moon. There’s a real coverage gap by the U.S. that needs closing.”

This week’s revelation by Air Force Secretary Troy Meink and Chief of Space Operations Gen. Douglas Schiess that the U.S. has on-orbit space-control weapons has raised legal questions about their responsible use. Experts have speculated that the weapons are likely non-kinetic, such as jammers and electronic warfare capabilities.

When asked whether U.S. policy limits the use of a kinetic space weapon, meaning a destructive capability that would cause debris, Gagnon deferred to policy offices.

“So we have capabilities in the military because we are preparing to defend the nation. The reason we have capabilities is to help create deterrence,” he said. “When you go to war, you break things.”

Brynildson said it’s not clear how current laws limit the use of space weapons.

“It’s unclear what the legal restraints on the use of kinetic or non-kinetic weapons in space might be. The Outer Space Treaty doesn’t give us great answers to what factors a military action must consider,” he said. “The DoD Law of War Manual is also non-committal on the unique aspects of the space domain. At a minimum, general principles from the law of armed conflict would apply, such as only striking military-related satellites, avoiding collateral damage to civilians, etc.”

U.S. lawmakers are also concerned by the lack of space-focused military legal knowledge. A provision inserted by the Senate Armed Service Committee in the 2027 National Defense Authorization Act tasks the Defense Department with assessing its “space law requirements” to face rising threats and examine “options for establishing a dedicated legal organization within the Air Force, Space Force, or Space Command.” The amendment adds that senators are “concerned that current legal, policy, and institutional structures within the Department of Defense may not have kept pace with the complexity of space operations.”

Those clarified legal norms may not emerge until it’s too late.

“Ultimately, I think the first space conflict might be the time when most of these rules get written,” Brynildson said.

]]>

‘It was time’ to admit US has weapons in orbit, Space Force’s new leader says

Thomas Novelly — Tue, 15 Sep 2026 13:58:40 -0400

NATIONAL HARBOR, Maryland—The advance of Chinese and Russian anti-satellite capabilities led the United States to admit it has weapons in space, the Space Force's top officer said on Tuesday, adding context to Monday’s bombshell revelation by the Air Force secretary.

Deterrence remains the Space Force’s goal, but the service will pursue it from a “position of strength,” Gen. Douglas Schiess said during a keynote address at the Air, Space, and Cyber Conference here.

On Monday, Air Force Secretary Troy Meink revealed the U.S. military has “on orbit, space-control weapons.” Schiess, who took over as chief of space operations less than two weeks ago, spoke to reporters after his keynote on Tuesday.

“We've talked about you know them being able to grapple a satellite and move it to a different orbit,” he said. “So, I think at this point, we are trying to say that we also need capabilities to not only defend the joint force from space-enabled attack, but defend our assets. And so, I think it was time that within the Department of War we talked about it, and it's time to talk about that we have the capabilities to make sure that we can do what the joint force needs.”

During his keynote, Schiess said the U.S. military relies on space assets for operations like the current war on Iran, that guardians are already prepared for orbital warfare, and that more money is needed for current and future operations.

“The Joint Force made it clear: without the Space Force's capabilities, the Joint Force could not and would not move forward,” Schiess said. “During Operation Epic Fury, our components, notably at U.S. Central Command and Space Command, with support from our components at European Command and Pacific Command, demonstrated that guardians are not supporting from the sidelines as a nice-to-have, but we are delivering space power directly into the fight as a need-to-have.”

Schiess highlighted one guardian in U.S. Central Command with the 42nd Electronic Warfare Detachment who “waged electromagnetic warfare against a determined adversary” during Operation Epic Fury.

“Even as alarm red sirens were blaring and incoming missiles targeted her site, she courageously held the line, protecting forces, denying adversary capability, and delivering space effects until her commander had to literally pull her from the console to safety,” Schiess said.

The CSO said the Space Force has been flexing its capabilities in outer space as well. He highlighted the service’s recent Victus Haze exercise, in which Rocket Lab quickly launched a space vehicle whose satellite chased after True Anomaly's spacecraft.

“This particular Victus Haze mission earlier this year demonstrated the ability to launch and respond to an on-demand, on-orbit threat in just 17 hours,” the general said. “Space Systems Command, our industry partners, and Combat Forces Command proved to the world that if an adversary targets the United States Space Force, we have the capability to deliver a swift response, and we are going to continue to work on getting faster and faster.”

Schiess said those current and future fights highlight the need for more resources.

“So, looking ahead, we must expand that advantage. We must build a sustained pipeline of guardian talent, equipped with the appropriate training and the kit and advanced capabilities, to ensure our joint force is fully powered by space expertise.” he said. “We must ensure today, tomorrow, and for as long as we have the pleasure to serve, that our joint force can execute because guardians are there, both at home and abroad, and in harm's way.”

Space Force has grown quickly since its founding in 2019, but this year, the Pentagon is asking Congress to allocate $71.3 billion for the service for the fiscal year that began more than two weeks ago. It would be the biggest single-year funding increase for a service branch, by percentage, since 1952, according to the Aerospace Corporation.

“Space is both a battlefield and the backbone of our joint force. We face determined and credible adversaries who are building and building counter-space systems at incredible speeds to target directly the United States state's space advantage,” Schiess said. “So that is why we don't just monitor the domain; we stand ready to defend it. So let me be crystal clear: today, Guardians operate on-orbit weapons that can defend the joint force against space-enabled attacks, and in the coming years, with the resources entrusted to us, by the way, we need your help, Congress-we will make disciplined and responsible choices about how we build and sustain our combat advantage, which means scaling our ability to respond to threats.”

It’s not clear whether Congress will grant the request. The White House wants $1.15 trillion through the normal defense-budget process and an additional $350 billion through reconciliation—a controversial and partisan budget maneuver never used for defense funding before last year. The Trump administration is pressing the GOP-led Congress to relent by proposing to use reconciliation to fund some major Space Force programs, such as the Air Moving Target Indicator and the space data network, and the vast majority of funds for the Golden Dome missile defense program.

In the meantime, 10 percent of the service’s programs are on hold because Congress hasn’t passed a fiscal 2027 defense spending bill, Schiess told reporters. The federal government is currently operating under a stopgap funding measure that will elapse on Dec. 11.

]]>

Iran strikes exposed gaps in medical evacuation ops across Middle East: IG

Patrick Tucker — Tue, 15 Sep 2026 04:43:10 -0400

The military abandoned plans to use Army helicopters to evacuate wounded troops involved in the war with Iran, and instead resorted to slower ground-based evacuations, in part due to the threat of drone strikes, according to a Defense Department Office of the Inspector General report released Monday. The shift illustrates a problem medical officials had warned about for years.

At the start of the operation, the U.S. used Army helicopters in Kuwait and Iraq for medical evacuation, but then moved them due to concerns about Iranian drone and missile strikes.

“Most evacuations during [Operation Epic Fury] were ultimately conducted by ground,” according to the report. In addition to the drone threat, the United States had the additional hurdle of relying on host country hospitals for what’s called “advanced, hospital level care” for particularly severe injuries, since establishing such hospitals on U.S. bases would require a large and more targetable footprint.

The move follows warnings from medical officials that future conflicts would be more dangerous for U.S. troops, as adversaries develop more advanced weapons—particularly drones. A 2022 Army University Press article by Lt. Col. Matthew Marsh and Capt. Ryan Hampton eerily forecasts the situation described in the inspector general report: “Medical personnel will experience intermittent air and ground evacuation with medical logistics constraints,” it reads.

Just as new technology has allowed some adversaries to become more dangerous and inflict higher casualties, other pressures led to cutbacks in medical evacuation capability, particularly in the Middle East. A July 2025 Pulse of Army Medicine article by Sgt. Maj. Sandra Johnson describes how, across U.S. Central Command, “Due to competing requirements, many of these bases only have one medic on post and no medical provider. A medic may have to care for a patient for several hours until they arrive at a local national hospital.”

She noted specifically the problem of “no Medical Evacuation (MEDEVAC) by flight or ground capability, or only ground Casualty Evacuation (CASEVAC) options,” across CENTCOM.

An April U.S. Naval Institute report explains: “Drone warfare [in Ukraine] has disrupted casualty movement from the point of injury throughout the combat casualty continuum of care.”

The IG report acknowledges that CENTCOM officials worked to rapidly develop new plans and strategies when faced with Iranian drone capabilities, moving troops and materiel.. “During OEF, USCENTCOM shifted personnel, assets, and storage facilities as locations came under Iranian and proxy attacks,” it reads.

The report carries a strong recommendation: To find and fix “the gaps in [Department of Defense counter-drone] interoperability, and the corrective actions needed to standardize” those capabilities.

]]>

25 years after 9/11, spy agencies face old lessons and new threats

David DiMolfetta — Fri, 11 Sep 2026 11:00:00 -0400

As Air Force One returned to Washington, D.C., on the night of Sept. 11, 2001, Michael Morell looked out a window and saw an F-16 off the aircraft’s wingtip. Beyond it, the Pentagon was smoldering.

Morell, then-President George W. Bush’s intelligence briefer, had spent the day answering the president’s questions and relaying intelligence as the country tried to understand the attacks that had hit the Pentagon and the World Trade Center in New York City. A quarter-century later, that view from the window remains one of his most vivid memories.

At the National Security Agency, Rick Ledgett recalled colleagues weeping in the hallways as the agency shifted into crisis mode. Within a month, it had transferred 3,000 analysts to counterterrorism work, he said.

“Personally, it was shattering,” Ledgett, who later served as NSA deputy director, told Nextgov/FCW in an email, adding that he “saw people step up and perform in ways they hadn’t before.”

The response to the worst terrorist attack in modern history would transform the government they served. The efforts involved reorganizing intelligence agencies, expanding surveillance powers and drawing spies deeper into a global campaign to capture or kill suspected terrorists. It also produced longstanding debates over torture policies, targeted killings, mass surveillance, prolonged wars, and disputes over presidential power that became inseparable from efforts made to keep Americans safe from another catastrophe.

Twenty-five years later, former officials describe a country better prepared to disrupt terrorist organizations, but facing a broader mix of threats from foreign governments, hackers, and extremists able to reach Americans online.

“I think we’re much safer than we were on September 10, 2001, from the threat of terrorism,” Morell, who later served as CIA deputy director and acting director, told Nextgov/FCW in an interview. But threats from nation-states like China or Russia, he said, are the most significant the country has faced since the Cold War.

The 9/11 Commission — chartered by Congress and the White House in late 2002 to present a full accounting of the attacks and response — described in its final report failures spanning imagination, policy, capabilities and management. Agencies held pieces of information that did not come together, and domestic defenses were not effectively mobilized despite mounting warnings about al Qaeda.

Just over a month before the attacks, Morell briefed Bush on a landmark intelligence report titled “Bin Ladin Determined To Strike in US” that flagged “patterns of suspicious activity in this country” consistent with preparations for hijackings and other attacks. He told Nextgov/FCW it outlined al Qaeda’s intent to attack the country but did not specifically identify when, where or how a specific plot would unfold.

Getting agencies to work together

The transformation that followed 9/11 sought to make cooperation a standing responsibility. Congress created the Office of the Director of National Intelligence in late 2004, establishing a lead unit responsible for integrating intelligence across agencies that collect data from human informants, satellite imagery, intercepted phone calls and other clandestine sources. The Department of Homeland Security was also stood up in late 2002 to drive domestic defense efforts.

The expansion also deepened agencies’ reliance on contractors. After years of workforce drawdowns following the Cold War, the federal government turned to private companies to meet demands for intelligence collection, analysis and technology support, according to a 2015 report from the Congressional Research Service. Today, they play a ubiquitous, outsized role in America’s national security missions.

Lauren Goldman, a former official in ODNI’s Cyber Threat Intelligence Integration Center and National Intelligence Council, recalled a major shift in the basic expectations that governed intelligence-sharing across government and the private sector.

“The burden became on why you shouldn’t share versus why you should share,” she said. That culture has permeated many categories of today’s national security landscape, especially cybersecurity.

ODNI sought to help ensure information reached people who needed it, including officials who might otherwise have been left outside an agency’s reporting channels, Goldman said. Because the office does not collect intelligence itself, it can assess reporting without the same institutional or cultural attachment to a particular collection method, she added.

James Clapper, who served as director of national intelligence for more than six years under the Obama administration, said that coordination requires a “full-time champion.” Under pre-9/11 arrangements, the CIA director also headed the intelligence community, but agency demands often consumed the attention needed for that broader role, he said.

Clapper said the DNI position was created to coordinate intelligence agencies but was not given full authority over them. Entities like the State Department or the Pentagon, for instance, retained control of their own intelligence shops. Still, the DNI could influence their priorities through oversight of intelligence funding and a direct advisory role to the president, he said.

“I do think there’s a need for an overall champion of collaboration and integration,” Clapper told Nextgov/FCW. His remarks come as the Trump administration has sought to shrink ODNI’s workforce and consolidate its functions, on grounds that the office has become bloated and duplicates work performed elsewhere in the intelligence community.

Ledgett credited ODNI with promoting cooperation, as well as running the National Counterterrorism Center and other hubs. But he said it had struggled to take power from individual agencies, particularly the CIA, and secure the president’s attention.

Morell said the CIA knew al Qaeda wanted to attack the United States but failed to uncover the 9/11 plot. He blamed that failure largely on a shortage of resources to gather intelligence, rather than agencies failing to share what they knew. That view differs in emphasis from the commission’s account, which identified missed opportunities to share or act on information.

Clapper said mistaken assessments about Iraq’s weapons of mass destruction programs also reshaped how spy agencies worked. The Bush administration cited those assessments in making its case for its 2003 invasion. Clapper, who had involvement in a key flawed assessment of Iraq’s WMDs, said the failure pushed agencies to scrutinize their sources and challenge assumptions more rigorously. U.S. analysts, in particular, had relied heavily on an Iraqi informant whose claims came through German intelligence, without direct access to question him.

The limits of intelligence powers

Global surveillance became one of the defining disputes of the post-9/11 era. The NSA’s bulk collection of domestic telephone records, exposed in Edward Snowden’s 2013 disclosures, drew scrutiny over both its intrusions into Americans’ lives and its value as a counterterrorism tool.

In 2014, the Privacy and Civil Liberties Oversight Board recommended ending that collection program, and a federal appeals court ruled in 2015 that it exceeded what Congress had authorized under Section 215 of the Patriot Act. But other surveillance programs exposed by Snowden — including those operating under the contentious Section 702 authority — have remained central to U.S. intelligence-gathering.

Ledgett, who led the NSA’s assessment of the damage from Snowden’s disclosures, defended the post-9/11 surveillance effort as “legal and authorized,” though he noted the intelligence community could have done better at public relations.

The incident forever changed how lawmakers and journalists examine spy agencies’ collection activities and whether Americans’ privacy is adequately protected. Contemporary mass surveillance debates have taken on new forms, including spy agencies’ purchases of sensitive data from commercial brokers and police use of artificial intelligence-powered tools to search vast networks of information about people’s movements and activities.

The CIA’s detention, interrogation and torture practices produced another reckoning. The Senate Intelligence Committee’s 2014 investigation concluded that the agency’s coercive interrogation techniques were ineffective in obtaining intelligence or cooperation and that the CIA impeded oversight and misrepresented aspects of the program.

Morell, who has previously disputed the Senate report’s conclusions, argued that responsibility also belonged to the president and other authorizing officials, and he rejected the idea that the agencies had acted entirely on their own.

Asked whether the country went too far in its broader response in the War on Terror, Morell said that “as a nation, we overreacted,” pointing mainly to the Iraq War and the length of the war in Afghanistan.

Intelligence agencies also helped identify and track suspected terrorists for controversial targeted killings, including those carried out through U.S. drone strikes. The debate reached American citizenship itself when the government targeted Anwar al-Awlaki, an American and al Qaeda operative, in a lethal strike. Defending the action in 2013, then-President Barack Obama argued that citizenship could not shield an operative plotting attacks when capture was not feasible.

Today, drones have become a battlefield mainstay in Russia’s war against Ukraine, and Western militaries are studying how to build, deploy and counter them. Weapons that drew scrutiny for their role in U.S. counterterrorism operations are now also held up as examples of military innovation, with NATO learning directly from Ukrainian drone operators. But questions about whom they kill and how they are used persist, as the United Nations documents their growing toll on civilians.

The fight over intelligence powers also became increasingly partisan. President Donald Trump’s disputes with intelligence officials over Russia’s interference in the 2016 election helped fuel his accusations that agencies were being used against him. A bipartisan Senate investigation upheld the intelligence community’s finding that Moscow sought to help him win. But allegations of political “weaponization” became a recurring theme in Trump’s criticism of intelligence and law enforcement agencies.

A changing threat landscape

Intelligence agencies now face a wider range of threats, including foreign hackers with access to fast-evolving AI tools.

Morell said the United States learned how to degrade terrorist organizations by denying them safe havens where they could train, raise money and prepare attacks. But the growing reach of digital networks has created other ways to threaten the U.S. without physically entering it.

Goldman pointed to critical infrastructure, where connected systems can allow the effects of an intrusion to spread beyond a single building or city, as a target of such threats. Hardening airports and other physical targets has value, she said, but does not eliminate vulnerabilities created by that cyber interconnectedness.

State-backed hacking illustrates the stakes. About six years ago, Russian cyber operatives compromised SolarWinds software as part of an espionage campaign that infiltrated multiple federal agencies and some 100 private companies. China-linked Salt Typhoon hackers later penetrated major telecommunications networks, targeting senior officials’ communications and accessing systems used for court-authorized wiretaps. And another Chinese campaign, Volt Typhoon, embedded hackers in American critical infrastructure, with U.S. officials warning that the access could enable disruption during a future conflict.

Terrorist groups have also found new ways to spread propaganda and reach potential recruits online. The Digital Citizens Alliance and cybersecurity firm risk3sixty recently examined 25 piracy-based internet television services and identified terrorist-linked broadcasters on 17 of them. Hezbollah’s Al-Manar satellite television station appeared on all 17, according to their analysis.

Some terrorism-prevention measures have also lapsed. A Sept. 8 Government Accountability Office report found that the 2023 expiration of the Chemical Facility Anti-Terrorism Standards program ended continuous screening of roughly 500,000 people for possible terrorist ties. The program covered about 3,200 high-risk chemical facilities, whose owners cannot independently access federal terrorist watchlist information.

As officials who lived through 9/11 reflect on their time in government, they want the next generation to remember how warnings were missed and what it took to get agencies working together.

Goldman said analysts need to keep questioning their conclusions, examining blind spots and sharing information, despite the demands of daily work. Clapper emphasized the difficulty of persuading policymakers to act on a danger the public has not yet experienced.

Ledgett expressed confidence in those who will take their place.

“Everyone eventually retires, and organizations continue,” he said. “The next generation steps up and delivers when needed.”

The U.S. is skilled at responding once a crisis arrives, but has struggled to prepare before it does, Morell said.

“Becoming a nation, a White House, a Congress, an American people that is proactive in preventing things — preventing bad things — is much better than only being reactive to them,” he said.

]]>

China is trying to steal US AI models' secrets, intel agencies warn

Alexandra Kelley — Tue, 08 Sep 2026 22:00:00 -0400

China is trying to glean the secrets of U.S. artificial-intelligence models by using simpler AI models to query more advanced American ones, national-security and intelligence agencies warned on Tuesday.

In a joint advisory, the National Security Agency, Cybersecurity and Infrastructure Security Agency and Federal Bureau of Investigation said that Chinese companies DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI used “aggressive, malicious, and targeted distillation” tactics to extract billions of tokens from the exchanges within U.S. frontier AI models since 2024, likely with Chinese government awareness.

Distillation is used to reduce the time and money needed to create a new model.

“China-based AI companies route distillation requests through multiple pathways to gain unauthorized access, consequently violating U.S. AI companies’ terms of use,” the advisory said. “These pathways include native application programming interfaces (APIs), remote cloud providers, and third-party aggregators that automatically obfuscate user metadata to avoid detection.”

It said the distillation campaigns targeted variants of Anthropic’s Claude, OpenAI’s ChatGPT, Google’s Gemini, and SpaceXAI’s Grok.

“China-based AI companies deliberately distribute operations across multiple providers, platforms, and pathways to avoid single-point detection,” the advisory said. “They also attempt to distill the best capabilities and proprietary features of each U.S. frontier model to train their China-based AI models. This represents systematic extraction of proprietary functionalities and capabilities threatening U.S. technological leadership.”

The agencies recommended three steps for U.S. AI developers: implement comprehensive detection and mitigation, deploy targeted response changes, and establish cross-organization intelligence sharing.

White House Office of Science and Technology Director Michael Kratsios in July said Chinese distillation efforts — specifically ones by Moonshot AI — have sought to steal proprietary functions from Anthropic’s advanced Fable model. Anthropic made the same accusations in February.

Advocacy groups have also requested the White House take stronger action to keep Chinese companies from importing advanced semiconductor chips.

]]>

July’s breakout at OpenAI was far more complex than initially realized

John Croxton — Fri, 04 Sep 2026 16:10:55 -0400

An AI breakout that made headlines in July was much more sophisticated than previously realized, investigators have found.

Hundreds of OpenAI agents collaborated to break out of their containers, disguising their actions and even sacrificing themselves as they attacked Hugging Face, a widely used open-source code library, according to a recent post from METR, a research nonprofit.

“This incident was orders of magnitude larger and more complex,” than previous instances of AI agents behaving in ways programmers didn’t intend, wrote METR researcher Ajeya Cotra, who co-led the investigation.

The report alarmed experts, who warned that AI-enabled hacks in the future could make the July breakouts involving Anthropic and OpenAI look quaint.

Even if the big AI companies figure out how to make reliable guardrails, their products are generally only a few months ahead of open-weight models, which can be freely downloaded and modified for use.

Nathan Calvin, general counsel at AI advocacy organization Encode AI, wrote on X, "On our current trajectory…a model as capable [as] OpenAI’s internal model that did the [Hugging Face] hack will be widely available guardrail free and cyber criminals will ask it ‘make me money by any means necessary.’”

Calvin added: "And then a truly absurd number of people…are going to get repeatedly hacked." The incident goes far beyond July's instances of AI agents accessing the internet, the METR researchers wrote. Hundreds of agents “developed a way to hack out of their containers and fully replace a part of the system for executing tool calls"—that is, commands to read and write files, access webpages, or perform other digital tasks.

"This allowed them to pretend to issue one tool call while actually running an arbitrary other tool call of their choice.” This meant that the AIs could pretend to run a command to, say, view a webpage, while actually running a totally different command, like deleting an unrelated file.

The researchers wrote that the agents weren’t intending to commit crimes, per se. Rather, they "seemed primarily motivated” to understand how to achieve the highest possible score during an experiment—including spending much of their time trying to fool the scoring mechanism into accepting cheats.

METR’s Cotra wrote, “Another jump like this could put us in very dangerous territory…in many ways we’ve still only scratched the surface of what these agents did and why.”

At Hugging Face, company engineers tried to use OpenAI tools to understand how their security was defeated by the agentic swarm, but were blocked by OpenAI's safeguards against misuse. So they turned to a Chinese open-weight model instead.

“The propensity to compromise infrastructure can drop over 100x when using the production ChatGPT harness and system prompt,” the company said in a statement after the hacks. Hugging Face co-founder and chief science officer Thomas Wolf wrote on X on August 5, “While we can impose these coping solutions at the API/deployment level, it's harder to impose them in advance on all actors using open-source models. Right now open-source models are slightly below the frontier level and have not yet shown any propensity to deceive humans, though.”

AI agents used for hacking could make it difficult for countries to determine who is behind new cyberattacks, because they strip out the stylistic clues investigators use to determine a hacker’s origins. Colin Shea-Blymyer, a research fellow at the Center for Security and Emerging Technology, said, “One of the ways that we can tell who performs an attack is by what tactics they use…like ‘Oh, that’s a classic Russian tactic. Oh, this looks like a tactic that a Chinese [actor] would use.’ If everybody’s using agents…using the same tactics, well, who knows who’s doing what any more?”

“If anonymity remains pretty high, I think it's potentially very destructive to have a lot of these models out there. That said, I'm not sure there's much we can do to stop it,” Shea-Blymyer said.

]]>

The US may lack the engineers to rebuild space assets in a future war: RAND

Thomas Novelly — Wed, 02 Sep 2026 16:52:36 -0400

The defense industry would likely struggle to rebuild the U.S. military’s crucial space capabilities during a war with China or Russia because it will have too few skilled engineers to do the work, according to a new report from RAND.

Today, the country’s space-focused defense companies employ roughly 3 percent of its engineers, and competition for skilled personnel means many jobs go unfilled. If an adversary destroys space-based intelligence, targeting, and communications assets, that shortfall would likely keep the military from getting them back online quickly.

“Modern warfare relies on space-based capabilities; therefore, a key question is how quickly then United States can replace those capabilities during a conflict,” the report said. “Although much attention has focused on making these systems more resilient, far less has examined how fast they can be rebuilt after an attack, especially within 12 to 24 months. China and Russia have shown they can threaten or destroy U.S. space assets, potentially weakening U.S. and allied military operations across many domains. In a prolonged conflict, the ability to restore these capabilities on a short timeline could be critical.”

Various commissions have long warned that U.S. dependence on space could become a vulnerability. In recent years, concerns have arisen over Russian and Chinese nuclear anti-satellite weapons. Rebuilding devastated constellations could require more engineers than the country has available, RAND wrote.

While recent Space Force and White House initiatives aim to turn the tide, it doesn't match the demand the administration is putting on the military space industry and, ultimately, more creative solutions are needed to grow that workforce, the report said.

“Being able to reconstitute after a conflict is absolutely essential, and that's not just business as usual for people who are working in the space industry. That's a massive surge in production,” Alexandra Gerber, the report’s lead author, said in an interview. “Think like World War II, Rosie the Riveter, everybody's on the line, and this is not just you can teach somebody how to work in a factory after one day. The timelines for creating people to work in the space industry are much much longer than that. So, we need to be thinking about what the space workforce might need to look like to support reconstitution during a conflict, 10, 20, 30 years in advance. Not just six months.”

Software development, data analytics, and artificial intelligence will be compete for future engineers, the report said. It can take at least 15 years to develop some of the more highly-skilled, space-focused experts.

RAND researchers found “there are approximately 30,000 job openings per year for technicians and technologists, but only 11,000 individuals are credentialed annually. The space industrial base annual demand is approximately 5,000 of the annual openings (17 percent).” For the 244,000 assembly-related job fields hired for annually, there are only 13,000 people credentialed.

“The space industrial base constitutes about 11,000 (5 percent) of the annual openings for assemblers, and competition for the 13,000 credentialed workers will be fierce,” the report said.

Other major hurdles to growing the talent include security-clearance delays for six months or more, and a limited pool of qualified experts — foreign nationals hold 70 percent of electrical and computer engineering doctorates, making them unavailable from most national security-related work, the report said.

Gerbet told Defense One the workforce isn’t needed just for a possible wartime surge. Last month, the White House released a new space transportation policy which aims to reach “more than 1,000 launches and reentries” by 2030. Building new launch infrastructure to meet that demand requires more skilled workers.

“We're currently at about 200 launches per year in the U.S. And they're talking about timesing that by five, but who are the workers who are going to build all of this infrastructure to support that?,” Gerber said. “Then what happens if there is a conflict on top of that. Then you're talking about a double surge.”

Last week, President Donald Trump announced plans to create a U.S. Space Academy to “educate and train an entire generation of skilled service members, engineers, and civil operators.”

“Think about what the volume throughput of the space academy is likely to be. I mean, you're only talking about what, a couple hundred graduates a year,” Gerber said. “This is not sufficient, right? I mean, that's not really happening at a scale that would impact what we're talking about.”

RAND researchers recommended that the Space Force and Pentagon focus new policy on growing workforce development by funding additional internships and vocational, bachelor's, and advanced degree levels scholarships for science, technology, engineering, and math students, investing in fellowships, and promoting space engineering careers.

Researchers said the Space Force should also “allow Reserve Officers’ Training Corps graduates and specialized program scholars to fulfill service obligations by working in qualifying” space defense firms.

Additionally, researchers said the defense industry should also look to automation as a supplement to those workforce challenges.

“Notably absent from these discussions were mentions of process automation, robotics, or artificial intelligence (AI)–enabled productivity tools as means to reduce the inherent labor intensity of space manufacturing, assembly, integration, and testing,” the report said. “Stakeholders appear to be addressing a structural productivity challenge primarily through volume-based hiring and training strategies and giving little weight to automation as a complementary surge enabler.”

]]>

A Pacific conflict may not look like conventional war, SOCPAC commander says

Jennifer Hlad — Fri, 28 Aug 2026 15:01:51 -0400

HONOLULU—The better the U.S. gets at fighting in conventional ways, the more likely it is that adversaries will avoid a conventional conflict, the head of Special Operations Command Pacific said.

But that doesn’t mean they will avoid a fight altogether, Army Brig. Gen. Michael Rose said at the Indo-Pacific Irregular Warfare Symposium here last week.

“If an adversary believes that a direct military confrontation with the United States or our allies is likely to end badly for them, that doesn’t necessarily make competition disappear. It changes how the adversaries will compete with us. They look for seams. They operate below thresholds. They exploit ambiguity. They use proxies, information, economic coercion, cyber capabilities, maritime forces, and other asymmetric approaches to achieve objectives without presenting us with a conventional fight for which we are preparing. In other words, our conventional superiority can actually increase the incentive for our adversaries to employ irregular warfare,” he said.

So, in a theater where the phrase “deterrence is our highest duty” is nearly as common as aloha shirts at military functions, how should the U.S. approach technology and competition?

“We must be able to outfight and outthink our adversaries,” and taking an irregular warfare approach to autonomy can help, Rose said.

That means moving “beyond autonomous systems towards autonomous campaigning, moving beyond exquisite systems toward distributed networks, moving beyond U.S. capability toward allied and partner ecosystems, moving beyond conventional deterrence to deterrence through resilience and denial, and moving beyond asking how many autonomous systems will help us win a future war, and instead asking how they can help us shape today’s competition.”

In the Indo-Pacific, he said, the “fundamental problem” is scale. The distances are too vast, the number of strategically important locations too numerous for persistent presence. But autonomy “potentially changes that equation.”

But military leaders must not rush to buy cool new tech without first identifying the problem they want to solve, said Maj. Gen. Jeffrey Van Antwerp, who turned over command of SOCPAC to Rose earlier this month and now leads the Army’s 25th Infantry Division.

“You can get caught up in trying to get the better technology, but you haven’t done the fundamental things to be able to leverage that technology well,” Van Antwerp said. “We don’t have the time just to experiment without established objectives.”

Adm. Frank Bradley, who leads U.S. Special Operations Command, outlined the challenge at the start of the symposium: “We face an increasingly weaponized cyber domain, a virtual domain that is transpiring and transmuting across our societies, an increasingly challenged space-based surveillance environment, a contested electromagnetic spectrum, and a rapidly emerging agent-driven artificial intelligence challenge to our security of our digital ecosystems.”

The next day, as the symposium came to a close, deputy INDOPACOM commander Marine Lt. Gen. George Rowell reiterated the trends Paparo believes are reshaping modern conflict. The megatrend that includes all three is “the absolute dominance of information in decision superiority,” he said.

“Our forces must be organized to observe, orient, decide, act, and learn faster than the adversary. Whoever can do that, whoever can adopt that mindset, whoever can adopt those technologies and training fastest will certainly win the day.”

]]>

FBI disables China-linked hacking tools used against US agencies

David DiMolfetta — Wed, 26 Aug 2026 12:28:00 -0400

The FBI seized three internet domains Wednesday that prosecutors say Chinese government-backed hackers used to target U.S. agencies, critical infrastructure and other networks.

The Justice Department attributed the tools, known as QScan and QTRouter, to a hacking group called QTFY. Court records say the group operates through Nanjing Xinjiuwei Network Technology Company, a private Chinese firm that sold hacking services to China’s main civilian intelligence agency and its military.

The group targeted networks belonging to NASA, the Federal Reserve, the National Institutes of Health, the U.S. Senate and the Energy, Justice and Health and Human Services departments, according to an FBI affidavit. Hospitals, telecommunications providers, power companies, banks and defense contractors were also targeted.

The filing does not say that every attempted attack succeeded. A 2019 attempt against NASA, for example, failed because the agency had already fixed the security flaw the hackers tried to exploit.

China’s embassy in Washington, D.C. did not immediately respond to a request for comment. Chinese officials have repeatedly denied Beijing sponsors hacking operations against the United States.

QScan was used to look for weak spots while QTRouter helped the hackers hide. QScan searched the internet for vulnerable systems and tried to break into them. QTRouter sent the hackers’ traffic through hijacked routers and other internet-connected devices, commercial proxy services and rented servers. The setup was meant to make the activity appear to come from somewhere other than China.

QScan carried code for more than 200 different attacks and could work on a massive scale. On one day in 2024, it processed more than 2 million scanning or exploitation tasks, according to the affidavit.

Lumen Technologies, which tracked the same infrastructure for roughly a year, described the operator as an “infrastructure quartermaster” that provided other China-linked hackers with a ready-made service for finding targets and hiding their tracks. Lumen said networks first examined by QScan were later seen communicating through the group’s concealed network, suggesting some operations had moved from scouting targets toward attempts to break in. The system also mixed malicious traffic with that of ordinary internet users, making it harder to spot and block.

“These tools were used by PRC cyber actors to hide the origin of their attacks,” FBI Director Kash Patel said Wednesday.

Investigators said QTFY could take advantage of newly discovered security flaws quickly and at a large scale. In May 2024, the group allegedly exploited a flaw in Check Point security equipment shortly after it became public, stealing server settings and user account information from more than 300 U.S. organizations, according to court documents.

Several months later, the hackers allegedly used a previously unknown flaw in an Ivanti product to access three national laboratories, NIH, another HHS agency and a U.S. security-device manufacturer.

Investigators also tied the group’s infrastructure to attempted attacks against an Ohio medical center during the COVID-19 pandemic, financial organizations in Michigan and South Korea and an insurance organization in Missouri.

The case highlights how Chinese intelligence and military agencies continue to heavily rely on private companies for cyber operations and services.

Wednesday’s announcement follows years of similar FBI operations against Chinese hacking infrastructure. The bureau last year removed PlugX surveillance malware from more than 4,200 U.S. computers infected by another state-backed hacking group.

Federal authorities have also dismantled a network of compromised routers, cameras and other devices associated with Flax Typhoon and disrupted a separate network used by prominent Chinese hacking collective Volt Typhoon to hide attacks against U.S. critical infrastructure.

]]>

Treasury sanctions Iranian hackers tied to critical-infrastructure breaches

David DiMolfetta — Tue, 25 Aug 2026 12:00:00 -0400

The Treasury Department sanctioned five Iranian citizens on Monday over alleged cyberattacks and theft aimed at U.S. critical infrastructure, government offices, and digital assets.

The designations were part of a much broader sanctions package that Treasury Secretary Scott Bessent called an “economic D-Day” aimed at isolating Iran and cutting off its revenue during the ongoing war.

Treasury accused four of the people — Keyvan Fayyaz Ghareh Blagh, Saber Shahbazi Balujeh, Mohammad Reza Kadkhoda’i, and Mojtaba Ghal’eh-Kuhi — of participating in a hacking operation directed by Iran’s Ministry of Intelligence and Security.

Blagh, Balujeh, and Kadkhoda’i allegedly carried out most of the group’s intrusions. Since late 2023, they have breached and stolen data from U.S. energy companies, defense contractors, health care institutions, technology firms and financial institutions, according to the department. The three are believed to have also compromised several local, state, and federal government offices during the summer of 2024.

Treasury officials said Ghal’eh-Kuhi and Behzad Mesri, who was previously sanctioned in 2018, have led the group since at least 2023. The hackers regularly conducted operations for the intelligence ministry, though officials said personal profit also played a role in their activity.

The department separately sanctioned Arman Kahzadian, another alleged member of the network who focused on digital asset theft. Officials said Kahzadian illicitly took control of a cryptocurrency wallet holding more than $30,000 in Bitcoin in 2023.

Other members sometimes turned their attention to targets inside Iran. Ghal’eh-Kuhi and Balujeh allegedly stole data from an Iranian telecommunications company in 2025. Treasury said that activity reflected the hackers’ willingness to put their own financial interests ahead of work benefiting Tehran.

Four of the five people sanctioned Monday were also charged last week in the Justice Department’s expanded case against 17 Iranian cyber actors affiliated with the Mabna Institute. Prosecutors have accused the Tehran-based firm of conducting a sprawling hacking-for-hire campaign for Iran’s Islamic Revolutionary Guard Corps and other Iranian partners. The group allegedly breached universities, government agencies, and companies while stealing more than 31 terabytes of academic research and intellectual property.

The sanctions come amid heightened concern about Iran’s ability to reach vulnerable U.S. infrastructure. CISA and the FBI have recently helped water utilities recover from cyberattacks affecting at least 12 states. Some U.S. officials suspect Iran-linked hackers were responsible, although CISA has not publicly attributed those intrusions.

Federal agencies also warned earlier this year that Iran-aligned groups were targeting industrial control systems used across the energy, water and government sectors.

The cyber sanctions were part of a broader package targeting nearly 60 people, companies and vessels tied to Iran’s nuclear and missile programs, oil trade and hacking operations. The moves block assets under U.S. control and generally prohibit Americans from doing business with those designated. Treasury also expanded sanctions categories to target people and companies operating in Iran’s digital assets, technology, gold, aviation and shipping sectors.

]]>

AI-enabled deception threatens future operations, raises chances of large conflict, says Special Operations leader

Patrick Tucker — Fri, 21 Aug 2026 17:27:00 -0400

HONOLULU — Faster intelligence gathering and analysis enabled by AI is allowing special operators to pull off missions that would have been impossible years ago, U.S. Special Operations Command leader Adm. Frank Bradley, said Wednesday. But malign actors empowered by simple AI tools are undermining military and civilian leaders’ confidence in digital information, he said. That credibility decay, raising doubt about what is and is not true, will affect not just operations but the ability of the United States to “generate that unity of effort” to deter or defend against adversarial attack, he said.

“I have been plagued by my own staff hijinks on the use of artificial intelligence,” he told the Global SOF Foundation’s Indo-Pacific Irregular Warfare Symposium, a meeting of international special operations forces, industry representatives, and some lawmakers. “If you weren't part of the inside crew, you probably couldn't tell the difference because of how capable AI is at creating deepfake content.”

Ongoing Russian and Chinese efforts to deceive Western audiences, both for tactical gain and to influence public sentiment, sometimes called “active measures,” get a boost from AI tools. But those efforts are hardly isolated. Ibrahim Traoré, the leader of a junta currently controlling Burkina Faso, has shown how easy it is for even small-scale dictators to use AI tools to gain control of populations.

“Active measures have eaten the world,” one former State Department intelligence official told Defense One.

More persuasive AI-enabled content, quietly but consistently shaping perceptions about what is happening where, has become the dominant feature of a new critical battleground, Bradley said. “Exposing hostile behavior for exactly what it is—that early credible illumination is a critical advantage…Information advantage leads to decision advantage,” he said.

A U.S. military official who works in counter-intelligence and foreign influence analysis said, “AI has made deception scalable. Even outside of specific campaigns, that will undermine confidence in all intelligence gathering. Every source of information will become increasingly suspect. We’re no longer just fighting phishing emails, we're fighting synthetic voices, cloned faces, and entire fake identities convincing enough to fool the people who know the real person best.”

The former State Department official said the United States, under the new Trump administration, had surrendered critical tools to watch and detect foreign influence just as adversaries were ramping up their ability to conduct influence operations.

“The information environment itself is much less transparent, ironically, than it used to be,” they said, describing how changes in leadership at social media companies had decreased transparency into issues like content moderation and allowing disinformation on the platform.

“The structures that were protecting the domestic environment don't exist anymore. It's not clear who's able to see this,” they said, referring to governmental offices like the Foreign Influence Task Force (FITF) at the FBI, the Foreign Malign Influence Center at the DNI, and various USAID activities and programs.

A secondary effect of those decisions: analysts or intelligence officers not directly working with those entities but who might be tracking foreign influence attacks in some other way will be less likely to raise concerns about what they see.

“The federal bureaucracy is very sensitive to priorities of political leadership, and I think you realize at this point that looking at this stuff is not going to be a career-enhancing move,” they said. “We're in this period now where we are largely flying blind.”

A new playing field

New tools to synthesize intelligence from multiple sources at scale will provide new pathways for getting to the truth faster. That is already enabling faster joint operations of the sort that would not have been possible just a few years ago, Bradley said.

He pointed to the April rescue of a downed F-15 pilot behind enemy lines, “made possible by a tightly synchronized intelligence, cyber-enabled support, and disciplined coordination across multiple elements.” It was the sort of coordination that can only occur when multiple elements can share a common intelligence picture that changes as quickly as real-world conditions, and data that effectively predicts how conditions will change, he said.

An intelligence official described how those new intelligence streams are shaping decisions not just for commanders, but for everyone at once.

“About 10 years ago, [virtual imagery] was just for analysts, or just for the people who had specialties into these things. But now we're bringing 10, 20, 30—I mean, dozens, if not thousands, of different data sources in to build that operator level,” they said. “And it updates every 15 minutes.”

The challenge going forward, Bradley and the intelligence official said, is not just finding new intelligence and data streams, but trusting them—especially in a future information environment where adversarial AI agents are finding new methods to access and alter data and intelligence.

“We're spending a good bit of time and energy right now inside the the Department of War, but across the United States government as well, to ensure that those data sets and that those those systems are are appropriately protected against agentic AI attacks that might, that are coming,” Bradley said.

]]>

DOJ charges 17 Iranians in cybertheft campaign

David DiMolfetta — Wed, 19 Aug 2026 12:13:00 -0400

Federal prosecutors have charged 17 Iranians affiliated with the Tehran-based Mabna Institute over an alleged hacking-for-hire operation that stole research and intellectual property from hundreds of universities and compromised email accounts belonging to U.S. government agencies and companies.

The 14-count superseding indictment, unsealed Tuesday, adds eight defendants to a case brought against nine other members of the firm in 2018. Prosecutors said the expanded charges expose a broader network that conducted cyber intrusions for Iran’s Islamic Revolutionary Guard Corps and other Iranian government and university clients.

The Mabna Institute targeted systems belonging to 144 U.S. universities, 178 universities abroad, at least 42 U.S. companies, 11 foreign companies and at least five federal and state government agencies since around 2013, according to the Justice Department.

The victims included the Labor Department, Federal Energy Regulatory Commission, the states of Hawaii and Indiana, the United Nations and UNICEF. The hackers also allegedly targeted HBO and unnamed technology firms and defense contractors.

Prosecutors said the university campaign targeted more than 100,000 professors’ accounts worldwide and successfully compromised approximately 8,000. The hackers used stolen credentials to access journals, dissertations, electronic books and other research spanning fields ranging from medicine and engineering to the social sciences.

All told, the group allegedly stole at least 31.5 terabytes of academic data and intellectual property. U.S. universities had spent more than $3.4 billion to procure or obtain access to the targeted materials, although prosecutors did not characterize that entire amount as a financial loss from the theft.

Some of the stolen material was later sold to customers in Iran through two websites. One offered academic resources taken from universities, while the other allowed customers to use compromised professors’ accounts to enter university library systems directly, according to the indictment.

Prosecutors said Mabna’s founders established the firm to help Iranian universities and research organizations obtain scientific resources from abroad. It employed or contracted with hackers who carried out phishing attacks, searched for vulnerable systems and traded credentials for compromised accounts.

The defendants face charges that include conspiracy to commit computer intrusions, wire fraud and aggravated identity theft. Some of the offenses carry maximum prison sentences of 20 years. The State Department is separately offering a reward of up to $10 million for information leading to the location of five of the defendants.

The charges come amid concerns about Iran’s use of cyber operations during the ongoing war.

Since U.S. and Israeli strikes began in February, suspected Iran-aligned groups have been linked to a disruptive attack against medical technology company Stryker, the compromise of FBI Director Kash Patel’s personal email and attacks against industrial-control systems across several U.S. sectors.

More than 30 Minnesota water systems and water infrastructure in several other states have been targeted in the last month in activity some officials suspect may be tied to Iran. U.S. officials previously told Nextgov/FCW that they expected Iranian and Iran-aligned cyber operations to continue regardless of whether fighting subsided.

]]>

Iran war reveals protection of space assets on bases has to ‘evolve,’ top general says

Thomas Novelly — Wed, 12 Aug 2026 23:32:57 -0400

HUNTSVILLE, Ala. — Iran’s deliberate targeting of U.S. radar systems during Epic Fury shows that the military has to change the way it protects key space assets on the ground, U.S. Space Command’s leader said.

Iranian drone and missile attacks after the initial U.S.-Israel joint strikes reportedly damaged multiple radar sites. One U.S. Army Space and Missile Defense Command soldier, Army Staff Sgt. Benjamin Pennington, was killed in the March 1 attack on Prince Sultan Air Base in Saudi Arabia. The loss of life and key technology in the war highlight the military’s need to improve the way it protects key space assets, said Gen. Stephen Whiting, the head of U.S. Space Command.

“No doubt, one of the lessons learned out of operations in the Middle East is that if you have fixed infrastructure, it will be targetable, and if your opponents have over-the-horizon fires, whether ballistic missiles or one-way attack drones, you will be at risk,” Whiting told a group of reporters Wednesday at Red Stone Arsenal. “I'm proud of the defense work that we've done, but we have to continue to evolve that, because the threats are rapidly improving as well.”

While Iran was never a substantial threat to U.S. assets in space, they scored major hits from the ground. Whiting, during his last Space and Missile Defense Symposium speech as Space Command’s leader, stressed that adversaries are taking note of how they can harm military operations by targeting space and missile defense targets. That’s only going to grow in future conflicts, the four-star general warned.

“Let’s be blunt and specific. Iran is a medium-size military power—and they’re choosing to fire at space and missile defense targets. When bullets cost so much, you take great care with your aim,” Whiting said during his keynote. “You only shoot at your adversary’s most valuable targets. And right now, they are targeting the forces and capabilities represented in this room.”

Potential changes to U.S. basing patterns in the Middle East will take time and money and are likely to be heavily debated between Congress and the military, Elliot Abrams, an expert at the Council on Foreign Relations, wrote last month.

“The wait will be costly—the longer U.S. troops remain within range of Iranian missiles, the more the United States will pay in readiness, deterrence, and lives,” Abrams wrote.

Defense experts have called for hardening existing structures on bases in the interim. But some military leaders don’t support increased investment in that type of protection.

Gen. Kenneth Wilsbach, the Air Force chief of staff, said in an interview last month: “I don’t want to spend a lot of money on hardening shelters.” He described it as economically inefficient and called for either simpler methods for protecting against drones or increased systems to destroy incoming rounds.

Whiting said the Iran war has shown how the nature of warfare is changing.

“It used to be that the enemy would aim their snipers and sharp shooters at a platoon leader or radio operator,” Whiting said. “Nowadays, our adversaries shoot at the space and missile defense units which are deployed inside their weapons engagement zone.”

]]>

Five things Space Command says it needs to win tomorrow’s wars

Thomas Novelly — Wed, 12 Aug 2026 17:42:53 -0400

HUNTSVILLE, Ala. — Space weapons and refuelable satellites are among the items needed to preserve the U.S. military’s orbital edge over China, the head of U.S. Space Command said.

America’s adversaries are targeting U.S. space assets and rapidly developing their own, Gen. Stephen Whiting told attendees at the Space and Missile Defense Symposium on Wednesday. China, for example, has direct-ascent ASAT missiles, ground-based lasers, jammers, and maneuverable, dual-use satellites, he said.

“These developments intend to degrade our current space superiority and would potentially give

China a maneuver and logistics advantage in space – something we would not accept on the land, at sea, or in the air,” Whiting said.

In the four-star’s final Space and Missile Defense Symposium speech as the leader of the combatant command, Whiting told military and industry audience members that there are five major things on U.S. Space Command’s Integrated Priorities List for 2029 to 2033.

“This isn’t just a wishlist. It’s a clear demand signal to several audiences describing the warfighting capabilities we need to meet our mission,” he said.

1. Integrated space fires: Mirroring Army usage, Whiting has used this term throughout his tenure at Space Command to refer to the offensive and defensive capabilities needed to deter orbiting threats.“

We’re a combatant command and we fight to win wars,” he said. “To win, we need credible, acknowledged, kinetic and non-kinetic fires. They are a key component of how we establish space superiority and restore credible deterrence.”

2. Counter-pLEO tech: Whiting said new technology is needed to counter adversaries’ low-Earth-orbit satellite constellations. As of last month, China has launched 200 G60 and 168 SatNet communications satellites as it builds a pair of “mega constellations...to compete with Western proliferated LEO (pLEO) architectures,” according to a Space Force fact sheet.

“I don't want any U.S. force to be put at risk because somebody else might have a proliferated low-Earth-orbit constellation that could find, fix, track, and target them,” Whiting told reporters after his keynote address.

3. Joint, integrated space command and control: Military leaders often stress the centrality of being able to oversee, organize, and order complex space operations.

“We must enhance machine-to-machine connectivity to support decision-making and battle management of this global space fight on tactically relevant timelines,” Whiting said in his address.

4. Dedicated space domain awareness for space engagements: It’s not just for missile defense, Whiting said: space domain awareness needs to expand and evolve to a whole range of space operations, not just one segment of it.

“We must adopt a ‘target-quality track’ mindset to everything we do in space, just like the missile defense community has done for decades,” he said.

5. Sustained space maneuver: Developing satellites that can be refueled to extend their usefulness remains one of U.S. Space Command key priorities. In March, a Chinese commercial satellite used a flexible robotic arm to “to demonstrate on-orbit servicing, refueling, and debris removal,” according to the Space Force.

“Today, our satellites are limited by the fuel they launch with, which leads to a psychology of scarcity. Husbanding that fuel often overrides desired warfighting maneuvers,” Whiting said. “That must change. We must be able to actively avoid threats and maneuver to gain a position of advantage on our adversaries.”

Whiting has pitched some of these items at past symposiums; in 2024, he said his 2027 Integrated Priorities List was topped by space fires and resilient command and control.

“Our space assets need to shoot, move, and communicate just like the rest of the Joint Force,” Whiting said Wednesday. “In short, space needs to fight like the Joint Force, to empower the Joint Force’s ability to fight and undermine our adversaries’ ability to do so.”

]]>

Local water utilities are under cyber attack. A new group wants to help

David DiMolfetta — Mon, 10 Aug 2026 18:00:00 -0400

LAS VEGAS — As dozens of small water utilities report cyber intrusions—possibly from Iran-linked groups–an industry association and a university are teaming up to help raise their defenses.

The Water Watch Center will provide cyber mitigation support to utilities that serve fewer than 10,000 people—that is, most of the nation’s community water systems. Launched at this year’s DEF CON hacker convention, the initiative is a collaboration of the National Rural Water Association and DEF CON Franklin, a project of the Cyber Policy Initiative at the University of Chicago Harris School of Public Policy.

More than 30 community water systems in Minnesota were targeted late last month, according to state officials. Around 12 states have reported similar activity in recent days, though state officials said they continued to operate safely and that there were no known effects on public health. The FBI and Cybersecurity and Infrastructure Security Agency are working on incident response.

An initial group of five cybersecurity firms will help deliver services to water utilities as part of the initiative.

“These leading cyber firms and NRWA are architecting a scalable cyber delivery model that has eluded water industry and national security officials to date,” Jake Braun, the co-founder of DEF CON Franklin and a former White House acting principal deputy national cyber director, said in a statement.

Paul Nakasone, who led U.S. Cyber Command and the NSA from 2018 to 2024, said at DEF CON this year that water utilities around the country are highly exposed, and he pushed for higher defense standards in the sector.

“These [programmable logic controllers] should not be exposed to the internet,” Nakasone told reporters in a briefing on Friday, referring to the small computers used to operate pumps, valves, and other equipment inside water facilities.

Some U.S. officials believe Iran may be responsible, though there has been no definitive public confirmation.

“I think [the government] is taking a very measured approach to make sure that they have the right actor that’s doing this,” Nakasone said when asked about why Iran hasn’t publicly been linked to the hacks.

“I look at intent. I look at capability. I look at history. I’m not the person that’s making the call on the attribution, but I see an actor here that has certainly shown a history of being able to do this,” he said. “They certainly have the capability, and I think there’s an intent right now — we’re in conflict with Iran.”

]]>

AI agents conspired to hack into networks and steal data during an experiment: study

Patrick Tucker — Mon, 10 Aug 2026 04:39:22 -0400

AI agents from OpenAI and Anthropic autonomously collaborated with one another to deceive humans, share break-in tools, and steal data in a series of independent tests, confirmed by both companies.

On Tuesday, the AI Security Institute published a paper about experiments intended to help understand how AI agents solve cybersecurity challenges. AISI researchers found that agents given access to the internet and allowed to disregard some security features would perform “autonomous, unsanctioned action...targeting real people and organizations.”

Company officials confirmed the findings Thursday.

“AI-orchestrated, fully automated offensive attacks are real now,” OpenAI security official Michael Dalton said during a briefing on the report during the Black Hat cybersecurity conference in Las Vegas.

In one of the tests, the researchers told an OpenAI model to compromise three target networks and recover a token as part of a “capture the flag” exercise.

In response, the model created a series of agents that set up a shared GitHub account so they could efficiently collaborate to build malware. When GitHub suspended the account, the agents set up new accounts on other websites, bypassing CAPTCHA and other security features by searching the web for audio and image samples to “see” and “hear” clues that are meant to be invisible to software programs. The agents exchanged credentials for passwords to access the new sites to continue to build out their attack tool.

It may be time for organizations to adjust how easily they grant access not just to humans, but to anything online, said Morey Haber, chief security advisor at BeyondTrust, a digital identity security firm.

“The technology industry has spent decades designing open models of interoperability. APIs connect everything, identities federate across boundaries, and access gets granted to enhance productivity. The concept of an open security model breaks down completely with agentic AI because of unmanageable risk,” Haber wrote in an Aug. 4 commentary.

In another AISI test, an Anthropic agent pretended to be a human to submit malware to GitHub, where developers routinely trade or post code to help one another. Cybersecurity officials’ warnings about attempts to poison open-source code libraries usually refer to human actors.

What the agent did next shocked AISI reviewers, who described it as “the kind of goal-directed deception that, until recently, had been largely theoretical.”

After submitting the poisoned code, the agent created a different “sock puppet” account to pose as an impartial third-party developer and endorse the contribution. When a reviewer flagged the code submission as likely to contain malware, the agent erased evidence that it had submitted malware, as well as the reviewer comments that it had done so.

In all, AISI ran 122 tests—and found that in 19 of them, agents took “autonomous, unsanctioned action on the live internet, targeting real people and organizations.”

In their report, the researchers note that they conducted the tests in a deliberately “permissive” environment, allowing the agents to access the open internet and even disabling some security features to better “assess what these models can do.” They recommend that “implementing internet access controls would likely have prevented these events.”

Had a gang of human hackers done any of these things—injecting malware, gaining access to data repositories under false pretenses, sharing stolen credentials to access a private network without permission—in a real world setting, they would face criminal prosecution.

But perhaps the most alarming incident mentioned in the paper was one that was not part of the test at all, only briefly mentioned alongside the suggestion on access controls.

In July, OpenAI’s GPT-5.6 Sol broke out of a sandbox, a confined virtual environment, by finding a vulnerability no one knew existed.

Rob Joyce, who once led the NSA’s Tailored Access Operations, told the audience at BlackHat on Thursday that the incident was “arguably the most consequential hack” in nearly three decades.

On Friday, OpenAI officials at Blackhat said they had decided to delay the release of the company’s newest Astra model over cybersecurity concerns.

]]>

US has too few interceptors to deter war with China, experts say

Patrick Tucker — Wed, 05 Aug 2026 21:33:31 -0400

The United States would run out of the interceptors it needs to take down Chinese missiles “within days” of a conflict, according to a new report from the Heritage Foundation. It's the latest in a series of warnings from experts and commanders highlighting a critical gap.

The White House, Congress, and defense contractors have taken steps to address it. But the ongoing war with Iran has exposed those efforts as insufficient, experts say.

It’s not a new problem. A 2023 report from the Center for Strategic and International Studies concluded that the U.S. would “within the first week of a Taiwan conflict” run out of key munitions, such as Patriot Advanced Capability-3 Missile Segment Enhancements, Terminal High Altitude Area Defense interceptors, and SM-6 and SM-3 Standard missiles. In May, CSIS reported that the United States will be in “a window of vulnerability for several years, until inventories return to their previous levels, and another several years before they get to the levels that war planners desire.”

The Trump administration is trying to wring more production out of industry. In January, the White House cut a deal with Lockheed Martin intended to triple annual production of PAC-3 missiles to 2,000. On Monday, the Pentagon announced a related seven-year, $3 billion deal with Lockheed and Northrop Grumman to boost the production of PAC-3 solid rocket motors. The deal is also intended to help “quadruple” annual production of THAAD interceptors.

A Northrop spokesperson said a billion-dollar investment in its Allegany Ballistics Laboratory has enabled the company to double annual production of motors since 2021, and that the company aims to triple production by 2027.

And yet these deals—and the goals the Pentagon set in January—are too small to quickly restore an arsenal depleted by Trump's war on Iran. “Those metrics that were set prior to [Operation Epic Fury]. That was before we just lit off billions of dollars in a decade worth of production per work in some cases,” said Tom Karako, who leads CSIS' Missile Defense Project.

The Heritage report makes its own estimate of weapons expended in the war: “During the first four days of Operation Epic Fury, U.S. and allied forces used approximately 1,738 theater surface-to-air munitions to defend against 565 Iranian ballistic missiles and 57 cruise missiles.”

The report says the Pentagon currently has “less than 10 percent" of the PAC-3 MSE, THAAD, SM-6, and SM-3 interceptors "required to deter or, if necessary, prevail, in a protracted, high-intensity conflict with China.”

The Heritage report is dire, but it may not go far enough, as it does not factor in how China may use low-cost drone warfare to further frustrate U.S. operations in the region.

In an April hearing, U.S. Indo-Pacific Command leader Adm. Sam Paparo also communicated his concerns about missile shortfalls and a lack of solutions for countering cheap drones. “Current production timelines are misaligned with operational expenditures and the threats we face,” Paparo said.

Ukraine's shortage of Patriot interceptor missiles is reducing its ability to fight off Russian ballistic missiles. On July 28, Ukrainian President Volodymyr Zelenskyy met with Lockheed Martin representatives to discuss the possibility of license-building a Ukrainian version of the PAC-3. But such an agreement would not produce usable missiles until 2030.

The White House has gone back and forth on the issue. But Ukraine has gotten further with President Donald Trump than it did with his predecessor, Zelenskyy said in May: “I started this conversation with President Biden and I will continue with President Trump. Ukraine has not received a license to manufacture PAC-3. I believe that in the future, perhaps we will obtain one or there will be our own system.”

]]>

Chinese telecoms kept footholds in US despite crackdowns, probe finds

David DiMolfetta — Tue, 04 Aug 2026 16:00:00 -0400

Years after federal regulators invoked national security to push three Chinese state-owned telecommunications providers out of the American market, the companies never fully left, a new House probe has found.

China Telecom, China Mobile, and China Unicom retained equipment, data-center space and connections to other networks in the United States after the Federal Communications Commission denied or revoked their authority to provide certain telecommunications services, according to a nearly 50-page bipartisan House China Committee investigation planned for release Tuesday and first seen by Nextgov/FCW.

From 2019 to 2022, the FCC denied China Mobile USA’s application to provide international service; it revoked related authorizations held by China Telecom Americas and China Unicom Americas. But those actions did not require the companies to remove equipment, leave data centers, or sever private network links, so the carriers continued offering enterprise networking, internet transit and other services, the panel found.

The committee argues that those remaining footholds could give Beijing’s cyberspies visibility into sensitive traffic, help keep malicious infrastructure online and create opportunities to reroute data or reach U.S. targets. American officials regard China as the country’s leading cyber adversary, with a record of targeting critical infrastructure and stealing military, commercial and personal data.

The three carriers did not respond to detailed requests for comment.

Nextgov/FCW also sought comment from the FBI, the Cybersecurity and Infrastructure Security Agency, and several U.S. spy agencies. The Defense Intelligence Agency, which produces intelligence findings for the Pentagon, declined to comment.

A spokesperson for China’s embassy in Washington said Beijing “firmly opposes the U.S. overstretching the concept of national security and going after Chinese companies,” adding that China would defend its “legitimate and lawful rights and interests.”

The remaining network ties took on added significance in the committee’s review of Salt Typhoon, the sweeping Chinese espionage campaign uncovered in 2024 where hackers breached major telecom carriers in the United States and abroad. The intrusion reached systems used to comply with court-authorized wiretap requests and allowed the cyberspies to target the communications of senior U.S. officials, including President Donald Trump and Vice President JD Vance.

Reviewing routing data from Sept. 22 to 25, 2024, just as the Salt Typhoon campaign became public, the committee identified 58 groups of internet addresses that CISA had linked to Salt Typhoon servers. China Mobile International’s network appeared in routes to those servers at least 192 times, helping keep the attacker infrastructure reachable as U.S. defenders sought to shut it down, the report said.

The committee does not allege that China Mobile USA employees knew about or participated in the campaign, and it says the routing evidence does not definitively link the company to Salt Typhoon. But the panel argues that the overlap shows how China Mobile’s remaining network ties could help sustain malicious infrastructure.

That finding came from a broader analysis that identified nearly 109,000 incidents from January 2018 through May 2025 in which Chinese or Hong Kong-linked networks allegedly claimed U.S. internet addresses without authorization, potentially diverting American traffic through their systems. The committee classified them as high-confidence hijacks of the Border Gateway Protocol, a bedrock system that directs traffic across networks, but acknowledged that some may have resulted from mistakes or poor network management.

More than 4,200 of the incidents involved China Mobile-controlled networks. In September 2024, eight originated from the same network that appeared in routes to Salt Typhoon servers and diverted traffic belonging to unnamed U.S. network operators, the committee said.

Addressing the threat

Telecommunications networks have long been prized intelligence targets because they can expose private conversations and reveal what political and diplomatic leaders are thinking. Such concerns are compounded by China’s 2017 National Intelligence Law, which requires companies and citizens to assist state intelligence work. Beijing denies that the law compels companies to participate in illegal espionage.

“China’s state telecommunications carriers for too long have enjoyed non-reciprocal access to U.S. domestic networks, but the seriousness of Salt Typhoon gives the FCC and other agencies more than enough justification to restrict or expel them,” said James Mulvenon, a leading authority on Chinese national security issues and vice president of intelligence at risk advisory firm Pamir Consulting.

The committee recommends giving federal agencies greater authority over equipment and private network arrangements that remain after a license revocation, along with targeted removal funding, stronger routing protections and logging requirements for foreign-controlled operators.

Marc Rogers, a veteran telecommunications expert who helped develop the mobile internet in the 2000s and has spent roughly two decades consulting governments and companies on telecom cybersecurity, agreed with many of the panel’s recommendations. Those include treating core telecom systems as high-risk targets requiring closer oversight, strengthening checks on how traffic moves across networks and tightening rules on the foreign-made equipment U.S. carriers can use.

But Rogers disputed the panel’s call to expand “rip and replace” telecom equipment, calling such programs economically unrealistic and could disrupt carrier operations.

“On paper it sounds great, until you get someone with operational experience,” Rogers said. “Then they realize you’re basically talking about bulldozing an entire city and building a new one.”

Rogers also said the panel’s recommendations resemble measures in British telecom security law but warned that they would work only if countries act together.

“If only one country takes a strong position, China will just maneuver around them,” he said, adding that the proposals are largely aimed at tactics China has already used. Policymakers should learn from those incidents, Rogers said, while also preparing for how Beijing’s methods may evolve.

The findings underscore the difficulty of removing operators deemed national security risks from a telecommunications ecosystem built on private infrastructure and decades of commercial ties. Regulators can ban specific services without necessarily reaching the equipment, leases and private agreements that preserve connectivity.

The committee based its report on subpoenaed company records, eight interviews conducted under oath, federal records, routing data and network infrastructure scans. It said Cloudflare and unnamed outside cybersecurity experts independently reviewed and verified portions of its routing analysis.

Parent company control and U.S. footprint

Across all three companies, the committee found U.S. subsidiaries that remained dependent on parent or affiliate entities in China or Hong Kong for important technical and operational functions while retaining equipment and network connections inside the United States.

At China Telecom Americas, requests involving connections between U.S. and overseas networks were handled by personnel in Shanghai, Hong Kong or Beijing, according to testimony cited in the report. Service orders could also flow through a parent-controlled system to Shanghai Telecom without a separate contract. The U.S. subsidiary did not keep independent traffic-flow records, leaving employees unable to determine whether a parent or affiliate had changed routes involving equipment in the United States.

China Telecom Americas identified 10 active points of presence — sites where a carrier keeps equipment and connects with other networks — across seven metropolitan areas. A senior engineering official also told the committee that about a quarter of the company’s U.S. transmission hardware was still made by Huawei, whose equipment the FCC has deemed a national security risk.

China Mobile USA, meanwhile, was described by one witness as “basically a sales team,” while another said it had no network engineers. Orders for data center space and network connections were approved at its Hong Kong headquarters, and witnesses could not identify a network operations team based elsewhere.

Despite this, China Mobile USA’s records contained 39 point-of-presence entries across 27 data-center and interconnection facilities. The committee said those sites connected it to carrier backbones, internet exchanges and private networks used by major U.S. technology companies. Investigators identified at least 143 active China Mobile network assets in U.S. facilities.

China Unicom Americas disclosed that seven of its eight directors and two of its three senior managers were Chinese Communist Party members. Its U.S. employees used parent-controlled email and computer systems, and evidence indicated that they operated under cybersecurity, administrative and privacy policies issued by China Unicom Global.

A compliance official told the report’s authors the subsidiary could guarantee its own adherence to U.S. law, but not its parent’s.

A China Unicom Americas compliance official also acknowledged that the subsidiary did not know the identities of some third parties in China that ultimately received services ordered through China Unicom Global. The company had equipment and active connections in roughly 10 U.S. data centers.

Other carrier relations

The report also describes relationships between the three Chinese carriers and companies linked by U.S. authorities to Chinese hacking operations.

China Mobile, in one case, acted as a middleman for CloudRadium, a Hong Kong hosting provider whose infrastructure has repeatedly surfaced in malicious cyber activity, the committee said. Subpoenaed records showed that China Mobile purchased U.S. data center space and network connections on CloudRadium’s behalf, including through a four-year contract valued at $480,000.

The report also links CloudRadium to a Wyoming company of the same name and GlobalData Investments, a California corporation that markets hosting and data center services under the CeraNetworks name. Nextgov/FCW found that the companies’ websites used similar logos, layouts and animations. An email sent to an address listed for Steven Beals, identified online as GlobalData Investments’ chief operating officer, was returned as undeliverable.

The committee also details China Unicom’s relationships with Integrity Technology Group and i-SOON, two Chinese cybersecurity contractors U.S. authorities have linked to state-backed hacking.

A 2024 U.S. advisory identified Integrity Tech infrastructure as the control layer for a botnet of compromised routers and other internet-connected devices operated by Flax Typhoon, a Chinese state-sponsored hacking group. China Unicom Beijing network addresses were used to manage the botnet and connect it to other attack infrastructure and, according to the committee’s report, China Unicom and Integrity Tech formalized a cooperation agreement in November 2023 while the botnet was operating.

China Unicom separately appeared as a corporate partner of i-SOON. The company drew international scrutiny after a large collection of purported internal documents appeared on GitHub in 2024, exposing details about its hacking tools, targets and work for Chinese police and intelligence agencies.

The Justice Department later charged eight i-SOON employees and two Chinese police officers in a years-long hacking campaign, alleging that the company worked with at least 43 intelligence or police bureaus. The charges have not been proven in court.

Integrity Tech’s website was unavailable when Nextgov/FCW attempted to contact the company, and a functioning corporate website for i-SOON could not be located.

“China has been conducting an escalating campaign of cyberattacks on U.S. networks as a form [of] operational preparation of the battlefield,” said Jack Burnham, a senior research analyst in the China Program at the Foundation for Defense of Democracies whose work focuses on China’s military, emerging technologies and science and technology policy.

“Key to these efforts is Beijing’s capacity to access core domestic networks, either via installed equipment, routing relationships, or other interconnections,” Burnham said. “While the FCC has sought to tamp down on Chinese state-owned telecoms firms that pose a national security threat, there is clearly more work to be done, both in terms of regulation and rip-and-replace, to properly handle these threats.”

]]>

OPM breach victims could get identity protection for life

David DiMolfetta — Mon, 03 Aug 2026 09:00:00 -0400

Federal employees and contractors whose sensitive personal data was stolen in the massive Office of Personnel Management breaches disclosed a decade ago would receive identity protection for the rest of their lives under new bicameral legislation.

Senate Intelligence Committee Vice Chair Mark Warner, D-Va., and Del. Eleanor Holmes Norton, D-D.C., plan to introduce the RECOVER PII Act on Monday, aiming to prevent the federal government’s identity-protection program for victims from expiring Sept. 30, according to bill text first seen by Nextgov/FCW. Sens. Tim Kaine, D-Va.; Angela Alsobrooks, D-Md.; and Chris Van Hollen, D-Md., are also Senate cosponsors.

Just over 10 years after the OPM breaches compromised personal information belonging to roughly 22 million people, the identity-protection services provided to affected federal workers, contractors and their families have begun expiring. People who enrolled in OPM’s MyIDCare program are receiving notices that their complimentary coverage will end 10 years after their individual enrollment date. Some notices began arriving late last year and will continue through September, when OPM plans to conclude the services at the end of the federal fiscal year.

“More than ten years after the OPM data breach exposed the personal information of millions of federal employees, the threat remains,” Warner said in the statement. “The data stolen included workers’ most sensitive and personal information — from Social Security numbers to security clearance records — and once that information is in the hands of a bad actor, you don’t get it back.”

The two breaches compromised information belonging to some 22.1 million current, former and prospective federal employees, contractors and others. One intrusion exposed personnel records for roughly 4.2 million people, while a second compromised 21.5 million background-investigation records. About 3.6 million people were affected in both incidents, according to the Government Accountability Office.

Foreign intelligence services can hold onto these OPM records for years, combine them with information from other cyber intrusions and use the fuller picture to identify or target government personnel and their families.

Those risks can also grow over time. Data stolen from a lower-level employee in 2015 could become far more valuable if that person later moves into a more sensitive national security role. GAO warned last year that adversaries can combine publicly available data to identify military personnel and their families or disrupt Defense Department operations.

Congress responded to the breach in a 2017 appropriations law by requiring OPM to provide victims with at least 10 years of complimentary identity protection and no less than $5 million in identity-theft insurance. The new bill would replace that limit with coverage lasting for the remainder of each affected person’s life while retaining the insurance requirement.

“We have a responsibility to stand by the federal workers who were put at risk through no fault of their own,” Warner said. “This legislation will ensure those affected continue to receive the identity protection they need, while helping better safeguard personal information from future exploitation.”

The bill would also allow agencies to reimburse federal employees and contractors for privacy tools and services, such as those that remove or limit their personal information online. Agencies would decide whether to offer the reimbursements, which would not be limited to OPM breach victims and would come from their salary-and-expense budgets.

Norton has introduced legislation in the past seeking lifetime protection for OPM victims, beginning after the breaches were disclosed. Similar bills introduced over the years have not become law.

“Lifetime identity protection is the only solution that will give the workers whose data was compromised the peace of mind they deserve,” Norton said in a statement. “Because there is no limit on how long personal information can be exploited, Congress must protect these federal employees and contractors in perpetuity. Thank you to Senator Warner for working with me to secure this vital protection for those affected.”

]]>